From sebastian.p.lorenz at gmail.com  Wed Apr  1 02:52:25 2015
From: sebastian.p.lorenz at gmail.com (Sebastian Lorenz)
Date: Wed, 1 Apr 2015 08:52:25 +0200
Subject: [keycloak-user] Fwd:  Help troubleshooting config
Message-ID: <CAKNZJdq3xp+6W0yvue0TebC+pWbcnuy-RXXMZDZ6VHN1puyKHA@mail.gmail.com>

Hi Tom,

I'm also quite new to Keycloak and had some trouble setting it up in the
beginning.
That's why I wrote a small tutorial http://sebplorenz.blogspot.de/
Maybe it is of help for you.

Since you are not redirected to Keycloak at all, I would assume that either:

1. Your web resource is not listed in the <security-constraint> element in
web.xml or
2. Your <auth-method> is not set to Keycloak in web.xml or
3. Keycloak is not configured correctly in your standalone.xml server
configuration and therefore does not interrupt the access to the resource.

Good Luck. Sebastian



> ---------- Weitergeleitete Nachricht ----------
> From: Thomas LaPorte <Thomas.LaPorte at dreamworks.com>
> To: keycloak-user at lists.jboss.org
> Cc:
> Date: Tue, 31 Mar 2015 15:05:32 -0700
> Subject: Re: [keycloak-user] Help troubleshooting config
> Thanks to a list member for some debug setup help, I'm getting much more
> information.
>
> Now I can see (and confirm my suspicion), that something is not right and
> my resource is unprotected.
>
> For the example customer-portal app, I see that after the "callback-uri:
> ..." message, I get a "Sending redirect to login page:..." message.
>
> For my app, it goes directly to "AuthenticatedActionsValve.invoke"
>
> -- Tom
>
> On Tue, Mar 31, 2015 at 2:49 PM, Guy Davis <guydavis.ca at gmail.com> wrote:
>
>> Hi Thomas,
>>
>> To dial up logging, try adding this to your standalone.xml file in the
>> logging subsystem and re-starting your Wildfly instance:
>>
>>             <logger category="org.keycloak">
>>                 <level name="DEBUG"/>
>>             </logger>
>>
>> Then, be sure you have the right configuration in your web.xml of your
>> test WAR file.  See the docs here
>> <http://docs.jboss.org/keycloak/docs/1.1.0.Final/userguide/html_single/#d4e786>
>> for details.
>>
>> Hope this helps,
>> Guy
>>
>>
>> On Tue, Mar 31, 2015 at 3:30 PM, Thomas LaPorte <
>> Thomas.LaPorte at dreamworks.com> wrote:
>>
>>> Apologies for cutting off by hitting send prematurely.
>>>
>>>
>>>
>>> On Tue, Mar 31, 2015 at 2:26 PM, Thomas LaPorte <
>>> Thomas.LaPorte at dreamworks.com> wrote:
>>>
>>>> Greetings. I'm a first-time user of Keycloak, trying to set up a simple
>>>> demonstration after the examples, however, I'm having 0% success in getting
>>>> my configuration correct enough such that my web resource is protected.
>>>>
>>>> I have reduced my setup all the way down to a basic "HelloWorld.jsp" in
>>>> a WAR file that is deployed into the standalone Wildfly server that is also
>>>> hosting the Keycloak server.
>>>>
>>>> I am convinced that it is a configuration step being missed somewhere,
>>>> as I can always access my URL without intervention from the Keycloak server.
>>>>
>>>> My WAR file consists of the following:
>>>>
>>>>      0 Tue Mar 31 14:20:20 PDT 2015 META-INF/
>>>>     68 Tue Mar 31 14:20:20 PDT 2015 META-INF/MANIFEST.MF
>>>>      0 Tue Mar 31 14:08:34 PDT 2015 WEB-INF/
>>>>   1584 Tue Mar 31 09:47:52 PDT 2015 WEB-INF/web.xml
>>>>    491 Tue Mar 31 14:08:34 PDT 2015 WEB-INF/keycloak.json
>>>>    308 Tue Mar 31 14:20:18 PDT 2015 index.jsp
>>>>
>>>
>>> I have added my application to the demo realm by copying the
>>> customer-portal application stanza, and replacing the "customer-portal"
>>> with my app name:
>>>
>>>         {
>>>             "name": "goalkeepers",
>>>             "enabled": true,
>>>             "adminUrl": "/goalkeepers",
>>>             "baseUrl": "/goalkeepers",
>>>             "redirectUris": [
>>>                 "/goalkeepers/*"
>>>             ],
>>>             "secret": "password"
>>>         }
>>>
>>> At this stage I am just looking for suggestions on how best to
>>> troubleshoot my configuration? What logging properties can I set to enable
>>> more debugging? Or where else can I look for some clues as to the errors in
>>> my configuration?
>>>
>>> I fear I am missing something extremely fundamental, but I can't for the
>>> life of me see what it is.
>>>
>>> - Tom
>>>
>>> _______________________________________________
>>> keycloak-user mailing list
>>> keycloak-user at lists.jboss.org
>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>
>>
>>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150401/7ef03686/attachment.html 

From stian at redhat.com  Wed Apr  1 02:58:39 2015
From: stian at redhat.com (Stian Thorgersen)
Date: Wed, 1 Apr 2015 02:58:39 -0400 (EDT)
Subject: [keycloak-user] Fwd:  Help troubleshooting config
In-Reply-To: <CAKNZJdq3xp+6W0yvue0TebC+pWbcnuy-RXXMZDZ6VHN1puyKHA@mail.gmail.com>
References: <CAKNZJdq3xp+6W0yvue0TebC+pWbcnuy-RXXMZDZ6VHN1puyKHA@mail.gmail.com>
Message-ID: <1956978098.9763144.1427871519460.JavaMail.zimbra@redhat.com>



----- Original Message -----
> From: "Sebastian Lorenz" <sebastian.p.lorenz at gmail.com>
> To: keycloak-user at lists.jboss.org
> Sent: Wednesday, 1 April, 2015 8:52:25 AM
> Subject: [keycloak-user] Fwd:  Help troubleshooting config
> 
> Hi Tom,
> 
> I'm also quite new to Keycloak and had some trouble setting it up in the
> beginning.
> That's why I wrote a small tutorial http://sebplorenz.blogspot.de/
> Maybe it is of help for you.
> 
> Since you are not redirected to Keycloak at all, I would assume that either:
> 
> 1. Your web resource is not listed in the <security-constraint> element in
> web.xml or

I'd say this is the problem - as 2 and 3 would result in errors not leaving the resource unsecured

> 2. Your <auth-method> is not set to Keycloak in web.xml or
> 3. Keycloak is not configured correctly in your standalone.xml server
> configuration and therefore does not interrupt the access to the resource.
> 
> Good Luck. Sebastian
> 
> 
> 
> ---------- Weitergeleitete Nachricht ----------
> From: Thomas LaPorte < Thomas.LaPorte at dreamworks.com >
> To: keycloak-user at lists.jboss.org
> Cc:
> Date: Tue, 31 Mar 2015 15:05:32 -0700
> Subject: Re: [keycloak-user] Help troubleshooting config
> Thanks to a list member for some debug setup help, I'm getting much more
> information.
> 
> Now I can see (and confirm my suspicion), that something is not right and my
> resource is unprotected.
> 
> For the example customer-portal app, I see that after the "callback-uri: ..."
> message, I get a "Sending redirect to login page:..." message.
> 
> For my app, it goes directly to "AuthenticatedActionsValve.invoke"
> 
> -- Tom
> 
> On Tue, Mar 31, 2015 at 2:49 PM, Guy Davis < guydavis.ca at gmail.com > wrote:
> 
> 
> 
> Hi Thomas,
> 
> To dial up logging, try adding this to your standalone.xml file in the
> logging subsystem and re-starting your Wildfly instance:
> 
> <logger category="org.keycloak">
> <level name="DEBUG"/>
> </logger>
> 
> Then, be sure you have the right configuration in your web.xml of your test
> WAR file. See the docs here for details.
> 
> Hope this helps,
> Guy
> 
> 
> On Tue, Mar 31, 2015 at 3:30 PM, Thomas LaPorte <
> Thomas.LaPorte at dreamworks.com > wrote:
> 
> 
> 
> Apologies for cutting off by hitting send prematurely.
> 
> 
> 
> On Tue, Mar 31, 2015 at 2:26 PM, Thomas LaPorte <
> Thomas.LaPorte at dreamworks.com > wrote:
> 
> 
> 
> Greetings. I'm a first-time user of Keycloak, trying to set up a simple
> demonstration after the examples, however, I'm having 0% success in getting
> my configuration correct enough such that my web resource is protected.
> 
> I have reduced my setup all the way down to a basic "HelloWorld.jsp" in a WAR
> file that is deployed into the standalone Wildfly server that is also
> hosting the Keycloak server.
> 
> I am convinced that it is a configuration step being missed somewhere, as I
> can always access my URL without intervention from the Keycloak server.
> 
> My WAR file consists of the following:
> 
> 0 Tue Mar 31 14:20:20 PDT 2015 META-INF/
> 68 Tue Mar 31 14:20:20 PDT 2015 META-INF/MANIFEST.MF
> 0 Tue Mar 31 14:08:34 PDT 2015 WEB-INF/
> 1584 Tue Mar 31 09:47:52 PDT 2015 WEB-INF/web.xml
> 491 Tue Mar 31 14:08:34 PDT 2015 WEB-INF/keycloak.json
> 308 Tue Mar 31 14:20:18 PDT 2015 index.jsp
> 
> I have added my application to the demo realm by copying the customer-portal
> application stanza, and replacing the "customer-portal" with my app name:
> 
> {
> "name": "goalkeepers",
> "enabled": true,
> "adminUrl": "/goalkeepers",
> "baseUrl": "/goalkeepers",
> "redirectUris": [
> "/goalkeepers/*"
> ],
> "secret": "password"
> }
> At this stage I am just looking for suggestions on how best to troubleshoot
> my configuration? What logging properties can I set to enable more
> debugging? Or where else can I look for some clues as to the errors in my
> configuration?
> 
> I fear I am missing something extremely fundamental, but I can't for the life
> of me see what it is.
> 
> - Tom
> 
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
> 
> 
> 
> 
> 
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From chenkeong.yap at izeno.com  Wed Apr  1 03:14:26 2015
From: chenkeong.yap at izeno.com (Chen Keong Yap)
Date: Wed, 1 Apr 2015 15:14:26 +0800
Subject: [keycloak-user] Application access control by user
Message-ID: <CAC2UnuWPy_TSda7o0zukT+B8RtyJpSSxQhEYBo2Sqf0dwiuYjg@mail.gmail.com>

Hi Guys,

I just wondering can we restrict the application access by user in keycloak?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150401/4d7a77a6/attachment.html 

From stian at redhat.com  Wed Apr  1 03:31:15 2015
From: stian at redhat.com (Stian Thorgersen)
Date: Wed, 1 Apr 2015 03:31:15 -0400 (EDT)
Subject: [keycloak-user] Application access control by user
In-Reply-To: <CAC2UnuWPy_TSda7o0zukT+B8RtyJpSSxQhEYBo2Sqf0dwiuYjg@mail.gmail.com>
References: <CAC2UnuWPy_TSda7o0zukT+B8RtyJpSSxQhEYBo2Sqf0dwiuYjg@mail.gmail.com>
Message-ID: <1596005791.9779136.1427873475679.JavaMail.zimbra@redhat.com>

Yes, you just select what roles a user has permissions to.

----- Original Message -----
> From: "Chen Keong Yap" <chenkeong.yap at izeno.com>
> To: keycloak-user at lists.jboss.org
> Sent: Wednesday, 1 April, 2015 9:14:26 AM
> Subject: [keycloak-user] Application access control by user
> 
> Hi Guys,
> 
> I just wondering can we restrict the application access by user in keycloak?
> 
> 
> 
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From Henk.Laracker at planonsoftware.com  Wed Apr  1 05:52:34 2015
From: Henk.Laracker at planonsoftware.com (Henk Laracker)
Date: Wed, 1 Apr 2015 11:52:34 +0200
Subject: [keycloak-user] keycloak openshift cartridge
In-Reply-To: <D140BE2D.1AE5D%henk.laracker@planonsoftware.com>
References: <D1408457.1AE51%henk.laracker@planonsoftware.com>
	<1253396268.9347081.1427823413622.JavaMail.zimbra@redhat.com>
	<D140BE2D.1AE5D%henk.laracker@planonsoftware.com>
Message-ID: <D1418C17.1AEEA%henk.laracker@planonsoftware.com>

Hi,

We have a local open shift origin installation (v3) what are the
preconditions on the node to install the keycloak cartridge ? Locally I
get the following error:

* Error: Failed to execute: 'control start' for
/var/lib/openshift/551bbdcf740240aa43000004/wildfly
* Starting wildfly cart wildfly process failed to start
* WildFly 8 administrator added. Please make note of these credentials:
Username: adminLBGfqXG Password: P6LkriS1mLWu run 'rhc port-forward
keycloak' to access the web admin area on port 9990.
* Unable to complete the requested operation due to: An invalid exit code
(157) was returned from the server
node-dev-eu-m-atd-00.infra.planoncloud.com. This indicates an unexpected
problem during the execution of your request.. Reference ID:
c9bc685846fcf14554c2dc7251d80949

I think wildfly is missing, do I need to add the cartridge to open shift
or do I need to install it on every node?


Thanks

On 31/03/15 21:33, "Henk Laracker" <Henk.Laracker at planonsoftware.com>
wrote:


>
>On 31/03/15 19:36, "Stian Thorgersen" <stian at redhat.com> wrote:
>
>>
>>
>>----- Original Message -----
>>> From: "Henk Laracker" <Henk.Laracker at planonsoftware.com>
>>> To: keycloak-user at lists.jboss.org
>>> Sent: Tuesday, 31 March, 2015 5:05:27 PM
>>> Subject: [keycloak-user] keycloak openshift cartridge
>>> 
>>> Hi,
>>> 
>>> Can someone explain me the difference between the two openshift
>>>projects in
>>> github.
>>> 
>>> https://github.com/stianst/openshift-keycloak-cartridge/
>>
>>That's my personal fork which I often push snapshots to
>>
>>> 
>>> https://github.com/keycloak/openshift-keycloak-cartridge
>>
>>That's the official one and should be working so please give me some more
>>details about your issues
>
>It is not tagged (branch) for keycloak 1.1, so I don?t now which version I
>install of keycloak when I install the master. I don?t like to install the
>master because the result can change every time.
>The result of installing the master on open shift online is that I first
>get a message:
>
>Application creation is taking longer than expected. Please wait a few
>minutes, then refresh this page.
>
>After that the application is very short visible but automaticly removed
>from openshift.
>
>De second time I try it works
>WildFly 8 administrator added.  Please make note of these credentials:
>
>   Username: ************
>   Password: ************
>   
>   run 'rhc port-forward keycloakmaster' to access the web admin area on
>port 9990.
>
>
>The result : http://keycloakmaster-ciwwa.rhcloud.com/ is working fine (
>this is the first time after several attempts the last days)
>
>Some suggestion, can you add
>
>Mappings:
>    - Frontend: ''
>  Backend: ''
>  Options: { tohttps: '' }
>
>
>This will result in automatically redirection to https.
>
>The next step I will try out is to use the new server, I keep you informed
>if I get again the message "ERROR: failed verification of token?
>
>Keep up the good work!
>
>>
>>> 
>>> I?m curieus about the status, the official keycloak openshift cartridge
>>>does
>>> not show the keycloak interface after deployment, I don?t know what I?m
>>> doing wrong.
>>> The openshift cartridge of stianst is working but I have problems
>>>connecting
>>> to it, it keep getting a ERROR: failed verification of token in my
>>>local
>>> tomcat when trying to use it.
>>> 
>>> 
>>> 
>>> Met vriendelijke groet / Yours sincerely / Mit freundlichen Gr??en /
>>>Tr?s
>>> cordialement,
>>> 
>>> 
>>> 
>>> 
>>> Henk Laracker
>>> 
>>> 
>>> 
>>> _______________________________________________
>>> keycloak-user mailing list
>>> keycloak-user at lists.jboss.org
>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>



From chenkeong.yap at izeno.com  Wed Apr  1 06:14:52 2015
From: chenkeong.yap at izeno.com (Chen Keong Yap)
Date: Wed, 1 Apr 2015 18:14:52 +0800
Subject: [keycloak-user] Application access control by user
In-Reply-To: <1596005791.9779136.1427873475679.JavaMail.zimbra@redhat.com>
References: <CAC2UnuWPy_TSda7o0zukT+B8RtyJpSSxQhEYBo2Sqf0dwiuYjg@mail.gmail.com>
	<1596005791.9779136.1427873475679.JavaMail.zimbra@redhat.com>
Message-ID: <CAC2UnuVUDvN+3UpsnNYpgD1CYA26g0zKkJbh+awFi_GEhBzDNg@mail.gmail.com>

thanks! it's working now.

On Wed, Apr 1, 2015 at 3:31 PM, Stian Thorgersen <stian at redhat.com> wrote:

> Yes, you just select what roles a user has permissions to.
>
> ----- Original Message -----
> > From: "Chen Keong Yap" <chenkeong.yap at izeno.com>
> > To: keycloak-user at lists.jboss.org
> > Sent: Wednesday, 1 April, 2015 9:14:26 AM
> > Subject: [keycloak-user] Application access control by user
> >
> > Hi Guys,
> >
> > I just wondering can we restrict the application access by user in
> keycloak?
> >
> >
> >
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150401/130c0eef/attachment.html 

From chenkeong.yap at izeno.com  Wed Apr  1 06:26:02 2015
From: chenkeong.yap at izeno.com (Chen Keong Yap)
Date: Wed, 1 Apr 2015 18:26:02 +0800
Subject: [keycloak-user] Default Redirect URL is not working
Message-ID: <CAC2UnuXyTmS7Tt=rDBVX5hL9BRWJzq3e=dm28neZyQHACRgRVg@mail.gmail.com>

Hi,

I've configured Default Redirect URL=http://localhost:8080/employee/test.jsp
in keycloak (1.1.0 beta2) admin console. When i access ServiceURL, the
request is redirected to keycloak
login page. After authentication is successful then keycloak redirected to
ServiceURL instead of Default Redirect URL. Can someone please advise?

Picketlink.xml :

<PicketLink xmlns="urn:picketlink:identity-federation:config:2.1">
<PicketLinkSP xmlns="urn:picketlink:identity-federation:config:2.1"
ServerEnvironment="tomcat" BindingType="REDIRECT" RelayState="someURL">
<IdentityURL>${idp.url::
https://localhost:8443/auth/realms/saml-demo-1/protocol/saml}</IdentityURL>
<ServiceURL>${EMPLOYEE.url::http://localhost:8080/employee/}
</ServiceURL>
</PicketLinkSP>
<Handlers xmlns="urn:picketlink:identity-federation:handler:config:2.1">
<Handler
class="org.picketlink.identity.federation.web.handlers.saml2.SAML2LogOutHandler"
/>
<Handler
class="org.picketlink.identity.federation.web.handlers.saml2.SAML2AuthenticationHandler">
</Handler>
<Handler
class="org.picketlink.identity.federation.web.handlers.saml2.RolesGenerationHandler"
/>
</Handlers>
</PicketLink>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150401/e74dcc1c/attachment.html 

From bburke at redhat.com  Wed Apr  1 08:16:48 2015
From: bburke at redhat.com (Bill Burke)
Date: Wed, 01 Apr 2015 08:16:48 -0400
Subject: [keycloak-user] Default Redirect URL is not working
In-Reply-To: <CAC2UnuXyTmS7Tt=rDBVX5hL9BRWJzq3e=dm28neZyQHACRgRVg@mail.gmail.com>
References: <CAC2UnuXyTmS7Tt=rDBVX5hL9BRWJzq3e=dm28neZyQHACRgRVg@mail.gmail.com>
Message-ID: <551BE1B0.10408@redhat.com>

Default URL is for when no redirect URL is provided to Keycloak at 
login.  For SAML, you have to be redirected back to the service URL or 
login won't complete successfully.

On 4/1/2015 6:26 AM, Chen Keong Yap wrote:
> Hi,
>
> I've configured Default Redirect
> URL=http://localhost:8080/employee/test.jsp in keycloak (1.1.0 beta2)
> admin console. When i access ServiceURL, the request is redirected to
> keycloak
> login page. After authentication is successful then keycloak redirected
> to ServiceURL instead of Default Redirect URL. Can someone please advise?
>
> Picketlink.xml :
>
> <PicketLink xmlns="urn:picketlink:identity-federation:config:2.1">
> <PicketLinkSP xmlns="urn:picketlink:identity-federation:config:2.1"
> ServerEnvironment="tomcat" BindingType="REDIRECT" RelayState="someURL">
> <IdentityURL>${idp.url::https://localhost:8443/auth/realms/saml-demo-1/protocol/saml}</IdentityURL>
> <ServiceURL>${EMPLOYEE.url::http://localhost:8080/employee/}
> </ServiceURL>
> </PicketLinkSP>
> <Handlers xmlns="urn:picketlink:identity-federation:handler:config:2.1">
> <Handler
> class="org.picketlink.identity.federation.web.handlers.saml2.SAML2LogOutHandler"
> />
> <Handler
> class="org.picketlink.identity.federation.web.handlers.saml2.SAML2AuthenticationHandler">
> </Handler>
> <Handler
> class="org.picketlink.identity.federation.web.handlers.saml2.RolesGenerationHandler"
> />
> </Handlers>
> </PicketLink>
>
>
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

-- 
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com

From Tom.Nuernberger at tceq.texas.gov  Wed Apr  1 13:28:39 2015
From: Tom.Nuernberger at tceq.texas.gov (Tom Nuernberger)
Date: Wed, 1 Apr 2015 17:28:39 +0000
Subject: [keycloak-user] Is there an example Oracle Configuration for
	Keycloak
Message-ID: <BLUPR0501MB105902233BBFC17F48ED2F7FC3F30@BLUPR0501MB1059.namprd05.prod.outlook.com>

Can anyone point me to some example Oracle configuration ?

Thanks.

Tom W. Nuernberger
Programmer Analyst IV
Texas Commission on Environmental Equality
12100 Park 35 Circle | Bldg. A | Austin, TX 78753
(512) 239-0895
[cid:image001.jpg at 01D06C77.5FEAB630]

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150401/a6fd3c36/attachment.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.jpg
Type: image/jpeg
Size: 2402 bytes
Desc: image001.jpg
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20150401/a6fd3c36/attachment.jpg 

From stian at redhat.com  Wed Apr  1 13:31:01 2015
From: stian at redhat.com (Stian Thorgersen)
Date: Wed, 1 Apr 2015 13:31:01 -0400 (EDT)
Subject: [keycloak-user] Is there an example Oracle Configuration
	for	Keycloak
In-Reply-To: <BLUPR0501MB105902233BBFC17F48ED2F7FC3F30@BLUPR0501MB1059.namprd05.prod.outlook.com>
References: <BLUPR0501MB105902233BBFC17F48ED2F7FC3F30@BLUPR0501MB1059.namprd05.prod.outlook.com>
Message-ID: <1298505730.10275962.1427909461321.JavaMail.zimbra@redhat.com>

Google "WildFly oracle datasource" and you'll find it ;)

----- Original Message -----
> From: "Tom Nuernberger" <Tom.Nuernberger at tceq.texas.gov>
> To: keycloak-user at lists.jboss.org
> Sent: Wednesday, 1 April, 2015 7:28:39 PM
> Subject: [keycloak-user] Is there an example Oracle Configuration for	Keycloak
> 
> 
> 
> Can anyone point me to some example Oracle configuration ?
> 
> 
> 
> Thanks.
> 
> 
> 
> Tom W. Nuernberger
> 
> Programmer Analyst IV
> 
> Texas Commission on Environmental Equality
> 
> 12100 Park 35 Circle | Bldg. A | Austin, TX 78753
> 
> (512) 239-0895
> 
> 
> 
> 
> 
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From thiago.addevico at gmail.com  Wed Apr  1 13:33:26 2015
From: thiago.addevico at gmail.com (Thiago Presa)
Date: Wed, 1 Apr 2015 14:33:26 -0300
Subject: [keycloak-user] Application Management
In-Reply-To: <1915332308.6796315.1427464264502.JavaMail.zimbra@redhat.com>
References: <CAHDpToU94_F930cgJjNFtWe7wyEuJx_cHo1+bGL0enaUNAJxNw@mail.gmail.com>
	<235824875.3863019.1427201098648.JavaMail.zimbra@redhat.com>
	<CAHDpToUsdDRdHo2pPBaQTVSZuKy7ewEC1SREK0x0wLDX=pnxgQ@mail.gmail.com>
	<CAHDpToUx-k3FyXc2QVY_AwG3UjwCzrUdr=7KxzdUzshx_BpvaQ@mail.gmail.com>
	<596874598.6524658.1427432321791.JavaMail.zimbra@redhat.com>
	<CAHDpToX0-FbxM_QmHHtDRjNa+A5Fs4+msnR_=U0u-Ug6Ktiyow@mail.gmail.com>
	<1915332308.6796315.1427464264502.JavaMail.zimbra@redhat.com>
Message-ID: <CAHDpToXP5P==Qm7bHa=Fwa9QmFihVjtkDh9EuvozXN+fG9JTWw@mail.gmail.com>

Speaking with my colleagues, I believe it won't cause troubles for us. We
had to give view-applications: the admin console wouldn't work properly,
but this is also OK according to our requirements.

Would you mind giving us some feedback on [1]? We wrote this to experiment
a bit with the proposal, but I'm not familiar with keycloak's source or
practices. What should I do to help get this merged?

[1] https://github.com/keycloak/keycloak/compare/master...tpresa:master

On Fri, Mar 27, 2015 at 10:51 AM, Stian Thorgersen <stian at redhat.com> wrote:

>
>
> ----- Original Message -----
> > From: "Thiago Presa" <thiago.addevico at gmail.com>
> > To: "Stian Thorgersen" <stian at redhat.com>
> > Cc: keycloak-user at lists.jboss.org
> > Sent: Friday, 27 March, 2015 2:01:56 PM
> > Subject: Re: [keycloak-user] Application Management
> >
> > Ah, yes, I didn't understand your proposal properly. Wouldn't giving
> > manage-users to app-admins wouldn't cause trouble, since app-admins could
> > create and modify user accounts?
>
> Whether or not it's causing trouble depends on your requirements, but yes,
> they could create and modify user accounts, but not grant more privileges.
>
> If you need to go beyond this one alternative is to wrap the admin
> endpoints in your own application. We've just got so much on our plate at
> the moment that we can't provide this level of control on permissions.
>
> >
> > On Fri, Mar 27, 2015 at 1:58 AM, Stian Thorgersen <stian at redhat.com>
> wrote:
> >
> > > Well, yes.. I told you it was a bit rubbish and would need some
> re-design
> > > to implement more fine grained permissions. Doing that is a relatively
> big
> > > task and is not a high priority for us ATM.
> > >
> > > I'm a bit confused by this email as I proposed a simple solution that
> > > would resolve your requirements. If an admin can only grant permissions
> > > that admin has access to all you have to do is to create an admin that
> can
> > > only access roles for certain applications and your problem should be
> > > solved. That's a simple solution that we can add soon.
> > >
> > > ----- Original Message -----
> > > > From: "Thiago Presa" <thiago.addevico at gmail.com>
> > > > To: "Stian Thorgersen" <stian at redhat.com>
> > > > Cc: keycloak-user at lists.jboss.org
> > > > Sent: Thursday, 26 March, 2015 8:10:07 PM
> > > > Subject: Re: [keycloak-user] Application Management
> > > >
> > > > So I've spent the last couple of days playing with the source. :-)
> > > >
> > > > The current authorization mechanism is based on Realm/RealmApp i.e.
> > > > whenever an API resource is called, check if the User has the
> required
> > > > Right (manage, any, view) in the resource's Realm/RealmApp.
> > > >
> > > > Consider, for example, the URI
> > > >
> /admin/realms/{realm}/applications-by-id/{app-name}/roles/{role-name}.
> > > What
> > > > I was trying to do is to create a permission for {app-name} so that
> this
> > > > API call wouldn't require any Realm/RealmApp right.
> > > >
> > > > The problem I see is that this API call trigger many methods (i.e.
> > > > AdminRoot#getRealmsAdmin, RealmsAdminResource#getRealmAdmin,
> > > > RealmAdminResource#getApplicationsById, and so on...), and at those
> > > methods
> > > > there is not enough information to figure out whether this is:
> > > >
> > > > 1- An app-specific call and thus should be authorized even without
> realm
> > > > authorization, or;
> > > > 2- Not app-specific call and this should be properly authorized by
> > > > Realm/RealmApp.
> > > >
> > > > Even in the case of (1), the information on which app should I check
> for
> > > > authorization is not available.
> > > >
> > > > So it seems to me that this resource-loading mechanisms pressuposes
> an
> > > > authorization mechanism that checks only against the realm for
> > > permission,
> > > > and changing this seems daunting to me.
> > > >
> > > > Do you guys have any idea on a more local change I could make to
> achieve
> > > > the intended behavior?
> > > >
> > > > On Tue, Mar 24, 2015 at 2:33 PM, Thiago Presa <
> thiago.addevico at gmail.com
> > > >
> > > > wrote:
> > > >
> > > > > OK, agreed. We thought this out of consistency, but if that's not a
> > > good
> > > > > design we surely can consider a better one.
> > > > >
> > > > > On Tue, Mar 24, 2015 at 9:44 AM, Stian Thorgersen <
> stian at redhat.com>
> > > > > wrote:
> > > > >
> > > > >>
> > > > >>
> > > > >> ----- Original Message -----
> > > > >> > From: "Thiago Presa" <thiago.addevico at gmail.com>
> > > > >> > To: stian at redhat.com
> > > > >> > Cc: keycloak-user at lists.jboss.org
> > > > >> > Sent: Tuesday, 24 March, 2015 1:41:16 PM
> > > > >> > Subject: Re: [keycloak-user] Application Management
> > > > >> >
> > > > >> > Hi there,
> > > > >> >
> > > > >> > I'm Alex's coworker and I'll be working on this too.
> > > > >> >
> > > > >> > We were just discussing your idea, and it seems to fit our
> > > requirements.
> > > > >> >
> > > > >> > As far as we have seen, keycloak already has a realm-admin
> concept.
> > > > >> > Whenever a realm "R" is created, it creates a R-realm
> application
> > > with
> > > > >> > a bunch of default roles (manage-users, manage-roles, etc.)
> into the
> > > > >> > realm master.
> > > > >> >
> > > > >> > We are currently thinking if we could mimic this structure for
> > > > >> > applications. What do you think?
> > > > >>
> > > > >> It's already messy with the way I modelled it and adding the same
> for
> > > > >> applications would be even worse. I don't see why that's needed
> > > though if
> > > > >> we'd add what I proposed.
> > > > >>
> > > > >> >
> > > > >> > > I had an idea a while back that is a simple way to achieve
> what
> > > you're
> > > > >> > > asking for. Th> e idea would be to only allow an admin to
> grant
> > > roles
> > > > >> that
> > > > >> > > the admin has access to.
> > > > >> >
> > > > >> > > Basically:> * A user with admin (super user) role can grant
> any
> > > roles
> > > > >> (we
> > > > >> > > would need to add a per-> realm super user role)
> > > > >> >
> > > > >> > > * A user with the role manage-users and some roles on app1 can
> > > only
> > > > >> grant
> > > > >> > > other users > the roles on app1
> > > > >> >
> > > > >> > > * A user with the role manage-users and some roles on app2 can
> > > only
> > > > >> grant
> > > > >> > > other users > the roles on app2
> > > > >> >
> > > > >> > >
> > > > >> >
> > > > >> > > This is something we should add in either case (to prevent
> users
> > > > >> granting
> > > > >> > themselves more access). Would it solve your problems?
> > > > >> >
> > > > >>
> > > > >
> > > > >
> > > >
> > >
> >
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150401/8f964f28/attachment-0001.html 

From Thomas.LaPorte at dreamworks.com  Wed Apr  1 18:58:23 2015
From: Thomas.LaPorte at dreamworks.com (Thomas LaPorte)
Date: Wed, 1 Apr 2015 15:58:23 -0700
Subject: [keycloak-user] Fwd: Help troubleshooting config
In-Reply-To: <1956978098.9763144.1427871519460.JavaMail.zimbra@redhat.com>
References: <CAKNZJdq3xp+6W0yvue0TebC+pWbcnuy-RXXMZDZ6VHN1puyKHA@mail.gmail.com>
	<1956978098.9763144.1427871519460.JavaMail.zimbra@redhat.com>
Message-ID: <CAN-f4SPdRypwDZYr-v1uW8HVt4EbR5njnAXcy+WSPgAJ2zk79Q@mail.gmail.com>

Thank you both, very much!

Pointing me at the web.xml was the final piece I needed. I spent some more
time trying to understand the bits and bobs in that file and finally
understood the URL paths of my sample app, and how they were (or were not,
in my case) being reflected in the web.xml.

I was even able to move my working configuration to a Tomcat server and
replicate my success there. Many thanks!!

On Tue, Mar 31, 2015 at 11:58 PM, Stian Thorgersen <stian at redhat.com> wrote:

>
>
> ----- Original Message -----
> > From: "Sebastian Lorenz" <sebastian.p.lorenz at gmail.com>
> > To: keycloak-user at lists.jboss.org
> > Sent: Wednesday, 1 April, 2015 8:52:25 AM
> > Subject: [keycloak-user] Fwd:  Help troubleshooting config
> >
> > Hi Tom,
> >
> > I'm also quite new to Keycloak and had some trouble setting it up in the
> > beginning.
> > That's why I wrote a small tutorial http://sebplorenz.blogspot.de/
> > Maybe it is of help for you.
> >
> > Since you are not redirected to Keycloak at all, I would assume that
> either:
> >
> > 1. Your web resource is not listed in the <security-constraint> element
> in
> > web.xml or
>
> I'd say this is the problem - as 2 and 3 would result in errors not
> leaving the resource unsecured
>
> > 2. Your <auth-method> is not set to Keycloak in web.xml or
> > 3. Keycloak is not configured correctly in your standalone.xml server
> > configuration and therefore does not interrupt the access to the
> resource.
> >
> > Good Luck. Sebastian
> >
> >
> >
> > ---------- Weitergeleitete Nachricht ----------
> > From: Thomas LaPorte < Thomas.LaPorte at dreamworks.com >
> > To: keycloak-user at lists.jboss.org
> > Cc:
> > Date: Tue, 31 Mar 2015 15:05:32 -0700
> > Subject: Re: [keycloak-user] Help troubleshooting config
> > Thanks to a list member for some debug setup help, I'm getting much more
> > information.
> >
> > Now I can see (and confirm my suspicion), that something is not right
> and my
> > resource is unprotected.
> >
> > For the example customer-portal app, I see that after the "callback-uri:
> ..."
> > message, I get a "Sending redirect to login page:..." message.
> >
> > For my app, it goes directly to "AuthenticatedActionsValve.invoke"
> >
> > -- Tom
> >
> > On Tue, Mar 31, 2015 at 2:49 PM, Guy Davis < guydavis.ca at gmail.com >
> wrote:
> >
> >
> >
> > Hi Thomas,
> >
> > To dial up logging, try adding this to your standalone.xml file in the
> > logging subsystem and re-starting your Wildfly instance:
> >
> > <logger category="org.keycloak">
> > <level name="DEBUG"/>
> > </logger>
> >
> > Then, be sure you have the right configuration in your web.xml of your
> test
> > WAR file. See the docs here for details.
> >
> > Hope this helps,
> > Guy
> >
> >
> > On Tue, Mar 31, 2015 at 3:30 PM, Thomas LaPorte <
> > Thomas.LaPorte at dreamworks.com > wrote:
> >
> >
> >
> > Apologies for cutting off by hitting send prematurely.
> >
> >
> >
> > On Tue, Mar 31, 2015 at 2:26 PM, Thomas LaPorte <
> > Thomas.LaPorte at dreamworks.com > wrote:
> >
> >
> >
> > Greetings. I'm a first-time user of Keycloak, trying to set up a simple
> > demonstration after the examples, however, I'm having 0% success in
> getting
> > my configuration correct enough such that my web resource is protected.
> >
> > I have reduced my setup all the way down to a basic "HelloWorld.jsp" in
> a WAR
> > file that is deployed into the standalone Wildfly server that is also
> > hosting the Keycloak server.
> >
> > I am convinced that it is a configuration step being missed somewhere,
> as I
> > can always access my URL without intervention from the Keycloak server.
> >
> > My WAR file consists of the following:
> >
> > 0 Tue Mar 31 14:20:20 PDT 2015 META-INF/
> > 68 Tue Mar 31 14:20:20 PDT 2015 META-INF/MANIFEST.MF
> > 0 Tue Mar 31 14:08:34 PDT 2015 WEB-INF/
> > 1584 Tue Mar 31 09:47:52 PDT 2015 WEB-INF/web.xml
> > 491 Tue Mar 31 14:08:34 PDT 2015 WEB-INF/keycloak.json
> > 308 Tue Mar 31 14:20:18 PDT 2015 index.jsp
> >
> > I have added my application to the demo realm by copying the
> customer-portal
> > application stanza, and replacing the "customer-portal" with my app name:
> >
> > {
> > "name": "goalkeepers",
> > "enabled": true,
> > "adminUrl": "/goalkeepers",
> > "baseUrl": "/goalkeepers",
> > "redirectUris": [
> > "/goalkeepers/*"
> > ],
> > "secret": "password"
> > }
> > At this stage I am just looking for suggestions on how best to
> troubleshoot
> > my configuration? What logging properties can I set to enable more
> > debugging? Or where else can I look for some clues as to the errors in my
> > configuration?
> >
> > I fear I am missing something extremely fundamental, but I can't for the
> life
> > of me see what it is.
> >
> > - Tom
> >
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
> >
> >
> >
> >
> >
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150401/99bb217a/attachment.html 

From srossillo at smartling.com  Wed Apr  1 19:37:23 2015
From: srossillo at smartling.com (Scott Rossillo)
Date: Wed, 1 Apr 2015 19:37:23 -0400
Subject: [keycloak-user] CatalinaUserSessionManagement: Session not present
	or already invalidated
Message-ID: <CALAqdu8UmKN7aqQHDkNH1uAAyhTv02gD-8sv5MjoTebt0m-FrQ@mail.gmail.com>

Hi all,

I?m running Keycloak 1.1.0-Final in standalone mode and using Keycloak
agents on Tomcat 6 and Tomcat 8.

With both agents, whenever I try to log a user out via the Keycloak server,
I see this in the Tomcat server?s log:

Apr 01, 2015 7:27:47 PM
org.keycloak.adapters.tomcat.CatalinaUserSessionManagement logoutSession
WARN: Session not present or already invalidated.

The session is still valid and continues to be valid for some period of
time in each of the Tomcat instances. Anyone know how to fix?

I was looking at the source and I see this method:

   -


   - org.keycloak.adapters.tomcat.CatalinaUserSessionManagement.

logoutSession()

I may test loging the actual exception tomorrow if no one has a clue, but I
think it?s probably the exception is being thrown for some reason other
than the session no longer existing (it definitely still does).

Best,
Scott
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150401/cf536830/attachment.html 

From stian at redhat.com  Thu Apr  2 08:38:51 2015
From: stian at redhat.com (Stian Thorgersen)
Date: Thu, 2 Apr 2015 08:38:51 -0400 (EDT)
Subject: [keycloak-user] Keycloak 1.2.0.Beta1 Released
In-Reply-To: <1943269927.10938403.1427978311541.JavaMail.zimbra@redhat.com>
Message-ID: <1466648129.10938551.1427978331196.JavaMail.zimbra@redhat.com>

We're proud to announce the release of Keycloak 1.2.0.Beta1. This is a great release, especially if you're after enterprise capabilities.

The major new features in this release includes:

* Protocol mapping - With protocol mapping it's easy to define what claims are added to the token an application receives.
* Kerberos - It's now possible to authenticate with a Keycloak realm using Kerberos tickets through SPNEGO.
* Identity Brokering - As well as Kerberos you can also authenticate with Keycloak with an external SAML 2.0 or OpenID Connect Identity Provider.
* OpenID Connect improvements - We've made several improvements to comply with the OpenID Connect specification and we've also introduced new features such as Discovery, Session Management and UserInfo endpoint.
* Internationalization support for login and account management Thanks to Michael Gerber the login and account management pages now have internationalization support. We have built in support for English, German and Brazilian Portuguese. We've also made it easy to add your own and if you'd like to contribute a translation let us know.
* Deploy providers as modules - It's now possible to deploy custom providers as modules. This gives you full control of the classloader for your provider.
* Deploy themes as modules - We've made it much simpler to package themes and they can also be deployed as a module. This makes it simpler to distribute themes as well as using custom themes in a cluster.
* Login with Stackoverflow and LinkedIn - Thanks to Vlastimil Eli?? we now have built-in support to login with Stackoverflow and LinkedIn.
* SysLog event listener - Thanks to Giriraj Sharma we now have a syslog event listener.
* Version control on cached resources - A common issue in the past was that the admin console didn't work after upgrading Keycloak. This was caused by the browser caching old html and javascript. We've solved this issue by including a version number in the resource urls, so upgrading should be even simpler now!

To get the release go to www.keycloak.org. For the full lists of issues resolved for this release check https://issues.jboss.org/browse/KEYCLOAK.

Remember to read the migration guide before upgrading as it contains vital information about what's changed and how to upgrade.


From mposolda at redhat.com  Thu Apr  2 10:23:55 2015
From: mposolda at redhat.com (Marek Posolda)
Date: Thu, 02 Apr 2015 16:23:55 +0200
Subject: [keycloak-user] CatalinaUserSessionManagement: Session not
 present or already invalidated
In-Reply-To: <CALAqdu8UmKN7aqQHDkNH1uAAyhTv02gD-8sv5MjoTebt0m-FrQ@mail.gmail.com>
References: <CALAqdu8UmKN7aqQHDkNH1uAAyhTv02gD-8sv5MjoTebt0m-FrQ@mail.gmail.com>
Message-ID: <551D50FB.9010601@redhat.com>

Hi,

I've tried with Apache Tomcat 6.0.35 but wasn't able to reproduce with 
latest Keycloak 1.2.0.Beta1. Logout works fine for me.

How are you doing logout? From the application or from KC admin console? 
For the tomcat6, the httpServletRequest.logout() method is not yet 
available, so best for logout from the application is redirecting to 
Keycloak logout URL similarly like in our demo example: 
https://github.com/keycloak/keycloak/blob/master/examples/demo-template/customer-app/src/main/webapp/customers/view.jsp#L14

You can also enable debug logging, which should show some additional 
messages in the log by adding this line into 
$TOMCAT_HOME/conf/logging.properties:

org.keycloak.level = FINE

Marek


On 2.4.2015 01:37, Scott Rossillo wrote:
> Hi all,
>
> I?m running Keycloak 1.1.0-Final in standalone mode and using Keycloak 
> agents on Tomcat 6 and Tomcat 8.
>
> With both agents, whenever I try to log a user out via the Keycloak 
> server, I see this in the Tomcat server?s log:
>
> Apr 01, 2015 7:27:47 PM 
> org.keycloak.adapters.tomcat.CatalinaUserSessionManagement logoutSession
> WARN: Session not present or already invalidated.
>
> The session is still valid and continues to be valid for some period 
> of time in each of the Tomcat instances. Anyone know how to fix?
>
> I was looking at the source and I see this method:
>
>  *
>
>
>   * org.keycloak.adapters.tomcat.CatalinaUserSessionManagement.
>
> logoutSession()
>
> I may test loging the actual exception tomorrow if no one has a clue, 
> but I think it?s probably the exception is being thrown for some 
> reason other than the session no longer existing (it definitely still 
> does).
>
> Best,
> Scott
>
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150402/a992fd79/attachment-0001.html 

From srossillo at smartling.com  Thu Apr  2 11:06:40 2015
From: srossillo at smartling.com (Scott Rossillo)
Date: Thu, 2 Apr 2015 11:06:40 -0400
Subject: [keycloak-user] CatalinaUserSessionManagement: Session not
 present or already invalidated
In-Reply-To: <551D50FB.9010601@redhat.com>
References: <CALAqdu8UmKN7aqQHDkNH1uAAyhTv02gD-8sv5MjoTebt0m-FrQ@mail.gmail.com>
	<551D50FB.9010601@redhat.com>
Message-ID: <CALAqdu-wxO0nw9uJ4e4j_pn2n1ykFNKEqsC7o-1PqdRXnDyQrg@mail.gmail.com>

Hi,

Thanks for the reply.

I was trying to log a user out from the Keycloak admin console. I will try
the redirect method and see if it works.

Also, I?m using 1.1.0.Final. I will upgrade to 1.2.0.Beta1 and report if
the issue is still occurring.

Best,
Scott


On Thu, Apr 2, 2015 at 10:23 AM, Marek Posolda <mposolda at redhat.com> wrote:

>  Hi,
>
> I've tried with Apache Tomcat 6.0.35 but wasn't able to reproduce with
> latest Keycloak 1.2.0.Beta1. Logout works fine for me.
>
> How are you doing logout? From the application or from KC admin console?
> For the tomcat6, the httpServletRequest.logout() method is not yet
> available, so best for logout from the application is redirecting to
> Keycloak logout URL similarly like in our demo example:
> https://github.com/keycloak/keycloak/blob/master/examples/demo-template/customer-app/src/main/webapp/customers/view.jsp#L14
>
> You can also enable debug logging, which should show some additional
> messages in the log by adding this line into
> $TOMCAT_HOME/conf/logging.properties:
>
> org.keycloak.level = FINE
>
> Marek
>
>
>
> On 2.4.2015 01:37, Scott Rossillo wrote:
>
> Hi all,
>
>  I?m running Keycloak 1.1.0-Final in standalone mode and using Keycloak
> agents on Tomcat 6 and Tomcat 8.
>
>  With both agents, whenever I try to log a user out via the Keycloak
> server, I see this in the Tomcat server?s log:
>
>  Apr 01, 2015 7:27:47 PM
> org.keycloak.adapters.tomcat.CatalinaUserSessionManagement logoutSession
> WARN: Session not present or already invalidated.
>
>  The session is still valid and continues to be valid for some period of
> time in each of the Tomcat instances. Anyone know how to fix?
>
>  I was looking at the source and I see this method:
>
>    -
>
>
>    - org.keycloak.adapters.tomcat.CatalinaUserSessionManagement.
>
> logoutSession()
>
>  I may test loging the actual exception tomorrow if no one has a clue,
> but I think it?s probably the exception is being thrown for some reason
> other than the session no longer existing (it definitely still does).
>
>  Best,
> Scott
>
>
>
> _______________________________________________
> keycloak-user mailing listkeycloak-user at lists.jboss.orghttps://lists.jboss.org/mailman/listinfo/keycloak-user
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150402/03735e67/attachment.html 

From srossillo at smartling.com  Thu Apr  2 11:37:25 2015
From: srossillo at smartling.com (Scott Rossillo)
Date: Thu, 2 Apr 2015 11:37:25 -0400
Subject: [keycloak-user] Keycloak 1.2.0.Beta1 Released
In-Reply-To: <1466648129.10938551.1427978331196.JavaMail.zimbra@redhat.com>
References: <1943269927.10938403.1427978311541.JavaMail.zimbra@redhat.com>
	<1466648129.10938551.1427978331196.JavaMail.zimbra@redhat.com>
Message-ID: <CALAqdu_7KPvfQFHb0ZBCRGb=n=E2ghiJcr2_SpnZ6ytLp8vAyQ@mail.gmail.com>

Looks great! Will 1.2.0.Beta1 hit Maven Central today?

~ Scott

On Thu, Apr 2, 2015 at 8:38 AM, Stian Thorgersen <stian at redhat.com> wrote:

> We're proud to announce the release of Keycloak 1.2.0.Beta1. This is a
> great release, especially if you're after enterprise capabilities.
>
> The major new features in this release includes:
>
> * Protocol mapping - With protocol mapping it's easy to define what claims
> are added to the token an application receives.
> * Kerberos - It's now possible to authenticate with a Keycloak realm using
> Kerberos tickets through SPNEGO.
> * Identity Brokering - As well as Kerberos you can also authenticate with
> Keycloak with an external SAML 2.0 or OpenID Connect Identity Provider.
> * OpenID Connect improvements - We've made several improvements to comply
> with the OpenID Connect specification and we've also introduced new
> features such as Discovery, Session Management and UserInfo endpoint.
> * Internationalization support for login and account management Thanks to
> Michael Gerber the login and account management pages now have
> internationalization support. We have built in support for English, German
> and Brazilian Portuguese. We've also made it easy to add your own and if
> you'd like to contribute a translation let us know.
> * Deploy providers as modules - It's now possible to deploy custom
> providers as modules. This gives you full control of the classloader for
> your provider.
> * Deploy themes as modules - We've made it much simpler to package themes
> and they can also be deployed as a module. This makes it simpler to
> distribute themes as well as using custom themes in a cluster.
> * Login with Stackoverflow and LinkedIn - Thanks to Vlastimil Eli?? we now
> have built-in support to login with Stackoverflow and LinkedIn.
> * SysLog event listener - Thanks to Giriraj Sharma we now have a syslog
> event listener.
> * Version control on cached resources - A common issue in the past was
> that the admin console didn't work after upgrading Keycloak. This was
> caused by the browser caching old html and javascript. We've solved this
> issue by including a version number in the resource urls, so upgrading
> should be even simpler now!
>
> To get the release go to www.keycloak.org. For the full lists of issues
> resolved for this release check https://issues.jboss.org/browse/KEYCLOAK.
>
> Remember to read the migration guide before upgrading as it contains vital
> information about what's changed and how to upgrade.
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150402/70b8b812/attachment.html 

From aryvlin at morphotrust.com  Thu Apr  2 13:21:51 2015
From: aryvlin at morphotrust.com (Ryvlin, Andrey)
Date: Thu, 2 Apr 2015 17:21:51 +0000
Subject: [keycloak-user] keycloak.json file for angular app
Message-ID: <c56348ed91894eefae72897f2acb34db@BLM-MAIL01P.l1id.local>

Hi
I have AngularJs based UI web app talking to RESTfull web services using Keycloak security.
Keycloak is running on a separate instance of Wildfly having https connection.
UI Web application has keycloak.json file with hardcoded Keycloak URL.
Everything works well with one problem: when I need to install my web application to a different environment I need to open WAR, modify keycloak.json with new URL and package it back.
Since we deliver the entire installation to the client, I don?t know their host names, so they have to open WAR, which is in-convenient.
Is there any way to avoid that?

Thanks?


Thanks?
-----------------
Andrey Ryvlin
Principal Software Engineer

Phone: 952-979-8492
5705 W Old Shakopee Road, Suite 100
Bloomington, MN 55437 USA
ARyvlin at MorphoTrust.com<mailto:ARyvlin at MorphoTrust.com>
www.MorphoTrust.com<http://www.morphotrust.com/>

[cid:image003.jpg at 01CFF75A.60542BC0]


________________________________

This message is only for the use of the intended recipient and may contain information that is CONFIDENTIAL and PROPRIETARY to MorphoTrust USA, Inc. If you are not the intended recipient, please erase all copies of the message and its attachments and notify the sender immediately.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150402/5d6cc04a/attachment-0001.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.jpg
Type: image/jpeg
Size: 1778 bytes
Desc: image001.jpg
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20150402/5d6cc04a/attachment-0001.jpg 

From mposolda at redhat.com  Thu Apr  2 14:04:56 2015
From: mposolda at redhat.com (Marek Posolda)
Date: Thu, 02 Apr 2015 20:04:56 +0200
Subject: [keycloak-user] keycloak.json file for angular app
In-Reply-To: <c56348ed91894eefae72897f2acb34db@BLM-MAIL01P.l1id.local>
References: <c56348ed91894eefae72897f2acb34db@BLM-MAIL01P.l1id.local>
Message-ID: <551D84C8.70500@redhat.com>

Hi,

I guess in your Angular application you're using something like:

var keycloakAuth = new Keycloak('keycloak.json');

right? So instead of this, you can read the Keycloak configuration from 
some separate URI like:

var keycloakAuth = new Keycloak('myconfig');

Where the path 'myconfig' could be mapped to some servlet (or jaxrs 
application if you prefer), which will return you the JSON with the 
configuration. So instead of serving the configuration directly from 
file keycloak.json, you will serve it from the servlet (or jaxrs app). 
The servlet will run on server side, so you can use whatever is good for 
your app to init the auth-server-url dynamically (For example read it 
from System property)

Marek


On 2.4.2015 19:21, Ryvlin, Andrey wrote:
>
> Hi
>
> I have AngularJs based UI web app talking to RESTfull web services 
> using Keycloak security.
>
> Keycloak is running on a separate instance of Wildfly having https 
> connection.
>
> UI Web application has keycloak.json file with hardcoded Keycloak URL.
>
> Everything works well with one problem: when I need to install my web 
> application to a different environment I need to open WAR, modify 
> keycloak.json with new URL and package it back.
>
> Since we deliver the entire installation to the client, I don?t know 
> their host names, so they have to open WAR, which is in-convenient.
>
> Is there any way to avoid that?
>
> Thanks?
>
> Thanks?
>
> -----------------
>
> Andrey Ryvlin
>
> Principal Software Engineer
>
> Phone: 952-979-8492
>
> 5705 W Old Shakopee Road, Suite 100
>
> Bloomington, MN 55437 USA
>
> ARyvlin at MorphoTrust.com <mailto:ARyvlin at MorphoTrust.com>
>
> www.MorphoTrust.com <http://www.morphotrust.com/>
>
> cid:image003.jpg at 01CFF75A.60542BC0
>
>
> ------------------------------------------------------------------------
>
> This message is only for the use of the intended recipient and may 
> contain information that is CONFIDENTIAL and PROPRIETARY to 
> MorphoTrust USA, Inc. If you are not the intended recipient, please 
> erase all copies of the message and its attachments and notify the 
> sender immediately.
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150402/0817e896/attachment.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: image/jpeg
Size: 1778 bytes
Desc: not available
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20150402/0817e896/attachment.jpe 

From aryvlin at morphotrust.com  Thu Apr  2 16:02:43 2015
From: aryvlin at morphotrust.com (Ryvlin, Andrey)
Date: Thu, 2 Apr 2015 20:02:43 +0000
Subject: [keycloak-user] keycloak.json file for angular app
In-Reply-To: <551D84C8.70500@redhat.com>
References: <c56348ed91894eefae72897f2acb34db@BLM-MAIL01P.l1id.local>
	<551D84C8.70500@redhat.com>
Message-ID: <6d2823192e314b3f90af07ee5eb5b183@BLM-MAIL01P.l1id.local>

Marek,
I guess this would work if I can pass Json object to Keycloak constructor.
Is it possible?
Thanks?
-----------------
Andrey Ryvlin
Principal Software Engineer

Phone: 952-979-8492
5705 W Old Shakopee Road, Suite 100
Bloomington, MN 55437 USA
ARyvlin at MorphoTrust.com<mailto:ARyvlin at MorphoTrust.com>
www.MorphoTrust.com<http://www.morphotrust.com/>

[cid:image003.jpg at 01CFF75A.60542BC0]

From: Marek Posolda [mailto:mposolda at redhat.com]
Sent: Thursday, April 02, 2015 1:05 PM
To: Ryvlin, Andrey; keycloak-user at lists.jboss.org
Subject: Re: [keycloak-user] keycloak.json file for angular app

Hi,

I guess in your Angular application you're using something like:

var keycloakAuth = new Keycloak('keycloak.json');

right? So instead of this, you can read the Keycloak configuration from some separate URI like:

var keycloakAuth = new Keycloak('myconfig');

Where the path 'myconfig' could be mapped to some servlet (or jaxrs application if you prefer), which will return you the JSON with the configuration. So instead of serving the configuration directly from file keycloak.json, you will serve it from the servlet (or jaxrs app). The servlet will run on server side, so you can use whatever is good for your app to init the auth-server-url dynamically (For example read it from System property)

Marek


On 2.4.2015 19:21, Ryvlin, Andrey wrote:
Hi
I have AngularJs based UI web app talking to RESTfull web services using Keycloak security.
Keycloak is running on a separate instance of Wildfly having https connection.
UI Web application has keycloak.json file with hardcoded Keycloak URL.
Everything works well with one problem: when I need to install my web application to a different environment I need to open WAR, modify keycloak.json with new URL and package it back.
Since we deliver the entire installation to the client, I don?t know their host names, so they have to open WAR, which is in-convenient.
Is there any way to avoid that?

Thanks?


Thanks?
-----------------
Andrey Ryvlin
Principal Software Engineer

Phone: 952-979-8492
5705 W Old Shakopee Road, Suite 100
Bloomington, MN 55437 USA
ARyvlin at MorphoTrust.com<mailto:ARyvlin at MorphoTrust.com>
www.MorphoTrust.com<http://www.morphotrust.com/>

[cid:image003.jpg at 01CFF75A.60542BC0]


________________________________

This message is only for the use of the intended recipient and may contain information that is CONFIDENTIAL and PROPRIETARY to MorphoTrust USA, Inc. If you are not the intended recipient, please erase all copies of the message and its attachments and notify the sender immediately.




_______________________________________________

keycloak-user mailing list

keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>

https://lists.jboss.org/mailman/listinfo/keycloak-user

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150402/3d3aaed2/attachment-0001.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.jpg
Type: image/jpeg
Size: 1778 bytes
Desc: image001.jpg
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20150402/3d3aaed2/attachment-0001.jpg 

From srossillo at smartling.com  Thu Apr  2 19:30:58 2015
From: srossillo at smartling.com (Scott Rossillo)
Date: Thu, 2 Apr 2015 19:30:58 -0400
Subject: [keycloak-user] CatalinaUserSessionManagement: Session not
	present or already invalidated
In-Reply-To: <CALAqdu-wxO0nw9uJ4e4j_pn2n1ykFNKEqsC7o-1PqdRXnDyQrg@mail.gmail.com>
References: <CALAqdu8UmKN7aqQHDkNH1uAAyhTv02gD-8sv5MjoTebt0m-FrQ@mail.gmail.com>
	<551D50FB.9010601@redhat.com>
	<CALAqdu-wxO0nw9uJ4e4j_pn2n1ykFNKEqsC7o-1PqdRXnDyQrg@mail.gmail.com>
Message-ID: <CALAqdu-_Oq1GGevQ_aQ=rEwB3P7UmiGOvrh1ZFu3D_MrKvm3fA@mail.gmail.com>

Still no luck using Tomcat 8 and Keycloak 1.2.0.Beta1.

I will install a custom built agent tomorrow to catch the actual exception
to see what's up.


On Thursday, April 2, 2015, Scott Rossillo <srossillo at smartling.com> wrote:

> Hi,
>
> Thanks for the reply.
>
> I was trying to log a user out from the Keycloak admin console. I will try
> the redirect method and see if it works.
>
> Also, I?m using 1.1.0.Final. I will upgrade to 1.2.0.Beta1 and report if
> the issue is still occurring.
>
> Best,
> Scott
>
>
> On Thu, Apr 2, 2015 at 10:23 AM, Marek Posolda <mposolda at redhat.com
> <javascript:_e(%7B%7D,'cvml','mposolda at redhat.com');>> wrote:
>
>>  Hi,
>>
>> I've tried with Apache Tomcat 6.0.35 but wasn't able to reproduce with
>> latest Keycloak 1.2.0.Beta1. Logout works fine for me.
>>
>> How are you doing logout? From the application or from KC admin console?
>> For the tomcat6, the httpServletRequest.logout() method is not yet
>> available, so best for logout from the application is redirecting to
>> Keycloak logout URL similarly like in our demo example:
>> https://github.com/keycloak/keycloak/blob/master/examples/demo-template/customer-app/src/main/webapp/customers/view.jsp#L14
>>
>> You can also enable debug logging, which should show some additional
>> messages in the log by adding this line into
>> $TOMCAT_HOME/conf/logging.properties:
>>
>> org.keycloak.level = FINE
>>
>> Marek
>>
>>
>>
>> On 2.4.2015 01:37, Scott Rossillo wrote:
>>
>> Hi all,
>>
>>  I?m running Keycloak 1.1.0-Final in standalone mode and using Keycloak
>> agents on Tomcat 6 and Tomcat 8.
>>
>>  With both agents, whenever I try to log a user out via the Keycloak
>> server, I see this in the Tomcat server?s log:
>>
>>  Apr 01, 2015 7:27:47 PM
>> org.keycloak.adapters.tomcat.CatalinaUserSessionManagement logoutSession
>> WARN: Session not present or already invalidated.
>>
>>  The session is still valid and continues to be valid for some period of
>> time in each of the Tomcat instances. Anyone know how to fix?
>>
>>  I was looking at the source and I see this method:
>>
>>    -
>>
>>
>>    - org.keycloak.adapters.tomcat.CatalinaUserSessionManagement.
>>
>> logoutSession()
>>
>>  I may test loging the actual exception tomorrow if no one has a clue,
>> but I think it?s probably the exception is being thrown for some reason
>> other than the session no longer existing (it definitely still does).
>>
>>  Best,
>> Scott
>>
>>
>>
>> _______________________________________________
>> keycloak-user mailing listkeycloak-user at lists.jboss.org <javascript:_e(%7B%7D,'cvml','keycloak-user at lists.jboss.org');>https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>>
>>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150402/9bfb7bc3/attachment.html 

From chenkeong.yap at izeno.com  Thu Apr  2 19:44:24 2015
From: chenkeong.yap at izeno.com (Chen Keong Yap)
Date: Fri, 3 Apr 2015 07:44:24 +0800
Subject: [keycloak-user] Http Session is not invalidated
Message-ID: <CAC2UnuUrPd44VyqcvM6MPWUHUTVC-s8xY7=4cMJO1gyPBsRTfw@mail.gmail.com>

Hi,

I've 2 applications installed with Picketlink SPFilter to authenticate with
keycloak 1.1.0 beta 2.

When i perform global logout, first application was logged out successfully
because SP/keycloak session and application http session are removed but
the problem is second
application SP/keycloak session is removed but application http session is
still remained. I've set admin url for these 2 applications in keycloak
admin console. Kindly share your ideas.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150403/357befc9/attachment.html 

From mposolda at redhat.com  Fri Apr  3 01:37:16 2015
From: mposolda at redhat.com (Marek Posolda)
Date: Fri, 03 Apr 2015 07:37:16 +0200
Subject: [keycloak-user] keycloak.json file for angular app
In-Reply-To: <6d2823192e314b3f90af07ee5eb5b183@BLM-MAIL01P.l1id.local>
References: <c56348ed91894eefae72897f2acb34db@BLM-MAIL01P.l1id.local>
	<551D84C8.70500@redhat.com>
	<6d2823192e314b3f90af07ee5eb5b183@BLM-MAIL01P.l1id.local>
Message-ID: <551E270C.3020102@redhat.com>

Yes, that works too. You can pass the JSON object with properties "url", 
"realm" and "clientId" to the constructor. See the docs with the example 
for this: 
http://docs.jboss.org/keycloak/docs/1.2.0.Beta1/userguide/html/ch08.html#javascript-adapter

Marek

On 2.4.2015 22:02, Ryvlin, Andrey wrote:
>
> Marek,
>
> I guess this would work if I can pass Json object to Keycloak constructor.
>
> Is it possible?
>
> Thanks?
>
> -----------------
>
> Andrey Ryvlin
>
> Principal Software Engineer
>
> Phone: 952-979-8492
>
> 5705 W Old Shakopee Road, Suite 100
>
> Bloomington, MN 55437 USA
>
> ARyvlin at MorphoTrust.com <mailto:ARyvlin at MorphoTrust.com>
>
> www.MorphoTrust.com <http://www.morphotrust.com/>
>
> cid:image003.jpg at 01CFF75A.60542BC0
>
> *From:*Marek Posolda [mailto:mposolda at redhat.com]
> *Sent:* Thursday, April 02, 2015 1:05 PM
> *To:* Ryvlin, Andrey; keycloak-user at lists.jboss.org
> *Subject:* Re: [keycloak-user] keycloak.json file for angular app
>
> Hi,
>
> I guess in your Angular application you're using something like:
>
> var keycloakAuth = new Keycloak('keycloak.json');
>
> right? So instead of this, you can read the Keycloak configuration 
> from some separate URI like:
>
> var keycloakAuth = new Keycloak('myconfig');
>
> Where the path 'myconfig' could be mapped to some servlet (or jaxrs 
> application if you prefer), which will return you the JSON with the 
> configuration. So instead of serving the configuration directly from 
> file keycloak.json, you will serve it from the servlet (or jaxrs app). 
> The servlet will run on server side, so you can use whatever is good 
> for your app to init the auth-server-url dynamically (For example read 
> it from System property)
>
> Marek
>
>
> On 2.4.2015 19:21, Ryvlin, Andrey wrote:
>
>     Hi
>
>     I have AngularJs based UI web app talking to RESTfull web services
>     using Keycloak security.
>
>     Keycloak is running on a separate instance of Wildfly having https
>     connection.
>
>     UI Web application has keycloak.json file with hardcoded Keycloak URL.
>
>     Everything works well with one problem: when I need to install my
>     web application to a different environment I need to open WAR,
>     modify keycloak.json with new URL and package it back.
>
>     Since we deliver the entire installation to the client, I don?t
>     know their host names, so they have to open WAR, which is
>     in-convenient.
>
>     Is there any way to avoid that?
>
>     Thanks?
>
>     Thanks?
>
>     -----------------
>
>     Andrey Ryvlin
>
>     Principal Software Engineer
>
>     Phone: 952-979-8492
>
>     5705 W Old Shakopee Road, Suite 100
>
>     Bloomington, MN 55437 USA
>
>     ARyvlin at MorphoTrust.com <mailto:ARyvlin at MorphoTrust.com>
>
>     www.MorphoTrust.com <http://www.morphotrust.com/>
>
>     cid:image003.jpg at 01CFF75A.60542BC0
>
>     ------------------------------------------------------------------------
>
>
>     This message is only for the use of the intended recipient and may
>     contain information that is CONFIDENTIAL and PROPRIETARY to
>     MorphoTrust USA, Inc. If you are not the intended recipient,
>     please erase all copies of the message and its attachments and
>     notify the sender immediately.
>
>
>
>     _______________________________________________
>
>     keycloak-user mailing list
>
>     keycloak-user at lists.jboss.org  <mailto:keycloak-user at lists.jboss.org>
>
>     https://lists.jboss.org/mailman/listinfo/keycloak-user
>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150403/ca309569/attachment-0001.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: image/jpeg
Size: 1778 bytes
Desc: not available
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20150403/ca309569/attachment-0001.jpe 

From mposolda at redhat.com  Fri Apr  3 01:42:47 2015
From: mposolda at redhat.com (Marek Posolda)
Date: Fri, 03 Apr 2015 07:42:47 +0200
Subject: [keycloak-user] CatalinaUserSessionManagement: Session not
 present or already invalidated
In-Reply-To: <CALAqdu-_Oq1GGevQ_aQ=rEwB3P7UmiGOvrh1ZFu3D_MrKvm3fA@mail.gmail.com>
References: <CALAqdu8UmKN7aqQHDkNH1uAAyhTv02gD-8sv5MjoTebt0m-FrQ@mail.gmail.com>	<551D50FB.9010601@redhat.com>	<CALAqdu-wxO0nw9uJ4e4j_pn2n1ykFNKEqsC7o-1PqdRXnDyQrg@mail.gmail.com>
	<CALAqdu-_Oq1GGevQ_aQ=rEwB3P7UmiGOvrh1ZFu3D_MrKvm3fA@mail.gmail.com>
Message-ID: <551E2857.6020501@redhat.com>

Sure, maybe even easier alternative is to try debugger. You can add this 
to the beginning of $TOMCAT_HOME/bin/catalina.sh:

JAVA_OPTS="$JAVA_OPTS 
-agentlib:jdwp=transport=dt_socket,address=5005,server=y,suspend=n"

then start tomcat and then remotely connect to it from your IDE. You 
will need opened IDE with keycloak sources though.

I've changed the code to display the exception stacktrace, but it will 
be available in next release (not yet in 1.2.0.Beta1 released yesterday)

Marek

On 3.4.2015 01:30, Scott Rossillo wrote:
> Still no luck using Tomcat 8 and Keycloak 1.2.0.Beta1.
>
> I will install a custom built agent tomorrow to catch the actual 
> exception to see what's up.
>
>
> On Thursday, April 2, 2015, Scott Rossillo <srossillo at smartling.com 
> <mailto:srossillo at smartling.com>> wrote:
>
>     Hi,
>
>     Thanks for the reply.
>
>     I was trying to log a user out from the Keycloak admin console. I
>     will try the redirect method and see if it works.
>
>     Also, I?m using 1.1.0.Final. I will upgrade to 1.2.0.Beta1 and
>     report if the issue is still occurring.
>
>     Best,
>     Scott
>
>     On Thu, Apr 2, 2015 at 10:23 AM, Marek Posolda
>     <mposolda at redhat.com
>     <javascript:_e(%7B%7D,'cvml','mposolda at redhat.com');>> wrote:
>
>         Hi,
>
>         I've tried with Apache Tomcat 6.0.35 but wasn't able to
>         reproduce with latest Keycloak 1.2.0.Beta1. Logout works fine
>         for me.
>
>         How are you doing logout? From the application or from KC
>         admin console? For the tomcat6, the
>         httpServletRequest.logout() method is not yet available, so
>         best for logout from the application is redirecting to
>         Keycloak logout URL similarly like in our demo example:
>         https://github.com/keycloak/keycloak/blob/master/examples/demo-template/customer-app/src/main/webapp/customers/view.jsp#L14
>
>         You can also enable debug logging, which should show some
>         additional messages in the log by adding this line into
>         $TOMCAT_HOME/conf/logging.properties:
>
>         org.keycloak.level = FINE
>
>         Marek
>
>
>
>         On 2.4.2015 01:37, Scott Rossillo wrote:
>>         Hi all,
>>
>>         I?m running Keycloak 1.1.0-Final in standalone mode and using
>>         Keycloak agents on Tomcat 6 and Tomcat 8.
>>
>>         With both agents, whenever I try to log a user out via the
>>         Keycloak server, I see this in the Tomcat server?s log:
>>
>>         Apr 01, 2015 7:27:47 PM
>>         org.keycloak.adapters.tomcat.CatalinaUserSessionManagement
>>         logoutSession
>>         WARN: Session not present or already invalidated.
>>
>>         The session is still valid and continues to be valid for some
>>         period of time in each of the Tomcat instances. Anyone know
>>         how to fix?
>>
>>         I was looking at the source and I see this method:
>>
>>          *
>>
>>
>>           * org.keycloak.adapters.tomcat.CatalinaUserSessionManagement.
>>
>>         logoutSession()
>>
>>         I may test loging the actual exception tomorrow if no one has
>>         a clue, but I think it?s probably the exception is being
>>         thrown for some reason other than the session no longer
>>         existing (it definitely still does).
>>
>>         Best,
>>         Scott
>>
>>
>>
>>         _______________________________________________
>>         keycloak-user mailing list
>>         keycloak-user at lists.jboss.org  <javascript:_e(%7B%7D,'cvml','keycloak-user at lists.jboss.org');>
>>         https://lists.jboss.org/mailman/listinfo/keycloak-user
>
>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150403/ba532a00/attachment.html 

From mposolda at redhat.com  Fri Apr  3 01:50:52 2015
From: mposolda at redhat.com (Marek Posolda)
Date: Fri, 03 Apr 2015 07:50:52 +0200
Subject: [keycloak-user] Http Session is not invalidated
In-Reply-To: <CAC2UnuUrPd44VyqcvM6MPWUHUTVC-s8xY7=4cMJO1gyPBsRTfw@mail.gmail.com>
References: <CAC2UnuUrPd44VyqcvM6MPWUHUTVC-s8xY7=4cMJO1gyPBsRTfw@mail.gmail.com>
Message-ID: <551E2A3C.8070006@redhat.com>

I would try to upgrade to latest 1.2.0.Beta1 as it has some related 
fixes AFAIK.

In this version, you have also possibility to setup either frontChannel 
logout or backchannel logout for the application. It could be set in 
Keycloak admin console. I think that at least one of them will work with 
SP filter in latest version (if not both).

Marek

On 3.4.2015 01:44, Chen Keong Yap wrote:
> Hi,
>
> I've 2 applications installed with Picketlink SPFilter to authenticate 
> with keycloak 1.1.0 beta 2.
>
> When i perform global logout, first application was logged out 
> successfully because SP/keycloak session and application http session 
> are removed but the problem is second
> application SP/keycloak session is removed but application http 
> session is still remained. I've set admin url for these 2 applications 
> in keycloak admin console. Kindly share your ideas.
>
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150403/3726a699/attachment.html 

From chenkeong.yap at izeno.com  Fri Apr  3 02:28:24 2015
From: chenkeong.yap at izeno.com (Chen Keong Yap)
Date: Fri, 3 Apr 2015 14:28:24 +0800
Subject: [keycloak-user] Http Session is not invalidated
In-Reply-To: <551E2A3C.8070006@redhat.com>
References: <CAC2UnuUrPd44VyqcvM6MPWUHUTVC-s8xY7=4cMJO1gyPBsRTfw@mail.gmail.com>
	<551E2A3C.8070006@redhat.com>
Message-ID: <CAC2UnuV9O_xZzW25pz3utwVuA+eLcVrXF-rdTBs9iYij2R948g@mail.gmail.com>

Hi Merek,

I've tried frontChannel logout in 1.2.0.Beta1 and it's giving me the same
issues, please refer to the settings shown in the screen shot.

Can you please advise how to test  backchannel logout?


[image: Inline image 1]



On Fri, Apr 3, 2015 at 1:50 PM, Marek Posolda <mposolda at redhat.com> wrote:

>  I would try to upgrade to latest 1.2.0.Beta1 as it has some related
> fixes AFAIK.
>
> In this version, you have also possibility to setup either frontChannel
> logout or backchannel logout for the application. It could be set in
> Keycloak admin console. I think that at least one of them will work with SP
> filter in latest version (if not both).
>
> Marek
>
>
> On 3.4.2015 01:44, Chen Keong Yap wrote:
>
>  Hi,
>
>  I've 2 applications installed with Picketlink SPFilter to authenticate
> with keycloak 1.1.0 beta 2.
>
>  When i perform global logout, first application was logged out
> successfully because SP/keycloak session and application http session are
> removed but the problem is second
> application SP/keycloak session is removed but application http session is
> still remained. I've set admin url for these 2 applications in keycloak
> admin console. Kindly share your ideas.
>
>
>
> _______________________________________________
> keycloak-user mailing listkeycloak-user at lists.jboss.orghttps://lists.jboss.org/mailman/listinfo/keycloak-user
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150403/dcea2f7b/attachment-0001.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image.png
Type: image/png
Size: 71582 bytes
Desc: not available
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20150403/dcea2f7b/attachment-0001.png 

From mposolda at redhat.com  Fri Apr  3 03:36:23 2015
From: mposolda at redhat.com (Marek Posolda)
Date: Fri, 03 Apr 2015 09:36:23 +0200
Subject: [keycloak-user] Http Session is not invalidated
In-Reply-To: <CAC2UnuV9O_xZzW25pz3utwVuA+eLcVrXF-rdTBs9iYij2R948g@mail.gmail.com>
References: <CAC2UnuUrPd44VyqcvM6MPWUHUTVC-s8xY7=4cMJO1gyPBsRTfw@mail.gmail.com>
	<551E2A3C.8070006@redhat.com>
	<CAC2UnuV9O_xZzW25pz3utwVuA+eLcVrXF-rdTBs9iYij2R948g@mail.gmail.com>
Message-ID: <551E42F7.9070404@redhat.com>

Switch the "Front channel logout" to off. In this case it should use 
backchannel (not redirecting through browser, but sending logout 
requests from Keycloak in background)

Marek


On 3.4.2015 08:28, Chen Keong Yap wrote:
>
> Hi Merek,
>
> I've tried frontChannel logout in 1.2.0.Beta1 and it's giving me the 
> same issues, please refer to the settings shown in the screen shot.
>
> Can you please advise how to test  backchannel logout?
>
>
> Inline image 1
>
>
>
> On Fri, Apr 3, 2015 at 1:50 PM, Marek Posolda <mposolda at redhat.com 
> <mailto:mposolda at redhat.com>> wrote:
>
>     I would try to upgrade to latest 1.2.0.Beta1 as it has some
>     related fixes AFAIK.
>
>     In this version, you have also possibility to setup either
>     frontChannel logout or backchannel logout for the application. It
>     could be set in Keycloak admin console. I think that at least one
>     of them will work with SP filter in latest version (if not both).
>
>     Marek
>
>
>     On 3.4.2015 01:44, Chen Keong Yap wrote:
>>     Hi,
>>
>>     I've 2 applications installed with Picketlink SPFilter to
>>     authenticate with keycloak 1.1.0 beta 2.
>>
>>     When i perform global logout, first application was logged out
>>     successfully because SP/keycloak session and application http
>>     session are removed but the problem is second
>>     application SP/keycloak session is removed but application http
>>     session is still remained. I've set admin url for these 2
>>     applications in keycloak admin console. Kindly share your ideas.
>>
>>
>>
>>     _______________________________________________
>>     keycloak-user mailing list
>>     keycloak-user at lists.jboss.org  <mailto:keycloak-user at lists.jboss.org>
>>     https://lists.jboss.org/mailman/listinfo/keycloak-user
>
>
>
>
>
>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150403/1aec29c7/attachment-0001.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: image/png
Size: 71582 bytes
Desc: not available
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20150403/1aec29c7/attachment-0001.png 

From chenkeong.yap at izeno.com  Fri Apr  3 03:47:19 2015
From: chenkeong.yap at izeno.com (Chen Keong Yap)
Date: Fri, 3 Apr 2015 15:47:19 +0800
Subject: [keycloak-user] Http Session is not invalidated
In-Reply-To: <551E42F7.9070404@redhat.com>
References: <CAC2UnuUrPd44VyqcvM6MPWUHUTVC-s8xY7=4cMJO1gyPBsRTfw@mail.gmail.com>
	<551E2A3C.8070006@redhat.com>
	<CAC2UnuV9O_xZzW25pz3utwVuA+eLcVrXF-rdTBs9iYij2R948g@mail.gmail.com>
	<551E42F7.9070404@redhat.com>
Message-ID: <CAC2UnuVnVe4Znxauo1ngy8y5eY=9HELQTLc2a1ftRnBGsyG1YA@mail.gmail.com>

Hi Marek,

I've just tested backchannel logout and it's showing same issue. Both
applications are using PL SP Filter and the steps below are used for
testing.

1. Open https://localhost:8443/employee/ and http request is redirected to
https://localhost:8443/auth/realms/saml-demo-1/protocol/saml

2. Enter username and password into keycloak login page and redirected to
employee landing page

3. Open https://localhost:8443/sales-post/ and redirected to sales-post
landing page without login

4. Logon to keycloak admin console and noticed there are 2 active sessions

5. Perform global logout from employee landing page (
https://localhost:8443/employee/?GLO=true) and http request is redirected
to https://localhost:8443/auth/realms/saml-demo-1/protocol/saml

6. Logon to keycloak admin console and noticed all sessions are gone

7. Refresh sales-post landing page and it's not redirected to keycloak
login page. sales-post session still active.

Kindly advise why GLO is performed but the second application (sales-post)
session still active?

On Fri, Apr 3, 2015 at 3:36 PM, Marek Posolda <mposolda at redhat.com> wrote:

>  Switch the "Front channel logout" to off. In this case it should use
> backchannel (not redirecting through browser, but sending logout requests
> from Keycloak in background)
>
> Marek
>
>
>
> On 3.4.2015 08:28, Chen Keong Yap wrote:
>
>
>  Hi Merek,
>
>  I've tried frontChannel logout in 1.2.0.Beta1 and it's giving me the
> same issues, please refer to the settings shown in the screen shot.
>
>  Can you please advise how to test  backchannel logout?
>
>
>  [image: Inline image 1]
>
>
>
> On Fri, Apr 3, 2015 at 1:50 PM, Marek Posolda <mposolda at redhat.com> wrote:
>
>>  I would try to upgrade to latest 1.2.0.Beta1 as it has some related
>> fixes AFAIK.
>>
>> In this version, you have also possibility to setup either frontChannel
>> logout or backchannel logout for the application. It could be set in
>> Keycloak admin console. I think that at least one of them will work with SP
>> filter in latest version (if not both).
>>
>> Marek
>>
>>
>> On 3.4.2015 01:44, Chen Keong Yap wrote:
>>
>>   Hi,
>>
>>  I've 2 applications installed with Picketlink SPFilter to authenticate
>> with keycloak 1.1.0 beta 2.
>>
>>  When i perform global logout, first application was logged out
>> successfully because SP/keycloak session and application http session are
>> removed but the problem is second
>> application SP/keycloak session is removed but application http session
>> is still remained. I've set admin url for these 2 applications in keycloak
>> admin console. Kindly share your ideas.
>>
>>
>>
>>  _______________________________________________
>> keycloak-user mailing listkeycloak-user at lists.jboss.orghttps://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>>
>>
>
>
>
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150403/400efcef/attachment-0001.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: image/png
Size: 71582 bytes
Desc: not available
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20150403/400efcef/attachment-0001.png 

From prabhalar at yahoo.com  Fri Apr  3 09:19:55 2015
From: prabhalar at yahoo.com (Raghu Prabhala)
Date: Fri, 3 Apr 2015 13:19:55 +0000 (UTC)
Subject: [keycloak-user] Keycloak 1.2.0.Beta1 Released
In-Reply-To: <1466648129.10938551.1427978331196.JavaMail.zimbra@redhat.com>
References: <1466648129.10938551.1427978331196.JavaMail.zimbra@redhat.com>
Message-ID: <531579039.4426124.1428067195788.JavaMail.yahoo@mail.yahoo.com>

That's great news Stian. Kudos to the team for putting in a?great deal of functionality in such a short period of time - KC has now taken a big leap in terms of enterprise capabilities.
Can you also outline the roadmap for Keycloak and whether the below will be addressed?1) FIDO protocols2)?STS
Thanks,Raghu
?      From: Stian Thorgersen <stian at redhat.com>
 To: keycloak-dev <keycloak-dev at lists.jboss.org>; "keycloak-user at lists.jboss.org" <keycloak-user at lists.jboss.org> 
 Sent: Thursday, April 2, 2015 8:38 AM
 Subject: [keycloak-user] Keycloak 1.2.0.Beta1 Released
   
We're proud to announce the release of Keycloak 1.2.0.Beta1. This is a great release, especially if you're after enterprise capabilities.

The major new features in this release includes:

* Protocol mapping - With protocol mapping it's easy to define what claims are added to the token an application receives.
* Kerberos - It's now possible to authenticate with a Keycloak realm using Kerberos tickets through SPNEGO.
* Identity Brokering - As well as Kerberos you can also authenticate with Keycloak with an external SAML 2.0 or OpenID Connect Identity Provider.
* OpenID Connect improvements - We've made several improvements to comply with the OpenID Connect specification and we've also introduced new features such as Discovery, Session Management and UserInfo endpoint.
* Internationalization support for login and account management Thanks to Michael Gerber the login and account management pages now have internationalization support. We have built in support for English, German and Brazilian Portuguese. We've also made it easy to add your own and if you'd like to contribute a translation let us know.
* Deploy providers as modules - It's now possible to deploy custom providers as modules. This gives you full control of the classloader for your provider.
* Deploy themes as modules - We've made it much simpler to package themes and they can also be deployed as a module. This makes it simpler to distribute themes as well as using custom themes in a cluster.
* Login with Stackoverflow and LinkedIn - Thanks to Vlastimil Eli?? we now have built-in support to login with Stackoverflow and LinkedIn.
* SysLog event listener - Thanks to Giriraj Sharma we now have a syslog event listener.
* Version control on cached resources - A common issue in the past was that the admin console didn't work after upgrading Keycloak. This was caused by the browser caching old html and javascript. We've solved this issue by including a version number in the resource urls, so upgrading should be even simpler now!

To get the release go to www.keycloak.org. For the full lists of issues resolved for this release check https://issues.jboss.org/browse/KEYCLOAK.

Remember to read the migration guide before upgrading as it contains vital information about what's changed and how to upgrade.

_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user

  
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150403/e15a281e/attachment.html 

From msakho at redhat.com  Fri Apr  3 09:41:45 2015
From: msakho at redhat.com (Meissa M'baye Sakho)
Date: Fri, 3 Apr 2015 09:41:45 -0400 (EDT)
Subject: [keycloak-user] deploying restful service application out of the
 keycloak autorisation server
In-Reply-To: <2025474053.10998781.1428066513501.JavaMail.zimbra@redhat.com>
Message-ID: <1081623203.11004743.1428068505044.JavaMail.zimbra@redhat.com>

Hi all, 
I have a question about running my applications in a different server than the keycloak one. 

I have one third party oauth client web application and one pure restful web service application. 
I have created a realm, configured the two applications as explained in the videos tutorials. 
The two applications behaviour are similar to the database service and the third-party oauth client that are shipped in the example of keycloak distribution. 
Every thing work fine when I deploy all on the same wildfly server that is hosting the keycloak server; 

I would like to deploy the restful web application and the oauth client in a another JBOSS EAP 6 server. 
For the oauth client, as explained in the video tutorial, I will have to define the complete url while defining the redirect url in the registration step. 

For the restful services web application, it's a bearer only access type application. It will only accept token authentification. There is no redirect url. 

How do I configure the restful services web application in this situation? 
Is there something to configure so that the keycloak adapter could be able to valide the token when the oauth client calls a service from the restful web application? 

Thank you in advance. 
Meissa 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150403/cae66974/attachment.html 

From aryvlin at morphotrust.com  Fri Apr  3 15:15:38 2015
From: aryvlin at morphotrust.com (Ryvlin, Andrey)
Date: Fri, 3 Apr 2015 19:15:38 +0000
Subject: [keycloak-user] Exchange access token to id token
Message-ID: <ac68358c01e64e58bb0f095e116058f7@BLM-MAIL01P.l1id.local>

Hi,
I?m using Keycloak direct grant login to my REST APIs and I need to get authenticated user information for auditing purpose.
At my REST implementation class I can get access token from HTTP header by using a request interceptor, but I believe that token is useless for auditing.
Is there Keycloak REST API to get id token for the access token?

Thank you in advance

Andrey Ryvlin
Sr. Software Engineer

________________________________

This message is only for the use of the intended recipient and may contain information that is CONFIDENTIAL and PROPRIETARY to MorphoTrust USA, Inc. If you are not the intended recipient, please erase all copies of the message and its attachments and notify the sender immediately.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150403/e7f0339d/attachment.html 

From bburke at redhat.com  Fri Apr  3 15:20:27 2015
From: bburke at redhat.com (Bill Burke)
Date: Fri, 03 Apr 2015 15:20:27 -0400
Subject: [keycloak-user] Exchange access token to id token
In-Reply-To: <ac68358c01e64e58bb0f095e116058f7@BLM-MAIL01P.l1id.local>
References: <ac68358c01e64e58bb0f095e116058f7@BLM-MAIL01P.l1id.local>
Message-ID: <551EE7FB.40702@redhat.com>

Our access tokens are actually JsonWebTokens packaged in a Json Web 
Signature.  Direct Grant login should also return an IDToken within the 
Access Token Response.

On 4/3/2015 3:15 PM, Ryvlin, Andrey wrote:
> Hi,
>
> I?m using Keycloak direct grant login to my REST APIs and I need to get
> authenticated user information for auditing purpose.
>
> At my REST implementation class I can get access token from HTTP header
> by using a request interceptor, but I believe that token is useless for
> auditing.
>
> Is there Keycloak REST API to get id token for the access token?
>
> Thank you in advance
>
> Andrey Ryvlin
>
> Sr. Software Engineer
>
>
> ------------------------------------------------------------------------
>
> This message is only for the use of the intended recipient and may
> contain information that is CONFIDENTIAL and PROPRIETARY to MorphoTrust
> USA, Inc. If you are not the intended recipient, please erase all copies
> of the message and its attachments and notify the sender immediately.
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

-- 
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com

From srossillo at smartling.com  Fri Apr  3 15:21:10 2015
From: srossillo at smartling.com (Scott Rossillo)
Date: Fri, 3 Apr 2015 15:21:10 -0400
Subject: [keycloak-user] CatalinaUserSessionManagement: Session not
	present or already invalidated
In-Reply-To: <551E2857.6020501@redhat.com>
References: <CALAqdu8UmKN7aqQHDkNH1uAAyhTv02gD-8sv5MjoTebt0m-FrQ@mail.gmail.com>
	<551D50FB.9010601@redhat.com>
	<CALAqdu-wxO0nw9uJ4e4j_pn2n1ykFNKEqsC7o-1PqdRXnDyQrg@mail.gmail.com>
	<CALAqdu-_Oq1GGevQ_aQ=rEwB3P7UmiGOvrh1ZFu3D_MrKvm3fA@mail.gmail.com>
	<551E2857.6020501@redhat.com>
Message-ID: <CALAqdu9m1dfTvjx9jL8TWEunR=oBsLBv-R5hO5fLs3y3+f9y3g@mail.gmail.com>

Ok, so a few followups. Just to be clear, here?s what I?m trying to do and
the outcomes of each against 1.2.0.Beta1:

1. (Original scenario) Log user out from KC console (Users > [user]
Sessions).
Result: This still fails with the exception,
"org.keycloak.adapters.tomcat.CatalinaUserSessionManagement.logoutSession
Session not present or already invalidated.?

The exception thrown here is an NPE as manager.findSession(httpSessionId)
failed to find the session. Interestingly, the session is still valid and
the ID passed into the manager is correct. Furthermore, while debugging I
can see that manager.findSession() looks up the session in a hash map.
Interestingly, the session id (key) is there, but the value (session) is
null.  Maybe this is a Tomcat bug.  Using Tomcat 8.0.18, will test with
8.0.21.

2. (Second scenario) Application logout.
Documentation 8.10. Logout (
http://docs.jboss.org/keycloak/docs/1.2.0.Beta1/userguide/html/ch08.html#d4e1152)
say you can either call HttpServletRequest.logout() or redirect
tohttp://auth-server/auth/realms/{realm-name}/tokens/logout?redirect_uri=encodedRedirectUri.

However, you have to do both.

Call only .logout() and the KC token is still valid and user can access app
with a new session (it will just redirect to KC, see KC session is valid
and grant access).

Call only auth-server/?/logout and the Tomcat session remains valid. I
would have thought that calling the auth-server?s logout endpoint would
broadcast logout events to logged in applications, but it doesn?t.

I?ll file a JIRA for the second case and continue investigating the first
scenario with a newer Tomcat release.

Best,
Scott









On Fri, Apr 3, 2015 at 1:42 AM, Marek Posolda <mposolda at redhat.com> wrote:

>  Sure, maybe even easier alternative is to try debugger. You can add this
> to the beginning of $TOMCAT_HOME/bin/catalina.sh:
>
> JAVA_OPTS="$JAVA_OPTS
> -agentlib:jdwp=transport=dt_socket,address=5005,server=y,suspend=n"
>
> then start tomcat and then remotely connect to it from your IDE. You will
> need opened IDE with keycloak sources though.
>
> I've changed the code to display the exception stacktrace, but it will be
> available in next release (not yet in 1.2.0.Beta1 released yesterday)
>
> Marek
>
>
> On 3.4.2015 01:30, Scott Rossillo wrote:
>
> Still no luck using Tomcat 8 and Keycloak 1.2.0.Beta1.
>
>  I will install a custom built agent tomorrow to catch the actual
> exception to see what's up.
>
>
> On Thursday, April 2, 2015, Scott Rossillo <srossillo at smartling.com>
> wrote:
>
>> Hi,
>>
>>  Thanks for the reply.
>>
>>  I was trying to log a user out from the Keycloak admin console. I will
>> try the redirect method and see if it works.
>>
>>  Also, I?m using 1.1.0.Final. I will upgrade to 1.2.0.Beta1 and report
>> if the issue is still occurring.
>>
>>  Best,
>> Scott
>>
>>
>> On Thu, Apr 2, 2015 at 10:23 AM, Marek Posolda <mposolda at redhat.com>
>> wrote:
>>
>>>  Hi,
>>>
>>> I've tried with Apache Tomcat 6.0.35 but wasn't able to reproduce with
>>> latest Keycloak 1.2.0.Beta1. Logout works fine for me.
>>>
>>> How are you doing logout? From the application or from KC admin console?
>>> For the tomcat6, the httpServletRequest.logout() method is not yet
>>> available, so best for logout from the application is redirecting to
>>> Keycloak logout URL similarly like in our demo example:
>>> https://github.com/keycloak/keycloak/blob/master/examples/demo-template/customer-app/src/main/webapp/customers/view.jsp#L14
>>>
>>> You can also enable debug logging, which should show some additional
>>> messages in the log by adding this line into
>>> $TOMCAT_HOME/conf/logging.properties:
>>>
>>> org.keycloak.level = FINE
>>>
>>> Marek
>>>
>>>
>>>
>>> On 2.4.2015 01:37, Scott Rossillo wrote:
>>>
>>>  Hi all,
>>>
>>>  I?m running Keycloak 1.1.0-Final in standalone mode and using Keycloak
>>> agents on Tomcat 6 and Tomcat 8.
>>>
>>>  With both agents, whenever I try to log a user out via the Keycloak
>>> server, I see this in the Tomcat server?s log:
>>>
>>>  Apr 01, 2015 7:27:47 PM
>>> org.keycloak.adapters.tomcat.CatalinaUserSessionManagement logoutSession
>>> WARN: Session not present or already invalidated.
>>>
>>>  The session is still valid and continues to be valid for some period
>>> of time in each of the Tomcat instances. Anyone know how to fix?
>>>
>>>  I was looking at the source and I see this method:
>>>
>>>    -
>>>
>>>
>>>    - org.keycloak.adapters.tomcat.CatalinaUserSessionManagement.
>>>
>>> logoutSession()
>>>
>>>  I may test loging the actual exception tomorrow if no one has a clue,
>>> but I think it?s probably the exception is being thrown for some reason
>>> other than the session no longer existing (it definitely still does).
>>>
>>>  Best,
>>> Scott
>>>
>>>
>>>
>>>  _______________________________________________
>>> keycloak-user mailing listkeycloak-user at lists.jboss.orghttps://lists.jboss.org/mailman/listinfo/keycloak-user
>>>
>>>
>>>
>>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150403/35d62b8d/attachment-0001.html 

From aryvlin at morphotrust.com  Fri Apr  3 15:29:40 2015
From: aryvlin at morphotrust.com (Ryvlin, Andrey)
Date: Fri, 3 Apr 2015 19:29:40 +0000
Subject: [keycloak-user] Exchange access token to id token
In-Reply-To: <551EE7FB.40702@redhat.com>
References: <ac68358c01e64e58bb0f095e116058f7@BLM-MAIL01P.l1id.local>
	<551EE7FB.40702@redhat.com>
Message-ID: <92e3221bd8fd4486bd49d60e177924dd@BLM-MAIL01P.l1id.local>

Can I get user id from the access token?
That's the only token I can get from HTTP Authorization header. Actual login and getting login response happens earlier, at my web application or oauth client.
So, at my REST implementation class I only have access token.

Thanks!!

-----Original Message-----
From: keycloak-user-bounces at lists.jboss.org [mailto:keycloak-user-bounces at lists.jboss.org] On Behalf Of Bill Burke
Sent: Friday, April 03, 2015 2:20 PM
To: keycloak-user at lists.jboss.org
Subject: Re: [keycloak-user] Exchange access token to id token

Our access tokens are actually JsonWebTokens packaged in a Json Web Signature.  Direct Grant login should also return an IDToken within the Access Token Response.

On 4/3/2015 3:15 PM, Ryvlin, Andrey wrote:
> Hi,
>
> I?m using Keycloak direct grant login to my REST APIs and I need to
> get authenticated user information for auditing purpose.
>
> At my REST implementation class I can get access token from HTTP
> header by using a request interceptor, but I believe that token is
> useless for auditing.
>
> Is there Keycloak REST API to get id token for the access token?
>
> Thank you in advance
>
> Andrey Ryvlin
>
> Sr. Software Engineer
>
>
> ----------------------------------------------------------------------
> --
>
> This message is only for the use of the intended recipient and may
> contain information that is CONFIDENTIAL and PROPRIETARY to
> MorphoTrust USA, Inc. If you are not the intended recipient, please
> erase all copies of the message and its attachments and notify the sender immediately.
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

--
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com
_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user

________________________________

This message is only for the use of the intended recipient and may contain information that is CONFIDENTIAL and PROPRIETARY to MorphoTrust USA, Inc. If you are not the intended recipient, please erase all copies of the message and its attachments and notify the sender immediately.


From bburke at redhat.com  Fri Apr  3 15:40:26 2015
From: bburke at redhat.com (Bill Burke)
Date: Fri, 03 Apr 2015 15:40:26 -0400
Subject: [keycloak-user] Exchange access token to id token
In-Reply-To: <92e3221bd8fd4486bd49d60e177924dd@BLM-MAIL01P.l1id.local>
References: <ac68358c01e64e58bb0f095e116058f7@BLM-MAIL01P.l1id.local>
	<551EE7FB.40702@redhat.com>
	<92e3221bd8fd4486bd49d60e177924dd@BLM-MAIL01P.l1id.local>
Message-ID: <551EECAA.6060705@redhat.com>

Oh, you have a REST service being invoked on?  And you want to get claim 
information?  Yes, you can get the access token.

     AccessToken accessToken  = 
((KeycloakSecurityContext)request.getAttribute(KeycloakSecurityContext.class.getName())).getToken();


request here is HttpServetRequest

On 4/3/2015 3:29 PM, Ryvlin, Andrey wrote:
> Can I get user id from the access token?
> That's the only token I can get from HTTP Authorization header. Actual login and getting login response happens earlier, at my web application or oauth client.
> So, at my REST implementation class I only have access token.
>
> Thanks!!
>
> -----Original Message-----
> From: keycloak-user-bounces at lists.jboss.org [mailto:keycloak-user-bounces at lists.jboss.org] On Behalf Of Bill Burke
> Sent: Friday, April 03, 2015 2:20 PM
> To: keycloak-user at lists.jboss.org
> Subject: Re: [keycloak-user] Exchange access token to id token
>
> Our access tokens are actually JsonWebTokens packaged in a Json Web Signature.  Direct Grant login should also return an IDToken within the Access Token Response.
>
> On 4/3/2015 3:15 PM, Ryvlin, Andrey wrote:
>> Hi,
>>
>> I?m using Keycloak direct grant login to my REST APIs and I need to
>> get authenticated user information for auditing purpose.
>>
>> At my REST implementation class I can get access token from HTTP
>> header by using a request interceptor, but I believe that token is
>> useless for auditing.
>>
>> Is there Keycloak REST API to get id token for the access token?
>>
>> Thank you in advance
>>
>> Andrey Ryvlin
>>
>> Sr. Software Engineer
>>
>>
>> ----------------------------------------------------------------------
>> --
>>
>> This message is only for the use of the intended recipient and may
>> contain information that is CONFIDENTIAL and PROPRIETARY to
>> MorphoTrust USA, Inc. If you are not the intended recipient, please
>> erase all copies of the message and its attachments and notify the sender immediately.
>>
>>
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>
> --
> Bill Burke
> JBoss, a division of Red Hat
> http://bill.burkecentral.com
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
> ________________________________
>
> This message is only for the use of the intended recipient and may contain information that is CONFIDENTIAL and PROPRIETARY to MorphoTrust USA, Inc. If you are not the intended recipient, please erase all copies of the message and its attachments and notify the sender immediately.
>

-- 
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com

From srossillo at smartling.com  Fri Apr  3 16:22:24 2015
From: srossillo at smartling.com (Scott Rossillo)
Date: Fri, 3 Apr 2015 16:22:24 -0400
Subject: [keycloak-user] CatalinaUserSessionManagement: Session not
	present or already invalidated
In-Reply-To: <CALAqdu9m1dfTvjx9jL8TWEunR=oBsLBv-R5hO5fLs3y3+f9y3g@mail.gmail.com>
References: <CALAqdu8UmKN7aqQHDkNH1uAAyhTv02gD-8sv5MjoTebt0m-FrQ@mail.gmail.com>
	<551D50FB.9010601@redhat.com>
	<CALAqdu-wxO0nw9uJ4e4j_pn2n1ykFNKEqsC7o-1PqdRXnDyQrg@mail.gmail.com>
	<CALAqdu-_Oq1GGevQ_aQ=rEwB3P7UmiGOvrh1ZFu3D_MrKvm3fA@mail.gmail.com>
	<551E2857.6020501@redhat.com>
	<CALAqdu9m1dfTvjx9jL8TWEunR=oBsLBv-R5hO5fLs3y3+f9y3g@mail.gmail.com>
Message-ID: <CALAqdu8B+6FheoQnkTKb1MM+ko_4CKrY=B3ymS7_yOZZ2R4pFg@mail.gmail.com>

Update on issue 1, Log user out from KC console:
It appears this is due to Spring security creating a new session and
migrating data into it but KC knows nothing about this. There?s a way to
disable this behavior in Spring Security and I?m going to take that path.
This should be a non-issue.

~ Scott


On Fri, Apr 3, 2015 at 3:21 PM, Scott Rossillo <srossillo at smartling.com>
wrote:

> Ok, so a few followups. Just to be clear, here?s what I?m trying to do and
> the outcomes of each against 1.2.0.Beta1:
>
> 1. (Original scenario) Log user out from KC console (Users > [user]
> Sessions).
> Result: This still fails with the exception,
> "org.keycloak.adapters.tomcat.CatalinaUserSessionManagement.logoutSession
> Session not present or already invalidated.?
>
> The exception thrown here is an NPE as manager.findSession(httpSessionId)
> failed to find the session. Interestingly, the session is still valid and
> the ID passed into the manager is correct. Furthermore, while debugging I
> can see that manager.findSession() looks up the session in a hash map.
> Interestingly, the session id (key) is there, but the value (session) is
> null.  Maybe this is a Tomcat bug.  Using Tomcat 8.0.18, will test with
> 8.0.21.
>
> 2. (Second scenario) Application logout.
> Documentation 8.10. Logout (
> http://docs.jboss.org/keycloak/docs/1.2.0.Beta1/userguide/html/ch08.html#d4e1152)
> say you can either call HttpServletRequest.logout() or redirect
> tohttp://auth-server/auth/realms/{realm-name}/tokens/logout?redirect_uri=encodedRedirectUri.
>
> However, you have to do both.
>
> Call only .logout() and the KC token is still valid and user can access
> app with a new session (it will just redirect to KC, see KC session is
> valid and grant access).
>
> Call only auth-server/?/logout and the Tomcat session remains valid. I
> would have thought that calling the auth-server?s logout endpoint would
> broadcast logout events to logged in applications, but it doesn?t.
>
> I?ll file a JIRA for the second case and continue investigating the first
> scenario with a newer Tomcat release.
>
> Best,
> Scott
>
>
>
>
>
>
>
>
>
> On Fri, Apr 3, 2015 at 1:42 AM, Marek Posolda <mposolda at redhat.com> wrote:
>
>>  Sure, maybe even easier alternative is to try debugger. You can add
>> this to the beginning of $TOMCAT_HOME/bin/catalina.sh:
>>
>> JAVA_OPTS="$JAVA_OPTS
>> -agentlib:jdwp=transport=dt_socket,address=5005,server=y,suspend=n"
>>
>> then start tomcat and then remotely connect to it from your IDE. You will
>> need opened IDE with keycloak sources though.
>>
>> I've changed the code to display the exception stacktrace, but it will be
>> available in next release (not yet in 1.2.0.Beta1 released yesterday)
>>
>> Marek
>>
>>
>> On 3.4.2015 01:30, Scott Rossillo wrote:
>>
>> Still no luck using Tomcat 8 and Keycloak 1.2.0.Beta1.
>>
>>  I will install a custom built agent tomorrow to catch the actual
>> exception to see what's up.
>>
>>
>> On Thursday, April 2, 2015, Scott Rossillo <srossillo at smartling.com>
>> wrote:
>>
>>> Hi,
>>>
>>>  Thanks for the reply.
>>>
>>>  I was trying to log a user out from the Keycloak admin console. I will
>>> try the redirect method and see if it works.
>>>
>>>  Also, I?m using 1.1.0.Final. I will upgrade to 1.2.0.Beta1 and report
>>> if the issue is still occurring.
>>>
>>>  Best,
>>> Scott
>>>
>>>
>>> On Thu, Apr 2, 2015 at 10:23 AM, Marek Posolda <mposolda at redhat.com>
>>> wrote:
>>>
>>>>  Hi,
>>>>
>>>> I've tried with Apache Tomcat 6.0.35 but wasn't able to reproduce with
>>>> latest Keycloak 1.2.0.Beta1. Logout works fine for me.
>>>>
>>>> How are you doing logout? From the application or from KC admin
>>>> console? For the tomcat6, the httpServletRequest.logout() method is not yet
>>>> available, so best for logout from the application is redirecting to
>>>> Keycloak logout URL similarly like in our demo example:
>>>> https://github.com/keycloak/keycloak/blob/master/examples/demo-template/customer-app/src/main/webapp/customers/view.jsp#L14
>>>>
>>>> You can also enable debug logging, which should show some additional
>>>> messages in the log by adding this line into
>>>> $TOMCAT_HOME/conf/logging.properties:
>>>>
>>>> org.keycloak.level = FINE
>>>>
>>>> Marek
>>>>
>>>>
>>>>
>>>> On 2.4.2015 01:37, Scott Rossillo wrote:
>>>>
>>>>  Hi all,
>>>>
>>>>  I?m running Keycloak 1.1.0-Final in standalone mode and using
>>>> Keycloak agents on Tomcat 6 and Tomcat 8.
>>>>
>>>>  With both agents, whenever I try to log a user out via the Keycloak
>>>> server, I see this in the Tomcat server?s log:
>>>>
>>>>  Apr 01, 2015 7:27:47 PM
>>>> org.keycloak.adapters.tomcat.CatalinaUserSessionManagement logoutSession
>>>> WARN: Session not present or already invalidated.
>>>>
>>>>  The session is still valid and continues to be valid for some period
>>>> of time in each of the Tomcat instances. Anyone know how to fix?
>>>>
>>>>  I was looking at the source and I see this method:
>>>>
>>>>    -
>>>>
>>>>
>>>>    - org.keycloak.adapters.tomcat.CatalinaUserSessionManagement.
>>>>
>>>> logoutSession()
>>>>
>>>>  I may test loging the actual exception tomorrow if no one has a clue,
>>>> but I think it?s probably the exception is being thrown for some reason
>>>> other than the session no longer existing (it definitely still does).
>>>>
>>>>  Best,
>>>> Scott
>>>>
>>>>
>>>>
>>>>  _______________________________________________
>>>> keycloak-user mailing listkeycloak-user at lists.jboss.orghttps://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>
>>>>
>>>>
>>>
>>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150403/b82ee157/attachment.html 

From chenkeong.yap at izeno.com  Sun Apr  5 18:41:20 2015
From: chenkeong.yap at izeno.com (Chen Keong Yap)
Date: Mon, 6 Apr 2015 06:41:20 +0800
Subject: [keycloak-user] Http Session is not invalidated
In-Reply-To: <CAC2UnuVnVe4Znxauo1ngy8y5eY=9HELQTLc2a1ftRnBGsyG1YA@mail.gmail.com>
References: <CAC2UnuUrPd44VyqcvM6MPWUHUTVC-s8xY7=4cMJO1gyPBsRTfw@mail.gmail.com>
	<551E2A3C.8070006@redhat.com>
	<CAC2UnuV9O_xZzW25pz3utwVuA+eLcVrXF-rdTBs9iYij2R948g@mail.gmail.com>
	<551E42F7.9070404@redhat.com>
	<CAC2UnuVnVe4Znxauo1ngy8y5eY=9HELQTLc2a1ftRnBGsyG1YA@mail.gmail.com>
Message-ID: <CAC2UnuWq_t1gyA7n-5SE33CmfojnpQA8iiYhNndpuxGp1au5Rg@mail.gmail.com>

Guys,

Can share your ideas why global logout is not working?
On Apr 3, 2015 3:47 PM, "Chen Keong Yap" <chenkeong.yap at izeno.com> wrote:

> Hi Marek,
>
> I've just tested backchannel logout and it's showing same issue. Both
> applications are using PL SP Filter and the steps below are used for
> testing.
>
> 1. Open https://localhost:8443/employee/ and http request is redirected
> to https://localhost:8443/auth/realms/saml-demo-1/protocol/saml
>
> 2. Enter username and password into keycloak login page and redirected to
> employee landing page
>
> 3. Open https://localhost:8443/sales-post/ and redirected to sales-post
> landing page without login
>
> 4. Logon to keycloak admin console and noticed there are 2 active sessions
>
> 5. Perform global logout from employee landing page (
> https://localhost:8443/employee/?GLO=true) and http request is redirected
> to https://localhost:8443/auth/realms/saml-demo-1/protocol/saml
>
> 6. Logon to keycloak admin console and noticed all sessions are gone
>
> 7. Refresh sales-post landing page and it's not redirected to keycloak
> login page. sales-post session still active.
>
> Kindly advise why GLO is performed but the second application (sales-post)
> session still active?
>
> On Fri, Apr 3, 2015 at 3:36 PM, Marek Posolda <mposolda at redhat.com> wrote:
>
>>  Switch the "Front channel logout" to off. In this case it should use
>> backchannel (not redirecting through browser, but sending logout requests
>> from Keycloak in background)
>>
>> Marek
>>
>>
>>
>> On 3.4.2015 08:28, Chen Keong Yap wrote:
>>
>>
>>  Hi Merek,
>>
>>  I've tried frontChannel logout in 1.2.0.Beta1 and it's giving me the
>> same issues, please refer to the settings shown in the screen shot.
>>
>>  Can you please advise how to test  backchannel logout?
>>
>>
>>  [image: Inline image 1]
>>
>>
>>
>> On Fri, Apr 3, 2015 at 1:50 PM, Marek Posolda <mposolda at redhat.com>
>> wrote:
>>
>>>  I would try to upgrade to latest 1.2.0.Beta1 as it has some related
>>> fixes AFAIK.
>>>
>>> In this version, you have also possibility to setup either frontChannel
>>> logout or backchannel logout for the application. It could be set in
>>> Keycloak admin console. I think that at least one of them will work with SP
>>> filter in latest version (if not both).
>>>
>>> Marek
>>>
>>>
>>> On 3.4.2015 01:44, Chen Keong Yap wrote:
>>>
>>>   Hi,
>>>
>>>  I've 2 applications installed with Picketlink SPFilter to authenticate
>>> with keycloak 1.1.0 beta 2.
>>>
>>>  When i perform global logout, first application was logged out
>>> successfully because SP/keycloak session and application http session are
>>> removed but the problem is second
>>> application SP/keycloak session is removed but application http session
>>> is still remained. I've set admin url for these 2 applications in keycloak
>>> admin console. Kindly share your ideas.
>>>
>>>
>>>
>>>  _______________________________________________
>>> keycloak-user mailing listkeycloak-user at lists.jboss.orghttps://lists.jboss.org/mailman/listinfo/keycloak-user
>>>
>>>
>>>
>>
>>
>>
>>
>>
>>
>
>
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150406/d3ca96ae/attachment-0001.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: image/png
Size: 71582 bytes
Desc: not available
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20150406/d3ca96ae/attachment-0001.png 

From chenkeong.yap at izeno.com  Mon Apr  6 06:47:43 2015
From: chenkeong.yap at izeno.com (Chen Keong Yap)
Date: Mon, 6 Apr 2015 18:47:43 +0800
Subject: [keycloak-user] Http Session is not invalidated
In-Reply-To: <CAC2UnuWq_t1gyA7n-5SE33CmfojnpQA8iiYhNndpuxGp1au5Rg@mail.gmail.com>
References: <CAC2UnuUrPd44VyqcvM6MPWUHUTVC-s8xY7=4cMJO1gyPBsRTfw@mail.gmail.com>
	<551E2A3C.8070006@redhat.com>
	<CAC2UnuV9O_xZzW25pz3utwVuA+eLcVrXF-rdTBs9iYij2R948g@mail.gmail.com>
	<551E42F7.9070404@redhat.com>
	<CAC2UnuVnVe4Znxauo1ngy8y5eY=9HELQTLc2a1ftRnBGsyG1YA@mail.gmail.com>
	<CAC2UnuWq_t1gyA7n-5SE33CmfojnpQA8iiYhNndpuxGp1au5Rg@mail.gmail.com>
Message-ID: <CAC2UnuXFdbN_6W0CQh5TQ=3kMC1R-1ukrEM=MStWEQh9s=NebA@mail.gmail.com>

Hi bill,

Global logout only removed sp sessions but not web application sessions and
this created security loopholes.

Please advise

On Mon, Apr 6, 2015 at 6:41 AM, Chen Keong Yap <chenkeong.yap at izeno.com>
wrote:

> Guys,
>
> Can share your ideas why global logout is not working?
> On Apr 3, 2015 3:47 PM, "Chen Keong Yap" <chenkeong.yap at izeno.com> wrote:
>
>> Hi Marek,
>>
>> I've just tested backchannel logout and it's showing same issue. Both
>> applications are using PL SP Filter and the steps below are used for
>> testing.
>>
>> 1. Open https://localhost:8443/employee/ and http request is redirected
>> to https://localhost:8443/auth/realms/saml-demo-1/protocol/saml
>>
>> 2. Enter username and password into keycloak login page and redirected to
>> employee landing page
>>
>> 3. Open https://localhost:8443/sales-post/ and redirected to sales-post
>> landing page without login
>>
>> 4. Logon to keycloak admin console and noticed there are 2 active sessions
>>
>> 5. Perform global logout from employee landing page (
>> https://localhost:8443/employee/?GLO=true) and http request is
>> redirected to
>> https://localhost:8443/auth/realms/saml-demo-1/protocol/saml
>>
>> 6. Logon to keycloak admin console and noticed all sessions are gone
>>
>> 7. Refresh sales-post landing page and it's not redirected to keycloak
>> login page. sales-post session still active.
>>
>> Kindly advise why GLO is performed but the second application
>> (sales-post) session still active?
>>
>> On Fri, Apr 3, 2015 at 3:36 PM, Marek Posolda <mposolda at redhat.com>
>> wrote:
>>
>>>  Switch the "Front channel logout" to off. In this case it should use
>>> backchannel (not redirecting through browser, but sending logout requests
>>> from Keycloak in background)
>>>
>>> Marek
>>>
>>>
>>>
>>> On 3.4.2015 08:28, Chen Keong Yap wrote:
>>>
>>>
>>>  Hi Merek,
>>>
>>>  I've tried frontChannel logout in 1.2.0.Beta1 and it's giving me the
>>> same issues, please refer to the settings shown in the screen shot.
>>>
>>>  Can you please advise how to test  backchannel logout?
>>>
>>>
>>>  [image: Inline image 1]
>>>
>>>
>>>
>>> On Fri, Apr 3, 2015 at 1:50 PM, Marek Posolda <mposolda at redhat.com>
>>> wrote:
>>>
>>>>  I would try to upgrade to latest 1.2.0.Beta1 as it has some related
>>>> fixes AFAIK.
>>>>
>>>> In this version, you have also possibility to setup either frontChannel
>>>> logout or backchannel logout for the application. It could be set in
>>>> Keycloak admin console. I think that at least one of them will work with SP
>>>> filter in latest version (if not both).
>>>>
>>>> Marek
>>>>
>>>>
>>>> On 3.4.2015 01:44, Chen Keong Yap wrote:
>>>>
>>>>   Hi,
>>>>
>>>>  I've 2 applications installed with Picketlink SPFilter to
>>>> authenticate with keycloak 1.1.0 beta 2.
>>>>
>>>>  When i perform global logout, first application was logged out
>>>> successfully because SP/keycloak session and application http session are
>>>> removed but the problem is second
>>>> application SP/keycloak session is removed but application http session
>>>> is still remained. I've set admin url for these 2 applications in keycloak
>>>> admin console. Kindly share your ideas.
>>>>
>>>>
>>>>
>>>>  _______________________________________________
>>>> keycloak-user mailing listkeycloak-user at lists.jboss.orghttps://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>
>>>>
>>>>
>>>
>>>
>>>
>>>
>>>
>>>
>>
>>
>>
>>
>>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150406/5613e8ad/attachment-0001.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: image/png
Size: 71582 bytes
Desc: not available
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20150406/5613e8ad/attachment-0001.png 

From kalinga at leapset.com  Mon Apr  6 08:13:42 2015
From: kalinga at leapset.com (Kalinga Dissanayake)
Date: Mon, 6 Apr 2015 17:43:42 +0530 (IST)
Subject: [keycloak-user] Externalising session storage in keycloak
Message-ID: <1428322422.154413249@apps.rackspace.com>


Guys i know this has been discussed before, but im trying to find a simple number of steps for me to externalize the session storage in keycloak.
I just need to do the following;
1. Two servers running keycloak (wildfly)
2. A load balancer in front of these two servers. Preferably an AWS loadbalancer
3. I need to store the session details on an external store so that the sessions work accurately.
 
There is so much documentation for this but I am actually confused as to what i should do and the bare minimum i should do to achieve this. I dont need a distributed cache or anything just need one cache store (may be infinispan or memcached) and the two keycloak servers running storing the sessions on that. Is there one key place i should look into which contains the bare minimum i should do.
 
Kalinga.
 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150406/b2086c0c/attachment.html 

From bburke at redhat.com  Mon Apr  6 09:31:59 2015
From: bburke at redhat.com (Bill Burke)
Date: Mon, 06 Apr 2015 09:31:59 -0400
Subject: [keycloak-user] Http Session is not invalidated
In-Reply-To: <CAC2UnuXFdbN_6W0CQh5TQ=3kMC1R-1ukrEM=MStWEQh9s=NebA@mail.gmail.com>
References: <CAC2UnuUrPd44VyqcvM6MPWUHUTVC-s8xY7=4cMJO1gyPBsRTfw@mail.gmail.com>
	<551E2A3C.8070006@redhat.com>
	<CAC2UnuV9O_xZzW25pz3utwVuA+eLcVrXF-rdTBs9iYij2R948g@mail.gmail.com>
	<551E42F7.9070404@redhat.com>
	<CAC2UnuVnVe4Znxauo1ngy8y5eY=9HELQTLc2a1ftRnBGsyG1YA@mail.gmail.com>
	<CAC2UnuWq_t1gyA7n-5SE33CmfojnpQA8iiYhNndpuxGp1au5Rg@mail.gmail.com>
	<CAC2UnuXFdbN_6W0CQh5TQ=3kMC1R-1ukrEM=MStWEQh9s=NebA@mail.gmail.com>
Message-ID: <55228ACF.6020809@redhat.com>

I'll try out the demo example.  One problem I did have with the 
Picketlink SP adapter is that the session was invalidated, but the 
principal was still available when redirecting back to the logout page. 
  Doesn't sound like this is your problem though.

On 4/6/2015 6:47 AM, Chen Keong Yap wrote:
> Hi bill,
>
> Global logout only removed sp sessions but not web application sessions
> and this created security loopholes.
>
> Please advise
>
> On Mon, Apr 6, 2015 at 6:41 AM, Chen Keong Yap <chenkeong.yap at izeno.com
> <mailto:chenkeong.yap at izeno.com>> wrote:
>
>     Guys,
>
>     Can share your ideas why global logout is not working?
>
>     On Apr 3, 2015 3:47 PM, "Chen Keong Yap" <chenkeong.yap at izeno.com
>     <mailto:chenkeong.yap at izeno.com>> wrote:
>
>         Hi Marek,
>
>         I've just tested backchannel logout and it's showing same issue.
>         Both applications are using PL SP Filter and the steps below are
>         used for testing.
>
>         1. Open https://localhost:8443/employee/ and http request is
>         redirected to
>         https://localhost:8443/auth/realms/saml-demo-1/protocol/saml
>
>         2. Enter username and password into keycloak login page and
>         redirected to employee landing page
>
>         3. Open https://localhost:8443/sales-post/ and redirected to
>         sales-post landing page without login
>
>         4. Logon to keycloak admin console and noticed there are 2
>         active sessions
>
>         5. Perform global logout from employee landing page
>         (https://localhost:8443/employee/?GLO=true) and http request is
>         redirected to
>         https://localhost:8443/auth/realms/saml-demo-1/protocol/saml
>
>         6. Logon to keycloak admin console and noticed all sessions are gone
>
>         7. Refresh sales-post landing page and it's not redirected to
>         keycloak login page. sales-post session still active.
>
>         Kindly advise why GLO is performed but the second application
>         (sales-post) session still active?
>
>         On Fri, Apr 3, 2015 at 3:36 PM, Marek Posolda
>         <mposolda at redhat.com <mailto:mposolda at redhat.com>> wrote:
>
>             Switch the "Front channel logout" to off. In this case it
>             should use backchannel (not redirecting through browser, but
>             sending logout requests from Keycloak in background)
>
>             Marek
>
>
>
>             On 3.4.2015 08:28, Chen Keong Yap wrote:
>>
>>             Hi Merek,
>>
>>             I've tried frontChannel logout in 1.2.0.Beta1 and it's
>>             giving me the same issues, please refer to the settings
>>             shown in the screen shot.
>>
>>             Can you please advise how to test  backchannel logout?
>>
>>
>>             Inline image 1
>>
>>
>>
>>             On Fri, Apr 3, 2015 at 1:50 PM, Marek Posolda
>>             <mposolda at redhat.com <mailto:mposolda at redhat.com>> wrote:
>>
>>                 I would try to upgrade to latest 1.2.0.Beta1 as it has
>>                 some related fixes AFAIK.
>>
>>                 In this version, you have also possibility to setup
>>                 either frontChannel logout or backchannel logout for
>>                 the application. It could be set in Keycloak admin
>>                 console. I think that at least one of them will work
>>                 with SP filter in latest version (if not both).
>>
>>                 Marek
>>
>>
>>                 On 3.4.2015 01:44, Chen Keong Yap wrote:
>>>                 Hi,
>>>
>>>                 I've 2 applications installed with Picketlink
>>>                 SPFilter to authenticate with keycloak 1.1.0 beta 2.
>>>
>>>                 When i perform global logout, first application was
>>>                 logged out successfully because SP/keycloak session
>>>                 and application http session are removed but the
>>>                 problem is second
>>>                 application SP/keycloak session is removed but
>>>                 application http session is still remained. I've set
>>>                 admin url for these 2 applications in keycloak admin
>>>                 console. Kindly share your ideas.
>>>
>>>
>>>
>>>                 _______________________________________________
>>>                 keycloak-user mailing list
>>>                 keycloak-user at lists.jboss.org  <mailto:keycloak-user at lists.jboss.org>
>>>                 https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>>
>>
>>
>>
>>
>
>
>
>
>
>
>
>

-- 
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com

From bburke at redhat.com  Mon Apr  6 09:56:30 2015
From: bburke at redhat.com (Bill Burke)
Date: Mon, 06 Apr 2015 09:56:30 -0400
Subject: [keycloak-user] Http Session is not invalidated
In-Reply-To: <CAC2UnuXFdbN_6W0CQh5TQ=3kMC1R-1ukrEM=MStWEQh9s=NebA@mail.gmail.com>
References: <CAC2UnuUrPd44VyqcvM6MPWUHUTVC-s8xY7=4cMJO1gyPBsRTfw@mail.gmail.com>
	<551E2A3C.8070006@redhat.com>
	<CAC2UnuV9O_xZzW25pz3utwVuA+eLcVrXF-rdTBs9iYij2R948g@mail.gmail.com>
	<551E42F7.9070404@redhat.com>
	<CAC2UnuVnVe4Znxauo1ngy8y5eY=9HELQTLc2a1ftRnBGsyG1YA@mail.gmail.com>
	<CAC2UnuWq_t1gyA7n-5SE33CmfojnpQA8iiYhNndpuxGp1au5Rg@mail.gmail.com>
	<CAC2UnuXFdbN_6W0CQh5TQ=3kMC1R-1ukrEM=MStWEQh9s=NebA@mail.gmail.com>
Message-ID: <5522908E.4060507@redhat.com>

I tried out the saml demo app and logout works just fine, so I'm 
guessing this is a bug in the PL SP Filter.

On 4/6/2015 6:47 AM, Chen Keong Yap wrote:
> Hi bill,
>
> Global logout only removed sp sessions but not web application sessions
> and this created security loopholes.
>
> Please advise
>
> On Mon, Apr 6, 2015 at 6:41 AM, Chen Keong Yap <chenkeong.yap at izeno.com
> <mailto:chenkeong.yap at izeno.com>> wrote:
>
>     Guys,
>
>     Can share your ideas why global logout is not working?
>
>     On Apr 3, 2015 3:47 PM, "Chen Keong Yap" <chenkeong.yap at izeno.com
>     <mailto:chenkeong.yap at izeno.com>> wrote:
>
>         Hi Marek,
>
>         I've just tested backchannel logout and it's showing same issue.
>         Both applications are using PL SP Filter and the steps below are
>         used for testing.
>
>         1. Open https://localhost:8443/employee/ and http request is
>         redirected to
>         https://localhost:8443/auth/realms/saml-demo-1/protocol/saml
>
>         2. Enter username and password into keycloak login page and
>         redirected to employee landing page
>
>         3. Open https://localhost:8443/sales-post/ and redirected to
>         sales-post landing page without login
>
>         4. Logon to keycloak admin console and noticed there are 2
>         active sessions
>
>         5. Perform global logout from employee landing page
>         (https://localhost:8443/employee/?GLO=true) and http request is
>         redirected to
>         https://localhost:8443/auth/realms/saml-demo-1/protocol/saml
>
>         6. Logon to keycloak admin console and noticed all sessions are gone
>
>         7. Refresh sales-post landing page and it's not redirected to
>         keycloak login page. sales-post session still active.
>
>         Kindly advise why GLO is performed but the second application
>         (sales-post) session still active?
>
>         On Fri, Apr 3, 2015 at 3:36 PM, Marek Posolda
>         <mposolda at redhat.com <mailto:mposolda at redhat.com>> wrote:
>
>             Switch the "Front channel logout" to off. In this case it
>             should use backchannel (not redirecting through browser, but
>             sending logout requests from Keycloak in background)
>
>             Marek
>
>
>
>             On 3.4.2015 08:28, Chen Keong Yap wrote:
>>
>>             Hi Merek,
>>
>>             I've tried frontChannel logout in 1.2.0.Beta1 and it's
>>             giving me the same issues, please refer to the settings
>>             shown in the screen shot.
>>
>>             Can you please advise how to test  backchannel logout?
>>
>>
>>             Inline image 1
>>
>>
>>
>>             On Fri, Apr 3, 2015 at 1:50 PM, Marek Posolda
>>             <mposolda at redhat.com <mailto:mposolda at redhat.com>> wrote:
>>
>>                 I would try to upgrade to latest 1.2.0.Beta1 as it has
>>                 some related fixes AFAIK.
>>
>>                 In this version, you have also possibility to setup
>>                 either frontChannel logout or backchannel logout for
>>                 the application. It could be set in Keycloak admin
>>                 console. I think that at least one of them will work
>>                 with SP filter in latest version (if not both).
>>
>>                 Marek
>>
>>
>>                 On 3.4.2015 01:44, Chen Keong Yap wrote:
>>>                 Hi,
>>>
>>>                 I've 2 applications installed with Picketlink
>>>                 SPFilter to authenticate with keycloak 1.1.0 beta 2.
>>>
>>>                 When i perform global logout, first application was
>>>                 logged out successfully because SP/keycloak session
>>>                 and application http session are removed but the
>>>                 problem is second
>>>                 application SP/keycloak session is removed but
>>>                 application http session is still remained. I've set
>>>                 admin url for these 2 applications in keycloak admin
>>>                 console. Kindly share your ideas.
>>>
>>>
>>>
>>>                 _______________________________________________
>>>                 keycloak-user mailing list
>>>                 keycloak-user at lists.jboss.org  <mailto:keycloak-user at lists.jboss.org>
>>>                 https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>>
>>
>>
>>
>>
>
>
>
>
>
>
>
>

-- 
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com

From chenkeong.yap at izeno.com  Mon Apr  6 09:01:30 2015
From: chenkeong.yap at izeno.com (Chen Keong Yap)
Date: Mon, 6 Apr 2015 21:01:30 +0800
Subject: [keycloak-user] Http Session is not invalidated
In-Reply-To: <5522908E.4060507@redhat.com>
References: <CAC2UnuUrPd44VyqcvM6MPWUHUTVC-s8xY7=4cMJO1gyPBsRTfw@mail.gmail.com>
	<551E2A3C.8070006@redhat.com>
	<CAC2UnuV9O_xZzW25pz3utwVuA+eLcVrXF-rdTBs9iYij2R948g@mail.gmail.com>
	<551E42F7.9070404@redhat.com>
	<CAC2UnuVnVe4Znxauo1ngy8y5eY=9HELQTLc2a1ftRnBGsyG1YA@mail.gmail.com>
	<CAC2UnuWq_t1gyA7n-5SE33CmfojnpQA8iiYhNndpuxGp1au5Rg@mail.gmail.com>
	<CAC2UnuXFdbN_6W0CQh5TQ=3kMC1R-1ukrEM=MStWEQh9s=NebA@mail.gmail.com>
	<5522908E.4060507@redhat.com>
Message-ID: <CAC2UnuVTJ1Zwsp=sdodf132QtFnZF3QtSML01tEh2Vb8M1pa-A@mail.gmail.com>

Hi bill,

Are you using 2 applications for testing?

If yes, need to know have you logged out the first application then
redirect to keycloak login page? After that refresh the second application
then redirect to keycloak login page?

Can i know which version of picketlink federation lib are you using?
On Apr 6, 2015 8:56 PM, "Bill Burke" <bburke at redhat.com> wrote:

> I tried out the saml demo app and logout works just fine, so I'm guessing
> this is a bug in the PL SP Filter.
>
> On 4/6/2015 6:47 AM, Chen Keong Yap wrote:
>
>> Hi bill,
>>
>> Global logout only removed sp sessions but not web application sessions
>> and this created security loopholes.
>>
>> Please advise
>>
>> On Mon, Apr 6, 2015 at 6:41 AM, Chen Keong Yap <chenkeong.yap at izeno.com
>> <mailto:chenkeong.yap at izeno.com>> wrote:
>>
>>     Guys,
>>
>>     Can share your ideas why global logout is not working?
>>
>>     On Apr 3, 2015 3:47 PM, "Chen Keong Yap" <chenkeong.yap at izeno.com
>>     <mailto:chenkeong.yap at izeno.com>> wrote:
>>
>>         Hi Marek,
>>
>>         I've just tested backchannel logout and it's showing same issue.
>>         Both applications are using PL SP Filter and the steps below are
>>         used for testing.
>>
>>         1. Open https://localhost:8443/employee/ and http request is
>>         redirected to
>>         https://localhost:8443/auth/realms/saml-demo-1/protocol/saml
>>
>>         2. Enter username and password into keycloak login page and
>>         redirected to employee landing page
>>
>>         3. Open https://localhost:8443/sales-post/ and redirected to
>>         sales-post landing page without login
>>
>>         4. Logon to keycloak admin console and noticed there are 2
>>         active sessions
>>
>>         5. Perform global logout from employee landing page
>>         (https://localhost:8443/employee/?GLO=true) and http request is
>>         redirected to
>>         https://localhost:8443/auth/realms/saml-demo-1/protocol/saml
>>
>>         6. Logon to keycloak admin console and noticed all sessions are
>> gone
>>
>>         7. Refresh sales-post landing page and it's not redirected to
>>         keycloak login page. sales-post session still active.
>>
>>         Kindly advise why GLO is performed but the second application
>>         (sales-post) session still active?
>>
>>         On Fri, Apr 3, 2015 at 3:36 PM, Marek Posolda
>>         <mposolda at redhat.com <mailto:mposolda at redhat.com>> wrote:
>>
>>             Switch the "Front channel logout" to off. In this case it
>>             should use backchannel (not redirecting through browser, but
>>             sending logout requests from Keycloak in background)
>>
>>             Marek
>>
>>
>>
>>             On 3.4.2015 08:28, Chen Keong Yap wrote:
>>
>>>
>>>             Hi Merek,
>>>
>>>             I've tried frontChannel logout in 1.2.0.Beta1 and it's
>>>             giving me the same issues, please refer to the settings
>>>             shown in the screen shot.
>>>
>>>             Can you please advise how to test  backchannel logout?
>>>
>>>
>>>             Inline image 1
>>>
>>>
>>>
>>>             On Fri, Apr 3, 2015 at 1:50 PM, Marek Posolda
>>>             <mposolda at redhat.com <mailto:mposolda at redhat.com>> wrote:
>>>
>>>                 I would try to upgrade to latest 1.2.0.Beta1 as it has
>>>                 some related fixes AFAIK.
>>>
>>>                 In this version, you have also possibility to setup
>>>                 either frontChannel logout or backchannel logout for
>>>                 the application. It could be set in Keycloak admin
>>>                 console. I think that at least one of them will work
>>>                 with SP filter in latest version (if not both).
>>>
>>>                 Marek
>>>
>>>
>>>                 On 3.4.2015 01:44, Chen Keong Yap wrote:
>>>
>>>>                 Hi,
>>>>
>>>>                 I've 2 applications installed with Picketlink
>>>>                 SPFilter to authenticate with keycloak 1.1.0 beta 2.
>>>>
>>>>                 When i perform global logout, first application was
>>>>                 logged out successfully because SP/keycloak session
>>>>                 and application http session are removed but the
>>>>                 problem is second
>>>>                 application SP/keycloak session is removed but
>>>>                 application http session is still remained. I've set
>>>>                 admin url for these 2 applications in keycloak admin
>>>>                 console. Kindly share your ideas.
>>>>
>>>>
>>>>
>>>>                 _______________________________________________
>>>>                 keycloak-user mailing list
>>>>                 keycloak-user at lists.jboss.org  <mailto:
>>>> keycloak-user at lists.jboss.org>
>>>>                 https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>
>>>
>>>
>>>
>>>
>>>
>>>
>>>
>>
>>
>>
>>
>>
>>
>>
>>
> --
> Bill Burke
> JBoss, a division of Red Hat
> http://bill.burkecentral.com
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150406/b3a42702/attachment-0001.html 

From bburke at redhat.com  Mon Apr  6 10:20:49 2015
From: bburke at redhat.com (Bill Burke)
Date: Mon, 06 Apr 2015 10:20:49 -0400
Subject: [keycloak-user] Http Session is not invalidated
In-Reply-To: <CAC2UnuVTJ1Zwsp=sdodf132QtFnZF3QtSML01tEh2Vb8M1pa-A@mail.gmail.com>
References: <CAC2UnuUrPd44VyqcvM6MPWUHUTVC-s8xY7=4cMJO1gyPBsRTfw@mail.gmail.com>	<551E2A3C.8070006@redhat.com>	<CAC2UnuV9O_xZzW25pz3utwVuA+eLcVrXF-rdTBs9iYij2R948g@mail.gmail.com>	<551E42F7.9070404@redhat.com>	<CAC2UnuVnVe4Znxauo1ngy8y5eY=9HELQTLc2a1ftRnBGsyG1YA@mail.gmail.com>	<CAC2UnuWq_t1gyA7n-5SE33CmfojnpQA8iiYhNndpuxGp1au5Rg@mail.gmail.com>	<CAC2UnuXFdbN_6W0CQh5TQ=3kMC1R-1ukrEM=MStWEQh9s=NebA@mail.gmail.com>	<5522908E.4060507@redhat.com>
	<CAC2UnuVTJ1Zwsp=sdodf132QtFnZF3QtSML01tEh2Vb8M1pa-A@mail.gmail.com>
Message-ID: <55229641.6090406@redhat.com>

Demos work fine for me, but I'm using the wildfly Picketlink SP adapter. 
  I am able to have an SSO session with all the examples, then I am able 
to logout and have all sessions invalidated.

On 4/6/2015 9:01 AM, Chen Keong Yap wrote:
> Hi bill,
>
> Are you using 2 applications for testing?
>
> If yes, need to know have you logged out the first application then
> redirect to keycloak login page? After that refresh the second
> application then redirect to keycloak login page?
>
> Can i know which version of picketlink federation lib are you using?
>
> On Apr 6, 2015 8:56 PM, "Bill Burke" <bburke at redhat.com
> <mailto:bburke at redhat.com>> wrote:
>
>     I tried out the saml demo app and logout works just fine, so I'm
>     guessing this is a bug in the PL SP Filter.
>
>     On 4/6/2015 6:47 AM, Chen Keong Yap wrote:
>
>         Hi bill,
>
>         Global logout only removed sp sessions but not web application
>         sessions
>         and this created security loopholes.
>
>         Please advise
>
>         On Mon, Apr 6, 2015 at 6:41 AM, Chen Keong Yap
>         <chenkeong.yap at izeno.com <mailto:chenkeong.yap at izeno.com>
>         <mailto:chenkeong.yap at izeno.__com
>         <mailto:chenkeong.yap at izeno.com>>> wrote:
>
>              Guys,
>
>              Can share your ideas why global logout is not working?
>
>              On Apr 3, 2015 3:47 PM, "Chen Keong Yap"
>         <chenkeong.yap at izeno.com <mailto:chenkeong.yap at izeno.com>
>              <mailto:chenkeong.yap at izeno.__com
>         <mailto:chenkeong.yap at izeno.com>>> wrote:
>
>                  Hi Marek,
>
>                  I've just tested backchannel logout and it's showing
>         same issue.
>                  Both applications are using PL SP Filter and the steps
>         below are
>                  used for testing.
>
>                  1. Open https://localhost:8443/__employee/
>         <https://localhost:8443/employee/> and http request is
>                  redirected to
>         https://localhost:8443/auth/__realms/saml-demo-1/protocol/__saml
>         <https://localhost:8443/auth/realms/saml-demo-1/protocol/saml>
>
>                  2. Enter username and password into keycloak login page and
>                  redirected to employee landing page
>
>                  3. Open https://localhost:8443/sales-__post/
>         <https://localhost:8443/sales-post/> and redirected to
>                  sales-post landing page without login
>
>                  4. Logon to keycloak admin console and noticed there are 2
>                  active sessions
>
>                  5. Perform global logout from employee landing page
>                  (https://localhost:8443/__employee/?GLO=true
>         <https://localhost:8443/employee/?GLO=true>) and http request is
>                  redirected to
>         https://localhost:8443/auth/__realms/saml-demo-1/protocol/__saml
>         <https://localhost:8443/auth/realms/saml-demo-1/protocol/saml>
>
>                  6. Logon to keycloak admin console and noticed all
>         sessions are gone
>
>                  7. Refresh sales-post landing page and it's not
>         redirected to
>                  keycloak login page. sales-post session still active.
>
>                  Kindly advise why GLO is performed but the second
>         application
>                  (sales-post) session still active?
>
>                  On Fri, Apr 3, 2015 at 3:36 PM, Marek Posolda
>                  <mposolda at redhat.com <mailto:mposolda at redhat.com>
>         <mailto:mposolda at redhat.com <mailto:mposolda at redhat.com>>> wrote:
>
>                      Switch the "Front channel logout" to off. In this
>         case it
>                      should use backchannel (not redirecting through
>         browser, but
>                      sending logout requests from Keycloak in background)
>
>                      Marek
>
>
>
>                      On 3.4.2015 08:28, Chen Keong Yap wrote:
>
>
>                          Hi Merek,
>
>                          I've tried frontChannel logout in 1.2.0.Beta1
>             and it's
>                          giving me the same issues, please refer to the
>             settings
>                          shown in the screen shot.
>
>                          Can you please advise how to test  backchannel
>             logout?
>
>
>                          Inline image 1
>
>
>
>                          On Fri, Apr 3, 2015 at 1:50 PM, Marek Posolda
>                          <mposolda at redhat.com
>             <mailto:mposolda at redhat.com> <mailto:mposolda at redhat.com
>             <mailto:mposolda at redhat.com>>> wrote:
>
>                              I would try to upgrade to latest
>             1.2.0.Beta1 as it has
>                              some related fixes AFAIK.
>
>                              In this version, you have also possibility
>             to setup
>                              either frontChannel logout or backchannel
>             logout for
>                              the application. It could be set in
>             Keycloak admin
>                              console. I think that at least one of them
>             will work
>                              with SP filter in latest version (if not both).
>
>                              Marek
>
>
>                              On 3.4.2015 01:44, Chen Keong Yap wrote:
>
>                                  Hi,
>
>                                  I've 2 applications installed with
>                 Picketlink
>                                  SPFilter to authenticate with keycloak
>                 1.1.0 beta 2.
>
>                                  When i perform global logout, first
>                 application was
>                                  logged out successfully because
>                 SP/keycloak session
>                                  and application http session are
>                 removed but the
>                                  problem is second
>                                  application SP/keycloak session is
>                 removed but
>                                  application http session is still
>                 remained. I've set
>                                  admin url for these 2 applications in
>                 keycloak admin
>                                  console. Kindly share your ideas.
>
>
>
>
>                 _________________________________________________
>                                  keycloak-user mailing list
>                 keycloak-user at lists.jboss.org
>                 <mailto:keycloak-user at lists.jboss.org>
>                 <mailto:keycloak-user at lists.__jboss.org
>                 <mailto:keycloak-user at lists.jboss.org>>
>                 https://lists.jboss.org/__mailman/listinfo/keycloak-user
>                 <https://lists.jboss.org/mailman/listinfo/keycloak-user>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>     --
>     Bill Burke
>     JBoss, a division of Red Hat
>     http://bill.burkecentral.com
>

-- 
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com

From John.Schneider at carrier.utc.com  Mon Apr  6 13:20:15 2015
From: John.Schneider at carrier.utc.com (Schneider, John           DODGE CONSULTING SERVICES, LLC)
Date: Mon, 6 Apr 2015 17:20:15 +0000
Subject: [keycloak-user] Apache Reverse Proxy in front of Keycloak Proxy
Message-ID: <D5998B55A61D334EA803FEB70395CFD70B14D7D0@UUSNWE3K.na.utcmail.com>

Hi,

I have Keycloak Proxy working well.  However, it's installed on machines that are not Internet-accessible and I need to put an Apache Reverse Proxy in front of it.  Installing the Keycloak Proxy on the externally-facing Apache servers is not an option for me. My issue is, Keycloak Proxy sends a redirect-URI to the auth server that is based on the bind-address value in the config.  I need the redirect URI sent to the Auth server to be the Apache reverse proxy.

Is there a clever way to do this, or is a feature addition needed to support this?  If the latter, then I suggest adding an optional property "redirect_base_address" to the config.

Thanks,
John
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150406/6636ade9/attachment.html 

From bburke at redhat.com  Mon Apr  6 14:29:36 2015
From: bburke at redhat.com (Bill Burke)
Date: Mon, 06 Apr 2015 14:29:36 -0400
Subject: [keycloak-user] Apache Reverse Proxy in front of Keycloak Proxy
In-Reply-To: <D5998B55A61D334EA803FEB70395CFD70B14D7D0@UUSNWE3K.na.utcmail.com>
References: <D5998B55A61D334EA803FEB70395CFD70B14D7D0@UUSNWE3K.na.utcmail.com>
Message-ID: <5522D090.5090800@redhat.com>

No, nothing right now to work around this.

On 4/6/2015 1:20 PM, Schneider, John DODGE CONSULTING SERVICES, LLC wrote:
> Hi,
>
> I have Keycloak Proxy working well.  However, it?s installed on machines
> that are not Internet-accessible and I need to put an Apache Reverse
> Proxy in front of it.  Installing the Keycloak Proxy on the
> externally-facing Apache servers is not an option for me. My issue is,
> Keycloak Proxy sends a redirect-URI to the auth server that is based on
> the bind-address value in the config.  I need the redirect URI sent to
> the Auth server to be the Apache reverse proxy.
>
> Is there a clever way to do this, or is a feature addition needed to
> support this?  If the latter, then I suggest adding an optional property
> ?redirect_base_address? to the config.
>
> Thanks,
>
> John
>
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

-- 
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com

From bburke at redhat.com  Mon Apr  6 14:31:57 2015
From: bburke at redhat.com (Bill Burke)
Date: Mon, 06 Apr 2015 14:31:57 -0400
Subject: [keycloak-user] Apache Reverse Proxy in front of Keycloak Proxy
In-Reply-To: <D5998B55A61D334EA803FEB70395CFD70B14D7D0@UUSNWE3K.na.utcmail.com>
References: <D5998B55A61D334EA803FEB70395CFD70B14D7D0@UUSNWE3K.na.utcmail.com>
Message-ID: <5522D11D.9010901@redhat.com>

https://issues.jboss.org/browse/KEYCLOAK-1180

Added a jira for this and scheduled. Still a month away from this though.

On 4/6/2015 1:20 PM, Schneider, John DODGE CONSULTING SERVICES, LLC wrote:
> Hi,
>
> I have Keycloak Proxy working well.  However, it?s installed on machines
> that are not Internet-accessible and I need to put an Apache Reverse
> Proxy in front of it.  Installing the Keycloak Proxy on the
> externally-facing Apache servers is not an option for me. My issue is,
> Keycloak Proxy sends a redirect-URI to the auth server that is based on
> the bind-address value in the config.  I need the redirect URI sent to
> the Auth server to be the Apache reverse proxy.
>
> Is there a clever way to do this, or is a feature addition needed to
> support this?  If the latter, then I suggest adding an optional property
> ?redirect_base_address? to the config.
>
> Thanks,
>
> John
>
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

-- 
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com

From tschneider at connecture.com  Mon Apr  6 14:38:55 2015
From: tschneider at connecture.com (Schneider, Tom)
Date: Mon, 6 Apr 2015 18:38:55 +0000
Subject: [keycloak-user] Running Liquibase updates via maven plugin
Message-ID: <BLUPR08MB31003F9533E8D887EFE766BB4FE0@BLUPR08MB310.namprd08.prod.outlook.com>

I'd like to populate a database for keycloak via the command line using the liquibase maven plugin.

With the latest master code, when I try to run this command:
mvn -f connections/jpa-liquibase/pom.xml liquibase:update -Durl=jdbc:h2:keycloak

I receive the following error message:
[ERROR] liquibase.exception.UnexpectedLiquibaseException: liquibase.exception.CustomChangeException: liquibase.exception.SetupException: No KeycloakSession provided in ThreadLocal

Am I missing some setup or is this no longer supported?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150406/a70717d7/attachment.html 

From adisari06 at yahoo.com  Mon Apr  6 17:43:41 2015
From: adisari06 at yahoo.com (Adil Arif)
Date: Mon, 6 Apr 2015 21:43:41 +0000 (UTC)
Subject: [keycloak-user] Curious about the Email constraint on UserEntity
Message-ID: <1707221802.602972.1428356621257.JavaMail.yahoo@mail.yahoo.com>

I have been testing Keycloak (1.1.0 Final) federation ability against some of our existing user databases. I came across the unique email address constraint in the UserEntity table. What is the reasoning behind email addresses being unique?

Our particular use case is that a user can create multiple usernames and have the same email address across many of them if they choose to.
Adil Arif
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150406/c081e28a/attachment-0001.html 

From thomas_connolly at yahoo.com  Mon Apr  6 20:10:33 2015
From: thomas_connolly at yahoo.com (Thomas Connolly)
Date: Tue, 7 Apr 2015 00:10:33 +0000 (UTC)
Subject: [keycloak-user] Using Informix DB with Keycloak ...
Message-ID: <173304705.803869.1428365433517.JavaMail.yahoo@mail.yahoo.com>

Hi All
As part of a standardisation process, I'm trying to get Keycloak working with Informix DB, the enterprise DB!I understand that Keycloak does not officially support Informix however given the use of JPA / Hibernate I though there was a good chance it would work out of the box.However this has proven not the case. The connection dialect does indeed recognise Informix but does not appear to correctly map to this DB.
The issue I've come across is the handling of boolean conditional in SQL.
In RoleEntry.java the query? ? ? ? @NamedQuery(name="getRealmRoleByName", query="select role from RoleEntity role where role.applicationRole = false and role.name = :name and role.realm = :realm")
Generates the following?select? ? ? ? roleentity0_.id as id1_15_,? ? ? ? roleentity0_.APP_REALM_CONSTRAINT as APP_REAL2_15_,? ? ? ? roleentity0_.APPLICATION as APPLICAT7_15_,? ? ? ? roleentity0_.APPLICATION_ROLE as APPLICAT3_15_,? ? ? ? roleentity0_.DESCRIPTION as DESCRIPT4_15_,? ? ? ? roleentity0_.NAME as NAME5_15_,? ? ? ? roleentity0_.REALM as REALM8_15_,? ? ? ? roleentity0_.REALM_ID as REALM_ID6_15_?? ? from? ? ? ? KEYCLOAK_ROLE roleentity0_?? ? where? ? ? ? roleentity0_.APPLICATION_ROLE=0?The above does not work with Informix as 't', 'f', true and false respectively is used. So it should be? ? where? ? ? ??roleentity0_.APPLICATION_ROLE='f'
Looking through the code, it appears I cannot configure this. Happy to be proven wrong here!I found I could override within Hibernate using the property? ? hibernate.query.substitutions=true t, false f

I've added this change into DefaultJpaConnectionProviderFactory.java?
 String querySubstitutions = config.get("querySubstitutions"); if (querySubstitutions != null) { logger.debug("hibernate.query.substitutions=" + querySubstitutions);? ? properties.put("hibernate.query.substitutions", querySubstitutions); }
Adding the setting in?keycloak-server.json? ? "connectionsJpa": {? ? ? ? "default": {? ? ? ? ? ? "dataSource": "java:jboss/datasources/KeycloakDS",? ? ? ? ? ? "databaseSchema": "update", "querySubstitutions" : "true t, false f"? ? ? ? }
However I've found the translation is not occurring as I would have expected.?
Can you please advise on the approach I'm taking or any alternatives I have not looked into?
Also once we get this working with Informix how can I get it added to the supported DB list?
Regards
 Tom Connolly.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150407/e49c6971/attachment.html 

From chenkeong.yap at izeno.com  Mon Apr  6 20:37:17 2015
From: chenkeong.yap at izeno.com (Chen Keong Yap)
Date: Tue, 7 Apr 2015 08:37:17 +0800
Subject: [keycloak-user] Http Session is not invalidated
In-Reply-To: <55229641.6090406@redhat.com>
References: <CAC2UnuUrPd44VyqcvM6MPWUHUTVC-s8xY7=4cMJO1gyPBsRTfw@mail.gmail.com>
	<551E2A3C.8070006@redhat.com>
	<CAC2UnuV9O_xZzW25pz3utwVuA+eLcVrXF-rdTBs9iYij2R948g@mail.gmail.com>
	<551E42F7.9070404@redhat.com>
	<CAC2UnuVnVe4Znxauo1ngy8y5eY=9HELQTLc2a1ftRnBGsyG1YA@mail.gmail.com>
	<CAC2UnuWq_t1gyA7n-5SE33CmfojnpQA8iiYhNndpuxGp1au5Rg@mail.gmail.com>
	<CAC2UnuXFdbN_6W0CQh5TQ=3kMC1R-1ukrEM=MStWEQh9s=NebA@mail.gmail.com>
	<5522908E.4060507@redhat.com>
	<CAC2UnuVTJ1Zwsp=sdodf132QtFnZF3QtSML01tEh2Vb8M1pa-A@mail.gmail.com>
	<55229641.6090406@redhat.com>
Message-ID: <CAC2UnuWdqCrcFf-v=UT55bKEjHmm195yE09smwLyPzy=tQO0kg@mail.gmail.com>

Hi bill,

Can you give me the link or path for the demo? Not sure if you are using
keycloak or picketlink demo for testing?
On Apr 6, 2015 9:20 PM, "Bill Burke" <bburke at redhat.com> wrote:

> Demos work fine for me, but I'm using the wildfly Picketlink SP adapter.
> I am able to have an SSO session with all the examples, then I am able to
> logout and have all sessions invalidated.
>
> On 4/6/2015 9:01 AM, Chen Keong Yap wrote:
>
>> Hi bill,
>>
>> Are you using 2 applications for testing?
>>
>> If yes, need to know have you logged out the first application then
>> redirect to keycloak login page? After that refresh the second
>> application then redirect to keycloak login page?
>>
>> Can i know which version of picketlink federation lib are you using?
>>
>> On Apr 6, 2015 8:56 PM, "Bill Burke" <bburke at redhat.com
>> <mailto:bburke at redhat.com>> wrote:
>>
>>     I tried out the saml demo app and logout works just fine, so I'm
>>     guessing this is a bug in the PL SP Filter.
>>
>>     On 4/6/2015 6:47 AM, Chen Keong Yap wrote:
>>
>>         Hi bill,
>>
>>         Global logout only removed sp sessions but not web application
>>         sessions
>>         and this created security loopholes.
>>
>>         Please advise
>>
>>         On Mon, Apr 6, 2015 at 6:41 AM, Chen Keong Yap
>>         <chenkeong.yap at izeno.com <mailto:chenkeong.yap at izeno.com>
>>         <mailto:chenkeong.yap at izeno.__com
>>         <mailto:chenkeong.yap at izeno.com>>> wrote:
>>
>>              Guys,
>>
>>              Can share your ideas why global logout is not working?
>>
>>              On Apr 3, 2015 3:47 PM, "Chen Keong Yap"
>>         <chenkeong.yap at izeno.com <mailto:chenkeong.yap at izeno.com>
>>              <mailto:chenkeong.yap at izeno.__com
>>         <mailto:chenkeong.yap at izeno.com>>> wrote:
>>
>>                  Hi Marek,
>>
>>                  I've just tested backchannel logout and it's showing
>>         same issue.
>>                  Both applications are using PL SP Filter and the steps
>>         below are
>>                  used for testing.
>>
>>                  1. Open https://localhost:8443/__employee/
>>         <https://localhost:8443/employee/> and http request is
>>                  redirected to
>>         https://localhost:8443/auth/__realms/saml-demo-1/protocol/__saml
>>         <https://localhost:8443/auth/realms/saml-demo-1/protocol/saml>
>>
>>                  2. Enter username and password into keycloak login page
>> and
>>                  redirected to employee landing page
>>
>>                  3. Open https://localhost:8443/sales-__post/
>>         <https://localhost:8443/sales-post/> and redirected to
>>                  sales-post landing page without login
>>
>>                  4. Logon to keycloak admin console and noticed there are
>> 2
>>                  active sessions
>>
>>                  5. Perform global logout from employee landing page
>>                  (https://localhost:8443/__employee/?GLO=true
>>         <https://localhost:8443/employee/?GLO=true>) and http request is
>>                  redirected to
>>         https://localhost:8443/auth/__realms/saml-demo-1/protocol/__saml
>>         <https://localhost:8443/auth/realms/saml-demo-1/protocol/saml>
>>
>>                  6. Logon to keycloak admin console and noticed all
>>         sessions are gone
>>
>>                  7. Refresh sales-post landing page and it's not
>>         redirected to
>>                  keycloak login page. sales-post session still active.
>>
>>                  Kindly advise why GLO is performed but the second
>>         application
>>                  (sales-post) session still active?
>>
>>                  On Fri, Apr 3, 2015 at 3:36 PM, Marek Posolda
>>                  <mposolda at redhat.com <mailto:mposolda at redhat.com>
>>         <mailto:mposolda at redhat.com <mailto:mposolda at redhat.com>>> wrote:
>>
>>                      Switch the "Front channel logout" to off. In this
>>         case it
>>                      should use backchannel (not redirecting through
>>         browser, but
>>                      sending logout requests from Keycloak in background)
>>
>>                      Marek
>>
>>
>>
>>                      On 3.4.2015 08:28, Chen Keong Yap wrote:
>>
>>
>>                          Hi Merek,
>>
>>                          I've tried frontChannel logout in 1.2.0.Beta1
>>             and it's
>>                          giving me the same issues, please refer to the
>>             settings
>>                          shown in the screen shot.
>>
>>                          Can you please advise how to test  backchannel
>>             logout?
>>
>>
>>                          Inline image 1
>>
>>
>>
>>                          On Fri, Apr 3, 2015 at 1:50 PM, Marek Posolda
>>                          <mposolda at redhat.com
>>             <mailto:mposolda at redhat.com> <mailto:mposolda at redhat.com
>>             <mailto:mposolda at redhat.com>>> wrote:
>>
>>                              I would try to upgrade to latest
>>             1.2.0.Beta1 as it has
>>                              some related fixes AFAIK.
>>
>>                              In this version, you have also possibility
>>             to setup
>>                              either frontChannel logout or backchannel
>>             logout for
>>                              the application. It could be set in
>>             Keycloak admin
>>                              console. I think that at least one of them
>>             will work
>>                              with SP filter in latest version (if not
>> both).
>>
>>                              Marek
>>
>>
>>                              On 3.4.2015 01:44, Chen Keong Yap wrote:
>>
>>                                  Hi,
>>
>>                                  I've 2 applications installed with
>>                 Picketlink
>>                                  SPFilter to authenticate with keycloak
>>                 1.1.0 beta 2.
>>
>>                                  When i perform global logout, first
>>                 application was
>>                                  logged out successfully because
>>                 SP/keycloak session
>>                                  and application http session are
>>                 removed but the
>>                                  problem is second
>>                                  application SP/keycloak session is
>>                 removed but
>>                                  application http session is still
>>                 remained. I've set
>>                                  admin url for these 2 applications in
>>                 keycloak admin
>>                                  console. Kindly share your ideas.
>>
>>
>>
>>
>>                 _________________________________________________
>>                                  keycloak-user mailing list
>>                 keycloak-user at lists.jboss.org
>>                 <mailto:keycloak-user at lists.jboss.org>
>>                 <mailto:keycloak-user at lists.__jboss.org
>>                 <mailto:keycloak-user at lists.jboss.org>>
>>                 https://lists.jboss.org/__mailman/listinfo/keycloak-user
>>                 <https://lists.jboss.org/mailman/listinfo/keycloak-user>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>     --
>>     Bill Burke
>>     JBoss, a division of Red Hat
>>     http://bill.burkecentral.com
>>
>>
> --
> Bill Burke
> JBoss, a division of Red Hat
> http://bill.burkecentral.com
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150407/275a9d7e/attachment-0001.html 

From stian at redhat.com  Tue Apr  7 02:20:57 2015
From: stian at redhat.com (Stian Thorgersen)
Date: Tue, 7 Apr 2015 02:20:57 -0400 (EDT)
Subject: [keycloak-user] Externalising session storage in keycloak
In-Reply-To: <1428322422.154413249@apps.rackspace.com>
References: <1428322422.154413249@apps.rackspace.com>
Message-ID: <1715592343.13219857.1428387657008.JavaMail.zimbra@redhat.com>

We have support for using either Infinispan or a database (relational or Mongo) to store the user sessions when load balanced.

If performance is not a problem you can just go with storing sessions in the database. Otherwise go with Infinispan, see http://docs.jboss.org/keycloak/docs/1.2.0.Beta1/userguide/html/clustering.html for the details on how to configure that. To use a replicated cache instead of a distributed cache use the following config for Infinspan:

<subsystem xmlns="urn:jboss:domain:infinispan:2.0">
    <cache-container name="keycloak" jndi-name="infinispan/Keycloak" start="EAGER">
        <transport lock-timeout="60000"/>
        <invalidation-cache name="realms" mode="SYNC"/>
        <invalidation-cache name="users" mode="SYNC"/>
        <replicated-cachename="sessions" mode="SYNC"/>
        <replicated-cache name="loginFailures" mode="SYNC"/>
    </cache-container>
    ...
</subsystem>

You can also just use the configuration from the docs above but set 'owners="2"'.

----- Original Message -----
> From: "Kalinga Dissanayake" <kalinga at leapset.com>
> To: keycloak-user at lists.jboss.org
> Cc: "Stian Thorgersen" <stian at redhat.com>
> Sent: Monday, 6 April, 2015 2:13:42 PM
> Subject: Externalising session storage in keycloak
> 
> 
> Guys i know this has been discussed before, but im trying to find a simple
> number of steps for me to externalize the session storage in keycloak.
> I just need to do the following;
> 1. Two servers running keycloak (wildfly)
> 2. A load balancer in front of these two servers. Preferably an AWS
> loadbalancer
> 3. I need to store the session details on an external store so that the
> sessions work accurately.
>  
> There is so much documentation for this but I am actually confused as to what
> i should do and the bare minimum i should do to achieve this. I dont need a
> distributed cache or anything just need one cache store (may be infinispan
> or memcached) and the two keycloak servers running storing the sessions on
> that. Is there one key place i should look into which contains the bare
> minimum i should do.
>  
> Kalinga.
> 

From stian at redhat.com  Tue Apr  7 02:38:25 2015
From: stian at redhat.com (Stian Thorgersen)
Date: Tue, 7 Apr 2015 02:38:25 -0400 (EDT)
Subject: [keycloak-user] Application Management
In-Reply-To: <CAHDpToXP5P==Qm7bHa=Fwa9QmFihVjtkDh9EuvozXN+fG9JTWw@mail.gmail.com>
References: <CAHDpToU94_F930cgJjNFtWe7wyEuJx_cHo1+bGL0enaUNAJxNw@mail.gmail.com>
	<235824875.3863019.1427201098648.JavaMail.zimbra@redhat.com>
	<CAHDpToUsdDRdHo2pPBaQTVSZuKy7ewEC1SREK0x0wLDX=pnxgQ@mail.gmail.com>
	<CAHDpToUx-k3FyXc2QVY_AwG3UjwCzrUdr=7KxzdUzshx_BpvaQ@mail.gmail.com>
	<596874598.6524658.1427432321791.JavaMail.zimbra@redhat.com>
	<CAHDpToX0-FbxM_QmHHtDRjNa+A5Fs4+msnR_=U0u-Ug6Ktiyow@mail.gmail.com>
	<1915332308.6796315.1427464264502.JavaMail.zimbra@redhat.com>
	<CAHDpToXP5P==Qm7bHa=Fwa9QmFihVjtkDh9EuvozXN+fG9JTWw@mail.gmail.com>
Message-ID: <657783737.13228908.1428388705228.JavaMail.zimbra@redhat.com>

What's the purpose of app-admin?

----- Original Message -----
> From: "Thiago Presa" <thiago.addevico at gmail.com>
> To: "Stian Thorgersen" <stian at redhat.com>
> Cc: keycloak-user at lists.jboss.org
> Sent: Wednesday, 1 April, 2015 7:33:26 PM
> Subject: Re: [keycloak-user] Application Management
> 
> Speaking with my colleagues, I believe it won't cause troubles for us. We
> had to give view-applications: the admin console wouldn't work properly,
> but this is also OK according to our requirements.
> 
> Would you mind giving us some feedback on [1]? We wrote this to experiment
> a bit with the proposal, but I'm not familiar with keycloak's source or
> practices. What should I do to help get this merged?
> 
> [1] https://github.com/keycloak/keycloak/compare/master...tpresa:master
> 
> On Fri, Mar 27, 2015 at 10:51 AM, Stian Thorgersen <stian at redhat.com> wrote:
> 
> >
> >
> > ----- Original Message -----
> > > From: "Thiago Presa" <thiago.addevico at gmail.com>
> > > To: "Stian Thorgersen" <stian at redhat.com>
> > > Cc: keycloak-user at lists.jboss.org
> > > Sent: Friday, 27 March, 2015 2:01:56 PM
> > > Subject: Re: [keycloak-user] Application Management
> > >
> > > Ah, yes, I didn't understand your proposal properly. Wouldn't giving
> > > manage-users to app-admins wouldn't cause trouble, since app-admins could
> > > create and modify user accounts?
> >
> > Whether or not it's causing trouble depends on your requirements, but yes,
> > they could create and modify user accounts, but not grant more privileges.
> >
> > If you need to go beyond this one alternative is to wrap the admin
> > endpoints in your own application. We've just got so much on our plate at
> > the moment that we can't provide this level of control on permissions.
> >
> > >
> > > On Fri, Mar 27, 2015 at 1:58 AM, Stian Thorgersen <stian at redhat.com>
> > wrote:
> > >
> > > > Well, yes.. I told you it was a bit rubbish and would need some
> > re-design
> > > > to implement more fine grained permissions. Doing that is a relatively
> > big
> > > > task and is not a high priority for us ATM.
> > > >
> > > > I'm a bit confused by this email as I proposed a simple solution that
> > > > would resolve your requirements. If an admin can only grant permissions
> > > > that admin has access to all you have to do is to create an admin that
> > can
> > > > only access roles for certain applications and your problem should be
> > > > solved. That's a simple solution that we can add soon.
> > > >
> > > > ----- Original Message -----
> > > > > From: "Thiago Presa" <thiago.addevico at gmail.com>
> > > > > To: "Stian Thorgersen" <stian at redhat.com>
> > > > > Cc: keycloak-user at lists.jboss.org
> > > > > Sent: Thursday, 26 March, 2015 8:10:07 PM
> > > > > Subject: Re: [keycloak-user] Application Management
> > > > >
> > > > > So I've spent the last couple of days playing with the source. :-)
> > > > >
> > > > > The current authorization mechanism is based on Realm/RealmApp i.e.
> > > > > whenever an API resource is called, check if the User has the
> > required
> > > > > Right (manage, any, view) in the resource's Realm/RealmApp.
> > > > >
> > > > > Consider, for example, the URI
> > > > >
> > /admin/realms/{realm}/applications-by-id/{app-name}/roles/{role-name}.
> > > > What
> > > > > I was trying to do is to create a permission for {app-name} so that
> > this
> > > > > API call wouldn't require any Realm/RealmApp right.
> > > > >
> > > > > The problem I see is that this API call trigger many methods (i.e.
> > > > > AdminRoot#getRealmsAdmin, RealmsAdminResource#getRealmAdmin,
> > > > > RealmAdminResource#getApplicationsById, and so on...), and at those
> > > > methods
> > > > > there is not enough information to figure out whether this is:
> > > > >
> > > > > 1- An app-specific call and thus should be authorized even without
> > realm
> > > > > authorization, or;
> > > > > 2- Not app-specific call and this should be properly authorized by
> > > > > Realm/RealmApp.
> > > > >
> > > > > Even in the case of (1), the information on which app should I check
> > for
> > > > > authorization is not available.
> > > > >
> > > > > So it seems to me that this resource-loading mechanisms pressuposes
> > an
> > > > > authorization mechanism that checks only against the realm for
> > > > permission,
> > > > > and changing this seems daunting to me.
> > > > >
> > > > > Do you guys have any idea on a more local change I could make to
> > achieve
> > > > > the intended behavior?
> > > > >
> > > > > On Tue, Mar 24, 2015 at 2:33 PM, Thiago Presa <
> > thiago.addevico at gmail.com
> > > > >
> > > > > wrote:
> > > > >
> > > > > > OK, agreed. We thought this out of consistency, but if that's not a
> > > > good
> > > > > > design we surely can consider a better one.
> > > > > >
> > > > > > On Tue, Mar 24, 2015 at 9:44 AM, Stian Thorgersen <
> > stian at redhat.com>
> > > > > > wrote:
> > > > > >
> > > > > >>
> > > > > >>
> > > > > >> ----- Original Message -----
> > > > > >> > From: "Thiago Presa" <thiago.addevico at gmail.com>
> > > > > >> > To: stian at redhat.com
> > > > > >> > Cc: keycloak-user at lists.jboss.org
> > > > > >> > Sent: Tuesday, 24 March, 2015 1:41:16 PM
> > > > > >> > Subject: Re: [keycloak-user] Application Management
> > > > > >> >
> > > > > >> > Hi there,
> > > > > >> >
> > > > > >> > I'm Alex's coworker and I'll be working on this too.
> > > > > >> >
> > > > > >> > We were just discussing your idea, and it seems to fit our
> > > > requirements.
> > > > > >> >
> > > > > >> > As far as we have seen, keycloak already has a realm-admin
> > concept.
> > > > > >> > Whenever a realm "R" is created, it creates a R-realm
> > application
> > > > with
> > > > > >> > a bunch of default roles (manage-users, manage-roles, etc.)
> > into the
> > > > > >> > realm master.
> > > > > >> >
> > > > > >> > We are currently thinking if we could mimic this structure for
> > > > > >> > applications. What do you think?
> > > > > >>
> > > > > >> It's already messy with the way I modelled it and adding the same
> > for
> > > > > >> applications would be even worse. I don't see why that's needed
> > > > though if
> > > > > >> we'd add what I proposed.
> > > > > >>
> > > > > >> >
> > > > > >> > > I had an idea a while back that is a simple way to achieve
> > what
> > > > you're
> > > > > >> > > asking for. Th> e idea would be to only allow an admin to
> > grant
> > > > roles
> > > > > >> that
> > > > > >> > > the admin has access to.
> > > > > >> >
> > > > > >> > > Basically:> * A user with admin (super user) role can grant
> > any
> > > > roles
> > > > > >> (we
> > > > > >> > > would need to add a per-> realm super user role)
> > > > > >> >
> > > > > >> > > * A user with the role manage-users and some roles on app1 can
> > > > only
> > > > > >> grant
> > > > > >> > > other users > the roles on app1
> > > > > >> >
> > > > > >> > > * A user with the role manage-users and some roles on app2 can
> > > > only
> > > > > >> grant
> > > > > >> > > other users > the roles on app2
> > > > > >> >
> > > > > >> > >
> > > > > >> >
> > > > > >> > > This is something we should add in either case (to prevent
> > users
> > > > > >> granting
> > > > > >> > themselves more access). Would it solve your problems?
> > > > > >> >
> > > > > >>
> > > > > >
> > > > > >
> > > > >
> > > >
> > >
> >
> 

From stian at redhat.com  Tue Apr  7 03:02:17 2015
From: stian at redhat.com (Stian Thorgersen)
Date: Tue, 7 Apr 2015 03:02:17 -0400 (EDT)
Subject: [keycloak-user] Curious about the Email constraint on UserEntity
In-Reply-To: <1707221802.602972.1428356621257.JavaMail.yahoo@mail.yahoo.com>
References: <1707221802.602972.1428356621257.JavaMail.yahoo@mail.yahoo.com>
Message-ID: <1601687592.13235120.1428390137576.JavaMail.zimbra@redhat.com>

As we allow login using email it has to be unique

----- Original Message -----
> From: "Adil Arif" <adisari06 at yahoo.com>
> To: keycloak-user at lists.jboss.org
> Sent: Monday, 6 April, 2015 11:43:41 PM
> Subject: [keycloak-user] Curious about the Email constraint on UserEntity
> 
> I have been testing Keycloak (1.1.0 Final) federation ability against some of
> our existing user databases. I came across the unique email address
> constraint in the UserEntity table. What is the reasoning behind email
> addresses being unique?
> 
> Our particular use case is that a user can create multiple usernames and have
> the same email address across many of them if they choose to.
> 
> Adil Arif
> 
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From stian at redhat.com  Tue Apr  7 03:09:05 2015
From: stian at redhat.com (Stian Thorgersen)
Date: Tue, 7 Apr 2015 03:09:05 -0400 (EDT)
Subject: [keycloak-user] Using Informix DB with Keycloak ...
In-Reply-To: <173304705.803869.1428365433517.JavaMail.yahoo@mail.yahoo.com>
References: <173304705.803869.1428365433517.JavaMail.yahoo@mail.yahoo.com>
Message-ID: <493030664.13237004.1428390545942.JavaMail.zimbra@redhat.com>

To start with we can most likely accept PRs to make Informix to work, but we can't support all dbs out there.

That being said it looks like either the Informix dialect is not being used, or it's not working properly. What you've done below hibernate.query.substitutions should be taken care of by Hibernate dialects.

Try setting the "driverDialect" to org.hibernate.dialect.InformixDialect and see if you're still having issues.

Another problem you may encounter is that Liquibase change-sets may need to be tweaked to work with Informix.

----- Original Message -----
> From: "Thomas Connolly" <thomas_connolly at yahoo.com>
> To: keycloak-user at lists.jboss.org
> Sent: Tuesday, 7 April, 2015 2:10:33 AM
> Subject: [keycloak-user] Using Informix DB with Keycloak ...
> 
> Hi All
> 
> As part of a standardisation process, I'm trying to get Keycloak working with
> Informix DB, the enterprise DB!
> I understand that Keycloak does not officially support Informix however given
> the use of JPA / Hibernate I though there was a good chance it would work
> out of the box.
> However this has proven not the case. The connection dialect does indeed
> recognise Informix but does not appear to correctly map to this DB.
> 
> The issue I've come across is the handling of boolean conditional in SQL.
> 
> In RoleEntry.java the query
> @NamedQuery(name="getRealmRoleByName", query="select role from RoleEntity
> role where role.applicationRole = false and role.name = :name and role.realm
> = :realm")
> 
> Generates the following
> select
> roleentity0_.id as id1_15_,
> roleentity0_.APP_REALM_CONSTRAINT as APP_REAL2_15_,
> roleentity0_.APPLICATION as APPLICAT7_15_,
> roleentity0_.APPLICATION_ROLE as APPLICAT3_15_,
> roleentity0_.DESCRIPTION as DESCRIPT4_15_,
> roleentity0_.NAME as NAME5_15_,
> roleentity0_.REALM as REALM8_15_,
> roleentity0_.REALM_ID as REALM_ID6_15_
> from
> KEYCLOAK_ROLE roleentity0_
> where
> roleentity0_.APPLICATION_ROLE=0
> The above does not work with Informix as 't', 'f', true and false
> respectively is used. So it should be
> where
> roleentity0_.APPLICATION_ROLE='f'
> 
> Looking through the code, it appears I cannot configure this. Happy to be
> proven wrong here!
> I found I could override within Hibernate using the property
> hibernate.query.substitutions=true t, false f
> 
> I've added this change into DefaultJpaConnectionProviderFactory.java
> 
> String querySubstitutions = config.get("querySubstitutions");
> if (querySubstitutions != null) {
> logger.debug("hibernate.query.substitutions=" + querySubstitutions);
> properties.put("hibernate.query.substitutions", querySubstitutions);
> }
> 
> Adding the setting in keycloak-server.json
> "connectionsJpa": {
> "default": {
> "dataSource": "java:jboss/datasources/KeycloakDS",
> "databaseSchema": "update",
> "querySubstitutions" : "true t, false f"
> }
> 
> However I've found the translation is not occurring as I would have expected.
> 
> Can you please advise on the approach I'm taking or any alternatives I have
> not looked into?
> 
> Also once we get this working with Informix how can I get it added to the
> supported DB list?
> 
> Regards
> Tom Connolly.
> 
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From mposolda at redhat.com  Tue Apr  7 03:20:57 2015
From: mposolda at redhat.com (Marek Posolda)
Date: Tue, 07 Apr 2015 09:20:57 +0200
Subject: [keycloak-user] Http Session is not invalidated
In-Reply-To: <CAC2UnuWdqCrcFf-v=UT55bKEjHmm195yE09smwLyPzy=tQO0kg@mail.gmail.com>
References: <CAC2UnuUrPd44VyqcvM6MPWUHUTVC-s8xY7=4cMJO1gyPBsRTfw@mail.gmail.com>	<551E2A3C.8070006@redhat.com>	<CAC2UnuV9O_xZzW25pz3utwVuA+eLcVrXF-rdTBs9iYij2R948g@mail.gmail.com>	<551E42F7.9070404@redhat.com>	<CAC2UnuVnVe4Znxauo1ngy8y5eY=9HELQTLc2a1ftRnBGsyG1YA@mail.gmail.com>	<CAC2UnuWq_t1gyA7n-5SE33CmfojnpQA8iiYhNndpuxGp1au5Rg@mail.gmail.com>	<CAC2UnuXFdbN_6W0CQh5TQ=3kMC1R-1ukrEM=MStWEQh9s=NebA@mail.gmail.com>	<5522908E.4060507@redhat.com>	<CAC2UnuVTJ1Zwsp=sdodf132QtFnZF3QtSML01tEh2Vb8M1pa-A@mail.gmail.com>	<55229641.6090406@redhat.com>
	<CAC2UnuWdqCrcFf-v=UT55bKEjHmm195yE09smwLyPzy=tQO0kg@mail.gmail.com>
Message-ID: <55238559.4040902@redhat.com>

The demo is bundled in keycloak-appliance-dist ZIP in directory 
examples/saml .

The demo sources are here: 
https://github.com/keycloak/keycloak/tree/master/examples/saml

Marek

On 7.4.2015 02:37, Chen Keong Yap wrote:
>
> Hi bill,
>
> Can you give me the link or path for the demo? Not sure if you are 
> using keycloak or picketlink demo for testing?
>
> On Apr 6, 2015 9:20 PM, "Bill Burke" <bburke at redhat.com 
> <mailto:bburke at redhat.com>> wrote:
>
>     Demos work fine for me, but I'm using the wildfly Picketlink SP
>     adapter. I am able to have an SSO session with all the examples,
>     then I am able to logout and have all sessions invalidated.
>
>     On 4/6/2015 9:01 AM, Chen Keong Yap wrote:
>
>         Hi bill,
>
>         Are you using 2 applications for testing?
>
>         If yes, need to know have you logged out the first application
>         then
>         redirect to keycloak login page? After that refresh the second
>         application then redirect to keycloak login page?
>
>         Can i know which version of picketlink federation lib are you
>         using?
>
>         On Apr 6, 2015 8:56 PM, "Bill Burke" <bburke at redhat.com
>         <mailto:bburke at redhat.com>
>         <mailto:bburke at redhat.com <mailto:bburke at redhat.com>>> wrote:
>
>             I tried out the saml demo app and logout works just fine,
>         so I'm
>             guessing this is a bug in the PL SP Filter.
>
>             On 4/6/2015 6:47 AM, Chen Keong Yap wrote:
>
>                 Hi bill,
>
>                 Global logout only removed sp sessions but not web
>         application
>                 sessions
>                 and this created security loopholes.
>
>                 Please advise
>
>                 On Mon, Apr 6, 2015 at 6:41 AM, Chen Keong Yap
>                 <chenkeong.yap at izeno.com
>         <mailto:chenkeong.yap at izeno.com>
>         <mailto:chenkeong.yap at izeno.com <mailto:chenkeong.yap at izeno.com>>
>                 <mailto:chenkeong.yap at izeno.
>         <mailto:chenkeong.yap at izeno.>__com
>                 <mailto:chenkeong.yap at izeno.com
>         <mailto:chenkeong.yap at izeno.com>>>> wrote:
>
>                      Guys,
>
>                      Can share your ideas why global logout is not
>         working?
>
>                      On Apr 3, 2015 3:47 PM, "Chen Keong Yap"
>                 <chenkeong.yap at izeno.com
>         <mailto:chenkeong.yap at izeno.com>
>         <mailto:chenkeong.yap at izeno.com <mailto:chenkeong.yap at izeno.com>>
>                      <mailto:chenkeong.yap at izeno.
>         <mailto:chenkeong.yap at izeno.>__com
>                 <mailto:chenkeong.yap at izeno.com
>         <mailto:chenkeong.yap at izeno.com>>>> wrote:
>
>                          Hi Marek,
>
>                          I've just tested backchannel logout and it's
>         showing
>                 same issue.
>                          Both applications are using PL SP Filter and
>         the steps
>                 below are
>                          used for testing.
>
>                          1. Open https://localhost:8443/__employee/
>                 <https://localhost:8443/employee/> and http request is
>                          redirected to
>         https://localhost:8443/auth/__realms/saml-demo-1/protocol/__saml
>                
>         <https://localhost:8443/auth/realms/saml-demo-1/protocol/saml>
>
>                          2. Enter username and password into keycloak
>         login page and
>                          redirected to employee landing page
>
>                          3. Open https://localhost:8443/sales-__post/
>                 <https://localhost:8443/sales-post/> and redirected to
>                          sales-post landing page without login
>
>                          4. Logon to keycloak admin console and
>         noticed there are 2
>                          active sessions
>
>                          5. Perform global logout from employee
>         landing page
>                          (https://localhost:8443/__employee/?GLO=true
>                 <https://localhost:8443/employee/?GLO=true>) and http
>         request is
>                          redirected to
>         https://localhost:8443/auth/__realms/saml-demo-1/protocol/__saml
>                
>         <https://localhost:8443/auth/realms/saml-demo-1/protocol/saml>
>
>                          6. Logon to keycloak admin console and
>         noticed all
>                 sessions are gone
>
>                          7. Refresh sales-post landing page and it's not
>                 redirected to
>                          keycloak login page. sales-post session still
>         active.
>
>                          Kindly advise why GLO is performed but the second
>                 application
>                          (sales-post) session still active?
>
>                          On Fri, Apr 3, 2015 at 3:36 PM, Marek Posolda
>                          <mposolda at redhat.com
>         <mailto:mposolda at redhat.com> <mailto:mposolda at redhat.com
>         <mailto:mposolda at redhat.com>>
>                 <mailto:mposolda at redhat.com
>         <mailto:mposolda at redhat.com> <mailto:mposolda at redhat.com
>         <mailto:mposolda at redhat.com>>>> wrote:
>
>                              Switch the "Front channel logout" to off.
>         In this
>                 case it
>                              should use backchannel (not redirecting
>         through
>                 browser, but
>                              sending logout requests from Keycloak in
>         background)
>
>                              Marek
>
>
>
>                              On 3.4.2015 08:28, Chen Keong Yap wrote:
>
>
>                                  Hi Merek,
>
>                                  I've tried frontChannel logout in
>         1.2.0.Beta1
>                     and it's
>                                  giving me the same issues, please
>         refer to the
>                     settings
>                                  shown in the screen shot.
>
>                                  Can you please advise how to test
>         backchannel
>                     logout?
>
>
>                                  Inline image 1
>
>
>
>                                  On Fri, Apr 3, 2015 at 1:50 PM, Marek
>         Posolda
>                                  <mposolda at redhat.com
>         <mailto:mposolda at redhat.com>
>                     <mailto:mposolda at redhat.com
>         <mailto:mposolda at redhat.com>> <mailto:mposolda at redhat.com
>         <mailto:mposolda at redhat.com>
>                     <mailto:mposolda at redhat.com
>         <mailto:mposolda at redhat.com>>>> wrote:
>
>                                      I would try to upgrade to latest
>                     1.2.0.Beta1 as it has
>                                      some related fixes AFAIK.
>
>                                      In this version, you have also
>         possibility
>                     to setup
>                                      either frontChannel logout or
>         backchannel
>                     logout for
>                                      the application. It could be set in
>                     Keycloak admin
>                                      console. I think that at least
>         one of them
>                     will work
>                                      with SP filter in latest version
>         (if not both).
>
>                                      Marek
>
>
>                                      On 3.4.2015 01:44, Chen Keong Yap
>         wrote:
>
>                                          Hi,
>
>                                          I've 2 applications installed
>         with
>                         Picketlink
>                                          SPFilter to authenticate with
>         keycloak
>                         1.1.0 beta 2.
>
>                                          When i perform global logout,
>         first
>                         application was
>                                          logged out successfully because
>                         SP/keycloak session
>                                          and application http session are
>                         removed but the
>                                          problem is second
>                                          application SP/keycloak
>         session is
>                         removed but
>                                          application http session is still
>                         remained. I've set
>                                          admin url for these 2
>         applications in
>                         keycloak admin
>                                          console. Kindly share your ideas.
>
>
>
>
>                         _________________________________________________
>                                          keycloak-user mailing list
>         keycloak-user at lists.jboss.org
>         <mailto:keycloak-user at lists.jboss.org>
>                         <mailto:keycloak-user at lists.jboss.org
>         <mailto:keycloak-user at lists.jboss.org>>
>                         <mailto:keycloak-user at lists.
>         <mailto:keycloak-user at lists.>__jboss.org <http://jboss.org>
>                         <mailto:keycloak-user at lists.jboss.org
>         <mailto:keycloak-user at lists.jboss.org>>>
>         https://lists.jboss.org/__mailman/listinfo/keycloak-user
>                        
>         <https://lists.jboss.org/mailman/listinfo/keycloak-user>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>             --
>             Bill Burke
>             JBoss, a division of Red Hat
>         http://bill.burkecentral.com
>
>
>     -- 
>     Bill Burke
>     JBoss, a division of Red Hat
>     http://bill.burkecentral.com
>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150407/85cb004d/attachment-0001.html 

From mposolda at redhat.com  Tue Apr  7 03:33:05 2015
From: mposolda at redhat.com (Marek Posolda)
Date: Tue, 07 Apr 2015 09:33:05 +0200
Subject: [keycloak-user] CatalinaUserSessionManagement: Session not
 present or already invalidated
In-Reply-To: <CALAqdu9m1dfTvjx9jL8TWEunR=oBsLBv-R5hO5fLs3y3+f9y3g@mail.gmail.com>
References: <CALAqdu8UmKN7aqQHDkNH1uAAyhTv02gD-8sv5MjoTebt0m-FrQ@mail.gmail.com>	<551D50FB.9010601@redhat.com>	<CALAqdu-wxO0nw9uJ4e4j_pn2n1ykFNKEqsC7o-1PqdRXnDyQrg@mail.gmail.com>	<CALAqdu-_Oq1GGevQ_aQ=rEwB3P7UmiGOvrh1ZFu3D_MrKvm3fA@mail.gmail.com>	<551E2857.6020501@redhat.com>
	<CALAqdu9m1dfTvjx9jL8TWEunR=oBsLBv-R5hO5fLs3y3+f9y3g@mail.gmail.com>
Message-ID: <55238831.8080004@redhat.com>

On 3.4.2015 21:21, Scott Rossillo wrote:
> Ok, so a few followups. Just to be clear, here?s what I?m trying to do 
> and the outcomes of each against 1.2.0.Beta1:
>
> 1. (Original scenario) Log user out from KC console (Users > [user] 
> Sessions).
> Result: This still fails with the exception, 
> "org.keycloak.adapters.tomcat.CatalinaUserSessionManagement.logoutSession 
> Session not present or already invalidated.?
>
> The exception thrown here is an NPE 
> as manager.findSession(httpSessionId) failed to find the session. 
> Interestingly, the session is still valid and the ID passed into the 
> manager is correct. Furthermore, while debugging I can see that 
> manager.findSession() looks up the session in a hash map. 
> Interestingly, the session id (key) is there, but the value (session) 
> is null.  Maybe this is a Tomcat bug.  Using Tomcat 8.0.18, will test 
> with 8.0.21.
>
> 2. (Second scenario) Application logout.
> Documentation 8.10. Logout 
> (http://docs.jboss.org/keycloak/docs/1.2.0.Beta1/userguide/html/ch08.html#d4e1152) 
> say you can either call HttpServletRequest.logout() or redirect 
> tohttp://auth-server/auth/realms/{realm-name}/tokens/logout?redirect_uri=encodedRedirectUri.
>
> However, you have to do both.
>
> Call only .logout() and the KC token is still valid and user can 
> access app with a new session (it will just redirect to KC, see KC 
> session is valid and grant access).
>
> Call only auth-server/?/logout and the Tomcat session remains valid. I 
> would have thought that calling the auth-server?s logout endpoint 
> would broadcast logout events to logged in applications, but it doesn?t.
Actually auth-server logout should broadcast the logout to all logged-in 
applications. Auth-server will do it if you have configured "admin URL" 
for your application in Keycloak admin console. Do you have it configured?

Calling to .logout() should ensure redirecting to auth-server, which 
will logout Keycloak user session and then broadcast to logged applications.

In summary, both .logout() and redirection to auth-server/.../logout 
should invalidate both Keycloak UserSession and all logged application 
sessions (As long as you have admin URL configured for the 
applications). If something of it doesn't work, it may be a bug.

Marek
>
> I?ll file a JIRA for the second case and continue investigating the 
> first scenario with a newer Tomcat release.
>
> Best,
> Scott
>
>
>
>
>
>
>
>
>
> On Fri, Apr 3, 2015 at 1:42 AM, Marek Posolda <mposolda at redhat.com 
> <mailto:mposolda at redhat.com>> wrote:
>
>     Sure, maybe even easier alternative is to try debugger. You can
>     add this to the beginning of $TOMCAT_HOME/bin/catalina.sh:
>
>     JAVA_OPTS="$JAVA_OPTS
>     -agentlib:jdwp=transport=dt_socket,address=5005,server=y,suspend=n"
>
>     then start tomcat and then remotely connect to it from your IDE.
>     You will need opened IDE with keycloak sources though.
>
>     I've changed the code to display the exception stacktrace, but it
>     will be available in next release (not yet in 1.2.0.Beta1 released
>     yesterday)
>
>     Marek
>
>
>     On 3.4.2015 01:30, Scott Rossillo wrote:
>>     Still no luck using Tomcat 8 and Keycloak 1.2.0.Beta1.
>>
>>     I will install a custom built agent tomorrow to catch the actual
>>     exception to see what's up.
>>
>>
>>     On Thursday, April 2, 2015, Scott Rossillo
>>     <srossillo at smartling.com <mailto:srossillo at smartling.com>> wrote:
>>
>>         Hi,
>>
>>         Thanks for the reply.
>>
>>         I was trying to log a user out from the Keycloak admin
>>         console. I will try the redirect method and see if it works.
>>
>>         Also, I?m using 1.1.0.Final. I will upgrade to 1.2.0.Beta1
>>         and report if the issue is still occurring.
>>
>>         Best,
>>         Scott
>>
>>         On Thu, Apr 2, 2015 at 10:23 AM, Marek Posolda
>>         <mposolda at redhat.com> wrote:
>>
>>             Hi,
>>
>>             I've tried with Apache Tomcat 6.0.35 but wasn't able to
>>             reproduce with latest Keycloak 1.2.0.Beta1. Logout works
>>             fine for me.
>>
>>             How are you doing logout? From the application or from KC
>>             admin console? For the tomcat6, the
>>             httpServletRequest.logout() method is not yet available,
>>             so best for logout from the application is redirecting to
>>             Keycloak logout URL similarly like in our demo example:
>>             https://github.com/keycloak/keycloak/blob/master/examples/demo-template/customer-app/src/main/webapp/customers/view.jsp#L14
>>
>>             You can also enable debug logging, which should show some
>>             additional messages in the log by adding this line into
>>             $TOMCAT_HOME/conf/logging.properties:
>>
>>             org.keycloak.level = FINE
>>
>>             Marek
>>
>>
>>
>>             On 2.4.2015 01:37, Scott Rossillo wrote:
>>>             Hi all,
>>>
>>>             I?m running Keycloak 1.1.0-Final in standalone mode and
>>>             using Keycloak agents on Tomcat 6 and Tomcat 8.
>>>
>>>             With both agents, whenever I try to log a user out via
>>>             the Keycloak server, I see this in the Tomcat server?s log:
>>>
>>>             Apr 01, 2015 7:27:47 PM
>>>             org.keycloak.adapters.tomcat.CatalinaUserSessionManagement
>>>             logoutSession
>>>             WARN: Session not present or already invalidated.
>>>
>>>             The session is still valid and continues to be valid for
>>>             some period of time in each of the Tomcat instances.
>>>             Anyone know how to fix?
>>>
>>>             I was looking at the source and I see this method:
>>>
>>>              *
>>>
>>>
>>>               * org.keycloak.adapters.tomcat.CatalinaUserSessionManagement.
>>>
>>>             logoutSession()
>>>
>>>             I may test loging the actual exception tomorrow if no
>>>             one has a clue, but I think it?s probably the exception
>>>             is being thrown for some reason other than the session
>>>             no longer existing (it definitely still does).
>>>
>>>             Best,
>>>             Scott
>>>
>>>
>>>
>>>             _______________________________________________
>>>             keycloak-user mailing list
>>>             keycloak-user at lists.jboss.org
>>>             https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>>
>
>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150407/792500a2/attachment.html 

From mposolda at redhat.com  Tue Apr  7 03:38:55 2015
From: mposolda at redhat.com (Marek Posolda)
Date: Tue, 07 Apr 2015 09:38:55 +0200
Subject: [keycloak-user] CatalinaUserSessionManagement: Session not
 present or already invalidated
In-Reply-To: <CALAqdu8B+6FheoQnkTKb1MM+ko_4CKrY=B3ymS7_yOZZ2R4pFg@mail.gmail.com>
References: <CALAqdu8UmKN7aqQHDkNH1uAAyhTv02gD-8sv5MjoTebt0m-FrQ@mail.gmail.com>	<551D50FB.9010601@redhat.com>	<CALAqdu-wxO0nw9uJ4e4j_pn2n1ykFNKEqsC7o-1PqdRXnDyQrg@mail.gmail.com>	<CALAqdu-_Oq1GGevQ_aQ=rEwB3P7UmiGOvrh1ZFu3D_MrKvm3fA@mail.gmail.com>	<551E2857.6020501@redhat.com>	<CALAqdu9m1dfTvjx9jL8TWEunR=oBsLBv-R5hO5fLs3y3+f9y3g@mail.gmail.com>
	<CALAqdu8B+6FheoQnkTKb1MM+ko_4CKrY=B3ymS7_yOZZ2R4pFg@mail.gmail.com>
Message-ID: <5523898F.1020305@redhat.com>

So you're using spring security? This is quite an important detail, 
which you didn't mention before...

Yeah, it depends on the behaviour what Spring security is doing 
regarding sessions. You can try our demo applications customer-portal + 
product-portal. Those are simple servlet applications. If you're not 
seeing issues with them, but still seeing issue with your spring 
security app, then we know that the issue might be related to spring 
security.

If you manage to have it working with Spring security, it would be cool 
if you can share the details here. We had some questions related to 
spring security in the past. If you manage to secure Spring Security 
with our adapter, it could be good reference for the future.

Thanks,
Marek

On 3.4.2015 22:22, Scott Rossillo wrote:
> Update on issue 1, Log user out from KC console:
> It appears this is due to Spring security creating a new session and 
> migrating data into it but KC knows nothing about this. There?s a way 
> to disable this behavior in Spring Security and I?m going to take that 
> path.  This should be a non-issue.
>
> ~ Scott
>
>
> On Fri, Apr 3, 2015 at 3:21 PM, Scott Rossillo 
> <srossillo at smartling.com <mailto:srossillo at smartling.com>> wrote:
>
>     Ok, so a few followups. Just to be clear, here?s what I?m trying
>     to do and the outcomes of each against 1.2.0.Beta1:
>
>     1. (Original scenario) Log user out from KC console (Users >
>     [user] Sessions).
>     Result: This still fails with the exception,
>     "org.keycloak.adapters.tomcat.CatalinaUserSessionManagement.logoutSession
>     Session not present or already invalidated.?
>
>     The exception thrown here is an NPE
>     as manager.findSession(httpSessionId) failed to find the session.
>     Interestingly, the session is still valid and the ID passed into
>     the manager is correct. Furthermore, while debugging I can see
>     that manager.findSession() looks up the session in a hash map.
>     Interestingly, the session id (key) is there, but the value
>     (session) is null.  Maybe this is a Tomcat bug.  Using
>     Tomcat 8.0.18, will test with 8.0.21.
>
>     2. (Second scenario) Application logout.
>     Documentation 8.10. Logout
>     (http://docs.jboss.org/keycloak/docs/1.2.0.Beta1/userguide/html/ch08.html#d4e1152)
>     say you can either call HttpServletRequest.logout() or redirect
>     tohttp://auth-server/auth/realms/{realm-name}/tokens/logout?redirect_uri=encodedRedirectUri.
>
>     However, you have to do both.
>
>     Call only .logout() and the KC token is still valid and user can
>     access app with a new session (it will just redirect to KC, see KC
>     session is valid and grant access).
>
>     Call only auth-server/?/logout and the Tomcat session remains
>     valid. I would have thought that calling the auth-server?s logout
>     endpoint would broadcast logout events to logged in applications,
>     but it doesn?t.
>
>     I?ll file a JIRA for the second case and continue investigating
>     the first scenario with a newer Tomcat release.
>
>     Best,
>     Scott
>
>
>
>
>
>
>
>
>
>     On Fri, Apr 3, 2015 at 1:42 AM, Marek Posolda <mposolda at redhat.com
>     <mailto:mposolda at redhat.com>> wrote:
>
>         Sure, maybe even easier alternative is to try debugger. You
>         can add this to the beginning of $TOMCAT_HOME/bin/catalina.sh:
>
>         JAVA_OPTS="$JAVA_OPTS
>         -agentlib:jdwp=transport=dt_socket,address=5005,server=y,suspend=n"
>
>         then start tomcat and then remotely connect to it from your
>         IDE. You will need opened IDE with keycloak sources though.
>
>         I've changed the code to display the exception stacktrace, but
>         it will be available in next release (not yet in 1.2.0.Beta1
>         released yesterday)
>
>         Marek
>
>
>         On 3.4.2015 01:30, Scott Rossillo wrote:
>>         Still no luck using Tomcat 8 and Keycloak 1.2.0.Beta1.
>>
>>         I will install a custom built agent tomorrow to catch the
>>         actual exception to see what's up.
>>
>>
>>         On Thursday, April 2, 2015, Scott Rossillo
>>         <srossillo at smartling.com <mailto:srossillo at smartling.com>> wrote:
>>
>>             Hi,
>>
>>             Thanks for the reply.
>>
>>             I was trying to log a user out from the Keycloak admin
>>             console. I will try the redirect method and see if it works.
>>
>>             Also, I?m using 1.1.0.Final. I will upgrade to
>>             1.2.0.Beta1 and report if the issue is still occurring.
>>
>>             Best,
>>             Scott
>>
>>             On Thu, Apr 2, 2015 at 10:23 AM, Marek Posolda
>>             <mposolda at redhat.com> wrote:
>>
>>                 Hi,
>>
>>                 I've tried with Apache Tomcat 6.0.35 but wasn't able
>>                 to reproduce with latest Keycloak 1.2.0.Beta1. Logout
>>                 works fine for me.
>>
>>                 How are you doing logout? From the application or
>>                 from KC admin console? For the tomcat6, the
>>                 httpServletRequest.logout() method is not yet
>>                 available, so best for logout from the application is
>>                 redirecting to Keycloak logout URL similarly like in
>>                 our demo example:
>>                 https://github.com/keycloak/keycloak/blob/master/examples/demo-template/customer-app/src/main/webapp/customers/view.jsp#L14
>>
>>                 You can also enable debug logging, which should show
>>                 some additional messages in the log by adding this
>>                 line into $TOMCAT_HOME/conf/logging.properties:
>>
>>                 org.keycloak.level = FINE
>>
>>                 Marek
>>
>>
>>
>>                 On 2.4.2015 01:37, Scott Rossillo wrote:
>>>                 Hi all,
>>>
>>>                 I?m running Keycloak 1.1.0-Final in standalone mode
>>>                 and using Keycloak agents on Tomcat 6 and Tomcat 8.
>>>
>>>                 With both agents, whenever I try to log a user out
>>>                 via the Keycloak server, I see this in the Tomcat
>>>                 server?s log:
>>>
>>>                 Apr 01, 2015 7:27:47 PM
>>>                 org.keycloak.adapters.tomcat.CatalinaUserSessionManagement
>>>                 logoutSession
>>>                 WARN: Session not present or already invalidated.
>>>
>>>                 The session is still valid and continues to be valid
>>>                 for some period of time in each of the Tomcat
>>>                 instances. Anyone know how to fix?
>>>
>>>                 I was looking at the source and I see this method:
>>>
>>>                  *
>>>
>>>
>>>                   * org.keycloak.adapters.tomcat.CatalinaUserSessionManagement.
>>>
>>>                 logoutSession()
>>>
>>>                 I may test loging the actual exception tomorrow if
>>>                 no one has a clue, but I think it?s probably the
>>>                 exception is being thrown for some reason other than
>>>                 the session no longer existing (it definitely still
>>>                 does).
>>>
>>>                 Best,
>>>                 Scott
>>>
>>>
>>>
>>>                 _______________________________________________
>>>                 keycloak-user mailing list
>>>                 keycloak-user at lists.jboss.org
>>>                 https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>>
>
>
>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150407/dd329f63/attachment-0001.html 

From mposolda at redhat.com  Tue Apr  7 03:55:52 2015
From: mposolda at redhat.com (Marek Posolda)
Date: Tue, 07 Apr 2015 09:55:52 +0200
Subject: [keycloak-user] Running Liquibase updates via maven plugin
In-Reply-To: <BLUPR08MB31003F9533E8D887EFE766BB4FE0@BLUPR08MB310.namprd08.prod.outlook.com>
References: <BLUPR08MB31003F9533E8D887EFE766BB4FE0@BLUPR08MB310.namprd08.prod.outlook.com>
Message-ID: <55238D88.4050001@redhat.com>

Looks like a bug. I've created JIRA 
https://issues.jboss.org/browse/KEYCLOAK-1181 and will take a look at it.

Marek

On 6.4.2015 20:38, Schneider, Tom wrote:
>
> I?d like to populate a database for keycloak via the command line 
> using the liquibase maven plugin.
>
> With the latest master code, when I try to run this command:
>
> mvn -f connections/jpa-liquibase/pom.xml liquibase:update 
> -Durl=jdbc:h2:keycloak
>
> I receive the following error message:
>
> [ERROR] liquibase.exception.UnexpectedLiquibaseException: 
> liquibase.exception.CustomChangeException: 
> liquibase.exception.SetupException: No KeycloakSession provided in 
> ThreadLocal
>
> Am I missing some setup or is this no longer supported?
>
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150407/76798a28/attachment.html 

From sadiqkhoja at gmail.com  Tue Apr  7 04:24:49 2015
From: sadiqkhoja at gmail.com (Sadiq Khoja)
Date: Tue, 7 Apr 2015 13:24:49 +0500
Subject: [keycloak-user] CORS for direct grant access
Message-ID: <CAK2HbcydC=gd0RbMUz6LoJkmBhPJZXX5E=ZRcTxJpZtCP5Mf2w@mail.gmail.com>

Guys,

I want to enable CORS for Direct Grant Access, how to do it? I am getting
following error from my javascript application:

(index):1 XMLHttpRequest cannot load
http://localhost:8080/auth/realms/master/tokens/grants/access. No
'Access-Control-Allow-Origin' header is present on the requested resource.
Origin 'http://pn.localhost:81' is therefore not allowed access. The
response had HTTP status code 400.


?
Regards,
*??Sadiq Khoja*
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150407/b10d9545/attachment.html 

From chenkeong.yap at izeno.com  Tue Apr  7 04:41:15 2015
From: chenkeong.yap at izeno.com (Chen Keong Yap)
Date: Tue, 7 Apr 2015 16:41:15 +0800
Subject: [keycloak-user] Http Session is not invalidated
In-Reply-To: <55238559.4040902@redhat.com>
References: <CAC2UnuUrPd44VyqcvM6MPWUHUTVC-s8xY7=4cMJO1gyPBsRTfw@mail.gmail.com>
	<551E2A3C.8070006@redhat.com>
	<CAC2UnuV9O_xZzW25pz3utwVuA+eLcVrXF-rdTBs9iYij2R948g@mail.gmail.com>
	<551E42F7.9070404@redhat.com>
	<CAC2UnuVnVe4Znxauo1ngy8y5eY=9HELQTLc2a1ftRnBGsyG1YA@mail.gmail.com>
	<CAC2UnuWq_t1gyA7n-5SE33CmfojnpQA8iiYhNndpuxGp1au5Rg@mail.gmail.com>
	<CAC2UnuXFdbN_6W0CQh5TQ=3kMC1R-1ukrEM=MStWEQh9s=NebA@mail.gmail.com>
	<5522908E.4060507@redhat.com>
	<CAC2UnuVTJ1Zwsp=sdodf132QtFnZF3QtSML01tEh2Vb8M1pa-A@mail.gmail.com>
	<55229641.6090406@redhat.com>
	<CAC2UnuWdqCrcFf-v=UT55bKEjHmm195yE09smwLyPzy=tQO0kg@mail.gmail.com>
	<55238559.4040902@redhat.com>
Message-ID: <CAC2UnuW8-g5xgia42xdR3cxqK0CH_6YskjuOZ2936nxRsMUM9g@mail.gmail.com>

<?xml version="1.0" encoding="ISO-8859-1"?>

Hi,

I cannot find the spfilter definition in web.xml of the sample demo. Just
wondering is the demo running on SP filter?

<!DOCTYPE web-app
    PUBLIC "-//Sun Microsystems, Inc.//DTD Web Application 2.3//EN"
    "http://java.sun.com/dtd/web-app_2_3.dtd">

<web-app>

<welcome-file-list>
<filter>
<filter-name>SPFilter</filter-name>
<filter-class>org.picketlink.identity.federation.web.filters.SPFilter</filter-class>
<init-param>
<param-name>IGNORE_SIGNATURES</param-name>
<param-value>true</param-value>
</init-param>
<init-param>
<param-name>ROLES</param-name>
<param-value>PRUONE</param-value>
</init-param>
<init-param>
<param-name>LOGOUT_PAGE</param-name>
<param-value>/logout1.jsp</param-value>
</init-param>
</filter>
<filter-mapping>
<filter-name>SPFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
</web-app>

On Tue, Apr 7, 2015 at 3:20 PM, Marek Posolda <mposolda at redhat.com> wrote:

>  The demo is bundled in keycloak-appliance-dist ZIP in directory
> examples/saml .
>
> The demo sources are here:
> https://github.com/keycloak/keycloak/tree/master/examples/saml
>
> Marek
>
>
> On 7.4.2015 02:37, Chen Keong Yap wrote:
>
> Hi bill,
>
> Can you give me the link or path for the demo? Not sure if you are using
> keycloak or picketlink demo for testing?
> On Apr 6, 2015 9:20 PM, "Bill Burke" <bburke at redhat.com> wrote:
>
>> Demos work fine for me, but I'm using the wildfly Picketlink SP adapter.
>> I am able to have an SSO session with all the examples, then I am able to
>> logout and have all sessions invalidated.
>>
>> On 4/6/2015 9:01 AM, Chen Keong Yap wrote:
>>
>>> Hi bill,
>>>
>>> Are you using 2 applications for testing?
>>>
>>> If yes, need to know have you logged out the first application then
>>> redirect to keycloak login page? After that refresh the second
>>> application then redirect to keycloak login page?
>>>
>>> Can i know which version of picketlink federation lib are you using?
>>>
>>> On Apr 6, 2015 8:56 PM, "Bill Burke" <bburke at redhat.com
>>> <mailto:bburke at redhat.com>> wrote:
>>>
>>>     I tried out the saml demo app and logout works just fine, so I'm
>>>     guessing this is a bug in the PL SP Filter.
>>>
>>>     On 4/6/2015 6:47 AM, Chen Keong Yap wrote:
>>>
>>>         Hi bill,
>>>
>>>         Global logout only removed sp sessions but not web application
>>>         sessions
>>>         and this created security loopholes.
>>>
>>>         Please advise
>>>
>>>         On Mon, Apr 6, 2015 at 6:41 AM, Chen Keong Yap
>>>         <chenkeong.yap at izeno.com <mailto:chenkeong.yap at izeno.com>
>>>         <mailto:chenkeong.yap at izeno.__com
>>>         <mailto:chenkeong.yap at izeno.com>>> wrote:
>>>
>>>              Guys,
>>>
>>>              Can share your ideas why global logout is not working?
>>>
>>>              On Apr 3, 2015 3:47 PM, "Chen Keong Yap"
>>>         <chenkeong.yap at izeno.com <mailto:chenkeong.yap at izeno.com>
>>>              <mailto:chenkeong.yap at izeno.__com
>>>         <mailto:chenkeong.yap at izeno.com>>> wrote:
>>>
>>>                  Hi Marek,
>>>
>>>                  I've just tested backchannel logout and it's showing
>>>         same issue.
>>>                  Both applications are using PL SP Filter and the steps
>>>         below are
>>>                  used for testing.
>>>
>>>                  1. Open https://localhost:8443/__employee/
>>>         <https://localhost:8443/employee/> and http request is
>>>                  redirected to
>>>         https://localhost:8443/auth/__realms/saml-demo-1/protocol/__saml
>>>         <https://localhost:8443/auth/realms/saml-demo-1/protocol/saml>
>>>
>>>                  2. Enter username and password into keycloak login page
>>> and
>>>                  redirected to employee landing page
>>>
>>>                  3. Open https://localhost:8443/sales-__post/
>>>         <https://localhost:8443/sales-post/> and redirected to
>>>                  sales-post landing page without login
>>>
>>>                  4. Logon to keycloak admin console and noticed there
>>> are 2
>>>                  active sessions
>>>
>>>                  5. Perform global logout from employee landing page
>>>                  (https://localhost:8443/__employee/?GLO=true
>>>         <https://localhost:8443/employee/?GLO=true>) and http request is
>>>                  redirected to
>>>         https://localhost:8443/auth/__realms/saml-demo-1/protocol/__saml
>>>         <https://localhost:8443/auth/realms/saml-demo-1/protocol/saml>
>>>
>>>                  6. Logon to keycloak admin console and noticed all
>>>         sessions are gone
>>>
>>>                  7. Refresh sales-post landing page and it's not
>>>         redirected to
>>>                  keycloak login page. sales-post session still active.
>>>
>>>                  Kindly advise why GLO is performed but the second
>>>         application
>>>                  (sales-post) session still active?
>>>
>>>                  On Fri, Apr 3, 2015 at 3:36 PM, Marek Posolda
>>>                  <mposolda at redhat.com <mailto:mposolda at redhat.com>
>>>         <mailto:mposolda at redhat.com <mailto:mposolda at redhat.com>>>
>>> wrote:
>>>
>>>                      Switch the "Front channel logout" to off. In this
>>>         case it
>>>                      should use backchannel (not redirecting through
>>>         browser, but
>>>                      sending logout requests from Keycloak in background)
>>>
>>>                      Marek
>>>
>>>
>>>
>>>                      On 3.4.2015 08:28, Chen Keong Yap wrote:
>>>
>>>
>>>                          Hi Merek,
>>>
>>>                          I've tried frontChannel logout in 1.2.0.Beta1
>>>             and it's
>>>                          giving me the same issues, please refer to the
>>>             settings
>>>                          shown in the screen shot.
>>>
>>>                          Can you please advise how to test  backchannel
>>>             logout?
>>>
>>>
>>>                          Inline image 1
>>>
>>>
>>>
>>>                          On Fri, Apr 3, 2015 at 1:50 PM, Marek Posolda
>>>                          <mposolda at redhat.com
>>>             <mailto:mposolda at redhat.com> <mailto:mposolda at redhat.com
>>>             <mailto:mposolda at redhat.com>>> wrote:
>>>
>>>                              I would try to upgrade to latest
>>>             1.2.0.Beta1 as it has
>>>                              some related fixes AFAIK.
>>>
>>>                              In this version, you have also possibility
>>>             to setup
>>>                              either frontChannel logout or backchannel
>>>             logout for
>>>                              the application. It could be set in
>>>             Keycloak admin
>>>                              console. I think that at least one of them
>>>             will work
>>>                              with SP filter in latest version (if not
>>> both).
>>>
>>>                              Marek
>>>
>>>
>>>                              On 3.4.2015 01:44, Chen Keong Yap wrote:
>>>
>>>                                  Hi,
>>>
>>>                                  I've 2 applications installed with
>>>                 Picketlink
>>>                                  SPFilter to authenticate with keycloak
>>>                 1.1.0 beta 2.
>>>
>>>                                  When i perform global logout, first
>>>                 application was
>>>                                  logged out successfully because
>>>                 SP/keycloak session
>>>                                  and application http session are
>>>                 removed but the
>>>                                  problem is second
>>>                                  application SP/keycloak session is
>>>                 removed but
>>>                                  application http session is still
>>>                 remained. I've set
>>>                                  admin url for these 2 applications in
>>>                 keycloak admin
>>>                                  console. Kindly share your ideas.
>>>
>>>
>>>
>>>
>>>                 _________________________________________________
>>>                                  keycloak-user mailing list
>>>                 keycloak-user at lists.jboss.org
>>>                 <mailto:keycloak-user at lists.jboss.org>
>>>                 <mailto:keycloak-user at lists.__jboss.org
>>>                 <mailto:keycloak-user at lists.jboss.org>>
>>>                 https://lists.jboss.org/__mailman/listinfo/keycloak-user
>>>                 <https://lists.jboss.org/mailman/listinfo/keycloak-user>
>>>
>>>
>>>
>>>
>>>
>>>
>>>
>>>
>>>
>>>
>>>
>>>
>>>
>>>
>>>
>>>
>>>     --
>>>     Bill Burke
>>>     JBoss, a division of Red Hat
>>>     http://bill.burkecentral.com
>>>
>>>
>> --
>> Bill Burke
>> JBoss, a division of Red Hat
>> http://bill.burkecentral.com
>>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150407/18c48e77/attachment-0001.html 

From mposolda at redhat.com  Tue Apr  7 04:47:22 2015
From: mposolda at redhat.com (Marek Posolda)
Date: Tue, 07 Apr 2015 10:47:22 +0200
Subject: [keycloak-user] Http Session is not invalidated
In-Reply-To: <CAC2UnuW8-g5xgia42xdR3cxqK0CH_6YskjuOZ2936nxRsMUM9g@mail.gmail.com>
References: <CAC2UnuUrPd44VyqcvM6MPWUHUTVC-s8xY7=4cMJO1gyPBsRTfw@mail.gmail.com>
	<551E2A3C.8070006@redhat.com>
	<CAC2UnuV9O_xZzW25pz3utwVuA+eLcVrXF-rdTBs9iYij2R948g@mail.gmail.com>
	<551E42F7.9070404@redhat.com>
	<CAC2UnuVnVe4Znxauo1ngy8y5eY=9HELQTLc2a1ftRnBGsyG1YA@mail.gmail.com>
	<CAC2UnuWq_t1gyA7n-5SE33CmfojnpQA8iiYhNndpuxGp1au5Rg@mail.gmail.com>
	<CAC2UnuXFdbN_6W0CQh5TQ=3kMC1R-1ukrEM=MStWEQh9s=NebA@mail.gmail.com>
	<5522908E.4060507@redhat.com>
	<CAC2UnuVTJ1Zwsp=sdodf132QtFnZF3QtSML01tEh2Vb8M1pa-A@mail.gmail.com>
	<55229641.6090406@redhat.com>
	<CAC2UnuWdqCrcFf-v=UT55bKEjHmm195yE09smwLyPzy=tQO0kg@mail.gmail.com>
	<55238559.4040902@redhat.com>
	<CAC2UnuW8-g5xgia42xdR3cxqK0CH_6YskjuOZ2936nxRsMUM9g@mail.gmail.com>
Message-ID: <5523999A.9040200@redhat.com>

Nope, it's using the proper picketlink binding adapters 
(ServiceProviderAuthenticator valve on EAP6 and SPServletExtension on 
Wildfly). If you have opportunity to use those instead of SPFilter, it 
may be better though. I am not sure if Picketlink SPFilter is not 
deprecated (or if it supports all the features like binding adapters). 
Maybe Bill or Pedro knows more.

Marek


On 7.4.2015 10:41, Chen Keong Yap wrote:
>
>
> <?xml version="1.0" encoding="ISO-8859-1"?>
>
> Hi,
>
> I cannot find the spfilter definition in web.xml of the sample demo. 
> Just wondering is the demo running on SP filter?
>
> <!DOCTYPE web-app
>     PUBLIC "-//Sun Microsystems, Inc.//DTD Web Application 2.3//EN"
>     "http://java.sun.com/dtd/web-app_2_3.dtd">
>
> <web-app>
>
> <welcome-file-list>
> <filter>
> <filter-name>SPFilter</filter-name>
> <filter-class>org.picketlink.identity.federation.web.filters.SPFilter</filter-class>
> <init-param>
> <param-name>IGNORE_SIGNATURES</param-name>
> <param-value>true</param-value>
> </init-param>
> <init-param>
> <param-name>ROLES</param-name>
> <param-value>PRUONE</param-value>
> </init-param>
> <init-param>
> <param-name>LOGOUT_PAGE</param-name>
> <param-value>/logout1.jsp</param-value>
> </init-param>
> </filter>
> <filter-mapping>
> <filter-name>SPFilter</filter-name>
> <url-pattern>/*</url-pattern>
> </filter-mapping>
> </web-app>
>
> On Tue, Apr 7, 2015 at 3:20 PM, Marek Posolda <mposolda at redhat.com 
> <mailto:mposolda at redhat.com>> wrote:
>
>     The demo is bundled in keycloak-appliance-dist ZIP in directory
>     examples/saml .
>
>     The demo sources are here:
>     https://github.com/keycloak/keycloak/tree/master/examples/saml
>
>     Marek
>
>
>     On 7.4.2015 02:37, Chen Keong Yap wrote:
>>
>>     Hi bill,
>>
>>     Can you give me the link or path for the demo? Not sure if you
>>     are using keycloak or picketlink demo for testing?
>>
>>     On Apr 6, 2015 9:20 PM, "Bill Burke" <bburke at redhat.com
>>     <mailto:bburke at redhat.com>> wrote:
>>
>>         Demos work fine for me, but I'm using the wildfly Picketlink
>>         SP adapter.  I am able to have an SSO session with all the
>>         examples, then I am able to logout and have all sessions
>>         invalidated.
>>
>>         On 4/6/2015 9:01 AM, Chen Keong Yap wrote:
>>
>>             Hi bill,
>>
>>             Are you using 2 applications for testing?
>>
>>             If yes, need to know have you logged out the first
>>             application then
>>             redirect to keycloak login page? After that refresh the
>>             second
>>             application then redirect to keycloak login page?
>>
>>             Can i know which version of picketlink federation lib are
>>             you using?
>>
>>             On Apr 6, 2015 8:56 PM, "Bill Burke" <bburke at redhat.com
>>             <mailto:bburke at redhat.com>
>>             <mailto:bburke at redhat.com <mailto:bburke at redhat.com>>> wrote:
>>
>>                 I tried out the saml demo app and logout works just
>>             fine, so I'm
>>                 guessing this is a bug in the PL SP Filter.
>>
>>                 On 4/6/2015 6:47 AM, Chen Keong Yap wrote:
>>
>>                     Hi bill,
>>
>>                     Global logout only removed sp sessions but not
>>             web application
>>                     sessions
>>                     and this created security loopholes.
>>
>>                     Please advise
>>
>>                     On Mon, Apr 6, 2015 at 6:41 AM, Chen Keong Yap
>>                     <chenkeong.yap at izeno.com
>>             <mailto:chenkeong.yap at izeno.com>
>>             <mailto:chenkeong.yap at izeno.com
>>             <mailto:chenkeong.yap at izeno.com>>
>>                     <mailto:chenkeong.yap at izeno.
>>             <mailto:chenkeong.yap at izeno.>__com
>>                     <mailto:chenkeong.yap at izeno.com
>>             <mailto:chenkeong.yap at izeno.com>>>> wrote:
>>
>>                          Guys,
>>
>>                          Can share your ideas why global logout is
>>             not working?
>>
>>                          On Apr 3, 2015 3:47 PM, "Chen Keong Yap"
>>                     <chenkeong.yap at izeno.com
>>             <mailto:chenkeong.yap at izeno.com>
>>             <mailto:chenkeong.yap at izeno.com
>>             <mailto:chenkeong.yap at izeno.com>>
>>                          <mailto:chenkeong.yap at izeno.
>>             <mailto:chenkeong.yap at izeno.>__com
>>                     <mailto:chenkeong.yap at izeno.com
>>             <mailto:chenkeong.yap at izeno.com>>>> wrote:
>>
>>                              Hi Marek,
>>
>>                              I've just tested backchannel logout and
>>             it's showing
>>                     same issue.
>>                              Both applications are using PL SP Filter
>>             and the steps
>>                     below are
>>                              used for testing.
>>
>>                              1. Open https://localhost:8443/__employee/
>>                     <https://localhost:8443/employee/> and http
>>             request is
>>                              redirected to
>>             https://localhost:8443/auth/__realms/saml-demo-1/protocol/__saml
>>                    
>>             <https://localhost:8443/auth/realms/saml-demo-1/protocol/saml>
>>
>>                              2. Enter username and password into
>>             keycloak login page and
>>                              redirected to employee landing page
>>
>>                              3. Open https://localhost:8443/sales-__post/
>>                     <https://localhost:8443/sales-post/> and
>>             redirected to
>>                              sales-post landing page without login
>>
>>                              4. Logon to keycloak admin console and
>>             noticed there are 2
>>                              active sessions
>>
>>                              5. Perform global logout from employee
>>             landing page
>>                              (https://localhost:8443/__employee/?GLO=true
>>                     <https://localhost:8443/employee/?GLO=true>) and
>>             http request is
>>                              redirected to
>>             https://localhost:8443/auth/__realms/saml-demo-1/protocol/__saml
>>                    
>>             <https://localhost:8443/auth/realms/saml-demo-1/protocol/saml>
>>
>>                              6. Logon to keycloak admin console and
>>             noticed all
>>                     sessions are gone
>>
>>                              7. Refresh sales-post landing page and
>>             it's not
>>                     redirected to
>>                              keycloak login page. sales-post session
>>             still active.
>>
>>                              Kindly advise why GLO is performed but
>>             the second
>>                     application
>>                              (sales-post) session still active?
>>
>>                              On Fri, Apr 3, 2015 at 3:36 PM, Marek
>>             Posolda
>>                              <mposolda at redhat.com
>>             <mailto:mposolda at redhat.com> <mailto:mposolda at redhat.com
>>             <mailto:mposolda at redhat.com>>
>>                     <mailto:mposolda at redhat.com
>>             <mailto:mposolda at redhat.com> <mailto:mposolda at redhat.com
>>             <mailto:mposolda at redhat.com>>>> wrote:
>>
>>                                  Switch the "Front channel logout" to
>>             off. In this
>>                     case it
>>                                  should use backchannel (not
>>             redirecting through
>>                     browser, but
>>                                  sending logout requests from
>>             Keycloak in background)
>>
>>                                  Marek
>>
>>
>>
>>                                  On 3.4.2015 08:28, Chen Keong Yap wrote:
>>
>>
>>                                      Hi Merek,
>>
>>                                      I've tried frontChannel logout
>>             in 1.2.0.Beta1
>>                         and it's
>>                                      giving me the same issues,
>>             please refer to the
>>                         settings
>>                                      shown in the screen shot.
>>
>>                                      Can you please advise how to
>>             test  backchannel
>>                         logout?
>>
>>
>>                                      Inline image 1
>>
>>
>>
>>                                      On Fri, Apr 3, 2015 at 1:50 PM,
>>             Marek Posolda
>>                                      <mposolda at redhat.com
>>             <mailto:mposolda at redhat.com>
>>                         <mailto:mposolda at redhat.com
>>             <mailto:mposolda at redhat.com>> <mailto:mposolda at redhat.com
>>             <mailto:mposolda at redhat.com>
>>                         <mailto:mposolda at redhat.com
>>             <mailto:mposolda at redhat.com>>>> wrote:
>>
>>                                          I would try to upgrade to latest
>>                         1.2.0.Beta1 as it has
>>                                          some related fixes AFAIK.
>>
>>                                          In this version, you have
>>             also possibility
>>                         to setup
>>                                          either frontChannel logout
>>             or backchannel
>>                         logout for
>>                                          the application. It could be
>>             set in
>>                         Keycloak admin
>>                                          console. I think that at
>>             least one of them
>>                         will work
>>                                          with SP filter in latest
>>             version (if not both).
>>
>>                                          Marek
>>
>>
>>                                          On 3.4.2015 01:44, Chen
>>             Keong Yap wrote:
>>
>>                                              Hi,
>>
>>                                              I've 2 applications
>>             installed with
>>                             Picketlink
>>                                              SPFilter to authenticate
>>             with keycloak
>>                             1.1.0 beta 2.
>>
>>                                              When i perform global
>>             logout, first
>>                             application was
>>                                              logged out successfully
>>             because
>>                             SP/keycloak session
>>                                              and application http
>>             session are
>>                             removed but the
>>                                              problem is second
>>                                              application SP/keycloak
>>             session is
>>                             removed but
>>                                              application http session
>>             is still
>>                             remained. I've set
>>                                              admin url for these 2
>>             applications in
>>                             keycloak admin
>>                                              console. Kindly share
>>             your ideas.
>>
>>
>>
>>
>>             _________________________________________________
>>              keycloak-user mailing list
>>             keycloak-user at lists.jboss.org
>>             <mailto:keycloak-user at lists.jboss.org>
>>                             <mailto:keycloak-user at lists.jboss.org
>>             <mailto:keycloak-user at lists.jboss.org>>
>>                             <mailto:keycloak-user at lists.
>>             <mailto:keycloak-user at lists.>__jboss.org <http://jboss.org>
>>                             <mailto:keycloak-user at lists.jboss.org
>>             <mailto:keycloak-user at lists.jboss.org>>>
>>             https://lists.jboss.org/__mailman/listinfo/keycloak-user
>>                            
>>             <https://lists.jboss.org/mailman/listinfo/keycloak-user>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>                 --
>>                 Bill Burke
>>                 JBoss, a division of Red Hat
>>             http://bill.burkecentral.com
>>
>>
>>         -- 
>>         Bill Burke
>>         JBoss, a division of Red Hat
>>         http://bill.burkecentral.com
>>
>
>
>
>
>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150407/65d1544b/attachment-0001.html 

From chenkeong.yap at izeno.com  Tue Apr  7 04:52:26 2015
From: chenkeong.yap at izeno.com (Chen Keong Yap)
Date: Tue, 7 Apr 2015 16:52:26 +0800
Subject: [keycloak-user] Http Session is not invalidated
In-Reply-To: <5523999A.9040200@redhat.com>
References: <CAC2UnuUrPd44VyqcvM6MPWUHUTVC-s8xY7=4cMJO1gyPBsRTfw@mail.gmail.com>
	<551E2A3C.8070006@redhat.com>
	<CAC2UnuV9O_xZzW25pz3utwVuA+eLcVrXF-rdTBs9iYij2R948g@mail.gmail.com>
	<551E42F7.9070404@redhat.com>
	<CAC2UnuVnVe4Znxauo1ngy8y5eY=9HELQTLc2a1ftRnBGsyG1YA@mail.gmail.com>
	<CAC2UnuWq_t1gyA7n-5SE33CmfojnpQA8iiYhNndpuxGp1au5Rg@mail.gmail.com>
	<CAC2UnuXFdbN_6W0CQh5TQ=3kMC1R-1ukrEM=MStWEQh9s=NebA@mail.gmail.com>
	<5522908E.4060507@redhat.com>
	<CAC2UnuVTJ1Zwsp=sdodf132QtFnZF3QtSML01tEh2Vb8M1pa-A@mail.gmail.com>
	<55229641.6090406@redhat.com>
	<CAC2UnuWdqCrcFf-v=UT55bKEjHmm195yE09smwLyPzy=tQO0kg@mail.gmail.com>
	<55238559.4040902@redhat.com>
	<CAC2UnuW8-g5xgia42xdR3cxqK0CH_6YskjuOZ2936nxRsMUM9g@mail.gmail.com>
	<5523999A.9040200@redhat.com>
Message-ID: <CAC2UnuXnCMmqiLpyaWrki9uGQg0cCNW2bSTf8+vL0zUVBPiMxg@mail.gmail.com>

Hi,

Unfortunately i cannot use  picketlink binding adapters because my
application is running on websphere and we are not allowed to use keycloak
proxy. I guess the only way is to use SP Filter. Can someone advise the
alternative/solution to clear  web application session after global logout
is performed?

On Tue, Apr 7, 2015 at 4:47 PM, Marek Posolda <mposolda at redhat.com> wrote:

>  Nope, it's using the proper picketlink binding adapters
> (ServiceProviderAuthenticator valve on EAP6 and SPServletExtension on
> Wildfly). If you have opportunity to use those instead of SPFilter, it may
> be better though. I am not sure if Picketlink SPFilter is not deprecated
> (or if it supports all the features like binding adapters). Maybe Bill or
> Pedro knows more.
>
> Marek
>
>
>
> On 7.4.2015 10:41, Chen Keong Yap wrote:
>
>
>
>  <?xml version="1.0" encoding="ISO-8859-1"?>
>
>  Hi,
>
>  I cannot find the spfilter definition in web.xml of the sample demo.
> Just wondering is the demo running on SP filter?
>
>  <!DOCTYPE web-app
>     PUBLIC "-//Sun Microsystems, Inc.//DTD Web Application 2.3//EN"
>     "http://java.sun.com/dtd/web-app_2_3.dtd">
>
>  <web-app>
>
>  <welcome-file-list>
>  <filter>
>  <filter-name>SPFilter</filter-name>
>
> <filter-class>org.picketlink.identity.federation.web.filters.SPFilter</filter-class>
>  <init-param>
>  <param-name>IGNORE_SIGNATURES</param-name>
>  <param-value>true</param-value>
>  </init-param>
>  <init-param>
>  <param-name>ROLES</param-name>
>  <param-value>PRUONE</param-value>
>  </init-param>
> <init-param>
>  <param-name>LOGOUT_PAGE</param-name>
>  <param-value>/logout1.jsp</param-value>
>  </init-param>
>  </filter>
>  <filter-mapping>
>  <filter-name>SPFilter</filter-name>
>  <url-pattern>/*</url-pattern>
>  </filter-mapping>
> </web-app>
>
> On Tue, Apr 7, 2015 at 3:20 PM, Marek Posolda <mposolda at redhat.com> wrote:
>
>>  The demo is bundled in keycloak-appliance-dist ZIP in directory
>> examples/saml .
>>
>> The demo sources are here:
>> https://github.com/keycloak/keycloak/tree/master/examples/saml
>>
>> Marek
>>
>>
>> On 7.4.2015 02:37, Chen Keong Yap wrote:
>>
>> Hi bill,
>>
>> Can you give me the link or path for the demo? Not sure if you are using
>> keycloak or picketlink demo for testing?
>> On Apr 6, 2015 9:20 PM, "Bill Burke" <bburke at redhat.com> wrote:
>>
>>> Demos work fine for me, but I'm using the wildfly Picketlink SP
>>> adapter.  I am able to have an SSO session with all the examples, then I am
>>> able to logout and have all sessions invalidated.
>>>
>>> On 4/6/2015 9:01 AM, Chen Keong Yap wrote:
>>>
>>>> Hi bill,
>>>>
>>>> Are you using 2 applications for testing?
>>>>
>>>> If yes, need to know have you logged out the first application then
>>>> redirect to keycloak login page? After that refresh the second
>>>> application then redirect to keycloak login page?
>>>>
>>>> Can i know which version of picketlink federation lib are you using?
>>>>
>>>> On Apr 6, 2015 8:56 PM, "Bill Burke" <bburke at redhat.com
>>>> <mailto:bburke at redhat.com>> wrote:
>>>>
>>>>     I tried out the saml demo app and logout works just fine, so I'm
>>>>     guessing this is a bug in the PL SP Filter.
>>>>
>>>>     On 4/6/2015 6:47 AM, Chen Keong Yap wrote:
>>>>
>>>>         Hi bill,
>>>>
>>>>         Global logout only removed sp sessions but not web application
>>>>         sessions
>>>>         and this created security loopholes.
>>>>
>>>>         Please advise
>>>>
>>>>         On Mon, Apr 6, 2015 at 6:41 AM, Chen Keong Yap
>>>>         <chenkeong.yap at izeno.com <mailto:chenkeong.yap at izeno.com>
>>>>         <mailto:chenkeong.yap at izeno.__com
>>>>         <mailto:chenkeong.yap at izeno.com>>> wrote:
>>>>
>>>>              Guys,
>>>>
>>>>              Can share your ideas why global logout is not working?
>>>>
>>>>              On Apr 3, 2015 3:47 PM, "Chen Keong Yap"
>>>>         <chenkeong.yap at izeno.com <mailto:chenkeong.yap at izeno.com>
>>>>              <mailto:chenkeong.yap at izeno.__com
>>>>         <mailto:chenkeong.yap at izeno.com>>> wrote:
>>>>
>>>>                  Hi Marek,
>>>>
>>>>                  I've just tested backchannel logout and it's showing
>>>>         same issue.
>>>>                  Both applications are using PL SP Filter and the steps
>>>>         below are
>>>>                  used for testing.
>>>>
>>>>                  1. Open https://localhost:8443/__employee/
>>>>         <https://localhost:8443/employee/> and http request is
>>>>                  redirected to
>>>>
>>>> https://localhost:8443/auth/__realms/saml-demo-1/protocol/__saml
>>>>         <https://localhost:8443/auth/realms/saml-demo-1/protocol/saml>
>>>>
>>>>                  2. Enter username and password into keycloak login
>>>> page and
>>>>                  redirected to employee landing page
>>>>
>>>>                  3. Open https://localhost:8443/sales-__post/
>>>>         <https://localhost:8443/sales-post/> and redirected to
>>>>                  sales-post landing page without login
>>>>
>>>>                  4. Logon to keycloak admin console and noticed there
>>>> are 2
>>>>                  active sessions
>>>>
>>>>                  5. Perform global logout from employee landing page
>>>>                  (https://localhost:8443/__employee/?GLO=true
>>>>         <https://localhost:8443/employee/?GLO=true>) and http request
>>>> is
>>>>                  redirected to
>>>>
>>>> https://localhost:8443/auth/__realms/saml-demo-1/protocol/__saml
>>>>         <https://localhost:8443/auth/realms/saml-demo-1/protocol/saml>
>>>>
>>>>                  6. Logon to keycloak admin console and noticed all
>>>>         sessions are gone
>>>>
>>>>                  7. Refresh sales-post landing page and it's not
>>>>         redirected to
>>>>                  keycloak login page. sales-post session still active.
>>>>
>>>>                  Kindly advise why GLO is performed but the second
>>>>         application
>>>>                  (sales-post) session still active?
>>>>
>>>>                  On Fri, Apr 3, 2015 at 3:36 PM, Marek Posolda
>>>>                  <mposolda at redhat.com <mailto:mposolda at redhat.com>
>>>>         <mailto:mposolda at redhat.com <mailto:mposolda at redhat.com>>>
>>>> wrote:
>>>>
>>>>                      Switch the "Front channel logout" to off. In this
>>>>         case it
>>>>                      should use backchannel (not redirecting through
>>>>         browser, but
>>>>                      sending logout requests from Keycloak in
>>>> background)
>>>>
>>>>                      Marek
>>>>
>>>>
>>>>
>>>>                      On 3.4.2015 08:28, Chen Keong Yap wrote:
>>>>
>>>>
>>>>                          Hi Merek,
>>>>
>>>>                          I've tried frontChannel logout in 1.2.0.Beta1
>>>>             and it's
>>>>                          giving me the same issues, please refer to the
>>>>             settings
>>>>                          shown in the screen shot.
>>>>
>>>>                          Can you please advise how to test  backchannel
>>>>             logout?
>>>>
>>>>
>>>>                          Inline image 1
>>>>
>>>>
>>>>
>>>>                          On Fri, Apr 3, 2015 at 1:50 PM, Marek Posolda
>>>>                          <mposolda at redhat.com
>>>>             <mailto:mposolda at redhat.com> <mailto:mposolda at redhat.com
>>>>             <mailto:mposolda at redhat.com>>> wrote:
>>>>
>>>>                              I would try to upgrade to latest
>>>>             1.2.0.Beta1 as it has
>>>>                              some related fixes AFAIK.
>>>>
>>>>                              In this version, you have also possibility
>>>>             to setup
>>>>                              either frontChannel logout or backchannel
>>>>             logout for
>>>>                              the application. It could be set in
>>>>             Keycloak admin
>>>>                              console. I think that at least one of them
>>>>             will work
>>>>                              with SP filter in latest version (if not
>>>> both).
>>>>
>>>>                              Marek
>>>>
>>>>
>>>>                              On 3.4.2015 01:44, Chen Keong Yap wrote:
>>>>
>>>>                                  Hi,
>>>>
>>>>                                  I've 2 applications installed with
>>>>                 Picketlink
>>>>                                  SPFilter to authenticate with keycloak
>>>>                 1.1.0 beta 2.
>>>>
>>>>                                  When i perform global logout, first
>>>>                 application was
>>>>                                  logged out successfully because
>>>>                 SP/keycloak session
>>>>                                  and application http session are
>>>>                 removed but the
>>>>                                  problem is second
>>>>                                  application SP/keycloak session is
>>>>                 removed but
>>>>                                  application http session is still
>>>>                 remained. I've set
>>>>                                  admin url for these 2 applications in
>>>>                 keycloak admin
>>>>                                  console. Kindly share your ideas.
>>>>
>>>>
>>>>
>>>>
>>>>                 _________________________________________________
>>>>                                  keycloak-user mailing list
>>>>                 keycloak-user at lists.jboss.org
>>>>                 <mailto:keycloak-user at lists.jboss.org>
>>>>                 <mailto:keycloak-user at lists.__jboss.org
>>>>                 <mailto:keycloak-user at lists.jboss.org>>
>>>>
>>>> https://lists.jboss.org/__mailman/listinfo/keycloak-user
>>>>                 <https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>> >
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>     --
>>>>     Bill Burke
>>>>     JBoss, a division of Red Hat
>>>>     http://bill.burkecentral.com
>>>>
>>>>
>>> --
>>> Bill Burke
>>> JBoss, a division of Red Hat
>>> http://bill.burkecentral.com
>>>
>>
>>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150407/eb9a2581/attachment-0001.html 

From mposolda at redhat.com  Tue Apr  7 05:25:35 2015
From: mposolda at redhat.com (Marek Posolda)
Date: Tue, 07 Apr 2015 11:25:35 +0200
Subject: [keycloak-user] Running Liquibase updates via maven plugin
In-Reply-To: <55238D88.4050001@redhat.com>
References: <BLUPR08MB31003F9533E8D887EFE766BB4FE0@BLUPR08MB310.namprd08.prod.outlook.com>
	<55238D88.4050001@redhat.com>
Message-ID: <5523A28F.4030902@redhat.com>

Should be fixed now in latest master.

Marek

On 7.4.2015 09:55, Marek Posolda wrote:
> Looks like a bug. I've created JIRA 
> https://issues.jboss.org/browse/KEYCLOAK-1181 and will take a look at it.
>
> Marek
>
> On 6.4.2015 20:38, Schneider, Tom wrote:
>>
>> I?d like to populate a database for keycloak via the command line 
>> using the liquibase maven plugin.
>>
>> With the latest master code, when I try to run this command:
>>
>> mvn -f connections/jpa-liquibase/pom.xml liquibase:update 
>> -Durl=jdbc:h2:keycloak
>>
>> I receive the following error message:
>>
>> [ERROR] liquibase.exception.UnexpectedLiquibaseException: 
>> liquibase.exception.CustomChangeException: 
>> liquibase.exception.SetupException: No KeycloakSession provided in 
>> ThreadLocal
>>
>> Am I missing some setup or is this no longer supported?
>>
>>
>>
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150407/cc148bbd/attachment.html 

From mposolda at redhat.com  Tue Apr  7 06:12:18 2015
From: mposolda at redhat.com (Marek Posolda)
Date: Tue, 07 Apr 2015 12:12:18 +0200
Subject: [keycloak-user] CORS for direct grant access
In-Reply-To: <CAK2HbcydC=gd0RbMUz6LoJkmBhPJZXX5E=ZRcTxJpZtCP5Mf2w@mail.gmail.com>
References: <CAK2HbcydC=gd0RbMUz6LoJkmBhPJZXX5E=ZRcTxJpZtCP5Mf2w@mail.gmail.com>
Message-ID: <5523AD82.4090606@redhat.com>

Hi,

the question is why you need Direct Grant Access in javascript 
application? I think it will be much better to use our javascript 
adapter and retrieve the access token with it: 
http://docs.jboss.org/keycloak/docs/1.2.0.Beta1/userguide/html/ch08.html#javascript-adapter

Marek

On 7.4.2015 10:24, Sadiq Khoja wrote:
> Guys,
>
> I want to enable CORS for Direct Grant Access, how to do it? I am 
> getting following error from my javascript application:
>
> (index):1 XMLHttpRequest cannot load 
> http://localhost:8080/auth/realms/master/tokens/grants/access. No 
> 'Access-Control-Allow-Origin' header is present on the requested 
> resource. Origin 'http://pn.localhost:81' is therefore not allowed 
> access. The response had HTTP status code 400.
>
>
> ?
> Regards,
> *
> ??
> Sadiq Khoja*
>
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150407/cdadd0d7/attachment.html 

From sadiqkhoja at gmail.com  Tue Apr  7 06:28:28 2015
From: sadiqkhoja at gmail.com (Sadiq Khoja)
Date: Tue, 7 Apr 2015 15:28:28 +0500
Subject: [keycloak-user] CORS for direct grant access
In-Reply-To: <5523AD82.4090606@redhat.com>
References: <CAK2HbcydC=gd0RbMUz6LoJkmBhPJZXX5E=ZRcTxJpZtCP5Mf2w@mail.gmail.com>
	<5523AD82.4090606@redhat.com>
Message-ID: <CAK2HbcywFdeT3t33SMx39S4kqnEWxH9hTGNOv3+dHgPbAX-zEw@mail.gmail.com>

Dear Marek,

Because I don't want to redirect user to Keycloak's login page.

BTW: I was getting CORS error for refresh url as well so I added my origin
in security-admin-console
<http://localhost:8080/auth/admin/master/console/#/realms/master/applications/d1f6f182-1a13-4e9d-bee7-8a2693d9fae9>
application
and its working now.

?
Regards,
*??Sadiq Khoja*


On Tue, Apr 7, 2015 at 3:12 PM, Marek Posolda <mposolda at redhat.com> wrote:

>  Hi,
>
> the question is why you need Direct Grant Access in javascript
> application? I think it will be much better to use our javascript adapter
> and retrieve the access token with it:
> http://docs.jboss.org/keycloak/docs/1.2.0.Beta1/userguide/html/ch08.html#javascript-adapter
>
> Marek
>
>
> On 7.4.2015 10:24, Sadiq Khoja wrote:
>
>  Guys,
>
>  I want to enable CORS for Direct Grant Access, how to do it? I am
> getting following error from my javascript application:
>
>  (index):1 XMLHttpRequest cannot load
> http://localhost:8080/auth/realms/master/tokens/grants/access. No
> 'Access-Control-Allow-Origin' header is present on the requested resource.
> Origin 'http://pn.localhost:81' is therefore not allowed access. The
> response had HTTP status code 400.
>
>
>     ?
> Regards,
> * ?? Sadiq Khoja*
>
>
>
> _______________________________________________
> keycloak-user mailing listkeycloak-user at lists.jboss.orghttps://lists.jboss.org/mailman/listinfo/keycloak-user
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150407/a670df17/attachment.html 

From stian at redhat.com  Tue Apr  7 06:39:54 2015
From: stian at redhat.com (Stian Thorgersen)
Date: Tue, 7 Apr 2015 06:39:54 -0400 (EDT)
Subject: [keycloak-user] CORS for direct grant access
In-Reply-To: <CAK2HbcywFdeT3t33SMx39S4kqnEWxH9hTGNOv3+dHgPbAX-zEw@mail.gmail.com>
References: <CAK2HbcydC=gd0RbMUz6LoJkmBhPJZXX5E=ZRcTxJpZtCP5Mf2w@mail.gmail.com>
	<5523AD82.4090606@redhat.com>
	<CAK2HbcywFdeT3t33SMx39S4kqnEWxH9hTGNOv3+dHgPbAX-zEw@mail.gmail.com>
Message-ID: <444858971.13327700.1428403194599.JavaMail.zimbra@redhat.com>



----- Original Message -----
> From: "Sadiq Khoja" <sadiqkhoja at gmail.com>
> To: "Marek Posolda" <mposolda at redhat.com>
> Cc: keycloak-user at lists.jboss.org
> Sent: Tuesday, 7 April, 2015 12:28:28 PM
> Subject: Re: [keycloak-user] CORS for direct grant access
> 
> Dear Marek,
> 
> Because I don't want to redirect user to Keycloak's login page.
> 
> BTW: I was getting CORS error for refresh url as well so I added my origin in
> security-admin-console application and its working now.

There's many many reasons why what you're doing isn't the greatest idea and you'd be much better with redirecting to the login page (which you can style to match your app).

In either case you shouldn't use the security-admin-console app for your application, that's for the KC admin console. Create your own app and set origin on that!

> 
> ?
> Regards,
> ??
> Sadiq Khoja
> 
> 
> On Tue, Apr 7, 2015 at 3:12 PM, Marek Posolda < mposolda at redhat.com > wrote:
> 
> 
> 
> Hi,
> 
> the question is why you need Direct Grant Access in javascript application? I
> think it will be much better to use our javascript adapter and retrieve the
> access token with it:
> http://docs.jboss.org/keycloak/docs/1.2.0.Beta1/userguide/html/ch08.html#javascript-adapter
> 
> Marek
> 
> 
> On 7.4.2015 10:24, Sadiq Khoja wrote:
> 
> 
> 
> Guys,
> 
> I want to enable CORS for Direct Grant Access, how to do it? I am getting
> following error from my javascript application:
> 
> (index):1 XMLHttpRequest cannot load
> http://localhost:8080/auth/realms/master/tokens/grants/access . No
> 'Access-Control-Allow-Origin' header is present on the requested resource.
> Origin ' http://pn.localhost:81 ' is therefore not allowed access. The
> response had HTTP status code 400.
> 
> 
> ?
> Regards,
> ??
> Sadiq Khoja
> 
> 
> 
> _______________________________________________
> keycloak-user mailing list keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
> 
> 
> 
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user


From sadiqkhoja at gmail.com  Tue Apr  7 06:47:19 2015
From: sadiqkhoja at gmail.com (Sadiq Khoja)
Date: Tue, 7 Apr 2015 15:47:19 +0500
Subject: [keycloak-user] CORS for direct grant access
In-Reply-To: <444858971.13327700.1428403194599.JavaMail.zimbra@redhat.com>
References: <CAK2HbcydC=gd0RbMUz6LoJkmBhPJZXX5E=ZRcTxJpZtCP5Mf2w@mail.gmail.com>
	<5523AD82.4090606@redhat.com>
	<CAK2HbcywFdeT3t33SMx39S4kqnEWxH9hTGNOv3+dHgPbAX-zEw@mail.gmail.com>
	<444858971.13327700.1428403194599.JavaMail.zimbra@redhat.com>
Message-ID: <CAK2HbcyeTu_W_yJBAo26VZGoUXrYaZOke+G4SNZJgkUec8VMqw@mail.gmail.com>

Dear Stian,

The reason I am not using Keycloak login page is that I have existing
application which have its own user management. From that application I am
calling some RestEasy services for which I have configured KeyCloak. So
basically user would be authenticated using existing application's
mechanism + keycloak. [crazy things happen]

For refreshing token (
http://localhost:8080/auth/realms/master/tokens/refresh), if I add origin
to my own public application, would that work?


?
Regards,
*??Sadiq Khoja*


On Tue, Apr 7, 2015 at 3:39 PM, Stian Thorgersen <stian at redhat.com> wrote:

>
>
> ----- Original Message -----
> > From: "Sadiq Khoja" <sadiqkhoja at gmail.com>
> > To: "Marek Posolda" <mposolda at redhat.com>
> > Cc: keycloak-user at lists.jboss.org
> > Sent: Tuesday, 7 April, 2015 12:28:28 PM
> > Subject: Re: [keycloak-user] CORS for direct grant access
> >
> > Dear Marek,
> >
> > Because I don't want to redirect user to Keycloak's login page.
> >
> > BTW: I was getting CORS error for refresh url as well so I added my
> origin in
> > security-admin-console application and its working now.
>
> There's many many reasons why what you're doing isn't the greatest idea
> and you'd be much better with redirecting to the login page (which you can
> style to match your app).
>
> In either case you shouldn't use the security-admin-console app for your
> application, that's for the KC admin console. Create your own app and set
> origin on that!
>
> >
> > ?
> > Regards,
> > ??
> > Sadiq Khoja
> >
> >
> > On Tue, Apr 7, 2015 at 3:12 PM, Marek Posolda < mposolda at redhat.com >
> wrote:
> >
> >
> >
> > Hi,
> >
> > the question is why you need Direct Grant Access in javascript
> application? I
> > think it will be much better to use our javascript adapter and retrieve
> the
> > access token with it:
> >
> http://docs.jboss.org/keycloak/docs/1.2.0.Beta1/userguide/html/ch08.html#javascript-adapter
> >
> > Marek
> >
> >
> > On 7.4.2015 10:24, Sadiq Khoja wrote:
> >
> >
> >
> > Guys,
> >
> > I want to enable CORS for Direct Grant Access, how to do it? I am getting
> > following error from my javascript application:
> >
> > (index):1 XMLHttpRequest cannot load
> > http://localhost:8080/auth/realms/master/tokens/grants/access . No
> > 'Access-Control-Allow-Origin' header is present on the requested
> resource.
> > Origin ' http://pn.localhost:81 ' is therefore not allowed access. The
> > response had HTTP status code 400.
> >
> >
> > ?
> > Regards,
> > ??
> > Sadiq Khoja
> >
> >
> >
> > _______________________________________________
> > keycloak-user mailing list keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
> >
> >
> >
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150407/885349e7/attachment-0001.html 

From stian at redhat.com  Tue Apr  7 06:51:31 2015
From: stian at redhat.com (Stian Thorgersen)
Date: Tue, 7 Apr 2015 06:51:31 -0400 (EDT)
Subject: [keycloak-user] CORS for direct grant access
In-Reply-To: <CAK2HbcyeTu_W_yJBAo26VZGoUXrYaZOke+G4SNZJgkUec8VMqw@mail.gmail.com>
References: <CAK2HbcydC=gd0RbMUz6LoJkmBhPJZXX5E=ZRcTxJpZtCP5Mf2w@mail.gmail.com>
	<5523AD82.4090606@redhat.com>
	<CAK2HbcywFdeT3t33SMx39S4kqnEWxH9hTGNOv3+dHgPbAX-zEw@mail.gmail.com>
	<444858971.13327700.1428403194599.JavaMail.zimbra@redhat.com>
	<CAK2HbcyeTu_W_yJBAo26VZGoUXrYaZOke+G4SNZJgkUec8VMqw@mail.gmail.com>
Message-ID: <980267873.13332763.1428403891212.JavaMail.zimbra@redhat.com>



----- Original Message -----
> From: "Sadiq Khoja" <sadiqkhoja at gmail.com>
> To: "Stian Thorgersen" <stian at redhat.com>
> Cc: "Marek Posolda" <mposolda at redhat.com>, keycloak-user at lists.jboss.org
> Sent: Tuesday, 7 April, 2015 12:47:19 PM
> Subject: Re: [keycloak-user] CORS for direct grant access
> 
> Dear Stian,
> 
> The reason I am not using Keycloak login page is that I have existing
> application which have its own user management. From that application I am
> calling some RestEasy services for which I have configured KeyCloak. So
> basically user would be authenticated using existing application's
> mechanism + keycloak. [crazy things happen]

Sounds pretty crazy - so you basically login user twice from same js code?

> 
> For refreshing token (
> http://localhost:8080/auth/realms/master/tokens/refresh), if I add origin
> to my own public application, would that work?

Yes

> 
> 
> ?
> Regards,
> *??Sadiq Khoja*
> 
> 
> On Tue, Apr 7, 2015 at 3:39 PM, Stian Thorgersen <stian at redhat.com> wrote:
> 
> >
> >
> > ----- Original Message -----
> > > From: "Sadiq Khoja" <sadiqkhoja at gmail.com>
> > > To: "Marek Posolda" <mposolda at redhat.com>
> > > Cc: keycloak-user at lists.jboss.org
> > > Sent: Tuesday, 7 April, 2015 12:28:28 PM
> > > Subject: Re: [keycloak-user] CORS for direct grant access
> > >
> > > Dear Marek,
> > >
> > > Because I don't want to redirect user to Keycloak's login page.
> > >
> > > BTW: I was getting CORS error for refresh url as well so I added my
> > origin in
> > > security-admin-console application and its working now.
> >
> > There's many many reasons why what you're doing isn't the greatest idea
> > and you'd be much better with redirecting to the login page (which you can
> > style to match your app).
> >
> > In either case you shouldn't use the security-admin-console app for your
> > application, that's for the KC admin console. Create your own app and set
> > origin on that!
> >
> > >
> > > ?
> > > Regards,
> > > ??
> > > Sadiq Khoja
> > >
> > >
> > > On Tue, Apr 7, 2015 at 3:12 PM, Marek Posolda < mposolda at redhat.com >
> > wrote:
> > >
> > >
> > >
> > > Hi,
> > >
> > > the question is why you need Direct Grant Access in javascript
> > application? I
> > > think it will be much better to use our javascript adapter and retrieve
> > the
> > > access token with it:
> > >
> > http://docs.jboss.org/keycloak/docs/1.2.0.Beta1/userguide/html/ch08.html#javascript-adapter
> > >
> > > Marek
> > >
> > >
> > > On 7.4.2015 10:24, Sadiq Khoja wrote:
> > >
> > >
> > >
> > > Guys,
> > >
> > > I want to enable CORS for Direct Grant Access, how to do it? I am getting
> > > following error from my javascript application:
> > >
> > > (index):1 XMLHttpRequest cannot load
> > > http://localhost:8080/auth/realms/master/tokens/grants/access . No
> > > 'Access-Control-Allow-Origin' header is present on the requested
> > resource.
> > > Origin ' http://pn.localhost:81 ' is therefore not allowed access. The
> > > response had HTTP status code 400.
> > >
> > >
> > > ?
> > > Regards,
> > > ??
> > > Sadiq Khoja
> > >
> > >
> > >
> > > _______________________________________________
> > > keycloak-user mailing list keycloak-user at lists.jboss.org
> > > https://lists.jboss.org/mailman/listinfo/keycloak-user
> > >
> > >
> > >
> > > _______________________________________________
> > > keycloak-user mailing list
> > > keycloak-user at lists.jboss.org
> > > https://lists.jboss.org/mailman/listinfo/keycloak-user
> >
> 


From kalinga at leapset.com  Tue Apr  7 07:37:38 2015
From: kalinga at leapset.com (Kalinga Dissanayake)
Date: Tue, 7 Apr 2015 17:07:38 +0530 (IST)
Subject: [keycloak-user] Externalising session storage in keycloak
In-Reply-To: <1715592343.13219857.1428387657008.JavaMail.zimbra@redhat.com>
References: <1428322422.154413249@apps.rackspace.com> 
	<1715592343.13219857.1428387657008.JavaMail.zimbra@redhat.com>
Message-ID: <1428406658.20448916@apps.rackspace.com>


What should I do to store sessions in the database? Is there a guide to do this? Should I implement any SPI?
 
Kalinga

-----Original Message-----
From: "Stian Thorgersen" <stian at redhat.com>
Sent: Tuesday, April 7, 2015 11:50am
To: "Kalinga Dissanayake" <kalinga at leapset.com>
Cc: keycloak-user at lists.jboss.org
Subject: Re: Externalising session storage in keycloak



We have support for using either Infinispan or a database (relational or Mongo) to store the user sessions when load balanced.

If performance is not a problem you can just go with storing sessions in the database. Otherwise go with Infinispan, see http://docs.jboss.org/keycloak/docs/1.2.0.Beta1/userguide/html/clustering.html for the details on how to configure that. To use a replicated cache instead of a distributed cache use the following config for Infinspan:

<subsystem xmlns="urn:jboss:domain:infinispan:2.0">
 <cache-container name="keycloak" jndi-name="infinispan/Keycloak" start="EAGER">
 <transport lock-timeout="60000"/>
 <invalidation-cache name="realms" mode="SYNC"/>
 <invalidation-cache name="users" mode="SYNC"/>
 <replicated-cachename="sessions" mode="SYNC"/>
 <replicated-cache name="loginFailures" mode="SYNC"/>
 </cache-container>
 ...
</subsystem>

You can also just use the configuration from the docs above but set 'owners="2"'.

----- Original Message -----
> From: "Kalinga Dissanayake" <kalinga at leapset.com>
> To: keycloak-user at lists.jboss.org
> Cc: "Stian Thorgersen" <stian at redhat.com>
> Sent: Monday, 6 April, 2015 2:13:42 PM
> Subject: Externalising session storage in keycloak
> 
> 
> Guys i know this has been discussed before, but im trying to find a simple
> number of steps for me to externalize the session storage in keycloak.
> I just need to do the following;
> 1. Two servers running keycloak (wildfly)
> 2. A load balancer in front of these two servers. Preferably an AWS
> loadbalancer
> 3. I need to store the session details on an external store so that the
> sessions work accurately.
> 
> There is so much documentation for this but I am actually confused as to what
> i should do and the bare minimum i should do to achieve this. I dont need a
> distributed cache or anything just need one cache store (may be infinispan
> or memcached) and the two keycloak servers running storing the sessions on
> that. Is there one key place i should look into which contains the bare
> minimum i should do.
> 
> Kalinga.
> 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150407/ba370d6b/attachment.html 

From stian at redhat.com  Tue Apr  7 07:43:54 2015
From: stian at redhat.com (Stian Thorgersen)
Date: Tue, 7 Apr 2015 07:43:54 -0400 (EDT)
Subject: [keycloak-user] Externalising session storage in keycloak
In-Reply-To: <1428406658.20448916@apps.rackspace.com>
References: <1428322422.154413249@apps.rackspace.com>
	<1715592343.13219857.1428387657008.JavaMail.zimbra@redhat.com>
	<1428406658.20448916@apps.rackspace.com>
Message-ID: <1293143212.13359181.1428407034901.JavaMail.zimbra@redhat.com>

In keycloak-server.json set userSessionProvider to JPA:

    "userSessions": {
        "provider": "jpa"
    }

You also need to either disable realm and user caches:

    "realmCache": {
        "provider": "none"
    },

    "userCache": {
        "provider": "none"
    }

Or use Infinispan invalidation caches as the clustering documentation suggests.

Bear in mind that if you store user sessions in db and don't use the caches you'll be generating a fair bit of db traffic, so it won't scale extremely well.


----- Original Message -----
> From: "Kalinga Dissanayake" <kalinga at leapset.com>
> To: "Stian Thorgersen" <stian at redhat.com>
> Cc: keycloak-user at lists.jboss.org
> Sent: Tuesday, 7 April, 2015 1:37:38 PM
> Subject: Re: Externalising session storage in keycloak
> 
> 
> What should I do to store sessions in the database? Is there a guide to do
> this? Should I implement any SPI?
>  
> Kalinga
> 
> -----Original Message-----
> From: "Stian Thorgersen" <stian at redhat.com>
> Sent: Tuesday, April 7, 2015 11:50am
> To: "Kalinga Dissanayake" <kalinga at leapset.com>
> Cc: keycloak-user at lists.jboss.org
> Subject: Re: Externalising session storage in keycloak
> 
> 
> 
> We have support for using either Infinispan or a database (relational or
> Mongo) to store the user sessions when load balanced.
> 
> If performance is not a problem you can just go with storing sessions in the
> database. Otherwise go with Infinispan, see
> http://docs.jboss.org/keycloak/docs/1.2.0.Beta1/userguide/html/clustering.html
> for the details on how to configure that. To use a replicated cache instead
> of a distributed cache use the following config for Infinspan:
> 
> <subsystem xmlns="urn:jboss:domain:infinispan:2.0">
>  <cache-container name="keycloak" jndi-name="infinispan/Keycloak"
>  start="EAGER">
>  <transport lock-timeout="60000"/>
>  <invalidation-cache name="realms" mode="SYNC"/>
>  <invalidation-cache name="users" mode="SYNC"/>
>  <replicated-cachename="sessions" mode="SYNC"/>
>  <replicated-cache name="loginFailures" mode="SYNC"/>
>  </cache-container>
>  ...
> </subsystem>
> 
> You can also just use the configuration from the docs above but set
> 'owners="2"'.
> 
> ----- Original Message -----
> > From: "Kalinga Dissanayake" <kalinga at leapset.com>
> > To: keycloak-user at lists.jboss.org
> > Cc: "Stian Thorgersen" <stian at redhat.com>
> > Sent: Monday, 6 April, 2015 2:13:42 PM
> > Subject: Externalising session storage in keycloak
> > 
> > 
> > Guys i know this has been discussed before, but im trying to find a simple
> > number of steps for me to externalize the session storage in keycloak.
> > I just need to do the following;
> > 1. Two servers running keycloak (wildfly)
> > 2. A load balancer in front of these two servers. Preferably an AWS
> > loadbalancer
> > 3. I need to store the session details on an external store so that the
> > sessions work accurately.
> > 
> > There is so much documentation for this but I am actually confused as to
> > what
> > i should do and the bare minimum i should do to achieve this. I dont need a
> > distributed cache or anything just need one cache store (may be infinispan
> > or memcached) and the two keycloak servers running storing the sessions on
> > that. Is there one key place i should look into which contains the bare
> > minimum i should do.
> > 
> > Kalinga.
> >

From kalinga at leapset.com  Tue Apr  7 08:13:47 2015
From: kalinga at leapset.com (Kalinga Dissanayake)
Date: Tue, 7 Apr 2015 17:43:47 +0530 (IST)
Subject: [keycloak-user] Externalising session storage in keycloak
In-Reply-To: <1293143212.13359181.1428407034901.JavaMail.zimbra@redhat.com>
References: <1428322422.154413249@apps.rackspace.com> 
	<1715592343.13219857.1428387657008.JavaMail.zimbra@redhat.com> 
	<1428406658.20448916@apps.rackspace.com> 
	<1293143212.13359181.1428407034901.JavaMail.zimbra@redhat.com>
Message-ID: <1428408827.03846368@apps.rackspace.com>


The database would do for a POC im doing right now. Thanks Stian for the information. Thanks a lot for ur prompt response.
Kalinga


-----Original Message-----
From: "Stian Thorgersen" <stian at redhat.com>
Sent: Tuesday, April 7, 2015 5:13pm
To: "Kalinga Dissanayake" <kalinga at leapset.com>
Cc: keycloak-user at lists.jboss.org
Subject: Re: Externalising session storage in keycloak



In keycloak-server.json set userSessionProvider to JPA:

 "userSessions": {
 "provider": "jpa"
 }

You also need to either disable realm and user caches:

 "realmCache": {
 "provider": "none"
 },

 "userCache": {
 "provider": "none"
 }

Or use Infinispan invalidation caches as the clustering documentation suggests.

Bear in mind that if you store user sessions in db and don't use the caches you'll be generating a fair bit of db traffic, so it won't scale extremely well.


----- Original Message -----
> From: "Kalinga Dissanayake" <kalinga at leapset.com>
> To: "Stian Thorgersen" <stian at redhat.com>
> Cc: keycloak-user at lists.jboss.org
> Sent: Tuesday, 7 April, 2015 1:37:38 PM
> Subject: Re: Externalising session storage in keycloak
> 
> 
> What should I do to store sessions in the database? Is there a guide to do
> this? Should I implement any SPI?
> 
> Kalinga
> 
> -----Original Message-----
> From: "Stian Thorgersen" <stian at redhat.com>
> Sent: Tuesday, April 7, 2015 11:50am
> To: "Kalinga Dissanayake" <kalinga at leapset.com>
> Cc: keycloak-user at lists.jboss.org
> Subject: Re: Externalising session storage in keycloak
> 
> 
> 
> We have support for using either Infinispan or a database (relational or
> Mongo) to store the user sessions when load balanced.
> 
> If performance is not a problem you can just go with storing sessions in the
> database. Otherwise go with Infinispan, see
> http://docs.jboss.org/keycloak/docs/1.2.0.Beta1/userguide/html/clustering.html
> for the details on how to configure that. To use a replicated cache instead
> of a distributed cache use the following config for Infinspan:
> 
> <subsystem xmlns="urn:jboss:domain:infinispan:2.0">
> <cache-container name="keycloak" jndi-name="infinispan/Keycloak"
> start="EAGER">
> <transport lock-timeout="60000"/>
> <invalidation-cache name="realms" mode="SYNC"/>
> <invalidation-cache name="users" mode="SYNC"/>
> <replicated-cachename="sessions" mode="SYNC"/>
> <replicated-cache name="loginFailures" mode="SYNC"/>
> </cache-container>
> ...
> </subsystem>
> 
> You can also just use the configuration from the docs above but set
> 'owners="2"'.
> 
> ----- Original Message -----
> > From: "Kalinga Dissanayake" <kalinga at leapset.com>
> > To: keycloak-user at lists.jboss.org
> > Cc: "Stian Thorgersen" <stian at redhat.com>
> > Sent: Monday, 6 April, 2015 2:13:42 PM
> > Subject: Externalising session storage in keycloak
> > 
> > 
> > Guys i know this has been discussed before, but im trying to find a simple
> > number of steps for me to externalize the session storage in keycloak.
> > I just need to do the following;
> > 1. Two servers running keycloak (wildfly)
> > 2. A load balancer in front of these two servers. Preferably an AWS
> > loadbalancer
> > 3. I need to store the session details on an external store so that the
> > sessions work accurately.
> > 
> > There is so much documentation for this but I am actually confused as to
> > what
> > i should do and the bare minimum i should do to achieve this. I dont need a
> > distributed cache or anything just need one cache store (may be infinispan
> > or memcached) and the two keycloak servers running storing the sessions on
> > that. Is there one key place i should look into which contains the bare
> > minimum i should do.
> > 
> > Kalinga.
> >
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150407/16faf4f4/attachment-0001.html 

From thiago.addevico at gmail.com  Tue Apr  7 09:24:59 2015
From: thiago.addevico at gmail.com (Thiago Presa)
Date: Tue, 7 Apr 2015 10:24:59 -0300
Subject: [keycloak-user] Application Management
In-Reply-To: <657783737.13228908.1428388705228.JavaMail.zimbra@redhat.com>
References: <CAHDpToU94_F930cgJjNFtWe7wyEuJx_cHo1+bGL0enaUNAJxNw@mail.gmail.com>
	<235824875.3863019.1427201098648.JavaMail.zimbra@redhat.com>
	<CAHDpToUsdDRdHo2pPBaQTVSZuKy7ewEC1SREK0x0wLDX=pnxgQ@mail.gmail.com>
	<CAHDpToUx-k3FyXc2QVY_AwG3UjwCzrUdr=7KxzdUzshx_BpvaQ@mail.gmail.com>
	<596874598.6524658.1427432321791.JavaMail.zimbra@redhat.com>
	<CAHDpToX0-FbxM_QmHHtDRjNa+A5Fs4+msnR_=U0u-Ug6Ktiyow@mail.gmail.com>
	<1915332308.6796315.1427464264502.JavaMail.zimbra@redhat.com>
	<CAHDpToXP5P==Qm7bHa=Fwa9QmFihVjtkDh9EuvozXN+fG9JTWw@mail.gmail.com>
	<657783737.13228908.1428388705228.JavaMail.zimbra@redhat.com>
Message-ID: <CAHDpToX_tvzvbMXiOD1=g-AX_8PUt0hZphj1Bquc_vGxxY5i_Q@mail.gmail.com>

To make sure that the user has all roles of a given application. If someone
creates another role after granting app-admin, it is automatically inserted
into app-admin composite role and therefore granted.

On Tue, Apr 7, 2015 at 3:38 AM, Stian Thorgersen <stian at redhat.com> wrote:

> What's the purpose of app-admin?
>
> ----- Original Message -----
> > From: "Thiago Presa" <thiago.addevico at gmail.com>
> > To: "Stian Thorgersen" <stian at redhat.com>
> > Cc: keycloak-user at lists.jboss.org
> > Sent: Wednesday, 1 April, 2015 7:33:26 PM
> > Subject: Re: [keycloak-user] Application Management
> >
> > Speaking with my colleagues, I believe it won't cause troubles for us. We
> > had to give view-applications: the admin console wouldn't work properly,
> > but this is also OK according to our requirements.
> >
> > Would you mind giving us some feedback on [1]? We wrote this to
> experiment
> > a bit with the proposal, but I'm not familiar with keycloak's source or
> > practices. What should I do to help get this merged?
> >
> > [1] https://github.com/keycloak/keycloak/compare/master...tpresa:master
> >
> > On Fri, Mar 27, 2015 at 10:51 AM, Stian Thorgersen <stian at redhat.com>
> wrote:
> >
> > >
> > >
> > > ----- Original Message -----
> > > > From: "Thiago Presa" <thiago.addevico at gmail.com>
> > > > To: "Stian Thorgersen" <stian at redhat.com>
> > > > Cc: keycloak-user at lists.jboss.org
> > > > Sent: Friday, 27 March, 2015 2:01:56 PM
> > > > Subject: Re: [keycloak-user] Application Management
> > > >
> > > > Ah, yes, I didn't understand your proposal properly. Wouldn't giving
> > > > manage-users to app-admins wouldn't cause trouble, since app-admins
> could
> > > > create and modify user accounts?
> > >
> > > Whether or not it's causing trouble depends on your requirements, but
> yes,
> > > they could create and modify user accounts, but not grant more
> privileges.
> > >
> > > If you need to go beyond this one alternative is to wrap the admin
> > > endpoints in your own application. We've just got so much on our plate
> at
> > > the moment that we can't provide this level of control on permissions.
> > >
> > > >
> > > > On Fri, Mar 27, 2015 at 1:58 AM, Stian Thorgersen <stian at redhat.com>
> > > wrote:
> > > >
> > > > > Well, yes.. I told you it was a bit rubbish and would need some
> > > re-design
> > > > > to implement more fine grained permissions. Doing that is a
> relatively
> > > big
> > > > > task and is not a high priority for us ATM.
> > > > >
> > > > > I'm a bit confused by this email as I proposed a simple solution
> that
> > > > > would resolve your requirements. If an admin can only grant
> permissions
> > > > > that admin has access to all you have to do is to create an admin
> that
> > > can
> > > > > only access roles for certain applications and your problem should
> be
> > > > > solved. That's a simple solution that we can add soon.
> > > > >
> > > > > ----- Original Message -----
> > > > > > From: "Thiago Presa" <thiago.addevico at gmail.com>
> > > > > > To: "Stian Thorgersen" <stian at redhat.com>
> > > > > > Cc: keycloak-user at lists.jboss.org
> > > > > > Sent: Thursday, 26 March, 2015 8:10:07 PM
> > > > > > Subject: Re: [keycloak-user] Application Management
> > > > > >
> > > > > > So I've spent the last couple of days playing with the source.
> :-)
> > > > > >
> > > > > > The current authorization mechanism is based on Realm/RealmApp
> i.e.
> > > > > > whenever an API resource is called, check if the User has the
> > > required
> > > > > > Right (manage, any, view) in the resource's Realm/RealmApp.
> > > > > >
> > > > > > Consider, for example, the URI
> > > > > >
> > > /admin/realms/{realm}/applications-by-id/{app-name}/roles/{role-name}.
> > > > > What
> > > > > > I was trying to do is to create a permission for {app-name} so
> that
> > > this
> > > > > > API call wouldn't require any Realm/RealmApp right.
> > > > > >
> > > > > > The problem I see is that this API call trigger many methods
> (i.e.
> > > > > > AdminRoot#getRealmsAdmin, RealmsAdminResource#getRealmAdmin,
> > > > > > RealmAdminResource#getApplicationsById, and so on...), and at
> those
> > > > > methods
> > > > > > there is not enough information to figure out whether this is:
> > > > > >
> > > > > > 1- An app-specific call and thus should be authorized even
> without
> > > realm
> > > > > > authorization, or;
> > > > > > 2- Not app-specific call and this should be properly authorized
> by
> > > > > > Realm/RealmApp.
> > > > > >
> > > > > > Even in the case of (1), the information on which app should I
> check
> > > for
> > > > > > authorization is not available.
> > > > > >
> > > > > > So it seems to me that this resource-loading mechanisms
> pressuposes
> > > an
> > > > > > authorization mechanism that checks only against the realm for
> > > > > permission,
> > > > > > and changing this seems daunting to me.
> > > > > >
> > > > > > Do you guys have any idea on a more local change I could make to
> > > achieve
> > > > > > the intended behavior?
> > > > > >
> > > > > > On Tue, Mar 24, 2015 at 2:33 PM, Thiago Presa <
> > > thiago.addevico at gmail.com
> > > > > >
> > > > > > wrote:
> > > > > >
> > > > > > > OK, agreed. We thought this out of consistency, but if that's
> not a
> > > > > good
> > > > > > > design we surely can consider a better one.
> > > > > > >
> > > > > > > On Tue, Mar 24, 2015 at 9:44 AM, Stian Thorgersen <
> > > stian at redhat.com>
> > > > > > > wrote:
> > > > > > >
> > > > > > >>
> > > > > > >>
> > > > > > >> ----- Original Message -----
> > > > > > >> > From: "Thiago Presa" <thiago.addevico at gmail.com>
> > > > > > >> > To: stian at redhat.com
> > > > > > >> > Cc: keycloak-user at lists.jboss.org
> > > > > > >> > Sent: Tuesday, 24 March, 2015 1:41:16 PM
> > > > > > >> > Subject: Re: [keycloak-user] Application Management
> > > > > > >> >
> > > > > > >> > Hi there,
> > > > > > >> >
> > > > > > >> > I'm Alex's coworker and I'll be working on this too.
> > > > > > >> >
> > > > > > >> > We were just discussing your idea, and it seems to fit our
> > > > > requirements.
> > > > > > >> >
> > > > > > >> > As far as we have seen, keycloak already has a realm-admin
> > > concept.
> > > > > > >> > Whenever a realm "R" is created, it creates a R-realm
> > > application
> > > > > with
> > > > > > >> > a bunch of default roles (manage-users, manage-roles, etc.)
> > > into the
> > > > > > >> > realm master.
> > > > > > >> >
> > > > > > >> > We are currently thinking if we could mimic this structure
> for
> > > > > > >> > applications. What do you think?
> > > > > > >>
> > > > > > >> It's already messy with the way I modelled it and adding the
> same
> > > for
> > > > > > >> applications would be even worse. I don't see why that's
> needed
> > > > > though if
> > > > > > >> we'd add what I proposed.
> > > > > > >>
> > > > > > >> >
> > > > > > >> > > I had an idea a while back that is a simple way to achieve
> > > what
> > > > > you're
> > > > > > >> > > asking for. Th> e idea would be to only allow an admin to
> > > grant
> > > > > roles
> > > > > > >> that
> > > > > > >> > > the admin has access to.
> > > > > > >> >
> > > > > > >> > > Basically:> * A user with admin (super user) role can
> grant
> > > any
> > > > > roles
> > > > > > >> (we
> > > > > > >> > > would need to add a per-> realm super user role)
> > > > > > >> >
> > > > > > >> > > * A user with the role manage-users and some roles on
> app1 can
> > > > > only
> > > > > > >> grant
> > > > > > >> > > other users > the roles on app1
> > > > > > >> >
> > > > > > >> > > * A user with the role manage-users and some roles on
> app2 can
> > > > > only
> > > > > > >> grant
> > > > > > >> > > other users > the roles on app2
> > > > > > >> >
> > > > > > >> > >
> > > > > > >> >
> > > > > > >> > > This is something we should add in either case (to prevent
> > > users
> > > > > > >> granting
> > > > > > >> > themselves more access). Would it solve your problems?
> > > > > > >> >
> > > > > > >>
> > > > > > >
> > > > > > >
> > > > > >
> > > > >
> > > >
> > >
> >
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150407/6fccd757/attachment.html 

From tschneider at connecture.com  Tue Apr  7 09:45:53 2015
From: tschneider at connecture.com (Schneider, Tom)
Date: Tue, 7 Apr 2015 13:45:53 +0000
Subject: [keycloak-user] Running Liquibase updates via maven plugin
In-Reply-To: <5523A28F.4030902@redhat.com>
References: <BLUPR08MB31003F9533E8D887EFE766BB4FE0@BLUPR08MB310.namprd08.prod.outlook.com>
	<55238D88.4050001@redhat.com> <5523A28F.4030902@redhat.com>
Message-ID: <CY1PR0801MB1577F5029823C967345C1D26B4FD0@CY1PR0801MB1577.namprd08.prod.outlook.com>

Yes, it is working for me now.

Thanks!

From: Marek Posolda [mailto:mposolda at redhat.com]
Sent: Tuesday, April 07, 2015 4:26 AM
To: Schneider, Tom; keycloak-user at lists.jboss.org
Subject: Re: [keycloak-user] Running Liquibase updates via maven plugin

Should be fixed now in latest master.

Marek

On 7.4.2015 09:55, Marek Posolda wrote:
Looks like a bug. I've created JIRA https://issues.jboss.org/browse/KEYCLOAK-1181 and will take a look at it.

Marek

On 6.4.2015 20:38, Schneider, Tom wrote:
I'd like to populate a database for keycloak via the command line using the liquibase maven plugin.

With the latest master code, when I try to run this command:
mvn -f connections/jpa-liquibase/pom.xml liquibase:update -Durl=jdbc:h2:keycloak

I receive the following error message:
[ERROR] liquibase.exception.UnexpectedLiquibaseException: liquibase.exception.CustomChangeException: liquibase.exception.SetupException: No KeycloakSession provided in ThreadLocal

Am I missing some setup or is this no longer supported?




_______________________________________________

keycloak-user mailing list

keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>

https://lists.jboss.org/mailman/listinfo/keycloak-user


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150407/f720a0b4/attachment-0001.html 

From tschneider at connecture.com  Tue Apr  7 10:17:56 2015
From: tschneider at connecture.com (Schneider, Tom)
Date: Tue, 7 Apr 2015 14:17:56 +0000
Subject: [keycloak-user] External Registration Flow
Message-ID: <CY1PR0801MB1577E9A148A59AD9A4140E69B4FD0@CY1PR0801MB1577.namprd08.prod.outlook.com>

I have an existing application that I'm looking to integrate with keycloak.  One of the flows we're working on is a user self-registration flow.  In this flow, a user will enter registration information, then the user will be provisioned within the local app and then we use web service calls to create the user in keycloak.  After the user is provisioned, then we do a SAML post to keycloak, the user logs in and then they are redirected back to our app.

This is all working fine, however, the user must enter their username and password twice, once on the registration screen and once to log into keycloak to establish an SSO session.  We'd like to avoid using the keycloak registration screens since we collect additional business data on our registration screen that our app needs.  Are there any suggestions on how to avoid this double login?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150407/18f1cc47/attachment.html 

From bburke at redhat.com  Tue Apr  7 11:30:42 2015
From: bburke at redhat.com (Bill Burke)
Date: Tue, 07 Apr 2015 11:30:42 -0400
Subject: [keycloak-user] External Registration Flow
In-Reply-To: <CY1PR0801MB1577E9A148A59AD9A4140E69B4FD0@CY1PR0801MB1577.namprd08.prod.outlook.com>
References: <CY1PR0801MB1577E9A148A59AD9A4140E69B4FD0@CY1PR0801MB1577.namprd08.prod.outlook.com>
Message-ID: <5523F822.5040109@redhat.com>

To have the seemless integration you want, Keycloak would need some kind 
of remote registration protocol so that registration could be delegated 
to another app.  We don't have this ability yet.  This is because you 
want this flow, right?:

1. Visit app
2. Redirected to Keycloak login
3. Click on registration link on page
4. Redirect to External registration app
5. Register
6. Redirect back to keycloak
7. Import user
8. Redirect back to app


On 4/7/2015 10:17 AM, Schneider, Tom wrote:
> I have an existing application that I?m looking to integrate with
> keycloak.  One of the flows we?re working on is a user self-registration
> flow.  In this flow, a user will enter registration information, then
> the user will be provisioned within the local app and then we use web
> service calls to create the user in keycloak.  After the user is
> provisioned, then we do a SAML post to keycloak, the user logs in and
> then they are redirected back to our app.
>
> This is all working fine, however, the user must enter their username
> and password twice, once on the registration screen and once to log into
> keycloak to establish an SSO session.  We?d like to avoid using the
> keycloak registration screens since we collect additional business data
> on our registration screen that our app needs.  Are there any
> suggestions on how to avoid this double login?
>
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

-- 
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com

From juraci at kroehling.de  Tue Apr  7 11:44:18 2015
From: juraci at kroehling.de (=?UTF-8?B?SnVyYWNpIFBhaXjDo28gS3LDtmhsaW5n?=)
Date: Tue, 07 Apr 2015 17:44:18 +0200
Subject: [keycloak-user] Missing module
Message-ID: <5523FB52.3030506@kroehling.de>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hello,

For Hawkular, we build a distribution based on Wildfly and add our
deployments as modules. Up to Keycloak 1.1.0.Final, we could just add
keycloak-wildfly-adapter-dist to our assembly, plus some changes to
the standalone.xml and it would work fine.

- From Keycloak 1.2.0.Beta1, we get an exception while booting about a
missing module (org.picketlink.idm.schema, required by
org.keycloak.keycloak-ldap-federation). This module is present on
Keycloak's appliance distribution but isn't included on the
wildfly-adapter-dist anymore. Copying this module from the appliance
distribution is enough to make it work again. Is this change on
purpose? If not, I'll send a PR for adding this module into the
adapter-dist.

- - Juca.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBAgAGBQJVI/tSAAoJEDnJtskdmzLMr8gH/3aypIau9zlVEE6OXQFwgcM4
3oprAxVnSXWpxO05OsgAUKgA7yAXdzKzH0z15kYeqMwT0uGHq7w1Sp0+PZR8JWm9
ktv4uAmk974QgN7cevquKzAO/yXy2XPop/egRq0Smi/sR1gBkCw2KtQOSY//6qK2
mPA4aS4WUXmCp7HLU1EEjoJsAoSrZSKjUp4fD/knon7xjXBV+WGBnjKkCVVuUu5P
4rYXr/6dFohVNjShvB2tG9hJXAdeBF8mIgG/gvbgx186zPSi5HavbgJx61O/oJ2K
gp3HCUH7uDofdz3efWbk1CToRoJXnXK7h6d2ctRQBcE6b/iNLsTmr4fabD7JOHk=
=bqHe
-----END PGP SIGNATURE-----

From bburke at redhat.com  Tue Apr  7 11:46:48 2015
From: bburke at redhat.com (Bill Burke)
Date: Tue, 07 Apr 2015 11:46:48 -0400
Subject: [keycloak-user] Missing module
In-Reply-To: <5523FB52.3030506@kroehling.de>
References: <5523FB52.3030506@kroehling.de>
Message-ID: <5523FBE8.1000002@redhat.com>

Send a PR and/or JIRA.  This issue may actually go away for final 1.2 as 
we are forking and refactoring the parts of Picketlink we use and remove 
all dependencies on Picketlink.

On 4/7/2015 11:44 AM, Juraci Paix?o Kr?hling wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Hello,
>
> For Hawkular, we build a distribution based on Wildfly and add our
> deployments as modules. Up to Keycloak 1.1.0.Final, we could just add
> keycloak-wildfly-adapter-dist to our assembly, plus some changes to
> the standalone.xml and it would work fine.
>
> - From Keycloak 1.2.0.Beta1, we get an exception while booting about a
> missing module (org.picketlink.idm.schema, required by
> org.keycloak.keycloak-ldap-federation). This module is present on
> Keycloak's appliance distribution but isn't included on the
> wildfly-adapter-dist anymore. Copying this module from the appliance
> distribution is enough to make it work again. Is this change on
> purpose? If not, I'll send a PR for adding this module into the
> adapter-dist.
>
> - - Juca.
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v2
>
> iQEcBAEBAgAGBQJVI/tSAAoJEDnJtskdmzLMr8gH/3aypIau9zlVEE6OXQFwgcM4
> 3oprAxVnSXWpxO05OsgAUKgA7yAXdzKzH0z15kYeqMwT0uGHq7w1Sp0+PZR8JWm9
> ktv4uAmk974QgN7cevquKzAO/yXy2XPop/egRq0Smi/sR1gBkCw2KtQOSY//6qK2
> mPA4aS4WUXmCp7HLU1EEjoJsAoSrZSKjUp4fD/knon7xjXBV+WGBnjKkCVVuUu5P
> 4rYXr/6dFohVNjShvB2tG9hJXAdeBF8mIgG/gvbgx186zPSi5HavbgJx61O/oJ2K
> gp3HCUH7uDofdz3efWbk1CToRoJXnXK7h6d2ctRQBcE6b/iNLsTmr4fabD7JOHk=
> =bqHe
> -----END PGP SIGNATURE-----
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

-- 
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com

From tschneider at connecture.com  Tue Apr  7 11:52:14 2015
From: tschneider at connecture.com (Schneider, Tom)
Date: Tue, 7 Apr 2015 15:52:14 +0000
Subject: [keycloak-user] External Registration Flow
In-Reply-To: <5523F822.5040109@redhat.com>
References: <CY1PR0801MB1577E9A148A59AD9A4140E69B4FD0@CY1PR0801MB1577.namprd08.prod.outlook.com>
	<5523F822.5040109@redhat.com>
Message-ID: <CY1PR0801MB15777F34E180C5444BAAED06B4FD0@CY1PR0801MB1577.namprd08.prod.outlook.com>

That is close, but not quite the flow we're trying to implement.  This would be the flow we are attempting to implement:

1. Visit app
2. Click on registration link within app
3. Fill out registration info
4. App calls keycloak webservices to create user and set password
5. Redirect to keycloak
6. ??? (Currently SAML Login)
7. Redirect back to app

Ideally I would think there would be a way for the app to request some kind of token that can be sent back to keycloak to allow the user to be logged in with having the end user login explicitly.  However, I haven't found anything that would do something like this yet.

-----Original Message-----
From: keycloak-user-bounces at lists.jboss.org [mailto:keycloak-user-bounces at lists.jboss.org] On Behalf Of Bill Burke
Sent: Tuesday, April 07, 2015 10:31 AM
To: keycloak-user at lists.jboss.org
Subject: Re: [keycloak-user] External Registration Flow

To have the seemless integration you want, Keycloak would need some kind of remote registration protocol so that registration could be delegated to another app.  We don't have this ability yet.  This is because you want this flow, right?:

1. Visit app
2. Redirected to Keycloak login
3. Click on registration link on page
4. Redirect to External registration app 5. Register 6. Redirect back to keycloak 7. Import user 8. Redirect back to app


On 4/7/2015 10:17 AM, Schneider, Tom wrote:
> I have an existing application that I'm looking to integrate with 
> keycloak.  One of the flows we're working on is a user 
> self-registration flow.  In this flow, a user will enter registration 
> information, then the user will be provisioned within the local app 
> and then we use web service calls to create the user in keycloak.  
> After the user is provisioned, then we do a SAML post to keycloak, the 
> user logs in and then they are redirected back to our app.
>
> This is all working fine, however, the user must enter their username 
> and password twice, once on the registration screen and once to log 
> into keycloak to establish an SSO session.  We'd like to avoid using 
> the keycloak registration screens since we collect additional business 
> data on our registration screen that our app needs.  Are there any 
> suggestions on how to avoid this double login?
>
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

--
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com
_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user


From juraci at kroehling.de  Tue Apr  7 11:52:41 2015
From: juraci at kroehling.de (=?windows-1252?Q?Juraci_Paix=E3o_Kr=F6hling?=)
Date: Tue, 07 Apr 2015 17:52:41 +0200
Subject: [keycloak-user] Missing module
In-Reply-To: <5523FBE8.1000002@redhat.com>
References: <5523FB52.3030506@kroehling.de> <5523FBE8.1000002@redhat.com>
Message-ID: <5523FD49.7000809@kroehling.de>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

JIRA created: KEYCLOAK-1190

- - Juca.

On 04/07/2015 05:46 PM, Bill Burke wrote:
> Send a PR and/or JIRA.  This issue may actually go away for final
> 1.2 as we are forking and refactoring the parts of Picketlink we
> use and remove all dependencies on Picketlink.
> 
> On 4/7/2015 11:44 AM, Juraci Paix?o Kr?hling wrote: Hello,
> 
> For Hawkular, we build a distribution based on Wildfly and add our 
> deployments as modules. Up to Keycloak 1.1.0.Final, we could just
> add keycloak-wildfly-adapter-dist to our assembly, plus some
> changes to the standalone.xml and it would work fine.
> 
> From Keycloak 1.2.0.Beta1, we get an exception while booting about
> a missing module (org.picketlink.idm.schema, required by 
> org.keycloak.keycloak-ldap-federation). This module is present on 
> Keycloak's appliance distribution but isn't included on the 
> wildfly-adapter-dist anymore. Copying this module from the
> appliance distribution is enough to make it work again. Is this
> change on purpose? If not, I'll send a PR for adding this module
> into the adapter-dist.
> 
> - Juca.
>> _______________________________________________ keycloak-user
>> mailing list keycloak-user at lists.jboss.org 
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>> 
> 

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBAgAGBQJVI/1JAAoJEDnJtskdmzLMvlkH/iYH3qH93cy92Kt99mkR39Y2
v2NxyxhphnRBSY7ctrvr/9qRrQEdYITxP0I/c9fMNW6uTbF/iEi9MFKPY9ZXF/Qh
W4NthHS02kpkVjqDzgb+72k6d4yVJm38oxxBBmMdNWgJ5rDYrjziQ8JWttjjfm0L
+FC6El27izhZ8ICuUFRzoVFsbOFdQ4/fMfWaaUKGL7tUjIzy9ZXnEzxjEgbZSK7x
rLKOgnBF1mS6BTiK8/N4cImjPQha08YFRunBQyYkqJGuPhvePsr2ZaVIrPDqwEia
+fk/jkScwGG2hYz5BLIL/yGG9XKsA1LT1hk7hpuxRpQbBjLR36eGs8mlg8l9J8A=
=DGOs
-----END PGP SIGNATURE-----

From bburke at redhat.com  Tue Apr  7 12:01:29 2015
From: bburke at redhat.com (Bill Burke)
Date: Tue, 07 Apr 2015 12:01:29 -0400
Subject: [keycloak-user] External Registration Flow
In-Reply-To: <CY1PR0801MB15777F34E180C5444BAAED06B4FD0@CY1PR0801MB1577.namprd08.prod.outlook.com>
References: <CY1PR0801MB1577E9A148A59AD9A4140E69B4FD0@CY1PR0801MB1577.namprd08.prod.outlook.com>
	<5523F822.5040109@redhat.com>
	<CY1PR0801MB15777F34E180C5444BAAED06B4FD0@CY1PR0801MB1577.namprd08.prod.outlook.com>
Message-ID: <5523FF59.9040502@redhat.com>

Wouldn't you want Keycloak to ask for new credential input?  That way 
you can control from keycloak what credential types are required.

On 4/7/2015 11:52 AM, Schneider, Tom wrote:
> That is close, but not quite the flow we're trying to implement.  This would be the flow we are attempting to implement:
>
> 1. Visit app
> 2. Click on registration link within app
> 3. Fill out registration info
> 4. App calls keycloak webservices to create user and set password
> 5. Redirect to keycloak
> 6. ??? (Currently SAML Login)
> 7. Redirect back to app
>
> Ideally I would think there would be a way for the app to request some kind of token that can be sent back to keycloak to allow the user to be logged in with having the end user login explicitly.  However, I haven't found anything that would do something like this yet.
>
> -----Original Message-----
> From: keycloak-user-bounces at lists.jboss.org [mailto:keycloak-user-bounces at lists.jboss.org] On Behalf Of Bill Burke
> Sent: Tuesday, April 07, 2015 10:31 AM
> To: keycloak-user at lists.jboss.org
> Subject: Re: [keycloak-user] External Registration Flow
>
> To have the seemless integration you want, Keycloak would need some kind of remote registration protocol so that registration could be delegated to another app.  We don't have this ability yet.  This is because you want this flow, right?:
>
> 1. Visit app
> 2. Redirected to Keycloak login
> 3. Click on registration link on page
> 4. Redirect to External registration app 5. Register 6. Redirect back to keycloak 7. Import user 8. Redirect back to app
>
>
> On 4/7/2015 10:17 AM, Schneider, Tom wrote:
>> I have an existing application that I'm looking to integrate with
>> keycloak.  One of the flows we're working on is a user
>> self-registration flow.  In this flow, a user will enter registration
>> information, then the user will be provisioned within the local app
>> and then we use web service calls to create the user in keycloak.
>> After the user is provisioned, then we do a SAML post to keycloak, the
>> user logs in and then they are redirected back to our app.
>>
>> This is all working fine, however, the user must enter their username
>> and password twice, once on the registration screen and once to log
>> into keycloak to establish an SSO session.  We'd like to avoid using
>> the keycloak registration screens since we collect additional business
>> data on our registration screen that our app needs.  Are there any
>> suggestions on how to avoid this double login?
>>
>>
>>
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>
> --
> Bill Burke
> JBoss, a division of Red Hat
> http://bill.burkecentral.com
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

-- 
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com

From atgnatus at yahoo.com  Tue Apr  7 17:24:19 2015
From: atgnatus at yahoo.com (Chris Atkinson)
Date: Tue, 7 Apr 2015 21:24:19 +0000 (UTC)
Subject: [keycloak-user] Password Expiration
Message-ID: <1057350151.1728271.1428441859883.JavaMail.yahoo@mail.yahoo.com>


Hi,
How do you configure Keycloak to require users to change their password every, say, 90 days?? Or do you need to write a federation provider?

Thanks,

Chris

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150407/6aaad45d/attachment.html 

From c.rued at xsb.com  Tue Apr  7 17:41:47 2015
From: c.rued at xsb.com (Chris Rued)
Date: Tue, 7 Apr 2015 17:41:47 -0400 (EDT)
Subject: [keycloak-user] Client cert authentication
Message-ID: <2AE93AC3-A86F-4B52-8B26-8226C3CB35FD@xsb.com>

Hi all,

I see on the keycloak homepage that client certificate authentication is "coming soon" for keycloak. Any sense on timing for this/specifics on what it might look like or pointers to docs? 

Thanks,
Chris

Sent from my iPhone

From bburke at redhat.com  Tue Apr  7 17:49:32 2015
From: bburke at redhat.com (Bill Burke)
Date: Tue, 07 Apr 2015 17:49:32 -0400
Subject: [keycloak-user] Client cert authentication
In-Reply-To: <2AE93AC3-A86F-4B52-8B26-8226C3CB35FD@xsb.com>
References: <2AE93AC3-A86F-4B52-8B26-8226C3CB35FD@xsb.com>
Message-ID: <552450EC.9030304@redhat.com>

Apologies, its been "coming soon" for almost a year ;)  It is something 
we need to implement before we get "productized" by Red Hat, so I would 
say sometime this summer.

On 4/7/2015 5:41 PM, Chris Rued wrote:
> Hi all,
>
> I see on the keycloak homepage that client certificate authentication is "coming soon" for keycloak. Any sense on timing for this/specifics on what it might look like or pointers to docs?
>
> Thanks,
> Chris
>
> Sent from my iPhone
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

-- 
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com

From srossillo at smartling.com  Tue Apr  7 18:03:52 2015
From: srossillo at smartling.com (Scott Rossillo)
Date: Tue, 7 Apr 2015 18:03:52 -0400
Subject: [keycloak-user] Impersonate User
Message-ID: <CALAqdu8ecDs5VF4JsNBYkiS4Rc=n2bXjJ3DYT3XfyCWDiM3tgg@mail.gmail.com>

Hi,

We?re looking for the best way to support having one user, such as an
admin, have the ability to impersonate another user. I don?t see a simple
way to do this with Keycloak at the moment.

Would you mind letting me know if this is on the roadmap - I didn?t see a
JIRA - or if you have any recommendations on implementing such behavior.

Thanks,
Scott
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150407/fc2806af/attachment.html 

From bburke at redhat.com  Tue Apr  7 18:06:42 2015
From: bburke at redhat.com (Bill Burke)
Date: Tue, 07 Apr 2015 18:06:42 -0400
Subject: [keycloak-user] Impersonate User
In-Reply-To: <CALAqdu8ecDs5VF4JsNBYkiS4Rc=n2bXjJ3DYT3XfyCWDiM3tgg@mail.gmail.com>
References: <CALAqdu8ecDs5VF4JsNBYkiS4Rc=n2bXjJ3DYT3XfyCWDiM3tgg@mail.gmail.com>
Message-ID: <552454F2.8010403@redhat.com>

We don't have this feature but it is something that some key customers 
want.  I would say we would get to it sometime this summer.

On 4/7/2015 6:03 PM, Scott Rossillo wrote:
> Hi,
>
> We?re looking for the best way to support having one user, such as an
> admin, have the ability to impersonate another user. I don?t see a
> simple way to do this with Keycloak at the moment.
>
> Would you mind letting me know if this is on the roadmap - I didn?t see
> a JIRA - or if you have any recommendations on implementing such behavior.
>
> Thanks,
> Scott
>
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

-- 
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com

From pablo.m.gore at gmail.com  Tue Apr  7 18:29:33 2015
From: pablo.m.gore at gmail.com (Pablo Martin Gore)
Date: Tue, 7 Apr 2015 19:29:33 -0300
Subject: [keycloak-user] Play Framwork
Message-ID: <CANkqDNx+oAzOeKkCMYdrJ0=i5mjPWNM2ysiRa-kzhhynZ2NeMA@mail.gmail.com>

Hi
I need to implement a security process(SSO) in a play + scala application.
could someone help me how I should implement it.
Thanks
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150407/9bd52b4e/attachment.html 

From srossillo at smartling.com  Tue Apr  7 19:13:19 2015
From: srossillo at smartling.com (Scott Rossillo)
Date: Tue, 7 Apr 2015 19:13:19 -0400
Subject: [keycloak-user] Impersonate User
In-Reply-To: <552454F2.8010403@redhat.com>
References: <CALAqdu8ecDs5VF4JsNBYkiS4Rc=n2bXjJ3DYT3XfyCWDiM3tgg@mail.gmail.com>
	<552454F2.8010403@redhat.com>
Message-ID: <CALAqdu_mw7C+mHx1f1JOJcaPDv2EUsGQigQ6k9o8XnrOWcsQqA@mail.gmail.com>

Thanks.

Out of curiosity, how do you see this being implemented? Would a user who
can impersonate another have a specific role to allow this?

I?m thinking a bit about how I may be able to support it before it becomes
a feature, or if it?s something we would be able to contribute.

~ Scott



On Tue, Apr 7, 2015 at 6:06 PM, Bill Burke <bburke at redhat.com> wrote:

> We don't have this feature but it is something that some key customers
> want.  I would say we would get to it sometime this summer.
>
> On 4/7/2015 6:03 PM, Scott Rossillo wrote:
> > Hi,
> >
> > We?re looking for the best way to support having one user, such as an
> > admin, have the ability to impersonate another user. I don?t see a
> > simple way to do this with Keycloak at the moment.
> >
> > Would you mind letting me know if this is on the roadmap - I didn?t see
> > a JIRA - or if you have any recommendations on implementing such
> behavior.
> >
> > Thanks,
> > Scott
> >
> >
> >
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
> >
>
> --
> Bill Burke
> JBoss, a division of Red Hat
> http://bill.burkecentral.com
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150407/fed196a7/attachment.html 

From srossillo at smartling.com  Tue Apr  7 19:29:03 2015
From: srossillo at smartling.com (Scott Rossillo)
Date: Tue, 7 Apr 2015 19:29:03 -0400
Subject: [keycloak-user] CatalinaUserSessionManagement: Session not
	present or already invalidated
In-Reply-To: <5523898F.1020305@redhat.com>
References: <CALAqdu8UmKN7aqQHDkNH1uAAyhTv02gD-8sv5MjoTebt0m-FrQ@mail.gmail.com>
	<551D50FB.9010601@redhat.com>
	<CALAqdu-wxO0nw9uJ4e4j_pn2n1ykFNKEqsC7o-1PqdRXnDyQrg@mail.gmail.com>
	<CALAqdu-_Oq1GGevQ_aQ=rEwB3P7UmiGOvrh1ZFu3D_MrKvm3fA@mail.gmail.com>
	<551E2857.6020501@redhat.com>
	<CALAqdu9m1dfTvjx9jL8TWEunR=oBsLBv-R5hO5fLs3y3+f9y3g@mail.gmail.com>
	<CALAqdu8B+6FheoQnkTKb1MM+ko_4CKrY=B3ymS7_yOZZ2R4pFg@mail.gmail.com>
	<5523898F.1020305@redhat.com>
Message-ID: <CALAqdu9FSg228uGWPY7H1zo=jKN9UREn3MdG=+A1+CBZB8R4CQ@mail.gmail.com>

Marek, yes, I should have mentioned I was using Spring Security, sorry
about that. We will have some code I can share shortly on how to integrate
Spring Security with the adapter.

That being said, we solved the issue at hand by modifying the Spring
Security configuration. If anyone else is having problems with single
sign-out, the key part to change in the Spring Security configuration is to
disable Spring?s session fixation protection.

This is something that?s on by default in many Spring Security installs and
according to the Spring docs it?s intended to:

"Create a new session for the newly authenticated user if they already have
a session (as a defence against session-fixation protection attacks), and
copies their session attributes across to the new session."


So in Spring Security config, "sessionFixation().none()? must be set:

protected void configure(HttpSecurity http) throws Exception {
        http.sessionFixation().none();
}

Here?s the flow if you don?t disable this:
1. User access Resource Server (Spring Secured)
2. User redirected by Keycloak agent to Keycloak auth server
3. Successful login redirects back to Resource Server
4. Agent creates a session
5. Spring authentication invoked (how depends on integration method but
irrelevant here)
6. Spring - to prevent session fixation - creates a new session, copying
all attributes from Keycloak created session

Because of this, the authentication continues to function. However, on
single sign-out, the Keycloak agent tries to invalidate the wrong session
(Spring deleted it).

Hope that helps. Will be happy to share a full set of findings and a
working Spring configuration once we get things all worked out.

Best,
Scott










On Tue, Apr 7, 2015 at 3:38 AM, Marek Posolda <mposolda at redhat.com> wrote:

>  So you're using spring security? This is quite an important detail,
> which you didn't mention before...
>
> Yeah, it depends on the behaviour what Spring security is doing regarding
> sessions. You can try our demo applications customer-portal +
> product-portal. Those are simple servlet applications. If you're not seeing
> issues with them, but still seeing issue with your spring security app,
> then we know that the issue might be related to spring security.
>
> If you manage to have it working with Spring security, it would be cool if
> you can share the details here. We had some questions related to spring
> security in the past. If you manage to secure Spring Security with our
> adapter, it could be good reference for the future.
>
> Thanks,
> Marek
>
>
> On 3.4.2015 22:22, Scott Rossillo wrote:
>
> Update on issue 1, Log user out from KC console:
> It appears this is due to Spring security creating a new session and
> migrating data into it but KC knows nothing about this. There?s a way to
> disable this behavior in Spring Security and I?m going to take that path.
> This should be a non-issue.
>
>  ~ Scott
>
>
> On Fri, Apr 3, 2015 at 3:21 PM, Scott Rossillo <srossillo at smartling.com>
> wrote:
>
>> Ok, so a few followups. Just to be clear, here?s what I?m trying to do
>> and the outcomes of each against 1.2.0.Beta1:
>>
>>  1. (Original scenario) Log user out from KC console (Users > [user]
>> Sessions).
>> Result: This still fails with the exception,
>> "org.keycloak.adapters.tomcat.CatalinaUserSessionManagement.logoutSession
>> Session not present or already invalidated.?
>>
>>  The exception thrown here is an NPE
>> as manager.findSession(httpSessionId) failed to find the session.
>> Interestingly, the session is still valid and the ID passed into the
>> manager is correct. Furthermore, while debugging I can see that
>> manager.findSession() looks up the session in a hash map. Interestingly,
>> the session id (key) is there, but the value (session) is null.  Maybe this
>> is a Tomcat bug.  Using Tomcat 8.0.18, will test with 8.0.21.
>>
>>  2. (Second scenario) Application logout.
>> Documentation 8.10. Logout (
>> http://docs.jboss.org/keycloak/docs/1.2.0.Beta1/userguide/html/ch08.html#d4e1152)
>> say you can either call HttpServletRequest.logout() or redirect
>> tohttp://auth-server/auth/realms/{realm-name}/tokens/logout?redirect_uri=encodedRedirectUri.
>>
>>  However, you have to do both.
>>
>>  Call only .logout() and the KC token is still valid and user can access
>> app with a new session (it will just redirect to KC, see KC session is
>> valid and grant access).
>>
>>  Call only auth-server/?/logout and the Tomcat session remains valid. I
>> would have thought that calling the auth-server?s logout endpoint would
>> broadcast logout events to logged in applications, but it doesn?t.
>>
>>  I?ll file a JIRA for the second case and continue investigating the
>> first scenario with a newer Tomcat release.
>>
>>  Best,
>> Scott
>>
>>
>>
>>
>>
>>
>>
>>
>>
>> On Fri, Apr 3, 2015 at 1:42 AM, Marek Posolda <mposolda at redhat.com>
>> wrote:
>>
>>>  Sure, maybe even easier alternative is to try debugger. You can add
>>> this to the beginning of $TOMCAT_HOME/bin/catalina.sh:
>>>
>>> JAVA_OPTS="$JAVA_OPTS
>>> -agentlib:jdwp=transport=dt_socket,address=5005,server=y,suspend=n"
>>>
>>> then start tomcat and then remotely connect to it from your IDE. You
>>> will need opened IDE with keycloak sources though.
>>>
>>> I've changed the code to display the exception stacktrace, but it will
>>> be available in next release (not yet in 1.2.0.Beta1 released yesterday)
>>>
>>> Marek
>>>
>>>
>>> On 3.4.2015 01:30, Scott Rossillo wrote:
>>>
>>> Still no luck using Tomcat 8 and Keycloak 1.2.0.Beta1.
>>>
>>>  I will install a custom built agent tomorrow to catch the actual
>>> exception to see what's up.
>>>
>>>
>>> On Thursday, April 2, 2015, Scott Rossillo <srossillo at smartling.com>
>>> wrote:
>>>
>>>> Hi,
>>>>
>>>>  Thanks for the reply.
>>>>
>>>>  I was trying to log a user out from the Keycloak admin console. I
>>>> will try the redirect method and see if it works.
>>>>
>>>>  Also, I?m using 1.1.0.Final. I will upgrade to 1.2.0.Beta1 and report
>>>> if the issue is still occurring.
>>>>
>>>>  Best,
>>>> Scott
>>>>
>>>>
>>>> On Thu, Apr 2, 2015 at 10:23 AM, Marek Posolda <mposolda at redhat.com>
>>>> wrote:
>>>>
>>>>>  Hi,
>>>>>
>>>>> I've tried with Apache Tomcat 6.0.35 but wasn't able to reproduce with
>>>>> latest Keycloak 1.2.0.Beta1. Logout works fine for me.
>>>>>
>>>>> How are you doing logout? From the application or from KC admin
>>>>> console? For the tomcat6, the httpServletRequest.logout() method is not yet
>>>>> available, so best for logout from the application is redirecting to
>>>>> Keycloak logout URL similarly like in our demo example:
>>>>> https://github.com/keycloak/keycloak/blob/master/examples/demo-template/customer-app/src/main/webapp/customers/view.jsp#L14
>>>>>
>>>>> You can also enable debug logging, which should show some additional
>>>>> messages in the log by adding this line into
>>>>> $TOMCAT_HOME/conf/logging.properties:
>>>>>
>>>>> org.keycloak.level = FINE
>>>>>
>>>>> Marek
>>>>>
>>>>>
>>>>>
>>>>> On 2.4.2015 01:37, Scott Rossillo wrote:
>>>>>
>>>>>  Hi all,
>>>>>
>>>>>  I?m running Keycloak 1.1.0-Final in standalone mode and using
>>>>> Keycloak agents on Tomcat 6 and Tomcat 8.
>>>>>
>>>>>  With both agents, whenever I try to log a user out via the Keycloak
>>>>> server, I see this in the Tomcat server?s log:
>>>>>
>>>>>  Apr 01, 2015 7:27:47 PM
>>>>> org.keycloak.adapters.tomcat.CatalinaUserSessionManagement logoutSession
>>>>> WARN: Session not present or already invalidated.
>>>>>
>>>>>  The session is still valid and continues to be valid for some period
>>>>> of time in each of the Tomcat instances. Anyone know how to fix?
>>>>>
>>>>>  I was looking at the source and I see this method:
>>>>>
>>>>>    -
>>>>>
>>>>>
>>>>>    - org.keycloak.adapters.tomcat.CatalinaUserSessionManagement.
>>>>>
>>>>> logoutSession()
>>>>>
>>>>>  I may test loging the actual exception tomorrow if no one has a
>>>>> clue, but I think it?s probably the exception is being thrown for some
>>>>> reason other than the session no longer existing (it definitely still does).
>>>>>
>>>>>  Best,
>>>>> Scott
>>>>>
>>>>>
>>>>>
>>>>>  _______________________________________________
>>>>> keycloak-user mailing listkeycloak-user at lists.jboss.orghttps://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>>
>>>>>
>>>>>
>>>>
>>>
>>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150407/74ead484/attachment-0001.html 

From stian at redhat.com  Wed Apr  8 00:15:36 2015
From: stian at redhat.com (Stian Thorgersen)
Date: Wed, 8 Apr 2015 00:15:36 -0400 (EDT)
Subject: [keycloak-user] Application Management
In-Reply-To: <CAHDpToX_tvzvbMXiOD1=g-AX_8PUt0hZphj1Bquc_vGxxY5i_Q@mail.gmail.com>
References: <CAHDpToU94_F930cgJjNFtWe7wyEuJx_cHo1+bGL0enaUNAJxNw@mail.gmail.com>
	<CAHDpToUx-k3FyXc2QVY_AwG3UjwCzrUdr=7KxzdUzshx_BpvaQ@mail.gmail.com>
	<596874598.6524658.1427432321791.JavaMail.zimbra@redhat.com>
	<CAHDpToX0-FbxM_QmHHtDRjNa+A5Fs4+msnR_=U0u-Ug6Ktiyow@mail.gmail.com>
	<1915332308.6796315.1427464264502.JavaMail.zimbra@redhat.com>
	<CAHDpToXP5P==Qm7bHa=Fwa9QmFihVjtkDh9EuvozXN+fG9JTWw@mail.gmail.com>
	<657783737.13228908.1428388705228.JavaMail.zimbra@redhat.com>
	<CAHDpToX_tvzvbMXiOD1=g-AX_8PUt0hZphj1Bquc_vGxxY5i_Q@mail.gmail.com>
Message-ID: <142236929.14040814.1428466536253.JavaMail.zimbra@redhat.com>

Keycloak doesn't add any roles to applications, as we don't want to make special/reserved roles on those and leave it up to users to decide what roles they want. So that would have to be removed.

----- Original Message -----
> From: "Thiago Presa" <thiago.addevico at gmail.com>
> To: "Stian Thorgersen" <stian at redhat.com>
> Cc: keycloak-user at lists.jboss.org
> Sent: Tuesday, 7 April, 2015 3:24:59 PM
> Subject: Re: [keycloak-user] Application Management
> 
> To make sure that the user has all roles of a given application. If someone
> creates another role after granting app-admin, it is automatically inserted
> into app-admin composite role and therefore granted.
> 
> On Tue, Apr 7, 2015 at 3:38 AM, Stian Thorgersen <stian at redhat.com> wrote:
> 
> > What's the purpose of app-admin?
> >
> > ----- Original Message -----
> > > From: "Thiago Presa" <thiago.addevico at gmail.com>
> > > To: "Stian Thorgersen" <stian at redhat.com>
> > > Cc: keycloak-user at lists.jboss.org
> > > Sent: Wednesday, 1 April, 2015 7:33:26 PM
> > > Subject: Re: [keycloak-user] Application Management
> > >
> > > Speaking with my colleagues, I believe it won't cause troubles for us. We
> > > had to give view-applications: the admin console wouldn't work properly,
> > > but this is also OK according to our requirements.
> > >
> > > Would you mind giving us some feedback on [1]? We wrote this to
> > experiment
> > > a bit with the proposal, but I'm not familiar with keycloak's source or
> > > practices. What should I do to help get this merged?
> > >
> > > [1] https://github.com/keycloak/keycloak/compare/master...tpresa:master
> > >
> > > On Fri, Mar 27, 2015 at 10:51 AM, Stian Thorgersen <stian at redhat.com>
> > wrote:
> > >
> > > >
> > > >
> > > > ----- Original Message -----
> > > > > From: "Thiago Presa" <thiago.addevico at gmail.com>
> > > > > To: "Stian Thorgersen" <stian at redhat.com>
> > > > > Cc: keycloak-user at lists.jboss.org
> > > > > Sent: Friday, 27 March, 2015 2:01:56 PM
> > > > > Subject: Re: [keycloak-user] Application Management
> > > > >
> > > > > Ah, yes, I didn't understand your proposal properly. Wouldn't giving
> > > > > manage-users to app-admins wouldn't cause trouble, since app-admins
> > could
> > > > > create and modify user accounts?
> > > >
> > > > Whether or not it's causing trouble depends on your requirements, but
> > yes,
> > > > they could create and modify user accounts, but not grant more
> > privileges.
> > > >
> > > > If you need to go beyond this one alternative is to wrap the admin
> > > > endpoints in your own application. We've just got so much on our plate
> > at
> > > > the moment that we can't provide this level of control on permissions.
> > > >
> > > > >
> > > > > On Fri, Mar 27, 2015 at 1:58 AM, Stian Thorgersen <stian at redhat.com>
> > > > wrote:
> > > > >
> > > > > > Well, yes.. I told you it was a bit rubbish and would need some
> > > > re-design
> > > > > > to implement more fine grained permissions. Doing that is a
> > relatively
> > > > big
> > > > > > task and is not a high priority for us ATM.
> > > > > >
> > > > > > I'm a bit confused by this email as I proposed a simple solution
> > that
> > > > > > would resolve your requirements. If an admin can only grant
> > permissions
> > > > > > that admin has access to all you have to do is to create an admin
> > that
> > > > can
> > > > > > only access roles for certain applications and your problem should
> > be
> > > > > > solved. That's a simple solution that we can add soon.
> > > > > >
> > > > > > ----- Original Message -----
> > > > > > > From: "Thiago Presa" <thiago.addevico at gmail.com>
> > > > > > > To: "Stian Thorgersen" <stian at redhat.com>
> > > > > > > Cc: keycloak-user at lists.jboss.org
> > > > > > > Sent: Thursday, 26 March, 2015 8:10:07 PM
> > > > > > > Subject: Re: [keycloak-user] Application Management
> > > > > > >
> > > > > > > So I've spent the last couple of days playing with the source.
> > :-)
> > > > > > >
> > > > > > > The current authorization mechanism is based on Realm/RealmApp
> > i.e.
> > > > > > > whenever an API resource is called, check if the User has the
> > > > required
> > > > > > > Right (manage, any, view) in the resource's Realm/RealmApp.
> > > > > > >
> > > > > > > Consider, for example, the URI
> > > > > > >
> > > > /admin/realms/{realm}/applications-by-id/{app-name}/roles/{role-name}.
> > > > > > What
> > > > > > > I was trying to do is to create a permission for {app-name} so
> > that
> > > > this
> > > > > > > API call wouldn't require any Realm/RealmApp right.
> > > > > > >
> > > > > > > The problem I see is that this API call trigger many methods
> > (i.e.
> > > > > > > AdminRoot#getRealmsAdmin, RealmsAdminResource#getRealmAdmin,
> > > > > > > RealmAdminResource#getApplicationsById, and so on...), and at
> > those
> > > > > > methods
> > > > > > > there is not enough information to figure out whether this is:
> > > > > > >
> > > > > > > 1- An app-specific call and thus should be authorized even
> > without
> > > > realm
> > > > > > > authorization, or;
> > > > > > > 2- Not app-specific call and this should be properly authorized
> > by
> > > > > > > Realm/RealmApp.
> > > > > > >
> > > > > > > Even in the case of (1), the information on which app should I
> > check
> > > > for
> > > > > > > authorization is not available.
> > > > > > >
> > > > > > > So it seems to me that this resource-loading mechanisms
> > pressuposes
> > > > an
> > > > > > > authorization mechanism that checks only against the realm for
> > > > > > permission,
> > > > > > > and changing this seems daunting to me.
> > > > > > >
> > > > > > > Do you guys have any idea on a more local change I could make to
> > > > achieve
> > > > > > > the intended behavior?
> > > > > > >
> > > > > > > On Tue, Mar 24, 2015 at 2:33 PM, Thiago Presa <
> > > > thiago.addevico at gmail.com
> > > > > > >
> > > > > > > wrote:
> > > > > > >
> > > > > > > > OK, agreed. We thought this out of consistency, but if that's
> > not a
> > > > > > good
> > > > > > > > design we surely can consider a better one.
> > > > > > > >
> > > > > > > > On Tue, Mar 24, 2015 at 9:44 AM, Stian Thorgersen <
> > > > stian at redhat.com>
> > > > > > > > wrote:
> > > > > > > >
> > > > > > > >>
> > > > > > > >>
> > > > > > > >> ----- Original Message -----
> > > > > > > >> > From: "Thiago Presa" <thiago.addevico at gmail.com>
> > > > > > > >> > To: stian at redhat.com
> > > > > > > >> > Cc: keycloak-user at lists.jboss.org
> > > > > > > >> > Sent: Tuesday, 24 March, 2015 1:41:16 PM
> > > > > > > >> > Subject: Re: [keycloak-user] Application Management
> > > > > > > >> >
> > > > > > > >> > Hi there,
> > > > > > > >> >
> > > > > > > >> > I'm Alex's coworker and I'll be working on this too.
> > > > > > > >> >
> > > > > > > >> > We were just discussing your idea, and it seems to fit our
> > > > > > requirements.
> > > > > > > >> >
> > > > > > > >> > As far as we have seen, keycloak already has a realm-admin
> > > > concept.
> > > > > > > >> > Whenever a realm "R" is created, it creates a R-realm
> > > > application
> > > > > > with
> > > > > > > >> > a bunch of default roles (manage-users, manage-roles, etc.)
> > > > into the
> > > > > > > >> > realm master.
> > > > > > > >> >
> > > > > > > >> > We are currently thinking if we could mimic this structure
> > for
> > > > > > > >> > applications. What do you think?
> > > > > > > >>
> > > > > > > >> It's already messy with the way I modelled it and adding the
> > same
> > > > for
> > > > > > > >> applications would be even worse. I don't see why that's
> > needed
> > > > > > though if
> > > > > > > >> we'd add what I proposed.
> > > > > > > >>
> > > > > > > >> >
> > > > > > > >> > > I had an idea a while back that is a simple way to achieve
> > > > what
> > > > > > you're
> > > > > > > >> > > asking for. Th> e idea would be to only allow an admin to
> > > > grant
> > > > > > roles
> > > > > > > >> that
> > > > > > > >> > > the admin has access to.
> > > > > > > >> >
> > > > > > > >> > > Basically:> * A user with admin (super user) role can
> > grant
> > > > any
> > > > > > roles
> > > > > > > >> (we
> > > > > > > >> > > would need to add a per-> realm super user role)
> > > > > > > >> >
> > > > > > > >> > > * A user with the role manage-users and some roles on
> > app1 can
> > > > > > only
> > > > > > > >> grant
> > > > > > > >> > > other users > the roles on app1
> > > > > > > >> >
> > > > > > > >> > > * A user with the role manage-users and some roles on
> > app2 can
> > > > > > only
> > > > > > > >> grant
> > > > > > > >> > > other users > the roles on app2
> > > > > > > >> >
> > > > > > > >> > >
> > > > > > > >> >
> > > > > > > >> > > This is something we should add in either case (to prevent
> > > > users
> > > > > > > >> granting
> > > > > > > >> > themselves more access). Would it solve your problems?
> > > > > > > >> >
> > > > > > > >>
> > > > > > > >
> > > > > > > >
> > > > > > >
> > > > > >
> > > > >
> > > >
> > >
> >
> 

From stian at redhat.com  Wed Apr  8 00:44:07 2015
From: stian at redhat.com (Stian Thorgersen)
Date: Wed, 8 Apr 2015 00:44:07 -0400 (EDT)
Subject: [keycloak-user] Password Expiration
In-Reply-To: <1057350151.1728271.1428441859883.JavaMail.yahoo@mail.yahoo.com>
References: <1057350151.1728271.1428441859883.JavaMail.yahoo@mail.yahoo.com>
Message-ID: <701588571.14045338.1428468247706.JavaMail.zimbra@redhat.com>

We don't have this currently, but it's on the road-map to be added in the not so distant future

----- Original Message -----
> From: "Chris Atkinson" <atgnatus at yahoo.com>
> To: keycloak-user at lists.jboss.org
> Sent: Tuesday, 7 April, 2015 11:24:19 PM
> Subject: [keycloak-user] Password Expiration
> 
> 
> Hi,
> 
> How do you configure Keycloak to require users to change their password
> every, say, 90 days? Or do you need to write a federation provider?
> 
> Thanks,
> 
> Chris
> 
> 
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From stian at redhat.com  Wed Apr  8 00:53:43 2015
From: stian at redhat.com (Stian Thorgersen)
Date: Wed, 8 Apr 2015 00:53:43 -0400 (EDT)
Subject: [keycloak-user] Impersonate User
In-Reply-To: <CALAqdu_mw7C+mHx1f1JOJcaPDv2EUsGQigQ6k9o8XnrOWcsQqA@mail.gmail.com>
References: <CALAqdu8ecDs5VF4JsNBYkiS4Rc=n2bXjJ3DYT3XfyCWDiM3tgg@mail.gmail.com>
	<552454F2.8010403@redhat.com>
	<CALAqdu_mw7C+mHx1f1JOJcaPDv2EUsGQigQ6k9o8XnrOWcsQqA@mail.gmail.com>
Message-ID: <1204559404.14047153.1428468823726.JavaMail.zimbra@redhat.com>

I would say an admin would need a special role as well as having all the roles of the user the admin wants to impersonate.

That's the simple part, second part would be to let an admin login as another user. Maybe that could be done with a query param to the authorization endpoint, for example:

  /realms/myrealm/protocols/openid-connect/auth?...&kc_impersonate=<username>

Would also be good to have a enable/disable option for this feature for a realm.

----- Original Message -----
> From: "Scott Rossillo" <srossillo at smartling.com>
> To: "Bill Burke" <bburke at redhat.com>
> Cc: keycloak-user at lists.jboss.org
> Sent: Wednesday, 8 April, 2015 1:13:19 AM
> Subject: Re: [keycloak-user] Impersonate User
> 
> Thanks.
> 
> Out of curiosity, how do you see this being implemented? Would a user who can
> impersonate another have a specific role to allow this?
> 
> I?m thinking a bit about how I may be able to support it before it becomes a
> feature, or if it?s something we would be able to contribute.
> 
> ~ Scott
> 
> 
> 
> On Tue, Apr 7, 2015 at 6:06 PM, Bill Burke < bburke at redhat.com > wrote:
> 
> 
> We don't have this feature but it is something that some key customers
> want. I would say we would get to it sometime this summer.
> 
> On 4/7/2015 6:03 PM, Scott Rossillo wrote:
> > Hi,
> > 
> > We?re looking for the best way to support having one user, such as an
> > admin, have the ability to impersonate another user. I don?t see a
> > simple way to do this with Keycloak at the moment.
> > 
> > Would you mind letting me know if this is on the roadmap - I didn?t see
> > a JIRA - or if you have any recommendations on implementing such behavior.
> > 
> > Thanks,
> > Scott
> > 
> > 
> > 
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
> > 
> 
> --
> Bill Burke
> JBoss, a division of Red Hat
> http://bill.burkecentral.com
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
> 
> 
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user


From stian at redhat.com  Wed Apr  8 00:56:58 2015
From: stian at redhat.com (Stian Thorgersen)
Date: Wed, 8 Apr 2015 00:56:58 -0400 (EDT)
Subject: [keycloak-user] External Registration Flow
In-Reply-To: <5523FF59.9040502@redhat.com>
References: <CY1PR0801MB1577E9A148A59AD9A4140E69B4FD0@CY1PR0801MB1577.namprd08.prod.outlook.com>
	<5523F822.5040109@redhat.com>
	<CY1PR0801MB15777F34E180C5444BAAED06B4FD0@CY1PR0801MB1577.namprd08.prod.outlook.com>
	<5523FF59.9040502@redhat.com>
Message-ID: <959224520.14048041.1428469018357.JavaMail.zimbra@redhat.com>

Taking one step back on this. You say you can't use Keycloak's registration screens as you collect additional business data. If you could edit the registration page on Keycloak (which you already can) then intercept the required information in an event listener (which you soon can) would that satisfy your needs?


----- Original Message -----
> From: "Bill Burke" <bburke at redhat.com>
> To: "Tom Schneider" <tschneider at connecture.com>, keycloak-user at lists.jboss.org
> Sent: Tuesday, 7 April, 2015 6:01:29 PM
> Subject: Re: [keycloak-user] External Registration Flow
> 
> Wouldn't you want Keycloak to ask for new credential input?  That way
> you can control from keycloak what credential types are required.
> 
> On 4/7/2015 11:52 AM, Schneider, Tom wrote:
> > That is close, but not quite the flow we're trying to implement.  This
> > would be the flow we are attempting to implement:
> >
> > 1. Visit app
> > 2. Click on registration link within app
> > 3. Fill out registration info
> > 4. App calls keycloak webservices to create user and set password
> > 5. Redirect to keycloak
> > 6. ??? (Currently SAML Login)
> > 7. Redirect back to app
> >
> > Ideally I would think there would be a way for the app to request some kind
> > of token that can be sent back to keycloak to allow the user to be logged
> > in with having the end user login explicitly.  However, I haven't found
> > anything that would do something like this yet.
> >
> > -----Original Message-----
> > From: keycloak-user-bounces at lists.jboss.org
> > [mailto:keycloak-user-bounces at lists.jboss.org] On Behalf Of Bill Burke
> > Sent: Tuesday, April 07, 2015 10:31 AM
> > To: keycloak-user at lists.jboss.org
> > Subject: Re: [keycloak-user] External Registration Flow
> >
> > To have the seemless integration you want, Keycloak would need some kind of
> > remote registration protocol so that registration could be delegated to
> > another app.  We don't have this ability yet.  This is because you want
> > this flow, right?:
> >
> > 1. Visit app
> > 2. Redirected to Keycloak login
> > 3. Click on registration link on page
> > 4. Redirect to External registration app 5. Register 6. Redirect back to
> > keycloak 7. Import user 8. Redirect back to app
> >
> >
> > On 4/7/2015 10:17 AM, Schneider, Tom wrote:
> >> I have an existing application that I'm looking to integrate with
> >> keycloak.  One of the flows we're working on is a user
> >> self-registration flow.  In this flow, a user will enter registration
> >> information, then the user will be provisioned within the local app
> >> and then we use web service calls to create the user in keycloak.
> >> After the user is provisioned, then we do a SAML post to keycloak, the
> >> user logs in and then they are redirected back to our app.
> >>
> >> This is all working fine, however, the user must enter their username
> >> and password twice, once on the registration screen and once to log
> >> into keycloak to establish an SSO session.  We'd like to avoid using
> >> the keycloak registration screens since we collect additional business
> >> data on our registration screen that our app needs.  Are there any
> >> suggestions on how to avoid this double login?
> >>
> >>
> >>
> >> _______________________________________________
> >> keycloak-user mailing list
> >> keycloak-user at lists.jboss.org
> >> https://lists.jboss.org/mailman/listinfo/keycloak-user
> >>
> >
> > --
> > Bill Burke
> > JBoss, a division of Red Hat
> > http://bill.burkecentral.com
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
> >
> 
> --
> Bill Burke
> JBoss, a division of Red Hat
> http://bill.burkecentral.com
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
> 

From stian at redhat.com  Wed Apr  8 03:25:31 2015
From: stian at redhat.com (Stian Thorgersen)
Date: Wed, 8 Apr 2015 03:25:31 -0400 (EDT)
Subject: [keycloak-user] Keycloak OpenShift Cartridge updated to 1.2.0.Beta1
In-Reply-To: <694212140.14093778.1428477923038.JavaMail.zimbra@redhat.com>
Message-ID: <1946564269.14093836.1428477931444.JavaMail.zimbra@redhat.com>

Keycloak OpenShift Cartridge updated to 1.2.0.Beta1

https://github.com/keycloak/openshift-keycloak-cartridge

From bburke at redhat.com  Wed Apr  8 08:50:06 2015
From: bburke at redhat.com (Bill Burke)
Date: Wed, 08 Apr 2015 08:50:06 -0400
Subject: [keycloak-user] Impersonate User
In-Reply-To: <CALAqdu_mw7C+mHx1f1JOJcaPDv2EUsGQigQ6k9o8XnrOWcsQqA@mail.gmail.com>
References: <CALAqdu8ecDs5VF4JsNBYkiS4Rc=n2bXjJ3DYT3XfyCWDiM3tgg@mail.gmail.com>	<552454F2.8010403@redhat.com>
	<CALAqdu_mw7C+mHx1f1JOJcaPDv2EUsGQigQ6k9o8XnrOWcsQqA@mail.gmail.com>
Message-ID: <552523FE.1090103@redhat.com>

I'm not sure yet.  It would have to be a service that accepts a token, 
verifies a role (as you suggest), ditches the current user's session 
cookie and sets up themselves as the impersonated user.

On 4/7/2015 7:13 PM, Scott Rossillo wrote:
> Thanks.
>
> Out of curiosity, how do you see this being implemented? Would a user
> who can impersonate another have a specific role to allow this?
>
> I?m thinking a bit about how I may be able to support it before it
> becomes a feature, or if it?s something we would be able to contribute.
>
> ~ Scott
>
>
>
> On Tue, Apr 7, 2015 at 6:06 PM, Bill Burke <bburke at redhat.com
> <mailto:bburke at redhat.com>> wrote:
>
>     We don't have this feature but it is something that some key customers
>     want.  I would say we would get to it sometime this summer.
>
>     On 4/7/2015 6:03 PM, Scott Rossillo wrote:
>      > Hi,
>      >
>      > We?re looking for the best way to support having one user, such as an
>      > admin, have the ability to impersonate another user. I don?t see a
>      > simple way to do this with Keycloak at the moment.
>      >
>      > Would you mind letting me know if this is on the roadmap - I
>     didn?t see
>      > a JIRA - or if you have any recommendations on implementing such
>     behavior.
>      >
>      > Thanks,
>      > Scott
>      >
>      >
>      >
>      > _______________________________________________
>      > keycloak-user mailing list
>      > keycloak-user at lists.jboss.org <mailto:keycloak-user at lists.jboss.org>
>      > https://lists.jboss.org/mailman/listinfo/keycloak-user
>      >
>
>     --
>     Bill Burke
>     JBoss, a division of Red Hat
>     http://bill.burkecentral.com
>     _______________________________________________
>     keycloak-user mailing list
>     keycloak-user at lists.jboss.org <mailto:keycloak-user at lists.jboss.org>
>     https://lists.jboss.org/mailman/listinfo/keycloak-user
>
>

-- 
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com

From mposolda at redhat.com  Wed Apr  8 09:53:52 2015
From: mposolda at redhat.com (Marek Posolda)
Date: Wed, 08 Apr 2015 15:53:52 +0200
Subject: [keycloak-user] CatalinaUserSessionManagement: Session not
 present or already invalidated
In-Reply-To: <CALAqdu9FSg228uGWPY7H1zo=jKN9UREn3MdG=+A1+CBZB8R4CQ@mail.gmail.com>
References: <CALAqdu8UmKN7aqQHDkNH1uAAyhTv02gD-8sv5MjoTebt0m-FrQ@mail.gmail.com>	<551D50FB.9010601@redhat.com>	<CALAqdu-wxO0nw9uJ4e4j_pn2n1ykFNKEqsC7o-1PqdRXnDyQrg@mail.gmail.com>	<CALAqdu-_Oq1GGevQ_aQ=rEwB3P7UmiGOvrh1ZFu3D_MrKvm3fA@mail.gmail.com>	<551E2857.6020501@redhat.com>	<CALAqdu9m1dfTvjx9jL8TWEunR=oBsLBv-R5hO5fLs3y3+f9y3g@mail.gmail.com>	<CALAqdu8B+6FheoQnkTKb1MM+ko_4CKrY=B3ymS7_yOZZ2R4pFg@mail.gmail.com>	<5523898F.1020305@redhat.com>
	<CALAqdu9FSg228uGWPY7H1zo=jKN9UREn3MdG=+A1+CBZB8R4CQ@mail.gmail.com>
Message-ID: <552532F0.6070106@redhat.com>

Thanks for the info. So we can actually do either:
- Disable sessionFixation in spring security
- Provide an endpoint (or reuse existing refresh token endpoint), which 
will allow to send changed HttpSession ID to keycloak server. There was 
very similar request from someone else couple of days before, so 
probably it's something we should consider to support.

Anyway, it could be cool if you can share instructions and/or example on 
how to integrate Keycloak with Spring security. It's good that it works 
with our adapters without need to change something in them.

Thanks!
Marek

On 8.4.2015 01:29, Scott Rossillo wrote:
> Marek, yes, I should have mentioned I was using Spring Security, sorry 
> about that. We will have some code I can share shortly on how to 
> integrate Spring Security with the adapter.
>
> That being said, we solved the issue at hand by modifying the Spring 
> Security configuration. If anyone else is having problems with single 
> sign-out, the key part to change in the Spring Security configuration 
> is to disable Spring?s session fixation protection.
>
> This is something that?s on by default in many Spring Security 
> installs and according to the Spring docs it?s intended to:
>
>     "Create a new session for the newly authenticated user if they
>     already have a session (as a defence against session-fixation
>     protection attacks), and copies their session attributes across to
>     the new session."
>
>
> So in Spring Security config, "sessionFixation().none()? must be set:
>
> protected void configure(HttpSecurity http) throws Exception {
>         http.sessionFixation().none();
> }
>
> Here?s the flow if you don?t disable this:
> 1. User access Resource Server (Spring Secured)
> 2. User redirected by Keycloak agent to Keycloak auth server
> 3. Successful login redirects back to Resource Server
> 4. Agent creates a session
> 5. Spring authentication invoked (how depends on integration method 
> but irrelevant here)
> 6. Spring - to prevent session fixation - creates a new session, 
> copying all attributes from Keycloak created session
>
> Because of this, the authentication continues to function. However, on 
> single sign-out, the Keycloak agent tries to invalidate the wrong 
> session (Spring deleted it).
>
> Hope that helps. Will be happy to share a full set of findings and a 
> working Spring configuration once we get things all worked out.
>
> Best,
> Scott
>
>
>
>
>
>
>
>
>
>
> On Tue, Apr 7, 2015 at 3:38 AM, Marek Posolda <mposolda at redhat.com 
> <mailto:mposolda at redhat.com>> wrote:
>
>     So you're using spring security? This is quite an important
>     detail, which you didn't mention before...
>
>     Yeah, it depends on the behaviour what Spring security is doing
>     regarding sessions. You can try our demo applications
>     customer-portal + product-portal. Those are simple servlet
>     applications. If you're not seeing issues with them, but still
>     seeing issue with your spring security app, then we know that the
>     issue might be related to spring security.
>
>     If you manage to have it working with Spring security, it would be
>     cool if you can share the details here. We had some questions
>     related to spring security in the past. If you manage to secure
>     Spring Security with our adapter, it could be good reference for
>     the future.
>
>     Thanks,
>     Marek
>
>
>     On 3.4.2015 22:22, Scott Rossillo wrote:
>>     Update on issue 1, Log user out from KC console:
>>     It appears this is due to Spring security creating a new session
>>     and migrating data into it but KC knows nothing about this.
>>     There?s a way to disable this behavior in Spring Security and I?m
>>     going to take that path.  This should be a non-issue.
>>
>>     ~ Scott
>>
>>
>>     On Fri, Apr 3, 2015 at 3:21 PM, Scott Rossillo
>>     <srossillo at smartling.com <mailto:srossillo at smartling.com>> wrote:
>>
>>         Ok, so a few followups. Just to be clear, here?s what I?m
>>         trying to do and the outcomes of each against 1.2.0.Beta1:
>>
>>         1. (Original scenario) Log user out from KC console (Users >
>>         [user] Sessions).
>>         Result: This still fails with the exception,
>>         "org.keycloak.adapters.tomcat.CatalinaUserSessionManagement.logoutSession
>>         Session not present or already invalidated.?
>>
>>         The exception thrown here is an NPE
>>         as manager.findSession(httpSessionId) failed to find the
>>         session. Interestingly, the session is still valid and the ID
>>         passed into the manager is correct. Furthermore, while
>>         debugging I can see that manager.findSession() looks up the
>>         session in a hash map. Interestingly, the session id (key) is
>>         there, but the value (session) is null.  Maybe this is a
>>         Tomcat bug.  Using Tomcat 8.0.18, will test with 8.0.21.
>>
>>         2. (Second scenario) Application logout.
>>         Documentation 8.10. Logout
>>         (http://docs.jboss.org/keycloak/docs/1.2.0.Beta1/userguide/html/ch08.html#d4e1152)
>>         say you can either call HttpServletRequest.logout() or
>>         redirect
>>         tohttp://auth-server/auth/realms/{realm-name}/tokens/logout?redirect_uri=encodedRedirectUri.
>>
>>         However, you have to do both.
>>
>>         Call only .logout() and the KC token is still valid and user
>>         can access app with a new session (it will just redirect to
>>         KC, see KC session is valid and grant access).
>>
>>         Call only auth-server/?/logout and the Tomcat session remains
>>         valid. I would have thought that calling the auth-server?s
>>         logout endpoint would broadcast logout events to logged in
>>         applications, but it doesn?t.
>>
>>         I?ll file a JIRA for the second case and continue
>>         investigating the first scenario with a newer Tomcat release.
>>
>>         Best,
>>         Scott
>>
>>
>>
>>
>>
>>
>>
>>
>>
>>         On Fri, Apr 3, 2015 at 1:42 AM, Marek Posolda
>>         <mposolda at redhat.com <mailto:mposolda at redhat.com>> wrote:
>>
>>             Sure, maybe even easier alternative is to try debugger.
>>             You can add this to the beginning of
>>             $TOMCAT_HOME/bin/catalina.sh:
>>
>>             JAVA_OPTS="$JAVA_OPTS
>>             -agentlib:jdwp=transport=dt_socket,address=5005,server=y,suspend=n"
>>
>>             then start tomcat and then remotely connect to it from
>>             your IDE. You will need opened IDE with keycloak sources
>>             though.
>>
>>             I've changed the code to display the exception
>>             stacktrace, but it will be available in next release (not
>>             yet in 1.2.0.Beta1 released yesterday)
>>
>>             Marek
>>
>>
>>             On 3.4.2015 01:30, Scott Rossillo wrote:
>>>             Still no luck using Tomcat 8 and Keycloak 1.2.0.Beta1.
>>>
>>>             I will install a custom built agent tomorrow to catch
>>>             the actual exception to see what's up.
>>>
>>>
>>>             On Thursday, April 2, 2015, Scott Rossillo
>>>             <srossillo at smartling.com
>>>             <mailto:srossillo at smartling.com>> wrote:
>>>
>>>                 Hi,
>>>
>>>                 Thanks for the reply.
>>>
>>>                 I was trying to log a user out from the Keycloak
>>>                 admin console. I will try the redirect method and
>>>                 see if it works.
>>>
>>>                 Also, I?m using 1.1.0.Final. I will upgrade to
>>>                 1.2.0.Beta1 and report if the issue is still occurring.
>>>
>>>                 Best,
>>>                 Scott
>>>
>>>                 On Thu, Apr 2, 2015 at 10:23 AM, Marek Posolda
>>>                 <mposolda at redhat.com> wrote:
>>>
>>>                     Hi,
>>>
>>>                     I've tried with Apache Tomcat 6.0.35 but wasn't
>>>                     able to reproduce with latest Keycloak
>>>                     1.2.0.Beta1. Logout works fine for me.
>>>
>>>                     How are you doing logout? From the application
>>>                     or from KC admin console? For the tomcat6, the
>>>                     httpServletRequest.logout() method is not yet
>>>                     available, so best for logout from the
>>>                     application is redirecting to Keycloak logout
>>>                     URL similarly like in our demo example:
>>>                     https://github.com/keycloak/keycloak/blob/master/examples/demo-template/customer-app/src/main/webapp/customers/view.jsp#L14
>>>
>>>                     You can also enable debug logging, which should
>>>                     show some additional messages in the log by
>>>                     adding this line into
>>>                     $TOMCAT_HOME/conf/logging.properties:
>>>
>>>                     org.keycloak.level = FINE
>>>
>>>                     Marek
>>>
>>>
>>>
>>>                     On 2.4.2015 01:37, Scott Rossillo wrote:
>>>>                     Hi all,
>>>>
>>>>                     I?m running Keycloak 1.1.0-Final in standalone
>>>>                     mode and using Keycloak agents on Tomcat 6 and
>>>>                     Tomcat 8.
>>>>
>>>>                     With both agents, whenever I try to log a user
>>>>                     out via the Keycloak server, I see this in the
>>>>                     Tomcat server?s log:
>>>>
>>>>                     Apr 01, 2015 7:27:47 PM
>>>>                     org.keycloak.adapters.tomcat.CatalinaUserSessionManagement
>>>>                     logoutSession
>>>>                     WARN: Session not present or already invalidated.
>>>>
>>>>                     The session is still valid and continues to be
>>>>                     valid for some period of time in each of the
>>>>                     Tomcat instances. Anyone know how to fix?
>>>>
>>>>                     I was looking at the source and I see this method:
>>>>
>>>>                      *
>>>>
>>>>
>>>>                       * org.keycloak.adapters.tomcat.CatalinaUserSessionManagement.
>>>>
>>>>                     logoutSession()
>>>>
>>>>                     I may test loging the actual exception tomorrow
>>>>                     if no one has a clue, but I think it?s probably
>>>>                     the exception is being thrown for some reason
>>>>                     other than the session no longer existing (it
>>>>                     definitely still does).
>>>>
>>>>                     Best,
>>>>                     Scott
>>>>
>>>>
>>>>
>>>>                     _______________________________________________
>>>>                     keycloak-user mailing list
>>>>                     keycloak-user at lists.jboss.org
>>>>                     https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>
>>>
>>
>>
>>
>
>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150408/34907fa2/attachment-0001.html 

From bburke at redhat.com  Wed Apr  8 09:55:01 2015
From: bburke at redhat.com (Bill Burke)
Date: Wed, 08 Apr 2015 09:55:01 -0400
Subject: [keycloak-user] Impersonate User
In-Reply-To: <1204559404.14047153.1428468823726.JavaMail.zimbra@redhat.com>
References: <CALAqdu8ecDs5VF4JsNBYkiS4Rc=n2bXjJ3DYT3XfyCWDiM3tgg@mail.gmail.com>
	<552454F2.8010403@redhat.com>
	<CALAqdu_mw7C+mHx1f1JOJcaPDv2EUsGQigQ6k9o8XnrOWcsQqA@mail.gmail.com>
	<1204559404.14047153.1428468823726.JavaMail.zimbra@redhat.com>
Message-ID: <55253335.2080703@redhat.com>

I worry a bit about how this can be exploited.  I think it might need to 
be its own service that

1. checks and verifies the admin is logged in (via the cookie)
2. Re-authenticates the admin manually
3. Logouts out the admin and logins him in as impersonated user.

There might be other sensitive areas/features where we might want to 
require manual re-authentication before.

Also, we might also want to add information to the id/access tokens and 
saml assertions for auditing purposes so that clients know that the user 
is being impersonated.

FYI, I know this is a must-have feature in order for Red Hat IT to use us.


On 4/8/2015 12:53 AM, Stian Thorgersen wrote:
> I would say an admin would need a special role as well as having all the roles of the user the admin wants to impersonate.
>
> That's the simple part, second part would be to let an admin login as another user. Maybe that could be done with a query param to the authorization endpoint, for example:
>
>    /realms/myrealm/protocols/openid-connect/auth?...&kc_impersonate=<username>
>
> Would also be good to have a enable/disable option for this feature for a realm.
>
> ----- Original Message -----
>> From: "Scott Rossillo" <srossillo at smartling.com>
>> To: "Bill Burke" <bburke at redhat.com>
>> Cc: keycloak-user at lists.jboss.org
>> Sent: Wednesday, 8 April, 2015 1:13:19 AM
>> Subject: Re: [keycloak-user] Impersonate User
>>
>> Thanks.
>>
>> Out of curiosity, how do you see this being implemented? Would a user who can
>> impersonate another have a specific role to allow this?
>>
>> I?m thinking a bit about how I may be able to support it before it becomes a
>> feature, or if it?s something we would be able to contribute.
>>
>> ~ Scott
>>
>>
>>
>> On Tue, Apr 7, 2015 at 6:06 PM, Bill Burke < bburke at redhat.com > wrote:
>>
>>
>> We don't have this feature but it is something that some key customers
>> want. I would say we would get to it sometime this summer.
>>
>> On 4/7/2015 6:03 PM, Scott Rossillo wrote:
>>> Hi,
>>>
>>> We?re looking for the best way to support having one user, such as an
>>> admin, have the ability to impersonate another user. I don?t see a
>>> simple way to do this with Keycloak at the moment.
>>>
>>> Would you mind letting me know if this is on the roadmap - I didn?t see
>>> a JIRA - or if you have any recommendations on implementing such behavior.
>>>
>>> Thanks,
>>> Scott
>>>
>>>
>>>
>>> _______________________________________________
>>> keycloak-user mailing list
>>> keycloak-user at lists.jboss.org
>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>
>>
>> --
>> Bill Burke
>> JBoss, a division of Red Hat
>> http://bill.burkecentral.com
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>>
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user

-- 
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com

From bburke at redhat.com  Wed Apr  8 09:57:21 2015
From: bburke at redhat.com (Bill Burke)
Date: Wed, 08 Apr 2015 09:57:21 -0400
Subject: [keycloak-user] External Registration Flow
In-Reply-To: <959224520.14048041.1428469018357.JavaMail.zimbra@redhat.com>
References: <CY1PR0801MB1577E9A148A59AD9A4140E69B4FD0@CY1PR0801MB1577.namprd08.prod.outlook.com>
	<5523F822.5040109@redhat.com>
	<CY1PR0801MB15777F34E180C5444BAAED06B4FD0@CY1PR0801MB1577.namprd08.prod.outlook.com>
	<5523FF59.9040502@redhat.com>
	<959224520.14048041.1428469018357.JavaMail.zimbra@redhat.com>
Message-ID: <552533C1.10604@redhat.com>

Our registration pages can actually accept input to store any user 
attribute, albeit it is only name/value pairs for custom attributes.

http://docs.jboss.org/keycloak/docs/1.2.0.Beta1/userguide/html/custom-user-attributes.html

On 4/8/2015 12:56 AM, Stian Thorgersen wrote:
> Taking one step back on this. You say you can't use Keycloak's registration screens as you collect additional business data. If you could edit the registration page on Keycloak (which you already can) then intercept the required information in an event listener (which you soon can) would that satisfy your needs?
>
>
> ----- Original Message -----
>> From: "Bill Burke" <bburke at redhat.com>
>> To: "Tom Schneider" <tschneider at connecture.com>, keycloak-user at lists.jboss.org
>> Sent: Tuesday, 7 April, 2015 6:01:29 PM
>> Subject: Re: [keycloak-user] External Registration Flow
>>
>> Wouldn't you want Keycloak to ask for new credential input?  That way
>> you can control from keycloak what credential types are required.
>>
>> On 4/7/2015 11:52 AM, Schneider, Tom wrote:
>>> That is close, but not quite the flow we're trying to implement.  This
>>> would be the flow we are attempting to implement:
>>>
>>> 1. Visit app
>>> 2. Click on registration link within app
>>> 3. Fill out registration info
>>> 4. App calls keycloak webservices to create user and set password
>>> 5. Redirect to keycloak
>>> 6. ??? (Currently SAML Login)
>>> 7. Redirect back to app
>>>
>>> Ideally I would think there would be a way for the app to request some kind
>>> of token that can be sent back to keycloak to allow the user to be logged
>>> in with having the end user login explicitly.  However, I haven't found
>>> anything that would do something like this yet.
>>>
>>> -----Original Message-----
>>> From: keycloak-user-bounces at lists.jboss.org
>>> [mailto:keycloak-user-bounces at lists.jboss.org] On Behalf Of Bill Burke
>>> Sent: Tuesday, April 07, 2015 10:31 AM
>>> To: keycloak-user at lists.jboss.org
>>> Subject: Re: [keycloak-user] External Registration Flow
>>>
>>> To have the seemless integration you want, Keycloak would need some kind of
>>> remote registration protocol so that registration could be delegated to
>>> another app.  We don't have this ability yet.  This is because you want
>>> this flow, right?:
>>>
>>> 1. Visit app
>>> 2. Redirected to Keycloak login
>>> 3. Click on registration link on page
>>> 4. Redirect to External registration app 5. Register 6. Redirect back to
>>> keycloak 7. Import user 8. Redirect back to app
>>>
>>>
>>> On 4/7/2015 10:17 AM, Schneider, Tom wrote:
>>>> I have an existing application that I'm looking to integrate with
>>>> keycloak.  One of the flows we're working on is a user
>>>> self-registration flow.  In this flow, a user will enter registration
>>>> information, then the user will be provisioned within the local app
>>>> and then we use web service calls to create the user in keycloak.
>>>> After the user is provisioned, then we do a SAML post to keycloak, the
>>>> user logs in and then they are redirected back to our app.
>>>>
>>>> This is all working fine, however, the user must enter their username
>>>> and password twice, once on the registration screen and once to log
>>>> into keycloak to establish an SSO session.  We'd like to avoid using
>>>> the keycloak registration screens since we collect additional business
>>>> data on our registration screen that our app needs.  Are there any
>>>> suggestions on how to avoid this double login?
>>>>
>>>>
>>>>
>>>> _______________________________________________
>>>> keycloak-user mailing list
>>>> keycloak-user at lists.jboss.org
>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>
>>>
>>> --
>>> Bill Burke
>>> JBoss, a division of Red Hat
>>> http://bill.burkecentral.com
>>> _______________________________________________
>>> keycloak-user mailing list
>>> keycloak-user at lists.jboss.org
>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>
>>
>> --
>> Bill Burke
>> JBoss, a division of Red Hat
>> http://bill.burkecentral.com
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>

-- 
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com

From tschneider at connecture.com  Wed Apr  8 10:01:57 2015
From: tschneider at connecture.com (Schneider, Tom)
Date: Wed, 8 Apr 2015 14:01:57 +0000
Subject: [keycloak-user] External Registration Flow
In-Reply-To: <959224520.14048041.1428469018357.JavaMail.zimbra@redhat.com>
References: <CY1PR0801MB1577E9A148A59AD9A4140E69B4FD0@CY1PR0801MB1577.namprd08.prod.outlook.com>
	<5523F822.5040109@redhat.com>
	<CY1PR0801MB15777F34E180C5444BAAED06B4FD0@CY1PR0801MB1577.namprd08.prod.outlook.com>
	<5523FF59.9040502@redhat.com>
	<959224520.14048041.1428469018357.JavaMail.zimbra@redhat.com>
Message-ID: <CY1PR0801MB15778F3BDBB93DF9580A076AB4FC0@CY1PR0801MB1577.namprd08.prod.outlook.com>

I originally proposed that we separate out the account registration to a separate screen from the additional business data entry and hop over to keycloak for the account registration part.  This would work, however, our business analysts would prefer to keep the user experience the same as it is today.

As far as replicating the exact same screen we have today, I would see issues with that.  We have dynamic headers, footers and side navigation functionality that would be difficult to implement in keycloak.  This is also part of a larger flow so we would need to be able to handle forward/back navigation buttons.  There is also quite a bit of additional data that we capture, so I could see future maintenance being an issue if we had to update keycloak every time we wanted to make changes.  It's a good thought, but unfortunately I think our page is too complex for that.

One thought I had was utilizing the new identity broker functionality for this.  Our app would be setup as both a SAML service provider and a SAML brokered identity provider.  Our app would send a SAML response to keycloak as the identity provider, keycloak would create a SSO session for that user and then send the user back to our app with a keycloak SAML response.  Not quite the standard use case for this feature, but any thoughts on if this might work?

-----Original Message-----
From: Stian Thorgersen [mailto:stian at redhat.com] 
Sent: Tuesday, April 07, 2015 11:57 PM
To: Bill Burke
Cc: Schneider, Tom; keycloak-user at lists.jboss.org
Subject: Re: [keycloak-user] External Registration Flow

Taking one step back on this. You say you can't use Keycloak's registration screens as you collect additional business data. If you could edit the registration page on Keycloak (which you already can) then intercept the required information in an event listener (which you soon can) would that satisfy your needs?


----- Original Message -----
> From: "Bill Burke" <bburke at redhat.com>
> To: "Tom Schneider" <tschneider at connecture.com>, 
> keycloak-user at lists.jboss.org
> Sent: Tuesday, 7 April, 2015 6:01:29 PM
> Subject: Re: [keycloak-user] External Registration Flow
> 
> Wouldn't you want Keycloak to ask for new credential input?  That way 
> you can control from keycloak what credential types are required.
> 
> On 4/7/2015 11:52 AM, Schneider, Tom wrote:
> > That is close, but not quite the flow we're trying to implement.  
> > This would be the flow we are attempting to implement:
> >
> > 1. Visit app
> > 2. Click on registration link within app 3. Fill out registration 
> > info 4. App calls keycloak webservices to create user and set 
> > password 5. Redirect to keycloak 6. ??? (Currently SAML Login) 7. 
> > Redirect back to app
> >
> > Ideally I would think there would be a way for the app to request 
> > some kind of token that can be sent back to keycloak to allow the 
> > user to be logged in with having the end user login explicitly.  
> > However, I haven't found anything that would do something like this yet.
> >
> > -----Original Message-----
> > From: keycloak-user-bounces at lists.jboss.org
> > [mailto:keycloak-user-bounces at lists.jboss.org] On Behalf Of Bill 
> > Burke
> > Sent: Tuesday, April 07, 2015 10:31 AM
> > To: keycloak-user at lists.jboss.org
> > Subject: Re: [keycloak-user] External Registration Flow
> >
> > To have the seemless integration you want, Keycloak would need some 
> > kind of remote registration protocol so that registration could be 
> > delegated to another app.  We don't have this ability yet.  This is 
> > because you want this flow, right?:
> >
> > 1. Visit app
> > 2. Redirected to Keycloak login
> > 3. Click on registration link on page 4. Redirect to External 
> > registration app 5. Register 6. Redirect back to keycloak 7. Import 
> > user 8. Redirect back to app
> >
> >
> > On 4/7/2015 10:17 AM, Schneider, Tom wrote:
> >> I have an existing application that I'm looking to integrate with 
> >> keycloak.  One of the flows we're working on is a user 
> >> self-registration flow.  In this flow, a user will enter 
> >> registration information, then the user will be provisioned within 
> >> the local app and then we use web service calls to create the user in keycloak.
> >> After the user is provisioned, then we do a SAML post to keycloak, 
> >> the user logs in and then they are redirected back to our app.
> >>
> >> This is all working fine, however, the user must enter their 
> >> username and password twice, once on the registration screen and 
> >> once to log into keycloak to establish an SSO session.  We'd like 
> >> to avoid using the keycloak registration screens since we collect 
> >> additional business data on our registration screen that our app 
> >> needs.  Are there any suggestions on how to avoid this double login?
> >>
> >>
> >>
> >> _______________________________________________
> >> keycloak-user mailing list
> >> keycloak-user at lists.jboss.org
> >> https://lists.jboss.org/mailman/listinfo/keycloak-user
> >>
> >
> > --
> > Bill Burke
> > JBoss, a division of Red Hat
> > http://bill.burkecentral.com
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
> >
> 
> --
> Bill Burke
> JBoss, a division of Red Hat
> http://bill.burkecentral.com
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
> 


From bburke at redhat.com  Wed Apr  8 10:09:03 2015
From: bburke at redhat.com (Bill Burke)
Date: Wed, 08 Apr 2015 10:09:03 -0400
Subject: [keycloak-user] External Registration Flow
In-Reply-To: <CY1PR0801MB15778F3BDBB93DF9580A076AB4FC0@CY1PR0801MB1577.namprd08.prod.outlook.com>
References: <CY1PR0801MB1577E9A148A59AD9A4140E69B4FD0@CY1PR0801MB1577.namprd08.prod.outlook.com>
	<5523F822.5040109@redhat.com>
	<CY1PR0801MB15777F34E180C5444BAAED06B4FD0@CY1PR0801MB1577.namprd08.prod.outlook.com>
	<5523FF59.9040502@redhat.com>
	<959224520.14048041.1428469018357.JavaMail.zimbra@redhat.com>
	<CY1PR0801MB15778F3BDBB93DF9580A076AB4FC0@CY1PR0801MB1577.namprd08.prod.outlook.com>
Message-ID: <5525367F.8060607@redhat.com>



On 4/8/2015 10:01 AM, Schneider, Tom wrote:
> I originally proposed that we separate out the account registration to a separate screen from the additional business data entry and hop over to keycloak for the account registration part.  This would work, however, our business analysts would prefer to keep the user experience the same as it is today.
>
> As far as replicating the exact same screen we have today, I would see issues with that.  We have dynamic headers, footers and side navigation functionality that would be difficult to implement in keycloak.  This is also part of a larger flow so we would need to be able to handle forward/back navigation buttons.  There is also quite a bit of additional data that we capture, so I could see future maintenance being an issue if we had to update keycloak every time we wanted to make changes.  It's a good thought, but unfortunately I think our page is too complex for that.
>
> One thought I had was utilizing the new identity broker functionality for this.  Our app would be setup as both a SAML service provider and a SAML brokered identity provider.  Our app would send a SAML response to keycloak as the identity provider, keycloak would create a SSO session for that user and then send the user back to our app with a keycloak SAML response.  Not quite the standard use case for this feature, but any thoughts on if this might work?
>

Yes, using a broker could work if the registration link was on the 
Keycloak login page.  I guess in this case Keycloak would need a 
"lightweight" IDP implementation to use in this scenario.  Otherwise you 
guys will be implementing a lot of crap protocol stuff.

-- 
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com

From prabhalar at yahoo.com  Wed Apr  8 10:17:02 2015
From: prabhalar at yahoo.com (Raghu Prabhala)
Date: Wed, 8 Apr 2015 10:17:02 -0400
Subject: [keycloak-user] Impersonate User
In-Reply-To: <55253335.2080703@redhat.com>
References: <CALAqdu8ecDs5VF4JsNBYkiS4Rc=n2bXjJ3DYT3XfyCWDiM3tgg@mail.gmail.com>
	<552454F2.8010403@redhat.com>
	<CALAqdu_mw7C+mHx1f1JOJcaPDv2EUsGQigQ6k9o8XnrOWcsQqA@mail.gmail.com>
	<1204559404.14047153.1428468823726.JavaMail.zimbra@redhat.com>
	<55253335.2080703@redhat.com>
Message-ID: <E99EEBE1-B241-4775-B06D-F76C074250EC@yahoo.com>

Jumping in with my requirements as Impersonation is a very sensitive issue. It has to be read only and clearly indicated in both gui and audit engine( logs). We typically require both the admin and user information populated for audit purposes which means that the admin should not be logged out. 

Sent from my iPhone

> On Apr 8, 2015, at 9:55 AM, Bill Burke <bburke at redhat.com> wrote:
> 
> I worry a bit about how this can be exploited.  I think it might need to 
> be its own service that
> 
> 1. checks and verifies the admin is logged in (via the cookie)
> 2. Re-authenticates the admin manually
> 3. Logouts out the admin and logins him in as impersonated user.
> 
> There might be other sensitive areas/features where we might want to 
> require manual re-authentication before.
> 
> Also, we might also want to add information to the id/access tokens and 
> saml assertions for auditing purposes so that clients know that the user 
> is being impersonated.
> 
> FYI, I know this is a must-have feature in order for Red Hat IT to use us.
> 
> 
>> On 4/8/2015 12:53 AM, Stian Thorgersen wrote:
>> I would say an admin would need a special role as well as having all the roles of the user the admin wants to impersonate.
>> 
>> That's the simple part, second part would be to let an admin login as another user. Maybe that could be done with a query param to the authorization endpoint, for example:
>> 
>>   /realms/myrealm/protocols/openid-connect/auth?...&kc_impersonate=<username>
>> 
>> Would also be good to have a enable/disable option for this feature for a realm.
>> 
>> ----- Original Message -----
>>> From: "Scott Rossillo" <srossillo at smartling.com>
>>> To: "Bill Burke" <bburke at redhat.com>
>>> Cc: keycloak-user at lists.jboss.org
>>> Sent: Wednesday, 8 April, 2015 1:13:19 AM
>>> Subject: Re: [keycloak-user] Impersonate User
>>> 
>>> Thanks.
>>> 
>>> Out of curiosity, how do you see this being implemented? Would a user who can
>>> impersonate another have a specific role to allow this?
>>> 
>>> I?m thinking a bit about how I may be able to support it before it becomes a
>>> feature, or if it?s something we would be able to contribute.
>>> 
>>> ~ Scott
>>> 
>>> 
>>> 
>>> On Tue, Apr 7, 2015 at 6:06 PM, Bill Burke < bburke at redhat.com > wrote:
>>> 
>>> 
>>> We don't have this feature but it is something that some key customers
>>> want. I would say we would get to it sometime this summer.
>>> 
>>>> On 4/7/2015 6:03 PM, Scott Rossillo wrote:
>>>> Hi,
>>>> 
>>>> We?re looking for the best way to support having one user, such as an
>>>> admin, have the ability to impersonate another user. I don?t see a
>>>> simple way to do this with Keycloak at the moment.
>>>> 
>>>> Would you mind letting me know if this is on the roadmap - I didn?t see
>>>> a JIRA - or if you have any recommendations on implementing such behavior.
>>>> 
>>>> Thanks,
>>>> Scott
>>>> 
>>>> 
>>>> 
>>>> _______________________________________________
>>>> keycloak-user mailing list
>>>> keycloak-user at lists.jboss.org
>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>> 
>>> --
>>> Bill Burke
>>> JBoss, a division of Red Hat
>>> http://bill.burkecentral.com
>>> _______________________________________________
>>> keycloak-user mailing list
>>> keycloak-user at lists.jboss.org
>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>> 
>>> 
>>> _______________________________________________
>>> keycloak-user mailing list
>>> keycloak-user at lists.jboss.org
>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
> 
> -- 
> Bill Burke
> JBoss, a division of Red Hat
> http://bill.burkecentral.com
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user


From prabhalar at yahoo.com  Wed Apr  8 10:29:13 2015
From: prabhalar at yahoo.com (Raghu Prabhala)
Date: Wed, 8 Apr 2015 10:29:13 -0400
Subject: [keycloak-user] Keycloak roadmap
Message-ID: <702EF0BD-ACFE-4902-B7AF-29AAE61BCD58@yahoo.com>

Hi Dev team,

Can you let us know the road map for  keycloak? What are your plans regarding FIDO protocol and WS Trust/STS?

Thanks 
Raghu

Sent from my iPhone

From srossillo at smartling.com  Wed Apr  8 10:56:09 2015
From: srossillo at smartling.com (Scott Rossillo)
Date: Wed, 8 Apr 2015 10:56:09 -0400
Subject: [keycloak-user] Impersonate User
In-Reply-To: <E99EEBE1-B241-4775-B06D-F76C074250EC@yahoo.com>
References: <CALAqdu8ecDs5VF4JsNBYkiS4Rc=n2bXjJ3DYT3XfyCWDiM3tgg@mail.gmail.com>
	<552454F2.8010403@redhat.com>
	<CALAqdu_mw7C+mHx1f1JOJcaPDv2EUsGQigQ6k9o8XnrOWcsQqA@mail.gmail.com>
	<1204559404.14047153.1428468823726.JavaMail.zimbra@redhat.com>
	<55253335.2080703@redhat.com>
	<E99EEBE1-B241-4775-B06D-F76C074250EC@yahoo.com>
Message-ID: <CALAqdu8S4waCixOodbqUgzYh-DGsAAgOYEi82Bxv_PxNS5trTg@mail.gmail.com>

One thing I've seen done with Spring Security (custom code) is to implement
the impersonation as a "stack."  An admin impersonating another user gets
pushed instead of logged out and when the impersonated user is logged out,
the admin is popped and re-becomes the principal. This may be much more
complex with distributed security, but the pseudo code of the token would
be something like:

public class KeycloakSecurityContext {
  boolean isImpersonated;
  KeycloakSecurityContext impersonatingContext;
}

This is obviously only one aspect but could be used by an application to
know if the user is impersonated, and who's doing the impersonating.

~ Scott


On Wed, Apr 8, 2015 at 10:17 AM, Raghu Prabhala <prabhalar at yahoo.com> wrote:

> Jumping in with my requirements as Impersonation is a very sensitive
> issue. It has to be read only and clearly indicated in both gui and audit
> engine( logs). We typically require both the admin and user information
> populated for audit purposes which means that the admin should not be
> logged out.
>
> Sent from my iPhone
>
> > On Apr 8, 2015, at 9:55 AM, Bill Burke <bburke at redhat.com> wrote:
> >
> > I worry a bit about how this can be exploited.  I think it might need to
> > be its own service that
> >
> > 1. checks and verifies the admin is logged in (via the cookie)
> > 2. Re-authenticates the admin manually
> > 3. Logouts out the admin and logins him in as impersonated user.
> >
> > There might be other sensitive areas/features where we might want to
> > require manual re-authentication before.
> >
> > Also, we might also want to add information to the id/access tokens and
> > saml assertions for auditing purposes so that clients know that the user
> > is being impersonated.
> >
> > FYI, I know this is a must-have feature in order for Red Hat IT to use
> us.
> >
> >
> >> On 4/8/2015 12:53 AM, Stian Thorgersen wrote:
> >> I would say an admin would need a special role as well as having all
> the roles of the user the admin wants to impersonate.
> >>
> >> That's the simple part, second part would be to let an admin login as
> another user. Maybe that could be done with a query param to the
> authorization endpoint, for example:
> >>
> >>
>  /realms/myrealm/protocols/openid-connect/auth?...&kc_impersonate=<username>
> >>
> >> Would also be good to have a enable/disable option for this feature for
> a realm.
> >>
> >> ----- Original Message -----
> >>> From: "Scott Rossillo" <srossillo at smartling.com>
> >>> To: "Bill Burke" <bburke at redhat.com>
> >>> Cc: keycloak-user at lists.jboss.org
> >>> Sent: Wednesday, 8 April, 2015 1:13:19 AM
> >>> Subject: Re: [keycloak-user] Impersonate User
> >>>
> >>> Thanks.
> >>>
> >>> Out of curiosity, how do you see this being implemented? Would a user
> who can
> >>> impersonate another have a specific role to allow this?
> >>>
> >>> I?m thinking a bit about how I may be able to support it before it
> becomes a
> >>> feature, or if it?s something we would be able to contribute.
> >>>
> >>> ~ Scott
> >>>
> >>>
> >>>
> >>> On Tue, Apr 7, 2015 at 6:06 PM, Bill Burke < bburke at redhat.com >
> wrote:
> >>>
> >>>
> >>> We don't have this feature but it is something that some key customers
> >>> want. I would say we would get to it sometime this summer.
> >>>
> >>>> On 4/7/2015 6:03 PM, Scott Rossillo wrote:
> >>>> Hi,
> >>>>
> >>>> We?re looking for the best way to support having one user, such as an
> >>>> admin, have the ability to impersonate another user. I don?t see a
> >>>> simple way to do this with Keycloak at the moment.
> >>>>
> >>>> Would you mind letting me know if this is on the roadmap - I didn?t
> see
> >>>> a JIRA - or if you have any recommendations on implementing such
> behavior.
> >>>>
> >>>> Thanks,
> >>>> Scott
> >>>>
> >>>>
> >>>>
> >>>> _______________________________________________
> >>>> keycloak-user mailing list
> >>>> keycloak-user at lists.jboss.org
> >>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
> >>>
> >>> --
> >>> Bill Burke
> >>> JBoss, a division of Red Hat
> >>> http://bill.burkecentral.com
> >>> _______________________________________________
> >>> keycloak-user mailing list
> >>> keycloak-user at lists.jboss.org
> >>> https://lists.jboss.org/mailman/listinfo/keycloak-user
> >>>
> >>>
> >>> _______________________________________________
> >>> keycloak-user mailing list
> >>> keycloak-user at lists.jboss.org
> >>> https://lists.jboss.org/mailman/listinfo/keycloak-user
> >
> > --
> > Bill Burke
> > JBoss, a division of Red Hat
> > http://bill.burkecentral.com
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150408/c29cac50/attachment.html 

From stian at redhat.com  Wed Apr  8 13:44:06 2015
From: stian at redhat.com (Stian Thorgersen)
Date: Wed, 8 Apr 2015 13:44:06 -0400 (EDT)
Subject: [keycloak-user] Keycloak roadmap
In-Reply-To: <702EF0BD-ACFE-4902-B7AF-29AAE61BCD58@yahoo.com>
References: <702EF0BD-ACFE-4902-B7AF-29AAE61BCD58@yahoo.com>
Message-ID: <631534930.14551657.1428515046308.JavaMail.zimbra@redhat.com>



----- Original Message -----
> From: "Raghu Prabhala" <prabhalar at yahoo.com>
> To: keycloak-user at lists.jboss.org
> Sent: Wednesday, 8 April, 2015 4:29:13 PM
> Subject: [keycloak-user] Keycloak roadmap
> 
> Hi Dev team,
> 
> Can you let us know the road map for  keycloak? What are your plans regarding
> FIDO protocol and WS Trust/STS?

Both should be coming in the next few months

> 
> Thanks
> Raghu
> 
> Sent from my iPhone
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
> 

From thomas_connolly at yahoo.com  Wed Apr  8 19:50:28 2015
From: thomas_connolly at yahoo.com (Thomas Connolly)
Date: Wed, 8 Apr 2015 23:50:28 +0000 (UTC)
Subject: [keycloak-user] Using Informix DB with Keycloak ...
In-Reply-To: <493030664.13237004.1428390545942.JavaMail.zimbra@redhat.com>
References: <493030664.13237004.1428390545942.JavaMail.zimbra@redhat.com>
Message-ID: <1563383367.2903136.1428537028268.JavaMail.yahoo@mail.yahoo.com>

Hi Stian
Thank you, by default the Informix hibernate dialect is selected, thus I used the substitutions.See below.2015-04-07 08:48:41,160 INFO ?[org.hibernate.dialect.Dialect] (MSC service thread 1-6) HHH000400: Using dialect: org.hibernate.dialect.InformixDialect
As you suggested I also set the dialect explicitly the result was the same error as above.
I'll work this a little more, as I believe this may be an issue with hibernate on Informix. But I'll verify.
Regards
 Tom Connolly.
      From: Stian Thorgersen <stian at redhat.com>
 To: Thomas Connolly <thomas_connolly at yahoo.com> 
Cc: keycloak-user at lists.jboss.org 
 Sent: Tuesday, April 7, 2015 5:09 PM
 Subject: Re: [keycloak-user] Using Informix DB with Keycloak ...
   
To start with we can most likely accept PRs to make Informix to work, but we can't support all dbs out there.

That being said it looks like either the Informix dialect is not being used, or it's not working properly. What you've done below hibernate.query.substitutions should be taken care of by Hibernate dialects.

Try setting the "driverDialect" to org.hibernate.dialect.InformixDialect and see if you're still having issues.

Another problem you may encounter is that Liquibase change-sets may need to be tweaked to work with Informix.



----- Original Message -----
> From: "Thomas Connolly" <thomas_connolly at yahoo.com>
> To: keycloak-user at lists.jboss.org
> Sent: Tuesday, 7 April, 2015 2:10:33 AM
> Subject: [keycloak-user] Using Informix DB with Keycloak ...
> 
> Hi All
> 
> As part of a standardisation process, I'm trying to get Keycloak working with
> Informix DB, the enterprise DB!
> I understand that Keycloak does not officially support Informix however given
> the use of JPA / Hibernate I though there was a good chance it would work
> out of the box.
> However this has proven not the case. The connection dialect does indeed
> recognise Informix but does not appear to correctly map to this DB.
> 
> The issue I've come across is the handling of boolean conditional in SQL.
> 
> In RoleEntry.java the query
> @NamedQuery(name="getRealmRoleByName", query="select role from RoleEntity
> role where role.applicationRole = false and role.name = :name and role.realm
> = :realm")
> 
> Generates the following
> select
> roleentity0_.id as id1_15_,
> roleentity0_.APP_REALM_CONSTRAINT as APP_REAL2_15_,
> roleentity0_.APPLICATION as APPLICAT7_15_,
> roleentity0_.APPLICATION_ROLE as APPLICAT3_15_,
> roleentity0_.DESCRIPTION as DESCRIPT4_15_,
> roleentity0_.NAME as NAME5_15_,
> roleentity0_.REALM as REALM8_15_,
> roleentity0_.REALM_ID as REALM_ID6_15_
> from
> KEYCLOAK_ROLE roleentity0_
> where
> roleentity0_.APPLICATION_ROLE=0
> The above does not work with Informix as 't', 'f', true and false
> respectively is used. So it should be
> where
> roleentity0_.APPLICATION_ROLE='f'
> 
> Looking through the code, it appears I cannot configure this. Happy to be
> proven wrong here!
> I found I could override within Hibernate using the property
> hibernate.query.substitutions=true t, false f
> 
> I've added this change into DefaultJpaConnectionProviderFactory.java
> 
> String querySubstitutions = config.get("querySubstitutions");
> if (querySubstitutions != null) {
> logger.debug("hibernate.query.substitutions=" + querySubstitutions);
> properties.put("hibernate.query.substitutions", querySubstitutions);
> }
> 
> Adding the setting in keycloak-server.json
> "connectionsJpa": {
> "default": {
> "dataSource": "java:jboss/datasources/KeycloakDS",
> "databaseSchema": "update",
> "querySubstitutions" : "true t, false f"
> }
> 
> However I've found the translation is not occurring as I would have expected.
> 
> Can you please advise on the approach I'm taking or any alternatives I have
> not looked into?
> 
> Also once we get this working with Informix how can I get it added to the
> supported DB list?
> 
> Regards
> Tom Connolly.
> 
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user


  
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150408/f61f14c9/attachment-0001.html 

From egor.kolesnikov at fastlane-it.com  Wed Apr  8 22:58:12 2015
From: egor.kolesnikov at fastlane-it.com (Egor Kolesnikov)
Date: Thu, 9 Apr 2015 12:58:12 +1000
Subject: [keycloak-user] Multi-tenancy applications
Message-ID: <CAOQKvCaBik-yw=Uy6aBG9=+nOffmKSihyf1B63yJWVPgjDMOhg@mail.gmail.com>

I've been using Keycloak for quite some time now on a couple of projects,
and it's absolutely awesome - it just does the right thing, straight out of
the box.

However, what I found quite confusing is the "Realm" definition which is
missing from the documentation.
I'm trying to add multi-tenancy support to our application and found it a
bit confusing. It seems that Keycloak's approach to multitenancy is "Realm
per tenant" - which makes sense, until it comes to realisation that the
applications only exist within realms. This implies that if there are few
hundreds of tenants (i.e. organisations using the application), the task of
changing application config (i.e. adding application-level role or
adding/removing redirect URL) becomes maintenance nightmare.

Is it at all possible to define a "global", not realm-confined application
in Keycloak? Would it be hard to implement? Happy to put some effort into
it and send a pull request.

A bit more context:
- I have an webapp that serves multiple organisations.
- Each organisation has its own users and admins (who can create users and
other admins).
- There is a "Super" administrator who creates organisations and admins.
- Webapp can recognise the organisation based on Company ID or domain name.

Many thanks in advance.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150409/44ffabc9/attachment.html 

From mposolda at redhat.com  Thu Apr  9 03:23:43 2015
From: mposolda at redhat.com (Marek Posolda)
Date: Thu, 09 Apr 2015 09:23:43 +0200
Subject: [keycloak-user] Impersonate User
In-Reply-To: <CALAqdu8S4waCixOodbqUgzYh-DGsAAgOYEi82Bxv_PxNS5trTg@mail.gmail.com>
References: <CALAqdu8ecDs5VF4JsNBYkiS4Rc=n2bXjJ3DYT3XfyCWDiM3tgg@mail.gmail.com>	<552454F2.8010403@redhat.com>	<CALAqdu_mw7C+mHx1f1JOJcaPDv2EUsGQigQ6k9o8XnrOWcsQqA@mail.gmail.com>	<1204559404.14047153.1428468823726.JavaMail.zimbra@redhat.com>	<55253335.2080703@redhat.com>	<E99EEBE1-B241-4775-B06D-F76C074250EC@yahoo.com>
	<CALAqdu8S4waCixOodbqUgzYh-DGsAAgOYEi82Bxv_PxNS5trTg@mail.gmail.com>
Message-ID: <552628FF.7060303@redhat.com>

This is very similar to how I've implemented impersonation in GateIn 
portal. Basically the session wrapped the "admin" session and after 
logout, the admin session was restored back. So admin wasn't logged-out, 
but he was able to continue with his session in exactly same state like 
before impersonation.

But for the Keycloak, it will be very tricky to support this as Keycloak 
is SSO and admin is already logged to some applications before he 
started impersonation session. So for support of save/restore the admin 
session, we would need to implement the "stack" for the UserSession on 
auth-server but also for all the application sessions. This might be 
possible (but quite tricky) for servlet adapters, but I am not seeing 
how to properly support it for JS adapter...

In shortcut, it seems that we would really need to logout original admin 
session and then login as impersonated user. For audit purpose, we will 
have info that session is impersonated, but IMO we will not be able to 
restore original admin session back to the state before impersonation.

Marek


On 8.4.2015 16:56, Scott Rossillo wrote:
> One thing I've seen done with Spring Security (custom code) is to 
> implement the impersonation as a "stack."  An admin impersonating 
> another user gets pushed instead of logged out and when the 
> impersonated user is logged out, the admin is popped and re-becomes 
> the principal. This may be much more complex with distributed 
> security, but the pseudo code of the token would be something like:
>
> public class KeycloakSecurityContext {
>   boolean isImpersonated;
>   KeycloakSecurityContext impersonatingContext;
> }
>
> This is obviously only one aspect but could be used by an application 
> to know if the user is impersonated, and who's doing the impersonating.
>
> ~ Scott
>
>
> On Wed, Apr 8, 2015 at 10:17 AM, Raghu Prabhala <prabhalar at yahoo.com 
> <mailto:prabhalar at yahoo.com>> wrote:
>
>     Jumping in with my requirements as Impersonation is a very
>     sensitive issue. It has to be read only and clearly indicated in
>     both gui and audit engine( logs). We typically require both the
>     admin and user information populated for audit purposes which
>     means that the admin should not be logged out.
>
>     Sent from my iPhone
>
>     > On Apr 8, 2015, at 9:55 AM, Bill Burke <bburke at redhat.com
>     <mailto:bburke at redhat.com>> wrote:
>     >
>     > I worry a bit about how this can be exploited.  I think it might
>     need to
>     > be its own service that
>     >
>     > 1. checks and verifies the admin is logged in (via the cookie)
>     > 2. Re-authenticates the admin manually
>     > 3. Logouts out the admin and logins him in as impersonated user.
>     >
>     > There might be other sensitive areas/features where we might want to
>     > require manual re-authentication before.
>     >
>     > Also, we might also want to add information to the id/access
>     tokens and
>     > saml assertions for auditing purposes so that clients know that
>     the user
>     > is being impersonated.
>     >
>     > FYI, I know this is a must-have feature in order for Red Hat IT
>     to use us.
>     >
>     >
>     >> On 4/8/2015 12:53 AM, Stian Thorgersen wrote:
>     >> I would say an admin would need a special role as well as
>     having all the roles of the user the admin wants to impersonate.
>     >>
>     >> That's the simple part, second part would be to let an admin
>     login as another user. Maybe that could be done with a query param
>     to the authorization endpoint, for example:
>     >>
>     >>
>      /realms/myrealm/protocols/openid-connect/auth?...&kc_impersonate=<username>
>     >>
>     >> Would also be good to have a enable/disable option for this
>     feature for a realm.
>     >>
>     >> ----- Original Message -----
>     >>> From: "Scott Rossillo" <srossillo at smartling.com
>     <mailto:srossillo at smartling.com>>
>     >>> To: "Bill Burke" <bburke at redhat.com <mailto:bburke at redhat.com>>
>     >>> Cc: keycloak-user at lists.jboss.org
>     <mailto:keycloak-user at lists.jboss.org>
>     >>> Sent: Wednesday, 8 April, 2015 1:13:19 AM
>     >>> Subject: Re: [keycloak-user] Impersonate User
>     >>>
>     >>> Thanks.
>     >>>
>     >>> Out of curiosity, how do you see this being implemented? Would
>     a user who can
>     >>> impersonate another have a specific role to allow this?
>     >>>
>     >>> I?m thinking a bit about how I may be able to support it
>     before it becomes a
>     >>> feature, or if it?s something we would be able to contribute.
>     >>>
>     >>> ~ Scott
>     >>>
>     >>>
>     >>>
>     >>> On Tue, Apr 7, 2015 at 6:06 PM, Bill Burke < bburke at redhat.com
>     <mailto:bburke at redhat.com> > wrote:
>     >>>
>     >>>
>     >>> We don't have this feature but it is something that some key
>     customers
>     >>> want. I would say we would get to it sometime this summer.
>     >>>
>     >>>> On 4/7/2015 6:03 PM, Scott Rossillo wrote:
>     >>>> Hi,
>     >>>>
>     >>>> We?re looking for the best way to support having one user,
>     such as an
>     >>>> admin, have the ability to impersonate another user. I don?t
>     see a
>     >>>> simple way to do this with Keycloak at the moment.
>     >>>>
>     >>>> Would you mind letting me know if this is on the roadmap - I
>     didn?t see
>     >>>> a JIRA - or if you have any recommendations on implementing
>     such behavior.
>     >>>>
>     >>>> Thanks,
>     >>>> Scott
>     >>>>
>     >>>>
>     >>>>
>     >>>> _______________________________________________
>     >>>> keycloak-user mailing list
>     >>>> keycloak-user at lists.jboss.org
>     <mailto:keycloak-user at lists.jboss.org>
>     >>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>     >>>
>     >>> --
>     >>> Bill Burke
>     >>> JBoss, a division of Red Hat
>     >>> http://bill.burkecentral.com
>     >>> _______________________________________________
>     >>> keycloak-user mailing list
>     >>> keycloak-user at lists.jboss.org
>     <mailto:keycloak-user at lists.jboss.org>
>     >>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>     >>>
>     >>>
>     >>> _______________________________________________
>     >>> keycloak-user mailing list
>     >>> keycloak-user at lists.jboss.org
>     <mailto:keycloak-user at lists.jboss.org>
>     >>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>     >
>     > --
>     > Bill Burke
>     > JBoss, a division of Red Hat
>     > http://bill.burkecentral.com
>     > _______________________________________________
>     > keycloak-user mailing list
>     > keycloak-user at lists.jboss.org <mailto:keycloak-user at lists.jboss.org>
>     > https://lists.jboss.org/mailman/listinfo/keycloak-user
>
>
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150409/2bf20cba/attachment.html 

From stian at redhat.com  Thu Apr  9 06:43:46 2015
From: stian at redhat.com (Stian Thorgersen)
Date: Thu, 9 Apr 2015 06:43:46 -0400 (EDT)
Subject: [keycloak-user] Impersonate User
In-Reply-To: <552628FF.7060303@redhat.com>
References: <CALAqdu8ecDs5VF4JsNBYkiS4Rc=n2bXjJ3DYT3XfyCWDiM3tgg@mail.gmail.com>
	<552454F2.8010403@redhat.com>
	<CALAqdu_mw7C+mHx1f1JOJcaPDv2EUsGQigQ6k9o8XnrOWcsQqA@mail.gmail.com>
	<1204559404.14047153.1428468823726.JavaMail.zimbra@redhat.com>
	<55253335.2080703@redhat.com>
	<E99EEBE1-B241-4775-B06D-F76C074250EC@yahoo.com>
	<CALAqdu8S4waCixOodbqUgzYh-DGsAAgOYEi82Bxv_PxNS5trTg@mail.gmail.com>
	<552628FF.7060303@redhat.com>
Message-ID: <823017618.15013081.1428576226696.JavaMail.zimbra@redhat.com>

IMO impersonation shouldn't be done at the SSO level, it should be for a specific application and we should just have a endpoint that allows "swapping" a token for an admin user for a token for a different user.

To invoke the endpoint you'd have to have a token for an admin user with a special 'impersonate' role. We also need to some way of controlling what roles can be impersonated. That could be done by having a impersonate application where it's possible to set scope.

----- Original Message -----
> From: "Marek Posolda" <mposolda at redhat.com>
> To: "Scott Rossillo" <srossillo at smartling.com>, "Raghu Prabhala" <prabhalar at yahoo.com>
> Cc: keycloak-user at lists.jboss.org
> Sent: Thursday, 9 April, 2015 9:23:43 AM
> Subject: Re: [keycloak-user] Impersonate User
> 
> This is very similar to how I've implemented impersonation in GateIn portal.
> Basically the session wrapped the "admin" session and after logout, the
> admin session was restored back. So admin wasn't logged-out, but he was able
> to continue with his session in exactly same state like before
> impersonation.
> 
> But for the Keycloak, it will be very tricky to support this as Keycloak is
> SSO and admin is already logged to some applications before he started
> impersonation session. So for support of save/restore the admin session, we
> would need to implement the "stack" for the UserSession on auth-server but
> also for all the application sessions. This might be possible (but quite
> tricky) for servlet adapters, but I am not seeing how to properly support it
> for JS adapter...
> 
> In shortcut, it seems that we would really need to logout original admin
> session and then login as impersonated user. For audit purpose, we will have
> info that session is impersonated, but IMO we will not be able to restore
> original admin session back to the state before impersonation.
> 
> Marek
> 
> 
> On 8.4.2015 16:56, Scott Rossillo wrote:
> 
> 
> 
> One thing I've seen done with Spring Security (custom code) is to implement
> the impersonation as a "stack." An admin impersonating another user gets
> pushed instead of logged out and when the impersonated user is logged out,
> the admin is popped and re-becomes the principal. This may be much more
> complex with distributed security, but the pseudo code of the token would be
> something like:
> 
> public class KeycloakSecurityContext {
> boolean isImpersonated;
> KeycloakSecurityContext impersonatingContext;
> }
> 
> This is obviously only one aspect but could be used by an application to know
> if the user is impersonated, and who's doing the impersonating.
> 
> ~ Scott
> 
> 
> On Wed, Apr 8, 2015 at 10:17 AM, Raghu Prabhala < prabhalar at yahoo.com >
> wrote:
> 
> 
> Jumping in with my requirements as Impersonation is a very sensitive issue.
> It has to be read only and clearly indicated in both gui and audit engine(
> logs). We typically require both the admin and user information populated
> for audit purposes which means that the admin should not be logged out.
> 
> Sent from my iPhone
> 
> > On Apr 8, 2015, at 9:55 AM, Bill Burke < bburke at redhat.com > wrote:
> > 
> > I worry a bit about how this can be exploited. I think it might need to
> > be its own service that
> > 
> > 1. checks and verifies the admin is logged in (via the cookie)
> > 2. Re-authenticates the admin manually
> > 3. Logouts out the admin and logins him in as impersonated user.
> > 
> > There might be other sensitive areas/features where we might want to
> > require manual re-authentication before.
> > 
> > Also, we might also want to add information to the id/access tokens and
> > saml assertions for auditing purposes so that clients know that the user
> > is being impersonated.
> > 
> > FYI, I know this is a must-have feature in order for Red Hat IT to use us.
> > 
> > 
> >> On 4/8/2015 12:53 AM, Stian Thorgersen wrote:
> >> I would say an admin would need a special role as well as having all the
> >> roles of the user the admin wants to impersonate.
> >> 
> >> That's the simple part, second part would be to let an admin login as
> >> another user. Maybe that could be done with a query param to the
> >> authorization endpoint, for example:
> >> 
> >> /realms/myrealm/protocols/openid-connect/auth?...&kc_impersonate=<username>
> >> 
> >> Would also be good to have a enable/disable option for this feature for a
> >> realm.
> >> 
> >> ----- Original Message -----
> >>> From: "Scott Rossillo" < srossillo at smartling.com >
> >>> To: "Bill Burke" < bburke at redhat.com >
> >>> Cc: keycloak-user at lists.jboss.org
> >>> Sent: Wednesday, 8 April, 2015 1:13:19 AM
> >>> Subject: Re: [keycloak-user] Impersonate User
> >>> 
> >>> Thanks.
> >>> 
> >>> Out of curiosity, how do you see this being implemented? Would a user who
> >>> can
> >>> impersonate another have a specific role to allow this?
> >>> 
> >>> I?m thinking a bit about how I may be able to support it before it
> >>> becomes a
> >>> feature, or if it?s something we would be able to contribute.
> >>> 
> >>> ~ Scott
> >>> 
> >>> 
> >>> 
> >>> On Tue, Apr 7, 2015 at 6:06 PM, Bill Burke < bburke at redhat.com > wrote:
> >>> 
> >>> 
> >>> We don't have this feature but it is something that some key customers
> >>> want. I would say we would get to it sometime this summer.
> >>> 
> >>>> On 4/7/2015 6:03 PM, Scott Rossillo wrote:
> >>>> Hi,
> >>>> 
> >>>> We?re looking for the best way to support having one user, such as an
> >>>> admin, have the ability to impersonate another user. I don?t see a
> >>>> simple way to do this with Keycloak at the moment.
> >>>> 
> >>>> Would you mind letting me know if this is on the roadmap - I didn?t see
> >>>> a JIRA - or if you have any recommendations on implementing such
> >>>> behavior.
> >>>> 
> >>>> Thanks,
> >>>> Scott
> >>>> 
> >>>> 
> >>>> 
> >>>> _______________________________________________
> >>>> keycloak-user mailing list
> >>>> keycloak-user at lists.jboss.org
> >>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
> >>> 
> >>> --
> >>> Bill Burke
> >>> JBoss, a division of Red Hat
> >>> http://bill.burkecentral.com
> >>> _______________________________________________
> >>> keycloak-user mailing list
> >>> keycloak-user at lists.jboss.org
> >>> https://lists.jboss.org/mailman/listinfo/keycloak-user
> >>> 
> >>> 
> >>> _______________________________________________
> >>> keycloak-user mailing list
> >>> keycloak-user at lists.jboss.org
> >>> https://lists.jboss.org/mailman/listinfo/keycloak-user
> > 
> > --
> > Bill Burke
> > JBoss, a division of Red Hat
> > http://bill.burkecentral.com
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
> 
> 
> 
> _______________________________________________
> keycloak-user mailing list keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
> 
> 
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user


From stian at redhat.com  Thu Apr  9 08:11:29 2015
From: stian at redhat.com (Stian Thorgersen)
Date: Thu, 9 Apr 2015 08:11:29 -0400 (EDT)
Subject: [keycloak-user] Multi-tenancy applications
In-Reply-To: <CAOQKvCaBik-yw=Uy6aBG9=+nOffmKSihyf1B63yJWVPgjDMOhg@mail.gmail.com>
References: <CAOQKvCaBik-yw=Uy6aBG9=+nOffmKSihyf1B63yJWVPgjDMOhg@mail.gmail.com>
Message-ID: <1376562370.15118394.1428581489450.JavaMail.zimbra@redhat.com>



----- Original Message -----
> From: "Egor Kolesnikov" <egor.kolesnikov at fastlane-it.com>
> To: keycloak-user at lists.jboss.org
> Sent: Thursday, 9 April, 2015 4:58:12 AM
> Subject: [keycloak-user] Multi-tenancy applications
> 
> I've been using Keycloak for quite some time now on a couple of projects, and
> it's absolutely awesome - it just does the right thing, straight out of the
> box.
> 
> However, what I found quite confusing is the "Realm" definition which is
> missing from the documentation.
> I'm trying to add multi-tenancy support to our application and found it a bit
> confusing. It seems that Keycloak's approach to multitenancy is "Realm per
> tenant" - which makes sense, until it comes to realisation that the
> applications only exist within realms. This implies that if there are few
> hundreds of tenants (i.e. organisations using the application), the task of
> changing application config (i.e. adding application-level role or
> adding/removing redirect URL) becomes maintenance nightmare.
> 
> Is it at all possible to define a "global", not realm-confined application in
> Keycloak? Would it be hard to implement? Happy to put some effort into it
> and send a pull request.

It's not possible now and would require a lot of changes.

The best idea I can come up with is to use the admin endpoints to automate replicating the applications for multiple realms. Would be relatively easy to write something that uses the application in one realm as a reference and duplicates it to other realms.

> 
> A bit more context:
> - I have an webapp that serves multiple organisations.
> - Each organisation has its own users and admins (who can create users and
> other admins).
> - There is a "Super" administrator who creates organisations and admins.
> - Webapp can recognise the organisation based on Company ID or domain name.
> 
> Many thanks in advance.
> 
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From ssilvert at redhat.com  Thu Apr  9 08:15:17 2015
From: ssilvert at redhat.com (Stan Silvert)
Date: Thu, 09 Apr 2015 08:15:17 -0400
Subject: [keycloak-user] Impersonate User
In-Reply-To: <552628FF.7060303@redhat.com>
References: <CALAqdu8ecDs5VF4JsNBYkiS4Rc=n2bXjJ3DYT3XfyCWDiM3tgg@mail.gmail.com>	<552454F2.8010403@redhat.com>	<CALAqdu_mw7C+mHx1f1JOJcaPDv2EUsGQigQ6k9o8XnrOWcsQqA@mail.gmail.com>	<1204559404.14047153.1428468823726.JavaMail.zimbra@redhat.com>	<55253335.2080703@redhat.com>	<E99EEBE1-B241-4775-B06D-F76C074250EC@yahoo.com>
	<CALAqdu8S4waCixOodbqUgzYh-DGsAAgOYEi82Bxv_PxNS5trTg@mail.gmail.com>
	<552628FF.7060303@redhat.com>
Message-ID: <55266D55.40000@redhat.com>

I've only worked on one application that required impersonation, but we 
thought about the problem differently.

It was the corporate travel offering from Sabre.  The problem was that 
an administrative assistant needed to be able to book travel for one or 
more executives.  The assistant would not actually impersonate the user, 
but the application simply knew who she was allowed to book travel for.  
Therefore, impersonation was really more like composite roles that 
included a user name (or a wildcard for "any user").  It was up to the 
application to know what to do with the roles.  It would present a 
drop-down to select which user you were working on behalf of.

This way, you never require more than one login or logout.  You are just 
pushing all the complexity onto the application.   But maybe that's 
where it belongs.

On 4/9/2015 3:23 AM, Marek Posolda wrote:
> This is very similar to how I've implemented impersonation in GateIn 
> portal. Basically the session wrapped the "admin" session and after 
> logout, the admin session was restored back. So admin wasn't 
> logged-out, but he was able to continue with his session in exactly 
> same state like before impersonation.
>
> But for the Keycloak, it will be very tricky to support this as 
> Keycloak is SSO and admin is already logged to some applications 
> before he started impersonation session. So for support of 
> save/restore the admin session, we would need to implement the "stack" 
> for the UserSession on auth-server but also for all the application 
> sessions. This might be possible (but quite tricky) for servlet 
> adapters, but I am not seeing how to properly support it for JS adapter...
>
> In shortcut, it seems that we would really need to logout original 
> admin session and then login as impersonated user. For audit purpose, 
> we will have info that session is impersonated, but IMO we will not be 
> able to restore original admin session back to the state before 
> impersonation.
>
> Marek
>
>
> On 8.4.2015 16:56, Scott Rossillo wrote:
>> One thing I've seen done with Spring Security (custom code) is to 
>> implement the impersonation as a "stack."  An admin impersonating 
>> another user gets pushed instead of logged out and when the 
>> impersonated user is logged out, the admin is popped and re-becomes 
>> the principal. This may be much more complex with distributed 
>> security, but the pseudo code of the token would be something like:
>>
>> public class KeycloakSecurityContext {
>>   boolean isImpersonated;
>>   KeycloakSecurityContext impersonatingContext;
>> }
>>
>> This is obviously only one aspect but could be used by an application 
>> to know if the user is impersonated, and who's doing the impersonating.
>>
>> ~ Scott
>>
>>
>> On Wed, Apr 8, 2015 at 10:17 AM, Raghu Prabhala <prabhalar at yahoo.com 
>> <mailto:prabhalar at yahoo.com>> wrote:
>>
>>     Jumping in with my requirements as Impersonation is a very
>>     sensitive issue. It has to be read only and clearly indicated in
>>     both gui and audit engine( logs). We typically require both the
>>     admin and user information populated for audit purposes which
>>     means that the admin should not be logged out.
>>
>>     Sent from my iPhone
>>
>>     > On Apr 8, 2015, at 9:55 AM, Bill Burke <bburke at redhat.com
>>     <mailto:bburke at redhat.com>> wrote:
>>     >
>>     > I worry a bit about how this can be exploited.  I think it
>>     might need to
>>     > be its own service that
>>     >
>>     > 1. checks and verifies the admin is logged in (via the cookie)
>>     > 2. Re-authenticates the admin manually
>>     > 3. Logouts out the admin and logins him in as impersonated user.
>>     >
>>     > There might be other sensitive areas/features where we might
>>     want to
>>     > require manual re-authentication before.
>>     >
>>     > Also, we might also want to add information to the id/access
>>     tokens and
>>     > saml assertions for auditing purposes so that clients know that
>>     the user
>>     > is being impersonated.
>>     >
>>     > FYI, I know this is a must-have feature in order for Red Hat IT
>>     to use us.
>>     >
>>     >
>>     >> On 4/8/2015 12:53 AM, Stian Thorgersen wrote:
>>     >> I would say an admin would need a special role as well as
>>     having all the roles of the user the admin wants to impersonate.
>>     >>
>>     >> That's the simple part, second part would be to let an admin
>>     login as another user. Maybe that could be done with a query
>>     param to the authorization endpoint, for example:
>>     >>
>>     >>
>>      /realms/myrealm/protocols/openid-connect/auth?...&kc_impersonate=<username>
>>     >>
>>     >> Would also be good to have a enable/disable option for this
>>     feature for a realm.
>>     >>
>>     >> ----- Original Message -----
>>     >>> From: "Scott Rossillo" <srossillo at smartling.com
>>     <mailto:srossillo at smartling.com>>
>>     >>> To: "Bill Burke" <bburke at redhat.com <mailto:bburke at redhat.com>>
>>     >>> Cc: keycloak-user at lists.jboss.org
>>     <mailto:keycloak-user at lists.jboss.org>
>>     >>> Sent: Wednesday, 8 April, 2015 1:13:19 AM
>>     >>> Subject: Re: [keycloak-user] Impersonate User
>>     >>>
>>     >>> Thanks.
>>     >>>
>>     >>> Out of curiosity, how do you see this being implemented?
>>     Would a user who can
>>     >>> impersonate another have a specific role to allow this?
>>     >>>
>>     >>> I'm thinking a bit about how I may be able to support it
>>     before it becomes a
>>     >>> feature, or if it's something we would be able to contribute.
>>     >>>
>>     >>> ~ Scott
>>     >>>
>>     >>>
>>     >>>
>>     >>> On Tue, Apr 7, 2015 at 6:06 PM, Bill Burke <
>>     bburke at redhat.com <mailto:bburke at redhat.com> > wrote:
>>     >>>
>>     >>>
>>     >>> We don't have this feature but it is something that some key
>>     customers
>>     >>> want. I would say we would get to it sometime this summer.
>>     >>>
>>     >>>> On 4/7/2015 6:03 PM, Scott Rossillo wrote:
>>     >>>> Hi,
>>     >>>>
>>     >>>> We're looking for the best way to support having one user,
>>     such as an
>>     >>>> admin, have the ability to impersonate another user. I don't
>>     see a
>>     >>>> simple way to do this with Keycloak at the moment.
>>     >>>>
>>     >>>> Would you mind letting me know if this is on the roadmap - I
>>     didn't see
>>     >>>> a JIRA - or if you have any recommendations on implementing
>>     such behavior.
>>     >>>>
>>     >>>> Thanks,
>>     >>>> Scott
>>     >>>>
>>     >>>>
>>     >>>>
>>     >>>> _______________________________________________
>>     >>>> keycloak-user mailing list
>>     >>>> keycloak-user at lists.jboss.org
>>     <mailto:keycloak-user at lists.jboss.org>
>>     >>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>     >>>
>>     >>> --
>>     >>> Bill Burke
>>     >>> JBoss, a division of Red Hat
>>     >>> http://bill.burkecentral.com
>>     >>> _______________________________________________
>>     >>> keycloak-user mailing list
>>     >>> keycloak-user at lists.jboss.org
>>     <mailto:keycloak-user at lists.jboss.org>
>>     >>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>     >>>
>>     >>>
>>     >>> _______________________________________________
>>     >>> keycloak-user mailing list
>>     >>> keycloak-user at lists.jboss.org
>>     <mailto:keycloak-user at lists.jboss.org>
>>     >>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>     >
>>     > --
>>     > Bill Burke
>>     > JBoss, a division of Red Hat
>>     > http://bill.burkecentral.com
>>     > _______________________________________________
>>     > keycloak-user mailing list
>>     > keycloak-user at lists.jboss.org
>>     <mailto:keycloak-user at lists.jboss.org>
>>     > https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>>
>>
>>
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150409/3d7bb8c1/attachment.html 

From stian at redhat.com  Thu Apr  9 08:26:43 2015
From: stian at redhat.com (Stian Thorgersen)
Date: Thu, 9 Apr 2015 08:26:43 -0400 (EDT)
Subject: [keycloak-user] Impersonate User
In-Reply-To: <55266D55.40000@redhat.com>
References: <CALAqdu8ecDs5VF4JsNBYkiS4Rc=n2bXjJ3DYT3XfyCWDiM3tgg@mail.gmail.com>
	<CALAqdu_mw7C+mHx1f1JOJcaPDv2EUsGQigQ6k9o8XnrOWcsQqA@mail.gmail.com>
	<1204559404.14047153.1428468823726.JavaMail.zimbra@redhat.com>
	<55253335.2080703@redhat.com>
	<E99EEBE1-B241-4775-B06D-F76C074250EC@yahoo.com>
	<CALAqdu8S4waCixOodbqUgzYh-DGsAAgOYEi82Bxv_PxNS5trTg@mail.gmail.com>
	<552628FF.7060303@redhat.com> <55266D55.40000@redhat.com>
Message-ID: <1167065087.15129820.1428582403967.JavaMail.zimbra@redhat.com>



----- Original Message -----
> From: "Stan Silvert" <ssilvert at redhat.com>
> To: keycloak-user at lists.jboss.org
> Sent: Thursday, 9 April, 2015 2:15:17 PM
> Subject: Re: [keycloak-user] Impersonate User
> 
> I've only worked on one application that required impersonation, but we
> thought about the problem differently.
> 
> It was the corporate travel offering from Sabre. The problem was that an
> administrative assistant needed to be able to book travel for one or more
> executives. The assistant would not actually impersonate the user, but the
> application simply knew who she was allowed to book travel for. Therefore,
> impersonation was really more like composite roles that included a user name
> (or a wildcard for "any user"). It was up to the application to know what to
> do with the roles. It would present a drop-down to select which user you
> were working on behalf of.
> 
> This way, you never require more than one login or logout. You are just
> pushing all the complexity onto the application. But maybe that's where it
> belongs.

I totally agree - we can make life easier for app developers by providing a token swap service like I suggested though ;)

> 
> On 4/9/2015 3:23 AM, Marek Posolda wrote:
> 
> 
> 
> This is very similar to how I've implemented impersonation in GateIn portal.
> Basically the session wrapped the "admin" session and after logout, the
> admin session was restored back. So admin wasn't logged-out, but he was able
> to continue with his session in exactly same state like before
> impersonation.
> 
> But for the Keycloak, it will be very tricky to support this as Keycloak is
> SSO and admin is already logged to some applications before he started
> impersonation session. So for support of save/restore the admin session, we
> would need to implement the "stack" for the UserSession on auth-server but
> also for all the application sessions. This might be possible (but quite
> tricky) for servlet adapters, but I am not seeing how to properly support it
> for JS adapter...
> 
> In shortcut, it seems that we would really need to logout original admin
> session and then login as impersonated user. For audit purpose, we will have
> info that session is impersonated, but IMO we will not be able to restore
> original admin session back to the state before impersonation.
> 
> Marek
> 
> 
> On 8.4.2015 16:56, Scott Rossillo wrote:
> 
> 
> 
> One thing I've seen done with Spring Security (custom code) is to implement
> the impersonation as a "stack." An admin impersonating another user gets
> pushed instead of logged out and when the impersonated user is logged out,
> the admin is popped and re-becomes the principal. This may be much more
> complex with distributed security, but the pseudo code of the token would be
> something like:
> 
> public class KeycloakSecurityContext {
> boolean isImpersonated;
> KeycloakSecurityContext impersonatingContext;
> }
> 
> This is obviously only one aspect but could be used by an application to know
> if the user is impersonated, and who's doing the impersonating.
> 
> ~ Scott
> 
> 
> On Wed, Apr 8, 2015 at 10:17 AM, Raghu Prabhala < prabhalar at yahoo.com >
> wrote:
> 
> 
> Jumping in with my requirements as Impersonation is a very sensitive issue.
> It has to be read only and clearly indicated in both gui and audit engine(
> logs). We typically require both the admin and user information populated
> for audit purposes which means that the admin should not be logged out.
> 
> Sent from my iPhone
> 
> > On Apr 8, 2015, at 9:55 AM, Bill Burke < bburke at redhat.com > wrote:
> > 
> > I worry a bit about how this can be exploited. I think it might need to
> > be its own service that
> > 
> > 1. checks and verifies the admin is logged in (via the cookie)
> > 2. Re-authenticates the admin manually
> > 3. Logouts out the admin and logins him in as impersonated user.
> > 
> > There might be other sensitive areas/features where we might want to
> > require manual re-authentication before.
> > 
> > Also, we might also want to add information to the id/access tokens and
> > saml assertions for auditing purposes so that clients know that the user
> > is being impersonated.
> > 
> > FYI, I know this is a must-have feature in order for Red Hat IT to use us.
> > 
> > 
> >> On 4/8/2015 12:53 AM, Stian Thorgersen wrote:
> >> I would say an admin would need a special role as well as having all the
> >> roles of the user the admin wants to impersonate.
> >> 
> >> That's the simple part, second part would be to let an admin login as
> >> another user. Maybe that could be done with a query param to the
> >> authorization endpoint, for example:
> >> 
> >> /realms/myrealm/protocols/openid-connect/auth?...&kc_impersonate=<username>
> >> 
> >> Would also be good to have a enable/disable option for this feature for a
> >> realm.
> >> 
> >> ----- Original Message -----
> >>> From: "Scott Rossillo" < srossillo at smartling.com >
> >>> To: "Bill Burke" < bburke at redhat.com >
> >>> Cc: keycloak-user at lists.jboss.org
> >>> Sent: Wednesday, 8 April, 2015 1:13:19 AM
> >>> Subject: Re: [keycloak-user] Impersonate User
> >>> 
> >>> Thanks.
> >>> 
> >>> Out of curiosity, how do you see this being implemented? Would a user who
> >>> can
> >>> impersonate another have a specific role to allow this?
> >>> 
> >>> I?m thinking a bit about how I may be able to support it before it
> >>> becomes a
> >>> feature, or if it?s something we would be able to contribute.
> >>> 
> >>> ~ Scott
> >>> 
> >>> 
> >>> 
> >>> On Tue, Apr 7, 2015 at 6:06 PM, Bill Burke < bburke at redhat.com > wrote:
> >>> 
> >>> 
> >>> We don't have this feature but it is something that some key customers
> >>> want. I would say we would get to it sometime this summer.
> >>> 
> >>>> On 4/7/2015 6:03 PM, Scott Rossillo wrote:
> >>>> Hi,
> >>>> 
> >>>> We?re looking for the best way to support having one user, such as an
> >>>> admin, have the ability to impersonate another user. I don?t see a
> >>>> simple way to do this with Keycloak at the moment.
> >>>> 
> >>>> Would you mind letting me know if this is on the roadmap - I didn?t see
> >>>> a JIRA - or if you have any recommendations on implementing such
> >>>> behavior.
> >>>> 
> >>>> Thanks,
> >>>> Scott
> >>>> 
> >>>> 
> >>>> 
> >>>> _______________________________________________
> >>>> keycloak-user mailing list
> >>>> keycloak-user at lists.jboss.org
> >>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
> >>> 
> >>> --
> >>> Bill Burke
> >>> JBoss, a division of Red Hat
> >>> http://bill.burkecentral.com
> >>> _______________________________________________
> >>> keycloak-user mailing list
> >>> keycloak-user at lists.jboss.org
> >>> https://lists.jboss.org/mailman/listinfo/keycloak-user
> >>> 
> >>> 
> >>> _______________________________________________
> >>> keycloak-user mailing list
> >>> keycloak-user at lists.jboss.org
> >>> https://lists.jboss.org/mailman/listinfo/keycloak-user
> > 
> > --
> > Bill Burke
> > JBoss, a division of Red Hat
> > http://bill.burkecentral.com
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
> 
> 
> 
> _______________________________________________
> keycloak-user mailing list keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
> 
> 
> 
> _______________________________________________
> keycloak-user mailing list keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
> 
> 
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user


From egor.kolesnikov at fastlane-it.com  Thu Apr  9 08:32:47 2015
From: egor.kolesnikov at fastlane-it.com (Egor Kolesnikov)
Date: Thu, 9 Apr 2015 22:32:47 +1000
Subject: [keycloak-user] Multi-tenancy applications
In-Reply-To: <1376562370.15118394.1428581489450.JavaMail.zimbra@redhat.com>
References: <CAOQKvCaBik-yw=Uy6aBG9=+nOffmKSihyf1B63yJWVPgjDMOhg@mail.gmail.com>
	<1376562370.15118394.1428581489450.JavaMail.zimbra@redhat.com>
Message-ID: <CAOQKvCbBfsMSQG4Hh7b1qvYyi1iZhJfUVVebTity5NS00ikKtg@mail.gmail.com>

Hi Stan

Yes, that's what I thought - putting in some synchronisation smarts and
locking down applications within tenants' realms.

Is this even on the roadmap? If we take a look at, say, Google - they have
tenants (Google Apps for Business) who have their own domains, admins and
users, and they also have applications accessible by all users of all
tenants.


...on the other side, is it possible to use different approach and
implement "tenant ID" as a User attribute within the realm?

Cheers
Egor



On Thu, Apr 9, 2015 at 10:11 PM, Stian Thorgersen <stian at redhat.com> wrote:

>
>
> ----- Original Message -----
> > From: "Egor Kolesnikov" <egor.kolesnikov at fastlane-it.com>
> > To: keycloak-user at lists.jboss.org
> > Sent: Thursday, 9 April, 2015 4:58:12 AM
> > Subject: [keycloak-user] Multi-tenancy applications
> >
> > I've been using Keycloak for quite some time now on a couple of
> projects, and
> > it's absolutely awesome - it just does the right thing, straight out of
> the
> > box.
> >
> > However, what I found quite confusing is the "Realm" definition which is
> > missing from the documentation.
> > I'm trying to add multi-tenancy support to our application and found it
> a bit
> > confusing. It seems that Keycloak's approach to multitenancy is "Realm
> per
> > tenant" - which makes sense, until it comes to realisation that the
> > applications only exist within realms. This implies that if there are few
> > hundreds of tenants (i.e. organisations using the application), the task
> of
> > changing application config (i.e. adding application-level role or
> > adding/removing redirect URL) becomes maintenance nightmare.
> >
> > Is it at all possible to define a "global", not realm-confined
> application in
> > Keycloak? Would it be hard to implement? Happy to put some effort into it
> > and send a pull request.
>
> It's not possible now and would require a lot of changes.
>
> The best idea I can come up with is to use the admin endpoints to automate
> replicating the applications for multiple realms. Would be relatively easy
> to write something that uses the application in one realm as a reference
> and duplicates it to other realms.
>
> >
> > A bit more context:
> > - I have an webapp that serves multiple organisations.
> > - Each organisation has its own users and admins (who can create users
> and
> > other admins).
> > - There is a "Super" administrator who creates organisations and admins.
> > - Webapp can recognise the organisation based on Company ID or domain
> name.
> >
> > Many thanks in advance.
> >
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
>



-- 

Egor Kolesnikov
Director
Fastlane Solutions Pty Ltd
m. +61(4) 6884 5909
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150409/f645bd65/attachment.html 

From stian at redhat.com  Thu Apr  9 08:37:01 2015
From: stian at redhat.com (Stian Thorgersen)
Date: Thu, 9 Apr 2015 08:37:01 -0400 (EDT)
Subject: [keycloak-user] Multi-tenancy applications
In-Reply-To: <CAOQKvCbBfsMSQG4Hh7b1qvYyi1iZhJfUVVebTity5NS00ikKtg@mail.gmail.com>
References: <CAOQKvCaBik-yw=Uy6aBG9=+nOffmKSihyf1B63yJWVPgjDMOhg@mail.gmail.com>
	<1376562370.15118394.1428581489450.JavaMail.zimbra@redhat.com>
	<CAOQKvCbBfsMSQG4Hh7b1qvYyi1iZhJfUVVebTity5NS00ikKtg@mail.gmail.com>
Message-ID: <1434539319.15139709.1428583021783.JavaMail.zimbra@redhat.com>

This is not something that we have on our road-map and even if we decided to add it would be a long time until we'd get to.

However, as I suggested this is something you can implement yourself using the admin rest api.

----- Original Message -----
> From: "Egor Kolesnikov" <egor.kolesnikov at fastlane-it.com>
> To: "Stian Thorgersen" <stian at redhat.com>
> Cc: keycloak-user at lists.jboss.org
> Sent: Thursday, 9 April, 2015 2:32:47 PM
> Subject: Re: [keycloak-user] Multi-tenancy applications
> 
> Hi Stan
> 
> Yes, that's what I thought - putting in some synchronisation smarts and
> locking down applications within tenants' realms.
> 
> Is this even on the roadmap? If we take a look at, say, Google - they have
> tenants (Google Apps for Business) who have their own domains, admins and
> users, and they also have applications accessible by all users of all
> tenants.
> 
> 
> ...on the other side, is it possible to use different approach and
> implement "tenant ID" as a User attribute within the realm?

No, everything we have is very fixed to the concept of being contained within a specific realm. Persistence, APIs, GUIs, etc are all built on that concept.

> 
> Cheers
> Egor
> 
> 
> 
> On Thu, Apr 9, 2015 at 10:11 PM, Stian Thorgersen <stian at redhat.com> wrote:
> 
> >
> >
> > ----- Original Message -----
> > > From: "Egor Kolesnikov" <egor.kolesnikov at fastlane-it.com>
> > > To: keycloak-user at lists.jboss.org
> > > Sent: Thursday, 9 April, 2015 4:58:12 AM
> > > Subject: [keycloak-user] Multi-tenancy applications
> > >
> > > I've been using Keycloak for quite some time now on a couple of
> > projects, and
> > > it's absolutely awesome - it just does the right thing, straight out of
> > the
> > > box.
> > >
> > > However, what I found quite confusing is the "Realm" definition which is
> > > missing from the documentation.
> > > I'm trying to add multi-tenancy support to our application and found it
> > a bit
> > > confusing. It seems that Keycloak's approach to multitenancy is "Realm
> > per
> > > tenant" - which makes sense, until it comes to realisation that the
> > > applications only exist within realms. This implies that if there are few
> > > hundreds of tenants (i.e. organisations using the application), the task
> > of
> > > changing application config (i.e. adding application-level role or
> > > adding/removing redirect URL) becomes maintenance nightmare.
> > >
> > > Is it at all possible to define a "global", not realm-confined
> > application in
> > > Keycloak? Would it be hard to implement? Happy to put some effort into it
> > > and send a pull request.
> >
> > It's not possible now and would require a lot of changes.
> >
> > The best idea I can come up with is to use the admin endpoints to automate
> > replicating the applications for multiple realms. Would be relatively easy
> > to write something that uses the application in one realm as a reference
> > and duplicates it to other realms.
> >
> > >
> > > A bit more context:
> > > - I have an webapp that serves multiple organisations.
> > > - Each organisation has its own users and admins (who can create users
> > and
> > > other admins).
> > > - There is a "Super" administrator who creates organisations and admins.
> > > - Webapp can recognise the organisation based on Company ID or domain
> > name.
> > >
> > > Many thanks in advance.
> > >
> > > _______________________________________________
> > > keycloak-user mailing list
> > > keycloak-user at lists.jboss.org
> > > https://lists.jboss.org/mailman/listinfo/keycloak-user
> >
> 
> 
> 
> --
> 
> Egor Kolesnikov
> Director
> Fastlane Solutions Pty Ltd
> m. +61(4) 6884 5909
> 

From bburke at redhat.com  Thu Apr  9 08:38:01 2015
From: bburke at redhat.com (Bill Burke)
Date: Thu, 09 Apr 2015 08:38:01 -0400
Subject: [keycloak-user] Impersonate User
In-Reply-To: <823017618.15013081.1428576226696.JavaMail.zimbra@redhat.com>
References: <CALAqdu8ecDs5VF4JsNBYkiS4Rc=n2bXjJ3DYT3XfyCWDiM3tgg@mail.gmail.com>	<552454F2.8010403@redhat.com>	<CALAqdu_mw7C+mHx1f1JOJcaPDv2EUsGQigQ6k9o8XnrOWcsQqA@mail.gmail.com>	<1204559404.14047153.1428468823726.JavaMail.zimbra@redhat.com>	<55253335.2080703@redhat.com>	<E99EEBE1-B241-4775-B06D-F76C074250EC@yahoo.com>	<CALAqdu8S4waCixOodbqUgzYh-DGsAAgOYEi82Bxv_PxNS5trTg@mail.gmail.com>	<552628FF.7060303@redhat.com>
	<823017618.15013081.1428576226696.JavaMail.zimbra@redhat.com>
Message-ID: <552672A9.8090505@redhat.com>

I think you should ask the users what they want instead of assuming that 
only impersonating per application is the way to go.  There's certainly 
a lot of different features we could implement around this, but 
unfortunately there's only so much time to do them.

On 4/9/2015 6:43 AM, Stian Thorgersen wrote:
> IMO impersonation shouldn't be done at the SSO level, it should be for a specific application and we should just have a endpoint that allows "swapping" a token for an admin user for a token for a different user.
>
> To invoke the endpoint you'd have to have a token for an admin user with a special 'impersonate' role. We also need to some way of controlling what roles can be impersonated. That could be done by having a impersonate application where it's possible to set scope.
>
> ----- Original Message -----
>> From: "Marek Posolda" <mposolda at redhat.com>
>> To: "Scott Rossillo" <srossillo at smartling.com>, "Raghu Prabhala" <prabhalar at yahoo.com>
>> Cc: keycloak-user at lists.jboss.org
>> Sent: Thursday, 9 April, 2015 9:23:43 AM
>> Subject: Re: [keycloak-user] Impersonate User
>>
>> This is very similar to how I've implemented impersonation in GateIn portal.
>> Basically the session wrapped the "admin" session and after logout, the
>> admin session was restored back. So admin wasn't logged-out, but he was able
>> to continue with his session in exactly same state like before
>> impersonation.
>>
>> But for the Keycloak, it will be very tricky to support this as Keycloak is
>> SSO and admin is already logged to some applications before he started
>> impersonation session. So for support of save/restore the admin session, we
>> would need to implement the "stack" for the UserSession on auth-server but
>> also for all the application sessions. This might be possible (but quite
>> tricky) for servlet adapters, but I am not seeing how to properly support it
>> for JS adapter...
>>
>> In shortcut, it seems that we would really need to logout original admin
>> session and then login as impersonated user. For audit purpose, we will have
>> info that session is impersonated, but IMO we will not be able to restore
>> original admin session back to the state before impersonation.
>>
>> Marek
>>
>>
>> On 8.4.2015 16:56, Scott Rossillo wrote:
>>
>>
>>
>> One thing I've seen done with Spring Security (custom code) is to implement
>> the impersonation as a "stack." An admin impersonating another user gets
>> pushed instead of logged out and when the impersonated user is logged out,
>> the admin is popped and re-becomes the principal. This may be much more
>> complex with distributed security, but the pseudo code of the token would be
>> something like:
>>
>> public class KeycloakSecurityContext {
>> boolean isImpersonated;
>> KeycloakSecurityContext impersonatingContext;
>> }
>>
>> This is obviously only one aspect but could be used by an application to know
>> if the user is impersonated, and who's doing the impersonating.
>>
>> ~ Scott
>>
>>
>> On Wed, Apr 8, 2015 at 10:17 AM, Raghu Prabhala < prabhalar at yahoo.com >
>> wrote:
>>
>>
>> Jumping in with my requirements as Impersonation is a very sensitive issue.
>> It has to be read only and clearly indicated in both gui and audit engine(
>> logs). We typically require both the admin and user information populated
>> for audit purposes which means that the admin should not be logged out.
>>
>> Sent from my iPhone
>>
>>> On Apr 8, 2015, at 9:55 AM, Bill Burke < bburke at redhat.com > wrote:
>>>
>>> I worry a bit about how this can be exploited. I think it might need to
>>> be its own service that
>>>
>>> 1. checks and verifies the admin is logged in (via the cookie)
>>> 2. Re-authenticates the admin manually
>>> 3. Logouts out the admin and logins him in as impersonated user.
>>>
>>> There might be other sensitive areas/features where we might want to
>>> require manual re-authentication before.
>>>
>>> Also, we might also want to add information to the id/access tokens and
>>> saml assertions for auditing purposes so that clients know that the user
>>> is being impersonated.
>>>
>>> FYI, I know this is a must-have feature in order for Red Hat IT to use us.
>>>
>>>
>>>> On 4/8/2015 12:53 AM, Stian Thorgersen wrote:
>>>> I would say an admin would need a special role as well as having all the
>>>> roles of the user the admin wants to impersonate.
>>>>
>>>> That's the simple part, second part would be to let an admin login as
>>>> another user. Maybe that could be done with a query param to the
>>>> authorization endpoint, for example:
>>>>
>>>> /realms/myrealm/protocols/openid-connect/auth?...&kc_impersonate=<username>
>>>>
>>>> Would also be good to have a enable/disable option for this feature for a
>>>> realm.
>>>>
>>>> ----- Original Message -----
>>>>> From: "Scott Rossillo" < srossillo at smartling.com >
>>>>> To: "Bill Burke" < bburke at redhat.com >
>>>>> Cc: keycloak-user at lists.jboss.org
>>>>> Sent: Wednesday, 8 April, 2015 1:13:19 AM
>>>>> Subject: Re: [keycloak-user] Impersonate User
>>>>>
>>>>> Thanks.
>>>>>
>>>>> Out of curiosity, how do you see this being implemented? Would a user who
>>>>> can
>>>>> impersonate another have a specific role to allow this?
>>>>>
>>>>> I?m thinking a bit about how I may be able to support it before it
>>>>> becomes a
>>>>> feature, or if it?s something we would be able to contribute.
>>>>>
>>>>> ~ Scott
>>>>>
>>>>>
>>>>>
>>>>> On Tue, Apr 7, 2015 at 6:06 PM, Bill Burke < bburke at redhat.com > wrote:
>>>>>
>>>>>
>>>>> We don't have this feature but it is something that some key customers
>>>>> want. I would say we would get to it sometime this summer.
>>>>>
>>>>>> On 4/7/2015 6:03 PM, Scott Rossillo wrote:
>>>>>> Hi,
>>>>>>
>>>>>> We?re looking for the best way to support having one user, such as an
>>>>>> admin, have the ability to impersonate another user. I don?t see a
>>>>>> simple way to do this with Keycloak at the moment.
>>>>>>
>>>>>> Would you mind letting me know if this is on the roadmap - I didn?t see
>>>>>> a JIRA - or if you have any recommendations on implementing such
>>>>>> behavior.
>>>>>>
>>>>>> Thanks,
>>>>>> Scott
>>>>>>
>>>>>>
>>>>>>
>>>>>> _______________________________________________
>>>>>> keycloak-user mailing list
>>>>>> keycloak-user at lists.jboss.org
>>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>>
>>>>> --
>>>>> Bill Burke
>>>>> JBoss, a division of Red Hat
>>>>> http://bill.burkecentral.com
>>>>> _______________________________________________
>>>>> keycloak-user mailing list
>>>>> keycloak-user at lists.jboss.org
>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>>
>>>>>
>>>>> _______________________________________________
>>>>> keycloak-user mailing list
>>>>> keycloak-user at lists.jboss.org
>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>
>>> --
>>> Bill Burke
>>> JBoss, a division of Red Hat
>>> http://bill.burkecentral.com
>>> _______________________________________________
>>> keycloak-user mailing list
>>> keycloak-user at lists.jboss.org
>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>>
>>
>> _______________________________________________
>> keycloak-user mailing list keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>>
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

-- 
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com

From stian at redhat.com  Thu Apr  9 08:54:18 2015
From: stian at redhat.com (Stian Thorgersen)
Date: Thu, 9 Apr 2015 08:54:18 -0400 (EDT)
Subject: [keycloak-user] Impersonate User
In-Reply-To: <552672A9.8090505@redhat.com>
References: <CALAqdu8ecDs5VF4JsNBYkiS4Rc=n2bXjJ3DYT3XfyCWDiM3tgg@mail.gmail.com>
	<1204559404.14047153.1428468823726.JavaMail.zimbra@redhat.com>
	<55253335.2080703@redhat.com>
	<E99EEBE1-B241-4775-B06D-F76C074250EC@yahoo.com>
	<CALAqdu8S4waCixOodbqUgzYh-DGsAAgOYEi82Bxv_PxNS5trTg@mail.gmail.com>
	<552628FF.7060303@redhat.com>
	<823017618.15013081.1428576226696.JavaMail.zimbra@redhat.com>
	<552672A9.8090505@redhat.com>
Message-ID: <2568478.15156446.1428584058445.JavaMail.zimbra@redhat.com>



----- Original Message -----
> From: "Bill Burke" <bburke at redhat.com>
> To: keycloak-user at lists.jboss.org
> Sent: Thursday, 9 April, 2015 2:38:01 PM
> Subject: Re: [keycloak-user] Impersonate User
> 
> I think you should ask the users what they want instead of assuming that
> only impersonating per application is the way to go.  There's certainly
> a lot of different features we could implement around this, but
> unfortunately there's only so much time to do them.

I'm not assuming anything I'm just giving my opinion. Besides, we should not always just do exactly what users asks for, we should rather make sure we understand their requirements and come up with good solutions that works for Keycloak and them.

I'm sure there's situations where a SSO level impersonation would be more convinient. However, a token swap service like I suggested would be much simpler to implement and a lot less risky as well. We should add a token swap service in either case to allow for example downgrading tokens for chained services.

> 
> On 4/9/2015 6:43 AM, Stian Thorgersen wrote:
> > IMO impersonation shouldn't be done at the SSO level, it should be for a
> > specific application and we should just have a endpoint that allows
> > "swapping" a token for an admin user for a token for a different user.
> >
> > To invoke the endpoint you'd have to have a token for an admin user with a
> > special 'impersonate' role. We also need to some way of controlling what
> > roles can be impersonated. That could be done by having a impersonate
> > application where it's possible to set scope.
> >
> > ----- Original Message -----
> >> From: "Marek Posolda" <mposolda at redhat.com>
> >> To: "Scott Rossillo" <srossillo at smartling.com>, "Raghu Prabhala"
> >> <prabhalar at yahoo.com>
> >> Cc: keycloak-user at lists.jboss.org
> >> Sent: Thursday, 9 April, 2015 9:23:43 AM
> >> Subject: Re: [keycloak-user] Impersonate User
> >>
> >> This is very similar to how I've implemented impersonation in GateIn
> >> portal.
> >> Basically the session wrapped the "admin" session and after logout, the
> >> admin session was restored back. So admin wasn't logged-out, but he was
> >> able
> >> to continue with his session in exactly same state like before
> >> impersonation.
> >>
> >> But for the Keycloak, it will be very tricky to support this as Keycloak
> >> is
> >> SSO and admin is already logged to some applications before he started
> >> impersonation session. So for support of save/restore the admin session,
> >> we
> >> would need to implement the "stack" for the UserSession on auth-server but
> >> also for all the application sessions. This might be possible (but quite
> >> tricky) for servlet adapters, but I am not seeing how to properly support
> >> it
> >> for JS adapter...
> >>
> >> In shortcut, it seems that we would really need to logout original admin
> >> session and then login as impersonated user. For audit purpose, we will
> >> have
> >> info that session is impersonated, but IMO we will not be able to restore
> >> original admin session back to the state before impersonation.
> >>
> >> Marek
> >>
> >>
> >> On 8.4.2015 16:56, Scott Rossillo wrote:
> >>
> >>
> >>
> >> One thing I've seen done with Spring Security (custom code) is to
> >> implement
> >> the impersonation as a "stack." An admin impersonating another user gets
> >> pushed instead of logged out and when the impersonated user is logged out,
> >> the admin is popped and re-becomes the principal. This may be much more
> >> complex with distributed security, but the pseudo code of the token would
> >> be
> >> something like:
> >>
> >> public class KeycloakSecurityContext {
> >> boolean isImpersonated;
> >> KeycloakSecurityContext impersonatingContext;
> >> }
> >>
> >> This is obviously only one aspect but could be used by an application to
> >> know
> >> if the user is impersonated, and who's doing the impersonating.
> >>
> >> ~ Scott
> >>
> >>
> >> On Wed, Apr 8, 2015 at 10:17 AM, Raghu Prabhala < prabhalar at yahoo.com >
> >> wrote:
> >>
> >>
> >> Jumping in with my requirements as Impersonation is a very sensitive
> >> issue.
> >> It has to be read only and clearly indicated in both gui and audit engine(
> >> logs). We typically require both the admin and user information populated
> >> for audit purposes which means that the admin should not be logged out.
> >>
> >> Sent from my iPhone
> >>
> >>> On Apr 8, 2015, at 9:55 AM, Bill Burke < bburke at redhat.com > wrote:
> >>>
> >>> I worry a bit about how this can be exploited. I think it might need to
> >>> be its own service that
> >>>
> >>> 1. checks and verifies the admin is logged in (via the cookie)
> >>> 2. Re-authenticates the admin manually
> >>> 3. Logouts out the admin and logins him in as impersonated user.
> >>>
> >>> There might be other sensitive areas/features where we might want to
> >>> require manual re-authentication before.
> >>>
> >>> Also, we might also want to add information to the id/access tokens and
> >>> saml assertions for auditing purposes so that clients know that the user
> >>> is being impersonated.
> >>>
> >>> FYI, I know this is a must-have feature in order for Red Hat IT to use
> >>> us.
> >>>
> >>>
> >>>> On 4/8/2015 12:53 AM, Stian Thorgersen wrote:
> >>>> I would say an admin would need a special role as well as having all the
> >>>> roles of the user the admin wants to impersonate.
> >>>>
> >>>> That's the simple part, second part would be to let an admin login as
> >>>> another user. Maybe that could be done with a query param to the
> >>>> authorization endpoint, for example:
> >>>>
> >>>> /realms/myrealm/protocols/openid-connect/auth?...&kc_impersonate=<username>
> >>>>
> >>>> Would also be good to have a enable/disable option for this feature for
> >>>> a
> >>>> realm.
> >>>>
> >>>> ----- Original Message -----
> >>>>> From: "Scott Rossillo" < srossillo at smartling.com >
> >>>>> To: "Bill Burke" < bburke at redhat.com >
> >>>>> Cc: keycloak-user at lists.jboss.org
> >>>>> Sent: Wednesday, 8 April, 2015 1:13:19 AM
> >>>>> Subject: Re: [keycloak-user] Impersonate User
> >>>>>
> >>>>> Thanks.
> >>>>>
> >>>>> Out of curiosity, how do you see this being implemented? Would a user
> >>>>> who
> >>>>> can
> >>>>> impersonate another have a specific role to allow this?
> >>>>>
> >>>>> I?m thinking a bit about how I may be able to support it before it
> >>>>> becomes a
> >>>>> feature, or if it?s something we would be able to contribute.
> >>>>>
> >>>>> ~ Scott
> >>>>>
> >>>>>
> >>>>>
> >>>>> On Tue, Apr 7, 2015 at 6:06 PM, Bill Burke < bburke at redhat.com > wrote:
> >>>>>
> >>>>>
> >>>>> We don't have this feature but it is something that some key customers
> >>>>> want. I would say we would get to it sometime this summer.
> >>>>>
> >>>>>> On 4/7/2015 6:03 PM, Scott Rossillo wrote:
> >>>>>> Hi,
> >>>>>>
> >>>>>> We?re looking for the best way to support having one user, such as an
> >>>>>> admin, have the ability to impersonate another user. I don?t see a
> >>>>>> simple way to do this with Keycloak at the moment.
> >>>>>>
> >>>>>> Would you mind letting me know if this is on the roadmap - I didn?t
> >>>>>> see
> >>>>>> a JIRA - or if you have any recommendations on implementing such
> >>>>>> behavior.
> >>>>>>
> >>>>>> Thanks,
> >>>>>> Scott
> >>>>>>
> >>>>>>
> >>>>>>
> >>>>>> _______________________________________________
> >>>>>> keycloak-user mailing list
> >>>>>> keycloak-user at lists.jboss.org
> >>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
> >>>>>
> >>>>> --
> >>>>> Bill Burke
> >>>>> JBoss, a division of Red Hat
> >>>>> http://bill.burkecentral.com
> >>>>> _______________________________________________
> >>>>> keycloak-user mailing list
> >>>>> keycloak-user at lists.jboss.org
> >>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
> >>>>>
> >>>>>
> >>>>> _______________________________________________
> >>>>> keycloak-user mailing list
> >>>>> keycloak-user at lists.jboss.org
> >>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
> >>>
> >>> --
> >>> Bill Burke
> >>> JBoss, a division of Red Hat
> >>> http://bill.burkecentral.com
> >>> _______________________________________________
> >>> keycloak-user mailing list
> >>> keycloak-user at lists.jboss.org
> >>> https://lists.jboss.org/mailman/listinfo/keycloak-user
> >>
> >>
> >>
> >> _______________________________________________
> >> keycloak-user mailing list keycloak-user at lists.jboss.org
> >> https://lists.jboss.org/mailman/listinfo/keycloak-user
> >>
> >>
> >> _______________________________________________
> >> keycloak-user mailing list
> >> keycloak-user at lists.jboss.org
> >> https://lists.jboss.org/mailman/listinfo/keycloak-user
> >
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
> >
> 
> --
> Bill Burke
> JBoss, a division of Red Hat
> http://bill.burkecentral.com
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user


From kalc04 at gmail.com  Thu Apr  9 09:03:48 2015
From: kalc04 at gmail.com (Lohitha Chiranjeewa)
Date: Thu, 9 Apr 2015 18:33:48 +0530
Subject: [keycloak-user] Clarification on Remember Me Functionality
Message-ID: <CAPj1eSxqUFhzWj51NE1K+7RDXRKY0s9_9otbA_RY5a+EdvCfwg@mail.gmail.com>

Hi,

The Remember Me requirement on our application(s) is such that, once logged
in with Remember Me enabled, the user should be able to visit the
application(s) without logging in again for another two week period.

When I tested the Keycloak Remember Me functionality, it seems that,
despite Remember Me is turned on, the use has to log in again if either of
SSO Session Idle Timeout or SSO Session Max Lifespan reached.

Is this the expected behavior of Keycloak? If so, how can I map it to cater
my requriement? Or is there any way I can change the default Keycloak
behavior?


Thanks!
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150409/0cebd0c4/attachment.html 

From bburke at redhat.com  Thu Apr  9 09:07:45 2015
From: bburke at redhat.com (Bill Burke)
Date: Thu, 09 Apr 2015 09:07:45 -0400
Subject: [keycloak-user] Impersonate User
In-Reply-To: <2568478.15156446.1428584058445.JavaMail.zimbra@redhat.com>
References: <CALAqdu8ecDs5VF4JsNBYkiS4Rc=n2bXjJ3DYT3XfyCWDiM3tgg@mail.gmail.com>
	<1204559404.14047153.1428468823726.JavaMail.zimbra@redhat.com>
	<55253335.2080703@redhat.com>
	<E99EEBE1-B241-4775-B06D-F76C074250EC@yahoo.com>
	<CALAqdu8S4waCixOodbqUgzYh-DGsAAgOYEi82Bxv_PxNS5trTg@mail.gmail.com>
	<552628FF.7060303@redhat.com>
	<823017618.15013081.1428576226696.JavaMail.zimbra@redhat.com>
	<552672A9.8090505@redhat.com>
	<2568478.15156446.1428584058445.JavaMail.zimbra@redhat.com>
Message-ID: <552679A1.1060503@redhat.com>



On 4/9/2015 8:54 AM, Stian Thorgersen wrote:
>
>
> ----- Original Message -----
>> From: "Bill Burke" <bburke at redhat.com>
>> To: keycloak-user at lists.jboss.org
>> Sent: Thursday, 9 April, 2015 2:38:01 PM
>> Subject: Re: [keycloak-user] Impersonate User
>>
>> I think you should ask the users what they want instead of assuming that
>> only impersonating per application is the way to go.  There's certainly
>> a lot of different features we could implement around this, but
>> unfortunately there's only so much time to do them.
>
> I'm not assuming anything I'm just giving my opinion. Besides, we should not always just do exactly what users asks for, we should rather make sure we understand their requirements and come up with good solutions that works for Keycloak and them.
>
> I'm sure there's situations where a SSO level impersonation would be more convinient. However, a token swap service like I suggested would be much simpler to implement and a lot less risky as well. We should add a token swap service in either case to allow for example downgrading tokens for chained services.
>

An STS approach would work great for REST services and non-web access, 
but, what about web apps?  Specifically the case where an admin or IT 
support staff or developer wants to debug a problem a user is having. 
They impersonate the user so that they can see exactly what is going wrong.



-- 
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com

From ssilvert at redhat.com  Thu Apr  9 10:46:48 2015
From: ssilvert at redhat.com (Stan Silvert)
Date: Thu, 09 Apr 2015 10:46:48 -0400
Subject: [keycloak-user] Impersonate User
In-Reply-To: <552679A1.1060503@redhat.com>
References: <CALAqdu8ecDs5VF4JsNBYkiS4Rc=n2bXjJ3DYT3XfyCWDiM3tgg@mail.gmail.com>
	<1204559404.14047153.1428468823726.JavaMail.zimbra@redhat.com>
	<55253335.2080703@redhat.com>
	<E99EEBE1-B241-4775-B06D-F76C074250EC@yahoo.com>
	<CALAqdu8S4waCixOodbqUgzYh-DGsAAgOYEi82Bxv_PxNS5trTg@mail.gmail.com>
	<552628FF.7060303@redhat.com>
	<823017618.15013081.1428576226696.JavaMail.zimbra@redhat.com>
	<552672A9.8090505@redhat.com>
	<2568478.15156446.1428584058445.JavaMail.zimbra@redhat.com>
	<552679A1.1060503@redhat.com>
Message-ID: <552690D8.5010406@redhat.com>

On 4/9/2015 9:07 AM, Bill Burke wrote:
>
> On 4/9/2015 8:54 AM, Stian Thorgersen wrote:
>>
>> ----- Original Message -----
>>> From: "Bill Burke" <bburke at redhat.com>
>>> To: keycloak-user at lists.jboss.org
>>> Sent: Thursday, 9 April, 2015 2:38:01 PM
>>> Subject: Re: [keycloak-user] Impersonate User
>>>
>>> I think you should ask the users what they want instead of assuming that
>>> only impersonating per application is the way to go.  There's certainly
>>> a lot of different features we could implement around this, but
>>> unfortunately there's only so much time to do them.
>> I'm not assuming anything I'm just giving my opinion. Besides, we should not always just do exactly what users asks for, we should rather make sure we understand their requirements and come up with good solutions that works for Keycloak and them.
>>
>> I'm sure there's situations where a SSO level impersonation would be more convinient. However, a token swap service like I suggested would be much simpler to implement and a lot less risky as well. We should add a token swap service in either case to allow for example downgrading tokens for chained services.
>>
> An STS approach would work great for REST services and non-web access,
> but, what about web apps?  Specifically the case where an admin or IT
> support staff or developer wants to debug a problem a user is having.
> They impersonate the user so that they can see exactly what is going wrong.
>
>
>
Do we need to be the ones to solve that use case?  The user can either 
use a screen sharing application or give the admin his password.  Maybe 
that's good enough?



From mposolda at redhat.com  Thu Apr  9 10:49:45 2015
From: mposolda at redhat.com (Marek Posolda)
Date: Thu, 09 Apr 2015 16:49:45 +0200
Subject: [keycloak-user] Impersonate User
In-Reply-To: <552679A1.1060503@redhat.com>
References: <CALAqdu8ecDs5VF4JsNBYkiS4Rc=n2bXjJ3DYT3XfyCWDiM3tgg@mail.gmail.com>	<1204559404.14047153.1428468823726.JavaMail.zimbra@redhat.com>	<55253335.2080703@redhat.com>	<E99EEBE1-B241-4775-B06D-F76C074250EC@yahoo.com>	<CALAqdu8S4waCixOodbqUgzYh-DGsAAgOYEi82Bxv_PxNS5trTg@mail.gmail.com>	<552628FF.7060303@redhat.com>	<823017618.15013081.1428576226696.JavaMail.zimbra@redhat.com>	<552672A9.8090505@redhat.com>	<2568478.15156446.1428584058445.JavaMail.zimbra@redhat.com>
	<552679A1.1060503@redhat.com>
Message-ID: <55269189.6080305@redhat.com>

Yeah, I am not sure if token swap service is sufficient..

IMO the admin might want to see (or edit) the account management on 
behalf of particular user. But our account mgmt is secured by SSO 
cookie, not token.

For web applications, the swapping of token would still require the 
support on adapters. Basically if admin wants to impersonate as some 
user in webapp, we still need to figure backup (or invalidation) of 
admin HttpSession, so the web UI of impersonated session really looks 
like UI of user and is not polished with some previous state from admin 
session. The same would need to be solved for JS apps, but here it may 
be even more tricky...

In shortcut, if we want to have something more usable and give to admin 
the same experience like the impersonated user (including UI 
experience), we may need to do impersonation at SSO level. And do 
impersonation as logout of admin session and then SSO re-login of 
impersonated user.

Marek

On 9.4.2015 15:07, Bill Burke wrote:
>
> On 4/9/2015 8:54 AM, Stian Thorgersen wrote:
>>
>> ----- Original Message -----
>>> From: "Bill Burke" <bburke at redhat.com>
>>> To: keycloak-user at lists.jboss.org
>>> Sent: Thursday, 9 April, 2015 2:38:01 PM
>>> Subject: Re: [keycloak-user] Impersonate User
>>>
>>> I think you should ask the users what they want instead of assuming that
>>> only impersonating per application is the way to go.  There's certainly
>>> a lot of different features we could implement around this, but
>>> unfortunately there's only so much time to do them.
>> I'm not assuming anything I'm just giving my opinion. Besides, we should not always just do exactly what users asks for, we should rather make sure we understand their requirements and come up with good solutions that works for Keycloak and them.
>>
>> I'm sure there's situations where a SSO level impersonation would be more convinient. However, a token swap service like I suggested would be much simpler to implement and a lot less risky as well. We should add a token swap service in either case to allow for example downgrading tokens for chained services.
>>
> An STS approach would work great for REST services and non-web access,
> but, what about web apps?  Specifically the case where an admin or IT
> support staff or developer wants to debug a problem a user is having.
> They impersonate the user so that they can see exactly what is going wrong.
>
>
>


From stian at redhat.com  Fri Apr 10 00:33:48 2015
From: stian at redhat.com (Stian Thorgersen)
Date: Fri, 10 Apr 2015 00:33:48 -0400 (EDT)
Subject: [keycloak-user] Impersonate User
In-Reply-To: <55269189.6080305@redhat.com>
References: <CALAqdu8ecDs5VF4JsNBYkiS4Rc=n2bXjJ3DYT3XfyCWDiM3tgg@mail.gmail.com>
	<CALAqdu8S4waCixOodbqUgzYh-DGsAAgOYEi82Bxv_PxNS5trTg@mail.gmail.com>
	<552628FF.7060303@redhat.com>
	<823017618.15013081.1428576226696.JavaMail.zimbra@redhat.com>
	<552672A9.8090505@redhat.com>
	<2568478.15156446.1428584058445.JavaMail.zimbra@redhat.com>
	<552679A1.1060503@redhat.com> <55269189.6080305@redhat.com>
Message-ID: <1311734483.15611950.1428640428415.JavaMail.zimbra@redhat.com>

True a separate service might be to much work for applications to implement.

How about just having a kc_impersonate query param available in auth endpoint? In that case the adapter logs-out the current session, then redirects to auth endpoint with kc_impersonate=<username>? That way your still impersonating a single app rather than the whole SSO session and you can also have an option on each app to enable/disable impersonation.

----- Original Message -----
> From: "Marek Posolda" <mposolda at redhat.com>
> To: "Bill Burke" <bburke at redhat.com>, "Stian Thorgersen" <stian at redhat.com>
> Cc: keycloak-user at lists.jboss.org
> Sent: Thursday, 9 April, 2015 4:49:45 PM
> Subject: Re: [keycloak-user] Impersonate User
> 
> Yeah, I am not sure if token swap service is sufficient..
> 
> IMO the admin might want to see (or edit) the account management on
> behalf of particular user. But our account mgmt is secured by SSO
> cookie, not token.
> 
> For web applications, the swapping of token would still require the
> support on adapters. Basically if admin wants to impersonate as some
> user in webapp, we still need to figure backup (or invalidation) of
> admin HttpSession, so the web UI of impersonated session really looks
> like UI of user and is not polished with some previous state from admin
> session. The same would need to be solved for JS apps, but here it may
> be even more tricky...
> 
> In shortcut, if we want to have something more usable and give to admin
> the same experience like the impersonated user (including UI
> experience), we may need to do impersonation at SSO level. And do
> impersonation as logout of admin session and then SSO re-login of
> impersonated user.
> 
> Marek
> 
> On 9.4.2015 15:07, Bill Burke wrote:
> >
> > On 4/9/2015 8:54 AM, Stian Thorgersen wrote:
> >>
> >> ----- Original Message -----
> >>> From: "Bill Burke" <bburke at redhat.com>
> >>> To: keycloak-user at lists.jboss.org
> >>> Sent: Thursday, 9 April, 2015 2:38:01 PM
> >>> Subject: Re: [keycloak-user] Impersonate User
> >>>
> >>> I think you should ask the users what they want instead of assuming that
> >>> only impersonating per application is the way to go.  There's certainly
> >>> a lot of different features we could implement around this, but
> >>> unfortunately there's only so much time to do them.
> >> I'm not assuming anything I'm just giving my opinion. Besides, we should
> >> not always just do exactly what users asks for, we should rather make
> >> sure we understand their requirements and come up with good solutions
> >> that works for Keycloak and them.
> >>
> >> I'm sure there's situations where a SSO level impersonation would be more
> >> convinient. However, a token swap service like I suggested would be much
> >> simpler to implement and a lot less risky as well. We should add a token
> >> swap service in either case to allow for example downgrading tokens for
> >> chained services.
> >>
> > An STS approach would work great for REST services and non-web access,
> > but, what about web apps?  Specifically the case where an admin or IT
> > support staff or developer wants to debug a problem a user is having.
> > They impersonate the user so that they can see exactly what is going wrong.
> >
> >
> >
> 
> 

From stian at redhat.com  Fri Apr 10 01:04:46 2015
From: stian at redhat.com (Stian Thorgersen)
Date: Fri, 10 Apr 2015 01:04:46 -0400 (EDT)
Subject: [keycloak-user] Clarification on Remember Me Functionality
In-Reply-To: <CAPj1eSxqUFhzWj51NE1K+7RDXRKY0s9_9otbA_RY5a+EdvCfwg@mail.gmail.com>
References: <CAPj1eSxqUFhzWj51NE1K+7RDXRKY0s9_9otbA_RY5a+EdvCfwg@mail.gmail.com>
Message-ID: <1606336012.15615789.1428642286476.JavaMail.zimbra@redhat.com>



----- Original Message -----
> From: "Lohitha Chiranjeewa" <kalc04 at gmail.com>
> To: keycloak-user at lists.jboss.org
> Sent: Thursday, 9 April, 2015 3:03:48 PM
> Subject: [keycloak-user] Clarification on Remember Me Functionality
> 
> Hi,
> 
> The Remember Me requirement on our application(s) is such that, once logged
> in with Remember Me enabled, the user should be able to visit the
> application(s) without logging in again for another two week period.
> 
> When I tested the Keycloak Remember Me functionality, it seems that, despite
> Remember Me is turned on, the use has to log in again if either of SSO
> Session Idle Timeout or SSO Session Max Lifespan reached.
> 
> Is this the expected behavior of Keycloak? If so, how can I map it to cater
> my requriement? Or is there any way I can change the default Keycloak
> behavior?

Set SSO Session Max Lifespan to two weeks and you're sorted. The main thing the remember me option does is to make the browser cookie a persistent cookie rather than just a session cookie.

> 
> 
> Thanks!
> 
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From stian at redhat.com  Fri Apr 10 01:31:54 2015
From: stian at redhat.com (Stian Thorgersen)
Date: Fri, 10 Apr 2015 01:31:54 -0400 (EDT)
Subject: [keycloak-user] Keycloak Docker image updated to 1.2.0.Beta1
Message-ID: <1157817272.15644671.1428643914944.JavaMail.zimbra@redhat.com>

Keycloak Docker image updated to 1.2.0.Beta1

https://registry.hub.docker.com/u/jboss/keycloak/

From kalc04 at gmail.com  Fri Apr 10 02:57:19 2015
From: kalc04 at gmail.com (Lohitha Chiranjeewa)
Date: Fri, 10 Apr 2015 12:27:19 +0530
Subject: [keycloak-user] Clarification on Remember Me Functionality
In-Reply-To: <1077151537.15651304.1428645933306.JavaMail.zimbra@redhat.com>
References: <CAPj1eSxqUFhzWj51NE1K+7RDXRKY0s9_9otbA_RY5a+EdvCfwg@mail.gmail.com>
	<1606336012.15615789.1428642286476.JavaMail.zimbra@redhat.com>
	<CAPj1eSwehcAKD65E5xL0oxP=oMG3yNpGXxEmJXzNQFRKRhvAdg@mail.gmail.com>
	<1077151537.15651304.1428645933306.JavaMail.zimbra@redhat.com>
Message-ID: <CAPj1eSzcCoDF7T=RTT1bmUXM93VbOfa7Mz1sG2dKATdTsHN5Wg@mail.gmail.com>

Thanks for the suggestion. I will have to adjust both timeouts according to
my needs.

So is this the expected behavior of Keycloak or is there room for an
improvement? In my view, Remember Me functionality should work independent
of SSO Session Idle Timeout.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150410/b69bd86c/attachment.html 

From stian at redhat.com  Fri Apr 10 04:32:02 2015
From: stian at redhat.com (Stian Thorgersen)
Date: Fri, 10 Apr 2015 04:32:02 -0400 (EDT)
Subject: [keycloak-user] Clarification on Remember Me Functionality
In-Reply-To: <CAPj1eSzcCoDF7T=RTT1bmUXM93VbOfa7Mz1sG2dKATdTsHN5Wg@mail.gmail.com>
References: <CAPj1eSxqUFhzWj51NE1K+7RDXRKY0s9_9otbA_RY5a+EdvCfwg@mail.gmail.com>
	<1606336012.15615789.1428642286476.JavaMail.zimbra@redhat.com>
	<CAPj1eSwehcAKD65E5xL0oxP=oMG3yNpGXxEmJXzNQFRKRhvAdg@mail.gmail.com>
	<1077151537.15651304.1428645933306.JavaMail.zimbra@redhat.com>
	<CAPj1eSzcCoDF7T=RTT1bmUXM93VbOfa7Mz1sG2dKATdTsHN5Wg@mail.gmail.com>
Message-ID: <1163846703.15736138.1428654722223.JavaMail.zimbra@redhat.com>

This is expected behaviour

----- Original Message -----
> From: "Lohitha Chiranjeewa" <kalc04 at gmail.com>
> To: "Stian Thorgersen" <stian at redhat.com>, keycloak-user at lists.jboss.org
> Sent: Friday, 10 April, 2015 8:57:19 AM
> Subject: Re: [keycloak-user] Clarification on Remember Me Functionality
> 
> Thanks for the suggestion. I will have to adjust both timeouts according to
> my needs.
> 
> So is this the expected behavior of Keycloak or is there room for an
> improvement? In my view, Remember Me functionality should work independent
> of SSO Session Idle Timeout.
> 

From chenkeong.yap at izeno.com  Fri Apr 10 05:51:46 2015
From: chenkeong.yap at izeno.com (Chen Keong Yap)
Date: Fri, 10 Apr 2015 17:51:46 +0800
Subject: [keycloak-user] Secure application module access
Message-ID: <CAC2UnuXeXPe+UN3jj_7tsKchKhwAHb5+-PVJq_nZn=7pAbsWJw@mail.gmail.com>

Hi,

We had secured our erp application by using root context in keycloak.

Can someone advise is it possible to secure application module in keycloak?

If yes, kindly share your ideas please.

ERP root context url : https://localhost/erp/

Finance module url : ERP url : https://localhost/erp/finance/profitloss.jsp
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150410/003ef454/attachment.html 

From srossillo at smartling.com  Fri Apr 10 12:10:12 2015
From: srossillo at smartling.com (Scott Rossillo)
Date: Fri, 10 Apr 2015 12:10:12 -0400
Subject: [keycloak-user] API Tokens and Permissions (like GitHub Personal
	Tokens)
Message-ID: <CALAqdu972=z3mZ=k_-55_Uk4djw4eF4SiehaW+tVytorp1KdkQ@mail.gmail.com>

We have a system in place where a user is granted API access tokens for a
project. These tokens can also have permissions associated with them (it
could be as simple as read/write or read-only). In any case, if we migrate
to SSO with OIDC, I'm not sure how best to re-implement such a solution.

Should it even be a concern of the OIDC system? If so, is it something
that's being considered as a Keycloak feature? For example, GitHub allows
tokens to be generated and used in place of a password to access their
OAuth 2.0 API.

Thanks,
Scott
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150410/e4e8ee8b/attachment.html 

From bburke at redhat.com  Fri Apr 10 12:41:13 2015
From: bburke at redhat.com (Bill Burke)
Date: Fri, 10 Apr 2015 12:41:13 -0400
Subject: [keycloak-user] API Tokens and Permissions (like GitHub
 Personal Tokens)
In-Reply-To: <CALAqdu972=z3mZ=k_-55_Uk4djw4eF4SiehaW+tVytorp1KdkQ@mail.gmail.com>
References: <CALAqdu972=z3mZ=k_-55_Uk4djw4eF4SiehaW+tVytorp1KdkQ@mail.gmail.com>
Message-ID: <5527FD29.8070506@redhat.com>

Keycloak's access token format is an extension of JWT (JsonWebToken) in 
which we added role claims.  Hoe that answers your question.

On 4/10/2015 12:10 PM, Scott Rossillo wrote:
> We have a system in place where a user is granted API access tokens for
> a project. These tokens can also have permissions associated with them
> (it could be as simple as read/write or read-only). In any case, if we
> migrate to SSO with OIDC, I'm not sure how best to re-implement such a
> solution.
>
> Should it even be a concern of the OIDC system? If so, is it something
> that's being considered as a Keycloak feature? For example, GitHub
> allows tokens to be generated and used in place of a password to access
> their OAuth 2.0 API.
>
> Thanks,
> Scott
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

-- 
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com

From srossillo at smartling.com  Fri Apr 10 13:02:08 2015
From: srossillo at smartling.com (Scott Rossillo)
Date: Fri, 10 Apr 2015 13:02:08 -0400
Subject: [keycloak-user] API Tokens and Permissions (like GitHub
	Personal Tokens)
In-Reply-To: <5527FD29.8070506@redhat.com>
References: <CALAqdu972=z3mZ=k_-55_Uk4djw4eF4SiehaW+tVytorp1KdkQ@mail.gmail.com>
	<5527FD29.8070506@redhat.com>
Message-ID: <CALAqdu_x5CnEb1DQhvBEALhRKOS3q_XNjpBeFjuN+nn=FMZpRQ@mail.gmail.com>

Not quite. JTW and Keycloak's extensions make sense. The part I'm not sure
where best to manage is the API user. I'm assuming from your answer that
you'd envision each API user being a user in the Keycloak system, correct?
If so, I'm still not sure how to associate these with the main user account.

On Fri, Apr 10, 2015 at 12:41 PM, Bill Burke <bburke at redhat.com> wrote:

> Keycloak's access token format is an extension of JWT (JsonWebToken) in
> which we added role claims.  Hoe that answers your question.
>
> On 4/10/2015 12:10 PM, Scott Rossillo wrote:
> > We have a system in place where a user is granted API access tokens for
> > a project. These tokens can also have permissions associated with them
> > (it could be as simple as read/write or read-only). In any case, if we
> > migrate to SSO with OIDC, I'm not sure how best to re-implement such a
> > solution.
> >
> > Should it even be a concern of the OIDC system? If so, is it something
> > that's being considered as a Keycloak feature? For example, GitHub
> > allows tokens to be generated and used in place of a password to access
> > their OAuth 2.0 API.
> >
> > Thanks,
> > Scott
> >
> >
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
> >
>
> --
> Bill Burke
> JBoss, a division of Red Hat
> http://bill.burkecentral.com
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150410/e6c2ae14/attachment.html 

From chenkeong.yap at izeno.com  Fri Apr 10 20:41:44 2015
From: chenkeong.yap at izeno.com (Chen Keong Yap)
Date: Sat, 11 Apr 2015 08:41:44 +0800
Subject: [keycloak-user] Secure application module access
In-Reply-To: <CAC2UnuXeXPe+UN3jj_7tsKchKhwAHb5+-PVJq_nZn=7pAbsWJw@mail.gmail.com>
References: <CAC2UnuXeXPe+UN3jj_7tsKchKhwAHb5+-PVJq_nZn=7pAbsWJw@mail.gmail.com>
Message-ID: <CAC2UnuVicALAnN8ftcnr08R+MJcaBNh_d1jnob3GCUpygCBXxw@mail.gmail.com>

hi bill,

do you think is doable?

On Fri, Apr 10, 2015 at 5:51 PM, Chen Keong Yap <chenkeong.yap at izeno.com>
wrote:

> Hi,
>
> We had secured our erp application by using root context in keycloak.
>
> Can someone advise is it possible to secure application module in keycloak?
>
> If yes, kindly share your ideas please.
>
> ERP root context url : https://localhost/erp/
>
> Finance module url : ERP url :
> https://localhost/erp/finance/profitloss.jsp
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150411/755fb27e/attachment.html 

From Henk.Laracker at planonsoftware.com  Sun Apr 12 12:35:08 2015
From: Henk.Laracker at planonsoftware.com (Henk Laracker)
Date: Sun, 12 Apr 2015 18:35:08 +0200
Subject: [keycloak-user] Tomcat with 2 application
Message-ID: <D1506B5C.1B3B5%henk.laracker@planonsoftware.com>

Hi,

I have a tomcat 7 running with two web applications deployed , called ROOT and web client. I created a realm in keycloak and two applications. Configures tomcat with the correct json files. When I log in in Root it works fine, when I login in web client it works fine. But the following is the case. Both application are not owned by my , so I can not change the code. I login in ROOT, this application connects to web client through a rest call, this restcall results in a redirect to keycloak because I?m not logged in. the result of this is :
XMLHttpRequest cannot load https://keycloak-accdev.planoncloud.com/auth/realms/auth/protocol/openid-co?atorDataService&state=10%2Ff14baad8-c385-4221-b86a-0ac2f0cf8d6a&login=true. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'https://auth-proddev.planoncloud.com' is therefore not allowed access.
I know that this has something todo with CORS, so I added  the settings:

"enable-cors" : true,
"cors-max-age" : 1000,
"cors-allowed-methods" : "POST, PUT, DELETE, GET?,

To the json file. And added the keycloak url to web origin of both apps in the keycloak manager, but still I got the same result. What do I do wrong? Please advice.

Henk
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150412/c8d09a62/attachment.html 

From peterson.dean at gmail.com  Sun Apr 12 19:43:18 2015
From: peterson.dean at gmail.com (Dean Peterson)
Date: Sun, 12 Apr 2015 18:43:18 -0500
Subject: [keycloak-user] Tried upgrading again (no luck)
Message-ID: <CAFGzvPn9M_PToiAfhL0hgwRyf357AqKyCgVzkFMyVY49M8WQrw@mail.gmail.com>

I tried upgrading from 1.1.0-Alpha1 to 1.2.0.Beta1.jar.  I get many errors
that look like this:

[org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint] (default
task-122) Invoking deprecated endpoint
http://localhost:8080/auth/realms/abecorn/tokens/login?client_id=trade-client&redirect_uri=http%3A%2F%2Flocalhost%3A9001%2F%3Fredirect_fragment%3D%252F&state=150ce43d-1f7e-4462-8156-c3fbb5dcd92b&response_type=code
18:35:32,990 ERROR [io.undertow.request] (default task-122) UT005023:
Exception handling request to /auth/realms/abecorn/tokens/login

Also,  I had to copy the themes folder from the dist appliance because the
war distributable is missing the themes folder.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150412/0e18f79b/attachment-0001.html 

From peterson.dean at gmail.com  Sun Apr 12 20:57:11 2015
From: peterson.dean at gmail.com (Dean Peterson)
Date: Sun, 12 Apr 2015 19:57:11 -0500
Subject: [keycloak-user] Tried upgrading again (no luck)
In-Reply-To: <CAFGzvPn9M_PToiAfhL0hgwRyf357AqKyCgVzkFMyVY49M8WQrw@mail.gmail.com>
References: <CAFGzvPn9M_PToiAfhL0hgwRyf357AqKyCgVzkFMyVY49M8WQrw@mail.gmail.com>
Message-ID: <CAFGzvPmZtiQU7ueL3raya3PXbL_PjtuX2ue4wWRKL+=knPas8Q@mail.gmail.com>

Actually, I get this error.  The previous error I mentioned was due to an
old version of keycloak.js.

This is the error I am getting:
(default task-12) UT005023: Exception handling request to
/auth/realms/abecorn/protocol/openid-connect/auth:
java.lang.RuntimeException: request path:
/auth/realms/abecorn/protocol/openid-connect/auth
at
org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:54)
[keycloak-services-1.2.0.Beta1.jar:1.2.0.Beta1]
at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:60)
[undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
at
io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:132)
[undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
at
io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:85)
[undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
at
io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:61)
[undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
at
io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
[undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
at
org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78)
at
io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:25)
[undertow-core-1.0.15.Final.jar:1.0.15.Final]
at
io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:113)
[undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
at
io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:56)
[undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
at
io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:25)
[undertow-core-1.0.15.Final.jar:1.0.15.Final]
at
io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:45)
[undertow-core-1.0.15.Final.jar:1.0.15.Final]
at
io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:61)
[undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
at
io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:58)
[undertow-core-1.0.15.Final.jar:1.0.15.Final]
at
io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:70)
[undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
at
io.undertow.security.handlers.SecurityInitialHandler.handleRequest(SecurityInitialHandler.java:76)
[undertow-core-1.0.15.Final.jar:1.0.15.Final]
at
io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:25)
[undertow-core-1.0.15.Final.jar:1.0.15.Final]
at
org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)
at
io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:25)
[undertow-core-1.0.15.Final.jar:1.0.15.Final]
at
io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:25)
[undertow-core-1.0.15.Final.jar:1.0.15.Final]
at
io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:240)
[undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
at
io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:227)
[undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
at
io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:73)
[undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
at
io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:146)
[undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
at io.undertow.server.Connectors.executeRootHandler(Connectors.java:177)
[undertow-core-1.0.15.Final.jar:1.0.15.Final]
at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:727)
[undertow-core-1.0.15.Final.jar:1.0.15.Final]
at
java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
[rt.jar:1.8.0_31]
at
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
[rt.jar:1.8.0_31]
at java.lang.Thread.run(Thread.java:745) [rt.jar:1.8.0_31]
Caused by: org.jboss.resteasy.spi.UnhandledException:
java.lang.RuntimeException: java.lang.NullPointerException
at
org.jboss.resteasy.core.ExceptionHandler.handleApplicationException(ExceptionHandler.java:76)
[resteasy-jaxrs-3.0.8.Final.jar:]
at
org.jboss.resteasy.core.ExceptionHandler.handleException(ExceptionHandler.java:212)
[resteasy-jaxrs-3.0.8.Final.jar:]
at
org.jboss.resteasy.core.SynchronousDispatcher.writeException(SynchronousDispatcher.java:149)
[resteasy-jaxrs-3.0.8.Final.jar:]
at
org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:372)
[resteasy-jaxrs-3.0.8.Final.jar:]
at
org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:179)
[resteasy-jaxrs-3.0.8.Final.jar:]
at
org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:220)
[resteasy-jaxrs-3.0.8.Final.jar:]
at
org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56)
[resteasy-jaxrs-3.0.8.Final.jar:]
at
org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51)
[resteasy-jaxrs-3.0.8.Final.jar:]
at javax.servlet.http.HttpServlet.service(HttpServlet.java:790)
[jboss-servlet-api_3.1_spec-1.0.0.Final.jar:1.0.0.Final]
at
io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:85)
[undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
at
io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:130)
[undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
at
org.keycloak.services.filters.ClientConnectionFilter.doFilter(ClientConnectionFilter.java:41)
[keycloak-services-1.2.0.Beta1.jar:1.2.0.Beta1]
at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:60)
[undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
at
io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:132)
[undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
at
org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:40)
[keycloak-services-1.2.0.Beta1.jar:1.2.0.Beta1]
... 28 more
Caused by: java.lang.RuntimeException: java.lang.NullPointerException
at
org.keycloak.services.managers.ClientSessionCode.createHash(ClientSessionCode.java:171)
[keycloak-services-1.2.0.Beta1.jar:1.2.0.Beta1]
at
org.keycloak.services.managers.ClientSessionCode.generateCode(ClientSessionCode.java:151)
[keycloak-services-1.2.0.Beta1.jar:1.2.0.Beta1]
at
org.keycloak.services.managers.ClientSessionCode.getCode(ClientSessionCode.java:147)
[keycloak-services-1.2.0.Beta1.jar:1.2.0.Beta1]
at
org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint.buildAuthorizationCodeAuthorizationResponse(AuthorizationEndpoint.java:236)
[keycloak-services-1.2.0.Beta1.jar:1.2.0.Beta1]
at
org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint.build(AuthorizationEndpoint.java:100)
[keycloak-services-1.2.0.Beta1.jar:1.2.0.Beta1]
at sun.reflect.GeneratedMethodAccessor264.invoke(Unknown Source) [:1.8.0_31]
at
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
[rt.jar:1.8.0_31]
at java.lang.reflect.Method.invoke(Method.java:483) [rt.jar:1.8.0_31]
at
org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java:137)
[resteasy-jaxrs-3.0.8.Final.jar:]
at
org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTarget(ResourceMethodInvoker.java:296)
[resteasy-jaxrs-3.0.8.Final.jar:]
at
org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:250)
[resteasy-jaxrs-3.0.8.Final.jar:]
at
org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(ResourceLocatorInvoker.java:140)
[resteasy-jaxrs-3.0.8.Final.jar:]
at
org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:109)
[resteasy-jaxrs-3.0.8.Final.jar:]
at
org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(ResourceLocatorInvoker.java:135)
[resteasy-jaxrs-3.0.8.Final.jar:]
at
org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:103)
[resteasy-jaxrs-3.0.8.Final.jar:]
at
org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:356)
[resteasy-jaxrs-3.0.8.Final.jar:]
... 39 more
Caused by: java.lang.NullPointerException
at
org.keycloak.services.managers.ClientSessionCode.createHash(ClientSessionCode.java:164)
[keycloak-services-1.2.0.Beta1.jar:1.2.0.Beta1]

On Sun, Apr 12, 2015 at 6:43 PM, Dean Peterson <peterson.dean at gmail.com>
wrote:

> I tried upgrading from 1.1.0-Alpha1 to 1.2.0.Beta1.jar.  I get many errors
> that look like this:
>
> [org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint] (default
> task-122) Invoking deprecated endpoint
> http://localhost:8080/auth/realms/abecorn/tokens/login?client_id=trade-client&redirect_uri=http%3A%2F%2Flocalhost%3A9001%2F%3Fredirect_fragment%3D%252F&state=150ce43d-1f7e-4462-8156-c3fbb5dcd92b&response_type=code
> 18:35:32,990 ERROR [io.undertow.request] (default task-122) UT005023:
> Exception handling request to /auth/realms/abecorn/tokens/login
>
> Also,  I had to copy the themes folder from the dist appliance because the
> war distributable is missing the themes folder.
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150412/ff5f13c9/attachment.html 

From stian at redhat.com  Mon Apr 13 01:36:00 2015
From: stian at redhat.com (Stian Thorgersen)
Date: Mon, 13 Apr 2015 01:36:00 -0400 (EDT)
Subject: [keycloak-user] Tried upgrading again (no luck)
In-Reply-To: <CAFGzvPmZtiQU7ueL3raya3PXbL_PjtuX2ue4wWRKL+=knPas8Q@mail.gmail.com>
References: <CAFGzvPn9M_PToiAfhL0hgwRyf357AqKyCgVzkFMyVY49M8WQrw@mail.gmail.com>
	<CAFGzvPmZtiQU7ueL3raya3PXbL_PjtuX2ue4wWRKL+=knPas8Q@mail.gmail.com>
Message-ID: <1925815479.16992817.1428903360766.JavaMail.zimbra@redhat.com>

We've never released a "1.1.0-Alpha1" so I'm not sure what version you're referring to.

Did you follow the migration guide in the docs? Specifically the part about migrating the database?

The problem you're seeing is as the realm doesn't have a value for codeSecret, which was introduced in 1.1.0.Beta1 (https://issues.jboss.org/browse/KEYCLOAK-704). The migration feature takes care of adding that during upgrade.

----- Original Message -----
> From: "Dean Peterson" <peterson.dean at gmail.com>
> To: keycloak-user at lists.jboss.org
> Sent: Monday, 13 April, 2015 2:57:11 AM
> Subject: Re: [keycloak-user] Tried upgrading again (no luck)
> 
> Actually, I get this error. The previous error I mentioned was due to an old
> version of keycloak.js.
> 
> This is the error I am getting:
> (default task-12) UT005023: Exception handling request to
> /auth/realms/abecorn/protocol/openid-connect/auth:
> java.lang.RuntimeException: request path:
> /auth/realms/abecorn/protocol/openid-connect/auth
> at
> org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:54)
> [keycloak-services-1.2.0.Beta1.jar:1.2.0.Beta1]
> at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:60)
> [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
> at
> io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:132)
> [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
> at
> io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:85)
> [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
> at
> io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:61)
> [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
> at
> io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
> [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
> at
> org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78)
> at
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:25)
> [undertow-core-1.0.15.Final.jar:1.0.15.Final]
> at
> io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:113)
> [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
> at
> io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:56)
> [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
> at
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:25)
> [undertow-core-1.0.15.Final.jar:1.0.15.Final]
> at
> io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:45)
> [undertow-core-1.0.15.Final.jar:1.0.15.Final]
> at
> io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:61)
> [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
> at
> io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:58)
> [undertow-core-1.0.15.Final.jar:1.0.15.Final]
> at
> io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:70)
> [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
> at
> io.undertow.security.handlers.SecurityInitialHandler.handleRequest(SecurityInitialHandler.java:76)
> [undertow-core-1.0.15.Final.jar:1.0.15.Final]
> at
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:25)
> [undertow-core-1.0.15.Final.jar:1.0.15.Final]
> at
> org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)
> at
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:25)
> [undertow-core-1.0.15.Final.jar:1.0.15.Final]
> at
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:25)
> [undertow-core-1.0.15.Final.jar:1.0.15.Final]
> at
> io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:240)
> [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
> at
> io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:227)
> [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
> at
> io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:73)
> [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
> at
> io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:146)
> [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
> at io.undertow.server.Connectors.executeRootHandler(Connectors.java:177)
> [undertow-core-1.0.15.Final.jar:1.0.15.Final]
> at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:727)
> [undertow-core-1.0.15.Final.jar:1.0.15.Final]
> at
> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
> [rt.jar:1.8.0_31]
> at
> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
> [rt.jar:1.8.0_31]
> at java.lang.Thread.run(Thread.java:745) [rt.jar:1.8.0_31]
> Caused by: org.jboss.resteasy.spi.UnhandledException:
> java.lang.RuntimeException: java.lang.NullPointerException
> at
> org.jboss.resteasy.core.ExceptionHandler.handleApplicationException(ExceptionHandler.java:76)
> [resteasy-jaxrs-3.0.8.Final.jar:]
> at
> org.jboss.resteasy.core.ExceptionHandler.handleException(ExceptionHandler.java:212)
> [resteasy-jaxrs-3.0.8.Final.jar:]
> at
> org.jboss.resteasy.core.SynchronousDispatcher.writeException(SynchronousDispatcher.java:149)
> [resteasy-jaxrs-3.0.8.Final.jar:]
> at
> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:372)
> [resteasy-jaxrs-3.0.8.Final.jar:]
> at
> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:179)
> [resteasy-jaxrs-3.0.8.Final.jar:]
> at
> org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:220)
> [resteasy-jaxrs-3.0.8.Final.jar:]
> at
> org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56)
> [resteasy-jaxrs-3.0.8.Final.jar:]
> at
> org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51)
> [resteasy-jaxrs-3.0.8.Final.jar:]
> at javax.servlet.http.HttpServlet.service(HttpServlet.java:790)
> [jboss-servlet-api_3.1_spec-1.0.0.Final.jar:1.0.0.Final]
> at
> io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:85)
> [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
> at
> io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:130)
> [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
> at
> org.keycloak.services.filters.ClientConnectionFilter.doFilter(ClientConnectionFilter.java:41)
> [keycloak-services-1.2.0.Beta1.jar:1.2.0.Beta1]
> at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:60)
> [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
> at
> io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:132)
> [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
> at
> org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:40)
> [keycloak-services-1.2.0.Beta1.jar:1.2.0.Beta1]
> ... 28 more
> Caused by: java.lang.RuntimeException: java.lang.NullPointerException
> at
> org.keycloak.services.managers.ClientSessionCode.createHash(ClientSessionCode.java:171)
> [keycloak-services-1.2.0.Beta1.jar:1.2.0.Beta1]
> at
> org.keycloak.services.managers.ClientSessionCode.generateCode(ClientSessionCode.java:151)
> [keycloak-services-1.2.0.Beta1.jar:1.2.0.Beta1]
> at
> org.keycloak.services.managers.ClientSessionCode.getCode(ClientSessionCode.java:147)
> [keycloak-services-1.2.0.Beta1.jar:1.2.0.Beta1]
> at
> org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint.buildAuthorizationCodeAuthorizationResponse(AuthorizationEndpoint.java:236)
> [keycloak-services-1.2.0.Beta1.jar:1.2.0.Beta1]
> at
> org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint.build(AuthorizationEndpoint.java:100)
> [keycloak-services-1.2.0.Beta1.jar:1.2.0.Beta1]
> at sun.reflect.GeneratedMethodAccessor264.invoke(Unknown Source) [:1.8.0_31]
> at
> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
> [rt.jar:1.8.0_31]
> at java.lang.reflect.Method.invoke(Method.java:483) [rt.jar:1.8.0_31]
> at
> org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java:137)
> [resteasy-jaxrs-3.0.8.Final.jar:]
> at
> org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTarget(ResourceMethodInvoker.java:296)
> [resteasy-jaxrs-3.0.8.Final.jar:]
> at
> org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:250)
> [resteasy-jaxrs-3.0.8.Final.jar:]
> at
> org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(ResourceLocatorInvoker.java:140)
> [resteasy-jaxrs-3.0.8.Final.jar:]
> at
> org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:109)
> [resteasy-jaxrs-3.0.8.Final.jar:]
> at
> org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(ResourceLocatorInvoker.java:135)
> [resteasy-jaxrs-3.0.8.Final.jar:]
> at
> org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:103)
> [resteasy-jaxrs-3.0.8.Final.jar:]
> at
> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:356)
> [resteasy-jaxrs-3.0.8.Final.jar:]
> ... 39 more
> Caused by: java.lang.NullPointerException
> at
> org.keycloak.services.managers.ClientSessionCode.createHash(ClientSessionCode.java:164)
> [keycloak-services-1.2.0.Beta1.jar:1.2.0.Beta1]
> 
> On Sun, Apr 12, 2015 at 6:43 PM, Dean Peterson < peterson.dean at gmail.com >
> wrote:
> 
> 
> 
> I tried upgrading from 1.1.0-Alpha1 to 1.2.0.Beta1.jar. I get many errors
> that look like this:
> 
> [org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint] (default
> task-122) Invoking deprecated endpoint
> http://localhost:8080/auth/realms/abecorn/tokens/login?client_id=trade-client&redirect_uri=http%3A%2F%2Flocalhost%3A9001%2F%3Fredirect_fragment%3D%252F&state=150ce43d-1f7e-4462-8156-c3fbb5dcd92b&response_type=code
> 18:35:32,990 ERROR [io.undertow.request] (default task-122) UT005023:
> Exception handling request to /auth/realms/abecorn/tokens/login
> 
> Also, I had to copy the themes folder from the dist appliance because the war
> distributable is missing the themes folder.
> 
> 
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From peterson.dean at gmail.com  Mon Apr 13 09:19:08 2015
From: peterson.dean at gmail.com (Dean Peterson)
Date: Mon, 13 Apr 2015 08:19:08 -0500
Subject: [keycloak-user] Tried upgrading again (no luck)
In-Reply-To: <1925815479.16992817.1428903360766.JavaMail.zimbra@redhat.com>
References: <CAFGzvPn9M_PToiAfhL0hgwRyf357AqKyCgVzkFMyVY49M8WQrw@mail.gmail.com>
	<CAFGzvPmZtiQU7ueL3raya3PXbL_PjtuX2ue4wWRKL+=knPas8Q@mail.gmail.com>
	<1925815479.16992817.1428903360766.JavaMail.zimbra@redhat.com>
Message-ID: <CAFGzvPnxbADVnL2cwXCM7=hdTiiPQ8Dv=0otFtbD32Kf0XDUZQ@mail.gmail.com>

It is a snapshot version.  I was able to get it to work but I had to
regenerate a secret for an applications in the realm.  When I did that the
code secret for the realm was somehow generated.  I did the database
migration prior to that (it even listed it had been migrated in the
databaseChangeLog collection) but the code secret was still empty.

On Mon, Apr 13, 2015 at 12:36 AM, Stian Thorgersen <stian at redhat.com> wrote:

> We've never released a "1.1.0-Alpha1" so I'm not sure what version you're
> referring to.
>
> Did you follow the migration guide in the docs? Specifically the part
> about migrating the database?
>
> The problem you're seeing is as the realm doesn't have a value for
> codeSecret, which was introduced in 1.1.0.Beta1 (
> https://issues.jboss.org/browse/KEYCLOAK-704). The migration feature
> takes care of adding that during upgrade.
>
> ----- Original Message -----
> > From: "Dean Peterson" <peterson.dean at gmail.com>
> > To: keycloak-user at lists.jboss.org
> > Sent: Monday, 13 April, 2015 2:57:11 AM
> > Subject: Re: [keycloak-user] Tried upgrading again (no luck)
> >
> > Actually, I get this error. The previous error I mentioned was due to an
> old
> > version of keycloak.js.
> >
> > This is the error I am getting:
> > (default task-12) UT005023: Exception handling request to
> > /auth/realms/abecorn/protocol/openid-connect/auth:
> > java.lang.RuntimeException: request path:
> > /auth/realms/abecorn/protocol/openid-connect/auth
> > at
> >
> org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:54)
> > [keycloak-services-1.2.0.Beta1.jar:1.2.0.Beta1]
> > at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:60)
> > [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
> > at
> >
> io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:132)
> > [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
> > at
> >
> io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:85)
> > [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
> > at
> >
> io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:61)
> > [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
> > at
> >
> io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
> > [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
> > at
> >
> org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78)
> > at
> >
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:25)
> > [undertow-core-1.0.15.Final.jar:1.0.15.Final]
> > at
> >
> io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:113)
> > [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
> > at
> >
> io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:56)
> > [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
> > at
> >
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:25)
> > [undertow-core-1.0.15.Final.jar:1.0.15.Final]
> > at
> >
> io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:45)
> > [undertow-core-1.0.15.Final.jar:1.0.15.Final]
> > at
> >
> io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:61)
> > [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
> > at
> >
> io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:58)
> > [undertow-core-1.0.15.Final.jar:1.0.15.Final]
> > at
> >
> io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:70)
> > [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
> > at
> >
> io.undertow.security.handlers.SecurityInitialHandler.handleRequest(SecurityInitialHandler.java:76)
> > [undertow-core-1.0.15.Final.jar:1.0.15.Final]
> > at
> >
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:25)
> > [undertow-core-1.0.15.Final.jar:1.0.15.Final]
> > at
> >
> org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)
> > at
> >
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:25)
> > [undertow-core-1.0.15.Final.jar:1.0.15.Final]
> > at
> >
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:25)
> > [undertow-core-1.0.15.Final.jar:1.0.15.Final]
> > at
> >
> io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:240)
> > [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
> > at
> >
> io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:227)
> > [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
> > at
> >
> io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:73)
> > [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
> > at
> >
> io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:146)
> > [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
> > at io.undertow.server.Connectors.executeRootHandler(Connectors.java:177)
> > [undertow-core-1.0.15.Final.jar:1.0.15.Final]
> > at
> io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:727)
> > [undertow-core-1.0.15.Final.jar:1.0.15.Final]
> > at
> >
> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
> > [rt.jar:1.8.0_31]
> > at
> >
> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
> > [rt.jar:1.8.0_31]
> > at java.lang.Thread.run(Thread.java:745) [rt.jar:1.8.0_31]
> > Caused by: org.jboss.resteasy.spi.UnhandledException:
> > java.lang.RuntimeException: java.lang.NullPointerException
> > at
> >
> org.jboss.resteasy.core.ExceptionHandler.handleApplicationException(ExceptionHandler.java:76)
> > [resteasy-jaxrs-3.0.8.Final.jar:]
> > at
> >
> org.jboss.resteasy.core.ExceptionHandler.handleException(ExceptionHandler.java:212)
> > [resteasy-jaxrs-3.0.8.Final.jar:]
> > at
> >
> org.jboss.resteasy.core.SynchronousDispatcher.writeException(SynchronousDispatcher.java:149)
> > [resteasy-jaxrs-3.0.8.Final.jar:]
> > at
> >
> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:372)
> > [resteasy-jaxrs-3.0.8.Final.jar:]
> > at
> >
> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:179)
> > [resteasy-jaxrs-3.0.8.Final.jar:]
> > at
> >
> org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:220)
> > [resteasy-jaxrs-3.0.8.Final.jar:]
> > at
> >
> org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56)
> > [resteasy-jaxrs-3.0.8.Final.jar:]
> > at
> >
> org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51)
> > [resteasy-jaxrs-3.0.8.Final.jar:]
> > at javax.servlet.http.HttpServlet.service(HttpServlet.java:790)
> > [jboss-servlet-api_3.1_spec-1.0.0.Final.jar:1.0.0.Final]
> > at
> >
> io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:85)
> > [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
> > at
> >
> io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:130)
> > [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
> > at
> >
> org.keycloak.services.filters.ClientConnectionFilter.doFilter(ClientConnectionFilter.java:41)
> > [keycloak-services-1.2.0.Beta1.jar:1.2.0.Beta1]
> > at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:60)
> > [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
> > at
> >
> io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:132)
> > [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
> > at
> >
> org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:40)
> > [keycloak-services-1.2.0.Beta1.jar:1.2.0.Beta1]
> > ... 28 more
> > Caused by: java.lang.RuntimeException: java.lang.NullPointerException
> > at
> >
> org.keycloak.services.managers.ClientSessionCode.createHash(ClientSessionCode.java:171)
> > [keycloak-services-1.2.0.Beta1.jar:1.2.0.Beta1]
> > at
> >
> org.keycloak.services.managers.ClientSessionCode.generateCode(ClientSessionCode.java:151)
> > [keycloak-services-1.2.0.Beta1.jar:1.2.0.Beta1]
> > at
> >
> org.keycloak.services.managers.ClientSessionCode.getCode(ClientSessionCode.java:147)
> > [keycloak-services-1.2.0.Beta1.jar:1.2.0.Beta1]
> > at
> >
> org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint.buildAuthorizationCodeAuthorizationResponse(AuthorizationEndpoint.java:236)
> > [keycloak-services-1.2.0.Beta1.jar:1.2.0.Beta1]
> > at
> >
> org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint.build(AuthorizationEndpoint.java:100)
> > [keycloak-services-1.2.0.Beta1.jar:1.2.0.Beta1]
> > at sun.reflect.GeneratedMethodAccessor264.invoke(Unknown Source)
> [:1.8.0_31]
> > at
> >
> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
> > [rt.jar:1.8.0_31]
> > at java.lang.reflect.Method.invoke(Method.java:483) [rt.jar:1.8.0_31]
> > at
> >
> org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java:137)
> > [resteasy-jaxrs-3.0.8.Final.jar:]
> > at
> >
> org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTarget(ResourceMethodInvoker.java:296)
> > [resteasy-jaxrs-3.0.8.Final.jar:]
> > at
> >
> org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:250)
> > [resteasy-jaxrs-3.0.8.Final.jar:]
> > at
> >
> org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(ResourceLocatorInvoker.java:140)
> > [resteasy-jaxrs-3.0.8.Final.jar:]
> > at
> >
> org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:109)
> > [resteasy-jaxrs-3.0.8.Final.jar:]
> > at
> >
> org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(ResourceLocatorInvoker.java:135)
> > [resteasy-jaxrs-3.0.8.Final.jar:]
> > at
> >
> org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:103)
> > [resteasy-jaxrs-3.0.8.Final.jar:]
> > at
> >
> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:356)
> > [resteasy-jaxrs-3.0.8.Final.jar:]
> > ... 39 more
> > Caused by: java.lang.NullPointerException
> > at
> >
> org.keycloak.services.managers.ClientSessionCode.createHash(ClientSessionCode.java:164)
> > [keycloak-services-1.2.0.Beta1.jar:1.2.0.Beta1]
> >
> > On Sun, Apr 12, 2015 at 6:43 PM, Dean Peterson < peterson.dean at gmail.com
> >
> > wrote:
> >
> >
> >
> > I tried upgrading from 1.1.0-Alpha1 to 1.2.0.Beta1.jar. I get many errors
> > that look like this:
> >
> > [org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint] (default
> > task-122) Invoking deprecated endpoint
> >
> http://localhost:8080/auth/realms/abecorn/tokens/login?client_id=trade-client&redirect_uri=http%3A%2F%2Flocalhost%3A9001%2F%3Fredirect_fragment%3D%252F&state=150ce43d-1f7e-4462-8156-c3fbb5dcd92b&response_type=code
> > 18:35:32,990 ERROR [io.undertow.request] (default task-122) UT005023:
> > Exception handling request to /auth/realms/abecorn/tokens/login
> >
> > Also, I had to copy the themes folder from the dist appliance because
> the war
> > distributable is missing the themes folder.
> >
> >
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150413/ae23d428/attachment.html 

From stian at redhat.com  Mon Apr 13 09:53:57 2015
From: stian at redhat.com (Stian Thorgersen)
Date: Mon, 13 Apr 2015 09:53:57 -0400 (EDT)
Subject: [keycloak-user] Tried upgrading again (no luck)
In-Reply-To: <CAFGzvPnxbADVnL2cwXCM7=hdTiiPQ8Dv=0otFtbD32Kf0XDUZQ@mail.gmail.com>
References: <CAFGzvPn9M_PToiAfhL0hgwRyf357AqKyCgVzkFMyVY49M8WQrw@mail.gmail.com>
	<CAFGzvPmZtiQU7ueL3raya3PXbL_PjtuX2ue4wWRKL+=knPas8Q@mail.gmail.com>
	<1925815479.16992817.1428903360766.JavaMail.zimbra@redhat.com>
	<CAFGzvPnxbADVnL2cwXCM7=hdTiiPQ8Dv=0otFtbD32Kf0XDUZQ@mail.gmail.com>
Message-ID: <1488284972.17438443.1428933237421.JavaMail.zimbra@redhat.com>

Upgrading from a snapshot version is not really a good idea as you won't really know what state it was in before or after the upgrade. In that case I would recommend using the export to json feature and re-importing to a fresh installation instead.

The code secret is re-generated when the realm keys are generated, so yes that'll work. I would still not recommend using it though.



----- Original Message -----
> From: "Dean Peterson" <peterson.dean at gmail.com>
> To: "Stian Thorgersen" <stian at redhat.com>
> Cc: keycloak-user at lists.jboss.org
> Sent: Monday, 13 April, 2015 3:19:08 PM
> Subject: Re: [keycloak-user] Tried upgrading again (no luck)
> 
> It is a snapshot version.  I was able to get it to work but I had to
> regenerate a secret for an applications in the realm.  When I did that the
> code secret for the realm was somehow generated.  I did the database
> migration prior to that (it even listed it had been migrated in the
> databaseChangeLog collection) but the code secret was still empty.
> 
> On Mon, Apr 13, 2015 at 12:36 AM, Stian Thorgersen <stian at redhat.com> wrote:
> 
> > We've never released a "1.1.0-Alpha1" so I'm not sure what version you're
> > referring to.
> >
> > Did you follow the migration guide in the docs? Specifically the part
> > about migrating the database?
> >
> > The problem you're seeing is as the realm doesn't have a value for
> > codeSecret, which was introduced in 1.1.0.Beta1 (
> > https://issues.jboss.org/browse/KEYCLOAK-704). The migration feature
> > takes care of adding that during upgrade.
> >
> > ----- Original Message -----
> > > From: "Dean Peterson" <peterson.dean at gmail.com>
> > > To: keycloak-user at lists.jboss.org
> > > Sent: Monday, 13 April, 2015 2:57:11 AM
> > > Subject: Re: [keycloak-user] Tried upgrading again (no luck)
> > >
> > > Actually, I get this error. The previous error I mentioned was due to an
> > old
> > > version of keycloak.js.
> > >
> > > This is the error I am getting:
> > > (default task-12) UT005023: Exception handling request to
> > > /auth/realms/abecorn/protocol/openid-connect/auth:
> > > java.lang.RuntimeException: request path:
> > > /auth/realms/abecorn/protocol/openid-connect/auth
> > > at
> > >
> > org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:54)
> > > [keycloak-services-1.2.0.Beta1.jar:1.2.0.Beta1]
> > > at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:60)
> > > [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
> > > at
> > >
> > io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:132)
> > > [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
> > > at
> > >
> > io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:85)
> > > [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
> > > at
> > >
> > io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:61)
> > > [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
> > > at
> > >
> > io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
> > > [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
> > > at
> > >
> > org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78)
> > > at
> > >
> > io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:25)
> > > [undertow-core-1.0.15.Final.jar:1.0.15.Final]
> > > at
> > >
> > io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:113)
> > > [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
> > > at
> > >
> > io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:56)
> > > [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
> > > at
> > >
> > io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:25)
> > > [undertow-core-1.0.15.Final.jar:1.0.15.Final]
> > > at
> > >
> > io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:45)
> > > [undertow-core-1.0.15.Final.jar:1.0.15.Final]
> > > at
> > >
> > io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:61)
> > > [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
> > > at
> > >
> > io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:58)
> > > [undertow-core-1.0.15.Final.jar:1.0.15.Final]
> > > at
> > >
> > io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:70)
> > > [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
> > > at
> > >
> > io.undertow.security.handlers.SecurityInitialHandler.handleRequest(SecurityInitialHandler.java:76)
> > > [undertow-core-1.0.15.Final.jar:1.0.15.Final]
> > > at
> > >
> > io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:25)
> > > [undertow-core-1.0.15.Final.jar:1.0.15.Final]
> > > at
> > >
> > org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)
> > > at
> > >
> > io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:25)
> > > [undertow-core-1.0.15.Final.jar:1.0.15.Final]
> > > at
> > >
> > io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:25)
> > > [undertow-core-1.0.15.Final.jar:1.0.15.Final]
> > > at
> > >
> > io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:240)
> > > [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
> > > at
> > >
> > io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:227)
> > > [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
> > > at
> > >
> > io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:73)
> > > [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
> > > at
> > >
> > io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:146)
> > > [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
> > > at io.undertow.server.Connectors.executeRootHandler(Connectors.java:177)
> > > [undertow-core-1.0.15.Final.jar:1.0.15.Final]
> > > at
> > io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:727)
> > > [undertow-core-1.0.15.Final.jar:1.0.15.Final]
> > > at
> > >
> > java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
> > > [rt.jar:1.8.0_31]
> > > at
> > >
> > java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
> > > [rt.jar:1.8.0_31]
> > > at java.lang.Thread.run(Thread.java:745) [rt.jar:1.8.0_31]
> > > Caused by: org.jboss.resteasy.spi.UnhandledException:
> > > java.lang.RuntimeException: java.lang.NullPointerException
> > > at
> > >
> > org.jboss.resteasy.core.ExceptionHandler.handleApplicationException(ExceptionHandler.java:76)
> > > [resteasy-jaxrs-3.0.8.Final.jar:]
> > > at
> > >
> > org.jboss.resteasy.core.ExceptionHandler.handleException(ExceptionHandler.java:212)
> > > [resteasy-jaxrs-3.0.8.Final.jar:]
> > > at
> > >
> > org.jboss.resteasy.core.SynchronousDispatcher.writeException(SynchronousDispatcher.java:149)
> > > [resteasy-jaxrs-3.0.8.Final.jar:]
> > > at
> > >
> > org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:372)
> > > [resteasy-jaxrs-3.0.8.Final.jar:]
> > > at
> > >
> > org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:179)
> > > [resteasy-jaxrs-3.0.8.Final.jar:]
> > > at
> > >
> > org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:220)
> > > [resteasy-jaxrs-3.0.8.Final.jar:]
> > > at
> > >
> > org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56)
> > > [resteasy-jaxrs-3.0.8.Final.jar:]
> > > at
> > >
> > org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51)
> > > [resteasy-jaxrs-3.0.8.Final.jar:]
> > > at javax.servlet.http.HttpServlet.service(HttpServlet.java:790)
> > > [jboss-servlet-api_3.1_spec-1.0.0.Final.jar:1.0.0.Final]
> > > at
> > >
> > io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:85)
> > > [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
> > > at
> > >
> > io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:130)
> > > [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
> > > at
> > >
> > org.keycloak.services.filters.ClientConnectionFilter.doFilter(ClientConnectionFilter.java:41)
> > > [keycloak-services-1.2.0.Beta1.jar:1.2.0.Beta1]
> > > at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:60)
> > > [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
> > > at
> > >
> > io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:132)
> > > [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
> > > at
> > >
> > org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:40)
> > > [keycloak-services-1.2.0.Beta1.jar:1.2.0.Beta1]
> > > ... 28 more
> > > Caused by: java.lang.RuntimeException: java.lang.NullPointerException
> > > at
> > >
> > org.keycloak.services.managers.ClientSessionCode.createHash(ClientSessionCode.java:171)
> > > [keycloak-services-1.2.0.Beta1.jar:1.2.0.Beta1]
> > > at
> > >
> > org.keycloak.services.managers.ClientSessionCode.generateCode(ClientSessionCode.java:151)
> > > [keycloak-services-1.2.0.Beta1.jar:1.2.0.Beta1]
> > > at
> > >
> > org.keycloak.services.managers.ClientSessionCode.getCode(ClientSessionCode.java:147)
> > > [keycloak-services-1.2.0.Beta1.jar:1.2.0.Beta1]
> > > at
> > >
> > org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint.buildAuthorizationCodeAuthorizationResponse(AuthorizationEndpoint.java:236)
> > > [keycloak-services-1.2.0.Beta1.jar:1.2.0.Beta1]
> > > at
> > >
> > org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint.build(AuthorizationEndpoint.java:100)
> > > [keycloak-services-1.2.0.Beta1.jar:1.2.0.Beta1]
> > > at sun.reflect.GeneratedMethodAccessor264.invoke(Unknown Source)
> > [:1.8.0_31]
> > > at
> > >
> > sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
> > > [rt.jar:1.8.0_31]
> > > at java.lang.reflect.Method.invoke(Method.java:483) [rt.jar:1.8.0_31]
> > > at
> > >
> > org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java:137)
> > > [resteasy-jaxrs-3.0.8.Final.jar:]
> > > at
> > >
> > org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTarget(ResourceMethodInvoker.java:296)
> > > [resteasy-jaxrs-3.0.8.Final.jar:]
> > > at
> > >
> > org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:250)
> > > [resteasy-jaxrs-3.0.8.Final.jar:]
> > > at
> > >
> > org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(ResourceLocatorInvoker.java:140)
> > > [resteasy-jaxrs-3.0.8.Final.jar:]
> > > at
> > >
> > org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:109)
> > > [resteasy-jaxrs-3.0.8.Final.jar:]
> > > at
> > >
> > org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(ResourceLocatorInvoker.java:135)
> > > [resteasy-jaxrs-3.0.8.Final.jar:]
> > > at
> > >
> > org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:103)
> > > [resteasy-jaxrs-3.0.8.Final.jar:]
> > > at
> > >
> > org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:356)
> > > [resteasy-jaxrs-3.0.8.Final.jar:]
> > > ... 39 more
> > > Caused by: java.lang.NullPointerException
> > > at
> > >
> > org.keycloak.services.managers.ClientSessionCode.createHash(ClientSessionCode.java:164)
> > > [keycloak-services-1.2.0.Beta1.jar:1.2.0.Beta1]
> > >
> > > On Sun, Apr 12, 2015 at 6:43 PM, Dean Peterson < peterson.dean at gmail.com
> > >
> > > wrote:
> > >
> > >
> > >
> > > I tried upgrading from 1.1.0-Alpha1 to 1.2.0.Beta1.jar. I get many errors
> > > that look like this:
> > >
> > > [org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint] (default
> > > task-122) Invoking deprecated endpoint
> > >
> > http://localhost:8080/auth/realms/abecorn/tokens/login?client_id=trade-client&redirect_uri=http%3A%2F%2Flocalhost%3A9001%2F%3Fredirect_fragment%3D%252F&state=150ce43d-1f7e-4462-8156-c3fbb5dcd92b&response_type=code
> > > 18:35:32,990 ERROR [io.undertow.request] (default task-122) UT005023:
> > > Exception handling request to /auth/realms/abecorn/tokens/login
> > >
> > > Also, I had to copy the themes folder from the dist appliance because
> > the war
> > > distributable is missing the themes folder.
> > >
> > >
> > > _______________________________________________
> > > keycloak-user mailing list
> > > keycloak-user at lists.jboss.org
> > > https://lists.jboss.org/mailman/listinfo/keycloak-user
> >
> 

From mposolda at redhat.com  Mon Apr 13 10:50:19 2015
From: mposolda at redhat.com (Marek Posolda)
Date: Mon, 13 Apr 2015 16:50:19 +0200
Subject: [keycloak-user] Impersonate User
In-Reply-To: <1311734483.15611950.1428640428415.JavaMail.zimbra@redhat.com>
References: <CALAqdu8ecDs5VF4JsNBYkiS4Rc=n2bXjJ3DYT3XfyCWDiM3tgg@mail.gmail.com>
	<CALAqdu8S4waCixOodbqUgzYh-DGsAAgOYEi82Bxv_PxNS5trTg@mail.gmail.com>
	<552628FF.7060303@redhat.com>
	<823017618.15013081.1428576226696.JavaMail.zimbra@redhat.com>
	<552672A9.8090505@redhat.com>
	<2568478.15156446.1428584058445.JavaMail.zimbra@redhat.com>
	<552679A1.1060503@redhat.com> <55269189.6080305@redhat.com>
	<1311734483.15611950.1428640428415.JavaMail.zimbra@redhat.com>
Message-ID: <552BD7AB.9090704@redhat.com>

On 10.4.2015 06:33, Stian Thorgersen wrote:
> True a separate service might be to much work for applications to implement.
>
> How about just having a kc_impersonate query param available in auth endpoint? In that case the adapter logs-out the current session, then redirects to auth endpoint with kc_impersonate=<username>? That way your still impersonating a single app rather than the whole SSO session and you can also have an option on each app to enable/disable impersonation.
If I understand correctly, it means that UserSession on auth-server side 
would be still the session of "admin", but we will need to track which 
ClientSessions of this UserSession were impersonated. So the 
impersonation will be tracked per ClientSession. Is it correct? 
Refreshing token probably won't be a problem, as auth-server will know 
which clientSession was impersonated and will be able to grant 
accessToken for impersonated user.

One thing is, that adapters will need to support some kind of "local" 
logout. As we will need to support logout on application side, but not 
logout of corresponding userSession on auth-server though. So some 
special logic on adapters might be still needed though...

Also it won't address the impersonation of account-management 
application though, as this one is secured by our SSO cookie.

So not sure... I am probably still slightly more inclined to do it per 
SSO;-)

Marek

>
> ----- Original Message -----
>> From: "Marek Posolda" <mposolda at redhat.com>
>> To: "Bill Burke" <bburke at redhat.com>, "Stian Thorgersen" <stian at redhat.com>
>> Cc: keycloak-user at lists.jboss.org
>> Sent: Thursday, 9 April, 2015 4:49:45 PM
>> Subject: Re: [keycloak-user] Impersonate User
>>
>> Yeah, I am not sure if token swap service is sufficient..
>>
>> IMO the admin might want to see (or edit) the account management on
>> behalf of particular user. But our account mgmt is secured by SSO
>> cookie, not token.
>>
>> For web applications, the swapping of token would still require the
>> support on adapters. Basically if admin wants to impersonate as some
>> user in webapp, we still need to figure backup (or invalidation) of
>> admin HttpSession, so the web UI of impersonated session really looks
>> like UI of user and is not polished with some previous state from admin
>> session. The same would need to be solved for JS apps, but here it may
>> be even more tricky...
>>
>> In shortcut, if we want to have something more usable and give to admin
>> the same experience like the impersonated user (including UI
>> experience), we may need to do impersonation at SSO level. And do
>> impersonation as logout of admin session and then SSO re-login of
>> impersonated user.
>>
>> Marek
>>
>> On 9.4.2015 15:07, Bill Burke wrote:
>>> On 4/9/2015 8:54 AM, Stian Thorgersen wrote:
>>>> ----- Original Message -----
>>>>> From: "Bill Burke" <bburke at redhat.com>
>>>>> To: keycloak-user at lists.jboss.org
>>>>> Sent: Thursday, 9 April, 2015 2:38:01 PM
>>>>> Subject: Re: [keycloak-user] Impersonate User
>>>>>
>>>>> I think you should ask the users what they want instead of assuming that
>>>>> only impersonating per application is the way to go.  There's certainly
>>>>> a lot of different features we could implement around this, but
>>>>> unfortunately there's only so much time to do them.
>>>> I'm not assuming anything I'm just giving my opinion. Besides, we should
>>>> not always just do exactly what users asks for, we should rather make
>>>> sure we understand their requirements and come up with good solutions
>>>> that works for Keycloak and them.
>>>>
>>>> I'm sure there's situations where a SSO level impersonation would be more
>>>> convinient. However, a token swap service like I suggested would be much
>>>> simpler to implement and a lot less risky as well. We should add a token
>>>> swap service in either case to allow for example downgrading tokens for
>>>> chained services.
>>>>
>>> An STS approach would work great for REST services and non-web access,
>>> but, what about web apps?  Specifically the case where an admin or IT
>>> support staff or developer wants to debug a problem a user is having.
>>> They impersonate the user so that they can see exactly what is going wrong.
>>>
>>>
>>>
>>


From peterson.dean at gmail.com  Mon Apr 13 11:31:30 2015
From: peterson.dean at gmail.com (Dean Peterson)
Date: Mon, 13 Apr 2015 10:31:30 -0500
Subject: [keycloak-user] Tried upgrading again (no luck)
In-Reply-To: <1488284972.17438443.1428933237421.JavaMail.zimbra@redhat.com>
References: <CAFGzvPn9M_PToiAfhL0hgwRyf357AqKyCgVzkFMyVY49M8WQrw@mail.gmail.com>
	<CAFGzvPmZtiQU7ueL3raya3PXbL_PjtuX2ue4wWRKL+=knPas8Q@mail.gmail.com>
	<1925815479.16992817.1428903360766.JavaMail.zimbra@redhat.com>
	<CAFGzvPnxbADVnL2cwXCM7=hdTiiPQ8Dv=0otFtbD32Kf0XDUZQ@mail.gmail.com>
	<1488284972.17438443.1428933237421.JavaMail.zimbra@redhat.com>
Message-ID: <CAFGzvP=gGBaDiHryfKCLFW5zPky5ugSKMRPwrLF42uynQ-V+Lw@mail.gmail.com>

I was not aware of the export to json feature.  I'll try that.  Thanks!

On Mon, Apr 13, 2015 at 8:53 AM, Stian Thorgersen <stian at redhat.com> wrote:

> Upgrading from a snapshot version is not really a good idea as you won't
> really know what state it was in before or after the upgrade. In that case
> I would recommend using the export to json feature and re-importing to a
> fresh installation instead.
>
> The code secret is re-generated when the realm keys are generated, so yes
> that'll work. I would still not recommend using it though.
>
>
>
> ----- Original Message -----
> > From: "Dean Peterson" <peterson.dean at gmail.com>
> > To: "Stian Thorgersen" <stian at redhat.com>
> > Cc: keycloak-user at lists.jboss.org
> > Sent: Monday, 13 April, 2015 3:19:08 PM
> > Subject: Re: [keycloak-user] Tried upgrading again (no luck)
> >
> > It is a snapshot version.  I was able to get it to work but I had to
> > regenerate a secret for an applications in the realm.  When I did that
> the
> > code secret for the realm was somehow generated.  I did the database
> > migration prior to that (it even listed it had been migrated in the
> > databaseChangeLog collection) but the code secret was still empty.
> >
> > On Mon, Apr 13, 2015 at 12:36 AM, Stian Thorgersen <stian at redhat.com>
> wrote:
> >
> > > We've never released a "1.1.0-Alpha1" so I'm not sure what version
> you're
> > > referring to.
> > >
> > > Did you follow the migration guide in the docs? Specifically the part
> > > about migrating the database?
> > >
> > > The problem you're seeing is as the realm doesn't have a value for
> > > codeSecret, which was introduced in 1.1.0.Beta1 (
> > > https://issues.jboss.org/browse/KEYCLOAK-704). The migration feature
> > > takes care of adding that during upgrade.
> > >
> > > ----- Original Message -----
> > > > From: "Dean Peterson" <peterson.dean at gmail.com>
> > > > To: keycloak-user at lists.jboss.org
> > > > Sent: Monday, 13 April, 2015 2:57:11 AM
> > > > Subject: Re: [keycloak-user] Tried upgrading again (no luck)
> > > >
> > > > Actually, I get this error. The previous error I mentioned was due
> to an
> > > old
> > > > version of keycloak.js.
> > > >
> > > > This is the error I am getting:
> > > > (default task-12) UT005023: Exception handling request to
> > > > /auth/realms/abecorn/protocol/openid-connect/auth:
> > > > java.lang.RuntimeException: request path:
> > > > /auth/realms/abecorn/protocol/openid-connect/auth
> > > > at
> > > >
> > >
> org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:54)
> > > > [keycloak-services-1.2.0.Beta1.jar:1.2.0.Beta1]
> > > > at
> io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:60)
> > > > [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
> > > > at
> > > >
> > >
> io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:132)
> > > > [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
> > > > at
> > > >
> > >
> io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:85)
> > > > [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
> > > > at
> > > >
> > >
> io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:61)
> > > > [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
> > > > at
> > > >
> > >
> io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
> > > > [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
> > > > at
> > > >
> > >
> org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78)
> > > > at
> > > >
> > >
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:25)
> > > > [undertow-core-1.0.15.Final.jar:1.0.15.Final]
> > > > at
> > > >
> > >
> io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:113)
> > > > [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
> > > > at
> > > >
> > >
> io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:56)
> > > > [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
> > > > at
> > > >
> > >
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:25)
> > > > [undertow-core-1.0.15.Final.jar:1.0.15.Final]
> > > > at
> > > >
> > >
> io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:45)
> > > > [undertow-core-1.0.15.Final.jar:1.0.15.Final]
> > > > at
> > > >
> > >
> io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:61)
> > > > [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
> > > > at
> > > >
> > >
> io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:58)
> > > > [undertow-core-1.0.15.Final.jar:1.0.15.Final]
> > > > at
> > > >
> > >
> io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:70)
> > > > [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
> > > > at
> > > >
> > >
> io.undertow.security.handlers.SecurityInitialHandler.handleRequest(SecurityInitialHandler.java:76)
> > > > [undertow-core-1.0.15.Final.jar:1.0.15.Final]
> > > > at
> > > >
> > >
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:25)
> > > > [undertow-core-1.0.15.Final.jar:1.0.15.Final]
> > > > at
> > > >
> > >
> org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)
> > > > at
> > > >
> > >
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:25)
> > > > [undertow-core-1.0.15.Final.jar:1.0.15.Final]
> > > > at
> > > >
> > >
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:25)
> > > > [undertow-core-1.0.15.Final.jar:1.0.15.Final]
> > > > at
> > > >
> > >
> io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:240)
> > > > [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
> > > > at
> > > >
> > >
> io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:227)
> > > > [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
> > > > at
> > > >
> > >
> io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:73)
> > > > [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
> > > > at
> > > >
> > >
> io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:146)
> > > > [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
> > > > at
> io.undertow.server.Connectors.executeRootHandler(Connectors.java:177)
> > > > [undertow-core-1.0.15.Final.jar:1.0.15.Final]
> > > > at
> > >
> io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:727)
> > > > [undertow-core-1.0.15.Final.jar:1.0.15.Final]
> > > > at
> > > >
> > >
> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
> > > > [rt.jar:1.8.0_31]
> > > > at
> > > >
> > >
> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
> > > > [rt.jar:1.8.0_31]
> > > > at java.lang.Thread.run(Thread.java:745) [rt.jar:1.8.0_31]
> > > > Caused by: org.jboss.resteasy.spi.UnhandledException:
> > > > java.lang.RuntimeException: java.lang.NullPointerException
> > > > at
> > > >
> > >
> org.jboss.resteasy.core.ExceptionHandler.handleApplicationException(ExceptionHandler.java:76)
> > > > [resteasy-jaxrs-3.0.8.Final.jar:]
> > > > at
> > > >
> > >
> org.jboss.resteasy.core.ExceptionHandler.handleException(ExceptionHandler.java:212)
> > > > [resteasy-jaxrs-3.0.8.Final.jar:]
> > > > at
> > > >
> > >
> org.jboss.resteasy.core.SynchronousDispatcher.writeException(SynchronousDispatcher.java:149)
> > > > [resteasy-jaxrs-3.0.8.Final.jar:]
> > > > at
> > > >
> > >
> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:372)
> > > > [resteasy-jaxrs-3.0.8.Final.jar:]
> > > > at
> > > >
> > >
> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:179)
> > > > [resteasy-jaxrs-3.0.8.Final.jar:]
> > > > at
> > > >
> > >
> org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:220)
> > > > [resteasy-jaxrs-3.0.8.Final.jar:]
> > > > at
> > > >
> > >
> org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56)
> > > > [resteasy-jaxrs-3.0.8.Final.jar:]
> > > > at
> > > >
> > >
> org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51)
> > > > [resteasy-jaxrs-3.0.8.Final.jar:]
> > > > at javax.servlet.http.HttpServlet.service(HttpServlet.java:790)
> > > > [jboss-servlet-api_3.1_spec-1.0.0.Final.jar:1.0.0.Final]
> > > > at
> > > >
> > >
> io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:85)
> > > > [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
> > > > at
> > > >
> > >
> io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:130)
> > > > [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
> > > > at
> > > >
> > >
> org.keycloak.services.filters.ClientConnectionFilter.doFilter(ClientConnectionFilter.java:41)
> > > > [keycloak-services-1.2.0.Beta1.jar:1.2.0.Beta1]
> > > > at
> io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:60)
> > > > [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
> > > > at
> > > >
> > >
> io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:132)
> > > > [undertow-servlet-1.0.15.Final.jar:1.0.15.Final]
> > > > at
> > > >
> > >
> org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:40)
> > > > [keycloak-services-1.2.0.Beta1.jar:1.2.0.Beta1]
> > > > ... 28 more
> > > > Caused by: java.lang.RuntimeException: java.lang.NullPointerException
> > > > at
> > > >
> > >
> org.keycloak.services.managers.ClientSessionCode.createHash(ClientSessionCode.java:171)
> > > > [keycloak-services-1.2.0.Beta1.jar:1.2.0.Beta1]
> > > > at
> > > >
> > >
> org.keycloak.services.managers.ClientSessionCode.generateCode(ClientSessionCode.java:151)
> > > > [keycloak-services-1.2.0.Beta1.jar:1.2.0.Beta1]
> > > > at
> > > >
> > >
> org.keycloak.services.managers.ClientSessionCode.getCode(ClientSessionCode.java:147)
> > > > [keycloak-services-1.2.0.Beta1.jar:1.2.0.Beta1]
> > > > at
> > > >
> > >
> org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint.buildAuthorizationCodeAuthorizationResponse(AuthorizationEndpoint.java:236)
> > > > [keycloak-services-1.2.0.Beta1.jar:1.2.0.Beta1]
> > > > at
> > > >
> > >
> org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint.build(AuthorizationEndpoint.java:100)
> > > > [keycloak-services-1.2.0.Beta1.jar:1.2.0.Beta1]
> > > > at sun.reflect.GeneratedMethodAccessor264.invoke(Unknown Source)
> > > [:1.8.0_31]
> > > > at
> > > >
> > >
> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
> > > > [rt.jar:1.8.0_31]
> > > > at java.lang.reflect.Method.invoke(Method.java:483) [rt.jar:1.8.0_31]
> > > > at
> > > >
> > >
> org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java:137)
> > > > [resteasy-jaxrs-3.0.8.Final.jar:]
> > > > at
> > > >
> > >
> org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTarget(ResourceMethodInvoker.java:296)
> > > > [resteasy-jaxrs-3.0.8.Final.jar:]
> > > > at
> > > >
> > >
> org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:250)
> > > > [resteasy-jaxrs-3.0.8.Final.jar:]
> > > > at
> > > >
> > >
> org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(ResourceLocatorInvoker.java:140)
> > > > [resteasy-jaxrs-3.0.8.Final.jar:]
> > > > at
> > > >
> > >
> org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:109)
> > > > [resteasy-jaxrs-3.0.8.Final.jar:]
> > > > at
> > > >
> > >
> org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(ResourceLocatorInvoker.java:135)
> > > > [resteasy-jaxrs-3.0.8.Final.jar:]
> > > > at
> > > >
> > >
> org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:103)
> > > > [resteasy-jaxrs-3.0.8.Final.jar:]
> > > > at
> > > >
> > >
> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:356)
> > > > [resteasy-jaxrs-3.0.8.Final.jar:]
> > > > ... 39 more
> > > > Caused by: java.lang.NullPointerException
> > > > at
> > > >
> > >
> org.keycloak.services.managers.ClientSessionCode.createHash(ClientSessionCode.java:164)
> > > > [keycloak-services-1.2.0.Beta1.jar:1.2.0.Beta1]
> > > >
> > > > On Sun, Apr 12, 2015 at 6:43 PM, Dean Peterson <
> peterson.dean at gmail.com
> > > >
> > > > wrote:
> > > >
> > > >
> > > >
> > > > I tried upgrading from 1.1.0-Alpha1 to 1.2.0.Beta1.jar. I get many
> errors
> > > > that look like this:
> > > >
> > > > [org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint] (default
> > > > task-122) Invoking deprecated endpoint
> > > >
> > >
> http://localhost:8080/auth/realms/abecorn/tokens/login?client_id=trade-client&redirect_uri=http%3A%2F%2Flocalhost%3A9001%2F%3Fredirect_fragment%3D%252F&state=150ce43d-1f7e-4462-8156-c3fbb5dcd92b&response_type=code
> > > > 18:35:32,990 ERROR [io.undertow.request] (default task-122) UT005023:
> > > > Exception handling request to /auth/realms/abecorn/tokens/login
> > > >
> > > > Also, I had to copy the themes folder from the dist appliance because
> > > the war
> > > > distributable is missing the themes folder.
> > > >
> > > >
> > > > _______________________________________________
> > > > keycloak-user mailing list
> > > > keycloak-user at lists.jboss.org
> > > > https://lists.jboss.org/mailman/listinfo/keycloak-user
> > >
> >
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150413/ad08eb55/attachment-0001.html 

From Maurice.Quaedackers at planonsoftware.com  Mon Apr 13 16:32:38 2015
From: Maurice.Quaedackers at planonsoftware.com (Maurice Quaedackers)
Date: Mon, 13 Apr 2015 22:32:38 +0200
Subject: [keycloak-user] Keycloak 1.2.0 Beta1 and CORS
Message-ID: <16DCFFB91025EF4DB80D3ECCA6E097E46DAA1E6E4B@NL-MAIL02.planon-fm.com>

Hello,

Has somebody experience with the new 1.2.0 Beta1 release in combination with CORS.

I have a very simple html page (for testing purposes) that I have made available via keycloak.

When I configure this page to use a Keycloak 1.1.0 Final as authentication front end all works like expected.

When I configure the same page with a Keycloak 1.2.0 Beta1 authentication front end (exact the same configuration) I am not able to access my test html file.

Suggestions are highly appreciated.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150413/d3b78ed2/attachment.html 

From carlosthe19916 at gmail.com  Mon Apr 13 18:38:46 2015
From: carlosthe19916 at gmail.com (Carlos Feria)
Date: Mon, 13 Apr 2015 17:38:46 -0500
Subject: [keycloak-user] nodejs adapter
Message-ID: <CAAdSQ6hW6UDRLFFuhSOY2rHs9K4pEZmd0nXJKPxmW3Hx_ehShA@mail.gmail.com>

Hello, i need to use keycloak in a nodejs server. I find that exists a
nodejs adapter in https://github.com/keycloak/keycloak-nodejs is that
repository oficial and has support? i see that nobody commits since january
and doesn`t have a tag version.

can i use https://github.com/keycloak/keycloak-nodejs for production?

-- 
Carlos E. Feria Vila
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150413/ac2abc0b/attachment.html 

From guydavis.ca at gmail.com  Mon Apr 13 19:09:49 2015
From: guydavis.ca at gmail.com (Guy Davis)
Date: Mon, 13 Apr 2015 17:09:49 -0600
Subject: [keycloak-user] Backwards compatibility with j_security_check?
Message-ID: <CAAgmn1oFCxkfe+r+2U5AT4isX1-Ace4pkX+O6tTiB-h1n37bSw@mail.gmail.com>

Good day,

I'm looking to move our product to Keycloak for
authentication/authorization.  Currently some of our apps/services are
protected with Java's form-based authentication.  In particular, certain
clients (Java and .Net) are making HTTP POSTs of username/password to a URI
such as:

   http://[SERVER]:8080/my_resource/j_security_check

They are then including all cookies in the POST response on all subsequent
HTTP requests.

I was wondering if there was way to mimic/redirect/support this behavior in
a Keycloak protected service without requiring changes in the various
client code accessing it as described above.  If it helps, I'll be enabling
Keycloak's basic auth support (over SSL) as well.

Any hints or possible solutions would be greatly appreciated.

Thanks,
Guy
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150413/72d0534a/attachment.html 

From carlosthe19916 at gmail.com  Mon Apr 13 19:16:40 2015
From: carlosthe19916 at gmail.com (Carlos Feria)
Date: Mon, 13 Apr 2015 18:16:40 -0500
Subject: [keycloak-user] Node.js adapter
Message-ID: <CAAdSQ6h0Qzq2Jusc-1YumiB_AhcunPvjxst19ia5jhZv+1w5vg@mail.gmail.com>

Hello, i need to use keycloak in a nodejs server. I find that exists a
nodejs adapter in https://github.com/keycloak/keycloak-nodejs is that
repository oficial and has support? i see that nobody commits since january
and doesn`t have a tag version.

can i use https://github.com/keycloak/keycloak-nodejs for production?

-- 
Carlos E. Feria Vila
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150413/75bac3b7/attachment.html 

From srossillo at smartling.com  Mon Apr 13 19:42:12 2015
From: srossillo at smartling.com (Scott Rossillo)
Date: Mon, 13 Apr 2015 19:42:12 -0400
Subject: [keycloak-user] Keycloak + Spring Security
Message-ID: <CALAqdu-W7u9V8wzyUzq19UGBHXuo1YgNZCBXQwa-XRV5=-3chQ@mail.gmail.com>

As mentioned in a previous post, we would provide information on how to
integrate the Keycloak Adapters with Spring Security.

Today, we went a step further and released an integration under the Apache
2.0 license at http://smartling.github.io/spring-security-keycloak/

This code enables Spring Security to integrate with the single sign-on and
single sign out features of Keycloak when running under Tomcat or Jetty.
Additionally, Keycloak roles are correctly represented as Spring Security
granted authorities.

Please let me know if this is something you?d like to see contributed to
Keycloak proper.

Regards,
Scott
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150413/bcc654a5/attachment.html 

From bburke at redhat.com  Mon Apr 13 20:12:06 2015
From: bburke at redhat.com (Bill Burke)
Date: Mon, 13 Apr 2015 20:12:06 -0400
Subject: [keycloak-user] Keycloak + Spring Security
In-Reply-To: <CALAqdu-W7u9V8wzyUzq19UGBHXuo1YgNZCBXQwa-XRV5=-3chQ@mail.gmail.com>
References: <CALAqdu-W7u9V8wzyUzq19UGBHXuo1YgNZCBXQwa-XRV5=-3chQ@mail.gmail.com>
Message-ID: <552C5B56.8060004@redhat.com>

Nice. Yeah, we would be interested in having it in Keycloak proper.

On 4/13/2015 7:42 PM, Scott Rossillo wrote:
>
> As mentioned in a previous post, we would provide information on how to
> integrate the Keycloak Adapters with Spring Security.
>
> Today, we went a step further and released an integration under the
> Apache 2.0 license at http://smartling.github.io/spring-security-keycloak/
>
> This code enables Spring Security to integrate with the single sign-on
> and single sign out features of Keycloak when running under Tomcat or
> Jetty.  Additionally, Keycloak roles are correctly represented as Spring
> Security granted authorities.
>
> Please let me know if this is something you?d like to see contributed to
> Keycloak proper.
>
> Regards,
> Scott
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

-- 
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com

From bburke at redhat.com  Mon Apr 13 20:14:51 2015
From: bburke at redhat.com (Bill Burke)
Date: Mon, 13 Apr 2015 20:14:51 -0400
Subject: [keycloak-user] Node.js adapter
In-Reply-To: <CAAdSQ6h0Qzq2Jusc-1YumiB_AhcunPvjxst19ia5jhZv+1w5vg@mail.gmail.com>
References: <CAAdSQ6h0Qzq2Jusc-1YumiB_AhcunPvjxst19ia5jhZv+1w5vg@mail.gmail.com>
Message-ID: <552C5BFB.9090902@redhat.com>

Yes you can use it.

On 4/13/2015 7:16 PM, Carlos Feria wrote:
> Hello, i need to use keycloak in a nodejs server. I find that exists a
> nodejs adapter in https://github.com/keycloak/keycloak-nodejs is that
> repository oficial and has support? i see that nobody commits since
> january and doesn`t have a tag version.
>
> can i use https://github.com/keycloak/keycloak-nodejs for production?
>
> --
> Carlos E. Feria Vila
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

-- 
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com

From prabhalar at yahoo.com  Mon Apr 13 22:23:58 2015
From: prabhalar at yahoo.com (Raghu Prabhala)
Date: Tue, 14 Apr 2015 02:23:58 +0000 (UTC)
Subject: [keycloak-user] Roles/permissions specific to Client application.
Message-ID: <148240104.2364670.1428978238085.JavaMail.yahoo@mail.yahoo.com>

 Hi Dev team,
The current KC model has very coarse grained roles that do not work for us, specifically in regards to the application management. Let me explain our use case.
We allow only?a set of users to register/update client applications subject to the below conditions ( a simplification of our actual use case):
1) Every client application has a set of owners and only the owners of the application can register/update an application in KC in addition to the point 2) below.2) Every application is part of a family that has a set of owners who can register/update any application within that family.
When a user logs into KC,?I can query our external repository to see if the user is in say "App1 owner" role ?or "App1 Family Owner" role?and if so, allow him to register the application (App1)?in KC. I should also be able to link that "App1 owner" role to the newly?registered application in KC so that when if another user belonging to "App1 owner" or "App1 Family Owner" role comes in, I should allow him to update App1 and not any other application, subject to conditions 1 and 2. 
How can we achieve the above functionality in KC? Appreciate some pointers and if there is something that can be done in KC then let me know and I will put in an enhancement request.
Thanks in advance,Raghu


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150414/3804b1ed/attachment-0001.html 

From bmcwhirt at redhat.com  Tue Apr 14 09:13:04 2015
From: bmcwhirt at redhat.com (Bob McWhirter)
Date: Tue, 14 Apr 2015 09:13:04 -0400
Subject: [keycloak-user] nodejs adapter
In-Reply-To: <CAAdSQ6hW6UDRLFFuhSOY2rHs9K4pEZmd0nXJKPxmW3Hx_ehShA@mail.gmail.com>
References: <CAAdSQ6hW6UDRLFFuhSOY2rHs9K4pEZmd0nXJKPxmW3Hx_ehShA@mail.gmail.com>
Message-ID: <85AABF33-B361-4119-96F0-052DEE5412C3@redhat.com>

Howdy?

My apologies for not tagging the repository when I did the NPM publish.  HEAD of the repo should align with the latest NPM though.

Please do give it a whirl, and if you have any issues, file them @ github or ping the list here and I?ll take a look.

It?s not officially ?supported? but I do aim to make it work well, so anything that doesn?t work, let me know!

	-Bob


> On Apr 13, 2015, at 6:38 PM, Carlos Feria <carlosthe19916 at gmail.com> wrote:
> 
> Hello, i need to use keycloak in a nodejs server. I find that exists a nodejs adapter in https://github.com/keycloak/keycloak-nodejs <https://github.com/keycloak/keycloak-nodejs> is that repository oficial and has support? i see that nobody commits since january and doesn`t have a tag version.
> 
> can i use https://github.com/keycloak/keycloak-nodejs <https://github.com/keycloak/keycloak-nodejs> for production?
> 
> -- 
> Carlos E. Feria Vila
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150414/bc16a727/attachment.html 

From Henk.Laracker at planonsoftware.com  Tue Apr 14 10:38:23 2015
From: Henk.Laracker at planonsoftware.com (Henk Laracker)
Date: Tue, 14 Apr 2015 16:38:23 +0200
Subject: [keycloak-user] How to test CORS functionality
Message-ID: <D152F2FF.1B530%henk.laracker@planonsoftware.com>

Hi,

I like to be sure if CORS works as expected, I switch back to version 1.1 of keycloak configured a realm (planon) and a application (ROOT). With a web origin ?www.example.com?
The keycloak application runs on the open shift cloud : https://keycloakmaster-ciwwa.rhcloud.com/auth/

What is the best way to test if CORS is working?  If found the web site http://test-cors.org filled in the follwong url

https://keycloakmaster-ciwwa.rhcloud.com/auth/realms/planon/protocol/openid-connect/auth?response_type=code&client_id=ROOT

But this does not give me the expected result, does this mean that I found a bug? I expected to see

CORS Response

Set-Cookie: cookie-from-server=noop
Content-Length: 0
Content-Type: application/json
Access-Control-Allow-Origin: www.example.com
Cache-Control: no-cache

Please Help,

Henk



-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150414/ed037673/attachment.html 

From guydavis.ca at gmail.com  Tue Apr 14 16:34:16 2015
From: guydavis.ca at gmail.com (Guy Davis)
Date: Tue, 14 Apr 2015 14:34:16 -0600
Subject: [keycloak-user] Keycloak + Spring Security
In-Reply-To: <552C5B56.8060004@redhat.com>
References: <CALAqdu-W7u9V8wzyUzq19UGBHXuo1YgNZCBXQwa-XRV5=-3chQ@mail.gmail.com>
	<552C5B56.8060004@redhat.com>
Message-ID: <CAAgmn1pO0hwzp3eMiF91tu8eN3JdMx6nZ8pqe+cGY9dEzyaPCg@mail.gmail.com>

Hi Scott,

I was just looking for a solution to adding an app with Spring Security to
our mix of Keycloak-protected apps and services.  You mention "under Tomcat
or Jetty".  Would this also work for a web app, such as Pentaho, deployed
inside a JBoss container?

Very timely.  Bill, this would be great to have in Keycloak 1.2 if not too
late.

Thanks much,
Guy

On Mon, Apr 13, 2015 at 6:12 PM, Bill Burke <bburke at redhat.com> wrote:

> Nice. Yeah, we would be interested in having it in Keycloak proper.
>
> On 4/13/2015 7:42 PM, Scott Rossillo wrote:
> >
> > As mentioned in a previous post, we would provide information on how to
> > integrate the Keycloak Adapters with Spring Security.
> >
> > Today, we went a step further and released an integration under the
> > Apache 2.0 license at
> http://smartling.github.io/spring-security-keycloak/
> >
> > This code enables Spring Security to integrate with the single sign-on
> > and single sign out features of Keycloak when running under Tomcat or
> > Jetty.  Additionally, Keycloak roles are correctly represented as Spring
> > Security granted authorities.
> >
> > Please let me know if this is something you?d like to see contributed to
> > Keycloak proper.
> >
> > Regards,
> > Scott
> >
> >
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
> >
>
> --
> Bill Burke
> JBoss, a division of Red Hat
> http://bill.burkecentral.com
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150414/9fdd198a/attachment.html 

From srossillo at smartling.com  Tue Apr 14 16:40:46 2015
From: srossillo at smartling.com (Scott Rossillo)
Date: Tue, 14 Apr 2015 16:40:46 -0400
Subject: [keycloak-user] Keycloak + Spring Security
In-Reply-To: <CAAgmn1pO0hwzp3eMiF91tu8eN3JdMx6nZ8pqe+cGY9dEzyaPCg@mail.gmail.com>
References: <CALAqdu-W7u9V8wzyUzq19UGBHXuo1YgNZCBXQwa-XRV5=-3chQ@mail.gmail.com>
	<552C5B56.8060004@redhat.com>
	<CAAgmn1pO0hwzp3eMiF91tu8eN3JdMx6nZ8pqe+cGY9dEzyaPCg@mail.gmail.com>
Message-ID: <CALAqdu9yat2YC-c6tfZkj4noB9qyngSQq9vjwdGJeJYRfQ-h+Q@mail.gmail.com>

Hi Guy,

I haven?t done any testing with JBoss, but I don?t see why not. As long as
the KeycloakSecurityContext is present in the web request, it will work.

Best,
Scott


On Tue, Apr 14, 2015 at 4:34 PM, Guy Davis <guydavis.ca at gmail.com> wrote:

> Hi Scott,
>
> I was just looking for a solution to adding an app with Spring Security to
> our mix of Keycloak-protected apps and services.  You mention "under Tomcat
> or Jetty".  Would this also work for a web app, such as Pentaho, deployed
> inside a JBoss container?
>
> Very timely.  Bill, this would be great to have in Keycloak 1.2 if not too
> late.
>
> Thanks much,
> Guy
>
> On Mon, Apr 13, 2015 at 6:12 PM, Bill Burke <bburke at redhat.com> wrote:
>
>> Nice. Yeah, we would be interested in having it in Keycloak proper.
>>
>> On 4/13/2015 7:42 PM, Scott Rossillo wrote:
>> >
>> > As mentioned in a previous post, we would provide information on how to
>> > integrate the Keycloak Adapters with Spring Security.
>> >
>> > Today, we went a step further and released an integration under the
>> > Apache 2.0 license at
>> http://smartling.github.io/spring-security-keycloak/
>> >
>> > This code enables Spring Security to integrate with the single sign-on
>> > and single sign out features of Keycloak when running under Tomcat or
>> > Jetty.  Additionally, Keycloak roles are correctly represented as Spring
>> > Security granted authorities.
>> >
>> > Please let me know if this is something you?d like to see contributed to
>> > Keycloak proper.
>> >
>> > Regards,
>> > Scott
>> >
>> >
>> > _______________________________________________
>> > keycloak-user mailing list
>> > keycloak-user at lists.jboss.org
>> > https://lists.jboss.org/mailman/listinfo/keycloak-user
>> >
>>
>> --
>> Bill Burke
>> JBoss, a division of Red Hat
>> http://bill.burkecentral.com
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150414/91d08ffb/attachment.html 

From fiorenzo.pizza at ict-group.it  Tue Apr 14 16:54:51 2015
From: fiorenzo.pizza at ict-group.it (fiorenzo.pizza at ict-group.it)
Date: Tue, 14 Apr 2015 22:54:51 +0200
Subject: [keycloak-user] ldap import error with edirectory novell
Message-ID: <552D7E9B.8060101@ict-group.it>

Hi,

keycloak newbie here..

We would like to use keycloak with our Novell eDirectory LDAP , but we 
have problems in the procedures for importing user .
*Novell eDirectory uses GUID and not entryUUID.*

The users created in the keycloak's USER_ENTITY table from LDAP import 
procedure have all attributes valorized, but in the USER_ATTRIBUTE 
table, we missed the LDAP_ID:
NAME = LDAP_ID, VALUE = (null), USER_ID = xxxxxxxx

In picketlink code, *i found that LDAP_ID is entryUUID for non Active 
Directory.*
https://github.com/picketlink/picketlink/blob/b500ad3d2753a354c29716cd66695ddc3793d07a/modules/idm/impl/src/main/java/org/picketlink/idm/ldap/internal/LDAPOperationManager.java

When you try to find someone in the users list, we receive a Null 
Pointer ecception
Caused by : java.lang.NullPointerException
to org.keycloak.federation.ldap.LDAPFederationProvider.isValid ( 
LDAPFederationProvider.java:219 ) [ keycloak - ldap -federation - 
1.2.0.Beta1.jar : 1.2.0.Beta1 ]


*My question is: can we customize the attribute LDAP_ID attribute in 
keycloak?*

thanks in advance

Fiorenzo Pizza
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150414/35f9862b/attachment-0001.html 

From fiorenzo.pizza at ict-group.it  Tue Apr 14 18:30:27 2015
From: fiorenzo.pizza at ict-group.it (fiorenzo.pizza at ict-group.it)
Date: Wed, 15 Apr 2015 00:30:27 +0200
Subject: [keycloak-user] ldap novell eDirectory patch
Message-ID: <552D9503.9090407@ict-group.it>

Hi,

to support Novell eDirectory GUID, you can modify some lines of codes..

*1) [project keycloak-model-api] -> class: 
org.keycloak.models.LDAPConstants*

- adding a new vendor constant (   public static final String 
*VENDOR_NOVELL_EDIRECTORY="edirectory"*;)

*2) [project keycloak-picketlink-ldap]**->**class: 
**org.keycloak.picketlink.ldap.PartitionManagerRegistry*

// RHDS is using "nsuniqueid" as unique identifier instead of "entryUUID"
// Novell eDirectory use "guid"
         if (vendor != null && vendor.equals(LDAPConstants.VENDOR_RHDS)) {
ldapStoreBuilder.uniqueIdentifierAttributeName("nsuniqueid");
         } else if (LDAPConstants.VENDOR_TIVOLI.equals(vendor)) {
ldapStoreBuilder.uniqueIdentifierAttributeName("uniqueidentifier");
         }*else if 
(LDAPConstants.VENDOR_NOVELL_EDIRECTORY.equals(vendor)) {**
**ldapStoreBuilder.uniqueIdentifierAttributeName("guid");**
**        }*

*3) [project keycloak-forms-common-themes] -> file: users.js*

  $scope.ldapVendors = [
         { "id": "ad", "name": "Active Directory" },
         { "id": "rhds", "name": "Red Hat Directory Server" },
         { "id": "tivoli", "name": "Tivoli" },
*        { "id": "edirectory", "name": "eDirectory " },*
         { "id": "other", "name": "Other" }
     ];


What do you think about? I need more time to test my patch.. the 
keycloak project not compiles in my workspace...

Best Regards

Fiorenzo Pizza
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150415/031395b5/attachment.html 

From mposolda at redhat.com  Wed Apr 15 02:28:04 2015
From: mposolda at redhat.com (Marek Posolda)
Date: Wed, 15 Apr 2015 08:28:04 +0200
Subject: [keycloak-user] ldap novell eDirectory patch
In-Reply-To: <552D9503.9090407@ict-group.it>
References: <552D9503.9090407@ict-group.it>
Message-ID: <552E04F4.3010908@redhat.com>

Thanks for pointing this. We did not test with Novell eDirectory, so 
it's possible that it didn't work. If you have opportunity to try with 
latest Keycloak master, fix it in master and then send the PR, it will 
be very cool! Note that there was some refactoring in latest master and 
some code you pointed is not valid anymore (PartitionManagerRegistry was 
refactored and renamed to LDAPIdentityStoreRegistry).

Otherwise I can try to apply it myself and ping you, so you can give it 
a try with novell edirectory (or wait for the next released keycloak 
version).

What do you think?
Marek

On 15.4.2015 00:30, fiorenzo.pizza at ict-group.it wrote:
> Hi,
>
> to support Novell eDirectory GUID, you can modify some lines of codes..
>
> *1) [project keycloak-model-api] -> class: 
> org.keycloak.models.LDAPConstants*
>
> - adding a new vendor constant (   public static final String 
> *VENDOR_NOVELL_EDIRECTORY="edirectory"*;)
>
> *2) [project keycloak-picketlink-ldap]**->**class: 
> **org.keycloak.picketlink.ldap.PartitionManagerRegistry*
>
> // RHDS is using "nsuniqueid" as unique identifier instead of "entryUUID"
> // Novell eDirectory use "guid"
>         if (vendor != null && vendor.equals(LDAPConstants.VENDOR_RHDS)) {
> ldapStoreBuilder.uniqueIdentifierAttributeName("nsuniqueid");
>         } else if (LDAPConstants.VENDOR_TIVOLI.equals(vendor)) {
> ldapStoreBuilder.uniqueIdentifierAttributeName("uniqueidentifier");
>         }*else if 
> (LDAPConstants.VENDOR_NOVELL_EDIRECTORY.equals(vendor)) {**
> **ldapStoreBuilder.uniqueIdentifierAttributeName("guid");**
> **        }*
>
> *3) [project keycloak-forms-common-themes] -> file: users.js*
>
>  $scope.ldapVendors = [
>         { "id": "ad", "name": "Active Directory" },
>         { "id": "rhds", "name": "Red Hat Directory Server" },
>         { "id": "tivoli", "name": "Tivoli" },
> *        { "id": "edirectory", "name": "eDirectory " },*
>         { "id": "other", "name": "Other" }
>     ];
>
>
> What do you think about? I need more time to test my patch.. the 
> keycloak project not compiles in my workspace...
>
> Best Regards
>
> Fiorenzo Pizza
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150415/ab9ddbbe/attachment.html 

From fiorenzo.pizza at ict-group.it  Wed Apr 15 03:08:19 2015
From: fiorenzo.pizza at ict-group.it (fiorenzo.pizza at ict-group.it)
Date: Wed, 15 Apr 2015 09:08:19 +0200
Subject: [keycloak-user] ldap novell eDirectory patch
In-Reply-To: <552E04F4.3010908@redhat.com>
References: <552D9503.9090407@ict-group.it> <552E04F4.3010908@redhat.com>
Message-ID: <552E0E63.7090700@ict-group.it>

Hi Marek,

i will fix in the master and then i will send a PR.

I would like also add italian translation of messages
(in forms-common-themes -> messages_it.properties).


Fiorenzo

Il 15/04/15 08:28, Marek Posolda ha scritto:
> Thanks for pointing this. We did not test with Novell eDirectory, so 
> it's possible that it didn't work. If you have opportunity to try with 
> latest Keycloak master, fix it in master and then send the PR, it will 
> be very cool! Note that there was some refactoring in latest master 
> and some code you pointed is not valid anymore 
> (PartitionManagerRegistry was refactored and renamed to 
> LDAPIdentityStoreRegistry).
>
> Otherwise I can try to apply it myself and ping you, so you can give 
> it a try with novell edirectory (or wait for the next released 
> keycloak version).
>
> What do you think?
> Marek
>
> On 15.4.2015 00:30, fiorenzo.pizza at ict-group.it wrote:
>> Hi,
>>
>> to support Novell eDirectory GUID, you can modify some lines of codes..
>>
>> *1) [project keycloak-model-api] -> class: 
>> org.keycloak.models.LDAPConstants*
>>
>> - adding a new vendor constant (   public static final String 
>> *VENDOR_NOVELL_EDIRECTORY="edirectory"*;)
>>
>> *2) [project keycloak-picketlink-ldap]**->**class: 
>> **org.keycloak.picketlink.ldap.PartitionManagerRegistry*
>>
>> // RHDS is using "nsuniqueid" as unique identifier instead of "entryUUID"
>> // Novell eDirectory use "guid"
>>         if (vendor != null && vendor.equals(LDAPConstants.VENDOR_RHDS)) {
>> ldapStoreBuilder.uniqueIdentifierAttributeName("nsuniqueid");
>>         } else if (LDAPConstants.VENDOR_TIVOLI.equals(vendor)) {
>> ldapStoreBuilder.uniqueIdentifierAttributeName("uniqueidentifier");
>>         }*else if 
>> (LDAPConstants.VENDOR_NOVELL_EDIRECTORY.equals(vendor)) {**
>> **ldapStoreBuilder.uniqueIdentifierAttributeName("guid");**
>> **        }*
>>
>> *3) [project keycloak-forms-common-themes] -> file: users.js*
>>
>>  $scope.ldapVendors = [
>>         { "id": "ad", "name": "Active Directory" },
>>         { "id": "rhds", "name": "Red Hat Directory Server" },
>>         { "id": "tivoli", "name": "Tivoli" },
>> *        { "id": "edirectory", "name": "eDirectory " },*
>>         { "id": "other", "name": "Other" }
>>     ];
>>
>>
>> What do you think about? I need more time to test my patch.. the 
>> keycloak project not compiles in my workspace...
>>
>> Best Regards
>>
>> Fiorenzo Pizza
>>
>>
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150415/b255ac90/attachment.html 

From jayblanc at gmail.com  Wed Apr 15 06:08:55 2015
From: jayblanc at gmail.com (=?UTF-8?B?SsOpcsO0bWUgQmxhbmNoYXJk?=)
Date: Wed, 15 Apr 2015 10:08:55 +0000
Subject: [keycloak-user] Which adapter must I use ?
Message-ID: <CAPNq5vaNoTf-Rg6FrtJLFDAjPVUO1mTrObgaP=B-J3Gp7e=-dg@mail.gmail.com>

Hi all,
I'm facing a problem regarding which adapter to use in my case :
I have an application which runs on wildfly.
It is packaged as an ear containing an EJB backend (jar) and a web
application (war) that expose a REST API and a simple content browsing
servlet.
Both of the rest api and the content servlet allows anonymous access and
authentified access. The EJB layer takes in charge the access control usign
internal rules system.
The authentication on the REST API using bearer token works fine as it is a
javascript client that use it and the javascript adapter works fine.
What I want to do is to allow authentication on the content servlet in the
following way :
1. A user ask some content using the content servlet /content/file.txt
2. Because anonymous and the file.txt is protect, EJB layer return an
AccessDeniedException which is handled by the servlet to redirect the user
browser to an specific jsp page saying that content is protected and giving
a link to the keycloak server for eventual authentication.
3. The user follow this link to perform authentication and is redirected
back to the content url /content/file1.txt
4. I don't know how but the browser should be able to include something (a
cookie) that would holds the authentication token and allow the content
servlet to act as authentified.
Because my current adapter just check a bearer token header I don't see
which adapter to add, or how to handle authentication in another way
allowing the client navigator to propagate authentication token ??
Thanks in advance for your support and congratulation for this very nice
product that is keycloak.
Best regards, J?r?me.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150415/ca27d779/attachment.html 

From stian at redhat.com  Wed Apr 15 07:39:16 2015
From: stian at redhat.com (Stian Thorgersen)
Date: Wed, 15 Apr 2015 07:39:16 -0400 (EDT)
Subject: [keycloak-user] How to test CORS functionality
In-Reply-To: <D152F2FF.1B530%henk.laracker@planonsoftware.com>
References: <D152F2FF.1B530%henk.laracker@planonsoftware.com>
Message-ID: <606981872.62585.1429097956713.JavaMail.zimbra@redhat.com>

Keycloak has two types of CORS features:

* CORS support for Keycloak endpoints
* CORS support in adapters to implement CORS support for application

Which one are you trying to test?

In either case openid-connect/auth does not support CORS, while openid-connect/token does.

----- Original Message -----
> From: "Henk Laracker" <Henk.Laracker at planonsoftware.com>
> To: keycloak-user at lists.jboss.org
> Sent: Tuesday, April 14, 2015 4:38:23 PM
> Subject: [keycloak-user] How to test CORS functionality
> 
> Hi,
> 
> I like to be sure if CORS works as expected, I switch back to version 1.1 of
> keycloak configured a realm (planon) and a application (ROOT). With a web
> origin ?www.example.com?
> The keycloak application runs on the open shift cloud :
> https://keycloakmaster-ciwwa.rhcloud.com/auth /
> 
> What is the best way to test if CORS is working? If found the web site
> http://test-cors.org filled in the follwong url
> 
> https://keycloakmaster-ciwwa.rhcloud.com/auth/realms/planon/protocol/openid-connect/auth?response_type=code&client_id=ROOT
> 
> But this does not give me the expected result, does this mean that I found a
> bug? I expected to see
> 
> CORS Response
> Set-Cookie: cookie-from-server=noop
> Content-Length: 0
> Content-Type: application/json
> Access-Control-Allow-Origin: www.example.com
> Cache-Control: no-cache
> Please Help,
> 
> Henk
> 
> 
> 
> 
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user


From stian at redhat.com  Wed Apr 15 08:01:51 2015
From: stian at redhat.com (Stian Thorgersen)
Date: Wed, 15 Apr 2015 08:01:51 -0400 (EDT)
Subject: [keycloak-user] ldap novell eDirectory patch
In-Reply-To: <552E0E63.7090700@ict-group.it>
References: <552D9503.9090407@ict-group.it> <552E04F4.3010908@redhat.com>
	<552E0E63.7090700@ict-group.it>
Message-ID: <196254751.81992.1429099311709.JavaMail.zimbra@redhat.com>



----- Original Message -----
> From: "fiorenzo pizza" <fiorenzo.pizza at ict-group.it>
> To: "Marek Posolda" <mposolda at redhat.com>, keycloak-user at lists.jboss.org
> Sent: Wednesday, April 15, 2015 9:08:19 AM
> Subject: Re: [keycloak-user] ldap novell eDirectory patch
> 
> Hi Marek,
> 
> i will fix in the master and then i will send a PR.
> 
> I would like also add italian translation of messages
> (in forms-common-themes -> messages_it.properties).

We'd love to get a PR for Italian. However, for each language we add we need someone to volunteer to maintain it.

Would you be willing to track changes to messages_en.properties and apply to messages_it.properties?

> 
> 
> Fiorenzo
> 
> Il 15/04/15 08:28, Marek Posolda ha scritto:
> 
> 
> 
> Thanks for pointing this. We did not test with Novell eDirectory, so it's
> possible that it didn't work. If you have opportunity to try with latest
> Keycloak master, fix it in master and then send the PR, it will be very
> cool! Note that there was some refactoring in latest master and some code
> you pointed is not valid anymore (PartitionManagerRegistry was refactored
> and renamed to LDAPIdentityStoreRegistry).
> 
> 
> 
> 
> Otherwise I can try to apply it myself and ping you, so you can give it a try
> with novell edirectory (or wait for the next released keycloak version).
> 
> What do you think?
> Marek
> 
> On 15.4.2015 00:30, fiorenzo.pizza at ict-group.it wrote:
> 
> 
> Hi,
> 
> to support Novell eDirectory GUID, you can modify some lines of codes..
> 
> 1) [project keycloak-model-api] -> class: org.keycloak.models.LDAPConstants
> 
> - adding a new vendor constant ( public static final String
> VENDOR_NOVELL_EDIRECTORY="edirectory" ;)
> 
> 2) [project keycloak-picketlink-ldap] -> class:
> org.keycloak.picketlink.ldap.PartitionManagerRegistry
> 
> // RHDS is using "nsuniqueid" as unique identifier instead of "entryUUID"
> // Novell eDirectory use "guid"
> if (vendor != null && vendor.equals(LDAPConstants.VENDOR_RHDS)) {
> ldapStoreBuilder.uniqueIdentifierAttributeName("nsuniqueid");
> } else if (LDAPConstants.VENDOR_TIVOLI.equals(vendor)) {
> ldapStoreBuilder.uniqueIdentifierAttributeName("uniqueidentifier");
> } else if (LDAPConstants.VENDOR_NOVELL_EDIRECTORY.equals(vendor)) {
> ldapStoreBuilder.uniqueIdentifierAttributeName("guid");
> }
> 
> 3) [project keycloak-forms-common-themes] -> file: users.js
> 
> $scope.ldapVendors = [
> { "id": "ad", "name": "Active Directory" },
> { "id": "rhds", "name": "Red Hat Directory Server" },
> { "id": "tivoli", "name": "Tivoli" },
> { "id": "edirectory", "name": "eDirectory " },
> { "id": "other", "name": "Other" }
> ];
> 
> 
> What do you think about? I need more time to test my patch.. the keycloak
> project not compiles in my workspace...
> 
> Best Regards
> 
> Fiorenzo Pizza
> 
> 
> _______________________________________________
> keycloak-user mailing list keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
> 
> 
> 
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From stian at redhat.com  Wed Apr 15 08:16:42 2015
From: stian at redhat.com (Stian Thorgersen)
Date: Wed, 15 Apr 2015 08:16:42 -0400 (EDT)
Subject: [keycloak-user] Roles/permissions specific to Client
 application.
In-Reply-To: <148240104.2364670.1428978238085.JavaMail.yahoo@mail.yahoo.com>
References: <148240104.2364670.1428978238085.JavaMail.yahoo@mail.yahoo.com>
Message-ID: <850638182.90379.1429100202392.JavaMail.zimbra@redhat.com>

Supporting something like that would require a revamp of how we manage permissions for Keycloak admin console and endpoints.

If we can come up with a good way to do it properly I don't see any reason not to support this level of permissions. However, I wouldn't want to just duct tape it onto what we already have.

Currently we create "fictitious" applications to manage permissions for realms. I don't really like this approach and it would not work for applications (as you'd have two applications per-application).


----- Original Message -----
> From: "Raghu Prabhala" <prabhalar at yahoo.com>
> To: "Keycloak-user" <keycloak-user at lists.jboss.org>
> Sent: Tuesday, April 14, 2015 4:23:58 AM
> Subject: [keycloak-user] Roles/permissions specific to Client application.
> 
> Hi Dev team,
> 
> The current KC model has very coarse grained roles that do not work for us,
> specifically in regards to the application management. Let me explain our
> use case.
> 
> We allow only a set of users to register/update client applications subject
> to the below conditions ( a simplification of our actual use case):
> 
> 1) Every client application has a set of owners and only the owners of the
> application can register/update an application in KC in addition to the
> point 2) below.
> 2) Every application is part of a family that has a set of owners who can
> register/update any application within that family.
> 
> When a user logs into KC, I can query our external repository to see if the
> user is in say "App1 owner" role or "App1 Family Owner" role and if so,
> allow him to register the application (App1) in KC. I should also be able to
> link that "App1 owner" role to the newly registered application in KC so
> that when if another user belonging to "App1 owner" or "App1 Family Owner"
> role comes in, I should allow him to update App1 and not any other
> application, subject to conditions 1 and 2.
> 
> How can we achieve the above functionality in KC? Appreciate some pointers
> and if there is something that can be done in KC then let me know and I will
> put in an enhancement request.
> 
> Thanks in advance,
> Raghu
> 
> 
> 
> 
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From msakho at redhat.com  Wed Apr 15 09:27:56 2015
From: msakho at redhat.com (Meissa M'baye Sakho)
Date: Wed, 15 Apr 2015 09:27:56 -0400 (EDT)
Subject: [keycloak-user] Which adapter must I use ?
In-Reply-To: <CAPNq5vaNoTf-Rg6FrtJLFDAjPVUO1mTrObgaP=B-J3Gp7e=-dg@mail.gmail.com>
References: <CAPNq5vaNoTf-Rg6FrtJLFDAjPVUO1mTrObgaP=B-J3Gp7e=-dg@mail.gmail.com>
Message-ID: <2119770918.283507.1429104476242.JavaMail.zimbra@redhat.com>

Hi Jer?me, 
Since your application runs on Wildfy, you'll have to use the Keycloak-wildfly adapter. 
Meissa 

----- Mail original -----

De: "J?r?me Blanchard" <jayblanc at gmail.com> 
?: keycloak-user at lists.jboss.org 
Envoy?: Mercredi 15 Avril 2015 12:08:55 
Objet: [keycloak-user] Which adapter must I use ? 

Hi all, 
I'm facing a problem regarding which adapter to use in my case : 
I have an application which runs on wildfly. 
It is packaged as an ear containing an EJB backend (jar) and a web application (war) that expose a REST API and a simple content browsing servlet. 
Both of the rest api and the content servlet allows anonymous access and authentified access. The EJB layer takes in charge the access control usign internal rules system. 
The authentication on the REST API using bearer token works fine as it is a javascript client that use it and the javascript adapter works fine. 
What I want to do is to allow authentication on the content servlet in the following way : 
1. A user ask some content using the content servlet /content/file.txt 
2. Because anonymous and the file.txt is protect, EJB layer return an AccessDeniedException which is handled by the servlet to redirect the user browser to an specific jsp page saying that content is protected and giving a link to the keycloak server for eventual authentication. 
3. The user follow this link to perform authentication and is redirected back to the content url /content/file1.txt 
4. I don't know how but the browser should be able to include something (a cookie) that would holds the authentication token and allow the content servlet to act as authentified. 
Because my current adapter just check a bearer token header I don't see which adapter to add, or how to handle authentication in another way allowing the client navigator to propagate authentication token ?? 
Thanks in advance for your support and congratulation for this very nice product that is keycloak. 
Best regards, J?r?me. 

_______________________________________________ 
keycloak-user mailing list 
keycloak-user at lists.jboss.org 
https://lists.jboss.org/mailman/listinfo/keycloak-user 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150415/c21c24dc/attachment.html 

From jayblanc at gmail.com  Wed Apr 15 09:32:07 2015
From: jayblanc at gmail.com (=?UTF-8?B?SsOpcsO0bWUgQmxhbmNoYXJk?=)
Date: Wed, 15 Apr 2015 13:32:07 +0000
Subject: [keycloak-user] Which adapter must I use ?
In-Reply-To: <2119770918.283507.1429104476242.JavaMail.zimbra@redhat.com>
References: <CAPNq5vaNoTf-Rg6FrtJLFDAjPVUO1mTrObgaP=B-J3Gp7e=-dg@mail.gmail.com>
	<2119770918.283507.1429104476242.JavaMail.zimbra@redhat.com>
Message-ID: <CAPNq5vZy6KF6_ZsbQa+0Em28fbiEPNMaEEY3AmF-wf_vnzxgZg@mail.gmail.com>

Hi Meissa,
thanks for your answer I'm already using the keycloak wildfly adapter. WHat
I don't manage to do is to use it with a classic browser client. Is there
is a way to ask for a token stored in the client's browser cookie and to
the server application look for this token in a cookie instead of in the
authentication header ?
Jerome

Le mer. 15 avr. 2015 ? 14:27, Meissa M'baye Sakho <msakho at redhat.com> a
?crit :

> Hi Jer?me,
> Since your application runs on Wildfy, you'll have to use the
> Keycloak-wildfly adapter.
> Meissa
>
> ------------------------------
> *De: *"J?r?me Blanchard" <jayblanc at gmail.com>
> *?: *keycloak-user at lists.jboss.org
> *Envoy?: *Mercredi 15 Avril 2015 12:08:55
> *Objet: *[keycloak-user] Which adapter must I use ?
>
>
> Hi all,
> I'm facing a problem regarding which adapter to use in my case :
> I have an application which runs on wildfly.
> It is packaged as an ear containing an EJB backend (jar) and a web
> application (war) that expose a REST API and a simple content browsing
> servlet.
> Both of the rest api and the content servlet allows anonymous access and
> authentified access. The EJB layer takes in charge the access control usign
> internal rules system.
> The authentication on the REST API using bearer token works fine as it is
> a javascript client that use it and the javascript adapter works fine.
> What I want to do is to allow authentication on the content servlet in the
> following way :
> 1. A user ask some content using the content servlet /content/file.txt
> 2. Because anonymous and the file.txt is protect, EJB layer return an
> AccessDeniedException which is handled by the servlet to redirect the user
> browser to an specific jsp page saying that content is protected and giving
> a link to the keycloak server for eventual authentication.
> 3. The user follow this link to perform authentication and is redirected
> back to the content url /content/file1.txt
> 4. I don't know how but the browser should be able to include something (a
> cookie) that would holds the authentication token and allow the content
> servlet to act as authentified.
> Because my current adapter just check a bearer token header I don't see
> which adapter to add, or how to handle authentication in another way
> allowing the client navigator to propagate authentication token ??
> Thanks in advance for your support and congratulation for this very nice
> product that is keycloak.
> Best regards, J?r?me.
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150415/aa69773a/attachment.html 

From srossillo at smartling.com  Wed Apr 15 11:41:00 2015
From: srossillo at smartling.com (Scott Rossillo)
Date: Wed, 15 Apr 2015 11:41:00 -0400
Subject: [keycloak-user] Application to applications using bearer token
Message-ID: <CALAqdu-bre025M8cfcHypuLMG+fMP5D5zjitFWt0zupyfmx3wg@mail.gmail.com>

In the demos, there?s a clear example of how a user is authenticated
against an application, say the customer-portal, and then the
customer-portal requests information from the database-service using the
access token as a bearer token.

In this example, the database-service accepts the bearer token and returns
data.

However, using the Keycloak Adapters and attempting to do the same thing,
the authentication is rejected. Any idea what may be causing this?

Thanks,
Scott
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150415/8341e9de/attachment.html 

From srossillo at smartling.com  Wed Apr 15 11:44:37 2015
From: srossillo at smartling.com (Scott Rossillo)
Date: Wed, 15 Apr 2015 11:44:37 -0400
Subject: [keycloak-user] Application to applications using bearer token
In-Reply-To: <CALAqdu-bre025M8cfcHypuLMG+fMP5D5zjitFWt0zupyfmx3wg@mail.gmail.com>
References: <CALAqdu-bre025M8cfcHypuLMG+fMP5D5zjitFWt0zupyfmx3wg@mail.gmail.com>
Message-ID: <CALAqdu_oj-Cuw7SRsPS+rru_Oiw1++9kyftfcVCSV8UyosO6Mw@mail.gmail.com>

Actually, I wanted to clarify one thing:

In the demos the database-service is set up as bearer-only. Maybe that?s
the problem I?m having. I have the dependent service set as confidential.
But shouldn?t this be supported?

What if the service provides both user facing features and APIs that can be
accessed with bearer tokens?

Thanks again,
Scott

On Wed, Apr 15, 2015 at 11:41 AM, Scott Rossillo <srossillo at smartling.com>
wrote:

> In the demos, there?s a clear example of how a user is authenticated
> against an application, say the customer-portal, and then the
> customer-portal requests information from the database-service using the
> access token as a bearer token.
>
> In this example, the database-service accepts the bearer token and returns
> data.
>
> However, using the Keycloak Adapters and attempting to do the same thing,
> the authentication is rejected. Any idea what may be causing this?
>
> Thanks,
> Scott
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150415/90fc7317/attachment-0001.html 

From akurdyukov at gmail.com  Wed Apr 15 12:24:25 2015
From: akurdyukov at gmail.com (Alik Kurdyukov)
Date: Wed, 15 Apr 2015 19:24:25 +0300
Subject: [keycloak-user] User details storage
Message-ID: <etPan.552e90b9.b03e0c6.14d@AlikMacBookPro.local>

Hello!

First of all, thank you for implementing Keycloak, I made it work with Spring Security in a very short time.

I have architectural question: I need to store lots of additional field values for every user in the system. I see two ways:
1. extend existing Keycloak storage and add fields there
2. store additional info in the LDAP server and retrieve additional params by separate LDAP queries
What is the best way to store it?

--?
Best regards,
Alik Kurdyukov
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150415/0c2ab224/attachment.html 

From mposolda at redhat.com  Wed Apr 15 12:29:31 2015
From: mposolda at redhat.com (Marek Posolda)
Date: Wed, 15 Apr 2015 18:29:31 +0200
Subject: [keycloak-user] Application to applications using bearer token
In-Reply-To: <CALAqdu_oj-Cuw7SRsPS+rru_Oiw1++9kyftfcVCSV8UyosO6Mw@mail.gmail.com>
References: <CALAqdu-bre025M8cfcHypuLMG+fMP5D5zjitFWt0zupyfmx3wg@mail.gmail.com>
	<CALAqdu_oj-Cuw7SRsPS+rru_Oiw1++9kyftfcVCSV8UyosO6Mw@mail.gmail.com>
Message-ID: <552E91EB.8050101@redhat.com>

That's quite strange. It should already be possible to authenticate 
against confidential applications with bearer-token. For example if you 
switch demo database-service as "confidential" instead of "bearer-only", 
it should be still possible to authenticate to it with the bearer access 
token sent from customer-portal. You can try it and see if it works.

If demo works for you, but your applications don't, it's probably some 
configuration problem on your side.

Marek

On 15.4.2015 17:44, Scott Rossillo wrote:
> Actually, I wanted to clarify one thing:
>
> In the demos the database-service is set up as bearer-only. Maybe 
> that?s the problem I?m having. I have the dependent service set as 
> confidential. But shouldn?t this be supported?
>
> What if the service provides both user facing features and APIs that 
> can be accessed with bearer tokens?
>
> Thanks again,
> Scott
>
> On Wed, Apr 15, 2015 at 11:41 AM, Scott Rossillo 
> <srossillo at smartling.com <mailto:srossillo at smartling.com>> wrote:
>
>     In the demos, there?s a clear example of how a user is
>     authenticated against an application, say the customer-portal, and
>     then the customer-portal requests information from the
>     database-service using the access token as a bearer token.
>
>     In this example, the database-service accepts the bearer token and
>     returns data.
>
>     However, using the Keycloak Adapters and attempting to do the same
>     thing, the authentication is rejected. Any idea what may be
>     causing this?
>
>     Thanks,
>     Scott
>
>
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150415/c5e52659/attachment.html 

From srossillo at smartling.com  Wed Apr 15 12:34:52 2015
From: srossillo at smartling.com (Scott Rossillo)
Date: Wed, 15 Apr 2015 12:34:52 -0400
Subject: [keycloak-user] Application to applications using bearer token
In-Reply-To: <552E91EB.8050101@redhat.com>
References: <CALAqdu-bre025M8cfcHypuLMG+fMP5D5zjitFWt0zupyfmx3wg@mail.gmail.com>
	<CALAqdu_oj-Cuw7SRsPS+rru_Oiw1++9kyftfcVCSV8UyosO6Mw@mail.gmail.com>
	<552E91EB.8050101@redhat.com>
Message-ID: <CALAqdu-aLMm_AECpUfj=P_PdTvMn+NsedF92E8J=5ABFHzu_YQ@mail.gmail.com>

Thanks Marek,

I will try again. I did get it working by setting the service to
?bearer-only? but there was one bug with the keycloak.json generated by
Keycloak 1.2.0.Beta1. It?s missing the "auth-server-url?.

I get:
12:32:58.269 [http-nio-2080-exec-1] ERROR
o.k.a.BearerTokenRequestAuthenticator - Failed to verify token
org.keycloak.VerificationException: Realm URL is null. Make sure to add
auth-server-url to the configuration of your adapter!

After adding "auth-server-url? to the keycloak.json file, it works.

I?ll set app back to confidential and I will keep testing.

Thanks,
Scott




On Wed, Apr 15, 2015 at 12:29 PM, Marek Posolda <mposolda at redhat.com> wrote:

>  That's quite strange. It should already be possible to authenticate
> against confidential applications with bearer-token. For example if you
> switch demo database-service as "confidential" instead of "bearer-only", it
> should be still possible to authenticate to it with the bearer access token
> sent from customer-portal. You can try it and see if it works.
>
> If demo works for you, but your applications don't, it's probably some
> configuration problem on your side.
>
> Marek
>
>
> On 15.4.2015 17:44, Scott Rossillo wrote:
>
> Actually, I wanted to clarify one thing:
>
>  In the demos the database-service is set up as bearer-only. Maybe that?s
> the problem I?m having. I have the dependent service set as confidential.
> But shouldn?t this be supported?
>
>  What if the service provides both user facing features and APIs that can
> be accessed with bearer tokens?
>
>  Thanks again,
> Scott
>
> On Wed, Apr 15, 2015 at 11:41 AM, Scott Rossillo <srossillo at smartling.com>
> wrote:
>
>> In the demos, there?s a clear example of how a user is authenticated
>> against an application, say the customer-portal, and then the
>> customer-portal requests information from the database-service using the
>> access token as a bearer token.
>>
>>  In this example, the database-service accepts the bearer token and
>> returns data.
>>
>>  However, using the Keycloak Adapters and attempting to do the same
>> thing, the authentication is rejected. Any idea what may be causing this?
>>
>>  Thanks,
>> Scott
>>
>
>
>
> _______________________________________________
> keycloak-user mailing listkeycloak-user at lists.jboss.orghttps://lists.jboss.org/mailman/listinfo/keycloak-user
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150415/ea4fe047/attachment.html 

From mposolda at redhat.com  Wed Apr 15 12:35:47 2015
From: mposolda at redhat.com (Marek Posolda)
Date: Wed, 15 Apr 2015 18:35:47 +0200
Subject: [keycloak-user] User details storage
In-Reply-To: <etPan.552e90b9.b03e0c6.14d@AlikMacBookPro.local>
References: <etPan.552e90b9.b03e0c6.14d@AlikMacBookPro.local>
Message-ID: <552E9363.5000704@redhat.com>

Hi,

you probably don't need to change anything in keycloak model/storage. To 
add additional values for the user, you just need to do few changes in 
the UI. Model storage should be already flexible enough to support 
storing generic attributes. See this for more info: 
http://docs.jboss.org/keycloak/docs/1.2.0.Beta1/userguide/html/custom-user-attributes.html 
and this for how to map your generic attributes to accessToken/IDToken 
to see them in your application: 
http://docs.jboss.org/keycloak/docs/1.2.0.Beta1/userguide/html/mappers.html

ATM it's not possible to store dynamic attributes in to LDAP, but we're 
going to add it soon (probably in few months)

Marek

On 15.4.2015 18:24, Alik Kurdyukov wrote:
> Hello!
>
> First of all, thank you for implementing Keycloak, I made it work with 
> Spring Security in a very short time.
>
> I have architectural question: I need to store lots of additional 
> field values for every user in the system. I see two ways:
> 1. extend existing Keycloak storage and add fields there
> 2. store additional info in the LDAP server and retrieve additional 
> params by separate LDAP queries
> What is the best way to store it?
>
> -- 
> Best regards,
> Alik Kurdyukov
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150415/7a0521bd/attachment.html 

From stian at redhat.com  Thu Apr 16 03:16:00 2015
From: stian at redhat.com (Stian Thorgersen)
Date: Thu, 16 Apr 2015 03:16:00 -0400 (EDT)
Subject: [keycloak-user] Application to applications using bearer token
In-Reply-To: <CALAqdu-aLMm_AECpUfj=P_PdTvMn+NsedF92E8J=5ABFHzu_YQ@mail.gmail.com>
References: <CALAqdu-bre025M8cfcHypuLMG+fMP5D5zjitFWt0zupyfmx3wg@mail.gmail.com>
	<CALAqdu_oj-Cuw7SRsPS+rru_Oiw1++9kyftfcVCSV8UyosO6Mw@mail.gmail.com>
	<552E91EB.8050101@redhat.com>
	<CALAqdu-aLMm_AECpUfj=P_PdTvMn+NsedF92E8J=5ABFHzu_YQ@mail.gmail.com>
Message-ID: <1270907767.903654.1429168560399.JavaMail.zimbra@redhat.com>



----- Original Message -----
> From: "Scott Rossillo" <srossillo at smartling.com>
> To: "Marek Posolda" <mposolda at redhat.com>
> Cc: keycloak-user at lists.jboss.org
> Sent: Wednesday, April 15, 2015 6:34:52 PM
> Subject: Re: [keycloak-user] Application to applications using bearer token
> 
> Thanks Marek,
> 
> I will try again. I did get it working by setting the service to
> ?bearer-only? but there was one bug with the keycloak.json generated by
> Keycloak 1.2.0.Beta1. It?s missing the "auth-server-url?.
> 
> I get:
> 12:32:58.269 [http-nio-2080-exec-1] ERROR
> o.k.a.BearerTokenRequestAuthenticator - Failed to verify token
> org.keycloak.VerificationException: Realm URL is null. Make sure to add
> auth-server-url to the configuration of your adapter!
> 
> After adding "auth-server-url? to the keycloak.json file, it works.
> 
> I?ll set app back to confidential and I will keep testing.

https://issues.jboss.org/browse/KEYCLOAK-1213 - fixing now

> 
> Thanks,
> Scott
> 
> 
> 
> 
> On Wed, Apr 15, 2015 at 12:29 PM, Marek Posolda < mposolda at redhat.com >
> wrote:
> 
> 
> 
> That's quite strange. It should already be possible to authenticate against
> confidential applications with bearer-token. For example if you switch demo
> database-service as "confidential" instead of "bearer-only", it should be
> still possible to authenticate to it with the bearer access token sent from
> customer-portal. You can try it and see if it works.
> 
> If demo works for you, but your applications don't, it's probably some
> configuration problem on your side.
> 
> Marek
> 
> 
> On 15.4.2015 17:44, Scott Rossillo wrote:
> 
> 
> 
> Actually, I wanted to clarify one thing:
> 
> In the demos the database-service is set up as bearer-only. Maybe that?s the
> problem I?m having. I have the dependent service set as confidential. But
> shouldn?t this be supported?
> 
> What if the service provides both user facing features and APIs that can be
> accessed with bearer tokens?
> 
> Thanks again,
> Scott
> 
> On Wed, Apr 15, 2015 at 11:41 AM, Scott Rossillo < srossillo at smartling.com >
> wrote:
> 
> 
> 
> In the demos, there?s a clear example of how a user is authenticated against
> an application, say the customer-portal, and then the customer-portal
> requests information from the database-service using the access token as a
> bearer token.
> 
> In this example, the database-service accepts the bearer token and returns
> data.
> 
> However, using the Keycloak Adapters and attempting to do the same thing, the
> authentication is rejected. Any idea what may be causing this?
> 
> Thanks,
> Scott
> 
> 
> 
> _______________________________________________
> keycloak-user mailing list keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
> 
> 
> 
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user


From thorsten315 at gmx.de  Thu Apr 16 05:05:46 2015
From: thorsten315 at gmx.de (Thorsten)
Date: Thu, 16 Apr 2015 11:05:46 +0200
Subject: [keycloak-user] Get user roles in AngularJS from WildFly adapter
Message-ID: <CAMNcrz5R9K4EQJHteXc80RwH1yyyh36zL3hQU3VHEun-O3i+Tg@mail.gmail.com>

I have a WAR application that packages some JAX-RS services and an
AngularJS UI talking to them. No classic HTML/JSF stuff at all.

The app is running on WildFly and the Keycloak adapter with authentication
is already working and I can e.g. secure the JAX-RS endpoints with
@RolesAllowed etc.

My question is now what the recommended way is to get user role information
in the AngularJS part of the app? Since the authentication is not done in
JS I don't think keycloak.js would work? Can/should the keycloak.js adapter
get combined with the WildFly adapter or is there a different way to get
something like kc.hasRealmRole() to work?

Thanks
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150416/3b8a8589/attachment.html 

From stian at redhat.com  Thu Apr 16 05:18:10 2015
From: stian at redhat.com (Stian Thorgersen)
Date: Thu, 16 Apr 2015 05:18:10 -0400 (EDT)
Subject: [keycloak-user] Get user roles in AngularJS from WildFly adapter
In-Reply-To: <CAMNcrz5R9K4EQJHteXc80RwH1yyyh36zL3hQU3VHEun-O3i+Tg@mail.gmail.com>
References: <CAMNcrz5R9K4EQJHteXc80RwH1yyyh36zL3hQU3VHEun-O3i+Tg@mail.gmail.com>
Message-ID: <980957401.973535.1429175890938.JavaMail.zimbra@redhat.com>



----- Original Message -----
> From: "Thorsten" <thorsten315 at gmx.de>
> To: keycloak-user at lists.jboss.org
> Sent: Thursday, April 16, 2015 11:05:46 AM
> Subject: [keycloak-user] Get user roles in AngularJS from WildFly adapter
> 
> I have a WAR application that packages some JAX-RS services and an AngularJS
> UI talking to them. No classic HTML/JSF stuff at all.
> 
> The app is running on WildFly and the Keycloak adapter with authentication is
> already working and I can e.g. secure the JAX-RS endpoints with
> @RolesAllowed etc.
> 
> My question is now what the recommended way is to get user role information
> in the AngularJS part of the app? Since the authentication is not done in JS
> I don't think keycloak.js would work? Can/should the keycloak.js adapter get
> combined with the WildFly adapter or is there a different way to get
> something like kc.hasRealmRole() to work?

Use keycloak.js to authenticate your AngularJS app

> 
> Thanks
> 
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From stian at redhat.com  Thu Apr 16 05:21:31 2015
From: stian at redhat.com (Stian Thorgersen)
Date: Thu, 16 Apr 2015 05:21:31 -0400 (EDT)
Subject: [keycloak-user] Keycloak 1.2.0 Beta1 and CORS
In-Reply-To: <16DCFFB91025EF4DB80D3ECCA6E097E46DAA1E6E4B@NL-MAIL02.planon-fm.com>
References: <16DCFFB91025EF4DB80D3ECCA6E097E46DAA1E6E4B@NL-MAIL02.planon-fm.com>
Message-ID: <459707586.976068.1429176091465.JavaMail.zimbra@redhat.com>

See https://issues.jboss.org/browse/KEYCLOAK-1212

----- Original Message -----
> From: "Maurice Quaedackers" <Maurice.Quaedackers at planonsoftware.com>
> To: keycloak-user at lists.jboss.org
> Sent: Monday, April 13, 2015 10:32:38 PM
> Subject: [keycloak-user] Keycloak 1.2.0 Beta1 and CORS
> 
> 
> 
> Hello,
> 
> 
> 
> Has somebody experience with the new 1.2.0 Beta1 release in combination with
> CORS.
> 
> 
> 
> I have a very simple html page (for testing purposes) that I have made
> available via keycloak.
> 
> 
> 
> When I configure this page to use a Keycloak 1.1.0 Final as authentication
> front end all works like expected.
> 
> 
> 
> When I configure the same page with a Keycloak 1.2.0 Beta1 authentication
> front end (exact the same configuration) I am not able to access my test
> html file.
> 
> 
> 
> Suggestions are highly appreciated.
> 
> 
> 
> 
> 
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From fiorenzo.pizza at ict-group.it  Thu Apr 16 05:31:48 2015
From: fiorenzo.pizza at ict-group.it (fiorenzo.pizza at ict-group.it)
Date: Thu, 16 Apr 2015 11:31:48 +0200
Subject: [keycloak-user] ldap novell eDirectory patch
In-Reply-To: <196254751.81992.1429099311709.JavaMail.zimbra@redhat.com>
References: <552D9503.9090407@ict-group.it> <552E04F4.3010908@redhat.com>
	<552E0E63.7090700@ict-group.it>
	<196254751.81992.1429099311709.JavaMail.zimbra@redhat.com>
Message-ID: <552F8184.3010902@ict-group.it>

Hi Stian,

like i did in another jboss project (forge), today i will create 2 jira 
issues (one for adding Novello IDM and one for messages in IT) and send 
PR for these.

Ok?

No problem to track changes in messages_en.properties.. I need to watch 
the file changes in some way.. ( like gitwatch).


Fiorenzo

Il 15/04/15 14:01, Stian Thorgersen ha scritto:
>
> ----- Original Message -----
>> From: "fiorenzo pizza" <fiorenzo.pizza at ict-group.it>
>> To: "Marek Posolda" <mposolda at redhat.com>, keycloak-user at lists.jboss.org
>> Sent: Wednesday, April 15, 2015 9:08:19 AM
>> Subject: Re: [keycloak-user] ldap novell eDirectory patch
>>
>> Hi Marek,
>>
>> i will fix in the master and then i will send a PR.
>>
>> I would like also add italian translation of messages
>> (in forms-common-themes -> messages_it.properties).
> We'd love to get a PR for Italian. However, for each language we add we need someone to volunteer to maintain it.
>
> Would you be willing to track changes to messages_en.properties and apply to messages_it.properties?
>
>>
>> Fiorenzo
>>
>> Il 15/04/15 08:28, Marek Posolda ha scritto:
>>
>>
>>
>> Thanks for pointing this. We did not test with Novell eDirectory, so it's
>> possible that it didn't work. If you have opportunity to try with latest
>> Keycloak master, fix it in master and then send the PR, it will be very
>> cool! Note that there was some refactoring in latest master and some code
>> you pointed is not valid anymore (PartitionManagerRegistry was refactored
>> and renamed to LDAPIdentityStoreRegistry).
>>
>>
>>
>>
>> Otherwise I can try to apply it myself and ping you, so you can give it a try
>> with novell edirectory (or wait for the next released keycloak version).
>>
>> What do you think?
>> Marek
>>
>> On 15.4.2015 00:30, fiorenzo.pizza at ict-group.it wrote:
>>
>>
>> Hi,
>>
>> to support Novell eDirectory GUID, you can modify some lines of codes..
>>
>> 1) [project keycloak-model-api] -> class: org.keycloak.models.LDAPConstants
>>
>> - adding a new vendor constant ( public static final String
>> VENDOR_NOVELL_EDIRECTORY="edirectory" ;)
>>
>> 2) [project keycloak-picketlink-ldap] -> class:
>> org.keycloak.picketlink.ldap.PartitionManagerRegistry
>>
>> // RHDS is using "nsuniqueid" as unique identifier instead of "entryUUID"
>> // Novell eDirectory use "guid"
>> if (vendor != null && vendor.equals(LDAPConstants.VENDOR_RHDS)) {
>> ldapStoreBuilder.uniqueIdentifierAttributeName("nsuniqueid");
>> } else if (LDAPConstants.VENDOR_TIVOLI.equals(vendor)) {
>> ldapStoreBuilder.uniqueIdentifierAttributeName("uniqueidentifier");
>> } else if (LDAPConstants.VENDOR_NOVELL_EDIRECTORY.equals(vendor)) {
>> ldapStoreBuilder.uniqueIdentifierAttributeName("guid");
>> }
>>
>> 3) [project keycloak-forms-common-themes] -> file: users.js
>>
>> $scope.ldapVendors = [
>> { "id": "ad", "name": "Active Directory" },
>> { "id": "rhds", "name": "Red Hat Directory Server" },
>> { "id": "tivoli", "name": "Tivoli" },
>> { "id": "edirectory", "name": "eDirectory " },
>> { "id": "other", "name": "Other" }
>> ];
>>
>>
>> What do you think about? I need more time to test my patch.. the keycloak
>> project not compiles in my workspace...
>>
>> Best Regards
>>
>> Fiorenzo Pizza
>>
>>
>> _______________________________________________
>> keycloak-user mailing list keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>>
>>
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150416/8ceaa112/attachment.html 

From thorsten315 at gmx.de  Thu Apr 16 05:36:36 2015
From: thorsten315 at gmx.de (Thorsten)
Date: Thu, 16 Apr 2015 11:36:36 +0200
Subject: [keycloak-user] Get user roles in AngularJS from WildFly adapter
In-Reply-To: <980957401.973535.1429175890938.JavaMail.zimbra@redhat.com>
References: <CAMNcrz5R9K4EQJHteXc80RwH1yyyh36zL3hQU3VHEun-O3i+Tg@mail.gmail.com>
	<980957401.973535.1429175890938.JavaMail.zimbra@redhat.com>
Message-ID: <CAMNcrz7zZ4iShU4XwDSvHvs97NYGz48ZNx73Q2sbE1JYUiSVvw@mail.gmail.com>

So do I need to create two applications for the realm then? One for the
JAX-RS part with "Access Type" of "Bearer Only" and one for the Angular UI
with type "Public"?

2015-04-16 11:18 GMT+02:00 Stian Thorgersen <stian at redhat.com>:

>
>
> ----- Original Message -----
> > From: "Thorsten" <thorsten315 at gmx.de>
> > To: keycloak-user at lists.jboss.org
> > Sent: Thursday, April 16, 2015 11:05:46 AM
> > Subject: [keycloak-user] Get user roles in AngularJS from WildFly adapter
> >
> > I have a WAR application that packages some JAX-RS services and an
> AngularJS
> > UI talking to them. No classic HTML/JSF stuff at all.
> >
> > The app is running on WildFly and the Keycloak adapter with
> authentication is
> > already working and I can e.g. secure the JAX-RS endpoints with
> > @RolesAllowed etc.
> >
> > My question is now what the recommended way is to get user role
> information
> > in the AngularJS part of the app? Since the authentication is not done
> in JS
> > I don't think keycloak.js would work? Can/should the keycloak.js adapter
> get
> > combined with the WildFly adapter or is there a different way to get
> > something like kc.hasRealmRole() to work?
>
> Use keycloak.js to authenticate your AngularJS app
>
> >
> > Thanks
> >
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150416/70ac0e95/attachment.html 

From stian at redhat.com  Thu Apr 16 06:47:59 2015
From: stian at redhat.com (Stian Thorgersen)
Date: Thu, 16 Apr 2015 06:47:59 -0400 (EDT)
Subject: [keycloak-user] Get user roles in AngularJS from WildFly adapter
In-Reply-To: <CAMNcrz7zZ4iShU4XwDSvHvs97NYGz48ZNx73Q2sbE1JYUiSVvw@mail.gmail.com>
References: <CAMNcrz5R9K4EQJHteXc80RwH1yyyh36zL3hQU3VHEun-O3i+Tg@mail.gmail.com>
	<980957401.973535.1429175890938.JavaMail.zimbra@redhat.com>
	<CAMNcrz7zZ4iShU4XwDSvHvs97NYGz48ZNx73Q2sbE1JYUiSVvw@mail.gmail.com>
Message-ID: <1591867287.1110147.1429181279661.JavaMail.zimbra@redhat.com>

Yes, at least that's what I'd do

----- Original Message -----
> From: "Thorsten" <thorsten315 at gmx.de>
> To: "Stian Thorgersen" <stian at redhat.com>
> Cc: keycloak-user at lists.jboss.org
> Sent: Thursday, April 16, 2015 11:36:36 AM
> Subject: Re: [keycloak-user] Get user roles in AngularJS from WildFly adapter
> 
> So do I need to create two applications for the realm then? One for the
> JAX-RS part with "Access Type" of "Bearer Only" and one for the Angular UI
> with type "Public"?
> 
> 2015-04-16 11:18 GMT+02:00 Stian Thorgersen <stian at redhat.com>:
> 
> >
> >
> > ----- Original Message -----
> > > From: "Thorsten" <thorsten315 at gmx.de>
> > > To: keycloak-user at lists.jboss.org
> > > Sent: Thursday, April 16, 2015 11:05:46 AM
> > > Subject: [keycloak-user] Get user roles in AngularJS from WildFly adapter
> > >
> > > I have a WAR application that packages some JAX-RS services and an
> > AngularJS
> > > UI talking to them. No classic HTML/JSF stuff at all.
> > >
> > > The app is running on WildFly and the Keycloak adapter with
> > authentication is
> > > already working and I can e.g. secure the JAX-RS endpoints with
> > > @RolesAllowed etc.
> > >
> > > My question is now what the recommended way is to get user role
> > information
> > > in the AngularJS part of the app? Since the authentication is not done
> > in JS
> > > I don't think keycloak.js would work? Can/should the keycloak.js adapter
> > get
> > > combined with the WildFly adapter or is there a different way to get
> > > something like kc.hasRealmRole() to work?
> >
> > Use keycloak.js to authenticate your AngularJS app
> >
> > >
> > > Thanks
> > >
> > > _______________________________________________
> > > keycloak-user mailing list
> > > keycloak-user at lists.jboss.org
> > > https://lists.jboss.org/mailman/listinfo/keycloak-user
> >
> 

From stian at redhat.com  Thu Apr 16 06:50:30 2015
From: stian at redhat.com (Stian Thorgersen)
Date: Thu, 16 Apr 2015 06:50:30 -0400 (EDT)
Subject: [keycloak-user] ldap novell eDirectory patch
In-Reply-To: <552F8184.3010902@ict-group.it>
References: <552D9503.9090407@ict-group.it> <552E04F4.3010908@redhat.com>
	<552E0E63.7090700@ict-group.it>
	<196254751.81992.1429099311709.JavaMail.zimbra@redhat.com>
	<552F8184.3010902@ict-group.it>
Message-ID: <825431251.1111386.1429181430245.JavaMail.zimbra@redhat.com>



----- Original Message -----
> From: "fiorenzo pizza" <fiorenzo.pizza at ict-group.it>
> To: "Stian Thorgersen" <stian at redhat.com>
> Cc: "Marek Posolda" <mposolda at redhat.com>, keycloak-user at lists.jboss.org
> Sent: Thursday, April 16, 2015 11:31:48 AM
> Subject: Re: [keycloak-user] ldap novell eDirectory patch
> 
> Hi Stian,
> 
> like i did in another jboss project (forge), today i will create 2 jira
> issues (one for adding Novello IDM and one for messages in IT) and send
> PR for these.
> 
> Ok?

Sounds good

> 
> No problem to track changes in messages_en.properties.. I need to watch
> the file changes in some way.. ( like gitwatch).

Great, we may try to come up with a more "formal" way to maintain these translations to make sure they're updated before we release, but for the time being if you could just track it directly that'd be good

> 
> 
> Fiorenzo
> 
> Il 15/04/15 14:01, Stian Thorgersen ha scritto:
> >
> > ----- Original Message -----
> >> From: "fiorenzo pizza" <fiorenzo.pizza at ict-group.it>
> >> To: "Marek Posolda" <mposolda at redhat.com>, keycloak-user at lists.jboss.org
> >> Sent: Wednesday, April 15, 2015 9:08:19 AM
> >> Subject: Re: [keycloak-user] ldap novell eDirectory patch
> >>
> >> Hi Marek,
> >>
> >> i will fix in the master and then i will send a PR.
> >>
> >> I would like also add italian translation of messages
> >> (in forms-common-themes -> messages_it.properties).
> > We'd love to get a PR for Italian. However, for each language we add we
> > need someone to volunteer to maintain it.
> >
> > Would you be willing to track changes to messages_en.properties and apply
> > to messages_it.properties?
> >
> >>
> >> Fiorenzo
> >>
> >> Il 15/04/15 08:28, Marek Posolda ha scritto:
> >>
> >>
> >>
> >> Thanks for pointing this. We did not test with Novell eDirectory, so it's
> >> possible that it didn't work. If you have opportunity to try with latest
> >> Keycloak master, fix it in master and then send the PR, it will be very
> >> cool! Note that there was some refactoring in latest master and some code
> >> you pointed is not valid anymore (PartitionManagerRegistry was refactored
> >> and renamed to LDAPIdentityStoreRegistry).
> >>
> >>
> >>
> >>
> >> Otherwise I can try to apply it myself and ping you, so you can give it a
> >> try
> >> with novell edirectory (or wait for the next released keycloak version).
> >>
> >> What do you think?
> >> Marek
> >>
> >> On 15.4.2015 00:30, fiorenzo.pizza at ict-group.it wrote:
> >>
> >>
> >> Hi,
> >>
> >> to support Novell eDirectory GUID, you can modify some lines of codes..
> >>
> >> 1) [project keycloak-model-api] -> class:
> >> org.keycloak.models.LDAPConstants
> >>
> >> - adding a new vendor constant ( public static final String
> >> VENDOR_NOVELL_EDIRECTORY="edirectory" ;)
> >>
> >> 2) [project keycloak-picketlink-ldap] -> class:
> >> org.keycloak.picketlink.ldap.PartitionManagerRegistry
> >>
> >> // RHDS is using "nsuniqueid" as unique identifier instead of "entryUUID"
> >> // Novell eDirectory use "guid"
> >> if (vendor != null && vendor.equals(LDAPConstants.VENDOR_RHDS)) {
> >> ldapStoreBuilder.uniqueIdentifierAttributeName("nsuniqueid");
> >> } else if (LDAPConstants.VENDOR_TIVOLI.equals(vendor)) {
> >> ldapStoreBuilder.uniqueIdentifierAttributeName("uniqueidentifier");
> >> } else if (LDAPConstants.VENDOR_NOVELL_EDIRECTORY.equals(vendor)) {
> >> ldapStoreBuilder.uniqueIdentifierAttributeName("guid");
> >> }
> >>
> >> 3) [project keycloak-forms-common-themes] -> file: users.js
> >>
> >> $scope.ldapVendors = [
> >> { "id": "ad", "name": "Active Directory" },
> >> { "id": "rhds", "name": "Red Hat Directory Server" },
> >> { "id": "tivoli", "name": "Tivoli" },
> >> { "id": "edirectory", "name": "eDirectory " },
> >> { "id": "other", "name": "Other" }
> >> ];
> >>
> >>
> >> What do you think about? I need more time to test my patch.. the keycloak
> >> project not compiles in my workspace...
> >>
> >> Best Regards
> >>
> >> Fiorenzo Pizza
> >>
> >>
> >> _______________________________________________
> >> keycloak-user mailing list keycloak-user at lists.jboss.org
> >> https://lists.jboss.org/mailman/listinfo/keycloak-user
> >>
> >>
> >>
> >> _______________________________________________
> >> keycloak-user mailing list
> >> keycloak-user at lists.jboss.org
> >> https://lists.jboss.org/mailman/listinfo/keycloak-user
> 
> 

From thorsten315 at gmx.de  Thu Apr 16 06:54:05 2015
From: thorsten315 at gmx.de (Thorsten)
Date: Thu, 16 Apr 2015 12:54:05 +0200
Subject: [keycloak-user] Get user roles in AngularJS from WildFly adapter
In-Reply-To: <1591867287.1110147.1429181279661.JavaMail.zimbra@redhat.com>
References: <CAMNcrz5R9K4EQJHteXc80RwH1yyyh36zL3hQU3VHEun-O3i+Tg@mail.gmail.com>
	<980957401.973535.1429175890938.JavaMail.zimbra@redhat.com>
	<CAMNcrz7zZ4iShU4XwDSvHvs97NYGz48ZNx73Q2sbE1JYUiSVvw@mail.gmail.com>
	<1591867287.1110147.1429181279661.JavaMail.zimbra@redhat.com>
Message-ID: <CAMNcrz5dc4-zamMgjEKOgzOvpZAuaBL9Jj9qzqmBjO=EMC3A+A@mail.gmail.com>

Ok, I'll give that a try.

Thanks

2015-04-16 12:47 GMT+02:00 Stian Thorgersen <stian at redhat.com>:

> Yes, at least that's what I'd do
>
> ----- Original Message -----
> > From: "Thorsten" <thorsten315 at gmx.de>
> > To: "Stian Thorgersen" <stian at redhat.com>
> > Cc: keycloak-user at lists.jboss.org
> > Sent: Thursday, April 16, 2015 11:36:36 AM
> > Subject: Re: [keycloak-user] Get user roles in AngularJS from WildFly
> adapter
> >
> > So do I need to create two applications for the realm then? One for the
> > JAX-RS part with "Access Type" of "Bearer Only" and one for the Angular
> UI
> > with type "Public"?
> >
> > 2015-04-16 11:18 GMT+02:00 Stian Thorgersen <stian at redhat.com>:
> >
> > >
> > >
> > > ----- Original Message -----
> > > > From: "Thorsten" <thorsten315 at gmx.de>
> > > > To: keycloak-user at lists.jboss.org
> > > > Sent: Thursday, April 16, 2015 11:05:46 AM
> > > > Subject: [keycloak-user] Get user roles in AngularJS from WildFly
> adapter
> > > >
> > > > I have a WAR application that packages some JAX-RS services and an
> > > AngularJS
> > > > UI talking to them. No classic HTML/JSF stuff at all.
> > > >
> > > > The app is running on WildFly and the Keycloak adapter with
> > > authentication is
> > > > already working and I can e.g. secure the JAX-RS endpoints with
> > > > @RolesAllowed etc.
> > > >
> > > > My question is now what the recommended way is to get user role
> > > information
> > > > in the AngularJS part of the app? Since the authentication is not
> done
> > > in JS
> > > > I don't think keycloak.js would work? Can/should the keycloak.js
> adapter
> > > get
> > > > combined with the WildFly adapter or is there a different way to get
> > > > something like kc.hasRealmRole() to work?
> > >
> > > Use keycloak.js to authenticate your AngularJS app
> > >
> > > >
> > > > Thanks
> > > >
> > > > _______________________________________________
> > > > keycloak-user mailing list
> > > > keycloak-user at lists.jboss.org
> > > > https://lists.jboss.org/mailman/listinfo/keycloak-user
> > >
> >
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150416/ba19bdfd/attachment.html 

From b.hansmann at alphaapps.de  Thu Apr 16 09:28:10 2015
From: b.hansmann at alphaapps.de (Benjamin Hansmann [alphaApps])
Date: Thu, 16 Apr 2015 15:28:10 +0200
Subject: [keycloak-user] Securing a REST service with Keycloak?
Message-ID: <1429190890.4891.62.camel@devs.alphaapps.de>

Greetings. I am currently developing a RESTful web service for mobile
applications and was looking for a suitable solution to secure it.

My requirements are:

R1 Users can register over a REST API and have to verify their Email
address
R2 Users can manage their accounts over a REST API (change password
etc.)
R3 Other requests than registering need authentication
R4 Logging in should work native from the mobile app and not through a
website
R5 Data on the transmission line should be protected from eavesdropping
and other man-in-the-middle attacks (met: https with certificate
truststore on the client side)
R6 The service should be resistant to replay attacks
R7 The service should be resistant to brute-force attacks (met:
keycloak)
R8 (optional) Support OAUTH 2.0 to let a custodian perform actions on
behalf of the registered user (met: keycloak)

I set up a test environment on Debian running Wildfly 8.2 and Keycloak
1.1.0. My web application to be secured is based on the restEasy JAX-RS
implementation and is already configured to use the Keycloak
authentication subsystem and security annotations.

At this point I am not sure if keycloak is the right way to go. As of my
current understanding I would do it this way:

a Create an application in my keycloak realm that only supports bearer
token
b Maybe have a short token timeout
c Use the direct access grant API to obtain token
d Do some REST service requests with the issued token until it expires
and request a new one

But I have my concerns with this approach:

C1 Is a short token timeout sufficient to protect against replay attacks
(R6)? Does the keycloak implementation provide some additional protocol
features like the counters used in HTTP Digest authentication or
OATH-HOTP solutions? Maybe I just did not understand the Access Code and
Access Token mechanism...
C2 Does keycloak provide REST functionality for R2 and R3 (registration
and user self-service)
C3 Is there another way to authenticate to obtain a token than
Basic/x-www-form-urlencoded
C4 The user database is separated from my application's database. I've
seen that I could implement my own User Federation Provider, but is
there another way to maybe add user profile information to the keycloak
user database so that user information exists in only one place? I would
also like the idea where keycloak would use a user table in my
application's database...
C5 I could imagine a solution that requires Digest Authentication for
users and to support OAUTH 2.0 for custodians but as far as I know this
is not possible with keycloak.

I would be grateful to get some advice on this. I am new to the Java EE
and REST world and want to make my REST service as secure as possible
because it will expose sensitive data and also will incorporate
financial transactions. Maybe I am on the wrong track here...

Thanks in advance.

Best regards
Benjamin
 
-- 

[alphaApps] mobile development

Benjamin Hansmann

Nosthoffenstra?e 46
D-40589 D?sseldorf
Germany

Mobile: +49 (0) 177 249 47 47
Email: b.hansmann at alphaapps.de


From b.hansmann at alphaapps.de  Fri Apr 17 07:30:35 2015
From: b.hansmann at alphaapps.de (Benjamin Hansmann [alphaApps])
Date: Fri, 17 Apr 2015 13:30:35 +0200
Subject: [keycloak-user] always-refresh-token and admin rest api
Message-ID: <1429270235.4937.26.camel@devs.alphaapps.de>

Greetings. Following up my post from yesterday I have more specific
questions.

I plan to use keycloak with my REST service for mobile apps as follows:

Option A:
1 A user sends a REST registration request to my webapp and the webapp
adapts the request to the local keycloak admin rest api.
2 When the user is created he can then authenticate to keycloak via the
direct access grant rest api and receives an access token.
3 The issued access token should be valid for only one request, thus I
specified the option "always-refresh-token": true in my webapp's
keycloak.json file.

Option B:
1 Mobile app forms the HTTP POST request to the user registration page.
2 and 3 as in Option A

Option C:
1 Use a user federation provider and create users in my webapp's
datasource.
2 and 3 as in Option A

Question regarding all options:
How is the "always-refresh-token" option supposed to work? I supplied
the option as stated above but I am still able to reuse access tokens
that were issued from the direct access grant service. Another question
is how this token refreshing should be implemented on the client side.
Do I have to invoke on the direct access grant api to obtain a new token
for every request or can the issued "refresh_token" be used on
subsequent requests and a new refresh token is somehow included in the
response of my service?

Question regarding option C:
When creating users in my own database which serves as a federation
provider I loose some keycloak functionality like Email verification and
so on, right?

I am also not sure which option to use. What would you suggest.

Feature request:
It would be great to have a keycloak REST API for registration and user
self-service in order to fulfill the demands of mobile applications.

Best regards,
Benjamin
-- 

[alphaApps] mobile development

Benjamin Hansmann

Nosthoffenstra?e 46
D-40589 D?sseldorf
Germany

Mobile: +49 (0) 177 249 47 47
Email: b.hansmann at alphaapps.de


From mposolda at redhat.com  Fri Apr 17 11:48:47 2015
From: mposolda at redhat.com (Marek Posolda)
Date: Fri, 17 Apr 2015 17:48:47 +0200
Subject: [keycloak-user] always-refresh-token and admin rest api
In-Reply-To: <1429270235.4937.26.camel@devs.alphaapps.de>
References: <1429270235.4937.26.camel@devs.alphaapps.de>
Message-ID: <55312B5F.2050504@redhat.com>

On 17.4.2015 13:30, Benjamin Hansmann [alphaApps] wrote:
> Greetings. Following up my post from yesterday I have more specific
> questions.
>
> I plan to use keycloak with my REST service for mobile apps as follows:
>
> Option A:
> 1 A user sends a REST registration request to my webapp and the webapp
> adapts the request to the local keycloak admin rest api.
> 2 When the user is created he can then authenticate to keycloak via the
> direct access grant rest api and receives an access token.
> 3 The issued access token should be valid for only one request, thus I
> specified the option "always-refresh-token": true in my webapp's
> keycloak.json file.
>
> Option B:
> 1 Mobile app forms the HTTP POST request to the user registration page.
> 2 and 3 as in Option A
>
> Option C:
> 1 Use a user federation provider and create users in my webapp's
> datasource.
> 2 and 3 as in Option A
>
> Question regarding all options:
> How is the "always-refresh-token" option supposed to work? I supplied
> the option as stated above but I am still able to reuse access tokens
> that were issued from the direct access grant service. Another question
> is how this token refreshing should be implemented on the client side.
> Do I have to invoke on the direct access grant api to obtain a new token
> for every request or can the issued "refresh_token" be used on
> subsequent requests and a new refresh token is somehow included in the
> response of my service?
This option is used for servlet adapters. Each HTTP request to the 
servlet frontend application (For example "customer-portal" or 
"product-portal" from our demo) will perform sending back-channel 
request to the Keycloak auth-server and will refresh the token. You can 
try change our demo and add the option for example to the 
customer-portal keycloak.json: 
https://github.com/keycloak/keycloak/blob/master/examples/demo-template/customer-app/src/main/webapp/WEB-INF/keycloak.json 
and then check in the application that accessToken is different in each 
request: 
https://github.com/keycloak/keycloak/blob/master/examples/demo-template/customer-app/src/main/java/org/keycloak/example/CustomerDatabaseClient.java#L56 
.

This option has no effect for bearer-only applications as those are 
authenticated by accessToken sent from different application and they 
don't support any token refreshing at all. It also doesn't have any 
effect for direct grant API (we don't have any adapter for direct grant 
API. People are expected to invoke the HTTP request to retrieve 
accessToken from auth-server with direct grant API by themselves as 
shown in the documentation or in the admin-access-app example)

Marek
>
> Question regarding option C:
> When creating users in my own database which serves as a federation
> provider I loose some keycloak functionality like Email verification and
> so on, right?
>
> I am also not sure which option to use. What would you suggest.
>
> Feature request:
> It would be great to have a keycloak REST API for registration and user
> self-service in order to fulfill the demands of mobile applications.
>
> Best regards,
> Benjamin


From srossillo at smartling.com  Fri Apr 17 16:34:51 2015
From: srossillo at smartling.com (Scott Rossillo)
Date: Fri, 17 Apr 2015 16:34:51 -0400
Subject: [keycloak-user] Keycloak Adapter without web.xml security-constraint
Message-ID: <CALAqdu-EjwrWm_fidyrpZkMUDfFA2309xheAThkf3ADRXn3huw@mail.gmail.com>

When using a security mechanism, such as Spring Security, it?s possible
that multiple security mechanisms are in place or that only parts of an
application are secured via Keycloak, not a blanket path (e.g. /api/*).

What I?m trying to do is use the Spring?s authentication entrypoint to
direct to Keycloak (this part work somewhat) and have the Keycloak adapter
pick up from there (not working).

What?s the best way to handle this?

Thanks,
Scott
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150417/5af52880/attachment-0001.html 

From bburke at redhat.com  Fri Apr 17 16:46:06 2015
From: bburke at redhat.com (Bill Burke)
Date: Fri, 17 Apr 2015 16:46:06 -0400
Subject: [keycloak-user] Keycloak Adapter without web.xml
	security-constraint
In-Reply-To: <CALAqdu-EjwrWm_fidyrpZkMUDfFA2309xheAThkf3ADRXn3huw@mail.gmail.com>
References: <CALAqdu-EjwrWm_fidyrpZkMUDfFA2309xheAThkf3ADRXn3huw@mail.gmail.com>
Message-ID: <5531710E.4020804@redhat.com>

Our adapters need a security constraint or they won't be triggered.

On 4/17/2015 4:34 PM, Scott Rossillo wrote:
> When using a security mechanism, such as Spring Security, it?s possible
> that multiple security mechanisms are in place or that only parts of an
> application are secured via Keycloak, not a blanket path (e.g. /api/*).
>
> What I?m trying to do is use the Spring?s authentication entrypoint to
> direct to Keycloak (this part work somewhat) and have the Keycloak
> adapter pick up from there (not working).
>
> What?s the best way to handle this?
>
> Thanks,
> Scott
>
>
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

-- 
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com

From srossillo at smartling.com  Fri Apr 17 17:14:57 2015
From: srossillo at smartling.com (Scott Rossillo)
Date: Fri, 17 Apr 2015 17:14:57 -0400
Subject: [keycloak-user] Keycloak Adapter without web.xml
	security-constraint
In-Reply-To: <5531710E.4020804@redhat.com>
References: <CALAqdu-EjwrWm_fidyrpZkMUDfFA2309xheAThkf3ADRXn3huw@mail.gmail.com>
	<5531710E.4020804@redhat.com>
Message-ID: <CALAqdu8Js6u2ZOPF1OEo36bRXGAAAbdBF4FwqAwaOKDnc-q5kg@mail.gmail.com>

I could work around that for interactive logins, but it wouldn?t work for
application to application requests. Do you have any pointers on where I
could start to manually trigger the adapter?

Do you think it?s a reasonable requirement to have the application
determine if the adapter should be triggered? I feel it?s necessary for
integration with applications that have to support more than one
authentication mechanism.

Let me know.

Thanks in advance,
Scott


On Fri, Apr 17, 2015 at 4:46 PM, Bill Burke <bburke at redhat.com> wrote:

> Our adapters need a security constraint or they won't be triggered.
>
> On 4/17/2015 4:34 PM, Scott Rossillo wrote:
> > When using a security mechanism, such as Spring Security, it?s possible
> > that multiple security mechanisms are in place or that only parts of an
> > application are secured via Keycloak, not a blanket path (e.g. /api/*).
> >
> > What I?m trying to do is use the Spring?s authentication entrypoint to
> > direct to Keycloak (this part work somewhat) and have the Keycloak
> > adapter pick up from there (not working).
> >
> > What?s the best way to handle this?
> >
> > Thanks,
> > Scott
> >
> >
> >
> >
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
> >
>
> --
> Bill Burke
> JBoss, a division of Red Hat
> http://bill.burkecentral.com
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150417/8c63b41f/attachment.html 

From sblanc at redhat.com  Sun Apr 19 14:20:49 2015
From: sblanc at redhat.com (Sebastien Blanc)
Date: Mon, 20 Apr 2015 00:05:49 +0545
Subject: [keycloak-user] Best practice public API Rest (GET Method) Vs
	Protected
Message-ID: <CAMZCGg9MVox0YNcEQDgT-WmbcU4PVaXgJbn0qW1EjmZzd3_dHg@mail.gmail.com>

Hi all,

I wonder what would be the best approach, when using Keycloak, to just
protect POST, PUT and DELETE and keep GET unprotected and ideally  using
the same application path ?

Sebi
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150420/28455f28/attachment.html 

From srossillo at smartling.com  Sun Apr 19 20:50:26 2015
From: srossillo at smartling.com (Scott Rossillo)
Date: Sun, 19 Apr 2015 20:50:26 -0400
Subject: [keycloak-user] Keycloak Adapter without web.xml
	security-constraint
In-Reply-To: <CALAqdu8Js6u2ZOPF1OEo36bRXGAAAbdBF4FwqAwaOKDnc-q5kg@mail.gmail.com>
References: <CALAqdu-EjwrWm_fidyrpZkMUDfFA2309xheAThkf3ADRXn3huw@mail.gmail.com>
	<5531710E.4020804@redhat.com>
	<CALAqdu8Js6u2ZOPF1OEo36bRXGAAAbdBF4FwqAwaOKDnc-q5kg@mail.gmail.com>
Message-ID: <CALAqdu8ym=ato02FvM2Q_yF4g6=TkDqdmu107OsU4Gh2vzcVLw@mail.gmail.com>

Could we have a hook into application code to determine if a resource
should be protected by Keycloak? Maybe an event handler?

boolean shouldProtectResourse(HttpServletRequest)

On Friday, April 17, 2015, Scott Rossillo <srossillo at smartling.com> wrote:

> I could work around that for interactive logins, but it wouldn?t work for
> application to application requests. Do you have any pointers on where I
> could start to manually trigger the adapter?
>
> Do you think it?s a reasonable requirement to have the application
> determine if the adapter should be triggered? I feel it?s necessary for
> integration with applications that have to support more than one
> authentication mechanism.
>
> Let me know.
>
> Thanks in advance,
> Scott
>
>
> On Fri, Apr 17, 2015 at 4:46 PM, Bill Burke <bburke at redhat.com
> <javascript:_e(%7B%7D,'cvml','bburke at redhat.com');>> wrote:
>
>> Our adapters need a security constraint or they won't be triggered.
>>
>> On 4/17/2015 4:34 PM, Scott Rossillo wrote:
>> > When using a security mechanism, such as Spring Security, it?s possible
>> > that multiple security mechanisms are in place or that only parts of an
>> > application are secured via Keycloak, not a blanket path (e.g. /api/*).
>> >
>> > What I?m trying to do is use the Spring?s authentication entrypoint to
>> > direct to Keycloak (this part work somewhat) and have the Keycloak
>> > adapter pick up from there (not working).
>> >
>> > What?s the best way to handle this?
>> >
>> > Thanks,
>> > Scott
>> >
>> >
>> >
>> >
>> > _______________________________________________
>> > keycloak-user mailing list
>> > keycloak-user at lists.jboss.org
>> <javascript:_e(%7B%7D,'cvml','keycloak-user at lists.jboss.org');>
>> > https://lists.jboss.org/mailman/listinfo/keycloak-user
>> >
>>
>> --
>> Bill Burke
>> JBoss, a division of Red Hat
>> http://bill.burkecentral.com
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> <javascript:_e(%7B%7D,'cvml','keycloak-user at lists.jboss.org');>
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150419/9c8ed633/attachment.html 

From stian at redhat.com  Mon Apr 20 01:17:13 2015
From: stian at redhat.com (Stian Thorgersen)
Date: Mon, 20 Apr 2015 01:17:13 -0400 (EDT)
Subject: [keycloak-user] Best practice public API Rest (GET Method)
	Vs	Protected
In-Reply-To: <CAMZCGg9MVox0YNcEQDgT-WmbcU4PVaXgJbn0qW1EjmZzd3_dHg@mail.gmail.com>
References: <CAMZCGg9MVox0YNcEQDgT-WmbcU4PVaXgJbn0qW1EjmZzd3_dHg@mail.gmail.com>
Message-ID: <972432675.3022197.1429507033389.JavaMail.zimbra@redhat.com>

Assuming you're securing your paths using web.xml there's http-method-omission which allows omitting specific methods from the secure web collection.

http://docs.oracle.com/cd/E19798-01/821-1841/bncbk/index.html#indexterm-1457

----- Original Message -----
> From: "Sebastien Blanc" <sblanc at redhat.com>
> To: keycloak-user at lists.jboss.org
> Sent: Sunday, April 19, 2015 8:20:49 PM
> Subject: [keycloak-user] Best practice public API Rest (GET Method) Vs	Protected
> 
> Hi all,
> 
> I wonder what would be the best approach, when using Keycloak, to just
> protect POST, PUT and DELETE and keep GET unprotected and ideally using the
> same application path ?
> 
> Sebi
> 
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From lkrzyzan at redhat.com  Mon Apr 20 05:00:11 2015
From: lkrzyzan at redhat.com (=?utf-8?Q?Libor_Krzy=C5=BEanek?=)
Date: Mon, 20 Apr 2015 11:00:11 +0200
Subject: [keycloak-user] User attributes - checkbox
Message-ID: <AECDC74A-E63D-4EAE-9EE0-E71699F6D09B@redhat.com>

Hi,
I?d like to use user attributes to store information like ?Subscribe to newsletter? which is obviously checkbox.

How should I implement it in my account.ftl?

I have in account.flt:
<div class="form-group">
   <div class="checkbox">
      <label for="user.attributes.newsletter" class="control-label">
         <input type="checkbox" class="form-control" id="user.attributes.newsletter" name="user.attributes.newsletter" <#if account.attributes.newsletter??>checked</#if>/>
         ${msg("newsletter")}
      </label>
   </div>
</div>


When I tick it and submit form everything is OK but when untick it and submit then checkbox is still checked.
I guess it?s because checkbox state is included in HTTP Form Data only when it?s checked.

How to handle this in KC UI ?

I remember that other frameworks used some hidden fields to post the information either if checkbox was ticked or not. But I?m not sure how KC GUI framework handle this use case.

Thanks,

Libor Krzy?anek
jboss.org <http://jboss.org/> Development Team

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150420/4959201c/attachment-0001.html 

From b.hansmann at alphaapps.de  Mon Apr 20 09:15:38 2015
From: b.hansmann at alphaapps.de (Benjamin Hansmann [alphaApps])
Date: Mon, 20 Apr 2015 15:15:38 +0200
Subject: [keycloak-user] always-refresh-token and admin rest api
In-Reply-To: <55312B5F.2050504@redhat.com>
References: <1429270235.4937.26.camel@devs.alphaapps.de>
	<55312B5F.2050504@redhat.com>
Message-ID: <1429535518.4510.42.camel@devs.alphaapps.de>

On Fri, 2015-04-17 at 17:48 +0200, Marek Posolda wrote:
> On 17.4.2015 13:30, Benjamin Hansmann [alphaApps] wrote:
> > Greetings. Following up my post from yesterday I have more specific
> > questions.
> >
> > I plan to use keycloak with my REST service for mobile apps as follows:
> >
> > Option A:
> > 1 A user sends a REST registration request to my webapp and the webapp
> > adapts the request to the local keycloak admin rest api.
> > 2 When the user is created he can then authenticate to keycloak via the
> > direct access grant rest api and receives an access token.
> > 3 The issued access token should be valid for only one request, thus I
> > specified the option "always-refresh-token": true in my webapp's
> > keycloak.json file.
> >
> > Option B:
> > 1 Mobile app forms the HTTP POST request to the user registration page.
> > 2 and 3 as in Option A
> >
> > Option C:
> > 1 Use a user federation provider and create users in my webapp's
> > datasource.
> > 2 and 3 as in Option A
> >
> > Question regarding all options:
> > How is the "always-refresh-token" option supposed to work? I supplied
> > the option as stated above but I am still able to reuse access tokens
> > that were issued from the direct access grant service. Another question
> > is how this token refreshing should be implemented on the client side.
> > Do I have to invoke on the direct access grant api to obtain a new token
> > for every request or can the issued "refresh_token" be used on
> > subsequent requests and a new refresh token is somehow included in the
> > response of my service?
> This option is used for servlet adapters. Each HTTP request to the 
> servlet frontend application (For example "customer-portal" or 
> "product-portal" from our demo) will perform sending back-channel 
> request to the Keycloak auth-server and will refresh the token. You can 
> try change our demo and add the option for example to the 
> customer-portal keycloak.json: 
> https://github.com/keycloak/keycloak/blob/master/examples/demo-template/customer-app/src/main/webapp/WEB-INF/keycloak.json 
> and then check in the application that accessToken is different in each 
> request: 
> https://github.com/keycloak/keycloak/blob/master/examples/demo-template/customer-app/src/main/java/org/keycloak/example/CustomerDatabaseClient.java#L56 
> .
> 
> This option has no effect for bearer-only applications as those are 
> authenticated by accessToken sent from different application and they 
> don't support any token refreshing at all. It also doesn't have any 
> effect for direct grant API (we don't have any adapter for direct grant 
> API. People are expected to invoke the HTTP request to retrieve 
> accessToken from auth-server with direct grant API by themselves as 
> shown in the documentation or in the admin-access-app example)
> 
> Marek

Thanks Marek. With tcpdump I could see that access tokens are refreshed
on each request when logging into my realm through the keycloak web
front-end. These mechanisms seem to be based on cookies so there are not
feasible for my application.

As always-refresh-token doesn't work with the direct grant api I will do
it as follows:
- Mobile application will login with saved password
through /auth/realms/<my_realm>/tokens/grants/access
- When token expired (after 3 minutes) on subsequent request, mobile
application will refresh token
through /auth/realms/<my_realm>/tokens/refresh
- If session (and issued refresh_token) expired due to inactivity (after
10 minutes) automatically login again
- Set revocation policy on sensible rest requests to something >3
minutes
- Implement REST adapter to the keycloak admin api to let users register
and manage their profiles

In this scenario I do not need the web-frontend for users,
e.g. /auth/realms/<my_realm>/protocol/openid-connect, /auth/realms/<my_realm>/account, /auth/admin/<my_realm>/console, so I deleted the applications security-admin-console, account etc. from my realm. Is it possible to completely disable all web-frontends to this realm/application as some urls remain accessible? The JSON realm description from a GET /auth/realms/<my_realm> also still lists token-service, account-service and admin-api.

I also set bearer-only to true in my adapter config to disable the 302
redirects to the login web-frontend and instead return 401 unauthorized,
although my realm is configured as public to provide the direct access
grant api.

I also do not want to expose the admin master console and other web
services related to my master realm externally. Is it possible to let
these listen only on the local loopback device, e.g. a configuration
option like the socket-binding of wildfly?

I really like keycloak, though I think it is currently more dedicated to
browser applications than mobile ones. Are there any plans for the
future to adapt to special mobile client needs?

Best regards,
Benjamin


> >
> > Question regarding option C:
> > When creating users in my own database which serves as a federation
> > provider I loose some keycloak functionality like Email verification and
> > so on, right?
> >
> > I am also not sure which option to use. What would you suggest.
> >
> > Feature request:
> > It would be great to have a keycloak REST API for registration and user
> > self-service in order to fulfill the demands of mobile applications.
> >
> > Best regards,
> > Benjamin
> 

-- 

[alphaApps] mobile development

Benjamin Hansmann

Nosthoffenstra?e 46
D-40589 D?sseldorf
Germany

Mobile: +49 (0) 177 249 47 47
Email: b.hansmann at alphaapps.de


From Henk.Laracker at planonsoftware.com  Mon Apr 20 15:02:58 2015
From: Henk.Laracker at planonsoftware.com (Henk Laracker)
Date: Mon, 20 Apr 2015 21:02:58 +0200
Subject: [keycloak-user] Tomcat with 2 application
In-Reply-To: <CAAdSQ6iLA=jUUdkV_gdP6DnU+Rm3uzQw1iVTJLvJb3g6Kv=DWQ@mail.gmail.com>
References: <D1506B5C.1B3B5%henk.laracker@planonsoftware.com>
	<CAAdSQ6iLA=jUUdkV_gdP6DnU+Rm3uzQw1iVTJLvJb3g6Kv=DWQ@mail.gmail.com>
Message-ID: <D15B19C1.1B87B%henk.laracker@planonsoftware.com>

Carlos,

If you search in the maillist, you will see that there is a bug in keycloak which has to with cors, we are waiting for a fix.

Regards,
Henk


From: Carlos Feria <carlosthe19916 at gmail.com<mailto:carlosthe19916 at gmail.com>>
Date: Monday 20 April 2015 17:19
To: Henk Laracker <henk.laracker at planonsoftware.com<mailto:henk.laracker at planonsoftware.com>>
Subject: Re: [keycloak-user] Tomcat with 2 application

Hello, i have the same problem as you, could you solve your problem? please tell me hoy you solve your problem with No 'Access-Control-Allow-Origin'

2015-04-12 11:35 GMT-05:00 Henk Laracker <Henk.Laracker at planonsoftware.com<mailto:Henk.Laracker at planonsoftware.com>>:
Hi,

I have a tomcat 7 running with two web applications deployed , called ROOT and web client. I created a realm in keycloak and two applications. Configures tomcat with the correct json files. When I log in in Root it works fine, when I login in web client it works fine. But the following is the case. Both application are not owned by my , so I can not change the code. I login in ROOT, this application connects to web client through a rest call, this restcall results in a redirect to keycloak because I?m not logged in. the result of this is :
XMLHttpRequest cannot load https://keycloak-accdev.planoncloud.com/auth/realms/auth/protocol/openid-co?atorDataService&state=10%2Ff14baad8-c385-4221-b86a-0ac2f0cf8d6a&login=true. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'https://auth-proddev.planoncloud.com' is therefore not allowed access.
I know that this has something todo with CORS, so I added  the settings:

"enable-cors" : true,
"cors-max-age" : 1000,
"cors-allowed-methods" : "POST, PUT, DELETE, GET?,

To the json file. And added the keycloak url to web origin of both apps in the keycloak manager, but still I got the same result. What do I do wrong? Please advice.

Henk

_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user



--
Carlos E. Feria Vila
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150420/6d065f54/attachment.html 

From hernan.metaute at ceiba.com.co  Mon Apr 20 17:49:56 2015
From: hernan.metaute at ceiba.com.co (Hernan Dario Metaute Sarmiento)
Date: Mon, 20 Apr 2015 16:49:56 -0500
Subject: [keycloak-user] REST client credentials
Message-ID: <CAGvMg3B+mER2Os5wjt+H32htv9TLe9+ewXWMQkHmOFF1HpoOgg@mail.gmail.com>

Hi
I'm currently  developing an application that needs to access some user
data that is stored on the keycloak database. I could just write a database
access and query the user data myself (I need to get user name, last name,
email and the data from the registration login form that is stored on a
keycloak database)
As a general info I'm using a mongo database for my app data and a separate
database in mongo for keycloak specific data
I have been trying to access the rest API detailed here
http://docs.jboss.org/keycloak/docs/1.1.0.Final/rest-api/admin/realms/%7Brealm%7D/users/index.html
in specific I'm trying to make a request like

GET /admin/realms/{realm}/users?search=firstName=John

but I'm having trouble getting the credentials right (I have an admin
username and admin password for the master realm)

I don't see in the documentation how to set the credentials as headers or
as payload on the GET request.
Could someone give me some hints as to how could I leverage the API for
this purpose?
Thanks in advance for your tome

-- 

*Hern?n Metaute*
Arquitecto

*Ceiba Software *(57 4) 444 5 111 Ext 110
Cl 8 B  65 - 191 Of 409, Centro Empresarial Puertoseco ? Medell?n, Colombia
Visite nuestro sitio www.ceiba.co <http://www.ceiba.com.co/>
________________________________________
BEste mensaje, incluido su adjunto, es confidencial y puede ser
privilegiado. Si usted no es su destinatario, por favor notifique al
emisor, luego destruya la comunicacion y todas las copias. Usted no debe
copiar, distribuir y/o revelar esta comunicacion parcial o totalmente sin
autorizaci?n del emisor.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150420/45574449/attachment-0001.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.png
Type: image/png
Size: 8377 bytes
Desc: not available
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20150420/45574449/attachment-0001.png 

From stian at redhat.com  Tue Apr 21 02:49:38 2015
From: stian at redhat.com (Stian Thorgersen)
Date: Tue, 21 Apr 2015 02:49:38 -0400 (EDT)
Subject: [keycloak-user] REST client credentials
In-Reply-To: <CAGvMg3B+mER2Os5wjt+H32htv9TLe9+ewXWMQkHmOFF1HpoOgg@mail.gmail.com>
References: <CAGvMg3B+mER2Os5wjt+H32htv9TLe9+ewXWMQkHmOFF1HpoOgg@mail.gmail.com>
Message-ID: <953586302.3845220.1429598978467.JavaMail.zimbra@redhat.com>

See examples:

https://github.com/keycloak/keycloak/tree/master/examples/admin-client
https://github.com/keycloak/keycloak/tree/master/examples/demo-template/admin-access-app

----- Original Message -----
> From: "Hernan Dario Metaute Sarmiento" <hernan.metaute at ceiba.com.co>
> To: keycloak-user at lists.jboss.org
> Sent: Monday, 20 April, 2015 11:49:56 PM
> Subject: [keycloak-user] REST client credentials
> 
> Hi
> I'm currently developing an application that needs to access some user data
> that is stored on the keycloak database. I could just write a database
> access and query the user data myself (I need to get user name, last name,
> email and the data from the registration login form that is stored on a
> keycloak database)
> As a general info I'm using a mongo database for my app data and a separate
> database in mongo for keycloak specific data
> I have been trying to access the rest API detailed here
> http://docs.jboss.org/keycloak/docs/1.1.0.Final/rest-api/admin/realms/%7Brealm%7D/users/index.html
> in specific I'm trying to make a request like
> 
> GET /admin/realms/{realm}/users?search=firstName=John
> but I'm having trouble getting the credentials right (I have an admin
> username and admin password for the master realm)
> 
> I don't see in the documentation how to set the credentials as headers or as
> payload on the GET request.
> Could someone give me some hints as to how could I leverage the API for this
> purpose?
> Thanks in advance for your tome
> 
> --
> 
> 
> 
> Hern?n Metaute
> Arquitecto
> Ceiba Software
> (57 4) 444 5 111 Ext 110
> Cl 8 B 65 - 191 Of 409, Centro Empresarial Puertoseco ? Medell?n, Colombia
> Visite nuestro sitio www.ceiba.co ________________________________________
> BEste mensaje, incluido su adjunto, es confidencial y puede ser privilegiado.
> Si usted no es su destinatario, por favor notifique al emisor, luego
> destruya la comunicacion y todas las copias. Usted no debe copiar,
> distribuir y/o revelar esta comunicacion parcial o totalmente sin
> autorizaci?n del emisor.
> 
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user


From jayblanc at gmail.com  Tue Apr 21 06:14:39 2015
From: jayblanc at gmail.com (=?UTF-8?B?SsOpcsO0bWUgQmxhbmNoYXJk?=)
Date: Tue, 21 Apr 2015 10:14:39 +0000
Subject: [keycloak-user] How touser Servlet OAuth Client
Message-ID: <CAPNq5vYA0E1HdwR4mUzF0R2SyfaUfGc+u4Pc4bFvYJwuuKX9RA@mail.gmail.com>

Hi all,

I'm trying to protect a servlet application which can be accessed either as
anonymous user and as authenticated user. Some resources are protected and
my application takes in charge the access control (not role based) so I
can't use the war protection using role user constraint.
In this case I've removed the role constraint in the web.xml and the
keycloak wildfly (undertow) adapter let me access the application as
unauthentified user (anonymous) which is perfect.
What I want to handle on some AccessDeniedException is to redirect the user
to the authentication server manually. In this case, user authentified an
come back to the protected URL but is no more anonymous but a authentified
user.
Is ther is a way to handle this redirection to the authentication server
manually (I don't know where to store the state variable allowing keycloak
wildfly adapter to handle properly the auth redirect that include the code).

Best regards, J?r?me.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150421/ff944155/attachment.html 

From emorny at gmail.com  Tue Apr 21 08:30:51 2015
From: emorny at gmail.com (Edem Morny)
Date: Tue, 21 Apr 2015 12:30:51 +0000
Subject: [keycloak-user] Securing Pentaho in Tomcat
Message-ID: <1429619451.4432.14.camel@localhost.localdomain>

Hi,

I'm wondering if anybody has any tips on replacing Pentaho's login with
SSO via keycloak. Apparently it works with CAS, but although I tried to
follow the instructions on installing the tomcat adapters for keycloak,
I haven't had any luck.

Our application is already secured via keycloak, but needs integration
with Pentaho dashboards and document management via Alfresco, so I was
hoping keycloack can be all that we need for single sign-on. As of now
Pentaho is the more critical need.

Any pointers will really be appreciated.


-- 
Edem Morny
CTO,
Queauji Consulting Ltd
==================
Health Care Solutions and  Business Intelligence

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150421/f5a88246/attachment.html 

From b.hansmann at alphaapps.de  Tue Apr 21 11:13:28 2015
From: b.hansmann at alphaapps.de (Benjamin Hansmann [alphaApps])
Date: Tue, 21 Apr 2015 17:13:28 +0200
Subject: [keycloak-user] keycloak admin-client
Message-ID: <1429629208.7368.7.camel@devs.alphaapps.de>

When using the keycloak admin-client library in my servlet, it seems to
fail unmarshalling the JSON authorization response. I think that
admin-client/keycloak-core relies on resteasy-jackskon-provider where my
servlet uses resteasy-jackson2-provider. Maybe this is the root of the
cause. Any ideas?

17:00:50,910 ERROR [io.undertow.request] (default task-4) UT005023:
Exception handling request to /services/users:
org.jboss.resteasy.spi.UnhandledException:
javax.ws.rs.client.ResponseProcessingException:
javax.ws.rs.ProcessingException:
com.fasterxml.jackson.databind.exc.UnrecognizedPropertyException:
Unrecognized field "access_token" (class
org.keycloak.representations.AccessTokenResponse), not marked as
ignorable (9 known properties: "notBeforePolicy", "otherClaims",
"tokenType", "token", "expiresIn", "sessionState", "refreshExpiresIn",
"idToken", "refreshToken"])
 at [Source: org.apache.http.conn.EofSensorInputStream at 31df042a; line:
1, column: 18] (through reference chain:
org.keycloak.representations.AccessTokenResponse["access_token"])

-- 

[alphaApps] mobile development

Benjamin Hansmann

Nosthoffenstra?e 46
D-40589 D?sseldorf
Germany

Mobile: +49 (0) 177 249 47 47
Email: b.hansmann at alphaapps.de


From mposolda at redhat.com  Tue Apr 21 11:58:58 2015
From: mposolda at redhat.com (Marek Posolda)
Date: Tue, 21 Apr 2015 17:58:58 +0200
Subject: [keycloak-user] keycloak admin-client
In-Reply-To: <1429629208.7368.7.camel@devs.alphaapps.de>
References: <1429629208.7368.7.camel@devs.alphaapps.de>
Message-ID: <553673C2.609@redhat.com>

Is it an option for you to switch to jackson1 provider? It should be 
possible by adding the file WEB-INF/jboss-deployment-structure.xml into 
your WAR with the content like this: 
https://github.com/keycloak/keycloak/blob/master/examples/admin-client/src/main/webapp/WEB-INF/jboss-deployment-structure.xml

Marek

On 21.4.2015 17:13, Benjamin Hansmann [alphaApps] wrote:
> When using the keycloak admin-client library in my servlet, it seems to
> fail unmarshalling the JSON authorization response. I think that
> admin-client/keycloak-core relies on resteasy-jackskon-provider where my
> servlet uses resteasy-jackson2-provider. Maybe this is the root of the
> cause. Any ideas?
>
> 17:00:50,910 ERROR [io.undertow.request] (default task-4) UT005023:
> Exception handling request to /services/users:
> org.jboss.resteasy.spi.UnhandledException:
> javax.ws.rs.client.ResponseProcessingException:
> javax.ws.rs.ProcessingException:
> com.fasterxml.jackson.databind.exc.UnrecognizedPropertyException:
> Unrecognized field "access_token" (class
> org.keycloak.representations.AccessTokenResponse), not marked as
> ignorable (9 known properties: "notBeforePolicy", "otherClaims",
> "tokenType", "token", "expiresIn", "sessionState", "refreshExpiresIn",
> "idToken", "refreshToken"])
>   at [Source: org.apache.http.conn.EofSensorInputStream at 31df042a; line:
> 1, column: 18] (through reference chain:
> org.keycloak.representations.AccessTokenResponse["access_token"])
>


From mposolda at redhat.com  Tue Apr 21 12:12:52 2015
From: mposolda at redhat.com (Marek Posolda)
Date: Tue, 21 Apr 2015 18:12:52 +0200
Subject: [keycloak-user] How touser Servlet OAuth Client
In-Reply-To: <CAPNq5vYA0E1HdwR4mUzF0R2SyfaUfGc+u4Pc4bFvYJwuuKX9RA@mail.gmail.com>
References: <CAPNq5vYA0E1HdwR4mUzF0R2SyfaUfGc+u4Pc4bFvYJwuuKX9RA@mail.gmail.com>
Message-ID: <55367704.7020302@redhat.com>

You can take a look at our examples for how to use ServletOAuthClient. 
Hopefully it could help with your usecase:
https://github.com/keycloak/keycloak/tree/master/examples/demo-template/third-party
https://github.com/keycloak/keycloak/tree/master/examples/demo-template/third-party-cdi

Marek

On 21.4.2015 12:14, J?r?me Blanchard wrote:
> Hi all,
>
> I'm trying to protect a servlet application which can be accessed 
> either as anonymous user and as authenticated user. Some resources are 
> protected and my application takes in charge the access control (not 
> role based) so I can't use the war protection using role user constraint.
> In this case I've removed the role constraint in the web.xml and the 
> keycloak wildfly (undertow) adapter let me access the application as 
> unauthentified user (anonymous) which is perfect.
> What I want to handle on some AccessDeniedException is to redirect the 
> user to the authentication server manually. In this case, user 
> authentified an come back to the protected URL but is no more 
> anonymous but a authentified user.
> Is ther is a way to handle this redirection to the authentication 
> server manually (I don't know where to store the state variable 
> allowing keycloak wildfly adapter to handle properly the auth redirect 
> that include the code).
>
> Best regards, J?r?me.
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150421/9a05aff8/attachment.html 

From b.hansmann at alphaapps.de  Tue Apr 21 12:16:44 2015
From: b.hansmann at alphaapps.de (Benjamin Hansmann [alphaApps])
Date: Tue, 21 Apr 2015 18:16:44 +0200
Subject: [keycloak-user] keycloak admin-client
In-Reply-To: <553673C2.609@redhat.com>
References: <1429629208.7368.7.camel@devs.alphaapps.de>
	<553673C2.609@redhat.com>
Message-ID: <1429632932.4933.3.camel@devs.alphaapps.de>

Hi Marek,

thanks for your reply. I switched to the jackson1 provider and it
worked. Thanks.

Any ideas on my last thread? Is it possible to let the admin web console
of the master realm listen only on local loopback interface?

Best regards,
Benjamin

On Tue, 2015-04-21 at 17:58 +0200, Marek Posolda wrote:
> Is it an option for you to switch to jackson1 provider? It should be 
> possible by adding the file WEB-INF/jboss-deployment-structure.xml into 
> your WAR with the content like this: 
> https://github.com/keycloak/keycloak/blob/master/examples/admin-client/src/main/webapp/WEB-INF/jboss-deployment-structure.xml
> 
> Marek
> 
> On 21.4.2015 17:13, Benjamin Hansmann [alphaApps] wrote:
> > When using the keycloak admin-client library in my servlet, it seems to
> > fail unmarshalling the JSON authorization response. I think that
> > admin-client/keycloak-core relies on resteasy-jackskon-provider where my
> > servlet uses resteasy-jackson2-provider. Maybe this is the root of the
> > cause. Any ideas?
> >
> > 17:00:50,910 ERROR [io.undertow.request] (default task-4) UT005023:
> > Exception handling request to /services/users:
> > org.jboss.resteasy.spi.UnhandledException:
> > javax.ws.rs.client.ResponseProcessingException:
> > javax.ws.rs.ProcessingException:
> > com.fasterxml.jackson.databind.exc.UnrecognizedPropertyException:
> > Unrecognized field "access_token" (class
> > org.keycloak.representations.AccessTokenResponse), not marked as
> > ignorable (9 known properties: "notBeforePolicy", "otherClaims",
> > "tokenType", "token", "expiresIn", "sessionState", "refreshExpiresIn",
> > "idToken", "refreshToken"])
> >   at [Source: org.apache.http.conn.EofSensorInputStream at 31df042a; line:
> > 1, column: 18] (through reference chain:
> > org.keycloak.representations.AccessTokenResponse["access_token"])
> >
> 

-- 

[alphaApps] mobile development

Benjamin Hansmann

Nosthoffenstra?e 46
D-40589 D?sseldorf
Germany

Mobile: +49 (0) 177 249 47 47
Email: b.hansmann at alphaapps.de


From mposolda at redhat.com  Tue Apr 21 12:22:58 2015
From: mposolda at redhat.com (Marek Posolda)
Date: Tue, 21 Apr 2015 18:22:58 +0200
Subject: [keycloak-user] always-refresh-token and admin rest api
In-Reply-To: <1429535518.4510.42.camel@devs.alphaapps.de>
References: <1429270235.4937.26.camel@devs.alphaapps.de>	
	<55312B5F.2050504@redhat.com>
	<1429535518.4510.42.camel@devs.alphaapps.de>
Message-ID: <55367962.8090809@redhat.com>

Adding list back. Make sure to click on "Reply all" as you have much 
bigger chance that someone will reply you :-)

On 20.4.2015 15:11, Benjamin Hansmann [alphaApps] wrote:
> On Fri, 2015-04-17 at 17:48 +0200, Marek Posolda wrote:
>> On 17.4.2015 13:30, Benjamin Hansmann [alphaApps] wrote:
>>> Greetings. Following up my post from yesterday I have more specific
>>> questions.
>>>
>>> I plan to use keycloak with my REST service for mobile apps as follows:
>>>
>>> Option A:
>>> 1 A user sends a REST registration request to my webapp and the webapp
>>> adapts the request to the local keycloak admin rest api.
>>> 2 When the user is created he can then authenticate to keycloak via the
>>> direct access grant rest api and receives an access token.
>>> 3 The issued access token should be valid for only one request, thus I
>>> specified the option "always-refresh-token": true in my webapp's
>>> keycloak.json file.
>>>
>>> Option B:
>>> 1 Mobile app forms the HTTP POST request to the user registration page.
>>> 2 and 3 as in Option A
>>>
>>> Option C:
>>> 1 Use a user federation provider and create users in my webapp's
>>> datasource.
>>> 2 and 3 as in Option A
>>>
>>> Question regarding all options:
>>> How is the "always-refresh-token" option supposed to work? I supplied
>>> the option as stated above but I am still able to reuse access tokens
>>> that were issued from the direct access grant service. Another question
>>> is how this token refreshing should be implemented on the client side.
>>> Do I have to invoke on the direct access grant api to obtain a new token
>>> for every request or can the issued "refresh_token" be used on
>>> subsequent requests and a new refresh token is somehow included in the
>>> response of my service?
>> This option is used for servlet adapters. Each HTTP request to the
>> servlet frontend application (For example "customer-portal" or
>> "product-portal" from our demo) will perform sending back-channel
>> request to the Keycloak auth-server and will refresh the token. You can
>> try change our demo and add the option for example to the
>> customer-portal keycloak.json:
>> https://github.com/keycloak/keycloak/blob/master/examples/demo-template/customer-app/src/main/webapp/WEB-INF/keycloak.json
>> and then check in the application that accessToken is different in each
>> request:
>> https://github.com/keycloak/keycloak/blob/master/examples/demo-template/customer-app/src/main/java/org/keycloak/example/CustomerDatabaseClient.java#L56
>> .
>>
>> This option has no effect for bearer-only applications as those are
>> authenticated by accessToken sent from different application and they
>> don't support any token refreshing at all. It also doesn't have any
>> effect for direct grant API (we don't have any adapter for direct grant
>> API. People are expected to invoke the HTTP request to retrieve
>> accessToken from auth-server with direct grant API by themselves as
>> shown in the documentation or in the admin-access-app example)
>>
>> Marek
> Thanks Marek. With tcpdump I could see that access tokens are refreshed
> on each request when logging into my realm through the keycloak web
> front-end. These mechanisms seem to be based on cookies so there are not
> feasible for my application.
>
> As always-refresh-token doesn't work with the direct grant api I will do
> it as follows:
> - Mobile application will login with saved password
> through /auth/realms/<my_realm>/tokens/grants/access
> - When token expired (after 3 minutes) on subsequent request, mobile
> application will refresh token
> through /auth/realms/<my_realm>/tokens/refresh
> - If session (and issued refresh_token) expired due to inactivity (after
> 10 minutes) automatically login again
> - Set revocation policy on sensible rest requests to something >3
> minutes
> - Implement REST adapter to the keycloak admin api to let users register
> and manage their profiles
>
> In this scenario I do not need the web-frontend for users,
> e.g. /auth/realms/<my_realm>/protocol/openid-connect, /auth/realms/<my_realm>/account, /auth/admin/<my_realm>/console, so I deleted the applications security-admin-console, account etc. from my realm. Is it possible to completely disable all web-frontends to this realm/application as some urls remain accessible? The JSON realm description from a GET /auth/realms/<my_realm> also still lists token-service, account-service and admin-api.
>
> I also set bearer-only to true in my adapter config to disable the 302
> redirects to the login web-frontend and instead return 401 unauthorized,
> although my realm is configured as public to provide the direct access
> grant api.
>
> I also do not want to expose the admin master console and other web
> services related to my master realm externally. Is it possible to let
> these listen only on the local loopback device, e.g. a configuration
> option like the socket-binding of wildfly?
Keycloak is just a WAR deployed similarly like any other war on WildFly 
or EAP6. So when starting Keycloak on Wildfly or EAP6, you can just use 
the option like:
./standalone.sh -b localhost

and it should be bound just to the localhost. Is it sufficient for you?
>
> I really like keycloak, though I think it is currently more dedicated to
> browser applications than mobile ones. Are there any plans for the
> future to adapt to special mobile client needs?
I think there are plans and AFAIK we rely on the help from the aerogear 
team to help with the mobile adapters. I don't know the details and 
timeframes, but maybe someone else on this list has more info :-)

Marek
>
> Best regards,
> Benjamin
>
>
>>> Question regarding option C:
>>> When creating users in my own database which serves as a federation
>>> provider I loose some keycloak functionality like Email verification and
>>> so on, right?
>>>
>>> I am also not sure which option to use. What would you suggest.
>>>
>>> Feature request:
>>> It would be great to have a keycloak REST API for registration and user
>>> self-service in order to fulfill the demands of mobile applications.
>>>
>>> Best regards,
>>> Benjamin


From Jamie.Beznoski at cira.ca  Tue Apr 21 12:27:16 2015
From: Jamie.Beznoski at cira.ca (Jamie Beznoski)
Date: Tue, 21 Apr 2015 16:27:16 +0000
Subject: [keycloak-user] Do realm public keys expire?
Message-ID: <38B344567C5B784C838C0361363DE40191B2530D@EXCH-01.CORP.CIRA.CA>

Hi,

We set up a realm to use in conjunction with a JBoss login module - the BearerTokenLoginModule available here:
https://github.com/keycloak/keycloak/blob/master/integration/adapter-core/src/main/java/org/keycloak/adapters/jaas/BearerTokenLoginModule.java

Our application in question is a standalone Java app that invokes EJBs remotely on our JBoss server.  The JBoss EJB remoting subsystem is secured by the BearerTokenLoginModule.

This configuration worked well for us for several months, but last week we started to see issues.  Our client app could no longer authenticate against the JBoss server.  We generated a new realm public key (Settings -> Keys -> Generate new keys) and the issue was resolved.  Unfortunately, we were fire-fighting at the time and can't provide you with much more information than that.

Anyway, my (hopefully easy) question is: do the realm keys expire after a certain period?

Thanks,
Jamie Beznoski
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150421/40a9db28/attachment.html 

From bburke at redhat.com  Tue Apr 21 13:09:09 2015
From: bburke at redhat.com (Bill Burke)
Date: Tue, 21 Apr 2015 13:09:09 -0400
Subject: [keycloak-user] Do realm public keys expire?
In-Reply-To: <38B344567C5B784C838C0361363DE40191B2530D@EXCH-01.CORP.CIRA.CA>
References: <38B344567C5B784C838C0361363DE40191B2530D@EXCH-01.CORP.CIRA.CA>
Message-ID: <55368435.8010209@redhat.com>

I thought it was only certificates that expire.  You have a stack 
trace/log file available?

On 4/21/2015 12:27 PM, Jamie Beznoski wrote:
> Hi,
>
> We set up a realm to use in conjunction with a JBoss login module ? the
> BearerTokenLoginModule available here:
>
> https://github.com/keycloak/keycloak/blob/master/integration/adapter-core/src/main/java/org/keycloak/adapters/jaas/BearerTokenLoginModule.java
>
>
> Our application in question is a standalone Java app that invokes EJBs
> remotely on our JBoss server.  The JBoss EJB remoting subsystem is
> secured by the BearerTokenLoginModule.
>
> This configuration worked well for us for several months, but last week
> we started to see issues.  Our client app could no longer authenticate
> against the JBoss server.  We generated a new realm public key (Settings
> -> Keys -> Generate new keys) and the issue was resolved.
> Unfortunately, we were fire-fighting at the time and can?t provide you
> with much more information than that.
>
> Anyway, my (hopefully easy) question is: do the realm keys expire after
> a certain period?
>
> Thanks,
>
> Jamie Beznoski
>
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

-- 
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com

From Jamie.Beznoski at cira.ca  Tue Apr 21 13:47:19 2015
From: Jamie.Beznoski at cira.ca (Jamie Beznoski)
Date: Tue, 21 Apr 2015 17:47:19 +0000
Subject: [keycloak-user] Do realm public keys expire?
In-Reply-To: <55368435.8010209@redhat.com>
References: <38B344567C5B784C838C0361363DE40191B2530D@EXCH-01.CORP.CIRA.CA>
	<55368435.8010209@redhat.com>
Message-ID: <38B344567C5B784C838C0361363DE40191B2537A@EXCH-01.CORP.CIRA.CA>

Thanks for the reply, Bill.  See below for stack trace.

Not sure if it's related, though.... our client app does an anonymous login to JBoss remoting at startup.  These anonymous logins always throw an exception in our BearerTokenLoginModule, and they are generally harmless  (JBoss LoginContext consumes them and allows our client app access anyway).  The below was logged at ERROR level in our JBoss server log, which doesn't usually happen.

Wish I could give you more, but this was an outage that affected several people, so we were more concerned with a quick resolution than an investigation :)

Thanks,
Jamie

org.keycloak.VerificationException: Couldn't parse token
 	at org.keycloak.RSATokenVerifier.verifyToken(RSATokenVerifier.java:24)
 	at org.keycloak.RSATokenVerifier.verifyToken(RSATokenVerifier.java:16)
 	at ca.cira.jboss.loginmodules.AbstractKeycloakLoginModule.bearerAuth(AbstractKeycloakLoginModule.java:187)
 	at ca.cira.jboss.loginmodules.BearerTokenLoginModule.doAuth(BearerTokenLoginModule.java:18)
 	at ca.cira.jboss.loginmodules.AbstractKeycloakLoginModule.login(AbstractKeycloakLoginModule.java:95)
 	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
 	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
 	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
 	at java.lang.reflect.Method.invoke(Method.java:606)
 	at javax.security.auth.login.LoginContext.invoke(LoginContext.java:762)
 	at javax.security.auth.login.LoginContext.access$000(LoginContext.java:203)
 	at javax.security.auth.login.LoginContext$4.run(LoginContext.java:690)
 	at javax.security.auth.login.LoginContext$4.run(LoginContext.java:688)
 	at java.security.AccessController.doPrivileged(Native Method)
 	at javax.security.auth.login.LoginContext.invokePriv(LoginContext.java:687)
 	at javax.security.auth.login.LoginContext.login(LoginContext.java:595)
 	at org.jboss.security.authentication.JBossCachedAuthenticationManager.defaultLogin(JBossCachedAuthenticationManager.java:408)
 	at org.jboss.security.authentication.JBossCachedAuthenticationManager.proceedWithJaasLogin(JBossCachedAuthenticationManager.java:345)
 	at org.jboss.security.authentication.JBossCachedAuthenticationManager.authenticate(JBossCachedAuthenticationManager.java:323)
 	at org.jboss.security.authentication.JBossCachedAuthenticationManager.isValid(JBossCachedAuthenticationManager.java:146)
 	at org.jboss.as.security.service.SimpleSecurityManager.authenticate(SimpleSecurityManager.java:446)
 	at org.jboss.as.security.service.SimpleSecurityManager.push(SimpleSecurityManager.java:347)
 	at org.jboss.as.ejb3.security.SecurityContextInterceptor$1.run(SecurityContextInterceptor.java:52)
 	at org.jboss.as.ejb3.security.SecurityContextInterceptor$1.run(SecurityContextInterceptor.java:48)
 	at org.jboss.as.ejb3.security.SecurityContextInterceptor.processInvocation(SecurityContextInterceptor.java:83)
 	at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
 	at org.jboss.as.ejb3.component.interceptors.ShutDownInterceptorFactory$1.processInvocation(ShutDownInterceptorFactory.java:64)
 	at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
 	at org.jboss.as.ejb3.component.interceptors.LoggingInterceptor.processInvocation(LoggingInterceptor.java:59)
 	at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
 	at org.jboss.as.ee.component.NamespaceContextInterceptor.processInvocation(NamespaceContextInterceptor.java:50)
 	at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
 	at org.jboss.as.ejb3.component.interceptors.AdditionalSetupInterceptor.processInvocation(AdditionalSetupInterceptor.java:55)
 	at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
 	at org.jboss.as.ee.component.TCCLInterceptor.processInvocation(TCCLInterceptor.java:45)
 	at org.jboss.invocation.InterceptorContext.proceed(InterceptorContext.java:288)
 	at org.jboss.invocation.ChainedInterceptor.processInvocation(ChainedInterceptor.java:61)
 	at org.jboss.as.ee.component.ViewService$View.invoke(ViewService.java:185)
 	at org.jboss.as.ejb3.remote.protocol.versionone.MethodInvocationMessageHandler.invokeMethod(MethodInvocationMessageHandler.java:329)
 	at org.jboss.as.ejb3.remote.protocol.versionone.MethodInvocationMessageHandler.access$100(MethodInvocationMessageHandler.java:70)
 	at org.jboss.as.ejb3.remote.protocol.versionone.MethodInvocationMessageHandler$1.run(MethodInvocationMessageHandler.java:203)
 	at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:471)
 	at java.util.concurrent.FutureTask.run(FutureTask.java:262)
 	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
 	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
 	at java.lang.Thread.run(Thread.java:745)
 	at org.jboss.threads.JBossThread.run(JBossThread.java:122)
 Caused by: java.lang.IllegalArgumentException: Parsing error
 	at org.keycloak.jose.jws.JWSInput.<init>(JWSInput.java:27)
 	at org.keycloak.RSATokenVerifier.verifyToken(RSATokenVerifier.java:22)


-----Original Message-----
From: keycloak-user-bounces at lists.jboss.org [mailto:keycloak-user-bounces at lists.jboss.org] On Behalf Of Bill Burke
Sent: April-21-15 1:09 PM
To: keycloak-user at lists.jboss.org
Subject: Re: [keycloak-user] Do realm public keys expire?

I thought it was only certificates that expire.  You have a stack trace/log file available?

On 4/21/2015 12:27 PM, Jamie Beznoski wrote:
> Hi,
>
> We set up a realm to use in conjunction with a JBoss login module - 
> the BearerTokenLoginModule available here:
>
> https://github.com/keycloak/keycloak/blob/master/integration/adapter-c
> ore/src/main/java/org/keycloak/adapters/jaas/BearerTokenLoginModule.ja
> va
>
>
> Our application in question is a standalone Java app that invokes EJBs 
> remotely on our JBoss server.  The JBoss EJB remoting subsystem is 
> secured by the BearerTokenLoginModule.
>
> This configuration worked well for us for several months, but last 
> week we started to see issues.  Our client app could no longer 
> authenticate against the JBoss server.  We generated a new realm 
> public key (Settings
> -> Keys -> Generate new keys) and the issue was resolved.
> Unfortunately, we were fire-fighting at the time and can't provide you 
> with much more information than that.
>
> Anyway, my (hopefully easy) question is: do the realm keys expire 
> after a certain period?
>
> Thanks,
>
> Jamie Beznoski
>
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

--
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com
_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user


From supittma at redhat.com  Tue Apr 21 14:37:56 2015
From: supittma at redhat.com (Summers Pittman)
Date: Tue, 21 Apr 2015 14:37:56 -0400
Subject: [keycloak-user] Keycloak Download link comments
Message-ID: <CAEQz2Cu6TbvBNMd2BjAdUCBgptDEFg89gvAe=72SzMLKmRL2NQ@mail.gmail.com>

1 ) `wget
http://sourceforge.net/projects/keycloak/files/latest/download?source=files`
downloads a zip file and not a tar.gz file like the text on
http://sourceforge.net/projects/keycloak/files/1.2.0.Beta1/ suggests.

2) Using source forge makes me feel dirty.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150421/c0e35330/attachment.html 

From chenkeong.yap at izeno.com  Wed Apr 22 00:25:04 2015
From: chenkeong.yap at izeno.com (Chen Keong Yap)
Date: Wed, 22 Apr 2015 12:25:04 +0800
Subject: [keycloak-user] Keycloak JMeter Load Test Script
Message-ID: <CAC2UnuVfp0ePuts7aXaVEe4kyoC0w4FXtA31hwVZ0-VMm5Fcxw@mail.gmail.com>

Hi Guys,

I saw there's a sample script for keycloak token testing and not SAML.

https://github.com/keycloak/keycloak/blob/master/testsuite/performance-web/src/test/jmeter/keycloak_web_perf_test.jmx

Can someone share with us the test script for SAML?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150422/240e582b/attachment.html 

From mposolda at redhat.com  Wed Apr 22 02:45:50 2015
From: mposolda at redhat.com (Marek Posolda)
Date: Wed, 22 Apr 2015 08:45:50 +0200
Subject: [keycloak-user] Keycloak JMeter Load Test Script
In-Reply-To: <CAC2UnuVfp0ePuts7aXaVEe4kyoC0w4FXtA31hwVZ0-VMm5Fcxw@mail.gmail.com>
References: <CAC2UnuVfp0ePuts7aXaVEe4kyoC0w4FXtA31hwVZ0-VMm5Fcxw@mail.gmail.com>
Message-ID: <5537439E.9060601@redhat.com>

Hi,

I don't think that we have something for SAML yet. We didn't much 
performance testing with SAML AFAIK.

Marek

On 22.4.2015 06:25, Chen Keong Yap wrote:
> Hi Guys,
>
> I saw there's a sample script for keycloak token testing and not SAML.
>
> https://github.com/keycloak/keycloak/blob/master/testsuite/performance-web/src/test/jmeter/keycloak_web_perf_test.jmx
>
> Can someone share with us the test script for SAML?
>
>
>
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150422/262c720e/attachment.html 

From stian at redhat.com  Wed Apr 22 05:17:31 2015
From: stian at redhat.com (Stian Thorgersen)
Date: Wed, 22 Apr 2015 05:17:31 -0400 (EDT)
Subject: [keycloak-user] Keycloak Download link comments
In-Reply-To: <CAEQz2Cu6TbvBNMd2BjAdUCBgptDEFg89gvAe=72SzMLKmRL2NQ@mail.gmail.com>
References: <CAEQz2Cu6TbvBNMd2BjAdUCBgptDEFg89gvAe=72SzMLKmRL2NQ@mail.gmail.com>
Message-ID: <614652480.4674311.1429694251347.JavaMail.zimbra@redhat.com>



----- Original Message -----
> From: "Summers Pittman" <supittma at redhat.com>
> To: keycloak-user at lists.jboss.org
> Sent: Tuesday, 21 April, 2015 8:37:56 PM
> Subject: [keycloak-user] Keycloak Download link comments
> 
> 1 ) `wget
> http://sourceforge.net/projects/keycloak/files/latest/download?source=files`
> downloads a zip file and not a tar.gz file like the text on
> http://sourceforge.net/projects/keycloak/files/1.2.0.Beta1/ suggests.

Nothing we can do about that as it's all down to how sourceforge picks the default download for your platform. You can use https://sourceforge.net/projects/keycloak/files/1.2.0.Beta1/keycloak-appliance-dist-all-1.2.0.Beta1.tar.gz/download

> 
> 2) Using source forge makes me feel dirty.

Don't then - get it from Maven Central, that's what I do ;)

http://central.maven.org/maven2/org/keycloak/keycloak-appliance-dist-all/1.2.0.Beta1/keycloak-appliance-dist-all-1.2.0.Beta1.tar.gz

> 
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From supittma at redhat.com  Wed Apr 22 08:08:02 2015
From: supittma at redhat.com (Summers Pittman)
Date: Wed, 22 Apr 2015 08:08:02 -0400
Subject: [keycloak-user] Keycloak Download link comments
In-Reply-To: <614652480.4674311.1429694251347.JavaMail.zimbra@redhat.com>
References: <CAEQz2Cu6TbvBNMd2BjAdUCBgptDEFg89gvAe=72SzMLKmRL2NQ@mail.gmail.com>
	<614652480.4674311.1429694251347.JavaMail.zimbra@redhat.com>
Message-ID: <CAEQz2CuJyeRxtkZ8W-OCYpxoWD7N9mreHfpHe-A5srvkO6-LMw@mail.gmail.com>

On Wed, Apr 22, 2015 at 5:17 AM, Stian Thorgersen <stian at redhat.com> wrote:

>
>
> ----- Original Message -----
> > From: "Summers Pittman" <supittma at redhat.com>
> > To: keycloak-user at lists.jboss.org
> > Sent: Tuesday, 21 April, 2015 8:37:56 PM
> > Subject: [keycloak-user] Keycloak Download link comments
> >
> > 1 ) `wget
> >
> http://sourceforge.net/projects/keycloak/files/latest/download?source=files`
> > downloads a zip file and not a tar.gz file like the text on
> > http://sourceforge.net/projects/keycloak/files/1.2.0.Beta1/ suggests.
>
> Nothing we can do about that as it's all down to how sourceforge picks the
> default download for your platform. You can use
> https://sourceforge.net/projects/keycloak/files/1.2.0.Beta1/keycloak-appliance-dist-all-1.2.0.Beta1.tar.gz/download


Thanks

>
>
> >
> > 2) Using source forge makes me feel dirty.
>
> Don't then - get it from Maven Central, that's what I do ;)
>
>
> http://central.maven.org/maven2/org/keycloak/keycloak-appliance-dist-all/1.2.0.Beta1/keycloak-appliance-dist-all-1.2.0.Beta1.tar.gz
>
> >
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150422/a34fc168/attachment.html 

From stian at redhat.com  Thu Apr 23 01:55:52 2015
From: stian at redhat.com (Stian Thorgersen)
Date: Thu, 23 Apr 2015 01:55:52 -0400 (EDT)
Subject: [keycloak-user] Keycloak Adapter without
	web.xml	security-constraint
In-Reply-To: <CALAqdu8ym=ato02FvM2Q_yF4g6=TkDqdmu107OsU4Gh2vzcVLw@mail.gmail.com>
References: <CALAqdu-EjwrWm_fidyrpZkMUDfFA2309xheAThkf3ADRXn3huw@mail.gmail.com>
	<5531710E.4020804@redhat.com>
	<CALAqdu8Js6u2ZOPF1OEo36bRXGAAAbdBF4FwqAwaOKDnc-q5kg@mail.gmail.com>
	<CALAqdu8ym=ato02FvM2Q_yF4g6=TkDqdmu107OsU4Gh2vzcVLw@mail.gmail.com>
Message-ID: <1446564260.5273515.1429768552686.JavaMail.zimbra@redhat.com>

Currently Keycloak adapters are only a way of integrating existing frameworks with Keycloak so adding a event handler etc wouldn't make much sense.

We have plans on the road-map for a CDI based adapter that gives more capabilities like what you're asking for, but in the mean time you'd need to look at PicketLink, DeltaSpike, or a way to do it with standard JEE security.

----- Original Message -----
> From: "Scott Rossillo" <srossillo at smartling.com>
> To: "Bill Burke" <bburke at redhat.com>
> Cc: keycloak-user at lists.jboss.org
> Sent: Monday, 20 April, 2015 2:50:26 AM
> Subject: Re: [keycloak-user] Keycloak Adapter without web.xml	security-constraint
> 
> Could we have a hook into application code to determine if a resource should
> be protected by Keycloak? Maybe an event handler?
> 
> b oolean shouldProtectResourse(HttpServletRequest)
> 
> On Friday, April 17, 2015, Scott Rossillo < srossillo at smartling.com > wrote:
> 
> 
> 
> I could work around that for interactive logins, but it wouldn?t work for
> application to application requests. Do you have any pointers on where I
> could start to manually trigger the adapter?
> 
> Do you think it?s a reasonable requirement to have the application determine
> if the adapter should be triggered? I feel it?s necessary for integration
> with applications that have to support more than one authentication
> mechanism.
> 
> Let me know.
> 
> Thanks in advance,
> Scott
> 
> 
> On Fri, Apr 17, 2015 at 4:46 PM, Bill Burke < bburke at redhat.com > wrote:
> 
> 
> Our adapters need a security constraint or they won't be triggered.
> 
> On 4/17/2015 4:34 PM, Scott Rossillo wrote:
> > When using a security mechanism, such as Spring Security, it?s possible
> > that multiple security mechanisms are in place or that only parts of an
> > application are secured via Keycloak, not a blanket path (e.g. /api/*).
> > 
> > What I?m trying to do is use the Spring?s authentication entrypoint to
> > direct to Keycloak (this part work somewhat) and have the Keycloak
> > adapter pick up from there (not working).
> > 
> > What?s the best way to handle this?
> > 
> > Thanks,
> > Scott
> > 
> > 
> > 
> > 
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
> > 
> 
> --
> Bill Burke
> JBoss, a division of Red Hat
> http://bill.burkecentral.com
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
> 
> 
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user


From b.hansmann at alphaapps.de  Thu Apr 23 08:41:55 2015
From: b.hansmann at alphaapps.de (Benjamin Hansmann [alphaApps])
Date: Thu, 23 Apr 2015 14:41:55 +0200
Subject: [keycloak-user] Email verification and get admin-client exception
	entitiy
Message-ID: <1429792915.4339.10.camel@devs.alphaapps.de>

Greetings once again. Two more questions:

- Is there any way to trigger/send a verification email other than
logging in through the web frontend? I created the user through the
admin-client and the user will use the direct grant api to login.

- When using the admin-client to create a user I want to handle/forward
the response body. E.g. when a username already exists a
ClientErrorException is thrown which includes a
javax.ws.rs.core.Response with Status.CONFLICT. But there does not seem
to be an entitiy/body in this Response. When I use the Admin REST API
directly I will get: { "errorMessage" : "User exists with
same username" }. Is there a way to obtain it when using the
admin-client?

Thanks and best wishes,
Benjamin
-- 

[alphaApps] mobile development

Benjamin Hansmann

Nosthoffenstra?e 46
D-40589 D?sseldorf
Germany

Mobile: +49 (0) 177 249 47 47
Email: b.hansmann at alphaapps.de


From jayblanc at gmail.com  Thu Apr 23 09:35:14 2015
From: jayblanc at gmail.com (=?UTF-8?B?SsOpcsO0bWUgQmxhbmNoYXJk?=)
Date: Thu, 23 Apr 2015 13:35:14 +0000
Subject: [keycloak-user] How touser Servlet OAuth Client
In-Reply-To: <55367704.7020302@redhat.com>
References: <CAPNq5vYA0E1HdwR4mUzF0R2SyfaUfGc+u4Pc4bFvYJwuuKX9RA@mail.gmail.com>
	<55367704.7020302@redhat.com>
Message-ID: <CAPNq5vYTB2YnNXcPQb+CDSyT9s2oopZvX99NbhS2DrYY62t2qQ@mail.gmail.com>

Hi,
I wonder that the Servlet OAuth Client won't propagate authentication to
wildfy EJB layer... Am I wrong ?
J?r?me.

Le mar. 21 avr. 2015 ? 18:13, Marek Posolda <mposolda at redhat.com> a ?crit :

>  You can take a look at our examples for how to use ServletOAuthClient.
> Hopefully it could help with your usecase:
>
> https://github.com/keycloak/keycloak/tree/master/examples/demo-template/third-party
>
> https://github.com/keycloak/keycloak/tree/master/examples/demo-template/third-party-cdi
>
> Marek
>
>
> On 21.4.2015 12:14, J?r?me Blanchard wrote:
>
>    Hi all,
>
>  I'm trying to protect a servlet application which can be accessed either
> as anonymous user and as authenticated user. Some resources are protected
> and my application takes in charge the access control (not role based) so I
> can't use the war protection using role user constraint.
>  In this case I've removed the role constraint in the web.xml and the
> keycloak wildfly (undertow) adapter let me access the application as
> unauthentified user (anonymous) which is perfect.
>  What I want to handle on some AccessDeniedException is to redirect the
> user to the authentication server manually. In this case, user authentified
> an come back to the protected URL but is no more anonymous but a
> authentified user.
>  Is ther is a way to handle this redirection to the authentication server
> manually (I don't know where to store the state variable allowing keycloak
> wildfly adapter to handle properly the auth redirect that include the code).
>
>  Best regards, J?r?me.
>
>
> _______________________________________________
> keycloak-user mailing listkeycloak-user at lists.jboss.orghttps://lists.jboss.org/mailman/listinfo/keycloak-user
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150423/9828edb8/attachment.html 

From delkant at gmail.com  Thu Apr 23 09:56:26 2015
From: delkant at gmail.com (Rodrigo Del Canto)
Date: Thu, 23 Apr 2015 09:56:26 -0400
Subject: [keycloak-user] Unable to start Keycloak beta on AWS VM - HTTPS
	required
In-Reply-To: <261540225.39078942.1409119731885.JavaMail.zimbra@redhat.com>
References: <759CBD22-981B-4E64-B546-7AF96CD064F6@icloud.com>
	<261540225.39078942.1409119731885.JavaMail.zimbra@redhat.com>
Message-ID: <CAHedXPY4YzyaNrsRbZha_G=h9jt5a45GjrWHMZdgvfezLfnqyg@mail.gmail.com>

Hello!

I'm trying to do this on AWS too. I'm using
keycloak-appliance-dist-all-1.2.0.Beta1 , is there a way to disabled the
https by a configuration parameter?? I need to create a Dev environment
real quick and I don't want to set the https for that, I couldn't find a
way or file to do this.

Thanks a lot!!

Rodrigo.

On Wed, Aug 27, 2014 at 2:08 AM, Stian Thorgersen <stian at redhat.com> wrote:

> Yep, the old approach was more convenient. With local VMs you'll most
> likely be using a IP address in the range that we permit non-https to when
> set to external (http://en.wikipedia.org/wiki/Private_network). For PaaS
> (i.e. OpenShift) the provider usually sets up https for you so it's not a
> problem, but I guess the remaining issue is for IaaS (i.e. AWS). If there's
> demand for it we could add some mechanism to disable it for dev without
> having to use the admin console.
>
> ----- Original Message -----
> > From: "Christina Lau" <christinalau28 at icloud.com>
> > To: keycloak-user at lists.jboss.org
> > Sent: Tuesday, 26 August, 2014 10:20:21 PM
> > Subject: Re: [keycloak-user] Unable to start Keycloak beta on AWS VM -
>       HTTPS   required
> >
> > Thx. I was able to zip up my laptop version and ssh over to make it work
> > (i.e. bring up admin console). With RHEL VMs, there is no easy way to
> bring
> > up a local browser so the old defaults were more convenient for those
> that
> > do dev/test in the cloud.
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
> >
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150423/9f9e486e/attachment.html 

From stian at redhat.com  Thu Apr 23 10:01:13 2015
From: stian at redhat.com (Stian Thorgersen)
Date: Thu, 23 Apr 2015 10:01:13 -0400 (EDT)
Subject: [keycloak-user] Unable to start Keycloak beta on AWS VM - HTTPS
 required
In-Reply-To: <CAHedXPY4YzyaNrsRbZha_G=h9jt5a45GjrWHMZdgvfezLfnqyg@mail.gmail.com>
References: <759CBD22-981B-4E64-B546-7AF96CD064F6@icloud.com>
	<261540225.39078942.1409119731885.JavaMail.zimbra@redhat.com>
	<CAHedXPY4YzyaNrsRbZha_G=h9jt5a45GjrWHMZdgvfezLfnqyg@mail.gmail.com>
Message-ID: <1759821778.5570225.1429797673822.JavaMail.zimbra@redhat.com>

You could start the server locally and change the setting through the admin console, export the master realm, then when you provision it on AWS import the master realm.

Other than that there's nothing available atm. 

----- Original Message -----
> From: "Rodrigo Del Canto" <delkant at gmail.com>
> To: "Stian Thorgersen" <stian at redhat.com>
> Cc: "Christina Lau" <christinalau28 at icloud.com>, keycloak-user at lists.jboss.org
> Sent: Thursday, 23 April, 2015 3:56:26 PM
> Subject: Re: [keycloak-user] Unable to start Keycloak beta on AWS VM - HTTPS required
> 
> Hello!
> 
> I'm trying to do this on AWS too. I'm using
> keycloak-appliance-dist-all-1.2.0.Beta1 , is there a way to disabled the
> https by a configuration parameter?? I need to create a Dev environment
> real quick and I don't want to set the https for that, I couldn't find a
> way or file to do this.
> 
> Thanks a lot!!
> 
> Rodrigo.
> 
> On Wed, Aug 27, 2014 at 2:08 AM, Stian Thorgersen <stian at redhat.com> wrote:
> 
> > Yep, the old approach was more convenient. With local VMs you'll most
> > likely be using a IP address in the range that we permit non-https to when
> > set to external (http://en.wikipedia.org/wiki/Private_network). For PaaS
> > (i.e. OpenShift) the provider usually sets up https for you so it's not a
> > problem, but I guess the remaining issue is for IaaS (i.e. AWS). If there's
> > demand for it we could add some mechanism to disable it for dev without
> > having to use the admin console.
> >
> > ----- Original Message -----
> > > From: "Christina Lau" <christinalau28 at icloud.com>
> > > To: keycloak-user at lists.jboss.org
> > > Sent: Tuesday, 26 August, 2014 10:20:21 PM
> > > Subject: Re: [keycloak-user] Unable to start Keycloak beta on AWS VM -
> >       HTTPS   required
> > >
> > > Thx. I was able to zip up my laptop version and ssh over to make it work
> > > (i.e. bring up admin console). With RHEL VMs, there is no easy way to
> > bring
> > > up a local browser so the old defaults were more convenient for those
> > that
> > > do dev/test in the cloud.
> > > _______________________________________________
> > > keycloak-user mailing list
> > > keycloak-user at lists.jboss.org
> > > https://lists.jboss.org/mailman/listinfo/keycloak-user
> > >
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
> >
> 

From ivan at akvo.org  Thu Apr 23 10:36:46 2015
From: ivan at akvo.org (=?UTF-8?B?SXbDoW4=?= Perdomo)
Date: Thu, 23 Apr 2015 16:36:46 +0200
Subject: [keycloak-user] Unable to start Keycloak beta on AWS VM - HTTPS
 required
In-Reply-To: <1759821778.5570225.1429797673822.JavaMail.zimbra@redhat.com>
References: <759CBD22-981B-4E64-B546-7AF96CD064F6@icloud.com>
	<261540225.39078942.1409119731885.JavaMail.zimbra@redhat.com>
	<CAHedXPY4YzyaNrsRbZha_G=h9jt5a45GjrWHMZdgvfezLfnqyg@mail.gmail.com>
	<1759821778.5570225.1429797673822.JavaMail.zimbra@redhat.com>
Message-ID: <20150423163646.6a51bfd4@akvo.org>

Hi,

On Thu, 23 Apr 2015 10:01:13 -0400 (EDT)
Stian Thorgersen <stian at redhat.com> wrote:

> Other than that there's nothing available atm. 

A quick hack is to do port forwarding via SSH, e.g: 

ssh -L 8080 localhost:8080 user at host

If you're connected via ssh, accessing your http://localhost:8080 will
connect to the remote server as if it was locally, and AFAIK localhost
doesn't require https.

After login in, you can change the realm settings to not require https
for external connections.

My five cents,

-- 
Iv?n
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 819 bytes
Desc: OpenPGP digital signature
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20150423/78b033f3/attachment.bin 

From srossillo at smartling.com  Thu Apr 23 10:47:17 2015
From: srossillo at smartling.com (Scott Rossillo)
Date: Thu, 23 Apr 2015 10:47:17 -0400
Subject: [keycloak-user] Keycloak Adapter without web.xml
	security-constraint
In-Reply-To: <1446564260.5273515.1429768552686.JavaMail.zimbra@redhat.com>
References: <CALAqdu-EjwrWm_fidyrpZkMUDfFA2309xheAThkf3ADRXn3huw@mail.gmail.com>
	<5531710E.4020804@redhat.com>
	<CALAqdu8Js6u2ZOPF1OEo36bRXGAAAbdBF4FwqAwaOKDnc-q5kg@mail.gmail.com>
	<CALAqdu8ym=ato02FvM2Q_yF4g6=TkDqdmu107OsU4Gh2vzcVLw@mail.gmail.com>
	<1446564260.5273515.1429768552686.JavaMail.zimbra@redhat.com>
Message-ID: <C9EC69C4-8735-430E-9C06-53643D380878@smartling.com>

Thanks. By implementing the Spring Security adapter, I?m able to get around this by extending RequestAuthenticator. 


> On Apr 23, 2015, at 1:55 AM, Stian Thorgersen <stian at redhat.com> wrote:
> 
> Currently Keycloak adapters are only a way of integrating existing frameworks with Keycloak so adding a event handler etc wouldn't make much sense.
> 
> We have plans on the road-map for a CDI based adapter that gives more capabilities like what you're asking for, but in the mean time you'd need to look at PicketLink, DeltaSpike, or a way to do it with standard JEE security.
> 
> ----- Original Message -----
>> From: "Scott Rossillo" <srossillo at smartling.com>
>> To: "Bill Burke" <bburke at redhat.com>
>> Cc: keycloak-user at lists.jboss.org
>> Sent: Monday, 20 April, 2015 2:50:26 AM
>> Subject: Re: [keycloak-user] Keycloak Adapter without web.xml	security-constraint
>> 
>> Could we have a hook into application code to determine if a resource should
>> be protected by Keycloak? Maybe an event handler?
>> 
>> b oolean shouldProtectResourse(HttpServletRequest)
>> 
>> On Friday, April 17, 2015, Scott Rossillo < srossillo at smartling.com > wrote:
>> 
>> 
>> 
>> I could work around that for interactive logins, but it wouldn?t work for
>> application to application requests. Do you have any pointers on where I
>> could start to manually trigger the adapter?
>> 
>> Do you think it?s a reasonable requirement to have the application determine
>> if the adapter should be triggered? I feel it?s necessary for integration
>> with applications that have to support more than one authentication
>> mechanism.
>> 
>> Let me know.
>> 
>> Thanks in advance,
>> Scott
>> 
>> 
>> On Fri, Apr 17, 2015 at 4:46 PM, Bill Burke < bburke at redhat.com > wrote:
>> 
>> 
>> Our adapters need a security constraint or they won't be triggered.
>> 
>> On 4/17/2015 4:34 PM, Scott Rossillo wrote:
>>> When using a security mechanism, such as Spring Security, it?s possible
>>> that multiple security mechanisms are in place or that only parts of an
>>> application are secured via Keycloak, not a blanket path (e.g. /api/*).
>>> 
>>> What I?m trying to do is use the Spring?s authentication entrypoint to
>>> direct to Keycloak (this part work somewhat) and have the Keycloak
>>> adapter pick up from there (not working).
>>> 
>>> What?s the best way to handle this?
>>> 
>>> Thanks,
>>> Scott
>>> 
>>> 
>>> 
>>> 
>>> _______________________________________________
>>> keycloak-user mailing list
>>> keycloak-user at lists.jboss.org
>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>> 
>> 
>> --
>> Bill Burke
>> JBoss, a division of Red Hat
>> http://bill.burkecentral.com
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>> 
>> 
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user



From mposolda at redhat.com  Thu Apr 23 12:16:56 2015
From: mposolda at redhat.com (Marek Posolda)
Date: Thu, 23 Apr 2015 18:16:56 +0200
Subject: [keycloak-user] How touser Servlet OAuth Client
In-Reply-To: <CAPNq5vYTB2YnNXcPQb+CDSyT9s2oopZvX99NbhS2DrYY62t2qQ@mail.gmail.com>
References: <CAPNq5vYA0E1HdwR4mUzF0R2SyfaUfGc+u4Pc4bFvYJwuuKX9RA@mail.gmail.com>
	<55367704.7020302@redhat.com>
	<CAPNq5vYTB2YnNXcPQb+CDSyT9s2oopZvX99NbhS2DrYY62t2qQ@mail.gmail.com>
Message-ID: <55391AF8.7060704@redhat.com>

You're not wrong. With ServletOAuthClient you have control when you 
redirect user to the KC login screen. But you're completely independent 
on Wildfly container security layers, hence no propagation to EJB layer.

If ServletOAuthClient is good for you, depends on the usecase you want 
to achieve. Maybe it is better for you to add some security-constraints 
URL to your web.xml  (for example "/my-protected-url") and you will 
redirect your application to /my-protected-url (with 
httpResponse.sendRedirect) whenever you want your application to be 
logged with keycloak. Then once KC authentication is finished and your 
application will visit "/my-protected-url" as authenticated user, you 
will redirect back to the original URL before authentication.

Not sure if EJB propagation will happen once you're authenticated, but 
visit unprotected URL though... But at least you can give it a shot.

Marek

On 23.4.2015 15:35, J?r?me Blanchard wrote:
> Hi,
> I wonder that the Servlet OAuth Client won't propagate authentication 
> to wildfy EJB layer... Am I wrong ?
> J?r?me.
>
> Le mar. 21 avr. 2015 ? 18:13, Marek Posolda <mposolda at redhat.com 
> <mailto:mposolda at redhat.com>> a ?crit :
>
>     You can take a look at our examples for how to use
>     ServletOAuthClient. Hopefully it could help with your usecase:
>     https://github.com/keycloak/keycloak/tree/master/examples/demo-template/third-party
>     https://github.com/keycloak/keycloak/tree/master/examples/demo-template/third-party-cdi
>
>     Marek
>
>
>     On 21.4.2015 12:14, J?r?me Blanchard wrote:
>>     Hi all,
>>
>>     I'm trying to protect a servlet application which can be accessed
>>     either as anonymous user and as authenticated user. Some
>>     resources are protected and my application takes in charge the
>>     access control (not role based) so I can't use the war protection
>>     using role user constraint.
>>     In this case I've removed the role constraint in the web.xml and
>>     the keycloak wildfly (undertow) adapter let me access the
>>     application as unauthentified user (anonymous) which is perfect.
>>     What I want to handle on some AccessDeniedException is to
>>     redirect the user to the authentication server manually. In this
>>     case, user authentified an come back to the protected URL but is
>>     no more anonymous but a authentified user.
>>     Is ther is a way to handle this redirection to the authentication
>>     server manually (I don't know where to store the state variable
>>     allowing keycloak wildfly adapter to handle properly the auth
>>     redirect that include the code).
>>
>>     Best regards, J?r?me.
>>
>>
>>     _______________________________________________
>>     keycloak-user mailing list
>>     keycloak-user at lists.jboss.org  <mailto:keycloak-user at lists.jboss.org>
>>     https://lists.jboss.org/mailman/listinfo/keycloak-user
>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150423/5d0f4146/attachment.html 

From bburke at redhat.com  Thu Apr 23 12:34:22 2015
From: bburke at redhat.com (Bill Burke)
Date: Thu, 23 Apr 2015 12:34:22 -0400
Subject: [keycloak-user] How touser Servlet OAuth Client
In-Reply-To: <55391AF8.7060704@redhat.com>
References: <CAPNq5vYA0E1HdwR4mUzF0R2SyfaUfGc+u4Pc4bFvYJwuuKX9RA@mail.gmail.com>	<55367704.7020302@redhat.com>	<CAPNq5vYTB2YnNXcPQb+CDSyT9s2oopZvX99NbhS2DrYY62t2qQ@mail.gmail.com>
	<55391AF8.7060704@redhat.com>
Message-ID: <55391F0E.7010600@redhat.com>

Please read this:

http://docs.jboss.org/keycloak/docs/1.2.0.Beta1/userguide/html/ch08.html#jboss-adapter

add a @SecurityDomain("keycloak") to your EJB and it will pick up the 
Keylcoak context.

On 4/23/2015 12:16 PM, Marek Posolda wrote:
> You're not wrong. With ServletOAuthClient you have control when you
> redirect user to the KC login screen. But you're completely independent
> on Wildfly container security layers, hence no propagation to EJB layer.
>
> If ServletOAuthClient is good for you, depends on the usecase you want
> to achieve. Maybe it is better for you to add some security-constraints
> URL to your web.xml  (for example "/my-protected-url") and you will
> redirect your application to /my-protected-url (with
> httpResponse.sendRedirect) whenever you want your application to be
> logged with keycloak. Then once KC authentication is finished and your
> application will visit "/my-protected-url" as authenticated user, you
> will redirect back to the original URL before authentication.
>
> Not sure if EJB propagation will happen once you're authenticated, but
> visit unprotected URL though... But at least you can give it a shot.
>
> Marek
>
> On 23.4.2015 15:35, J?r?me Blanchard wrote:
>> Hi,
>> I wonder that the Servlet OAuth Client won't propagate authentication
>> to wildfy EJB layer... Am I wrong ?
>> J?r?me.
>>
>> Le mar. 21 avr. 2015 ? 18:13, Marek Posolda <mposolda at redhat.com
>> <mailto:mposolda at redhat.com>> a ?crit :
>>
>>     You can take a look at our examples for how to use
>>     ServletOAuthClient. Hopefully it could help with your usecase:
>>     https://github.com/keycloak/keycloak/tree/master/examples/demo-template/third-party
>>     https://github.com/keycloak/keycloak/tree/master/examples/demo-template/third-party-cdi
>>
>>     Marek
>>
>>
>>     On 21.4.2015 12:14, J?r?me Blanchard wrote:
>>>     Hi all,
>>>
>>>     I'm trying to protect a servlet application which can be accessed
>>>     either as anonymous user and as authenticated user. Some
>>>     resources are protected and my application takes in charge the
>>>     access control (not role based) so I can't use the war protection
>>>     using role user constraint.
>>>     In this case I've removed the role constraint in the web.xml and
>>>     the keycloak wildfly (undertow) adapter let me access the
>>>     application as unauthentified user (anonymous) which is perfect.
>>>     What I want to handle on some AccessDeniedException is to
>>>     redirect the user to the authentication server manually. In this
>>>     case, user authentified an come back to the protected URL but is
>>>     no more anonymous but a authentified user.
>>>     Is ther is a way to handle this redirection to the authentication
>>>     server manually (I don't know where to store the state variable
>>>     allowing keycloak wildfly adapter to handle properly the auth
>>>     redirect that include the code).
>>>
>>>     Best regards, J?r?me.
>>>
>>>
>>>     _______________________________________________
>>>     keycloak-user mailing list
>>>     keycloak-user at lists.jboss.org  <mailto:keycloak-user at lists.jboss.org>
>>>     https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

-- 
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com

From aryvlin at morphotrust.com  Thu Apr 23 12:42:35 2015
From: aryvlin at morphotrust.com (Ryvlin, Andrey)
Date: Thu, 23 Apr 2015 16:42:35 +0000
Subject: [keycloak-user] Exchange access token to id token
In-Reply-To: <551EECAA.6060705@redhat.com>
References: <ac68358c01e64e58bb0f095e116058f7@BLM-MAIL01P.l1id.local>
	<551EE7FB.40702@redhat.com>
	<92e3221bd8fd4486bd49d60e177924dd@BLM-MAIL01P.l1id.local>
	<551EECAA.6060705@redhat.com>
Message-ID: <44412819d4ac40ea99a948070672462c@BLM-MAIL01P.l1id.local>

Hi Bill,
I need you help!
I created a demo rest service with Keycloak role based security. I use OAuth client to obtain token, which I pass into the request header.
Everything works fine, I pass all security constraints and REST endpoint gets executed.
Now I am trying to get access token from the request as you suggested:
     AccessToken accessToken  = ((KeycloakSecurityContext)request.getAttribute(KeycloakSecurityContext.class.getName())).getToken();

But request.getAttribute(KeycloakSecurityContext.class.getName() returns null;

Here is the code of my REST WS class:
@Path("/")
public class SampleDataService {
	 @Context HttpServletRequest servletRequest; 

	@GET
	@Path("/query")
	@Produces("text/plain")
	public String getData() {
		Enumeration<String>attributes = servletRequest.getAttributeNames();
		StringBuilder names = new StringBuilder("Attributes: ");
		while (attributes.hasMoreElements()) {
			names.append( (String) attributes.nextElement());
			names.append(", ");
		}
		System.out.println("Keycloak security context: "+servletRequest.getAttribute(KeycloakSecurityContext.class.getName()));
		System.out.println("Request "+names.toString());
		return "Sample data for id ";
	}

Console output is like this:
11:28:22,400 DEBUG [org.apache.catalina.realm.RealmBase] (http-/0.0.0.0:8080-1)   Checking constraint 'SecurityConstraint[Admins]' against GET /query --> true
11:28:22,401 DEBUG [org.apache.catalina.realm.RealmBase] (http-/0.0.0.0:8080-1)   Checking constraint 'SecurityConstraint[Admins]' against GET /query --> true
11:28:22,401 DEBUG [org.apache.catalina.realm.RealmBase] (http-/0.0.0.0:8080-1)   Checking constraint 'SecurityConstraint[Admins]' against GET /query --> true
11:28:22,401 DEBUG [org.apache.catalina.realm.RealmBase] (http-/0.0.0.0:8080-1)   Checking constraint 'SecurityConstraint[Admins]' against GET /query --> true
11:28:22,401 DEBUG [org.apache.catalina.realm.RealmBase] (http-/0.0.0.0:8080-1)   No applicable constraint located
11:28:22,401 DEBUG [org.apache.catalina.authenticator.AuthenticatorBase] (http-/0.0.0.0:8080-1)  Not subject to any constraint
11:28:22,401 DEBUG [org.keycloak.adapters.tomcat.AuthenticatedActionsValve] (http-/0.0.0.0:8080-1) AuthenticatedActionsValve.invoke /audit/query
11:28:22,401 DEBUG [org.keycloak.adapters.AuthenticatedActionsHandler] (http-/0.0.0.0:8080-1) AuthenticatedActionsValve.invoke http://localhost:8080/audit/query
11:28:22,402 INFO  [stdout] (http-/0.0.0.0:8080-1) Keycloak security context: null
11:28:22,403 INFO  [stdout] (http-/0.0.0.0:8080-1) Request Attributes: RESTEASY_CHOSEN_ACCEPT, org.jboss.resteasy.core.ResourceMethodInvoker,

Please advise.

Thanks?
-----------------
Andrey Ryvlin
Principal Software Engineer

Phone: 952-979-8492
5705 W Old Shakopee Road, Suite 100
Bloomington, MN 55437 USA
ARyvlin at MorphoTrust.com
www.MorphoTrust.com




-----Original Message-----
From: Bill Burke [mailto:bburke at redhat.com] 
Sent: Friday, April 03, 2015 2:40 PM
To: Ryvlin, Andrey; keycloak-user at lists.jboss.org
Subject: Re: [keycloak-user] Exchange access token to id token

Oh, you have a REST service being invoked on?  And you want to get claim information?  Yes, you can get the access token.

     AccessToken accessToken  =
((KeycloakSecurityContext)request.getAttribute(KeycloakSecurityContext.class.getName())).getToken();


request here is HttpServetRequest

On 4/3/2015 3:29 PM, Ryvlin, Andrey wrote:
> Can I get user id from the access token?
> That's the only token I can get from HTTP Authorization header. Actual login and getting login response happens earlier, at my web application or oauth client.
> So, at my REST implementation class I only have access token.
>
> Thanks!!
>
> -----Original Message-----
> From: keycloak-user-bounces at lists.jboss.org [mailto:keycloak-user-bounces at lists.jboss.org] On Behalf Of Bill Burke
> Sent: Friday, April 03, 2015 2:20 PM
> To: keycloak-user at lists.jboss.org
> Subject: Re: [keycloak-user] Exchange access token to id token
>
> Our access tokens are actually JsonWebTokens packaged in a Json Web Signature.  Direct Grant login should also return an IDToken within the Access Token Response.
>
> On 4/3/2015 3:15 PM, Ryvlin, Andrey wrote:
>> Hi,
>>
>> I?m using Keycloak direct grant login to my REST APIs and I need to
>> get authenticated user information for auditing purpose.
>>
>> At my REST implementation class I can get access token from HTTP
>> header by using a request interceptor, but I believe that token is
>> useless for auditing.
>>
>> Is there Keycloak REST API to get id token for the access token?
>>
>> Thank you in advance
>>
>> Andrey Ryvlin
>>
>> Sr. Software Engineer
>>
>>
>> ----------------------------------------------------------------------
>> --
>>
>> This message is only for the use of the intended recipient and may
>> contain information that is CONFIDENTIAL and PROPRIETARY to
>> MorphoTrust USA, Inc. If you are not the intended recipient, please
>> erase all copies of the message and its attachments and notify the sender immediately.
>>
>>
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>
> --
> Bill Burke
> JBoss, a division of Red Hat
> http://bill.burkecentral.com
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
> ________________________________
>
> This message is only for the use of the intended recipient and may contain information that is CONFIDENTIAL and PROPRIETARY to MorphoTrust USA, Inc. If you are not the intended recipient, please erase all copies of the message and its attachments and notify the sender immediately.
>

-- 
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com


From delkant at gmail.com  Thu Apr 23 13:46:38 2015
From: delkant at gmail.com (Rodrigo Del Canto)
Date: Thu, 23 Apr 2015 13:46:38 -0400
Subject: [keycloak-user] Unable to start Keycloak beta on AWS VM - HTTPS
	required
In-Reply-To: <20150423163646.6a51bfd4@akvo.org>
References: <759CBD22-981B-4E64-B546-7AF96CD064F6@icloud.com>
	<261540225.39078942.1409119731885.JavaMail.zimbra@redhat.com>
	<CAHedXPY4YzyaNrsRbZha_G=h9jt5a45GjrWHMZdgvfezLfnqyg@mail.gmail.com>
	<1759821778.5570225.1429797673822.JavaMail.zimbra@redhat.com>
	<20150423163646.6a51bfd4@akvo.org>
Message-ID: <CAHedXPYXnuPk7w7CGPy8Q65p98NSqTnj848djZ8=Yq29tiN5ww@mail.gmail.com>

Thank you! but I ended up installing keycloak on a production box with
https, I will move my installation in the future.

On Thu, Apr 23, 2015 at 10:36 AM, Iv?n Perdomo <ivan at akvo.org> wrote:

> Hi,
>
> On Thu, 23 Apr 2015 10:01:13 -0400 (EDT)
> Stian Thorgersen <stian at redhat.com> wrote:
>
> > Other than that there's nothing available atm.
>
> A quick hack is to do port forwarding via SSH, e.g:
>
> ssh -L 8080 localhost:8080 user at host
>
> If you're connected via ssh, accessing your http://localhost:8080 will
> connect to the remote server as if it was locally, and AFAIK localhost
> doesn't require https.
>
> After login in, you can change the realm settings to not require https
> for external connections.
>
> My five cents,
>
> --
> Iv?n
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150423/1e561654/attachment.html 

From prabhalar at yahoo.com  Thu Apr 23 16:45:16 2015
From: prabhalar at yahoo.com (Raghu Prabhala)
Date: Thu, 23 Apr 2015 16:45:16 -0400
Subject: [keycloak-user] Client credentials grant
Message-ID: <21F0A7A1-41CC-45E9-82E2-5FE00BE6A79E@yahoo.com>

Bill/Dev team

Is "client credentials grant" supported  in KC?  Getting an "invalid grant" error when using a client code that was tested against other oidc implementation. Tried the bearer-only setting in KC but that did not help. If not supported, can  I put in an enhancement request? 

This is an important use case for us where one client application interacts with other by passing an access token and scope.

Thanks,
Raghu

Sent from my iPhone

From bburke at redhat.com  Thu Apr 23 16:49:22 2015
From: bburke at redhat.com (Bill Burke)
Date: Thu, 23 Apr 2015 16:49:22 -0400
Subject: [keycloak-user] Client credentials grant
In-Reply-To: <21F0A7A1-41CC-45E9-82E2-5FE00BE6A79E@yahoo.com>
References: <21F0A7A1-41CC-45E9-82E2-5FE00BE6A79E@yahoo.com>
Message-ID: <55395AD2.1010602@redhat.com>

No, we don't support this.

On 4/23/2015 4:45 PM, Raghu Prabhala wrote:
> Bill/Dev team
>
> Is "client credentials grant" supported  in KC?  Getting an "invalid grant" error when using a client code that was tested against other oidc implementation. Tried the bearer-only setting in KC but that did not help. If not supported, can  I put in an enhancement request?
>
> This is an important use case for us where one client application interacts with other by passing an access token and scope.
>
> Thanks,
> Raghu
>
> Sent from my iPhone
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

-- 
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com

From prabhalar at yahoo.com  Thu Apr 23 17:22:15 2015
From: prabhalar at yahoo.com (Raghu Prabhala)
Date: Thu, 23 Apr 2015 17:22:15 -0400
Subject: [keycloak-user] Client credentials grant
In-Reply-To: <55395AD2.1010602@redhat.com>
References: <21F0A7A1-41CC-45E9-82E2-5FE00BE6A79E@yahoo.com>
	<55395AD2.1010602@redhat.com>
Message-ID: <246DC9A8-E886-428E-B439-8E5FBC06E31E@yahoo.com>

Thanks. Noticed that there is already a jira 941 for that requirement. Any idea when that would be implemented?

Sent from my iPhone

> On Apr 23, 2015, at 4:49 PM, Bill Burke <bburke at redhat.com> wrote:
> 
> No, we don't support this.
> 
>> On 4/23/2015 4:45 PM, Raghu Prabhala wrote:
>> Bill/Dev team
>> 
>> Is "client credentials grant" supported  in KC?  Getting an "invalid grant" error when using a client code that was tested against other oidc implementation. Tried the bearer-only setting in KC but that did not help. If not supported, can  I put in an enhancement request?
>> 
>> This is an important use case for us where one client application interacts with other by passing an access token and scope.
>> 
>> Thanks,
>> Raghu
>> 
>> Sent from my iPhone
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>> 
> 
> -- 
> Bill Burke
> JBoss, a division of Red Hat
> http://bill.burkecentral.com
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user


From aryvlin at morphotrust.com  Thu Apr 23 20:42:32 2015
From: aryvlin at morphotrust.com (Ryvlin, Andrey)
Date: Fri, 24 Apr 2015 00:42:32 +0000
Subject: [keycloak-user] Exchange access token to id token
In-Reply-To: <44412819d4ac40ea99a948070672462c@BLM-MAIL01P.l1id.local>
References: <ac68358c01e64e58bb0f095e116058f7@BLM-MAIL01P.l1id.local>
	<551EE7FB.40702@redhat.com>
	<92e3221bd8fd4486bd49d60e177924dd@BLM-MAIL01P.l1id.local>
	<551EECAA.6060705@redhat.com>
	<44412819d4ac40ea99a948070672462c@BLM-MAIL01P.l1id.local>
Message-ID: <ba0dd4a671bd4b3883a3bac56b88ceec@BLM-MAIL01P.l1id.local>

Never mind, I figured it out. Got token from the request header and converted it to AccessToken object

Thanks anyways!

-----Original Message-----
From: Ryvlin, Andrey 
Sent: Thursday, April 23, 2015 11:43 AM
To: Bill Burke; keycloak-user at lists.jboss.org
Subject: RE: [keycloak-user] Exchange access token to id token

Hi Bill,
I need you help!
I created a demo rest service with Keycloak role based security. I use OAuth client to obtain token, which I pass into the request header.
Everything works fine, I pass all security constraints and REST endpoint gets executed.
Now I am trying to get access token from the request as you suggested:
     AccessToken accessToken  = ((KeycloakSecurityContext)request.getAttribute(KeycloakSecurityContext.class.getName())).getToken();

But request.getAttribute(KeycloakSecurityContext.class.getName() returns null;

Here is the code of my REST WS class:
@Path("/")
public class SampleDataService {
	 @Context HttpServletRequest servletRequest; 

	@GET
	@Path("/query")
	@Produces("text/plain")
	public String getData() {
		Enumeration<String>attributes = servletRequest.getAttributeNames();
		StringBuilder names = new StringBuilder("Attributes: ");
		while (attributes.hasMoreElements()) {
			names.append( (String) attributes.nextElement());
			names.append(", ");
		}
		System.out.println("Keycloak security context: "+servletRequest.getAttribute(KeycloakSecurityContext.class.getName()));
		System.out.println("Request "+names.toString());
		return "Sample data for id ";
	}

Console output is like this:
11:28:22,400 DEBUG [org.apache.catalina.realm.RealmBase] (http-/0.0.0.0:8080-1)   Checking constraint 'SecurityConstraint[Admins]' against GET /query --> true
11:28:22,401 DEBUG [org.apache.catalina.realm.RealmBase] (http-/0.0.0.0:8080-1)   Checking constraint 'SecurityConstraint[Admins]' against GET /query --> true
11:28:22,401 DEBUG [org.apache.catalina.realm.RealmBase] (http-/0.0.0.0:8080-1)   Checking constraint 'SecurityConstraint[Admins]' against GET /query --> true
11:28:22,401 DEBUG [org.apache.catalina.realm.RealmBase] (http-/0.0.0.0:8080-1)   Checking constraint 'SecurityConstraint[Admins]' against GET /query --> true
11:28:22,401 DEBUG [org.apache.catalina.realm.RealmBase] (http-/0.0.0.0:8080-1)   No applicable constraint located
11:28:22,401 DEBUG [org.apache.catalina.authenticator.AuthenticatorBase] (http-/0.0.0.0:8080-1)  Not subject to any constraint
11:28:22,401 DEBUG [org.keycloak.adapters.tomcat.AuthenticatedActionsValve] (http-/0.0.0.0:8080-1) AuthenticatedActionsValve.invoke /audit/query
11:28:22,401 DEBUG [org.keycloak.adapters.AuthenticatedActionsHandler] (http-/0.0.0.0:8080-1) AuthenticatedActionsValve.invoke http://localhost:8080/audit/query
11:28:22,402 INFO  [stdout] (http-/0.0.0.0:8080-1) Keycloak security context: null
11:28:22,403 INFO  [stdout] (http-/0.0.0.0:8080-1) Request Attributes: RESTEASY_CHOSEN_ACCEPT, org.jboss.resteasy.core.ResourceMethodInvoker,

Please advise.

Thanks?
-----------------
Andrey Ryvlin
Principal Software Engineer

Phone: 952-979-8492
5705 W Old Shakopee Road, Suite 100
Bloomington, MN 55437 USA
ARyvlin at MorphoTrust.com
www.MorphoTrust.com




-----Original Message-----
From: Bill Burke [mailto:bburke at redhat.com]
Sent: Friday, April 03, 2015 2:40 PM
To: Ryvlin, Andrey; keycloak-user at lists.jboss.org
Subject: Re: [keycloak-user] Exchange access token to id token

Oh, you have a REST service being invoked on?  And you want to get claim information?  Yes, you can get the access token.

     AccessToken accessToken  =
((KeycloakSecurityContext)request.getAttribute(KeycloakSecurityContext.class.getName())).getToken();


request here is HttpServetRequest

On 4/3/2015 3:29 PM, Ryvlin, Andrey wrote:
> Can I get user id from the access token?
> That's the only token I can get from HTTP Authorization header. Actual login and getting login response happens earlier, at my web application or oauth client.
> So, at my REST implementation class I only have access token.
>
> Thanks!!
>
> -----Original Message-----
> From: keycloak-user-bounces at lists.jboss.org 
> [mailto:keycloak-user-bounces at lists.jboss.org] On Behalf Of Bill Burke
> Sent: Friday, April 03, 2015 2:20 PM
> To: keycloak-user at lists.jboss.org
> Subject: Re: [keycloak-user] Exchange access token to id token
>
> Our access tokens are actually JsonWebTokens packaged in a Json Web Signature.  Direct Grant login should also return an IDToken within the Access Token Response.
>
> On 4/3/2015 3:15 PM, Ryvlin, Andrey wrote:
>> Hi,
>>
>> I?m using Keycloak direct grant login to my REST APIs and I need to 
>> get authenticated user information for auditing purpose.
>>
>> At my REST implementation class I can get access token from HTTP 
>> header by using a request interceptor, but I believe that token is 
>> useless for auditing.
>>
>> Is there Keycloak REST API to get id token for the access token?
>>
>> Thank you in advance
>>
>> Andrey Ryvlin
>>
>> Sr. Software Engineer
>>
>>
>> ---------------------------------------------------------------------
>> -
>> --
>>
>> This message is only for the use of the intended recipient and may 
>> contain information that is CONFIDENTIAL and PROPRIETARY to 
>> MorphoTrust USA, Inc. If you are not the intended recipient, please 
>> erase all copies of the message and its attachments and notify the sender immediately.
>>
>>
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>
> --
> Bill Burke
> JBoss, a division of Red Hat
> http://bill.burkecentral.com
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
> ________________________________
>
> This message is only for the use of the intended recipient and may contain information that is CONFIDENTIAL and PROPRIETARY to MorphoTrust USA, Inc. If you are not the intended recipient, please erase all copies of the message and its attachments and notify the sender immediately.
>

--
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com


From stian at redhat.com  Fri Apr 24 00:44:43 2015
From: stian at redhat.com (Stian Thorgersen)
Date: Fri, 24 Apr 2015 00:44:43 -0400 (EDT)
Subject: [keycloak-user] Client credentials grant
In-Reply-To: <246DC9A8-E886-428E-B439-8E5FBC06E31E@yahoo.com>
References: <21F0A7A1-41CC-45E9-82E2-5FE00BE6A79E@yahoo.com>
	<55395AD2.1010602@redhat.com>
	<246DC9A8-E886-428E-B439-8E5FBC06E31E@yahoo.com>
Message-ID: <358060306.5915611.1429850683608.JavaMail.zimbra@redhat.com>

It's on our roadmap, but not short term. So my guess would be in a few months and would be done together with client accounts and more auth mechanisms for clients (jwt/jws and cert)

----- Original Message -----
> From: "Raghu Prabhala" <prabhalar at yahoo.com>
> To: "Bill Burke" <bburke at redhat.com>
> Cc: keycloak-user at lists.jboss.org
> Sent: Thursday, 23 April, 2015 11:22:15 PM
> Subject: Re: [keycloak-user] Client credentials grant
> 
> Thanks. Noticed that there is already a jira 941 for that requirement. Any
> idea when that would be implemented?
> 
> Sent from my iPhone
> 
> > On Apr 23, 2015, at 4:49 PM, Bill Burke <bburke at redhat.com> wrote:
> > 
> > No, we don't support this.
> > 
> >> On 4/23/2015 4:45 PM, Raghu Prabhala wrote:
> >> Bill/Dev team
> >> 
> >> Is "client credentials grant" supported  in KC?  Getting an "invalid
> >> grant" error when using a client code that was tested against other oidc
> >> implementation. Tried the bearer-only setting in KC but that did not
> >> help. If not supported, can  I put in an enhancement request?
> >> 
> >> This is an important use case for us where one client application
> >> interacts with other by passing an access token and scope.
> >> 
> >> Thanks,
> >> Raghu
> >> 
> >> Sent from my iPhone
> >> _______________________________________________
> >> keycloak-user mailing list
> >> keycloak-user at lists.jboss.org
> >> https://lists.jboss.org/mailman/listinfo/keycloak-user
> >> 
> > 
> > --
> > Bill Burke
> > JBoss, a division of Red Hat
> > http://bill.burkecentral.com
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
> 
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
> 

From mposolda at redhat.com  Fri Apr 24 02:52:41 2015
From: mposolda at redhat.com (Marek Posolda)
Date: Fri, 24 Apr 2015 08:52:41 +0200
Subject: [keycloak-user] Email verification and get admin-client
 exception entitiy
In-Reply-To: <1429792915.4339.10.camel@devs.alphaapps.de>
References: <1429792915.4339.10.camel@devs.alphaapps.de>
Message-ID: <5539E839.1080005@redhat.com>

On 23.4.2015 14:41, Benjamin Hansmann [alphaApps] wrote:
> Greetings once again. Two more questions:
>
> - Is there any way to trigger/send a verification email other than
> logging in through the web frontend? I created the user through the
> admin-client and the user will use the direct grant api to login.
I think it's not possible. That's one of the limitations of Direct Grant 
API.

There is admin endpoint to remove required action from the user though, 
so you as admin can remove the required action for verify email from the 
user. But user himself needs to use frontend to verify email AFAIK.
>
> - When using the admin-client to create a user I want to handle/forward
> the response body. E.g. when a username already exists a
> ClientErrorException is thrown which includes a
> javax.ws.rs.core.Response with Status.CONFLICT. But there does not seem
> to be an entitiy/body in this Response. When I use the Admin REST API
> directly I will get: { "errorMessage" : "User exists with
> same username" }. Is there a way to obtain it when using the
> admin-client?
I think you're right. It looks that most of POST methods in admin-client 
return "void" instead of Response, so there is no possibility to check 
the details. Feel free to create JIRA for that.

Btv. If you have Keycloak sources and you want to give it a try, then 
you can try to change this line: 
https://github.com/keycloak/keycloak/blob/master/integration/admin-client/src/main/java/org/keycloak/admin/client/resource/UsersResource.java#L34 
to return "Response" instead of void. Then from the Response, you should 
be able to retrieve entity as ErrorRepresentation with the proper error 
method attached.

Marek
>
> Thanks and best wishes,
> Benjamin


From prabhalar at yahoo.com  Fri Apr 24 06:05:39 2015
From: prabhalar at yahoo.com (Raghu Prabhala)
Date: Fri, 24 Apr 2015 10:05:39 +0000 (UTC)
Subject: [keycloak-user] Client credentials grant
In-Reply-To: <358060306.5915611.1429850683608.JavaMail.zimbra@redhat.com>
References: <358060306.5915611.1429850683608.JavaMail.zimbra@redhat.com>
Message-ID: <699473346.3476793.1429869939089.JavaMail.yahoo@mail.yahoo.com>

Thanks Stian. Can that work be prioritized over the other?auth mechanisms you mentioned and if not, can?you provide me a few pointers on how I can extend KC to implement that use case ? I need to have something done quickly to present?KC as a viable solution?or risk losing out.
BTW is there any documentation that would help me use Eclipse?or any other IDE to develop/build and test any extensions?
?      From: Stian Thorgersen <stian at redhat.com>
 To: Raghu Prabhala <prabhalar at yahoo.com> 
Cc: Bill Burke <bburke at redhat.com>; keycloak-user at lists.jboss.org 
 Sent: Friday, April 24, 2015 12:44 AM
 Subject: Re: [keycloak-user] Client credentials grant
   
It's on our roadmap, but not short term. So my guess would be in a few months and would be done together with client accounts and more auth mechanisms for clients (jwt/jws and cert)

----- Original Message -----
> From: "Raghu Prabhala" <prabhalar at yahoo.com>
> To: "Bill Burke" <bburke at redhat.com>
> Cc: keycloak-user at lists.jboss.org
> Sent: Thursday, 23 April, 2015 11:22:15 PM
> Subject: Re: [keycloak-user] Client credentials grant
> 
> Thanks. Noticed that there is already a jira 941 for that requirement. Any
> idea when that would be implemented?
> 
> Sent from my iPhone
> 
> > On Apr 23, 2015, at 4:49 PM, Bill Burke <bburke at redhat.com> wrote:
> > 
> > No, we don't support this.
> > 
> >> On 4/23/2015 4:45 PM, Raghu Prabhala wrote:
> >> Bill/Dev team
> >> 
> >> Is "client credentials grant" supported? in KC?? Getting an "invalid
> >> grant" error when using a client code that was tested against other oidc
> >> implementation. Tried the bearer-only setting in KC but that did not
> >> help. If not supported, can? I put in an enhancement request?
> >> 
> >> This is an important use case for us where one client application
> >> interacts with other by passing an access token and scope.
> >> 
> >> Thanks,
> >> Raghu
> >> 
> >> Sent from my iPhone
> >> _______________________________________________
> >> keycloak-user mailing list
> >> keycloak-user at lists.jboss.org
> >> https://lists.jboss.org/mailman/listinfo/keycloak-user
> >> 
> > 
> > --
> > Bill Burke
> > JBoss, a division of Red Hat
> > http://bill.burkecentral.com


> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
> 
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
> 


  
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150424/288821fb/attachment-0001.html 

From fadiabdeen at gmail.com  Fri Apr 24 07:41:32 2015
From: fadiabdeen at gmail.com (Fadi Abdin)
Date: Fri, 24 Apr 2015 07:41:32 -0400
Subject: [keycloak-user] CORS
Message-ID: <CABXXV0QQC7X+RmnhpwEAxNWz1mrsEtbFUGqNpxGqYeXu2OVPMw@mail.gmail.com>

Hello Everyone,

How do i make http requests from another Server ? When i do a post request
i get this message below error, because that header is required to be on
the requested resource.

"No 'Access-Control-Allow-Origin' header is present on the requested
resource. Origin 'http://172.26.248.147:8383' is therefore not allowed
access. The response had HTTP status code 400

Thanks,
Fadi
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150424/6ed22b81/attachment.html 

From lkrzyzan at redhat.com  Fri Apr 24 08:58:57 2015
From: lkrzyzan at redhat.com (=?utf-8?Q?Libor_Krzy=C5=BEanek?=)
Date: Fri, 24 Apr 2015 14:58:57 +0200
Subject: [keycloak-user] CORS
In-Reply-To: <CABXXV0QQC7X+RmnhpwEAxNWz1mrsEtbFUGqNpxGqYeXu2OVPMw@mail.gmail.com>
References: <CABXXV0QQC7X+RmnhpwEAxNWz1mrsEtbFUGqNpxGqYeXu2OVPMw@mail.gmail.com>
Message-ID: <06B3A4C5-9D92-4457-944D-781A0763BE03@redhat.com>

Hi,
you need to put second server (http://172.26.248.147:8383 <http://172.26.248.147:8383/>) into list of ?Web Origin? attribute in your Keycloak Application settings.

Go to admin console, choose your realm then
Application > name of app. > Web Origin attribute.

Thanks,

Libor Krzy?anek
jboss.org <http://jboss.org/> Development Team

> On 24 Apr 2015, at 13:41, Fadi Abdin <fadiabdeen at gmail.com> wrote:
> 
> Hello Everyone, 
> 
> How do i make http requests from another Server ? When i do a post request i get this message below error, because that header is required to be on the requested resource.
> 
> "No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://172.26.248.147:8383 <http://172.26.248.147:8383/>' is therefore not allowed access. The response had HTTP status code 400
> 
> Thanks,
> Fadi
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150424/52bfeac2/attachment.html 

From lkrzyzan at redhat.com  Fri Apr 24 09:12:29 2015
From: lkrzyzan at redhat.com (=?utf-8?Q?Libor_Krzy=C5=BEanek?=)
Date: Fri, 24 Apr 2015 15:12:29 +0200
Subject: [keycloak-user] Clustering on localhost with shared DB
Message-ID: <F4DA0413-269A-4F82-89D8-EB3FFDE8ED88@redhat.com>

Hi,
I?m trying to achieve full user session replication which means when I?m logged in on node 1 and then hit node 2 then I expect to be logged in but I?m forced  to log in again.

I have:
1. two localhost nodes with JBoss EAP 6.4 + War installation
2. Postgres
3. EAP cofigured based on http://docs.jboss.org/keycloak/docs/1.2.0.Beta1/userguide/html/clustering.html <http://docs.jboss.org/keycloak/docs/1.2.0.Beta1/userguide/html/clustering.html>

I triedeither
        <distributed-cache name="sessions" mode="SYNC" owners=?2" />
        <distributed-cache name="loginFailures" mode="SYNC" owners=?2" />
or
                <replicated-cache name="sessions" mode="SYNC"/>
                <replicated-cache name="loginFailures" mode="SYNC?/>
but with same result.

I?m starting nodes by
./jb1/bin/standalone.sh  --server-config=standalone-ha.xml -Djboss.node.name=node1
./jb2/bin/standalone.sh  --server-config=standalone-ha.xml -Djboss.socket.binding.port-offset=100 -Djboss.node.name=node2


both jb1 and jb2 are identical and they know each other (Received new cluster view: [node1/keycloak|1] [node1/keycloak, node2/keycloak])

How do you test clustering of KC please?

Thanks,

Libor Krzy?anek
jboss.org <http://jboss.org/> Development Team

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150424/4395729e/attachment.html 

From stian at redhat.com  Fri Apr 24 09:36:23 2015
From: stian at redhat.com (Stian Thorgersen)
Date: Fri, 24 Apr 2015 09:36:23 -0400 (EDT)
Subject: [keycloak-user] Clustering on localhost with shared DB
In-Reply-To: <F4DA0413-269A-4F82-89D8-EB3FFDE8ED88@redhat.com>
References: <F4DA0413-269A-4F82-89D8-EB3FFDE8ED88@redhat.com>
Message-ID: <568869667.6140931.1429882583171.JavaMail.zimbra@redhat.com>

Can you attach your keycloak-server.json and standalone.xml?

----- Original Message -----
> From: "Libor Krzy?anek" <lkrzyzan at redhat.com>
> To: "keycloak-user" <keycloak-user at lists.jboss.org>
> Sent: Friday, 24 April, 2015 3:12:29 PM
> Subject: [keycloak-user] Clustering on localhost with shared DB
> 
> Hi,
> I?m trying to achieve full user session replication which means when I?m
> logged in on node 1 and then hit node 2 then I expect to be logged in but
> I?m forced to log in again.
> 
> I have:
> 1. two localhost nodes with JBoss EAP 6.4 + War installation
> 2. Postgres
> 3. EAP cofigured based on
> http://docs.jboss.org/keycloak/docs/1.2.0.Beta1/userguide/html/clustering.html
> 
> I triedeither
> <distributed-cache name="sessions" mode="SYNC" owners=? 2 " />
> <distributed-cache name="loginFailures" mode="SYNC" owners=? 2 " />
> or
> <replicated-cache name="sessions" mode="SYNC"/>
> <replicated-cache name="loginFailures" mode="SYNC?/>
> but with same result.
> 
> I?m starting nodes by
> ./jb1/bin/standalone.sh --server-config=standalone-ha.xml
> -Djboss.node.name=node1
> ./jb2/bin/standalone.sh --server-config=standalone-ha.xml
> -Djboss.socket.binding.port-offset=100 -Djboss.node.name=node2
> 
> 
> both jb1 and jb2 are identical and they know each other (Received new cluster
> view: [node1/keycloak|1] [node1/keycloak, node2/keycloak])
> 
> How do you test clustering of KC please?
> 
> Thanks,
> 
> Libor Krzy?anek
> jboss.org Development Team
> 
> 
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user


From lkrzyzan at redhat.com  Fri Apr 24 09:50:09 2015
From: lkrzyzan at redhat.com (=?utf-8?Q?Libor_Krzy=C5=BEanek?=)
Date: Fri, 24 Apr 2015 15:50:09 +0200
Subject: [keycloak-user] Clustering on localhost with shared DB
In-Reply-To: <568869667.6140931.1429882583171.JavaMail.zimbra@redhat.com>
References: <F4DA0413-269A-4F82-89D8-EB3FFDE8ED88@redhat.com>
	<568869667.6140931.1429882583171.JavaMail.zimbra@redhat.com>
Message-ID: <0AD87949-C8F5-418C-8C79-036155DBEBD7@redhat.com>

Attaching keycloak-server.json and standalone-ha.xml

Thanks,

Libor Krzy?anek
jboss.org <http://jboss.org/> Development Team

> On 24 Apr 2015, at 15:36, Stian Thorgersen <stian at redhat.com> wrote:
> 
> Can you attach your keycloak-server.json and standalone.xml?
> 
> ----- Original Message -----
>> From: "Libor Krzy?anek" <lkrzyzan at redhat.com>
>> To: "keycloak-user" <keycloak-user at lists.jboss.org>
>> Sent: Friday, 24 April, 2015 3:12:29 PM
>> Subject: [keycloak-user] Clustering on localhost with shared DB
>> 
>> Hi,
>> I?m trying to achieve full user session replication which means when I?m
>> logged in on node 1 and then hit node 2 then I expect to be logged in but
>> I?m forced to log in again.
>> 
>> I have:
>> 1. two localhost nodes with JBoss EAP 6.4 + War installation
>> 2. Postgres
>> 3. EAP cofigured based on
>> http://docs.jboss.org/keycloak/docs/1.2.0.Beta1/userguide/html/clustering.html
>> 
>> I triedeither
>> <distributed-cache name="sessions" mode="SYNC" owners=? 2 " />
>> <distributed-cache name="loginFailures" mode="SYNC" owners=? 2 " />
>> or
>> <replicated-cache name="sessions" mode="SYNC"/>
>> <replicated-cache name="loginFailures" mode="SYNC?/>
>> but with same result.
>> 
>> I?m starting nodes by
>> ./jb1/bin/standalone.sh --server-config=standalone-ha.xml
>> -Djboss.node.name=node1
>> ./jb2/bin/standalone.sh --server-config=standalone-ha.xml
>> -Djboss.socket.binding.port-offset=100 -Djboss.node.name=node2
>> 
>> 
>> both jb1 and jb2 are identical and they know each other (Received new cluster
>> view: [node1/keycloak|1] [node1/keycloak, node2/keycloak])
>> 
>> How do you test clustering of KC please?
>> 
>> Thanks,
>> 
>> Libor Krzy?anek
>> jboss.org Development Team
>> 
>> 
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150424/d2252ab2/attachment-0003.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: keycloak-server.json
Type: application/json
Size: 1358 bytes
Desc: not available
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20150424/d2252ab2/attachment-0001.bin 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150424/d2252ab2/attachment-0004.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: standalone-ha.xml
Type: application/xml
Size: 22512 bytes
Desc: not available
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20150424/d2252ab2/attachment-0001.rdf 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150424/d2252ab2/attachment-0005.html 

From mposolda at redhat.com  Fri Apr 24 13:06:16 2015
From: mposolda at redhat.com (Marek Posolda)
Date: Fri, 24 Apr 2015 19:06:16 +0200
Subject: [keycloak-user] Clustering on localhost with shared DB
In-Reply-To: <0AD87949-C8F5-418C-8C79-036155DBEBD7@redhat.com>
References: <F4DA0413-269A-4F82-89D8-EB3FFDE8ED88@redhat.com>	<568869667.6140931.1429882583171.JavaMail.zimbra@redhat.com>
	<0AD87949-C8F5-418C-8C79-036155DBEBD7@redhat.com>
Message-ID: <553A7808.4060602@redhat.com>

Hi Libor,

the config files looks good (at least for the first look), but question 
is if you're using loadbalancer?

If you're not using loadbalancer and you access keycloak servers 
directly on localhost:8080 and localhost:8180, the problem might be just 
in the fact that browser cookie KEYCLOAK_IDENTITY is not shared between 
them and hence going to localhost:8180 will not find KEYCLOAK_IDENTITY 
cookie from localhost:8080 and will try to create new session.

You can check admin console or account management and list available 
user sessions on both nodes. If both cluster nodes have same sessions, 
then replication of userSessions works fine, but only issue is really 
the cookie.

I suspect that in production, you will use loadbalancer, so this issue 
won't happen.

Marek

On 24.4.2015 15:50, Libor Krzy?anek wrote:
> Attaching keycloak-server.json and standalone-ha.xml
>
> Thanks,
>
> Libor Krzy?anek
> jboss.org <http://jboss.org> Development Team
>
>
>
>
>
>> On 24 Apr 2015, at 15:36, Stian Thorgersen <stian at redhat.com 
>> <mailto:stian at redhat.com>> wrote:
>>
>> Can you attach your keycloak-server.json and standalone.xml?
>>
>> ----- Original Message -----
>>> From: "Libor Krzy?anek" <lkrzyzan at redhat.com 
>>> <mailto:lkrzyzan at redhat.com>>
>>> To: "keycloak-user" <keycloak-user at lists.jboss.org 
>>> <mailto:keycloak-user at lists.jboss.org>>
>>> Sent: Friday, 24 April, 2015 3:12:29 PM
>>> Subject: [keycloak-user] Clustering on localhost with shared DB
>>>
>>> Hi,
>>> I?m trying to achieve full user session replication which means when I?m
>>> logged in on node 1 and then hit node 2 then I expect to be logged 
>>> in but
>>> I?m forced to log in again.
>>>
>>> I have:
>>> 1. two localhost nodes with JBoss EAP 6.4 + War installation
>>> 2. Postgres
>>> 3. EAP cofigured based on
>>> http://docs.jboss.org/keycloak/docs/1.2.0.Beta1/userguide/html/clustering.html
>>>
>>> I triedeither
>>> <distributed-cache name="sessions" mode="SYNC" owners=? 2 " />
>>> <distributed-cache name="loginFailures" mode="SYNC" owners=? 2 " />
>>> or
>>> <replicated-cache name="sessions" mode="SYNC"/>
>>> <replicated-cache name="loginFailures" mode="SYNC?/>
>>> but with same result.
>>>
>>> I?m starting nodes by
>>> ./jb1/bin/standalone.sh --server-config=standalone-ha.xml
>>> -Djboss.node.name=node1
>>> ./jb2/bin/standalone.sh --server-config=standalone-ha.xml
>>> -Djboss.socket.binding.port-offset=100 -Djboss.node.name=node2
>>>
>>>
>>> both jb1 and jb2 are identical and they know each other (Received 
>>> new cluster
>>> view: [node1/keycloak|1] [node1/keycloak, node2/keycloak])
>>>
>>> How do you test clustering of KC please?
>>>
>>> Thanks,
>>>
>>> Libor Krzy?anek
>>> jboss.org Development Team
>>>
>>>
>>> _______________________________________________
>>> keycloak-user mailing list
>>> keycloak-user at lists.jboss.org
>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150424/f174cd15/attachment.html 

From b.hansmann at alphaapps.de  Fri Apr 24 18:07:43 2015
From: b.hansmann at alphaapps.de (Benjamin Hansmann [alphaApps])
Date: Sat, 25 Apr 2015 00:07:43 +0200
Subject: [keycloak-user] Email verification and get admin-client
 exception entitiy
In-Reply-To: <5539E839.1080005@redhat.com>
References: <1429792915.4339.10.camel@devs.alphaapps.de>
	<5539E839.1080005@redhat.com>
Message-ID: <1429913263.8408.6.camel@devs.alphaapps.de>

On Fri, 2015-04-24 at 08:52 +0200, Marek Posolda wrote:
> On 23.4.2015 14:41, Benjamin Hansmann [alphaApps] wrote:
> > Greetings once again. Two more questions:
> >
> > - Is there any way to trigger/send a verification email other than
> > logging in through the web frontend? I created the user through the
> > admin-client and the user will use the direct grant api to login.
> I think it's not possible. That's one of the limitations of Direct Grant 
> API.
> 
> There is admin endpoint to remove required action from the user though, 
> so you as admin can remove the required action for verify email from the 
> user. But user himself needs to use frontend to verify email AFAIK.
> >
> > - When using the admin-client to create a user I want to handle/forward
> > the response body. E.g. when a username already exists a
> > ClientErrorException is thrown which includes a
> > javax.ws.rs.core.Response with Status.CONFLICT. But there does not seem
> > to be an entitiy/body in this Response. When I use the Admin REST API
> > directly I will get: { "errorMessage" : "User exists with
> > same username" }. Is there a way to obtain it when using the
> > admin-client?
> I think you're right. It looks that most of POST methods in admin-client 
> return "void" instead of Response, so there is no possibility to check 
> the details. Feel free to create JIRA for that.
> 
> Btv. If you have Keycloak sources and you want to give it a try, then 
> you can try to change this line: 
> https://github.com/keycloak/keycloak/blob/master/integration/admin-client/src/main/java/org/keycloak/admin/client/resource/UsersResource.java#L34 
> to return "Response" instead of void. Then from the Response, you should 
> be able to retrieve entity as ErrorRepresentation with the proper error 
> method attached.
> 

Thanks for the tip, Marek. I gave it a try, but the returned Response is
the same as the one that was included in the ClientErrorException. The
entity is null. Any other suggestions? If not I will use Apache
HttpClient.

Benjamin

> Marek
> >
> > Thanks and best wishes,
> > Benjamin
> 

-- 

[alphaApps] mobile development

Benjamin Hansmann

Nosthoffenstra?e 46
D-40589 D?sseldorf
Germany

Mobile: +49 (0) 177 249 47 47
Email: b.hansmann at alphaapps.de


From guydavis.ca at gmail.com  Sun Apr 26 23:03:19 2015
From: guydavis.ca at gmail.com (Guy Davis)
Date: Sun, 26 Apr 2015 21:03:19 -0600
Subject: [keycloak-user] Access to token and claims from SAML IdP
Message-ID: <CAAgmn1rtjzD2HPY+Xw8W5ihC1x-7smujye3u4ZWj9S0T9PT+LQ@mail.gmail.com>

Good day,

Similar to the way the recently added Kerberos support
<http://blog.keycloak.org/2015/04/kerberos-support-in-keycloak.html> allows
for an application to access the underlying Kerberos ticket, I was
wondering if it is possible to get at the token and claims of a configured
SAML identity broker?

If this is possible, are there any examples of such usage? Any help is much
appreciated.

Thanks,
Guy
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150426/83580671/attachment.html 

From lkrzyzan at redhat.com  Mon Apr 27 03:05:33 2015
From: lkrzyzan at redhat.com (=?utf-8?Q?Libor_Krzy=C5=BEanek?=)
Date: Mon, 27 Apr 2015 09:05:33 +0200
Subject: [keycloak-user] Clustering on localhost with shared DB
In-Reply-To: <553A7808.4060602@redhat.com>
References: <F4DA0413-269A-4F82-89D8-EB3FFDE8ED88@redhat.com>
	<568869667.6140931.1429882583171.JavaMail.zimbra@redhat.com>
	<0AD87949-C8F5-418C-8C79-036155DBEBD7@redhat.com>
	<553A7808.4060602@redhat.com>
Message-ID: <10489A03-3588-4C03-BBB6-44341EFBE94A@redhat.com>

Hi Marek,
your?re right that i?m hitting directly localhsot on different ports.

I was thinking about cookies resp. load balancer so I checked cookies and they were sent on both ports.

I?ll set up load balancer and I?ll will see. 

Thanks,

Libor Krzy?anek
jboss.org <http://jboss.org/> Development Team

> On 24 Apr 2015, at 19:06, Marek Posolda <mposolda at redhat.com> wrote:
> 
> Hi Libor,
> 
> the config files looks good (at least for the first look), but question is if you're using loadbalancer? 
> 
> If you're not using loadbalancer and you access keycloak servers directly on localhost:8080 and localhost:8180, the problem might be just in the fact that browser cookie KEYCLOAK_IDENTITY is not shared between them and hence going to localhost:8180 will not find KEYCLOAK_IDENTITY cookie from localhost:8080 and will try to create new session. 
> 
> You can check admin console or account management and list available user sessions on both nodes. If both cluster nodes have same sessions, then replication of userSessions works fine, but only issue is really the cookie. 
> 
> I suspect that in production, you will use loadbalancer, so this issue won't happen.
> 
> Marek
> 
> On 24.4.2015 15:50, Libor Krzy?anek wrote:
>> Attaching keycloak-server.json and standalone-ha.xml
>> 
>> Thanks,
>> 
>> Libor Krzy?anek
>> jboss.org <http://jboss.org/> Development Team
>> 
>> 
>> 
>> 
>> 
>>> On 24 Apr 2015, at 15:36, Stian Thorgersen <stian at redhat.com <mailto:stian at redhat.com>> wrote:
>>> 
>>> Can you attach your keycloak-server.json and standalone.xml?
>>> 
>>> ----- Original Message -----
>>>> From: "Libor Krzy?anek" <lkrzyzan at redhat.com <mailto:lkrzyzan at redhat.com>>
>>>> To: "keycloak-user" <keycloak-user at lists.jboss.org <mailto:keycloak-user at lists.jboss.org>>
>>>> Sent: Friday, 24 April, 2015 3:12:29 PM
>>>> Subject: [keycloak-user] Clustering on localhost with shared DB
>>>> 
>>>> Hi,
>>>> I?m trying to achieve full user session replication which means when I?m
>>>> logged in on node 1 and then hit node 2 then I expect to be logged in but
>>>> I?m forced to log in again.
>>>> 
>>>> I have:
>>>> 1. two localhost nodes with JBoss EAP 6.4 + War installation
>>>> 2. Postgres
>>>> 3. EAP cofigured based on
>>>> http://docs.jboss.org/keycloak/docs/1.2.0.Beta1/userguide/html/clustering.html <http://docs.jboss.org/keycloak/docs/1.2.0.Beta1/userguide/html/clustering.html>
>>>> 
>>>> I triedeither
>>>> <distributed-cache name="sessions" mode="SYNC" owners=? 2 " />
>>>> <distributed-cache name="loginFailures" mode="SYNC" owners=? 2 " />
>>>> or
>>>> <replicated-cache name="sessions" mode="SYNC"/>
>>>> <replicated-cache name="loginFailures" mode="SYNC?/>
>>>> but with same result.
>>>> 
>>>> I?m starting nodes by
>>>> ./jb1/bin/standalone.sh --server-config=standalone-ha.xml
>>>> -Djboss.node.name=node1
>>>> ./jb2/bin/standalone.sh --server-config=standalone-ha.xml
>>>> -Djboss.socket.binding.port-offset=100 -Djboss.node.name=node2
>>>> 
>>>> 
>>>> both jb1 and jb2 are identical and they know each other (Received new cluster
>>>> view: [node1/keycloak|1] [node1/keycloak, node2/keycloak])
>>>> 
>>>> How do you test clustering of KC please?
>>>> 
>>>> Thanks,
>>>> 
>>>> Libor Krzy?anek
>>>> jboss.org Development Team
>>>> 
>>>> 
>>>> _______________________________________________
>>>> keycloak-user mailing list
>>>> keycloak-user at lists.jboss.org <mailto:keycloak-user at lists.jboss.org>
>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user <https://lists.jboss.org/mailman/listinfo/keycloak-user>
>> 
>> 
>> 
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org <mailto:keycloak-user at lists.jboss.org>
>> https://lists.jboss.org/mailman/listinfo/keycloak-user <https://lists.jboss.org/mailman/listinfo/keycloak-user>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150427/143aba25/attachment-0001.html 

From mposolda at redhat.com  Mon Apr 27 03:46:39 2015
From: mposolda at redhat.com (Marek Posolda)
Date: Mon, 27 Apr 2015 09:46:39 +0200
Subject: [keycloak-user] Email verification and get admin-client
 exception entitiy
In-Reply-To: <1429913263.8408.6.camel@devs.alphaapps.de>
References: <1429792915.4339.10.camel@devs.alphaapps.de>	
	<5539E839.1080005@redhat.com>
	<1429913263.8408.6.camel@devs.alphaapps.de>
Message-ID: <553DE95F.4010406@redhat.com>

On 25.4.2015 00:07, Benjamin Hansmann [alphaApps] wrote:
> On Fri, 2015-04-24 at 08:52 +0200, Marek Posolda wrote:
>> On 23.4.2015 14:41, Benjamin Hansmann [alphaApps] wrote:
>>> Greetings once again. Two more questions:
>>>
>>> - Is there any way to trigger/send a verification email other than
>>> logging in through the web frontend? I created the user through the
>>> admin-client and the user will use the direct grant api to login.
>> I think it's not possible. That's one of the limitations of Direct Grant
>> API.
>>
>> There is admin endpoint to remove required action from the user though,
>> so you as admin can remove the required action for verify email from the
>> user. But user himself needs to use frontend to verify email AFAIK.
>>> - When using the admin-client to create a user I want to handle/forward
>>> the response body. E.g. when a username already exists a
>>> ClientErrorException is thrown which includes a
>>> javax.ws.rs.core.Response with Status.CONFLICT. But there does not seem
>>> to be an entitiy/body in this Response. When I use the Admin REST API
>>> directly I will get: { "errorMessage" : "User exists with
>>> same username" }. Is there a way to obtain it when using the
>>> admin-client?
>> I think you're right. It looks that most of POST methods in admin-client
>> return "void" instead of Response, so there is no possibility to check
>> the details. Feel free to create JIRA for that.
>>
>> Btv. If you have Keycloak sources and you want to give it a try, then
>> you can try to change this line:
>> https://github.com/keycloak/keycloak/blob/master/integration/admin-client/src/main/java/org/keycloak/admin/client/resource/UsersResource.java#L34
>> to return "Response" instead of void. Then from the Response, you should
>> be able to retrieve entity as ErrorRepresentation with the proper error
>> method attached.
>>
> Thanks for the tip, Marek. I gave it a try, but the returned Response is
> the same as the one that was included in the ClientErrorException. The
> entity is null. Any other suggestions? If not I will use Apache
> HttpClient.
That's quite strange. I've just tried our test of admin-client for 
duplicated user and it's possible to retrieve underlying 
ErrorRepresentation and error message from ClientErrorException without 
issues. See 
https://github.com/mposolda/keycloak/blob/master/testsuite/integration/src/test/java/org/keycloak/testsuite/admin/UserTest.java#L49 
. So not sure why it's not working for you.

Marek
>
> Benjamin
>
>> Marek
>>> Thanks and best wishes,
>>> Benjamin


From chamantha at outlook.com  Mon Apr 27 03:52:20 2015
From: chamantha at outlook.com (Chamantha De Silva)
Date: Mon, 27 Apr 2015 13:52:20 +0600
Subject: [keycloak-user] Keycloak logging with log4j to use custom rolling
	appender
In-Reply-To: <BAY168-W280CC0C4AF61B3891C7676A9E90@phx.gbl>
References: <BAY168-W280CC0C4AF61B3891C7676A9E90@phx.gbl>
Message-ID: <BAY168-W71A7C2493262BEE1D5D0B5A9E90@phx.gbl>


Hi Team,

I'm trying to use Log4J for keycloak project as logging framework 
since there are custom rolling appenders we have written with few value 
additions.

I was referring to changing logging subsystem in wildfly (at keycloak/standalone/configuration/standalone.xml ), 
but seems like I'm missing something.


How can I add a custom log4j rolling appender to Keycloak .


Best Regards,
Chamantha

 		 	   		   		 	   		  
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150427/3338e5f6/attachment.html 

From bburke at redhat.com  Mon Apr 27 07:44:30 2015
From: bburke at redhat.com (Bill Burke)
Date: Mon, 27 Apr 2015 07:44:30 -0400
Subject: [keycloak-user] Access to token and claims from SAML IdP
In-Reply-To: <CAAgmn1rtjzD2HPY+Xw8W5ihC1x-7smujye3u4ZWj9S0T9PT+LQ@mail.gmail.com>
References: <CAAgmn1rtjzD2HPY+Xw8W5ihC1x-7smujye3u4ZWj9S0T9PT+LQ@mail.gmail.com>
Message-ID: <553E211E.6020505@redhat.com>

In master this functionality is available.  You can also now set up 
mappers to import role mappings and other attributes.  We will have a 
release Wednesday.

On 4/26/2015 11:03 PM, Guy Davis wrote:
> Good day,
>
> Similar to the way the recently added Kerberos support
> <http://blog.keycloak.org/2015/04/kerberos-support-in-keycloak.html>
> allows for an application to access the underlying Kerberos ticket, I
> was wondering if it is possible to get at the token and claims of a
> configured SAML identity broker?
>
> If this is possible, are there any examples of such usage? Any help is
> much appreciated.
>
> Thanks,
> Guy
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

-- 
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com

From lkrzyzan at redhat.com  Mon Apr 27 07:50:29 2015
From: lkrzyzan at redhat.com (=?utf-8?Q?Libor_Krzy=C5=BEanek?=)
Date: Mon, 27 Apr 2015 13:50:29 +0200
Subject: [keycloak-user] Clustering on localhost with shared DB
In-Reply-To: <10489A03-3588-4C03-BBB6-44341EFBE94A@redhat.com>
References: <F4DA0413-269A-4F82-89D8-EB3FFDE8ED88@redhat.com>
	<568869667.6140931.1429882583171.JavaMail.zimbra@redhat.com>
	<0AD87949-C8F5-418C-8C79-036155DBEBD7@redhat.com>
	<553A7808.4060602@redhat.com>
	<10489A03-3588-4C03-BBB6-44341EFBE94A@redhat.com>
Message-ID: <DED42811-2CAD-484F-AEFB-BA723F5F48BD@redhat.com>

Hi,
I have now apache webproxy with this configuration:
<Proxy *>
  Order allow,deny
  Allow from all
</Proxy>
<Proxy balancer://app/>
  BalancerMember http://localhost:8080 route=app02
  BalancerMember http://localhost:8180 route=app03
  ProxySet lbmethod=byrequests
</Proxy>
ProxyPass /balancer-manager !
ProxyPass /server-status !
ProxyPass /server-info !
ProxyPass / balancer://app/ <balancer://app/>
ProxyPassReverse / balancer://app/

It looks it helped.
When I have started both nodes and I see that caches on both nodes are started then everything is fine.
Scenario: When I login to node1, then stop node1, then I?m redirected to node2 and I?m still logged in. Great!

But I see two issues right now:
1. Caches are replicated to newly started node too late.
Scenario is:
1. start node1, log in.
2. start node2, wait till you see that node1 knows new node and node2 is fully started
3. killl node1.

Then I?m redirected to login page.

This happens really only when no request hits newly started node2. If I do few reloads in browser before I kill node1 then I see in logs that those infinispan caches are created on node2 and fully replicated.

Is it related to ?start = EAGER? ?

2. Weird thing is on /account/session page (http://localhost/auth/realms/cluster-test/account/sessions <http://localhost/auth/realms/cluster-test/account/sessions>).

I got:

13:30:50,291 ERROR [org.apache.catalina.core.ContainerBase.[jboss.web].[default-host].[/auth].[Keycloak REST Interface]] (http-/127.0.0.1:8080-2) JBWEB000236: Servlet.service() for servlet Keycloak REST Interface threw exception: java.lang.RuntimeException: request path: /auth/realms/cluster-test/account/sessions
	at org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:54) [keycloak-services-1.2.0.Beta1.jar:1.2.0.Beta1]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:246) [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:214) [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
	at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:231) [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
	at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:149) [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
	at org.jboss.modcluster.container.jbossweb.JBossWebContext$RequestListenerValve.event(JBossWebContext.java:91)
	at org.jboss.modcluster.container.jbossweb.JBossWebContext$RequestListenerValve.invoke(JBossWebContext.java:72)
	at org.jboss.as.jpa.interceptor.WebNonTxEmCloserValve.invoke(WebNonTxEmCloserValve.java:50) [jboss-as-jpa-7.5.0.Final-redhat-21.jar:7.5.0.Final-redhat-21]
	at org.jboss.as.jpa.interceptor.WebNonTxEmCloserValve.invoke(WebNonTxEmCloserValve.java:50) [jboss-as-jpa-7.5.0.Final-redhat-21.jar:7.5.0.Final-redhat-21]
	at org.jboss.as.web.security.SecurityContextAssociationValve.invoke(SecurityContextAssociationValve.java:169) [jboss-as-web-7.5.0.Final-redhat-21.jar:7.5.0.Final-redhat-21]
	at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:150) [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
	at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:97) [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
	at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:102) [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
	at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:344) [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
	at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:854) [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
	at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:653) [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
	at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:926) [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
	at java.lang.Thread.run(Thread.java:745) [rt.jar:1.8.0_40]
Caused by: org.jboss.resteasy.spi.UnhandledException: java.lang.IllegalStateException: Cache mode should be DIST, rather than REPL_SYNC
	at org.jboss.resteasy.core.ExceptionHandler.handleApplicationException(ExceptionHandler.java:76) [resteasy-jaxrs-3.0.9.Final.jar:]
	at org.jboss.resteasy.core.ExceptionHandler.handleException(ExceptionHandler.java:212) [resteasy-jaxrs-3.0.9.Final.jar:]
	at org.jboss.resteasy.core.SynchronousDispatcher.writeException(SynchronousDispatcher.java:149) [resteasy-jaxrs-3.0.9.Final.jar:]
	at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:372) [resteasy-jaxrs-3.0.9.Final.jar:]
	at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:179) [resteasy-jaxrs-3.0.9.Final.jar:]
	at org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:220) [resteasy-jaxrs-3.0.9.Final.jar:]
	at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56) [resteasy-jaxrs-3.0.9.Final.jar:]
	at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51) [resteasy-jaxrs-3.0.9.Final.jar:]
	at javax.servlet.http.HttpServlet.service(HttpServlet.java:847) [jboss-servlet-api_3.0_spec-1.0.2.Final-redhat-2.jar:1.0.2.Final-redhat-2]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:295) [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:214) [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
	at org.keycloak.services.filters.ClientConnectionFilter.doFilter(ClientConnectionFilter.java:41) [keycloak-services-1.2.0.Beta1.jar:1.2.0.Beta1]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:246) [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:214) [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
	at org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:40) [keycloak-services-1.2.0.Beta1.jar:1.2.0.Beta1]
	... 17 more
Caused by: java.lang.IllegalStateException: Cache mode should be DIST, rather than REPL_SYNC
	at org.infinispan.distexec.mapreduce.MapReduceTask.ensureProperCacheState(MapReduceTask.java:685) [infinispan-core-5.2.11.Final-redhat-2.jar:5.2.11.Final-redhat-2]
	at org.infinispan.distexec.mapreduce.MapReduceTask.<init>(MapReduceTask.java:226) [infinispan-core-5.2.11.Final-redhat-2.jar:5.2.11.Final-redhat-2]
	at org.infinispan.distexec.mapreduce.MapReduceTask.<init>(MapReduceTask.java:190) [infinispan-core-5.2.11.Final-redhat-2.jar:5.2.11.Final-redhat-2]
	at org.keycloak.models.sessions.infinispan.InfinispanUserSessionProvider.getUserSessions(InfinispanUserSessionProvider.java:121) [keycloak-model-sessions-infinispan-1.2.0.Beta1.jar:1.2.0.Beta1]
	at org.keycloak.services.resources.AccountService.sessionsPage(AccountService.java:344) [keycloak-services-1.2.0.Beta1.jar:1.2.0.Beta1]
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) [rt.jar:1.8.0_40]
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) [rt.jar:1.8.0_40]
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) [rt.jar:1.8.0_40]
	at java.lang.reflect.Method.invoke(Method.java:497) [rt.jar:1.8.0_40]
	at org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java:137) [resteasy-jaxrs-3.0.9.Final.jar:]
	at org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTarget(ResourceMethodInvoker.java:296) [resteasy-jaxrs-3.0.9.Final.jar:]
	at org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:250) [resteasy-jaxrs-3.0.9.Final.jar:]
	at org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(ResourceLocatorInvoker.java:140) [resteasy-jaxrs-3.0.9.Final.jar:]
	at org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:103) [resteasy-jaxrs-3.0.9.Final.jar:]
	at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:356) [resteasy-jaxrs-3.0.9.Final.jar:]
	... 28 more


Same error I get in admin console (http://localhost/auth/admin/master/console/#/realms/cluster-test/sessions/realm <http://localhost/auth/admin/master/console/#/realms/cluster-test/sessions/realm>)

Thanks,

Libor Krzy?anek
jboss.org <http://jboss.org/> Development Team

> On 27 Apr 2015, at 09:05, Libor Krzy?anek <lkrzyzan at redhat.com> wrote:
> 
> Hi Marek,
> your?re right that i?m hitting directly localhsot on different ports.
> 
> I was thinking about cookies resp. load balancer so I checked cookies and they were sent on both ports.
> 
> I?ll set up load balancer and I?ll will see. 
> 
> Thanks,
> 
> Libor Krzy?anek
> jboss.org <http://jboss.org/> Development Team
> 
>> On 24 Apr 2015, at 19:06, Marek Posolda <mposolda at redhat.com <mailto:mposolda at redhat.com>> wrote:
>> 
>> Hi Libor,
>> 
>> the config files looks good (at least for the first look), but question is if you're using loadbalancer? 
>> 
>> If you're not using loadbalancer and you access keycloak servers directly on localhost:8080 and localhost:8180, the problem might be just in the fact that browser cookie KEYCLOAK_IDENTITY is not shared between them and hence going to localhost:8180 will not find KEYCLOAK_IDENTITY cookie from localhost:8080 and will try to create new session. 
>> 
>> You can check admin console or account management and list available user sessions on both nodes. If both cluster nodes have same sessions, then replication of userSessions works fine, but only issue is really the cookie. 
>> 
>> I suspect that in production, you will use loadbalancer, so this issue won't happen.
>> 
>> Marek
>> 
>> On 24.4.2015 15:50, Libor Krzy?anek wrote:
>>> Attaching keycloak-server.json and standalone-ha.xml
>>> 
>>> Thanks,
>>> 
>>> Libor Krzy?anek
>>> jboss.org <http://jboss.org/> Development Team
>>> 
>>> 
>>> 
>>> 
>>> 
>>>> On 24 Apr 2015, at 15:36, Stian Thorgersen <stian at redhat.com <mailto:stian at redhat.com>> wrote:
>>>> 
>>>> Can you attach your keycloak-server.json and standalone.xml?
>>>> 
>>>> ----- Original Message -----
>>>>> From: "Libor Krzy?anek" <lkrzyzan at redhat.com <mailto:lkrzyzan at redhat.com>>
>>>>> To: "keycloak-user" <keycloak-user at lists.jboss.org <mailto:keycloak-user at lists.jboss.org>>
>>>>> Sent: Friday, 24 April, 2015 3:12:29 PM
>>>>> Subject: [keycloak-user] Clustering on localhost with shared DB
>>>>> 
>>>>> Hi,
>>>>> I?m trying to achieve full user session replication which means when I?m
>>>>> logged in on node 1 and then hit node 2 then I expect to be logged in but
>>>>> I?m forced to log in again.
>>>>> 
>>>>> I have:
>>>>> 1. two localhost nodes with JBoss EAP 6.4 + War installation
>>>>> 2. Postgres
>>>>> 3. EAP cofigured based on
>>>>> http://docs.jboss.org/keycloak/docs/1.2.0.Beta1/userguide/html/clustering.html <http://docs.jboss.org/keycloak/docs/1.2.0.Beta1/userguide/html/clustering.html>
>>>>> 
>>>>> I triedeither
>>>>> <distributed-cache name="sessions" mode="SYNC" owners=? 2 " />
>>>>> <distributed-cache name="loginFailures" mode="SYNC" owners=? 2 " />
>>>>> or
>>>>> <replicated-cache name="sessions" mode="SYNC"/>
>>>>> <replicated-cache name="loginFailures" mode="SYNC?/>
>>>>> but with same result.
>>>>> 
>>>>> I?m starting nodes by
>>>>> ./jb1/bin/standalone.sh --server-config=standalone-ha.xml
>>>>> -Djboss.node.name=node1
>>>>> ./jb2/bin/standalone.sh --server-config=standalone-ha.xml
>>>>> -Djboss.socket.binding.port-offset=100 -Djboss.node.name=node2
>>>>> 
>>>>> 
>>>>> both jb1 and jb2 are identical and they know each other (Received new cluster
>>>>> view: [node1/keycloak|1] [node1/keycloak, node2/keycloak])
>>>>> 
>>>>> How do you test clustering of KC please?
>>>>> 
>>>>> Thanks,
>>>>> 
>>>>> Libor Krzy?anek
>>>>> jboss.org <http://jboss.org/> Development Team
>>>>> 
>>>>> 
>>>>> _______________________________________________
>>>>> keycloak-user mailing list
>>>>> keycloak-user at lists.jboss.org <mailto:keycloak-user at lists.jboss.org>
>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user <https://lists.jboss.org/mailman/listinfo/keycloak-user>
>>> 
>>> 
>>> 
>>> _______________________________________________
>>> keycloak-user mailing list
>>> keycloak-user at lists.jboss.org <mailto:keycloak-user at lists.jboss.org>
>>> https://lists.jboss.org/mailman/listinfo/keycloak-user <https://lists.jboss.org/mailman/listinfo/keycloak-user>
> 
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150427/eef0f54e/attachment-0001.html 

From mposolda at redhat.com  Mon Apr 27 08:24:46 2015
From: mposolda at redhat.com (Marek Posolda)
Date: Mon, 27 Apr 2015 14:24:46 +0200
Subject: [keycloak-user] Clustering on localhost with shared DB
In-Reply-To: <DED42811-2CAD-484F-AEFB-BA723F5F48BD@redhat.com>
References: <F4DA0413-269A-4F82-89D8-EB3FFDE8ED88@redhat.com>
	<568869667.6140931.1429882583171.JavaMail.zimbra@redhat.com>
	<0AD87949-C8F5-418C-8C79-036155DBEBD7@redhat.com>
	<553A7808.4060602@redhat.com>
	<10489A03-3588-4C03-BBB6-44341EFBE94A@redhat.com>
	<DED42811-2CAD-484F-AEFB-BA723F5F48BD@redhat.com>
Message-ID: <553E2A8E.3080309@redhat.com>

On 27.4.2015 13:50, Libor Krzy?anek wrote:
> Hi,
> I have now apache webproxy with this configuration:
> <Proxy *>
>   Order allow,deny
>   Allow from all
> </Proxy>
> <Proxy balancer://app/>
>   BalancerMember http://localhost:8080 route=app02
>   BalancerMember http://localhost:8180 route=app03
>   ProxySet lbmethod=byrequests
> </Proxy>
> ProxyPass /balancer-manager !
> ProxyPass /server-status !
> ProxyPass /server-info !
> ProxyPass / balancer://app/
> ProxyPassReverse / balancer://app/
>
> It looks it helped.
> When I have started both nodes and I see that caches on both nodes are 
> started then everything is fine.
> Scenario: When I login to node1, then stop node1, then I?m redirected 
> to node2 and I?m still logged in. Great!
>
> But I see two issues right now:
> 1. Caches are replicated to newly started node too late.
> Scenario is:
> 1. start node1, log in.
> 2. start node2, wait till you see that node1 knows new node and node2 
> is fully started
> 3. killl node1.
>
> Then I?m redirected to login page.
>
> This happens really only when no request hits newly started node2. If 
> I do few reloads in browser before I kill node1 then I see in logs 
> that those infinispan caches are created on node2 and fully replicated.
>
> Is it related to ?start = EAGER? ?
Will it help if you use in standalone-ha.xml the config like this? :

<distributed-cache name="sessions" mode="SYNC" owners="2" segments="60" >
   <state-transfer enabled="true" />
</distributed-cache>


>
> 2. Weird thing is on /account/session page 
> (http://localhost/auth/realms/cluster-test/account/sessions).
>
> I got:
>
> 13:30:50,291 ERROR 
> [org.apache.catalina.core.ContainerBase.[jboss.web].[default-host].[/auth].[Keycloak 
> REST Interface]] (http-/127.0.0.1:8080-2) 
> JBWEB000236: Servlet.service() for servlet Keycloak REST Interface 
> threw exception: java.lang.RuntimeException: request path: 
> /auth/realms/cluster-test/account/sessions
> at 
> org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:54) 
> [keycloak-services-1.2.0.Beta1.jar:1.2.0.Beta1]
> at 
> org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:246) 
> [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
> at 
> org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:214) 
> [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
> at 
> org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:231) 
> [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
> at 
> org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:149) 
> [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
> at 
> org.jboss.modcluster.container.jbossweb.JBossWebContext$RequestListenerValve.event(JBossWebContext.java:91)
> at 
> org.jboss.modcluster.container.jbossweb.JBossWebContext$RequestListenerValve.invoke(JBossWebContext.java:72)
> at 
> org.jboss.as.jpa.interceptor.WebNonTxEmCloserValve.invoke(WebNonTxEmCloserValve.java:50) 
> [jboss-as-jpa-7.5.0.Final-redhat-21.jar:7.5.0.Final-redhat-21]
> at 
> org.jboss.as.jpa.interceptor.WebNonTxEmCloserValve.invoke(WebNonTxEmCloserValve.java:50) 
> [jboss-as-jpa-7.5.0.Final-redhat-21.jar:7.5.0.Final-redhat-21]
> at 
> org.jboss.as.web.security.SecurityContextAssociationValve.invoke(SecurityContextAssociationValve.java:169) 
> [jboss-as-web-7.5.0.Final-redhat-21.jar:7.5.0.Final-redhat-21]
> at 
> org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:150) 
> [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
> at 
> org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:97) 
> [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
> at 
> org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:102) 
> [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
> at 
> org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:344) 
> [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
> at 
> org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:854) 
> [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
> at 
> org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:653) 
> [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
> at 
> org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:926) [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
> at java.lang.Thread.run(Thread.java:745) [rt.jar:1.8.0_40]
> Caused by: org.jboss.resteasy.spi.UnhandledException: 
> java.lang.IllegalStateException: Cache mode should be DIST, rather 
> than REPL_SYNC
> at 
> org.jboss.resteasy.core.ExceptionHandler.handleApplicationException(ExceptionHandler.java:76) 
> [resteasy-jaxrs-3.0.9.Final.jar:]
> at 
> org.jboss.resteasy.core.ExceptionHandler.handleException(ExceptionHandler.java:212) 
> [resteasy-jaxrs-3.0.9.Final.jar:]
> at 
> org.jboss.resteasy.core.SynchronousDispatcher.writeException(SynchronousDispatcher.java:149) 
> [resteasy-jaxrs-3.0.9.Final.jar:]
> at 
> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:372) 
> [resteasy-jaxrs-3.0.9.Final.jar:]
> at 
> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:179) 
> [resteasy-jaxrs-3.0.9.Final.jar:]
> at 
> org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:220) 
> [resteasy-jaxrs-3.0.9.Final.jar:]
> at 
> org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56) 
> [resteasy-jaxrs-3.0.9.Final.jar:]
> at 
> org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51) 
> [resteasy-jaxrs-3.0.9.Final.jar:]
> at javax.servlet.http.HttpServlet.service(HttpServlet.java:847) 
> [jboss-servlet-api_3.0_spec-1.0.2.Final-redhat-2.jar:1.0.2.Final-redhat-2]
> at 
> org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:295) 
> [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
> at 
> org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:214) 
> [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
> at 
> org.keycloak.services.filters.ClientConnectionFilter.doFilter(ClientConnectionFilter.java:41) 
> [keycloak-services-1.2.0.Beta1.jar:1.2.0.Beta1]
> at 
> org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:246) 
> [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
> at 
> org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:214) 
> [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
> at 
> org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:40) 
> [keycloak-services-1.2.0.Beta1.jar:1.2.0.Beta1]
> ... 17 more
> Caused by: java.lang.IllegalStateException: Cache mode should be DIST, 
> rather than REPL_SYNC
> at 
> org.infinispan.distexec.mapreduce.MapReduceTask.ensureProperCacheState(MapReduceTask.java:685) 
> [infinispan-core-5.2.11.Final-redhat-2.jar:5.2.11.Final-redhat-2]
> at 
> org.infinispan.distexec.mapreduce.MapReduceTask.<init>(MapReduceTask.java:226) 
> [infinispan-core-5.2.11.Final-redhat-2.jar:5.2.11.Final-redhat-2]
> at 
> org.infinispan.distexec.mapreduce.MapReduceTask.<init>(MapReduceTask.java:190) 
> [infinispan-core-5.2.11.Final-redhat-2.jar:5.2.11.Final-redhat-2]
> at 
> org.keycloak.models.sessions.infinispan.InfinispanUserSessionProvider.getUserSessions(InfinispanUserSessionProvider.java:121) 
> [keycloak-model-sessions-infinispan-1.2.0.Beta1.jar:1.2.0.Beta1]
> at 
> org.keycloak.services.resources.AccountService.sessionsPage(AccountService.java:344) 
> [keycloak-services-1.2.0.Beta1.jar:1.2.0.Beta1]
> at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) 
> [rt.jar:1.8.0_40]
> at 
> sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) 
> [rt.jar:1.8.0_40]
> at 
> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) 
> [rt.jar:1.8.0_40]
> at java.lang.reflect.Method.invoke(Method.java:497) [rt.jar:1.8.0_40]
> at 
> org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java:137) 
> [resteasy-jaxrs-3.0.9.Final.jar:]
> at 
> org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTarget(ResourceMethodInvoker.java:296) 
> [resteasy-jaxrs-3.0.9.Final.jar:]
> at 
> org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:250) 
> [resteasy-jaxrs-3.0.9.Final.jar:]
> at 
> org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(ResourceLocatorInvoker.java:140) 
> [resteasy-jaxrs-3.0.9.Final.jar:]
> at 
> org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:103) 
> [resteasy-jaxrs-3.0.9.Final.jar:]
> at 
> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:356) 
> [resteasy-jaxrs-3.0.9.Final.jar:]
> ... 28 more
>
>
> Same error I get in admin console 
> (http://localhost/auth/admin/master/console/#/realms/cluster-test/sessions/realm)
Strange... Are you using "distributed-cache" with mode "SYNC" on both 
cluster nodes?

Marek
>
> Thanks,
>
> Libor Krzy?anek
> jboss.org <http://jboss.org> Development Team
>
>> On 27 Apr 2015, at 09:05, Libor Krzy?anek <lkrzyzan at redhat.com 
>> <mailto:lkrzyzan at redhat.com>> wrote:
>>
>> Hi Marek,
>> your?re right that i?m hitting directly localhsot on different ports.
>>
>> I was thinking about cookies resp. load balancer so I checked cookies 
>> and they were sent on both ports.
>>
>> I?ll set up load balancer and I?ll will see.
>>
>> Thanks,
>>
>> Libor Krzy?anek
>> jboss.org <http://jboss.org/> Development Team
>>
>>> On 24 Apr 2015, at 19:06, Marek Posolda <mposolda at redhat.com 
>>> <mailto:mposolda at redhat.com>> wrote:
>>>
>>> Hi Libor,
>>>
>>> the config files looks good (at least for the first look), but 
>>> question is if you're using loadbalancer?
>>>
>>> If you're not using loadbalancer and you access keycloak servers 
>>> directly on localhost:8080 and localhost:8180, the problem might be 
>>> just in the fact that browser cookie KEYCLOAK_IDENTITY is not shared 
>>> between them and hence going to localhost:8180 will not find 
>>> KEYCLOAK_IDENTITY cookie from localhost:8080 and will try to create 
>>> new session.
>>>
>>> You can check admin console or account management and list available 
>>> user sessions on both nodes. If both cluster nodes have same 
>>> sessions, then replication of userSessions works fine, but only 
>>> issue is really the cookie.
>>>
>>> I suspect that in production, you will use loadbalancer, so this 
>>> issue won't happen.
>>>
>>> Marek
>>>
>>> On 24.4.2015 15:50, Libor Krzy?anek wrote:
>>>> Attaching keycloak-server.json and standalone-ha.xml
>>>>
>>>> Thanks,
>>>>
>>>> Libor Krzy?anek
>>>> jboss.org <http://jboss.org/> Development Team
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>> On 24 Apr 2015, at 15:36, Stian Thorgersen <stian at redhat.com 
>>>>> <mailto:stian at redhat.com>> wrote:
>>>>>
>>>>> Can you attach your keycloak-server.json and standalone.xml?
>>>>>
>>>>> ----- Original Message -----
>>>>>> From: "Libor Krzy?anek" <lkrzyzan at redhat.com 
>>>>>> <mailto:lkrzyzan at redhat.com>>
>>>>>> To: "keycloak-user" <keycloak-user at lists.jboss.org 
>>>>>> <mailto:keycloak-user at lists.jboss.org>>
>>>>>> Sent: Friday, 24 April, 2015 3:12:29 PM
>>>>>> Subject: [keycloak-user] Clustering on localhost with shared DB
>>>>>>
>>>>>> Hi,
>>>>>> I?m trying to achieve full user session replication which means 
>>>>>> when I?m
>>>>>> logged in on node 1 and then hit node 2 then I expect to be 
>>>>>> logged in but
>>>>>> I?m forced to log in again.
>>>>>>
>>>>>> I have:
>>>>>> 1. two localhost nodes with JBoss EAP 6.4 + War installation
>>>>>> 2. Postgres
>>>>>> 3. EAP cofigured based on
>>>>>> http://docs.jboss.org/keycloak/docs/1.2.0.Beta1/userguide/html/clustering.html
>>>>>>
>>>>>> I triedeither
>>>>>> <distributed-cache name="sessions" mode="SYNC" owners=? 2 " />
>>>>>> <distributed-cache name="loginFailures" mode="SYNC" owners=? 2 " />
>>>>>> or
>>>>>> <replicated-cache name="sessions" mode="SYNC"/>
>>>>>> <replicated-cache name="loginFailures" mode="SYNC?/>
>>>>>> but with same result.
>>>>>>
>>>>>> I?m starting nodes by
>>>>>> ./jb1/bin/standalone.sh --server-config=standalone-ha.xml
>>>>>> -Djboss.node.name=node1
>>>>>> ./jb2/bin/standalone.sh --server-config=standalone-ha.xml
>>>>>> -Djboss.socket.binding.port-offset=100 -Djboss.node.name=node2
>>>>>>
>>>>>>
>>>>>> both jb1 and jb2 are identical and they know each other (Received 
>>>>>> new cluster
>>>>>> view: [node1/keycloak|1] [node1/keycloak, node2/keycloak])
>>>>>>
>>>>>> How do you test clustering of KC please?
>>>>>>
>>>>>> Thanks,
>>>>>>
>>>>>> Libor Krzy?anek
>>>>>> jboss.org <http://jboss.org/> Development Team
>>>>>>
>>>>>>
>>>>>> _______________________________________________
>>>>>> keycloak-user mailing list
>>>>>> keycloak-user at lists.jboss.org
>>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>
>>>>
>>>>
>>>> _______________________________________________
>>>> keycloak-user mailing list
>>>> keycloak-user at lists.jboss.org
>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>
>>
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org <mailto:keycloak-user at lists.jboss.org>
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150427/182a46fc/attachment-0001.html 

From lkrzyzan at redhat.com  Mon Apr 27 08:55:43 2015
From: lkrzyzan at redhat.com (=?utf-8?Q?Libor_Krzy=C5=BEanek?=)
Date: Mon, 27 Apr 2015 14:55:43 +0200
Subject: [keycloak-user] Clustering on localhost with shared DB
In-Reply-To: <553E2A8E.3080309@redhat.com>
References: <F4DA0413-269A-4F82-89D8-EB3FFDE8ED88@redhat.com>
	<568869667.6140931.1429882583171.JavaMail.zimbra@redhat.com>
	<0AD87949-C8F5-418C-8C79-036155DBEBD7@redhat.com>
	<553A7808.4060602@redhat.com>
	<10489A03-3588-4C03-BBB6-44341EFBE94A@redhat.com>
	<DED42811-2CAD-484F-AEFB-BA723F5F48BD@redhat.com>
	<553E2A8E.3080309@redhat.com>
Message-ID: <48628332-A8FB-4948-B681-F43DE340DB48@redhat.com>

Hi,
yeah this helps little bit:
                <invalidation-cache name="realms" mode="SYNC"/>
                <invalidation-cache name="users" mode="SYNC"/>
                <distributed-cache name="sessions" mode="SYNC" owners="2" segments="60" >
                    <state-transfer enabled="true" />
                </distributed-cache>
                <distributed-cache name="loginFailures" mode="SYNC" owners="2" segments="60" >
                    <state-transfer enabled="true" />
                </distributed-cache>

When both caches on both nodes are up then syncing works fine.
Also /sessions works OK.

But I?m still facing issue no 1.

When node is up I see in logs this:

14:51:19,088 INFO  [org.jboss.as] (Controller Boot Thread) JBAS015874: JBoss EAP 6.4.0.GA (AS 7.5.0.Final-redhat-21) started in 18527ms - Started 242 of 347 services (141 services are lazy, passive or on-demand)

Caches are initialised after first hit not after KC start

I?m talking about this in log:
14:51:52,597 INFO  [org.infinispan.jmx.CacheJmxRegistration] (http-/127.0.0.1:8080-1) ISPN000031: MBeans were successfully registered to the platform MBean server.
14:51:52,605 INFO  [org.jboss.as.clustering.infinispan] (http-/127.0.0.1:8080-1) JBAS010281: Started users cache from keycloak container
14:51:52,710 INFO  [org.infinispan.jmx.CacheJmxRegistration] (http-/127.0.0.1:8080-2) ISPN000031: MBeans were successfully registered to the platform MBean server.
14:51:52,815 INFO  [org.jboss.as.clustering.infinispan] (http-/127.0.0.1:8080-2) JBAS010281: Started sessions cache from keycloak container
14:51:52,822 INFO  [org.infinispan.jmx.CacheJmxRegistration] (http-/127.0.0.1:8080-2) ISPN000031: MBeans were successfully registered to the platform MBean server.
14:51:52,847 INFO  [org.jboss.as.clustering.infinispan] (http-/127.0.0.1:8080-2) JBAS010281: Started loginFailures cache from keycloak container



Thanks,

Libor Krzy?anek
jboss.org <http://jboss.org/> Development Team

> On 27 Apr 2015, at 14:24, Marek Posolda <mposolda at redhat.com> wrote:
> 
> On 27.4.2015 13:50, Libor Krzy?anek wrote:
>> Hi,
>> I have now apache webproxy with this configuration:
>> <Proxy *>
>>   Order allow,deny
>>   Allow from all
>> </Proxy>
>> <Proxy balancer://app/ <balancer://app/>>
>>   BalancerMember http://localhost:8080 <http://localhost:8080/> route=app02
>>   BalancerMember http://localhost:8180 <http://localhost:8180/> route=app03
>>   ProxySet lbmethod=byrequests
>> </Proxy>
>> ProxyPass /balancer-manager !
>> ProxyPass /server-status !
>> ProxyPass /server-info !
>> ProxyPass / balancer://app/ <balancer://app/>
>> ProxyPassReverse / balancer://app/ <balancer://app/>
>> 
>> It looks it helped.
>> When I have started both nodes and I see that caches on both nodes are started then everything is fine.
>> Scenario: When I login to node1, then stop node1, then I?m redirected to node2 and I?m still logged in. Great!
>> 
>> But I see two issues right now:
>> 1. Caches are replicated to newly started node too late.
>> Scenario is:
>> 1. start node1, log in.
>> 2. start node2, wait till you see that node1 knows new node and node2 is fully started
>> 3. killl node1.
>> 
>> Then I?m redirected to login page.
>> 
>> This happens really only when no request hits newly started node2. If I do few reloads in browser before I kill node1 then I see in logs that those infinispan caches are created on node2 and fully replicated.
>> 
>> Is it related to ?start = EAGER? ?
> Will it help if you use in standalone-ha.xml the config like this? :
> 
> <distributed-cache name="sessions" mode="SYNC" owners="2" segments="60" >
>   <state-transfer enabled="true" />
> </distributed-cache>
> 
> 
>> 
>> 2. Weird thing is on /account/session page (http://localhost/auth/realms/cluster-test/account/sessions <http://localhost/auth/realms/cluster-test/account/sessions>).
>> 
>> I got:
>> 
>> 13:30:50,291 ERROR [org.apache.catalina.core.ContainerBase.[jboss.web].[default-host].[/auth].[Keycloak REST Interface]] (http-/127.0.0.1:8080-2) JBWEB000236: Servlet.service() for servlet Keycloak REST Interface threw exception: java.lang.RuntimeException: request path: /auth/realms/cluster-test/account/sessions
>>  at org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:54) [keycloak-services-1.2.0.Beta1.jar:1.2.0.Beta1]
>>  at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:246) [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
>>  at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:214) [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
>>  at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:231) [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
>>  at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:149) [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
>>  at org.jboss.modcluster.container.jbossweb.JBossWebContext$RequestListenerValve.event(JBossWebContext.java:91)
>>  at org.jboss.modcluster.container.jbossweb.JBossWebContext$RequestListenerValve.invoke(JBossWebContext.java:72)
>>  at org.jboss.as.jpa.interceptor.WebNonTxEmCloserValve.invoke(WebNonTxEmCloserValve.java:50) [jboss-as-jpa-7.5.0.Final-redhat-21.jar:7.5.0.Final-redhat-21]
>>  at org.jboss.as.jpa.interceptor.WebNonTxEmCloserValve.invoke(WebNonTxEmCloserValve.java:50) [jboss-as-jpa-7.5.0.Final-redhat-21.jar:7.5.0.Final-redhat-21]
>>  at org.jboss.as.web.security.SecurityContextAssociationValve.invoke(SecurityContextAssociationValve.java:169) [jboss-as-web-7.5.0.Final-redhat-21.jar:7.5.0.Final-redhat-21]
>>  at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:150) [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
>>  at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:97) [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
>>  at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:102) [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
>>  at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:344) [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
>>  at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:854) [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
>>  at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:653) [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
>>  at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:926) [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
>>  at java.lang.Thread.run(Thread.java:745) [rt.jar:1.8.0_40]
>> Caused by: org.jboss.resteasy.spi.UnhandledException: java.lang.IllegalStateException: Cache mode should be DIST, rather than REPL_SYNC
>>  at org.jboss.resteasy.core.ExceptionHandler.handleApplicationException(ExceptionHandler.java:76) [resteasy-jaxrs-3.0.9.Final.jar:]
>>  at org.jboss.resteasy.core.ExceptionHandler.handleException(ExceptionHandler.java:212) [resteasy-jaxrs-3.0.9.Final.jar:]
>>  at org.jboss.resteasy.core.SynchronousDispatcher.writeException(SynchronousDispatcher.java:149) [resteasy-jaxrs-3.0.9.Final.jar:]
>>  at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:372) [resteasy-jaxrs-3.0.9.Final.jar:]
>>  at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:179) [resteasy-jaxrs-3.0.9.Final.jar:]
>>  at org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:220) [resteasy-jaxrs-3.0.9.Final.jar:]
>>  at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56) [resteasy-jaxrs-3.0.9.Final.jar:]
>>  at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51) [resteasy-jaxrs-3.0.9.Final.jar:]
>>  at javax.servlet.http.HttpServlet.service(HttpServlet.java:847) [jboss-servlet-api_3.0_spec-1.0.2.Final-redhat-2.jar:1.0.2.Final-redhat-2]
>>  at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:295) [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
>>  at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:214) [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
>>  at org.keycloak.services.filters.ClientConnectionFilter.doFilter(ClientConnectionFilter.java:41) [keycloak-services-1.2.0.Beta1.jar:1.2.0.Beta1]
>>  at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:246) [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
>>  at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:214) [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
>>  at org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:40) [keycloak-services-1.2.0.Beta1.jar:1.2.0.Beta1]
>>  ... 17 more
>> Caused by: java.lang.IllegalStateException: Cache mode should be DIST, rather than REPL_SYNC
>>  at org.infinispan.distexec.mapreduce.MapReduceTask.ensureProperCacheState(MapReduceTask.java:685) [infinispan-core-5.2.11.Final-redhat-2.jar:5.2.11.Final-redhat-2]
>>  at org.infinispan.distexec.mapreduce.MapReduceTask.<init>(MapReduceTask.java:226) [infinispan-core-5.2.11.Final-redhat-2.jar:5.2.11.Final-redhat-2]
>>  at org.infinispan.distexec.mapreduce.MapReduceTask.<init>(MapReduceTask.java:190) [infinispan-core-5.2.11.Final-redhat-2.jar:5.2.11.Final-redhat-2]
>>  at org.keycloak.models.sessions.infinispan.InfinispanUserSessionProvider.getUserSessions(InfinispanUserSessionProvider.java:121) [keycloak-model-sessions-infinispan-1.2.0.Beta1.jar:1.2.0.Beta1]
>>  at org.keycloak.services.resources.AccountService.sessionsPage(AccountService.java:344) [keycloak-services-1.2.0.Beta1.jar:1.2.0.Beta1]
>>  at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) [rt.jar:1.8.0_40]
>>  at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) [rt.jar:1.8.0_40]
>>  at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) [rt.jar:1.8.0_40]
>>  at java.lang.reflect.Method.invoke(Method.java:497) [rt.jar:1.8.0_40]
>>  at org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java:137) [resteasy-jaxrs-3.0.9.Final.jar:]
>>  at org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTarget(ResourceMethodInvoker.java:296) [resteasy-jaxrs-3.0.9.Final.jar:]
>>  at org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:250) [resteasy-jaxrs-3.0.9.Final.jar:]
>>  at org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(ResourceLocatorInvoker.java:140) [resteasy-jaxrs-3.0.9.Final.jar:]
>>  at org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:103) [resteasy-jaxrs-3.0.9.Final.jar:]
>>  at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:356) [resteasy-jaxrs-3.0.9.Final.jar:]
>>  ... 28 more
>> 
>> 
>> Same error I get in admin console (http://localhost/auth/admin/master/console/#/realms/cluster-test/sessions/realm <http://localhost/auth/admin/master/console/#/realms/cluster-test/sessions/realm>)
> Strange... Are you using "distributed-cache" with mode "SYNC" on both cluster nodes?
> 
> Marek
>> 
>> Thanks,
>> 
>> Libor Krzy?anek
>> jboss.org <http://jboss.org/> Development Team
>> 
>>> On 27 Apr 2015, at 09:05, Libor Krzy?anek <lkrzyzan at redhat.com <mailto:lkrzyzan at redhat.com>> wrote:
>>> 
>>> Hi Marek,
>>> your?re right that i?m hitting directly localhsot on different ports.
>>> 
>>> I was thinking about cookies resp. load balancer so I checked cookies and they were sent on both ports.
>>> 
>>> I?ll set up load balancer and I?ll will see. 
>>> 
>>> Thanks,
>>> 
>>> Libor Krzy?anek
>>> jboss.org <http://jboss.org/> Development Team
>>> 
>>>> On 24 Apr 2015, at 19:06, Marek Posolda <mposolda at redhat.com <mailto:mposolda at redhat.com>> wrote:
>>>> 
>>>> Hi Libor,
>>>> 
>>>> the config files looks good (at least for the first look), but question is if you're using loadbalancer? 
>>>> 
>>>> If you're not using loadbalancer and you access keycloak servers directly on localhost:8080 and localhost:8180, the problem might be just in the fact that browser cookie KEYCLOAK_IDENTITY is not shared between them and hence going to localhost:8180 will not find KEYCLOAK_IDENTITY cookie from localhost:8080 and will try to create new session. 
>>>> 
>>>> You can check admin console or account management and list available user sessions on both nodes. If both cluster nodes have same sessions, then replication of userSessions works fine, but only issue is really the cookie. 
>>>> 
>>>> I suspect that in production, you will use loadbalancer, so this issue won't happen.
>>>> 
>>>> Marek
>>>> 
>>>> On 24.4.2015 15:50, Libor Krzy?anek wrote:
>>>>> Attaching keycloak-server.json and standalone-ha.xml
>>>>> 
>>>>> Thanks,
>>>>> 
>>>>> Libor Krzy?anek
>>>>> jboss.org <http://jboss.org/> Development Team
>>>>> 
>>>>> 
>>>>> 
>>>>> 
>>>>> 
>>>>>> On 24 Apr 2015, at 15:36, Stian Thorgersen <stian at redhat.com <mailto:stian at redhat.com>> wrote:
>>>>>> 
>>>>>> Can you attach your keycloak-server.json and standalone.xml?
>>>>>> 
>>>>>> ----- Original Message -----
>>>>>>> From: "Libor Krzy?anek" <lkrzyzan at redhat.com <mailto:lkrzyzan at redhat.com>>
>>>>>>> To: "keycloak-user" <keycloak-user at lists.jboss.org <mailto:keycloak-user at lists.jboss.org>>
>>>>>>> Sent: Friday, 24 April, 2015 3:12:29 PM
>>>>>>> Subject: [keycloak-user] Clustering on localhost with shared DB
>>>>>>> 
>>>>>>> Hi,
>>>>>>> I?m trying to achieve full user session replication which means when I?m
>>>>>>> logged in on node 1 and then hit node 2 then I expect to be logged in but
>>>>>>> I?m forced to log in again.
>>>>>>> 
>>>>>>> I have:
>>>>>>> 1. two localhost nodes with JBoss EAP 6.4 + War installation
>>>>>>> 2. Postgres
>>>>>>> 3. EAP cofigured based on
>>>>>>> http://docs.jboss.org/keycloak/docs/1.2.0.Beta1/userguide/html/clustering.html <http://docs.jboss.org/keycloak/docs/1.2.0.Beta1/userguide/html/clustering.html>
>>>>>>> 
>>>>>>> I triedeither
>>>>>>> <distributed-cache name="sessions" mode="SYNC" owners=? 2 " />
>>>>>>> <distributed-cache name="loginFailures" mode="SYNC" owners=? 2 " />
>>>>>>> or
>>>>>>> <replicated-cache name="sessions" mode="SYNC"/>
>>>>>>> <replicated-cache name="loginFailures" mode="SYNC?/>
>>>>>>> but with same result.
>>>>>>> 
>>>>>>> I?m starting nodes by
>>>>>>> ./jb1/bin/standalone.sh --server-config=standalone-ha.xml
>>>>>>> -Djboss.node.name=node1
>>>>>>> ./jb2/bin/standalone.sh --server-config=standalone-ha.xml
>>>>>>> -Djboss.socket.binding.port-offset=100 -Djboss.node.name=node2
>>>>>>> 
>>>>>>> 
>>>>>>> both jb1 and jb2 are identical and they know each other (Received new cluster
>>>>>>> view: [node1/keycloak|1] [node1/keycloak, node2/keycloak])
>>>>>>> 
>>>>>>> How do you test clustering of KC please?
>>>>>>> 
>>>>>>> Thanks,
>>>>>>> 
>>>>>>> Libor Krzy?anek
>>>>>>> jboss.org <http://jboss.org/> Development Team
>>>>>>> 
>>>>>>> 
>>>>>>> _______________________________________________
>>>>>>> keycloak-user mailing list
>>>>>>> keycloak-user at lists.jboss.org <mailto:keycloak-user at lists.jboss.org>
>>>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user <https://lists.jboss.org/mailman/listinfo/keycloak-user>
>>>>> 
>>>>> 
>>>>> 
>>>>> _______________________________________________
>>>>> keycloak-user mailing list
>>>>> keycloak-user at lists.jboss.org <mailto:keycloak-user at lists.jboss.org>
>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user <https://lists.jboss.org/mailman/listinfo/keycloak-user>
>>> 
>>> _______________________________________________
>>> keycloak-user mailing list
>>> keycloak-user at lists.jboss.org <mailto:keycloak-user at lists.jboss.org>
>>> https://lists.jboss.org/mailman/listinfo/keycloak-user <https://lists.jboss.org/mailman/listinfo/keycloak-user>
> 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150427/60bb2c09/attachment-0001.html 

From stian at redhat.com  Mon Apr 27 09:02:27 2015
From: stian at redhat.com (Stian Thorgersen)
Date: Mon, 27 Apr 2015 09:02:27 -0400 (EDT)
Subject: [keycloak-user] Clustering on localhost with shared DB
In-Reply-To: <48628332-A8FB-4948-B681-F43DE340DB48@redhat.com>
References: <F4DA0413-269A-4F82-89D8-EB3FFDE8ED88@redhat.com>
	<568869667.6140931.1429882583171.JavaMail.zimbra@redhat.com>
	<0AD87949-C8F5-418C-8C79-036155DBEBD7@redhat.com>
	<553A7808.4060602@redhat.com>
	<10489A03-3588-4C03-BBB6-44341EFBE94A@redhat.com>
	<DED42811-2CAD-484F-AEFB-BA723F5F48BD@redhat.com>
	<553E2A8E.3080309@redhat.com>
	<48628332-A8FB-4948-B681-F43DE340DB48@redhat.com>
Message-ID: <283118563.7277342.1430139747356.JavaMail.zimbra@redhat.com>



----- Original Message -----
> From: "Libor Krzy?anek" <lkrzyzan at redhat.com>
> To: "Marek Posolda" <mposolda at redhat.com>
> Cc: "keycloak-user" <keycloak-user at lists.jboss.org>
> Sent: Monday, 27 April, 2015 2:55:43 PM
> Subject: Re: [keycloak-user] Clustering on localhost with shared DB
> 
> Hi,
> yeah this helps little bit:
> <invalidation-cache name="realms" mode="SYNC"/>
> <invalidation-cache name="users" mode="SYNC"/>
> <distributed-cache name="sessions" mode="SYNC" owners="2" segments="60" >
> <state-transfer enabled="true" />
> </distributed-cache>
> <distributed-cache name="loginFailures" mode="SYNC" owners="2" segments="60"
> >
> <state-transfer enabled="true" />
> </distributed-cache>
> 
> When both caches on both nodes are up then syncing works fine.
> Also /sessions works OK.
> 
> But I?m still facing issue no 1.
> 
> When node is up I see in logs this:
> 
> 14:51:19,088 INFO [org.jboss.as] (Controller Boot Thread) JBAS015874: JBoss
> EAP 6.4.0.GA (AS 7.5.0.Final-redhat-21) started in 18527ms - Started 242 of
> 347 services (141 services are lazy, passive or on-demand)
> 
> Caches are initialised after first hit not after KC start

Have you tried putting start="EAGER" on both the cache-container and all caches in standalone.xml?

> 
> I?m talking about this in log:
> 14:51:52,597 INFO [org.infinispan.jmx.CacheJmxRegistration]
> (http-/127.0.0.1:8080-1) ISPN000031: MBeans were successfully registered to
> the platform MBean server.
> 14:51:52,605 INFO [org.jboss.as.clustering.infinispan]
> (http-/127.0.0.1:8080-1) JBAS010281: Started users cache from keycloak
> container
> 14:51:52,710 INFO [org.infinispan.jmx.CacheJmxRegistration]
> (http-/127.0.0.1:8080-2) ISPN000031: MBeans were successfully registered to
> the platform MBean server.
> 14:51:52,815 INFO [org.jboss.as.clustering.infinispan]
> (http-/127.0.0.1:8080-2) JBAS010281: Started sessions cache from keycloak
> container
> 14:51:52,822 INFO [org.infinispan.jmx.CacheJmxRegistration]
> (http-/127.0.0.1:8080-2) ISPN000031: MBeans were successfully registered to
> the platform MBean server.
> 14:51:52,847 INFO [org.jboss.as.clustering.infinispan]
> (http-/127.0.0.1:8080-2) JBAS010281: Started loginFailures cache from
> keycloak container
> 
> 
> 
> Thanks,
> 
> Libor Krzy?anek
> jboss.org Development Team
> 
> 
> 
> 
> On 27 Apr 2015, at 14:24, Marek Posolda < mposolda at redhat.com > wrote:
> 
> On 27.4.2015 13:50, Libor Krzy?anek wrote:
> 
> 
> Hi,
> I have now apache webproxy with this configuration:
> <Proxy *>
> Order allow,deny
> Allow from all
> </Proxy>
> <Proxy balancer://app/ >
> BalancerMember http://localhost:8080 route=app02
> BalancerMember http://localhost:8180 route=app03
> ProxySet lbmethod=byrequests
> </Proxy>
> ProxyPass /balancer-manager !
> ProxyPass /server-status !
> ProxyPass /server-info !
> ProxyPass / balancer://app/
> ProxyPassReverse / balancer://app/
> 
> It looks it helped.
> When I have started both nodes and I see that caches on both nodes are
> started then everything is fine.
> Scenario: When I login to node1, then stop node1, then I?m redirected to
> node2 and I?m still logged in. Great!
> 
> But I see two issues right now:
> 1. Caches are replicated to newly started node too late.
> Scenario is:
> 1. start node1, log in.
> 2. start node2, wait till you see that node1 knows new node and node2 is
> fully started
> 3. killl node1.
> 
> Then I?m redirected to login page.
> 
> This happens really only when no request hits newly started node2. If I do
> few reloads in browser before I kill node1 then I see in logs that those
> infinispan caches are created on node2 and fully replicated.
> 
> Is it related to ?start = EAGER? ?
> Will it help if you use in standalone-ha.xml the config like this? :
> 
> <distributed-cache name="sessions" mode="SYNC" owners="2" segments="60" >
> <state-transfer enabled="true" />
> </distributed-cache>
> 
> 
> 
> 
> 
> 
> 2. Weird thing is on /account/session page (
> http://localhost/auth/realms/cluster-test/account/sessions ).
> 
> I got:
> 
> 13:30:50,291 ERROR
> [org.apache.catalina.core.ContainerBase.[jboss.web].[default-host].[/auth].[Keycloak
> REST Interface]] (http-/127.0.0.1:8080-2) JBWEB000236: Servlet.service() for
> servlet Keycloak REST Interface threw exception: java.lang.RuntimeException:
> request path: /auth/realms/cluster-test/account/sessions
> at
> org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:54)
> [keycloak-services-1.2.0.Beta1.jar:1.2.0.Beta1]
> at
> org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:246)
> [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
> at
> org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:214)
> [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
> at
> org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:231)
> [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
> at
> org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:149)
> [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
> at
> org.jboss.modcluster.container.jbossweb.JBossWebContext$RequestListenerValve.event(JBossWebContext.java:91)
> at
> org.jboss.modcluster.container.jbossweb.JBossWebContext$RequestListenerValve.invoke(JBossWebContext.java:72)
> at
> org.jboss.as.jpa.interceptor.WebNonTxEmCloserValve.invoke(WebNonTxEmCloserValve.java:50)
> [jboss-as-jpa-7.5.0.Final-redhat-21.jar:7.5.0.Final-redhat-21]
> at
> org.jboss.as.jpa.interceptor.WebNonTxEmCloserValve.invoke(WebNonTxEmCloserValve.java:50)
> [jboss-as-jpa-7.5.0.Final-redhat-21.jar:7.5.0.Final-redhat-21]
> at
> org.jboss.as.web.security.SecurityContextAssociationValve.invoke(SecurityContextAssociationValve.java:169)
> [jboss-as-web-7.5.0.Final-redhat-21.jar:7.5.0.Final-redhat-21]
> at
> org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:150)
> [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
> at
> org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:97)
> [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
> at
> org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:102)
> [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
> at
> org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:344)
> [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
> at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:854)
> [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
> at
> org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:653)
> [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
> at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:926)
> [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
> at java.lang.Thread.run(Thread.java:745) [rt.jar:1.8.0_40]
> Caused by: org.jboss.resteasy.spi.UnhandledException:
> java.lang.IllegalStateException: Cache mode should be DIST, rather than
> REPL_SYNC
> at
> org.jboss.resteasy.core.ExceptionHandler.handleApplicationException(ExceptionHandler.java:76)
> [resteasy-jaxrs-3.0.9.Final.jar:]
> at
> org.jboss.resteasy.core.ExceptionHandler.handleException(ExceptionHandler.java:212)
> [resteasy-jaxrs-3.0.9.Final.jar:]
> at
> org.jboss.resteasy.core.SynchronousDispatcher.writeException(SynchronousDispatcher.java:149)
> [resteasy-jaxrs-3.0.9.Final.jar:]
> at
> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:372)
> [resteasy-jaxrs-3.0.9.Final.jar:]
> at
> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:179)
> [resteasy-jaxrs-3.0.9.Final.jar:]
> at
> org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:220)
> [resteasy-jaxrs-3.0.9.Final.jar:]
> at
> org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56)
> [resteasy-jaxrs-3.0.9.Final.jar:]
> at
> org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51)
> [resteasy-jaxrs-3.0.9.Final.jar:]
> at javax.servlet.http.HttpServlet.service(HttpServlet.java:847)
> [jboss-servlet-api_3.0_spec-1.0.2.Final-redhat-2.jar:1.0.2.Final-redhat-2]
> at
> org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:295)
> [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
> at
> org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:214)
> [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
> at
> org.keycloak.services.filters.ClientConnectionFilter.doFilter(ClientConnectionFilter.java:41)
> [keycloak-services-1.2.0.Beta1.jar:1.2.0.Beta1]
> at
> org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:246)
> [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
> at
> org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:214)
> [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
> at
> org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:40)
> [keycloak-services-1.2.0.Beta1.jar:1.2.0.Beta1]
> ... 17 more
> Caused by: java.lang.IllegalStateException: Cache mode should be DIST, rather
> than REPL_SYNC
> at
> org.infinispan.distexec.mapreduce.MapReduceTask.ensureProperCacheState(MapReduceTask.java:685)
> [infinispan-core-5.2.11.Final-redhat-2.jar:5.2.11.Final-redhat-2]
> at
> org.infinispan.distexec.mapreduce.MapReduceTask.<init>(MapReduceTask.java:226)
> [infinispan-core-5.2.11.Final-redhat-2.jar:5.2.11.Final-redhat-2]
> at
> org.infinispan.distexec.mapreduce.MapReduceTask.<init>(MapReduceTask.java:190)
> [infinispan-core-5.2.11.Final-redhat-2.jar:5.2.11.Final-redhat-2]
> at
> org.keycloak.models.sessions.infinispan.InfinispanUserSessionProvider.getUserSessions(InfinispanUserSessionProvider.java:121)
> [keycloak-model-sessions-infinispan-1.2.0.Beta1.jar:1.2.0.Beta1]
> at
> org.keycloak.services.resources.AccountService.sessionsPage(AccountService.java:344)
> [keycloak-services-1.2.0.Beta1.jar:1.2.0.Beta1]
> at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
> [rt.jar:1.8.0_40]
> at
> sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
> [rt.jar:1.8.0_40]
> at
> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
> [rt.jar:1.8.0_40]
> at java.lang.reflect.Method.invoke(Method.java:497) [rt.jar:1.8.0_40]
> at
> org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java:137)
> [resteasy-jaxrs-3.0.9.Final.jar:]
> at
> org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTarget(ResourceMethodInvoker.java:296)
> [resteasy-jaxrs-3.0.9.Final.jar:]
> at
> org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:250)
> [resteasy-jaxrs-3.0.9.Final.jar:]
> at
> org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(ResourceLocatorInvoker.java:140)
> [resteasy-jaxrs-3.0.9.Final.jar:]
> at
> org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:103)
> [resteasy-jaxrs-3.0.9.Final.jar:]
> at
> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:356)
> [resteasy-jaxrs-3.0.9.Final.jar:]
> ... 28 more
> 
> 
> Same error I get in admin console (
> http://localhost/auth/admin/master/console/#/realms/cluster-test/sessions/realm
> )
> Strange... Are you using "distributed-cache" with mode "SYNC" on both cluster
> nodes?
> 
> Marek
> 
> 
> 
> 
> Thanks,
> 
> Libor Krzy?anek
> jboss.org Development Team
> 
> 
> 
> 
> On 27 Apr 2015, at 09:05, Libor Krzy?anek < lkrzyzan at redhat.com > wrote:
> 
> Hi Marek,
> your?re right that i?m hitting directly localhsot on different ports.
> 
> I was thinking about cookies resp. load balancer so I checked cookies and
> they were sent on both ports.
> 
> I?ll set up load balancer and I?ll will see.
> 
> Thanks,
> 
> Libor Krzy?anek
> jboss.org Development Team
> 
> 
> 
> 
> On 24 Apr 2015, at 19:06, Marek Posolda < mposolda at redhat.com > wrote:
> 
> Hi Libor,
> 
> the config files looks good (at least for the first look), but question is if
> you're using loadbalancer?
> 
> If you're not using loadbalancer and you access keycloak servers directly on
> localhost:8080 and localhost:8180, the problem might be just in the fact
> that browser cookie KEYCLOAK_IDENTITY is not shared between them and hence
> going to localhost:8180 will not find KEYCLOAK_IDENTITY cookie from
> localhost:8080 and will try to create new session.
> 
> You can check admin console or account management and list available user
> sessions on both nodes. If both cluster nodes have same sessions, then
> replication of userSessions works fine, but only issue is really the cookie.
> 
> I suspect that in production, you will use loadbalancer, so this issue won't
> happen.
> 
> Marek
> 
> On 24.4.2015 15:50, Libor Krzy?anek wrote:
> 
> 
> Attaching keycloak-server.json and standalone-ha.xml
> 
> Thanks,
> 
> Libor Krzy?anek
> jboss.org Development Team
> 
> 
> 
> 
> 
> 
> 
> 
> On 24 Apr 2015, at 15:36, Stian Thorgersen < stian at redhat.com > wrote:
> 
> Can you attach your keycloak-server.json and standalone.xml?
> 
> ----- Original Message -----
> 
> 
> From: "Libor Krzy?anek" < lkrzyzan at redhat.com >
> To: "keycloak-user" < keycloak-user at lists.jboss.org >
> Sent: Friday, 24 April, 2015 3:12:29 PM
> Subject: [keycloak-user] Clustering on localhost with shared DB
> 
> Hi,
> I?m trying to achieve full user session replication which means when I?m
> logged in on node 1 and then hit node 2 then I expect to be logged in but
> I?m forced to log in again.
> 
> I have:
> 1. two localhost nodes with JBoss EAP 6.4 + War installation
> 2. Postgres
> 3. EAP cofigured based on
> http://docs.jboss.org/keycloak/docs/1.2.0.Beta1/userguide/html/clustering.html
> 
> I triedeither
> <distributed-cache name="sessions" mode="SYNC" owners=? 2 " />
> <distributed-cache name="loginFailures" mode="SYNC" owners=? 2 " />
> or
> <replicated-cache name="sessions" mode="SYNC"/>
> <replicated-cache name="loginFailures" mode="SYNC?/>
> but with same result.
> 
> I?m starting nodes by
> ./jb1/bin/standalone.sh --server-config=standalone-ha.xml
> -Djboss.node.name=node1
> ./jb2/bin/standalone.sh --server-config=standalone-ha.xml
> -Djboss.socket.binding.port-offset=100 -Djboss.node.name=node2
> 
> 
> both jb1 and jb2 are identical and they know each other (Received new cluster
> view: [node1/keycloak|1] [node1/keycloak, node2/keycloak])
> 
> How do you test clustering of KC please?
> 
> Thanks,
> 
> Libor Krzy?anek
> jboss.org Development Team
> 
> 
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
> 
> 
> 
> _______________________________________________
> keycloak-user mailing list keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
> 
> 
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
> 
> 
> 
> 
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user


From lkrzyzan at redhat.com  Mon Apr 27 09:06:53 2015
From: lkrzyzan at redhat.com (=?utf-8?Q?Libor_Krzy=C5=BEanek?=)
Date: Mon, 27 Apr 2015 15:06:53 +0200
Subject: [keycloak-user] Clustering on localhost with shared DB
In-Reply-To: <283118563.7277342.1430139747356.JavaMail.zimbra@redhat.com>
References: <F4DA0413-269A-4F82-89D8-EB3FFDE8ED88@redhat.com>
	<568869667.6140931.1429882583171.JavaMail.zimbra@redhat.com>
	<0AD87949-C8F5-418C-8C79-036155DBEBD7@redhat.com>
	<553A7808.4060602@redhat.com>
	<10489A03-3588-4C03-BBB6-44341EFBE94A@redhat.com>
	<DED42811-2CAD-484F-AEFB-BA723F5F48BD@redhat.com>
	<553E2A8E.3080309@redhat.com>
	<48628332-A8FB-4948-B681-F43DE340DB48@redhat.com>
	<283118563.7277342.1430139747356.JavaMail.zimbra@redhat.com>
Message-ID: <24C229A2-BA61-4293-A96B-0CCE648CEB09@redhat.com>

Yeah just tried:
                <invalidation-cache name="realms" mode="SYNC"  start="EAGER"/>
                <invalidation-cache name="users" mode="SYNC" start="EAGER"/>
                <distributed-cache name="sessions" mode="SYNC" owners="2" segments="60"  start="EAGER">
                    <state-transfer enabled="true" />
                </distributed-cache>
                <distributed-cache name="loginFailures" mode="SYNC" owners="2" segments="60"  start="EAGER">
                    <state-transfer enabled="true" />
                </distributed-cache>

Scenario:
 - node1 is up
 - I?m logged in in node 1
 - starting node 2

I get on node1:
15:00:45,988 INFO  [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (Incoming-1,shared=udp) ISPN000094: Received new cluster view: [node1/keycloak|1] [node1/keycloak, node2/keycloak]
15:00:46,706 ERROR [org.infinispan.statetransfer.OutboundTransferTask] (transport-thread-18) Failed to send entries to node node2/keycloak : ISPN000217: Received exception from node2/keycloak, see cause for remote stack trace: org.infinispan.remoting.RemoteException: ISPN000217: Received exception from node2/keycloak, see cause for remote stack trace
	at org.infinispan.remoting.transport.AbstractTransport.checkResponse(AbstractTransport.java:60)
	at org.infinispan.remoting.transport.jgroups.CommandAwareRpcDispatcher.processSingleCall(CommandAwareRpcDispatcher.java:310)
	at org.infinispan.remoting.transport.jgroups.CommandAwareRpcDispatcher.invokeRemoteCommand(CommandAwareRpcDispatcher.java:179)
	at org.infinispan.remoting.transport.jgroups.JGroupsTransport.invokeRemotely(JGroupsTransport.java:515)
	at org.infinispan.remoting.rpc.RpcManagerImpl.invokeRemotely(RpcManagerImpl.java:173)
	at org.infinispan.remoting.rpc.RpcManagerImpl.invokeRemotely(RpcManagerImpl.java:194)
	at org.infinispan.statetransfer.OutboundTransferTask.sendEntries(OutboundTransferTask.java:257)
	at org.infinispan.statetransfer.OutboundTransferTask.run(OutboundTransferTask.java:187)
	at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) [rt.jar:1.8.0_40]
	at java.util.concurrent.FutureTask.run(FutureTask.java:266) [rt.jar:1.8.0_40]
	at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) [rt.jar:1.8.0_40]
	at java.util.concurrent.FutureTask.run(FutureTask.java:266) [rt.jar:1.8.0_40]
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) [rt.jar:1.8.0_40]
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) [rt.jar:1.8.0_40]
	at java.lang.Thread.run(Thread.java:745) [rt.jar:1.8.0_40]
Caused by: org.infinispan.CacheException: Problems invoking command.
	at org.infinispan.remoting.transport.jgroups.CommandAwareRpcDispatcher.handle(CommandAwareRpcDispatcher.java:230)
	at org.jgroups.blocks.RequestCorrelator.handleRequest(RequestCorrelator.java:484)
	at org.jgroups.blocks.RequestCorrelator.receiveMessage(RequestCorrelator.java:391)
	at org.jgroups.blocks.RequestCorrelator.receive(RequestCorrelator.java:249)
	at org.jgroups.blocks.MessageDispatcher$ProtocolAdapter.up(MessageDispatcher.java:600)
	at org.jgroups.blocks.mux.MuxUpHandler.up(MuxUpHandler.java:130)
	at org.jgroups.JChannel.up(JChannel.java:707)
	at org.jgroups.stack.ProtocolStack.up(ProtocolStack.java:1025)
	at org.jgroups.protocols.RSVP.up(RSVP.java:172)
	at org.jgroups.protocols.FRAG2.up(FRAG2.java:181)
	at org.jgroups.protocols.FlowControl.up(FlowControl.java:418)
	at org.jgroups.protocols.FlowControl.up(FlowControl.java:400)
	at org.jgroups.protocols.pbcast.GMS.up(GMS.java:896)
	at org.jgroups.protocols.pbcast.STABLE.up(STABLE.java:245)
	at org.jgroups.protocols.UNICAST2.handleDataReceived(UNICAST2.java:766)
	at org.jgroups.protocols.UNICAST2.up(UNICAST2.java:420)
	at org.jgroups.protocols.pbcast.NAKACK.up(NAKACK.java:645)
	at org.jgroups.protocols.VERIFY_SUSPECT.up(VERIFY_SUSPECT.java:147)
	at org.jgroups.protocols.FD.up(FD.java:253)
	at org.jgroups.protocols.FD_SOCK.up(FD_SOCK.java:288)
	at org.jgroups.protocols.MERGE3.up(MERGE3.java:290)
	at org.jgroups.protocols.Discovery.up(Discovery.java:359)
	at org.jgroups.protocols.TP$ProtocolAdapter.up(TP.java:2607)
	at org.jgroups.protocols.TP.passMessageUp(TP.java:1260)
	at org.jgroups.protocols.TP$IncomingPacket.handleMyMessage(TP.java:1822)
	at org.jgroups.protocols.TP$IncomingPacket.run(TP.java:1795)
	... 3 more
Caused by: java.io.InvalidClassException: org.keycloak.models.sessions.infinispan.entities.ClientSessionEntity; Module load failed
	at org.jboss.marshalling.ModularClassResolver.resolveClass(ModularClassResolver.java:104)
	at org.jboss.marshalling.river.RiverUnmarshaller.doReadClassDescriptor(RiverUnmarshaller.java:948)
	at org.jboss.marshalling.river.RiverUnmarshaller.doReadNewObject(RiverUnmarshaller.java:1255)
	at org.jboss.marshalling.river.RiverUnmarshaller.doReadObject(RiverUnmarshaller.java:276)
	at org.jboss.marshalling.river.RiverUnmarshaller.doReadObject(RiverUnmarshaller.java:209)
	at org.jboss.marshalling.AbstractObjectInput.readObject(AbstractObjectInput.java:41)
	at org.infinispan.container.entries.ImmortalCacheEntry$Externalizer.readObject(ImmortalCacheEntry.java:160)
	at org.infinispan.container.entries.ImmortalCacheEntry$Externalizer.readObject(ImmortalCacheEntry.java:150)
	at org.infinispan.marshall.jboss.ExternalizerTable$ExternalizerAdapter.readObject(ExternalizerTable.java:406)
	at org.infinispan.marshall.jboss.ExternalizerTable.readObject(ExternalizerTable.java:226)
	at org.infinispan.marshall.jboss.JBossMarshaller$ExternalizerTableProxy.readObject(JBossMarshaller.java:167)
	at org.jboss.marshalling.river.RiverUnmarshaller.doReadObject(RiverUnmarshaller.java:354)
	at org.jboss.marshalling.river.RiverUnmarshaller.doReadObject(RiverUnmarshaller.java:209)
	at org.jboss.marshalling.AbstractObjectInput.readObject(AbstractObjectInput.java:41)
	at org.infinispan.marshall.exts.ArrayListExternalizer.readObject(ArrayListExternalizer.java:57)
	at org.infinispan.marshall.exts.ArrayListExternalizer.readObject(ArrayListExternalizer.java:45)
	at org.infinispan.marshall.jboss.ExternalizerTable$ExternalizerAdapter.readObject(ExternalizerTable.java:406)
	at org.infinispan.marshall.jboss.ExternalizerTable.readObject(ExternalizerTable.java:226)
	at org.infinispan.marshall.jboss.JBossMarshaller$ExternalizerTableProxy.readObject(JBossMarshaller.java:167)
	at org.jboss.marshalling.river.RiverUnmarshaller.doReadObject(RiverUnmarshaller.java:354)
	at org.jboss.marshalling.river.RiverUnmarshaller.doReadObject(RiverUnmarshaller.java:209)
	at org.jboss.marshalling.AbstractObjectInput.readObject(AbstractObjectInput.java:41)
	at org.infinispan.statetransfer.StateChunk$Externalizer.readObject(StateChunk.java:111)
	at org.infinispan.statetransfer.StateChunk$Externalizer.readObject(StateChunk.java:88)
	at org.infinispan.marshall.jboss.ExternalizerTable$ExternalizerAdapter.readObject(ExternalizerTable.java:406)
	at org.infinispan.marshall.jboss.ExternalizerTable.readObject(ExternalizerTable.java:226)
	at org.infinispan.marshall.jboss.JBossMarshaller$ExternalizerTableProxy.readObject(JBossMarshaller.java:167)
	at org.jboss.marshalling.river.RiverUnmarshaller.doReadObject(RiverUnmarshaller.java:354)
	at org.jboss.marshalling.river.RiverUnmarshaller.doReadObject(RiverUnmarshaller.java:209)
	at org.jboss.marshalling.AbstractObjectInput.readObject(AbstractObjectInput.java:41)
	at org.infinispan.marshall.exts.ArrayListExternalizer.readObject(ArrayListExternalizer.java:57)
	at org.infinispan.marshall.exts.ArrayListExternalizer.readObject(ArrayListExternalizer.java:45)
	at org.infinispan.marshall.jboss.ExternalizerTable$ExternalizerAdapter.readObject(ExternalizerTable.java:406)
	at org.infinispan.marshall.jboss.ExternalizerTable.readObject(ExternalizerTable.java:226)
	at org.infinispan.marshall.jboss.JBossMarshaller$ExternalizerTableProxy.readObject(JBossMarshaller.java:167)
	at org.jboss.marshalling.river.RiverUnmarshaller.doReadObject(RiverUnmarshaller.java:354)
	at org.jboss.marshalling.river.RiverUnmarshaller.doReadObject(RiverUnmarshaller.java:209)
	at org.jboss.marshalling.AbstractObjectInput.readObject(AbstractObjectInput.java:41)
	at org.infinispan.marshall.exts.ReplicableCommandExternalizer.readParameters(ReplicableCommandExternalizer.java:130)
	at org.infinispan.marshall.exts.CacheRpcCommandExternalizer.readObject(CacheRpcCommandExternalizer.java:158)
	at org.infinispan.marshall.exts.CacheRpcCommandExternalizer.readObject(CacheRpcCommandExternalizer.java:73)
	at org.infinispan.marshall.jboss.ExternalizerTable$ExternalizerAdapter.readObject(ExternalizerTable.java:406)
	at org.infinispan.marshall.jboss.ExternalizerTable.readObject(ExternalizerTable.java:226)
	at org.infinispan.marshall.jboss.JBossMarshaller$ExternalizerTableProxy.readObject(JBossMarshaller.java:167)
	at org.jboss.marshalling.river.RiverUnmarshaller.doReadObject(RiverUnmarshaller.java:354)
	at org.jboss.marshalling.river.RiverUnmarshaller.doReadObject(RiverUnmarshaller.java:209)
	at org.jboss.marshalling.AbstractObjectInput.readObject(AbstractObjectInput.java:41)
	at org.infinispan.marshall.jboss.AbstractJBossMarshaller.objectFromObjectStream(AbstractJBossMarshaller.java:163)
	at org.infinispan.marshall.VersionAwareMarshaller.objectFromByteBuffer(VersionAwareMarshaller.java:121)
	at org.infinispan.marshall.AbstractDelegatingMarshaller.objectFromByteBuffer(AbstractDelegatingMarshaller.java:104)
	at org.infinispan.remoting.transport.jgroups.MarshallerAdapter.objectFromBuffer(MarshallerAdapter.java:50)
	at org.infinispan.remoting.transport.jgroups.CommandAwareRpcDispatcher.handle(CommandAwareRpcDispatcher.java:215)
	... 28 more
Caused by: org.jboss.modules.ModuleNotFoundException: deployment.auth-server.war:main
	at org.jboss.modules.ModuleLoader.loadModule(ModuleLoader.java:240) [jboss-modules.jar:1.3.6.Final-redhat-1]
	at org.jboss.marshalling.ModularClassResolver.resolveClass(ModularClassResolver.java:102)
	... 79 more




Very similar on node2 plus something like this:
15:01:46,574 ERROR [org.jboss.msc.service.fail] (ServerService Thread Pool -- 57) MSC000001: Failed to start service jboss.infinispan.keycloak.sessions: org.jboss.msc.service.StartException in service jboss.infinispan.keycloak.sessions: org.infinispan.CacheException: Unable to invoke method public void org.infinispan.statetransfer.StateTransferManagerImpl.waitForInitialStateTransferToComplete() throws java.lang.InterruptedException on object of type StateTransferManagerImpl
	at org.jboss.as.clustering.msc.AsynchronousService$1.run(AsynchronousService.java:91) [jboss-as-clustering-common-7.5.0.Final-redhat-21.jar:7.5.0.Final-redhat-21]
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) [rt.jar:1.8.0_40]
<skipped>
Caused by: org.infinispan.CacheException: Initial state transfer timed out for cache sessions on node2/keycloak
	at org.infinispan.statetransfer.StateTransferManagerImpl.waitForInitialStateTransferToComplete(StateTransferManagerImpl.java:216)
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) [rt.jar:1.8.0_40]
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) [rt.jar:1.8.0_40]
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) [rt.jar:1.8.0_40]
	at java.lang.reflect.Method.invoke(Method.java:497) [rt.jar:1.8.0_40]
	at org.infinispan.util.ReflectionUtil.invokeAccessibly(ReflectionUtil.java:203)
	... 18 more

15:01:46,581 ERROR [org.jboss.as.controller.management-operation] (Controller Boot Thread) JBAS014612: Operation ("add") failed - address: ([
    ("subsystem" => "infinispan"),
    ("cache-container" => "keycloak"),
    ("distributed-cache" => "sessions")
]) - failure description: {"JBAS014671: Failed services" => {"jboss.infinispan.keycloak.sessions" => "org.jboss.msc.service.StartException in service jboss.infinispan.keycloak.sessions: org.infinispan.CacheException: Unable to invoke method public void org.infinispan.statetransfer.StateTransferManagerImpl.waitForInitialStateTransferToComplete() throws java.lang.InterruptedException on object of type StateTransferManagerImpl
    Caused by: org.infinispan.CacheException: Unable to invoke method public void org.infinispan.statetransfer.StateTransferManagerImpl.waitForInitialStateTransferToComplete() throws java.lang.InterruptedException on object of type StateTransferManagerImpl
    Caused by: org.infinispan.CacheException: Initial state transfer timed out for cache sessions on node2/keycloak"}}


Thanks,

Libor Krzy?anek
jboss.org <http://jboss.org/> Development Team

> On 27 Apr 2015, at 15:02, Stian Thorgersen <stian at redhat.com> wrote:
> 
> 
> 
> ----- Original Message -----
>> From: "Libor Krzy?anek" <lkrzyzan at redhat.com>
>> To: "Marek Posolda" <mposolda at redhat.com>
>> Cc: "keycloak-user" <keycloak-user at lists.jboss.org>
>> Sent: Monday, 27 April, 2015 2:55:43 PM
>> Subject: Re: [keycloak-user] Clustering on localhost with shared DB
>> 
>> Hi,
>> yeah this helps little bit:
>> <invalidation-cache name="realms" mode="SYNC"/>
>> <invalidation-cache name="users" mode="SYNC"/>
>> <distributed-cache name="sessions" mode="SYNC" owners="2" segments="60" >
>> <state-transfer enabled="true" />
>> </distributed-cache>
>> <distributed-cache name="loginFailures" mode="SYNC" owners="2" segments="60"
>>> 
>> <state-transfer enabled="true" />
>> </distributed-cache>
>> 
>> When both caches on both nodes are up then syncing works fine.
>> Also /sessions works OK.
>> 
>> But I?m still facing issue no 1.
>> 
>> When node is up I see in logs this:
>> 
>> 14:51:19,088 INFO [org.jboss.as] (Controller Boot Thread) JBAS015874: JBoss
>> EAP 6.4.0.GA (AS 7.5.0.Final-redhat-21) started in 18527ms - Started 242 of
>> 347 services (141 services are lazy, passive or on-demand)
>> 
>> Caches are initialised after first hit not after KC start
> 
> Have you tried putting start="EAGER" on both the cache-container and all caches in standalone.xml?
> 
>> 
>> I?m talking about this in log:
>> 14:51:52,597 INFO [org.infinispan.jmx.CacheJmxRegistration]
>> (http-/127.0.0.1:8080-1) ISPN000031: MBeans were successfully registered to
>> the platform MBean server.
>> 14:51:52,605 INFO [org.jboss.as.clustering.infinispan]
>> (http-/127.0.0.1:8080-1) JBAS010281: Started users cache from keycloak
>> container
>> 14:51:52,710 INFO [org.infinispan.jmx.CacheJmxRegistration]
>> (http-/127.0.0.1:8080-2) ISPN000031: MBeans were successfully registered to
>> the platform MBean server.
>> 14:51:52,815 INFO [org.jboss.as.clustering.infinispan]
>> (http-/127.0.0.1:8080-2) JBAS010281: Started sessions cache from keycloak
>> container
>> 14:51:52,822 INFO [org.infinispan.jmx.CacheJmxRegistration]
>> (http-/127.0.0.1:8080-2) ISPN000031: MBeans were successfully registered to
>> the platform MBean server.
>> 14:51:52,847 INFO [org.jboss.as.clustering.infinispan]
>> (http-/127.0.0.1:8080-2) JBAS010281: Started loginFailures cache from
>> keycloak container
>> 
>> 
>> 
>> Thanks,
>> 
>> Libor Krzy?anek
>> jboss.org Development Team
>> 
>> 
>> 
>> 
>> On 27 Apr 2015, at 14:24, Marek Posolda < mposolda at redhat.com > wrote:
>> 
>> On 27.4.2015 13:50, Libor Krzy?anek wrote:
>> 
>> 
>> Hi,
>> I have now apache webproxy with this configuration:
>> <Proxy *>
>> Order allow,deny
>> Allow from all
>> </Proxy>
>> <Proxy balancer://app/ >
>> BalancerMember http://localhost:8080 route=app02
>> BalancerMember http://localhost:8180 route=app03
>> ProxySet lbmethod=byrequests
>> </Proxy>
>> ProxyPass /balancer-manager !
>> ProxyPass /server-status !
>> ProxyPass /server-info !
>> ProxyPass / balancer://app/
>> ProxyPassReverse / balancer://app/
>> 
>> It looks it helped.
>> When I have started both nodes and I see that caches on both nodes are
>> started then everything is fine.
>> Scenario: When I login to node1, then stop node1, then I?m redirected to
>> node2 and I?m still logged in. Great!
>> 
>> But I see two issues right now:
>> 1. Caches are replicated to newly started node too late.
>> Scenario is:
>> 1. start node1, log in.
>> 2. start node2, wait till you see that node1 knows new node and node2 is
>> fully started
>> 3. killl node1.
>> 
>> Then I?m redirected to login page.
>> 
>> This happens really only when no request hits newly started node2. If I do
>> few reloads in browser before I kill node1 then I see in logs that those
>> infinispan caches are created on node2 and fully replicated.
>> 
>> Is it related to ?start = EAGER? ?
>> Will it help if you use in standalone-ha.xml the config like this? :
>> 
>> <distributed-cache name="sessions" mode="SYNC" owners="2" segments="60" >
>> <state-transfer enabled="true" />
>> </distributed-cache>
>> 
>> 
>> 
>> 
>> 
>> 
>> 2. Weird thing is on /account/session page (
>> http://localhost/auth/realms/cluster-test/account/sessions ).
>> 
>> I got:
>> 
>> 13:30:50,291 ERROR
>> [org.apache.catalina.core.ContainerBase.[jboss.web].[default-host].[/auth].[Keycloak
>> REST Interface]] (http-/127.0.0.1:8080-2) JBWEB000236: Servlet.service() for
>> servlet Keycloak REST Interface threw exception: java.lang.RuntimeException:
>> request path: /auth/realms/cluster-test/account/sessions
>> at
>> org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:54)
>> [keycloak-services-1.2.0.Beta1.jar:1.2.0.Beta1]
>> at
>> org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:246)
>> [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
>> at
>> org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:214)
>> [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
>> at
>> org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:231)
>> [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
>> at
>> org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:149)
>> [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
>> at
>> org.jboss.modcluster.container.jbossweb.JBossWebContext$RequestListenerValve.event(JBossWebContext.java:91)
>> at
>> org.jboss.modcluster.container.jbossweb.JBossWebContext$RequestListenerValve.invoke(JBossWebContext.java:72)
>> at
>> org.jboss.as.jpa.interceptor.WebNonTxEmCloserValve.invoke(WebNonTxEmCloserValve.java:50)
>> [jboss-as-jpa-7.5.0.Final-redhat-21.jar:7.5.0.Final-redhat-21]
>> at
>> org.jboss.as.jpa.interceptor.WebNonTxEmCloserValve.invoke(WebNonTxEmCloserValve.java:50)
>> [jboss-as-jpa-7.5.0.Final-redhat-21.jar:7.5.0.Final-redhat-21]
>> at
>> org.jboss.as.web.security.SecurityContextAssociationValve.invoke(SecurityContextAssociationValve.java:169)
>> [jboss-as-web-7.5.0.Final-redhat-21.jar:7.5.0.Final-redhat-21]
>> at
>> org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:150)
>> [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
>> at
>> org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:97)
>> [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
>> at
>> org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:102)
>> [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
>> at
>> org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:344)
>> [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
>> at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:854)
>> [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
>> at
>> org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:653)
>> [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
>> at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:926)
>> [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
>> at java.lang.Thread.run(Thread.java:745) [rt.jar:1.8.0_40]
>> Caused by: org.jboss.resteasy.spi.UnhandledException:
>> java.lang.IllegalStateException: Cache mode should be DIST, rather than
>> REPL_SYNC
>> at
>> org.jboss.resteasy.core.ExceptionHandler.handleApplicationException(ExceptionHandler.java:76)
>> [resteasy-jaxrs-3.0.9.Final.jar:]
>> at
>> org.jboss.resteasy.core.ExceptionHandler.handleException(ExceptionHandler.java:212)
>> [resteasy-jaxrs-3.0.9.Final.jar:]
>> at
>> org.jboss.resteasy.core.SynchronousDispatcher.writeException(SynchronousDispatcher.java:149)
>> [resteasy-jaxrs-3.0.9.Final.jar:]
>> at
>> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:372)
>> [resteasy-jaxrs-3.0.9.Final.jar:]
>> at
>> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:179)
>> [resteasy-jaxrs-3.0.9.Final.jar:]
>> at
>> org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:220)
>> [resteasy-jaxrs-3.0.9.Final.jar:]
>> at
>> org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56)
>> [resteasy-jaxrs-3.0.9.Final.jar:]
>> at
>> org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51)
>> [resteasy-jaxrs-3.0.9.Final.jar:]
>> at javax.servlet.http.HttpServlet.service(HttpServlet.java:847)
>> [jboss-servlet-api_3.0_spec-1.0.2.Final-redhat-2.jar:1.0.2.Final-redhat-2]
>> at
>> org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:295)
>> [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
>> at
>> org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:214)
>> [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
>> at
>> org.keycloak.services.filters.ClientConnectionFilter.doFilter(ClientConnectionFilter.java:41)
>> [keycloak-services-1.2.0.Beta1.jar:1.2.0.Beta1]
>> at
>> org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:246)
>> [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
>> at
>> org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:214)
>> [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
>> at
>> org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:40)
>> [keycloak-services-1.2.0.Beta1.jar:1.2.0.Beta1]
>> ... 17 more
>> Caused by: java.lang.IllegalStateException: Cache mode should be DIST, rather
>> than REPL_SYNC
>> at
>> org.infinispan.distexec.mapreduce.MapReduceTask.ensureProperCacheState(MapReduceTask.java:685)
>> [infinispan-core-5.2.11.Final-redhat-2.jar:5.2.11.Final-redhat-2]
>> at
>> org.infinispan.distexec.mapreduce.MapReduceTask.<init>(MapReduceTask.java:226)
>> [infinispan-core-5.2.11.Final-redhat-2.jar:5.2.11.Final-redhat-2]
>> at
>> org.infinispan.distexec.mapreduce.MapReduceTask.<init>(MapReduceTask.java:190)
>> [infinispan-core-5.2.11.Final-redhat-2.jar:5.2.11.Final-redhat-2]
>> at
>> org.keycloak.models.sessions.infinispan.InfinispanUserSessionProvider.getUserSessions(InfinispanUserSessionProvider.java:121)
>> [keycloak-model-sessions-infinispan-1.2.0.Beta1.jar:1.2.0.Beta1]
>> at
>> org.keycloak.services.resources.AccountService.sessionsPage(AccountService.java:344)
>> [keycloak-services-1.2.0.Beta1.jar:1.2.0.Beta1]
>> at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
>> [rt.jar:1.8.0_40]
>> at
>> sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
>> [rt.jar:1.8.0_40]
>> at
>> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
>> [rt.jar:1.8.0_40]
>> at java.lang.reflect.Method.invoke(Method.java:497) [rt.jar:1.8.0_40]
>> at
>> org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java:137)
>> [resteasy-jaxrs-3.0.9.Final.jar:]
>> at
>> org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTarget(ResourceMethodInvoker.java:296)
>> [resteasy-jaxrs-3.0.9.Final.jar:]
>> at
>> org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:250)
>> [resteasy-jaxrs-3.0.9.Final.jar:]
>> at
>> org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(ResourceLocatorInvoker.java:140)
>> [resteasy-jaxrs-3.0.9.Final.jar:]
>> at
>> org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:103)
>> [resteasy-jaxrs-3.0.9.Final.jar:]
>> at
>> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:356)
>> [resteasy-jaxrs-3.0.9.Final.jar:]
>> ... 28 more
>> 
>> 
>> Same error I get in admin console (
>> http://localhost/auth/admin/master/console/#/realms/cluster-test/sessions/realm
>> )
>> Strange... Are you using "distributed-cache" with mode "SYNC" on both cluster
>> nodes?
>> 
>> Marek
>> 
>> 
>> 
>> 
>> Thanks,
>> 
>> Libor Krzy?anek
>> jboss.org Development Team
>> 
>> 
>> 
>> 
>> On 27 Apr 2015, at 09:05, Libor Krzy?anek < lkrzyzan at redhat.com > wrote:
>> 
>> Hi Marek,
>> your?re right that i?m hitting directly localhsot on different ports.
>> 
>> I was thinking about cookies resp. load balancer so I checked cookies and
>> they were sent on both ports.
>> 
>> I?ll set up load balancer and I?ll will see.
>> 
>> Thanks,
>> 
>> Libor Krzy?anek
>> jboss.org Development Team
>> 
>> 
>> 
>> 
>> On 24 Apr 2015, at 19:06, Marek Posolda < mposolda at redhat.com > wrote:
>> 
>> Hi Libor,
>> 
>> the config files looks good (at least for the first look), but question is if
>> you're using loadbalancer?
>> 
>> If you're not using loadbalancer and you access keycloak servers directly on
>> localhost:8080 and localhost:8180, the problem might be just in the fact
>> that browser cookie KEYCLOAK_IDENTITY is not shared between them and hence
>> going to localhost:8180 will not find KEYCLOAK_IDENTITY cookie from
>> localhost:8080 and will try to create new session.
>> 
>> You can check admin console or account management and list available user
>> sessions on both nodes. If both cluster nodes have same sessions, then
>> replication of userSessions works fine, but only issue is really the cookie.
>> 
>> I suspect that in production, you will use loadbalancer, so this issue won't
>> happen.
>> 
>> Marek
>> 
>> On 24.4.2015 15:50, Libor Krzy?anek wrote:
>> 
>> 
>> Attaching keycloak-server.json and standalone-ha.xml
>> 
>> Thanks,
>> 
>> Libor Krzy?anek
>> jboss.org Development Team
>> 
>> 
>> 
>> 
>> 
>> 
>> 
>> 
>> On 24 Apr 2015, at 15:36, Stian Thorgersen < stian at redhat.com > wrote:
>> 
>> Can you attach your keycloak-server.json and standalone.xml?
>> 
>> ----- Original Message -----
>> 
>> 
>> From: "Libor Krzy?anek" < lkrzyzan at redhat.com >
>> To: "keycloak-user" < keycloak-user at lists.jboss.org >
>> Sent: Friday, 24 April, 2015 3:12:29 PM
>> Subject: [keycloak-user] Clustering on localhost with shared DB
>> 
>> Hi,
>> I?m trying to achieve full user session replication which means when I?m
>> logged in on node 1 and then hit node 2 then I expect to be logged in but
>> I?m forced to log in again.
>> 
>> I have:
>> 1. two localhost nodes with JBoss EAP 6.4 + War installation
>> 2. Postgres
>> 3. EAP cofigured based on
>> http://docs.jboss.org/keycloak/docs/1.2.0.Beta1/userguide/html/clustering.html
>> 
>> I triedeither
>> <distributed-cache name="sessions" mode="SYNC" owners=? 2 " />
>> <distributed-cache name="loginFailures" mode="SYNC" owners=? 2 " />
>> or
>> <replicated-cache name="sessions" mode="SYNC"/>
>> <replicated-cache name="loginFailures" mode="SYNC?/>
>> but with same result.
>> 
>> I?m starting nodes by
>> ./jb1/bin/standalone.sh --server-config=standalone-ha.xml
>> -Djboss.node.name=node1
>> ./jb2/bin/standalone.sh --server-config=standalone-ha.xml
>> -Djboss.socket.binding.port-offset=100 -Djboss.node.name=node2
>> 
>> 
>> both jb1 and jb2 are identical and they know each other (Received new cluster
>> view: [node1/keycloak|1] [node1/keycloak, node2/keycloak])
>> 
>> How do you test clustering of KC please?
>> 
>> Thanks,
>> 
>> Libor Krzy?anek
>> jboss.org Development Team
>> 
>> 
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>> 
>> 
>> 
>> _______________________________________________
>> keycloak-user mailing list keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>> 
>> 
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>> 
>> 
>> 
>> 
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org <mailto:keycloak-user at lists.jboss.org>
>> https://lists.jboss.org/mailman/listinfo/keycloak-user <https://lists.jboss.org/mailman/listinfo/keycloak-user>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150427/29ce65a0/attachment-0001.html 

From stian at redhat.com  Mon Apr 27 09:15:07 2015
From: stian at redhat.com (Stian Thorgersen)
Date: Mon, 27 Apr 2015 09:15:07 -0400 (EDT)
Subject: [keycloak-user] Clustering on localhost with shared DB
In-Reply-To: <24C229A2-BA61-4293-A96B-0CCE648CEB09@redhat.com>
References: <F4DA0413-269A-4F82-89D8-EB3FFDE8ED88@redhat.com>
	<553A7808.4060602@redhat.com>
	<10489A03-3588-4C03-BBB6-44341EFBE94A@redhat.com>
	<DED42811-2CAD-484F-AEFB-BA723F5F48BD@redhat.com>
	<553E2A8E.3080309@redhat.com>
	<48628332-A8FB-4948-B681-F43DE340DB48@redhat.com>
	<283118563.7277342.1430139747356.JavaMail.zimbra@redhat.com>
	<24C229A2-BA61-4293-A96B-0CCE648CEB09@redhat.com>
Message-ID: <1265142742.7286531.1430140507654.JavaMail.zimbra@redhat.com>

Can you JIRA this and we'll try to get it fixed for 1.2.0.CR1?

----- Original Message -----
> From: "Libor Krzy?anek" <lkrzyzan at redhat.com>
> To: "Stian Thorgersen" <stian at redhat.com>
> Cc: "Marek Posolda" <mposolda at redhat.com>, "keycloak-user" <keycloak-user at lists.jboss.org>
> Sent: Monday, 27 April, 2015 3:06:53 PM
> Subject: Re: [keycloak-user] Clustering on localhost with shared DB
> 
> Yeah just tried:
>                 <invalidation-cache name="realms" mode="SYNC"
>                 start="EAGER"/>
>                 <invalidation-cache name="users" mode="SYNC" start="EAGER"/>
>                 <distributed-cache name="sessions" mode="SYNC" owners="2"
>                 segments="60"  start="EAGER">
>                     <state-transfer enabled="true" />
>                 </distributed-cache>
>                 <distributed-cache name="loginFailures" mode="SYNC"
>                 owners="2" segments="60"  start="EAGER">
>                     <state-transfer enabled="true" />
>                 </distributed-cache>
> 
> Scenario:
>  - node1 is up
>  - I?m logged in in node 1
>  - starting node 2
> 
> I get on node1:
> 15:00:45,988 INFO
> [org.infinispan.remoting.transport.jgroups.JGroupsTransport]
> (Incoming-1,shared=udp) ISPN000094: Received new cluster view:
> [node1/keycloak|1] [node1/keycloak, node2/keycloak]
> 15:00:46,706 ERROR [org.infinispan.statetransfer.OutboundTransferTask]
> (transport-thread-18) Failed to send entries to node node2/keycloak :
> ISPN000217: Received exception from node2/keycloak, see cause for remote
> stack trace: org.infinispan.remoting.RemoteException: ISPN000217: Received
> exception from node2/keycloak, see cause for remote stack trace
> 	at
> 	org.infinispan.remoting.transport.AbstractTransport.checkResponse(AbstractTransport.java:60)
> 	at
> 	org.infinispan.remoting.transport.jgroups.CommandAwareRpcDispatcher.processSingleCall(CommandAwareRpcDispatcher.java:310)
> 	at
> 	org.infinispan.remoting.transport.jgroups.CommandAwareRpcDispatcher.invokeRemoteCommand(CommandAwareRpcDispatcher.java:179)
> 	at
> 	org.infinispan.remoting.transport.jgroups.JGroupsTransport.invokeRemotely(JGroupsTransport.java:515)
> 	at
> 	org.infinispan.remoting.rpc.RpcManagerImpl.invokeRemotely(RpcManagerImpl.java:173)
> 	at
> 	org.infinispan.remoting.rpc.RpcManagerImpl.invokeRemotely(RpcManagerImpl.java:194)
> 	at
> 	org.infinispan.statetransfer.OutboundTransferTask.sendEntries(OutboundTransferTask.java:257)
> 	at
> 	org.infinispan.statetransfer.OutboundTransferTask.run(OutboundTransferTask.java:187)
> 	at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
> 	[rt.jar:1.8.0_40]
> 	at java.util.concurrent.FutureTask.run(FutureTask.java:266)
> 	[rt.jar:1.8.0_40]
> 	at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
> 	[rt.jar:1.8.0_40]
> 	at java.util.concurrent.FutureTask.run(FutureTask.java:266)
> 	[rt.jar:1.8.0_40]
> 	at
> 	java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
> 	[rt.jar:1.8.0_40]
> 	at
> 	java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
> 	[rt.jar:1.8.0_40]
> 	at java.lang.Thread.run(Thread.java:745) [rt.jar:1.8.0_40]
> Caused by: org.infinispan.CacheException: Problems invoking command.
> 	at
> 	org.infinispan.remoting.transport.jgroups.CommandAwareRpcDispatcher.handle(CommandAwareRpcDispatcher.java:230)
> 	at
> 	org.jgroups.blocks.RequestCorrelator.handleRequest(RequestCorrelator.java:484)
> 	at
> 	org.jgroups.blocks.RequestCorrelator.receiveMessage(RequestCorrelator.java:391)
> 	at org.jgroups.blocks.RequestCorrelator.receive(RequestCorrelator.java:249)
> 	at
> 	org.jgroups.blocks.MessageDispatcher$ProtocolAdapter.up(MessageDispatcher.java:600)
> 	at org.jgroups.blocks.mux.MuxUpHandler.up(MuxUpHandler.java:130)
> 	at org.jgroups.JChannel.up(JChannel.java:707)
> 	at org.jgroups.stack.ProtocolStack.up(ProtocolStack.java:1025)
> 	at org.jgroups.protocols.RSVP.up(RSVP.java:172)
> 	at org.jgroups.protocols.FRAG2.up(FRAG2.java:181)
> 	at org.jgroups.protocols.FlowControl.up(FlowControl.java:418)
> 	at org.jgroups.protocols.FlowControl.up(FlowControl.java:400)
> 	at org.jgroups.protocols.pbcast.GMS.up(GMS.java:896)
> 	at org.jgroups.protocols.pbcast.STABLE.up(STABLE.java:245)
> 	at org.jgroups.protocols.UNICAST2.handleDataReceived(UNICAST2.java:766)
> 	at org.jgroups.protocols.UNICAST2.up(UNICAST2.java:420)
> 	at org.jgroups.protocols.pbcast.NAKACK.up(NAKACK.java:645)
> 	at org.jgroups.protocols.VERIFY_SUSPECT.up(VERIFY_SUSPECT.java:147)
> 	at org.jgroups.protocols.FD.up(FD.java:253)
> 	at org.jgroups.protocols.FD_SOCK.up(FD_SOCK.java:288)
> 	at org.jgroups.protocols.MERGE3.up(MERGE3.java:290)
> 	at org.jgroups.protocols.Discovery.up(Discovery.java:359)
> 	at org.jgroups.protocols.TP$ProtocolAdapter.up(TP.java:2607)
> 	at org.jgroups.protocols.TP.passMessageUp(TP.java:1260)
> 	at org.jgroups.protocols.TP$IncomingPacket.handleMyMessage(TP.java:1822)
> 	at org.jgroups.protocols.TP$IncomingPacket.run(TP.java:1795)
> 	... 3 more
> Caused by: java.io.InvalidClassException:
> org.keycloak.models.sessions.infinispan.entities.ClientSessionEntity; Module
> load failed
> 	at
> 	org.jboss.marshalling.ModularClassResolver.resolveClass(ModularClassResolver.java:104)
> 	at
> 	org.jboss.marshalling.river.RiverUnmarshaller.doReadClassDescriptor(RiverUnmarshaller.java:948)
> 	at
> 	org.jboss.marshalling.river.RiverUnmarshaller.doReadNewObject(RiverUnmarshaller.java:1255)
> 	at
> 	org.jboss.marshalling.river.RiverUnmarshaller.doReadObject(RiverUnmarshaller.java:276)
> 	at
> 	org.jboss.marshalling.river.RiverUnmarshaller.doReadObject(RiverUnmarshaller.java:209)
> 	at
> 	org.jboss.marshalling.AbstractObjectInput.readObject(AbstractObjectInput.java:41)
> 	at
> 	org.infinispan.container.entries.ImmortalCacheEntry$Externalizer.readObject(ImmortalCacheEntry.java:160)
> 	at
> 	org.infinispan.container.entries.ImmortalCacheEntry$Externalizer.readObject(ImmortalCacheEntry.java:150)
> 	at
> 	org.infinispan.marshall.jboss.ExternalizerTable$ExternalizerAdapter.readObject(ExternalizerTable.java:406)
> 	at
> 	org.infinispan.marshall.jboss.ExternalizerTable.readObject(ExternalizerTable.java:226)
> 	at
> 	org.infinispan.marshall.jboss.JBossMarshaller$ExternalizerTableProxy.readObject(JBossMarshaller.java:167)
> 	at
> 	org.jboss.marshalling.river.RiverUnmarshaller.doReadObject(RiverUnmarshaller.java:354)
> 	at
> 	org.jboss.marshalling.river.RiverUnmarshaller.doReadObject(RiverUnmarshaller.java:209)
> 	at
> 	org.jboss.marshalling.AbstractObjectInput.readObject(AbstractObjectInput.java:41)
> 	at
> 	org.infinispan.marshall.exts.ArrayListExternalizer.readObject(ArrayListExternalizer.java:57)
> 	at
> 	org.infinispan.marshall.exts.ArrayListExternalizer.readObject(ArrayListExternalizer.java:45)
> 	at
> 	org.infinispan.marshall.jboss.ExternalizerTable$ExternalizerAdapter.readObject(ExternalizerTable.java:406)
> 	at
> 	org.infinispan.marshall.jboss.ExternalizerTable.readObject(ExternalizerTable.java:226)
> 	at
> 	org.infinispan.marshall.jboss.JBossMarshaller$ExternalizerTableProxy.readObject(JBossMarshaller.java:167)
> 	at
> 	org.jboss.marshalling.river.RiverUnmarshaller.doReadObject(RiverUnmarshaller.java:354)
> 	at
> 	org.jboss.marshalling.river.RiverUnmarshaller.doReadObject(RiverUnmarshaller.java:209)
> 	at
> 	org.jboss.marshalling.AbstractObjectInput.readObject(AbstractObjectInput.java:41)
> 	at
> 	org.infinispan.statetransfer.StateChunk$Externalizer.readObject(StateChunk.java:111)
> 	at
> 	org.infinispan.statetransfer.StateChunk$Externalizer.readObject(StateChunk.java:88)
> 	at
> 	org.infinispan.marshall.jboss.ExternalizerTable$ExternalizerAdapter.readObject(ExternalizerTable.java:406)
> 	at
> 	org.infinispan.marshall.jboss.ExternalizerTable.readObject(ExternalizerTable.java:226)
> 	at
> 	org.infinispan.marshall.jboss.JBossMarshaller$ExternalizerTableProxy.readObject(JBossMarshaller.java:167)
> 	at
> 	org.jboss.marshalling.river.RiverUnmarshaller.doReadObject(RiverUnmarshaller.java:354)
> 	at
> 	org.jboss.marshalling.river.RiverUnmarshaller.doReadObject(RiverUnmarshaller.java:209)
> 	at
> 	org.jboss.marshalling.AbstractObjectInput.readObject(AbstractObjectInput.java:41)
> 	at
> 	org.infinispan.marshall.exts.ArrayListExternalizer.readObject(ArrayListExternalizer.java:57)
> 	at
> 	org.infinispan.marshall.exts.ArrayListExternalizer.readObject(ArrayListExternalizer.java:45)
> 	at
> 	org.infinispan.marshall.jboss.ExternalizerTable$ExternalizerAdapter.readObject(ExternalizerTable.java:406)
> 	at
> 	org.infinispan.marshall.jboss.ExternalizerTable.readObject(ExternalizerTable.java:226)
> 	at
> 	org.infinispan.marshall.jboss.JBossMarshaller$ExternalizerTableProxy.readObject(JBossMarshaller.java:167)
> 	at
> 	org.jboss.marshalling.river.RiverUnmarshaller.doReadObject(RiverUnmarshaller.java:354)
> 	at
> 	org.jboss.marshalling.river.RiverUnmarshaller.doReadObject(RiverUnmarshaller.java:209)
> 	at
> 	org.jboss.marshalling.AbstractObjectInput.readObject(AbstractObjectInput.java:41)
> 	at
> 	org.infinispan.marshall.exts.ReplicableCommandExternalizer.readParameters(ReplicableCommandExternalizer.java:130)
> 	at
> 	org.infinispan.marshall.exts.CacheRpcCommandExternalizer.readObject(CacheRpcCommandExternalizer.java:158)
> 	at
> 	org.infinispan.marshall.exts.CacheRpcCommandExternalizer.readObject(CacheRpcCommandExternalizer.java:73)
> 	at
> 	org.infinispan.marshall.jboss.ExternalizerTable$ExternalizerAdapter.readObject(ExternalizerTable.java:406)
> 	at
> 	org.infinispan.marshall.jboss.ExternalizerTable.readObject(ExternalizerTable.java:226)
> 	at
> 	org.infinispan.marshall.jboss.JBossMarshaller$ExternalizerTableProxy.readObject(JBossMarshaller.java:167)
> 	at
> 	org.jboss.marshalling.river.RiverUnmarshaller.doReadObject(RiverUnmarshaller.java:354)
> 	at
> 	org.jboss.marshalling.river.RiverUnmarshaller.doReadObject(RiverUnmarshaller.java:209)
> 	at
> 	org.jboss.marshalling.AbstractObjectInput.readObject(AbstractObjectInput.java:41)
> 	at
> 	org.infinispan.marshall.jboss.AbstractJBossMarshaller.objectFromObjectStream(AbstractJBossMarshaller.java:163)
> 	at
> 	org.infinispan.marshall.VersionAwareMarshaller.objectFromByteBuffer(VersionAwareMarshaller.java:121)
> 	at
> 	org.infinispan.marshall.AbstractDelegatingMarshaller.objectFromByteBuffer(AbstractDelegatingMarshaller.java:104)
> 	at
> 	org.infinispan.remoting.transport.jgroups.MarshallerAdapter.objectFromBuffer(MarshallerAdapter.java:50)
> 	at
> 	org.infinispan.remoting.transport.jgroups.CommandAwareRpcDispatcher.handle(CommandAwareRpcDispatcher.java:215)
> 	... 28 more
> Caused by: org.jboss.modules.ModuleNotFoundException:
> deployment.auth-server.war:main
> 	at org.jboss.modules.ModuleLoader.loadModule(ModuleLoader.java:240)
> 	[jboss-modules.jar:1.3.6.Final-redhat-1]
> 	at
> 	org.jboss.marshalling.ModularClassResolver.resolveClass(ModularClassResolver.java:102)
> 	... 79 more
> 
> 
> 
> 
> Very similar on node2 plus something like this:
> 15:01:46,574 ERROR [org.jboss.msc.service.fail] (ServerService Thread Pool --
> 57) MSC000001: Failed to start service jboss.infinispan.keycloak.sessions:
> org.jboss.msc.service.StartException in service
> jboss.infinispan.keycloak.sessions: org.infinispan.CacheException: Unable to
> invoke method public void
> org.infinispan.statetransfer.StateTransferManagerImpl.waitForInitialStateTransferToComplete()
> throws java.lang.InterruptedException on object of type
> StateTransferManagerImpl
> 	at
> 	org.jboss.as.clustering.msc.AsynchronousService$1.run(AsynchronousService.java:91)
> 	[jboss-as-clustering-common-7.5.0.Final-redhat-21.jar:7.5.0.Final-redhat-21]
> 	at
> 	java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
> 	[rt.jar:1.8.0_40]
> <skipped>
> Caused by: org.infinispan.CacheException: Initial state transfer timed out
> for cache sessions on node2/keycloak
> 	at
> 	org.infinispan.statetransfer.StateTransferManagerImpl.waitForInitialStateTransferToComplete(StateTransferManagerImpl.java:216)
> 	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
> 	[rt.jar:1.8.0_40]
> 	at
> 	sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
> 	[rt.jar:1.8.0_40]
> 	at
> 	sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
> 	[rt.jar:1.8.0_40]
> 	at java.lang.reflect.Method.invoke(Method.java:497) [rt.jar:1.8.0_40]
> 	at
> 	org.infinispan.util.ReflectionUtil.invokeAccessibly(ReflectionUtil.java:203)
> 	... 18 more
> 
> 15:01:46,581 ERROR [org.jboss.as.controller.management-operation] (Controller
> Boot Thread) JBAS014612: Operation ("add") failed - address: ([
>     ("subsystem" => "infinispan"),
>     ("cache-container" => "keycloak"),
>     ("distributed-cache" => "sessions")
> ]) - failure description: {"JBAS014671: Failed services" =>
> {"jboss.infinispan.keycloak.sessions" =>
> "org.jboss.msc.service.StartException in service
> jboss.infinispan.keycloak.sessions: org.infinispan.CacheException: Unable to
> invoke method public void
> org.infinispan.statetransfer.StateTransferManagerImpl.waitForInitialStateTransferToComplete()
> throws java.lang.InterruptedException on object of type
> StateTransferManagerImpl
>     Caused by: org.infinispan.CacheException: Unable to invoke method public
>     void
>     org.infinispan.statetransfer.StateTransferManagerImpl.waitForInitialStateTransferToComplete()
>     throws java.lang.InterruptedException on object of type
>     StateTransferManagerImpl
>     Caused by: org.infinispan.CacheException: Initial state transfer timed
>     out for cache sessions on node2/keycloak"}}
> 
> 
> Thanks,
> 
> Libor Krzy?anek
> jboss.org <http://jboss.org/> Development Team
> 
> > On 27 Apr 2015, at 15:02, Stian Thorgersen <stian at redhat.com> wrote:
> > 
> > 
> > 
> > ----- Original Message -----
> >> From: "Libor Krzy?anek" <lkrzyzan at redhat.com>
> >> To: "Marek Posolda" <mposolda at redhat.com>
> >> Cc: "keycloak-user" <keycloak-user at lists.jboss.org>
> >> Sent: Monday, 27 April, 2015 2:55:43 PM
> >> Subject: Re: [keycloak-user] Clustering on localhost with shared DB
> >> 
> >> Hi,
> >> yeah this helps little bit:
> >> <invalidation-cache name="realms" mode="SYNC"/>
> >> <invalidation-cache name="users" mode="SYNC"/>
> >> <distributed-cache name="sessions" mode="SYNC" owners="2" segments="60" >
> >> <state-transfer enabled="true" />
> >> </distributed-cache>
> >> <distributed-cache name="loginFailures" mode="SYNC" owners="2"
> >> segments="60"
> >>> 
> >> <state-transfer enabled="true" />
> >> </distributed-cache>
> >> 
> >> When both caches on both nodes are up then syncing works fine.
> >> Also /sessions works OK.
> >> 
> >> But I?m still facing issue no 1.
> >> 
> >> When node is up I see in logs this:
> >> 
> >> 14:51:19,088 INFO [org.jboss.as] (Controller Boot Thread) JBAS015874:
> >> JBoss
> >> EAP 6.4.0.GA (AS 7.5.0.Final-redhat-21) started in 18527ms - Started 242
> >> of
> >> 347 services (141 services are lazy, passive or on-demand)
> >> 
> >> Caches are initialised after first hit not after KC start
> > 
> > Have you tried putting start="EAGER" on both the cache-container and all
> > caches in standalone.xml?
> > 
> >> 
> >> I?m talking about this in log:
> >> 14:51:52,597 INFO [org.infinispan.jmx.CacheJmxRegistration]
> >> (http-/127.0.0.1:8080-1) ISPN000031: MBeans were successfully registered
> >> to
> >> the platform MBean server.
> >> 14:51:52,605 INFO [org.jboss.as.clustering.infinispan]
> >> (http-/127.0.0.1:8080-1) JBAS010281: Started users cache from keycloak
> >> container
> >> 14:51:52,710 INFO [org.infinispan.jmx.CacheJmxRegistration]
> >> (http-/127.0.0.1:8080-2) ISPN000031: MBeans were successfully registered
> >> to
> >> the platform MBean server.
> >> 14:51:52,815 INFO [org.jboss.as.clustering.infinispan]
> >> (http-/127.0.0.1:8080-2) JBAS010281: Started sessions cache from keycloak
> >> container
> >> 14:51:52,822 INFO [org.infinispan.jmx.CacheJmxRegistration]
> >> (http-/127.0.0.1:8080-2) ISPN000031: MBeans were successfully registered
> >> to
> >> the platform MBean server.
> >> 14:51:52,847 INFO [org.jboss.as.clustering.infinispan]
> >> (http-/127.0.0.1:8080-2) JBAS010281: Started loginFailures cache from
> >> keycloak container
> >> 
> >> 
> >> 
> >> Thanks,
> >> 
> >> Libor Krzy?anek
> >> jboss.org Development Team
> >> 
> >> 
> >> 
> >> 
> >> On 27 Apr 2015, at 14:24, Marek Posolda < mposolda at redhat.com > wrote:
> >> 
> >> On 27.4.2015 13:50, Libor Krzy?anek wrote:
> >> 
> >> 
> >> Hi,
> >> I have now apache webproxy with this configuration:
> >> <Proxy *>
> >> Order allow,deny
> >> Allow from all
> >> </Proxy>
> >> <Proxy balancer://app/ >
> >> BalancerMember http://localhost:8080 route=app02
> >> BalancerMember http://localhost:8180 route=app03
> >> ProxySet lbmethod=byrequests
> >> </Proxy>
> >> ProxyPass /balancer-manager !
> >> ProxyPass /server-status !
> >> ProxyPass /server-info !
> >> ProxyPass / balancer://app/
> >> ProxyPassReverse / balancer://app/
> >> 
> >> It looks it helped.
> >> When I have started both nodes and I see that caches on both nodes are
> >> started then everything is fine.
> >> Scenario: When I login to node1, then stop node1, then I?m redirected to
> >> node2 and I?m still logged in. Great!
> >> 
> >> But I see two issues right now:
> >> 1. Caches are replicated to newly started node too late.
> >> Scenario is:
> >> 1. start node1, log in.
> >> 2. start node2, wait till you see that node1 knows new node and node2 is
> >> fully started
> >> 3. killl node1.
> >> 
> >> Then I?m redirected to login page.
> >> 
> >> This happens really only when no request hits newly started node2. If I do
> >> few reloads in browser before I kill node1 then I see in logs that those
> >> infinispan caches are created on node2 and fully replicated.
> >> 
> >> Is it related to ?start = EAGER? ?
> >> Will it help if you use in standalone-ha.xml the config like this? :
> >> 
> >> <distributed-cache name="sessions" mode="SYNC" owners="2" segments="60" >
> >> <state-transfer enabled="true" />
> >> </distributed-cache>
> >> 
> >> 
> >> 
> >> 
> >> 
> >> 
> >> 2. Weird thing is on /account/session page (
> >> http://localhost/auth/realms/cluster-test/account/sessions ).
> >> 
> >> I got:
> >> 
> >> 13:30:50,291 ERROR
> >> [org.apache.catalina.core.ContainerBase.[jboss.web].[default-host].[/auth].[Keycloak
> >> REST Interface]] (http-/127.0.0.1:8080-2) JBWEB000236: Servlet.service()
> >> for
> >> servlet Keycloak REST Interface threw exception:
> >> java.lang.RuntimeException:
> >> request path: /auth/realms/cluster-test/account/sessions
> >> at
> >> org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:54)
> >> [keycloak-services-1.2.0.Beta1.jar:1.2.0.Beta1]
> >> at
> >> org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:246)
> >> [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
> >> at
> >> org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:214)
> >> [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
> >> at
> >> org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:231)
> >> [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
> >> at
> >> org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:149)
> >> [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
> >> at
> >> org.jboss.modcluster.container.jbossweb.JBossWebContext$RequestListenerValve.event(JBossWebContext.java:91)
> >> at
> >> org.jboss.modcluster.container.jbossweb.JBossWebContext$RequestListenerValve.invoke(JBossWebContext.java:72)
> >> at
> >> org.jboss.as.jpa.interceptor.WebNonTxEmCloserValve.invoke(WebNonTxEmCloserValve.java:50)
> >> [jboss-as-jpa-7.5.0.Final-redhat-21.jar:7.5.0.Final-redhat-21]
> >> at
> >> org.jboss.as.jpa.interceptor.WebNonTxEmCloserValve.invoke(WebNonTxEmCloserValve.java:50)
> >> [jboss-as-jpa-7.5.0.Final-redhat-21.jar:7.5.0.Final-redhat-21]
> >> at
> >> org.jboss.as.web.security.SecurityContextAssociationValve.invoke(SecurityContextAssociationValve.java:169)
> >> [jboss-as-web-7.5.0.Final-redhat-21.jar:7.5.0.Final-redhat-21]
> >> at
> >> org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:150)
> >> [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
> >> at
> >> org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:97)
> >> [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
> >> at
> >> org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:102)
> >> [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
> >> at
> >> org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:344)
> >> [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
> >> at
> >> org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:854)
> >> [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
> >> at
> >> org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:653)
> >> [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
> >> at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:926)
> >> [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
> >> at java.lang.Thread.run(Thread.java:745) [rt.jar:1.8.0_40]
> >> Caused by: org.jboss.resteasy.spi.UnhandledException:
> >> java.lang.IllegalStateException: Cache mode should be DIST, rather than
> >> REPL_SYNC
> >> at
> >> org.jboss.resteasy.core.ExceptionHandler.handleApplicationException(ExceptionHandler.java:76)
> >> [resteasy-jaxrs-3.0.9.Final.jar:]
> >> at
> >> org.jboss.resteasy.core.ExceptionHandler.handleException(ExceptionHandler.java:212)
> >> [resteasy-jaxrs-3.0.9.Final.jar:]
> >> at
> >> org.jboss.resteasy.core.SynchronousDispatcher.writeException(SynchronousDispatcher.java:149)
> >> [resteasy-jaxrs-3.0.9.Final.jar:]
> >> at
> >> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:372)
> >> [resteasy-jaxrs-3.0.9.Final.jar:]
> >> at
> >> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:179)
> >> [resteasy-jaxrs-3.0.9.Final.jar:]
> >> at
> >> org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:220)
> >> [resteasy-jaxrs-3.0.9.Final.jar:]
> >> at
> >> org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56)
> >> [resteasy-jaxrs-3.0.9.Final.jar:]
> >> at
> >> org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51)
> >> [resteasy-jaxrs-3.0.9.Final.jar:]
> >> at javax.servlet.http.HttpServlet.service(HttpServlet.java:847)
> >> [jboss-servlet-api_3.0_spec-1.0.2.Final-redhat-2.jar:1.0.2.Final-redhat-2]
> >> at
> >> org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:295)
> >> [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
> >> at
> >> org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:214)
> >> [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
> >> at
> >> org.keycloak.services.filters.ClientConnectionFilter.doFilter(ClientConnectionFilter.java:41)
> >> [keycloak-services-1.2.0.Beta1.jar:1.2.0.Beta1]
> >> at
> >> org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:246)
> >> [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
> >> at
> >> org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:214)
> >> [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
> >> at
> >> org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:40)
> >> [keycloak-services-1.2.0.Beta1.jar:1.2.0.Beta1]
> >> ... 17 more
> >> Caused by: java.lang.IllegalStateException: Cache mode should be DIST,
> >> rather
> >> than REPL_SYNC
> >> at
> >> org.infinispan.distexec.mapreduce.MapReduceTask.ensureProperCacheState(MapReduceTask.java:685)
> >> [infinispan-core-5.2.11.Final-redhat-2.jar:5.2.11.Final-redhat-2]
> >> at
> >> org.infinispan.distexec.mapreduce.MapReduceTask.<init>(MapReduceTask.java:226)
> >> [infinispan-core-5.2.11.Final-redhat-2.jar:5.2.11.Final-redhat-2]
> >> at
> >> org.infinispan.distexec.mapreduce.MapReduceTask.<init>(MapReduceTask.java:190)
> >> [infinispan-core-5.2.11.Final-redhat-2.jar:5.2.11.Final-redhat-2]
> >> at
> >> org.keycloak.models.sessions.infinispan.InfinispanUserSessionProvider.getUserSessions(InfinispanUserSessionProvider.java:121)
> >> [keycloak-model-sessions-infinispan-1.2.0.Beta1.jar:1.2.0.Beta1]
> >> at
> >> org.keycloak.services.resources.AccountService.sessionsPage(AccountService.java:344)
> >> [keycloak-services-1.2.0.Beta1.jar:1.2.0.Beta1]
> >> at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
> >> [rt.jar:1.8.0_40]
> >> at
> >> sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
> >> [rt.jar:1.8.0_40]
> >> at
> >> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
> >> [rt.jar:1.8.0_40]
> >> at java.lang.reflect.Method.invoke(Method.java:497) [rt.jar:1.8.0_40]
> >> at
> >> org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java:137)
> >> [resteasy-jaxrs-3.0.9.Final.jar:]
> >> at
> >> org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTarget(ResourceMethodInvoker.java:296)
> >> [resteasy-jaxrs-3.0.9.Final.jar:]
> >> at
> >> org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:250)
> >> [resteasy-jaxrs-3.0.9.Final.jar:]
> >> at
> >> org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(ResourceLocatorInvoker.java:140)
> >> [resteasy-jaxrs-3.0.9.Final.jar:]
> >> at
> >> org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:103)
> >> [resteasy-jaxrs-3.0.9.Final.jar:]
> >> at
> >> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:356)
> >> [resteasy-jaxrs-3.0.9.Final.jar:]
> >> ... 28 more
> >> 
> >> 
> >> Same error I get in admin console (
> >> http://localhost/auth/admin/master/console/#/realms/cluster-test/sessions/realm
> >> )
> >> Strange... Are you using "distributed-cache" with mode "SYNC" on both
> >> cluster
> >> nodes?
> >> 
> >> Marek
> >> 
> >> 
> >> 
> >> 
> >> Thanks,
> >> 
> >> Libor Krzy?anek
> >> jboss.org Development Team
> >> 
> >> 
> >> 
> >> 
> >> On 27 Apr 2015, at 09:05, Libor Krzy?anek < lkrzyzan at redhat.com > wrote:
> >> 
> >> Hi Marek,
> >> your?re right that i?m hitting directly localhsot on different ports.
> >> 
> >> I was thinking about cookies resp. load balancer so I checked cookies and
> >> they were sent on both ports.
> >> 
> >> I?ll set up load balancer and I?ll will see.
> >> 
> >> Thanks,
> >> 
> >> Libor Krzy?anek
> >> jboss.org Development Team
> >> 
> >> 
> >> 
> >> 
> >> On 24 Apr 2015, at 19:06, Marek Posolda < mposolda at redhat.com > wrote:
> >> 
> >> Hi Libor,
> >> 
> >> the config files looks good (at least for the first look), but question is
> >> if
> >> you're using loadbalancer?
> >> 
> >> If you're not using loadbalancer and you access keycloak servers directly
> >> on
> >> localhost:8080 and localhost:8180, the problem might be just in the fact
> >> that browser cookie KEYCLOAK_IDENTITY is not shared between them and hence
> >> going to localhost:8180 will not find KEYCLOAK_IDENTITY cookie from
> >> localhost:8080 and will try to create new session.
> >> 
> >> You can check admin console or account management and list available user
> >> sessions on both nodes. If both cluster nodes have same sessions, then
> >> replication of userSessions works fine, but only issue is really the
> >> cookie.
> >> 
> >> I suspect that in production, you will use loadbalancer, so this issue
> >> won't
> >> happen.
> >> 
> >> Marek
> >> 
> >> On 24.4.2015 15:50, Libor Krzy?anek wrote:
> >> 
> >> 
> >> Attaching keycloak-server.json and standalone-ha.xml
> >> 
> >> Thanks,
> >> 
> >> Libor Krzy?anek
> >> jboss.org Development Team
> >> 
> >> 
> >> 
> >> 
> >> 
> >> 
> >> 
> >> 
> >> On 24 Apr 2015, at 15:36, Stian Thorgersen < stian at redhat.com > wrote:
> >> 
> >> Can you attach your keycloak-server.json and standalone.xml?
> >> 
> >> ----- Original Message -----
> >> 
> >> 
> >> From: "Libor Krzy?anek" < lkrzyzan at redhat.com >
> >> To: "keycloak-user" < keycloak-user at lists.jboss.org >
> >> Sent: Friday, 24 April, 2015 3:12:29 PM
> >> Subject: [keycloak-user] Clustering on localhost with shared DB
> >> 
> >> Hi,
> >> I?m trying to achieve full user session replication which means when I?m
> >> logged in on node 1 and then hit node 2 then I expect to be logged in but
> >> I?m forced to log in again.
> >> 
> >> I have:
> >> 1. two localhost nodes with JBoss EAP 6.4 + War installation
> >> 2. Postgres
> >> 3. EAP cofigured based on
> >> http://docs.jboss.org/keycloak/docs/1.2.0.Beta1/userguide/html/clustering.html
> >> 
> >> I triedeither
> >> <distributed-cache name="sessions" mode="SYNC" owners=? 2 " />
> >> <distributed-cache name="loginFailures" mode="SYNC" owners=? 2 " />
> >> or
> >> <replicated-cache name="sessions" mode="SYNC"/>
> >> <replicated-cache name="loginFailures" mode="SYNC?/>
> >> but with same result.
> >> 
> >> I?m starting nodes by
> >> ./jb1/bin/standalone.sh --server-config=standalone-ha.xml
> >> -Djboss.node.name=node1
> >> ./jb2/bin/standalone.sh --server-config=standalone-ha.xml
> >> -Djboss.socket.binding.port-offset=100 -Djboss.node.name=node2
> >> 
> >> 
> >> both jb1 and jb2 are identical and they know each other (Received new
> >> cluster
> >> view: [node1/keycloak|1] [node1/keycloak, node2/keycloak])
> >> 
> >> How do you test clustering of KC please?
> >> 
> >> Thanks,
> >> 
> >> Libor Krzy?anek
> >> jboss.org Development Team
> >> 
> >> 
> >> _______________________________________________
> >> keycloak-user mailing list
> >> keycloak-user at lists.jboss.org
> >> https://lists.jboss.org/mailman/listinfo/keycloak-user
> >> 
> >> 
> >> 
> >> _______________________________________________
> >> keycloak-user mailing list keycloak-user at lists.jboss.org
> >> https://lists.jboss.org/mailman/listinfo/keycloak-user
> >> 
> >> 
> >> _______________________________________________
> >> keycloak-user mailing list
> >> keycloak-user at lists.jboss.org
> >> https://lists.jboss.org/mailman/listinfo/keycloak-user
> >> 
> >> 
> >> 
> >> 
> >> _______________________________________________
> >> keycloak-user mailing list
> >> keycloak-user at lists.jboss.org <mailto:keycloak-user at lists.jboss.org>
> >> https://lists.jboss.org/mailman/listinfo/keycloak-user
> >> <https://lists.jboss.org/mailman/listinfo/keycloak-user>
> 


From lkrzyzan at redhat.com  Mon Apr 27 09:22:22 2015
From: lkrzyzan at redhat.com (=?utf-8?Q?Libor_Krzy=C5=BEanek?=)
Date: Mon, 27 Apr 2015 15:22:22 +0200
Subject: [keycloak-user] Clustering on localhost with shared DB
In-Reply-To: <1265142742.7286531.1430140507654.JavaMail.zimbra@redhat.com>
References: <F4DA0413-269A-4F82-89D8-EB3FFDE8ED88@redhat.com>
	<553A7808.4060602@redhat.com>
	<10489A03-3588-4C03-BBB6-44341EFBE94A@redhat.com>
	<DED42811-2CAD-484F-AEFB-BA723F5F48BD@redhat.com>
	<553E2A8E.3080309@redhat.com>
	<48628332-A8FB-4948-B681-F43DE340DB48@redhat.com>
	<283118563.7277342.1430139747356.JavaMail.zimbra@redhat.com>
	<24C229A2-BA61-4293-A96B-0CCE648CEB09@redhat.com>
	<1265142742.7286531.1430140507654.JavaMail.zimbra@redhat.com>
Message-ID: <1A0C1F2A-F94F-4DBF-B5A5-12CE6014D6B2@redhat.com>

Here it is: https://issues.jboss.org/browse/KEYCLOAK-1237 <https://issues.jboss.org/browse/KEYCLOAK-1237>

Very appreciated!

Thanks,

Libor Krzy?anek
jboss.org <http://jboss.org/> Development Team

> On 27 Apr 2015, at 15:15, Stian Thorgersen <stian at redhat.com> wrote:
> 
> Can you JIRA this and we'll try to get it fixed for 1.2.0.CR1?
> 
> ----- Original Message -----
>> From: "Libor Krzy?anek" <lkrzyzan at redhat.com <mailto:lkrzyzan at redhat.com>>
>> To: "Stian Thorgersen" <stian at redhat.com <mailto:stian at redhat.com>>
>> Cc: "Marek Posolda" <mposolda at redhat.com <mailto:mposolda at redhat.com>>, "keycloak-user" <keycloak-user at lists.jboss.org <mailto:keycloak-user at lists.jboss.org>>
>> Sent: Monday, 27 April, 2015 3:06:53 PM
>> Subject: Re: [keycloak-user] Clustering on localhost with shared DB
>> 
>> Yeah just tried:
>>                <invalidation-cache name="realms" mode="SYNC"
>>                start="EAGER"/>
>>                <invalidation-cache name="users" mode="SYNC" start="EAGER"/>
>>                <distributed-cache name="sessions" mode="SYNC" owners="2"
>>                segments="60"  start="EAGER">
>>                    <state-transfer enabled="true" />
>>                </distributed-cache>
>>                <distributed-cache name="loginFailures" mode="SYNC"
>>                owners="2" segments="60"  start="EAGER">
>>                    <state-transfer enabled="true" />
>>                </distributed-cache>
>> 
>> Scenario:
>> - node1 is up
>> - I?m logged in in node 1
>> - starting node 2
>> 
>> I get on node1:
>> 15:00:45,988 INFO
>> [org.infinispan.remoting.transport.jgroups.JGroupsTransport]
>> (Incoming-1,shared=udp) ISPN000094: Received new cluster view:
>> [node1/keycloak|1] [node1/keycloak, node2/keycloak]
>> 15:00:46,706 ERROR [org.infinispan.statetransfer.OutboundTransferTask]
>> (transport-thread-18) Failed to send entries to node node2/keycloak :
>> ISPN000217: Received exception from node2/keycloak, see cause for remote
>> stack trace: org.infinispan.remoting.RemoteException: ISPN000217: Received
>> exception from node2/keycloak, see cause for remote stack trace
>> 	at
>> 	org.infinispan.remoting.transport.AbstractTransport.checkResponse(AbstractTransport.java:60)
>> 	at
>> 	org.infinispan.remoting.transport.jgroups.CommandAwareRpcDispatcher.processSingleCall(CommandAwareRpcDispatcher.java:310)
>> 	at
>> 	org.infinispan.remoting.transport.jgroups.CommandAwareRpcDispatcher.invokeRemoteCommand(CommandAwareRpcDispatcher.java:179)
>> 	at
>> 	org.infinispan.remoting.transport.jgroups.JGroupsTransport.invokeRemotely(JGroupsTransport.java:515)
>> 	at
>> 	org.infinispan.remoting.rpc.RpcManagerImpl.invokeRemotely(RpcManagerImpl.java:173)
>> 	at
>> 	org.infinispan.remoting.rpc.RpcManagerImpl.invokeRemotely(RpcManagerImpl.java:194)
>> 	at
>> 	org.infinispan.statetransfer.OutboundTransferTask.sendEntries(OutboundTransferTask.java:257)
>> 	at
>> 	org.infinispan.statetransfer.OutboundTransferTask.run(OutboundTransferTask.java:187)
>> 	at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
>> 	[rt.jar:1.8.0_40]
>> 	at java.util.concurrent.FutureTask.run(FutureTask.java:266)
>> 	[rt.jar:1.8.0_40]
>> 	at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
>> 	[rt.jar:1.8.0_40]
>> 	at java.util.concurrent.FutureTask.run(FutureTask.java:266)
>> 	[rt.jar:1.8.0_40]
>> 	at
>> 	java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
>> 	[rt.jar:1.8.0_40]
>> 	at
>> 	java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
>> 	[rt.jar:1.8.0_40]
>> 	at java.lang.Thread.run(Thread.java:745) [rt.jar:1.8.0_40]
>> Caused by: org.infinispan.CacheException: Problems invoking command.
>> 	at
>> 	org.infinispan.remoting.transport.jgroups.CommandAwareRpcDispatcher.handle(CommandAwareRpcDispatcher.java:230)
>> 	at
>> 	org.jgroups.blocks.RequestCorrelator.handleRequest(RequestCorrelator.java:484)
>> 	at
>> 	org.jgroups.blocks.RequestCorrelator.receiveMessage(RequestCorrelator.java:391)
>> 	at org.jgroups.blocks.RequestCorrelator.receive(RequestCorrelator.java:249)
>> 	at
>> 	org.jgroups.blocks.MessageDispatcher$ProtocolAdapter.up(MessageDispatcher.java:600)
>> 	at org.jgroups.blocks.mux.MuxUpHandler.up(MuxUpHandler.java:130)
>> 	at org.jgroups.JChannel.up(JChannel.java:707)
>> 	at org.jgroups.stack.ProtocolStack.up(ProtocolStack.java:1025)
>> 	at org.jgroups.protocols.RSVP.up(RSVP.java:172)
>> 	at org.jgroups.protocols.FRAG2.up(FRAG2.java:181)
>> 	at org.jgroups.protocols.FlowControl.up(FlowControl.java:418)
>> 	at org.jgroups.protocols.FlowControl.up(FlowControl.java:400)
>> 	at org.jgroups.protocols.pbcast.GMS.up(GMS.java:896)
>> 	at org.jgroups.protocols.pbcast.STABLE.up(STABLE.java:245)
>> 	at org.jgroups.protocols.UNICAST2.handleDataReceived(UNICAST2.java:766)
>> 	at org.jgroups.protocols.UNICAST2.up(UNICAST2.java:420)
>> 	at org.jgroups.protocols.pbcast.NAKACK.up(NAKACK.java:645)
>> 	at org.jgroups.protocols.VERIFY_SUSPECT.up(VERIFY_SUSPECT.java:147)
>> 	at org.jgroups.protocols.FD.up(FD.java:253)
>> 	at org.jgroups.protocols.FD_SOCK.up(FD_SOCK.java:288)
>> 	at org.jgroups.protocols.MERGE3.up(MERGE3.java:290)
>> 	at org.jgroups.protocols.Discovery.up(Discovery.java:359)
>> 	at org.jgroups.protocols.TP$ProtocolAdapter.up(TP.java:2607)
>> 	at org.jgroups.protocols.TP.passMessageUp(TP.java:1260)
>> 	at org.jgroups.protocols.TP$IncomingPacket.handleMyMessage(TP.java:1822)
>> 	at org.jgroups.protocols.TP$IncomingPacket.run(TP.java:1795)
>> 	... 3 more
>> Caused by: java.io.InvalidClassException:
>> org.keycloak.models.sessions.infinispan.entities.ClientSessionEntity; Module
>> load failed
>> 	at
>> 	org.jboss.marshalling.ModularClassResolver.resolveClass(ModularClassResolver.java:104)
>> 	at
>> 	org.jboss.marshalling.river.RiverUnmarshaller.doReadClassDescriptor(RiverUnmarshaller.java:948)
>> 	at
>> 	org.jboss.marshalling.river.RiverUnmarshaller.doReadNewObject(RiverUnmarshaller.java:1255)
>> 	at
>> 	org.jboss.marshalling.river.RiverUnmarshaller.doReadObject(RiverUnmarshaller.java:276)
>> 	at
>> 	org.jboss.marshalling.river.RiverUnmarshaller.doReadObject(RiverUnmarshaller.java:209)
>> 	at
>> 	org.jboss.marshalling.AbstractObjectInput.readObject(AbstractObjectInput.java:41)
>> 	at
>> 	org.infinispan.container.entries.ImmortalCacheEntry$Externalizer.readObject(ImmortalCacheEntry.java:160)
>> 	at
>> 	org.infinispan.container.entries.ImmortalCacheEntry$Externalizer.readObject(ImmortalCacheEntry.java:150)
>> 	at
>> 	org.infinispan.marshall.jboss.ExternalizerTable$ExternalizerAdapter.readObject(ExternalizerTable.java:406)
>> 	at
>> 	org.infinispan.marshall.jboss.ExternalizerTable.readObject(ExternalizerTable.java:226)
>> 	at
>> 	org.infinispan.marshall.jboss.JBossMarshaller$ExternalizerTableProxy.readObject(JBossMarshaller.java:167)
>> 	at
>> 	org.jboss.marshalling.river.RiverUnmarshaller.doReadObject(RiverUnmarshaller.java:354)
>> 	at
>> 	org.jboss.marshalling.river.RiverUnmarshaller.doReadObject(RiverUnmarshaller.java:209)
>> 	at
>> 	org.jboss.marshalling.AbstractObjectInput.readObject(AbstractObjectInput.java:41)
>> 	at
>> 	org.infinispan.marshall.exts.ArrayListExternalizer.readObject(ArrayListExternalizer.java:57)
>> 	at
>> 	org.infinispan.marshall.exts.ArrayListExternalizer.readObject(ArrayListExternalizer.java:45)
>> 	at
>> 	org.infinispan.marshall.jboss.ExternalizerTable$ExternalizerAdapter.readObject(ExternalizerTable.java:406)
>> 	at
>> 	org.infinispan.marshall.jboss.ExternalizerTable.readObject(ExternalizerTable.java:226)
>> 	at
>> 	org.infinispan.marshall.jboss.JBossMarshaller$ExternalizerTableProxy.readObject(JBossMarshaller.java:167)
>> 	at
>> 	org.jboss.marshalling.river.RiverUnmarshaller.doReadObject(RiverUnmarshaller.java:354)
>> 	at
>> 	org.jboss.marshalling.river.RiverUnmarshaller.doReadObject(RiverUnmarshaller.java:209)
>> 	at
>> 	org.jboss.marshalling.AbstractObjectInput.readObject(AbstractObjectInput.java:41)
>> 	at
>> 	org.infinispan.statetransfer.StateChunk$Externalizer.readObject(StateChunk.java:111)
>> 	at
>> 	org.infinispan.statetransfer.StateChunk$Externalizer.readObject(StateChunk.java:88)
>> 	at
>> 	org.infinispan.marshall.jboss.ExternalizerTable$ExternalizerAdapter.readObject(ExternalizerTable.java:406)
>> 	at
>> 	org.infinispan.marshall.jboss.ExternalizerTable.readObject(ExternalizerTable.java:226)
>> 	at
>> 	org.infinispan.marshall.jboss.JBossMarshaller$ExternalizerTableProxy.readObject(JBossMarshaller.java:167)
>> 	at
>> 	org.jboss.marshalling.river.RiverUnmarshaller.doReadObject(RiverUnmarshaller.java:354)
>> 	at
>> 	org.jboss.marshalling.river.RiverUnmarshaller.doReadObject(RiverUnmarshaller.java:209)
>> 	at
>> 	org.jboss.marshalling.AbstractObjectInput.readObject(AbstractObjectInput.java:41)
>> 	at
>> 	org.infinispan.marshall.exts.ArrayListExternalizer.readObject(ArrayListExternalizer.java:57)
>> 	at
>> 	org.infinispan.marshall.exts.ArrayListExternalizer.readObject(ArrayListExternalizer.java:45)
>> 	at
>> 	org.infinispan.marshall.jboss.ExternalizerTable$ExternalizerAdapter.readObject(ExternalizerTable.java:406)
>> 	at
>> 	org.infinispan.marshall.jboss.ExternalizerTable.readObject(ExternalizerTable.java:226)
>> 	at
>> 	org.infinispan.marshall.jboss.JBossMarshaller$ExternalizerTableProxy.readObject(JBossMarshaller.java:167)
>> 	at
>> 	org.jboss.marshalling.river.RiverUnmarshaller.doReadObject(RiverUnmarshaller.java:354)
>> 	at
>> 	org.jboss.marshalling.river.RiverUnmarshaller.doReadObject(RiverUnmarshaller.java:209)
>> 	at
>> 	org.jboss.marshalling.AbstractObjectInput.readObject(AbstractObjectInput.java:41)
>> 	at
>> 	org.infinispan.marshall.exts.ReplicableCommandExternalizer.readParameters(ReplicableCommandExternalizer.java:130)
>> 	at
>> 	org.infinispan.marshall.exts.CacheRpcCommandExternalizer.readObject(CacheRpcCommandExternalizer.java:158)
>> 	at
>> 	org.infinispan.marshall.exts.CacheRpcCommandExternalizer.readObject(CacheRpcCommandExternalizer.java:73)
>> 	at
>> 	org.infinispan.marshall.jboss.ExternalizerTable$ExternalizerAdapter.readObject(ExternalizerTable.java:406)
>> 	at
>> 	org.infinispan.marshall.jboss.ExternalizerTable.readObject(ExternalizerTable.java:226)
>> 	at
>> 	org.infinispan.marshall.jboss.JBossMarshaller$ExternalizerTableProxy.readObject(JBossMarshaller.java:167)
>> 	at
>> 	org.jboss.marshalling.river.RiverUnmarshaller.doReadObject(RiverUnmarshaller.java:354)
>> 	at
>> 	org.jboss.marshalling.river.RiverUnmarshaller.doReadObject(RiverUnmarshaller.java:209)
>> 	at
>> 	org.jboss.marshalling.AbstractObjectInput.readObject(AbstractObjectInput.java:41)
>> 	at
>> 	org.infinispan.marshall.jboss.AbstractJBossMarshaller.objectFromObjectStream(AbstractJBossMarshaller.java:163)
>> 	at
>> 	org.infinispan.marshall.VersionAwareMarshaller.objectFromByteBuffer(VersionAwareMarshaller.java:121)
>> 	at
>> 	org.infinispan.marshall.AbstractDelegatingMarshaller.objectFromByteBuffer(AbstractDelegatingMarshaller.java:104)
>> 	at
>> 	org.infinispan.remoting.transport.jgroups.MarshallerAdapter.objectFromBuffer(MarshallerAdapter.java:50)
>> 	at
>> 	org.infinispan.remoting.transport.jgroups.CommandAwareRpcDispatcher.handle(CommandAwareRpcDispatcher.java:215)
>> 	... 28 more
>> Caused by: org.jboss.modules.ModuleNotFoundException:
>> deployment.auth-server.war:main
>> 	at org.jboss.modules.ModuleLoader.loadModule(ModuleLoader.java:240)
>> 	[jboss-modules.jar:1.3.6.Final-redhat-1]
>> 	at
>> 	org.jboss.marshalling.ModularClassResolver.resolveClass(ModularClassResolver.java:102)
>> 	... 79 more
>> 
>> 
>> 
>> 
>> Very similar on node2 plus something like this:
>> 15:01:46,574 ERROR [org.jboss.msc.service.fail] (ServerService Thread Pool --
>> 57) MSC000001: Failed to start service jboss.infinispan.keycloak.sessions:
>> org.jboss.msc.service.StartException in service
>> jboss.infinispan.keycloak.sessions: org.infinispan.CacheException: Unable to
>> invoke method public void
>> org.infinispan.statetransfer.StateTransferManagerImpl.waitForInitialStateTransferToComplete()
>> throws java.lang.InterruptedException on object of type
>> StateTransferManagerImpl
>> 	at
>> 	org.jboss.as.clustering.msc.AsynchronousService$1.run(AsynchronousService.java:91)
>> 	[jboss-as-clustering-common-7.5.0.Final-redhat-21.jar:7.5.0.Final-redhat-21]
>> 	at
>> 	java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
>> 	[rt.jar:1.8.0_40]
>> <skipped>
>> Caused by: org.infinispan.CacheException: Initial state transfer timed out
>> for cache sessions on node2/keycloak
>> 	at
>> 	org.infinispan.statetransfer.StateTransferManagerImpl.waitForInitialStateTransferToComplete(StateTransferManagerImpl.java:216)
>> 	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
>> 	[rt.jar:1.8.0_40]
>> 	at
>> 	sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
>> 	[rt.jar:1.8.0_40]
>> 	at
>> 	sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
>> 	[rt.jar:1.8.0_40]
>> 	at java.lang.reflect.Method.invoke(Method.java:497) [rt.jar:1.8.0_40]
>> 	at
>> 	org.infinispan.util.ReflectionUtil.invokeAccessibly(ReflectionUtil.java:203)
>> 	... 18 more
>> 
>> 15:01:46,581 ERROR [org.jboss.as.controller.management-operation] (Controller
>> Boot Thread) JBAS014612: Operation ("add") failed - address: ([
>>    ("subsystem" => "infinispan"),
>>    ("cache-container" => "keycloak"),
>>    ("distributed-cache" => "sessions")
>> ]) - failure description: {"JBAS014671: Failed services" =>
>> {"jboss.infinispan.keycloak.sessions" =>
>> "org.jboss.msc.service.StartException in service
>> jboss.infinispan.keycloak.sessions: org.infinispan.CacheException: Unable to
>> invoke method public void
>> org.infinispan.statetransfer.StateTransferManagerImpl.waitForInitialStateTransferToComplete()
>> throws java.lang.InterruptedException on object of type
>> StateTransferManagerImpl
>>    Caused by: org.infinispan.CacheException: Unable to invoke method public
>>    void
>>    org.infinispan.statetransfer.StateTransferManagerImpl.waitForInitialStateTransferToComplete()
>>    throws java.lang.InterruptedException on object of type
>>    StateTransferManagerImpl
>>    Caused by: org.infinispan.CacheException: Initial state transfer timed
>>    out for cache sessions on node2/keycloak"}}
>> 
>> 
>> Thanks,
>> 
>> Libor Krzy?anek
>> jboss.org <http://jboss.org/> <http://jboss.org/ <http://jboss.org/>> Development Team
>> 
>>> On 27 Apr 2015, at 15:02, Stian Thorgersen <stian at redhat.com <mailto:stian at redhat.com>> wrote:
>>> 
>>> 
>>> 
>>> ----- Original Message -----
>>>> From: "Libor Krzy?anek" <lkrzyzan at redhat.com <mailto:lkrzyzan at redhat.com>>
>>>> To: "Marek Posolda" <mposolda at redhat.com <mailto:mposolda at redhat.com>>
>>>> Cc: "keycloak-user" <keycloak-user at lists.jboss.org <mailto:keycloak-user at lists.jboss.org>>
>>>> Sent: Monday, 27 April, 2015 2:55:43 PM
>>>> Subject: Re: [keycloak-user] Clustering on localhost with shared DB
>>>> 
>>>> Hi,
>>>> yeah this helps little bit:
>>>> <invalidation-cache name="realms" mode="SYNC"/>
>>>> <invalidation-cache name="users" mode="SYNC"/>
>>>> <distributed-cache name="sessions" mode="SYNC" owners="2" segments="60" >
>>>> <state-transfer enabled="true" />
>>>> </distributed-cache>
>>>> <distributed-cache name="loginFailures" mode="SYNC" owners="2"
>>>> segments="60"
>>>>> 
>>>> <state-transfer enabled="true" />
>>>> </distributed-cache>
>>>> 
>>>> When both caches on both nodes are up then syncing works fine.
>>>> Also /sessions works OK.
>>>> 
>>>> But I?m still facing issue no 1.
>>>> 
>>>> When node is up I see in logs this:
>>>> 
>>>> 14:51:19,088 INFO [org.jboss.as] (Controller Boot Thread) JBAS015874:
>>>> JBoss
>>>> EAP 6.4.0.GA (AS 7.5.0.Final-redhat-21) started in 18527ms - Started 242
>>>> of
>>>> 347 services (141 services are lazy, passive or on-demand)
>>>> 
>>>> Caches are initialised after first hit not after KC start
>>> 
>>> Have you tried putting start="EAGER" on both the cache-container and all
>>> caches in standalone.xml?
>>> 
>>>> 
>>>> I?m talking about this in log:
>>>> 14:51:52,597 INFO [org.infinispan.jmx.CacheJmxRegistration]
>>>> (http-/127.0.0.1:8080-1) ISPN000031: MBeans were successfully registered
>>>> to
>>>> the platform MBean server.
>>>> 14:51:52,605 INFO [org.jboss.as.clustering.infinispan]
>>>> (http-/127.0.0.1:8080-1) JBAS010281: Started users cache from keycloak
>>>> container
>>>> 14:51:52,710 INFO [org.infinispan.jmx.CacheJmxRegistration]
>>>> (http-/127.0.0.1:8080-2) ISPN000031: MBeans were successfully registered
>>>> to
>>>> the platform MBean server.
>>>> 14:51:52,815 INFO [org.jboss.as.clustering.infinispan]
>>>> (http-/127.0.0.1:8080-2) JBAS010281: Started sessions cache from keycloak
>>>> container
>>>> 14:51:52,822 INFO [org.infinispan.jmx.CacheJmxRegistration]
>>>> (http-/127.0.0.1:8080-2) ISPN000031: MBeans were successfully registered
>>>> to
>>>> the platform MBean server.
>>>> 14:51:52,847 INFO [org.jboss.as.clustering.infinispan]
>>>> (http-/127.0.0.1:8080-2) JBAS010281: Started loginFailures cache from
>>>> keycloak container
>>>> 
>>>> 
>>>> 
>>>> Thanks,
>>>> 
>>>> Libor Krzy?anek
>>>> jboss.org <http://jboss.org/> Development Team
>>>> 
>>>> 
>>>> 
>>>> 
>>>> On 27 Apr 2015, at 14:24, Marek Posolda < mposolda at redhat.com <mailto:mposolda at redhat.com> > wrote:
>>>> 
>>>> On 27.4.2015 13:50, Libor Krzy?anek wrote:
>>>> 
>>>> 
>>>> Hi,
>>>> I have now apache webproxy with this configuration:
>>>> <Proxy *>
>>>> Order allow,deny
>>>> Allow from all
>>>> </Proxy>
>>>> <Proxy balancer://app/ <balancer://app/> >
>>>> BalancerMember http://localhost:8080 <http://localhost:8080/> route=app02
>>>> BalancerMember http://localhost:8180 <http://localhost:8180/> route=app03
>>>> ProxySet lbmethod=byrequests
>>>> </Proxy>
>>>> ProxyPass /balancer-manager !
>>>> ProxyPass /server-status !
>>>> ProxyPass /server-info !
>>>> ProxyPass / balancer://app/ <balancer://app/>
>>>> ProxyPassReverse / balancer://app/ <balancer://app/>
>>>> 
>>>> It looks it helped.
>>>> When I have started both nodes and I see that caches on both nodes are
>>>> started then everything is fine.
>>>> Scenario: When I login to node1, then stop node1, then I?m redirected to
>>>> node2 and I?m still logged in. Great!
>>>> 
>>>> But I see two issues right now:
>>>> 1. Caches are replicated to newly started node too late.
>>>> Scenario is:
>>>> 1. start node1, log in.
>>>> 2. start node2, wait till you see that node1 knows new node and node2 is
>>>> fully started
>>>> 3. killl node1.
>>>> 
>>>> Then I?m redirected to login page.
>>>> 
>>>> This happens really only when no request hits newly started node2. If I do
>>>> few reloads in browser before I kill node1 then I see in logs that those
>>>> infinispan caches are created on node2 and fully replicated.
>>>> 
>>>> Is it related to ?start = EAGER? ?
>>>> Will it help if you use in standalone-ha.xml the config like this? :
>>>> 
>>>> <distributed-cache name="sessions" mode="SYNC" owners="2" segments="60" >
>>>> <state-transfer enabled="true" />
>>>> </distributed-cache>
>>>> 
>>>> 
>>>> 
>>>> 
>>>> 
>>>> 
>>>> 2. Weird thing is on /account/session page (
>>>> http://localhost/auth/realms/cluster-test/account/sessions <http://localhost/auth/realms/cluster-test/account/sessions> ).
>>>> 
>>>> I got:
>>>> 
>>>> 13:30:50,291 ERROR
>>>> [org.apache.catalina.core.ContainerBase.[jboss.web].[default-host].[/auth].[Keycloak
>>>> REST Interface]] (http-/127.0.0.1:8080-2) JBWEB000236: Servlet.service()
>>>> for
>>>> servlet Keycloak REST Interface threw exception:
>>>> java.lang.RuntimeException:
>>>> request path: /auth/realms/cluster-test/account/sessions
>>>> at
>>>> org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:54)
>>>> [keycloak-services-1.2.0.Beta1.jar:1.2.0.Beta1]
>>>> at
>>>> org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:246)
>>>> [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
>>>> at
>>>> org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:214)
>>>> [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
>>>> at
>>>> org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:231)
>>>> [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
>>>> at
>>>> org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:149)
>>>> [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
>>>> at
>>>> org.jboss.modcluster.container.jbossweb.JBossWebContext$RequestListenerValve.event(JBossWebContext.java:91)
>>>> at
>>>> org.jboss.modcluster.container.jbossweb.JBossWebContext$RequestListenerValve.invoke(JBossWebContext.java:72)
>>>> at
>>>> org.jboss.as.jpa.interceptor.WebNonTxEmCloserValve.invoke(WebNonTxEmCloserValve.java:50)
>>>> [jboss-as-jpa-7.5.0.Final-redhat-21.jar:7.5.0.Final-redhat-21]
>>>> at
>>>> org.jboss.as.jpa.interceptor.WebNonTxEmCloserValve.invoke(WebNonTxEmCloserValve.java:50)
>>>> [jboss-as-jpa-7.5.0.Final-redhat-21.jar:7.5.0.Final-redhat-21]
>>>> at
>>>> org.jboss.as.web.security.SecurityContextAssociationValve.invoke(SecurityContextAssociationValve.java:169)
>>>> [jboss-as-web-7.5.0.Final-redhat-21.jar:7.5.0.Final-redhat-21]
>>>> at
>>>> org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:150)
>>>> [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
>>>> at
>>>> org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:97)
>>>> [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
>>>> at
>>>> org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:102)
>>>> [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
>>>> at
>>>> org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:344)
>>>> [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
>>>> at
>>>> org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:854)
>>>> [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
>>>> at
>>>> org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:653)
>>>> [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
>>>> at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:926)
>>>> [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
>>>> at java.lang.Thread.run(Thread.java:745) [rt.jar:1.8.0_40]
>>>> Caused by: org.jboss.resteasy.spi.UnhandledException:
>>>> java.lang.IllegalStateException: Cache mode should be DIST, rather than
>>>> REPL_SYNC
>>>> at
>>>> org.jboss.resteasy.core.ExceptionHandler.handleApplicationException(ExceptionHandler.java:76)
>>>> [resteasy-jaxrs-3.0.9.Final.jar:]
>>>> at
>>>> org.jboss.resteasy.core.ExceptionHandler.handleException(ExceptionHandler.java:212)
>>>> [resteasy-jaxrs-3.0.9.Final.jar:]
>>>> at
>>>> org.jboss.resteasy.core.SynchronousDispatcher.writeException(SynchronousDispatcher.java:149)
>>>> [resteasy-jaxrs-3.0.9.Final.jar:]
>>>> at
>>>> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:372)
>>>> [resteasy-jaxrs-3.0.9.Final.jar:]
>>>> at
>>>> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:179)
>>>> [resteasy-jaxrs-3.0.9.Final.jar:]
>>>> at
>>>> org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:220)
>>>> [resteasy-jaxrs-3.0.9.Final.jar:]
>>>> at
>>>> org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56)
>>>> [resteasy-jaxrs-3.0.9.Final.jar:]
>>>> at
>>>> org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51)
>>>> [resteasy-jaxrs-3.0.9.Final.jar:]
>>>> at javax.servlet.http.HttpServlet.service(HttpServlet.java:847)
>>>> [jboss-servlet-api_3.0_spec-1.0.2.Final-redhat-2.jar:1.0.2.Final-redhat-2]
>>>> at
>>>> org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:295)
>>>> [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
>>>> at
>>>> org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:214)
>>>> [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
>>>> at
>>>> org.keycloak.services.filters.ClientConnectionFilter.doFilter(ClientConnectionFilter.java:41)
>>>> [keycloak-services-1.2.0.Beta1.jar:1.2.0.Beta1]
>>>> at
>>>> org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:246)
>>>> [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
>>>> at
>>>> org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:214)
>>>> [jbossweb-7.5.7.Final-redhat-1.jar:7.5.7.Final-redhat-1]
>>>> at
>>>> org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:40)
>>>> [keycloak-services-1.2.0.Beta1.jar:1.2.0.Beta1]
>>>> ... 17 more
>>>> Caused by: java.lang.IllegalStateException: Cache mode should be DIST,
>>>> rather
>>>> than REPL_SYNC
>>>> at
>>>> org.infinispan.distexec.mapreduce.MapReduceTask.ensureProperCacheState(MapReduceTask.java:685)
>>>> [infinispan-core-5.2.11.Final-redhat-2.jar:5.2.11.Final-redhat-2]
>>>> at
>>>> org.infinispan.distexec.mapreduce.MapReduceTask.<init>(MapReduceTask.java:226)
>>>> [infinispan-core-5.2.11.Final-redhat-2.jar:5.2.11.Final-redhat-2]
>>>> at
>>>> org.infinispan.distexec.mapreduce.MapReduceTask.<init>(MapReduceTask.java:190)
>>>> [infinispan-core-5.2.11.Final-redhat-2.jar:5.2.11.Final-redhat-2]
>>>> at
>>>> org.keycloak.models.sessions.infinispan.InfinispanUserSessionProvider.getUserSessions(InfinispanUserSessionProvider.java:121)
>>>> [keycloak-model-sessions-infinispan-1.2.0.Beta1.jar:1.2.0.Beta1]
>>>> at
>>>> org.keycloak.services.resources.AccountService.sessionsPage(AccountService.java:344)
>>>> [keycloak-services-1.2.0.Beta1.jar:1.2.0.Beta1]
>>>> at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
>>>> [rt.jar:1.8.0_40]
>>>> at
>>>> sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
>>>> [rt.jar:1.8.0_40]
>>>> at
>>>> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
>>>> [rt.jar:1.8.0_40]
>>>> at java.lang.reflect.Method.invoke(Method.java:497) [rt.jar:1.8.0_40]
>>>> at
>>>> org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java:137)
>>>> [resteasy-jaxrs-3.0.9.Final.jar:]
>>>> at
>>>> org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTarget(ResourceMethodInvoker.java:296)
>>>> [resteasy-jaxrs-3.0.9.Final.jar:]
>>>> at
>>>> org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:250)
>>>> [resteasy-jaxrs-3.0.9.Final.jar:]
>>>> at
>>>> org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(ResourceLocatorInvoker.java:140)
>>>> [resteasy-jaxrs-3.0.9.Final.jar:]
>>>> at
>>>> org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:103)
>>>> [resteasy-jaxrs-3.0.9.Final.jar:]
>>>> at
>>>> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:356)
>>>> [resteasy-jaxrs-3.0.9.Final.jar:]
>>>> ... 28 more
>>>> 
>>>> 
>>>> Same error I get in admin console (
>>>> http://localhost/auth/admin/master/console/#/realms/cluster-test/sessions/realm <http://localhost/auth/admin/master/console/#/realms/cluster-test/sessions/realm>
>>>> )
>>>> Strange... Are you using "distributed-cache" with mode "SYNC" on both
>>>> cluster
>>>> nodes?
>>>> 
>>>> Marek
>>>> 
>>>> 
>>>> 
>>>> 
>>>> Thanks,
>>>> 
>>>> Libor Krzy?anek
>>>> jboss.org <http://jboss.org/> Development Team
>>>> 
>>>> 
>>>> 
>>>> 
>>>> On 27 Apr 2015, at 09:05, Libor Krzy?anek < lkrzyzan at redhat.com <mailto:lkrzyzan at redhat.com> > wrote:
>>>> 
>>>> Hi Marek,
>>>> your?re right that i?m hitting directly localhsot on different ports.
>>>> 
>>>> I was thinking about cookies resp. load balancer so I checked cookies and
>>>> they were sent on both ports.
>>>> 
>>>> I?ll set up load balancer and I?ll will see.
>>>> 
>>>> Thanks,
>>>> 
>>>> Libor Krzy?anek
>>>> jboss.org <http://jboss.org/> Development Team
>>>> 
>>>> 
>>>> 
>>>> 
>>>> On 24 Apr 2015, at 19:06, Marek Posolda < mposolda at redhat.com <mailto:mposolda at redhat.com> > wrote:
>>>> 
>>>> Hi Libor,
>>>> 
>>>> the config files looks good (at least for the first look), but question is
>>>> if
>>>> you're using loadbalancer?
>>>> 
>>>> If you're not using loadbalancer and you access keycloak servers directly
>>>> on
>>>> localhost:8080 and localhost:8180, the problem might be just in the fact
>>>> that browser cookie KEYCLOAK_IDENTITY is not shared between them and hence
>>>> going to localhost:8180 will not find KEYCLOAK_IDENTITY cookie from
>>>> localhost:8080 and will try to create new session.
>>>> 
>>>> You can check admin console or account management and list available user
>>>> sessions on both nodes. If both cluster nodes have same sessions, then
>>>> replication of userSessions works fine, but only issue is really the
>>>> cookie.
>>>> 
>>>> I suspect that in production, you will use loadbalancer, so this issue
>>>> won't
>>>> happen.
>>>> 
>>>> Marek
>>>> 
>>>> On 24.4.2015 15:50, Libor Krzy?anek wrote:
>>>> 
>>>> 
>>>> Attaching keycloak-server.json and standalone-ha.xml
>>>> 
>>>> Thanks,
>>>> 
>>>> Libor Krzy?anek
>>>> jboss.org <http://jboss.org/> Development Team
>>>> 
>>>> 
>>>> 
>>>> 
>>>> 
>>>> 
>>>> 
>>>> 
>>>> On 24 Apr 2015, at 15:36, Stian Thorgersen < stian at redhat.com <mailto:stian at redhat.com> > wrote:
>>>> 
>>>> Can you attach your keycloak-server.json and standalone.xml?
>>>> 
>>>> ----- Original Message -----
>>>> 
>>>> 
>>>> From: "Libor Krzy?anek" < lkrzyzan at redhat.com <mailto:lkrzyzan at redhat.com> >
>>>> To: "keycloak-user" < keycloak-user at lists.jboss.org <mailto:keycloak-user at lists.jboss.org> >
>>>> Sent: Friday, 24 April, 2015 3:12:29 PM
>>>> Subject: [keycloak-user] Clustering on localhost with shared DB
>>>> 
>>>> Hi,
>>>> I?m trying to achieve full user session replication which means when I?m
>>>> logged in on node 1 and then hit node 2 then I expect to be logged in but
>>>> I?m forced to log in again.
>>>> 
>>>> I have:
>>>> 1. two localhost nodes with JBoss EAP 6.4 + War installation
>>>> 2. Postgres
>>>> 3. EAP cofigured based on
>>>> http://docs.jboss.org/keycloak/docs/1.2.0.Beta1/userguide/html/clustering.html <http://docs.jboss.org/keycloak/docs/1.2.0.Beta1/userguide/html/clustering.html>
>>>> 
>>>> I triedeither
>>>> <distributed-cache name="sessions" mode="SYNC" owners=? 2 " />
>>>> <distributed-cache name="loginFailures" mode="SYNC" owners=? 2 " />
>>>> or
>>>> <replicated-cache name="sessions" mode="SYNC"/>
>>>> <replicated-cache name="loginFailures" mode="SYNC?/>
>>>> but with same result.
>>>> 
>>>> I?m starting nodes by
>>>> ./jb1/bin/standalone.sh --server-config=standalone-ha.xml
>>>> -Djboss.node.name=node1
>>>> ./jb2/bin/standalone.sh --server-config=standalone-ha.xml
>>>> -Djboss.socket.binding.port-offset=100 -Djboss.node.name=node2
>>>> 
>>>> 
>>>> both jb1 and jb2 are identical and they know each other (Received new
>>>> cluster
>>>> view: [node1/keycloak|1] [node1/keycloak, node2/keycloak])
>>>> 
>>>> How do you test clustering of KC please?
>>>> 
>>>> Thanks,
>>>> 
>>>> Libor Krzy?anek
>>>> jboss.org <http://jboss.org/> Development Team
>>>> 
>>>> 
>>>> _______________________________________________
>>>> keycloak-user mailing list
>>>> keycloak-user at lists.jboss.org
>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>> 
>>>> 
>>>> 
>>>> _______________________________________________
>>>> keycloak-user mailing list keycloak-user at lists.jboss.org
>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>> 
>>>> 
>>>> _______________________________________________
>>>> keycloak-user mailing list
>>>> keycloak-user at lists.jboss.org
>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>> 
>>>> 
>>>> 
>>>> 
>>>> _______________________________________________
>>>> keycloak-user mailing list
>>>> keycloak-user at lists.jboss.org <mailto:keycloak-user at lists.jboss.org> <mailto:keycloak-user at lists.jboss.org <mailto:keycloak-user at lists.jboss.org>>
>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user <https://lists.jboss.org/mailman/listinfo/keycloak-user>
>>>> <https://lists.jboss.org/mailman/listinfo/keycloak-user <https://lists.jboss.org/mailman/listinfo/keycloak-user>>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150427/7dd24c31/attachment-0001.html 

From shivasaxena999 at gmail.com  Tue Apr 28 02:41:34 2015
From: shivasaxena999 at gmail.com (Shiva Saxena)
Date: Tue, 28 Apr 2015 12:11:34 +0530
Subject: [keycloak-user] How to suggest corrections to keycloak documentation
Message-ID: <CADjggukUab7+=_DwobDQfnzBnsdd4bU5ONcFxypk7Tfz00xDjQ@mail.gmail.com>

Hi,

In section *22.1. SAML Entity Descriptor
<http://docs.jboss.org/keycloak/docs/1.1.0.Final/userguide/html/saml.html#d4e1790>*
of
the documentation It says that URL where you can view the XML entity
descriptor for the IDP is

root/realms/{realm}/protocol/saml/descriptor

 but after trail and error I found that actually the URL is

root/auth/realms/{realm}/protocol/saml/descriptor

So can we create a Jira request for these type of issues or there is a
different procedure?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150428/95a463b8/attachment.html 

From giriraj.sharma27 at gmail.com  Tue Apr 28 02:50:25 2015
From: giriraj.sharma27 at gmail.com (Giriraj Sharma)
Date: Tue, 28 Apr 2015 12:20:25 +0530
Subject: [keycloak-user] How to suggest corrections to keycloak
	documentation
In-Reply-To: <CADjggukUab7+=_DwobDQfnzBnsdd4bU5ONcFxypk7Tfz00xDjQ@mail.gmail.com>
References: <CADjggukUab7+=_DwobDQfnzBnsdd4bU5ONcFxypk7Tfz00xDjQ@mail.gmail.com>
Message-ID: <CAB5vuUxsLqBN9dU5-BQR7mBJv04F1C2VSsj2M56waMY8bYJ3VA@mail.gmail.com>

Hi Shiva,
If you find any error in the docs, then you can create a JIRA for it at
[1]. If you wish to go a step ahead, then you can issue a PR too. The
reference guide can be found in the Keycloak source repository[2] at [3].


[1] https://issues.jboss.org/browse/KEYCLOAK
[2] https://github.com/keycloak/keycloak
[3] /keycloak-reference-guide-/reference/en/en-US/modules/saml.xml

On Tue, Apr 28, 2015 at 12:11 PM, Shiva Saxena <shivasaxena999 at gmail.com>
wrote:

> Hi,
>
> In section *22.1. SAML Entity Descriptor
> <http://docs.jboss.org/keycloak/docs/1.1.0.Final/userguide/html/saml.html#d4e1790>* of
> the documentation It says that URL where you can view the XML entity
> descriptor for the IDP is
>
> root/realms/{realm}/protocol/saml/descriptor
>
>  but after trail and error I found that actually the URL is
>
> root/auth/realms/{realm}/protocol/saml/descriptor
>
> So can we create a Jira request for these type of issues or there is a
> different procedure?
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>



-- 

Giriraj Sharma
about.me/girirajsharma
<http://about.me/girirajsharma?promo=email_sig>
 Giriraj Sharma,
Department of Computer Science
National Institute of Technology Hamirpur
Himachal Pradesh, India 177005
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150428/cfdce830/attachment.html 

From stian at redhat.com  Tue Apr 28 02:59:48 2015
From: stian at redhat.com (Stian Thorgersen)
Date: Tue, 28 Apr 2015 02:59:48 -0400 (EDT)
Subject: [keycloak-user] How to suggest corrections to
	keycloak	documentation
In-Reply-To: <CAB5vuUxsLqBN9dU5-BQR7mBJv04F1C2VSsj2M56waMY8bYJ3VA@mail.gmail.com>
References: <CADjggukUab7+=_DwobDQfnzBnsdd4bU5ONcFxypk7Tfz00xDjQ@mail.gmail.com>
	<CAB5vuUxsLqBN9dU5-BQR7mBJv04F1C2VSsj2M56waMY8bYJ3VA@mail.gmail.com>
Message-ID: <170253059.7780812.1430204388268.JavaMail.zimbra@redhat.com>

For minor fixes to documentation you can skip the JIRA and just do a PR

----- Original Message -----
> From: "Giriraj Sharma" <giriraj.sharma27 at gmail.com>
> To: "Shiva Saxena" <shivasaxena999 at gmail.com>
> Cc: keycloak-user at lists.jboss.org
> Sent: Tuesday, April 28, 2015 8:50:25 AM
> Subject: Re: [keycloak-user] How to suggest corrections to keycloak	documentation
> 
> Hi Shiva,
> If you find any error in the docs, then you can create a JIRA for it at [1].
> If you wish to go a step ahead, then you can issue a PR too. The reference
> guide can be found in the Keycloak source repository[2] at [3].
> 
> 
> [1] https://issues.jboss.org/browse/KEYCLOAK
> [2] https://github.com/keycloak/keycloak
> [3] /keycloak-reference-guide-/reference/en/en-US/modules/saml.xml
> 
> On Tue, Apr 28, 2015 at 12:11 PM, Shiva Saxena < shivasaxena999 at gmail.com >
> wrote:
> 
> 
> 
> Hi,
> 
> In section 22.1. SAML Entity Descriptor of the documentation It says that URL
> where you can view the XML entity descriptor for the IDP is
> 
> root/realms/{realm}/protocol/saml/descriptor
> 
> but after trail and error I found that actually the URL is
> 
> root/ auth/ realms/{realm}/protocol/saml/descriptor
> 
> So can we create a Jira request for these type of issues or there is a
> different procedure?
> 
> 
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
> 
> 
> 
> --
> 
> Giriraj Sharma
> about.me/girirajsharma
> 
> 
> Giriraj Sharma,
> Department of Computer Science
> National Institute of Technology Hamirpur
> Himachal Pradesh, India 177005
> 
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From kalinga at leapset.com  Wed Apr 29 03:47:50 2015
From: kalinga at leapset.com (Kalinga Dissanayake)
Date: Wed, 29 Apr 2015 13:17:50 +0530 (IST)
Subject: [keycloak-user] Clarification on Remember Me Functionality
In-Reply-To: <1163846703.15736138.1428654722223.JavaMail.zimbra@redhat.com>
References: <CAPj1eSxqUFhzWj51NE1K+7RDXRKY0s9_9otbA_RY5a+EdvCfwg@mail.gmail.com>
	<1606336012.15615789.1428642286476.JavaMail.zimbra@redhat.com> 
	<CAPj1eSwehcAKD65E5xL0oxP=oMG3yNpGXxEmJXzNQFRKRhvAdg@mail.gmail.com> 
	<1077151537.15651304.1428645933306.JavaMail.zimbra@redhat.com> 
	<CAPj1eSzcCoDF7T=RTT1bmUXM93VbOfa7Mz1sG2dKATdTsHN5Wg@mail.gmail.com> 
	<1163846703.15736138.1428654722223.JavaMail.zimbra@redhat.com>
Message-ID: <1430293670.756224901@apps.rackspace.com>


Stian,
 
I am having this issue on remember me functionality
Can you help me getting it sorted?
 
I need keycloak to remember me for 2 weeks but i need the session idle timeout to be only 20 minutes.
I tried setting SSO Session Max Lifespan to 14 days and setting SSO Session Idle Timeout to 20 minutes.
But keycloak remember me token expires after 20 minutes! I need the remember me token to be valid for 14 days and session idle timeout to be valid for 20 minutes. :) How can i get this sorted? Setting both parameters to 14 days does not work for me :) Any other way forward?
 
Kalinga

-----Original Message-----
From: "Stian Thorgersen" <stian at redhat.com>
Sent: Friday, April 10, 2015 2:02pm
To: "Lohitha Chiranjeewa" <kalc04 at gmail.com>
Cc: keycloak-user at lists.jboss.org
Subject: Re: [keycloak-user] Clarification on Remember Me Functionality



This is expected behaviour

----- Original Message -----
> From: "Lohitha Chiranjeewa" <kalc04 at gmail.com>
> To: "Stian Thorgersen" <stian at redhat.com>, keycloak-user at lists.jboss.org
> Sent: Friday, 10 April, 2015 8:57:19 AM
> Subject: Re: [keycloak-user] Clarification on Remember Me Functionality
> 
> Thanks for the suggestion. I will have to adjust both timeouts according to
> my needs.
> 
> So is this the expected behavior of Keycloak or is there room for an
> improvement? In my view, Remember Me functionality should work independent
> of SSO Session Idle Timeout.
> 
_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150429/d3979581/attachment.html 

From stian at redhat.com  Wed Apr 29 04:13:16 2015
From: stian at redhat.com (Stian Thorgersen)
Date: Wed, 29 Apr 2015 04:13:16 -0400 (EDT)
Subject: [keycloak-user] Clarification on Remember Me Functionality
In-Reply-To: <1430293670.756224901@apps.rackspace.com>
References: <CAPj1eSxqUFhzWj51NE1K+7RDXRKY0s9_9otbA_RY5a+EdvCfwg@mail.gmail.com>
	<1606336012.15615789.1428642286476.JavaMail.zimbra@redhat.com>
	<CAPj1eSwehcAKD65E5xL0oxP=oMG3yNpGXxEmJXzNQFRKRhvAdg@mail.gmail.com>
	<1077151537.15651304.1428645933306.JavaMail.zimbra@redhat.com>
	<CAPj1eSzcCoDF7T=RTT1bmUXM93VbOfa7Mz1sG2dKATdTsHN5Wg@mail.gmail.com>
	<1163846703.15736138.1428654722223.JavaMail.zimbra@redhat.com>
	<1430293670.756224901@apps.rackspace.com>
Message-ID: <812709433.9010092.1430295196992.JavaMail.zimbra@redhat.com>

I'm confused, what do you actual think the session timeout does? Exactly why do you think that remember-me/session should be valid after the session has timed out?

----- Original Message -----
> From: "Kalinga Dissanayake" <kalinga at leapset.com>
> To: "Stian Thorgersen" <stian at redhat.com>
> Cc: "Lohitha Chiranjeewa" <kalc04 at gmail.com>, keycloak-user at lists.jboss.org
> Sent: Wednesday, 29 April, 2015 9:47:50 AM
> Subject: Re: [keycloak-user] Clarification on Remember Me Functionality
> 
> 
> Stian,
>  
> I am having this issue on remember me functionality
> Can you help me getting it sorted?
>  
> I need keycloak to remember me for 2 weeks but i need the session idle
> timeout to be only 20 minutes.
> I tried setting SSO Session Max Lifespan to 14 days and setting SSO Session
> Idle Timeout to 20 minutes.
> But keycloak remember me token expires after 20 minutes! I need the remember
> me token to be valid for 14 days and session idle timeout to be valid for 20
> minutes. :) How can i get this sorted? Setting both parameters to 14 days
> does not work for me :) Any other way forward?
>  
> Kalinga
> 
> -----Original Message-----
> From: "Stian Thorgersen" <stian at redhat.com>
> Sent: Friday, April 10, 2015 2:02pm
> To: "Lohitha Chiranjeewa" <kalc04 at gmail.com>
> Cc: keycloak-user at lists.jboss.org
> Subject: Re: [keycloak-user] Clarification on Remember Me Functionality
> 
> 
> 
> This is expected behaviour
> 
> ----- Original Message -----
> > From: "Lohitha Chiranjeewa" <kalc04 at gmail.com>
> > To: "Stian Thorgersen" <stian at redhat.com>, keycloak-user at lists.jboss.org
> > Sent: Friday, 10 April, 2015 8:57:19 AM
> > Subject: Re: [keycloak-user] Clarification on Remember Me Functionality
> > 
> > Thanks for the suggestion. I will have to adjust both timeouts according to
> > my needs.
> > 
> > So is this the expected behavior of Keycloak or is there room for an
> > improvement? In my view, Remember Me functionality should work independent
> > of SSO Session Idle Timeout.
> > 
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From kalinga at leapset.com  Wed Apr 29 05:17:40 2015
From: kalinga at leapset.com (Kalinga Dissanayake)
Date: Wed, 29 Apr 2015 14:47:40 +0530 (IST)
Subject: [keycloak-user] Clarification on Remember Me Functionality
In-Reply-To: <812709433.9010092.1430295196992.JavaMail.zimbra@redhat.com>
References: <CAPj1eSxqUFhzWj51NE1K+7RDXRKY0s9_9otbA_RY5a+EdvCfwg@mail.gmail.com>
	<1606336012.15615789.1428642286476.JavaMail.zimbra@redhat.com> 
	<CAPj1eSwehcAKD65E5xL0oxP=oMG3yNpGXxEmJXzNQFRKRhvAdg@mail.gmail.com> 
	<1077151537.15651304.1428645933306.JavaMail.zimbra@redhat.com> 
	<CAPj1eSzcCoDF7T=RTT1bmUXM93VbOfa7Mz1sG2dKATdTsHN5Wg@mail.gmail.com> 
	<1163846703.15736138.1428654722223.JavaMail.zimbra@redhat.com> 
	<1430293670.756224901@apps.rackspace.com> 
	<812709433.9010092.1430295196992.JavaMail.zimbra@redhat.com>
Message-ID: <1430299060.339127383@apps.rackspace.com>


Sorry for the confusion.
Let me rephrase, please correct me if I am wrong.
 
This is my requirement
If a user logins via keycloak without ticking "remember me", I need the session on keycloak to timeout after 20 minutes. (in case its idle)
If a user logins via keycloak ticking "remember me", I need the user to be "remembered" on keycloak for 12 weeks irrespective of whether the user continues to interact with keycloak or not. Something like facebook.
 
Just saw this thread as well
[ http://ux.stackexchange.com/questions/62857/which-remember-me-option-is-the-best/62862#62862 ]( http://ux.stackexchange.com/questions/62857/which-remember-me-option-is-the-best/62862#62862 )
 
Hope my requirement is clear.
 
Kalinga


-----Original Message-----
From: "Stian Thorgersen" <stian at redhat.com>
Sent: Wednesday, April 29, 2015 1:43pm
To: "Kalinga Dissanayake" <kalinga at leapset.com>
Cc: "Lohitha Chiranjeewa" <kalc04 at gmail.com>, keycloak-user at lists.jboss.org
Subject: Re: [keycloak-user] Clarification on Remember Me Functionality



I'm confused, what do you actual think the session timeout does? Exactly why do you think that remember-me/session should be valid after the session has timed out?

----- Original Message -----
> From: "Kalinga Dissanayake" <kalinga at leapset.com>
> To: "Stian Thorgersen" <stian at redhat.com>
> Cc: "Lohitha Chiranjeewa" <kalc04 at gmail.com>, keycloak-user at lists.jboss.org
> Sent: Wednesday, 29 April, 2015 9:47:50 AM
> Subject: Re: [keycloak-user] Clarification on Remember Me Functionality
> 
> 
> Stian,
> 
> I am having this issue on remember me functionality
> Can you help me getting it sorted?
> 
> I need keycloak to remember me for 2 weeks but i need the session idle
> timeout to be only 20 minutes.
> I tried setting SSO Session Max Lifespan to 14 days and setting SSO Session
> Idle Timeout to 20 minutes.
> But keycloak remember me token expires after 20 minutes! I need the remember
> me token to be valid for 14 days and session idle timeout to be valid for 20
> minutes. :) How can i get this sorted? Setting both parameters to 14 days
> does not work for me :) Any other way forward?
> 
> Kalinga
> 
> -----Original Message-----
> From: "Stian Thorgersen" <stian at redhat.com>
> Sent: Friday, April 10, 2015 2:02pm
> To: "Lohitha Chiranjeewa" <kalc04 at gmail.com>
> Cc: keycloak-user at lists.jboss.org
> Subject: Re: [keycloak-user] Clarification on Remember Me Functionality
> 
> 
> 
> This is expected behaviour
> 
> ----- Original Message -----
> > From: "Lohitha Chiranjeewa" <kalc04 at gmail.com>
> > To: "Stian Thorgersen" <stian at redhat.com>, keycloak-user at lists.jboss.org
> > Sent: Friday, 10 April, 2015 8:57:19 AM
> > Subject: Re: [keycloak-user] Clarification on Remember Me Functionality
> > 
> > Thanks for the suggestion. I will have to adjust both timeouts according to
> > my needs.
> > 
> > So is this the expected behavior of Keycloak or is there room for an
> > improvement? In my view, Remember Me functionality should work independent
> > of SSO Session Idle Timeout.
> > 
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150429/a85268af/attachment.html 

From stian at redhat.com  Wed Apr 29 07:43:41 2015
From: stian at redhat.com (Stian Thorgersen)
Date: Wed, 29 Apr 2015 07:43:41 -0400 (EDT)
Subject: [keycloak-user] Clarification on Remember Me Functionality
In-Reply-To: <1430299060.339127383@apps.rackspace.com>
References: <CAPj1eSxqUFhzWj51NE1K+7RDXRKY0s9_9otbA_RY5a+EdvCfwg@mail.gmail.com>
	<CAPj1eSwehcAKD65E5xL0oxP=oMG3yNpGXxEmJXzNQFRKRhvAdg@mail.gmail.com>
	<1077151537.15651304.1428645933306.JavaMail.zimbra@redhat.com>
	<CAPj1eSzcCoDF7T=RTT1bmUXM93VbOfa7Mz1sG2dKATdTsHN5Wg@mail.gmail.com>
	<1163846703.15736138.1428654722223.JavaMail.zimbra@redhat.com>
	<1430293670.756224901@apps.rackspace.com>
	<812709433.9010092.1430295196992.JavaMail.zimbra@redhat.com>
	<1430299060.339127383@apps.rackspace.com>
Message-ID: <1092658797.9307847.1430307821196.JavaMail.zimbra@redhat.com>

Oki, that makes sense - it's not possible atm, but if you create a jira we'll add it when we can

----- Original Message -----
> From: "Kalinga Dissanayake" <kalinga at leapset.com>
> To: "Stian Thorgersen" <stian at redhat.com>
> Cc: "Lohitha Chiranjeewa" <kalc04 at gmail.com>, keycloak-user at lists.jboss.org
> Sent: Wednesday, 29 April, 2015 11:17:40 AM
> Subject: Re: [keycloak-user] Clarification on Remember Me Functionality
> 
> 
> Sorry for the confusion.
> Let me rephrase, please correct me if I am wrong.
>  
> This is my requirement
> If a user logins via keycloak without ticking "remember me", I need the
> session on keycloak to timeout after 20 minutes. (in case its idle)
> If a user logins via keycloak ticking "remember me", I need the user to be
> "remembered" on keycloak for 12 weeks irrespective of whether the user
> continues to interact with keycloak or not. Something like facebook.
>  
> Just saw this thread as well
> [
> http://ux.stackexchange.com/questions/62857/which-remember-me-option-is-the-best/62862#62862
> ](
> http://ux.stackexchange.com/questions/62857/which-remember-me-option-is-the-best/62862#62862
> )
>  
> Hope my requirement is clear.
>  
> Kalinga
> 
> 
> -----Original Message-----
> From: "Stian Thorgersen" <stian at redhat.com>
> Sent: Wednesday, April 29, 2015 1:43pm
> To: "Kalinga Dissanayake" <kalinga at leapset.com>
> Cc: "Lohitha Chiranjeewa" <kalc04 at gmail.com>, keycloak-user at lists.jboss.org
> Subject: Re: [keycloak-user] Clarification on Remember Me Functionality
> 
> 
> 
> I'm confused, what do you actual think the session timeout does? Exactly why
> do you think that remember-me/session should be valid after the session has
> timed out?
> 
> ----- Original Message -----
> > From: "Kalinga Dissanayake" <kalinga at leapset.com>
> > To: "Stian Thorgersen" <stian at redhat.com>
> > Cc: "Lohitha Chiranjeewa" <kalc04 at gmail.com>, keycloak-user at lists.jboss.org
> > Sent: Wednesday, 29 April, 2015 9:47:50 AM
> > Subject: Re: [keycloak-user] Clarification on Remember Me Functionality
> > 
> > 
> > Stian,
> > 
> > I am having this issue on remember me functionality
> > Can you help me getting it sorted?
> > 
> > I need keycloak to remember me for 2 weeks but i need the session idle
> > timeout to be only 20 minutes.
> > I tried setting SSO Session Max Lifespan to 14 days and setting SSO Session
> > Idle Timeout to 20 minutes.
> > But keycloak remember me token expires after 20 minutes! I need the
> > remember
> > me token to be valid for 14 days and session idle timeout to be valid for
> > 20
> > minutes. :) How can i get this sorted? Setting both parameters to 14 days
> > does not work for me :) Any other way forward?
> > 
> > Kalinga
> > 
> > -----Original Message-----
> > From: "Stian Thorgersen" <stian at redhat.com>
> > Sent: Friday, April 10, 2015 2:02pm
> > To: "Lohitha Chiranjeewa" <kalc04 at gmail.com>
> > Cc: keycloak-user at lists.jboss.org
> > Subject: Re: [keycloak-user] Clarification on Remember Me Functionality
> > 
> > 
> > 
> > This is expected behaviour
> > 
> > ----- Original Message -----
> > > From: "Lohitha Chiranjeewa" <kalc04 at gmail.com>
> > > To: "Stian Thorgersen" <stian at redhat.com>, keycloak-user at lists.jboss.org
> > > Sent: Friday, 10 April, 2015 8:57:19 AM
> > > Subject: Re: [keycloak-user] Clarification on Remember Me Functionality
> > > 
> > > Thanks for the suggestion. I will have to adjust both timeouts according
> > > to
> > > my needs.
> > > 
> > > So is this the expected behavior of Keycloak or is there room for an
> > > improvement? In my view, Remember Me functionality should work
> > > independent
> > > of SSO Session Idle Timeout.
> > > 
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user

From fadiabdeen at gmail.com  Wed Apr 29 13:08:02 2015
From: fadiabdeen at gmail.com (Fadi Abdin)
Date: Wed, 29 Apr 2015 13:08:02 -0400
Subject: [keycloak-user] Endpoints
Message-ID: <CABXXV0TYnGMLOK0gtp_XStujZUHJmkajx3ooDG5KU6X3zTXLKQ@mail.gmail.com>

Hello,

I'm wondering if there is documentation somewhere that lists the REST
services that we can use to (refresh , revoke and get profile info) ..

If anyone can help that will be great.

Thanks,
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150429/69b1d72b/attachment.html 

From Henk.Laracker at planonsoftware.com  Thu Apr 30 02:45:22 2015
From: Henk.Laracker at planonsoftware.com (Henk Laracker)
Date: Thu, 30 Apr 2015 08:45:22 +0200
Subject: [keycloak-user] IDP SAMLV2.0 with Salesforce
Message-ID: <D1670D23.1CB26%henk.laracker@planonsoftware.com>

Hi,

I like to use Salesforce as Identity Provider, the metadata provided by salesforce can be imported.
But I need to specify the Service Provider in salesforce, I have to fill in a couple of fields, but two of them I don?t understand (and are mandatory). Does someone have any clue


 1.  entity id , remark of salesforce : get this value from your serviceprovider
 2.  ACS URL, remark of slaesforce : The assertion consumer service. Get this value from your service provider.

I have tried a lot of values but every-time I click the saml button on my app, it redirects to salesforce but I get a page with the error : Error: Unable to resolve request into a Service Provider

Henk
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150430/441e49c4/attachment.html 

From mposolda at redhat.com  Thu Apr 30 04:49:45 2015
From: mposolda at redhat.com (Marek Posolda)
Date: Thu, 30 Apr 2015 10:49:45 +0200
Subject: [keycloak-user] IDP SAMLV2.0 with Salesforce
In-Reply-To: <D1670D23.1CB26%henk.laracker@planonsoftware.com>
References: <D1670D23.1CB26%henk.laracker@planonsoftware.com>
Message-ID: <5541ECA9.1040000@redhat.com>

Not sure at 100%, but I think that for both values you can just use URI 
when you want Salesforce to redirect after authentication. So something 
like (replace stuff in braces with values for your environment):
http://localhost:8080/auth/realms/{your-realm}/broker/{your-identity-provider-alis}/endpoint

For some hints, you can see picketlink documentation for Salesforce 
integration here 
https://docs.jboss.org/author/display/PLINK/Picketlink+as+SP,+Salesforce+as+IDP 
. I assume many steps are similar for Keycloak like for Picketlink.

Marek

On 30.4.2015 08:45, Henk Laracker wrote:
> Hi,
>
> I like to use Salesforce as Identity Provider, the metadata provided 
> by salesforce can be imported.
> But I need to specify the Service Provider in salesforce, I have to 
> fill in a couple of fields, but two of them I don?t understand (and 
> are mandatory). Does someone have any clue
>
>  1. entity id , remark of salesforce : get this value from your
>     serviceprovider
>  2. ACS URL, remark of slaesforce : The assertion consumer service.
>     Get this value from your service provider.
>
> I have tried a lot of values but every-time I click the saml button on 
> my app, it redirects to salesforce but I get a page with the error : 
> Error: Unable to resolve request into a Service Provider
>
> Henk
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150430/70c3bed6/attachment-0001.html 

From prabhalar at yahoo.com  Thu Apr 30 05:14:42 2015
From: prabhalar at yahoo.com (Raghu Prabhala)
Date: Thu, 30 Apr 2015 09:14:42 +0000 (UTC)
Subject: [keycloak-user] IDP SAMLV2.0 with Salesforce
In-Reply-To: <5541ECA9.1040000@redhat.com>
References: <5541ECA9.1040000@redhat.com>
Message-ID: <1831876109.1122207.1430385282179.JavaMail.yahoo@mail.yahoo.com>

If you get any errors about the?entityid, try the belowhttp://localhost:8080/auth/realms/{your-realm}
Marek/Dev team - Despite spending a good amount of time on KC, even I find it difficult to make things work as the end points are not documented. Is that something that can be done before you go for the next release?
Thanks,Raghu?      From: Marek Posolda <mposolda at redhat.com>
 To: Henk Laracker <Henk.Laracker at planonsoftware.com>; "keycloak-user at lists.jboss.org" <keycloak-user at lists.jboss.org> 
 Sent: Thursday, April 30, 2015 4:49 AM
 Subject: Re: [keycloak-user] IDP SAMLV2.0 with Salesforce
   
 Not sure at 100%, but I think that for both values you can just use URI when you want Salesforce to redirect after authentication. So something like (replace stuff in  braces with values for your environment):
http://localhost:8080/auth/realms/{your-realm}/broker/{your-identity-provider-alis}/endpoint
 
 For some hints, you can see picketlink documentation for Salesforce integration here https://docs.jboss.org/author/display/PLINK/Picketlink+as+SP,+Salesforce+as+IDP . I assume many steps are similar for Keycloak like for Picketlink.
 
 Marek
 


 On 30.4.2015 08:45, Henk Laracker wrote:
  
 
Hi, 
  I like to use Salesforce as Identity Provider, the metadata provided by salesforce can be imported.? But I need to specify the Service Provider in salesforce, I have to fill in a couple of fields, but two of them I don?t understand (and are mandatory). Does someone have any clue 
     
   - entity id , remark of salesforce : get this value from your serviceprovider?
   - ACS URL, remark of slaesforce :?The assertion consumer service. Get this value from your service provider.
 I have tried a lot of values but every-time I click the saml button on my app, it redirects to salesforce but I get a page with the error : Error: Unable to  resolve request into a Service Provider 
  Henk 
  
 _______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user 
 
_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user

  
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150430/f4d5dc72/attachment.html 

From mposolda at redhat.com  Thu Apr 30 05:40:45 2015
From: mposolda at redhat.com (Marek Posolda)
Date: Thu, 30 Apr 2015 11:40:45 +0200
Subject: [keycloak-user] IDP SAMLV2.0 with Salesforce
In-Reply-To: <1831876109.1122207.1430385282179.JavaMail.yahoo@mail.yahoo.com>
References: <5541ECA9.1040000@redhat.com>
	<1831876109.1122207.1430385282179.JavaMail.yahoo@mail.yahoo.com>
Message-ID: <5541F89D.1060209@redhat.com>

Hi Raghu,

There is some documentation for admin endpoins here 
http://docs.jboss.org/keycloak/docs/1.2.0.Beta1/rest-api/overview-index.html 
. The endpoints specific to OpenID Connect or SAML protocol (like 
endpoint for refresh token, validate token etc) are not here though... 
We will possibly try to improve for the next release.

Marek

On 30.4.2015 11:14, Raghu Prabhala wrote:
> If you get any errors about the entityid, try the below
> http://localhost:8080/auth/realms/ 
> <http://localhost:8080/auth/realms/%7Byour-realm>{your-realm 
> <http://localhost:8080/auth/realms/%7Byour-realm>}
>
> Marek/Dev team - Despite spending a good amount of time on KC, even I 
> find it difficult to make things work as the end points are not 
> documented. Is that something that can be done before you go for the 
> next release?
>
> Thanks,
> Raghu
> ------------------------------------------------------------------------
> *From:* Marek Posolda <mposolda at redhat.com>
> *To:* Henk Laracker <Henk.Laracker at planonsoftware.com>; 
> "keycloak-user at lists.jboss.org" <keycloak-user at lists.jboss.org>
> *Sent:* Thursday, April 30, 2015 4:49 AM
> *Subject:* Re: [keycloak-user] IDP SAMLV2.0 with Salesforce
>
> Not sure at 100%, but I think that for both values you can just use 
> URI when you want Salesforce to redirect after authentication. So 
> something like (replace stuff in braces with values for your environment):
> http://localhost:8080/auth/realms/{your-realm}/broker/{your-identity-provider-alis}/endpoint
>
> For some hints, you can see picketlink documentation for Salesforce 
> integration here 
> https://docs.jboss.org/author/display/PLINK/Picketlink+as+SP,+Salesforce+as+IDP 
> . I assume many steps are similar for Keycloak like for Picketlink.
>
> Marek
>
>
>
> On 30.4.2015 08:45, Henk Laracker wrote:
> Hi,
>
> I like to use Salesforce as Identity Provider, the metadata provided 
> by salesforce can be imported.
> But I need to specify the Service Provider in salesforce, I have to 
> fill in a couple of fields, but two of them I don?t understand (and 
> are mandatory). Does someone have any clue
>
>  1. entity id , remark of salesforce : get this value from your
>     serviceprovider
>  2. ACS URL, remark of slaesforce : The assertion consumer service.
>     Get this value from your service provider.
>
> I have tried a lot of values but every-time I click the saml button on 
> my app, it redirects to salesforce but I get a page with the error : 
> Error: Unable to resolve request into a Service Provider
>
> Henk
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org  <mailto:keycloak-user at lists.jboss.org>
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org <mailto:keycloak-user at lists.jboss.org>
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150430/332e9c9c/attachment.html 

From mposolda at redhat.com  Thu Apr 30 05:41:11 2015
From: mposolda at redhat.com (Marek Posolda)
Date: Thu, 30 Apr 2015 11:41:11 +0200
Subject: [keycloak-user] Endpoints
In-Reply-To: <CABXXV0TYnGMLOK0gtp_XStujZUHJmkajx3ooDG5KU6X3zTXLKQ@mail.gmail.com>
References: <CABXXV0TYnGMLOK0gtp_XStujZUHJmkajx3ooDG5KU6X3zTXLKQ@mail.gmail.com>
Message-ID: <5541F8B7.6030709@redhat.com>

There is some documentation for admin endpoins here 
http://docs.jboss.org/keycloak/docs/1.2.0.Beta1/rest-api/overview-index.html 
. The endpoints specific to OpenID Connect or SAML protocol (like 
endpoint for refresh token, validate token etc) are not here though... 
We will possibly try to improve for the next release.

Marek

On 29.4.2015 19:08, Fadi Abdin wrote:
> Hello,
>
> I'm wondering if there is documentation somewhere that lists the REST 
> services that we can use to (refresh , revoke and get profile info) ..
>
> If anyone can help that will be great.
>
> Thanks,
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150430/6f601f45/attachment-0001.html 

From bburke at redhat.com  Thu Apr 30 08:31:18 2015
From: bburke at redhat.com (Bill Burke)
Date: Thu, 30 Apr 2015 08:31:18 -0400
Subject: [keycloak-user] IDP SAMLV2.0 with Salesforce
In-Reply-To: <D1670D23.1CB26%henk.laracker@planonsoftware.com>
References: <D1670D23.1CB26%henk.laracker@planonsoftware.com>
Message-ID: <55422096.8000500@redhat.com>

You want to chain keycloak server to Salesforce?

If you create a SAMLv2 IdentityProvider in keycloak that points to 
Salesforce, you;ll see after you create it, an Export button.  Click 
that.  That will create an entity descriptor with all the information 
you need.

On 4/30/2015 2:45 AM, Henk Laracker wrote:
> Hi,
>
> I like to use Salesforce as Identity Provider, the metadata provided by
> salesforce can be imported.
> But I need to specify the Service Provider in salesforce, I have to fill
> in a couple of fields, but two of them I don?t understand (and are
> mandatory). Does someone have any clue
>
>  1. entity id , remark of salesforce : get this value from your
>     serviceprovider
>  2. ACS URL, remark of slaesforce : The assertion consumer service. Get
>     this value from your service provider.
>
> I have tried a lot of values but every-time I click the saml button on
> my app, it redirects to salesforce but I get a page with the error :
> Error: Unable to resolve request into a Service Provider
>
> Henk
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

-- 
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com

From stian at redhat.com  Thu Apr 30 09:13:42 2015
From: stian at redhat.com (Stian Thorgersen)
Date: Thu, 30 Apr 2015 09:13:42 -0400 (EDT)
Subject: [keycloak-user] Keycloak logging with log4j to use custom
 rolling	appender
In-Reply-To: <BAY168-W71A7C2493262BEE1D5D0B5A9E90@phx.gbl>
References: <BAY168-W280CC0C4AF61B3891C7676A9E90@phx.gbl>
	<BAY168-W71A7C2493262BEE1D5D0B5A9E90@phx.gbl>
Message-ID: <1002314054.10346952.1430399622276.JavaMail.zimbra@redhat.com>

We just delegate logging to WildFly with jboss-logging. So just add it to WildFly and you should be good.

----- Original Message -----
> From: "Chamantha De Silva" <chamantha at outlook.com>
> To: keycloak-user at lists.jboss.org
> Sent: Monday, April 27, 2015 9:52:20 AM
> Subject: [keycloak-user] Keycloak logging with log4j to use custom rolling	appender
> 
> 
> Hi Team,
> 
> I'm trying to use Log4J for keycloak project as logging framework since there
> are custom rolling appenders we have written with few value additions. I was
> referring to changing logging subsystem in wildfly (at
> keycloak/standalone/configuration/standalone.xml ), but seems like I'm
> missing something.
> How can I add a custom log4j rolling appender to Keycloak .
> 
> 
> Best Regards,
> Chamantha
> 
> 
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From Henk.Laracker at planonsoftware.com  Thu Apr 30 09:25:08 2015
From: Henk.Laracker at planonsoftware.com (Henk Laracker)
Date: Thu, 30 Apr 2015 15:25:08 +0200
Subject: [keycloak-user] IDP SAMLV2.0 with Salesforce
In-Reply-To: <55422096.8000500@redhat.com>
References: <D1670D23.1CB26%henk.laracker@planonsoftware.com>
	<55422096.8000500@redhat.com>
Message-ID: <D167F961.1CBF7%henk.laracker@planonsoftware.com>

Hi Bill,

I don?t know why I missed that, thanks! Salesforce respons know with the
correct login page. After logging in in Salesforce, I?m redirected to
keycloak again with a internal error:

Caused by: org.keycloak.broker.provider.IdentityBrokerException: Could not
process response from SAML identity provider.
	at 
org.keycloak.broker.saml.SAMLEndpoint$Binding.handleLoginResponse(SAMLEndpo
int.java:299)
	at 
org.keycloak.broker.saml.SAMLEndpoint$Binding.handleSamlResponse(SAMLEndpoi
nt.java:343)
	at 
org.keycloak.broker.saml.SAMLEndpoint$Binding.execute(SAMLEndpoint.java:169
)
	at 
org.keycloak.broker.saml.SAMLEndpoint.postBinding(SAMLEndpoint.java:117)
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
[rt.jar:1.8.0_45]
	at 
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:6
2) [rt.jar:1.8.0_45]
	at 
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImp
l.java:43) [rt.jar:1.8.0_45]
	at java.lang.reflect.Method.invoke(Method.java:497) [rt.jar:1.8.0_45]
	at 
org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java:1
37) [resteasy-jaxrs-3.0.10.Final.jar:]
	at 
org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTarget(ResourceMethod
Invoker.java:296) [resteasy-jaxrs-3.0.10.Final.jar:]
	at 
org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.
java:250) [resteasy-jaxrs-3.0.10.Final.jar:]
	at 
org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(Resourc
eLocatorInvoker.java:140) [resteasy-jaxrs-3.0.10.Final.jar:]
	at 
org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoke
r.java:109) [resteasy-jaxrs-3.0.10.Final.jar:]
	at 
org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(Resourc
eLocatorInvoker.java:135) [resteasy-jaxrs-3.0.10.Final.jar:]
	at 
org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoke
r.java:103) [resteasy-jaxrs-3.0.10.Final.jar:]
	at 
org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.
java:356) [resteasy-jaxrs-3.0.10.Final.jar:]
	... 39 more
Caused by: org.keycloak.broker.provider.IdentityBrokerException: No
assertion from response.
	at 
org.keycloak.broker.saml.SAMLEndpoint$Binding.getAssertion(SAMLEndpoint.jav
a:309)
	at 
org.keycloak.broker.saml.SAMLEndpoint$Binding.handleLoginResponse(SAMLEndpo
int.java:264)
	... 54 more

Any idea? 

Henk




On 30/04/15 14:31, "Bill Burke" <bburke at redhat.com> wrote:

>You want to chain keycloak server to Salesforce?
>
>If you create a SAMLv2 IdentityProvider in keycloak that points to
>Salesforce, you;ll see after you create it, an Export button.  Click
>that.  That will create an entity descriptor with all the information
>you need.
>
>On 4/30/2015 2:45 AM, Henk Laracker wrote:
>> Hi,
>>
>> I like to use Salesforce as Identity Provider, the metadata provided by
>> salesforce can be imported.
>> But I need to specify the Service Provider in salesforce, I have to fill
>> in a couple of fields, but two of them I don?t understand (and are
>> mandatory). Does someone have any clue
>>
>>  1. entity id , remark of salesforce : get this value from your
>>     serviceprovider
>>  2. ACS URL, remark of slaesforce : The assertion consumer service. Get
>>     this value from your service provider.
>>
>> I have tried a lot of values but every-time I click the saml button on
>> my app, it redirects to salesforce but I get a page with the error :
>> Error: Unable to resolve request into a Service Provider
>>
>> Henk
>>
>>
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>
>-- 
>Bill Burke
>JBoss, a division of Red Hat
>http://bill.burkecentral.com
>_______________________________________________
>keycloak-user mailing list
>keycloak-user at lists.jboss.org
>https://lists.jboss.org/mailman/listinfo/keycloak-user



From bburke at redhat.com  Thu Apr 30 09:43:58 2015
From: bburke at redhat.com (Bill Burke)
Date: Thu, 30 Apr 2015 09:43:58 -0400
Subject: [keycloak-user] IDP SAMLV2.0 with Salesforce
In-Reply-To: <D167F961.1CBF7%henk.laracker@planonsoftware.com>
References: <D1670D23.1CB26%henk.laracker@planonsoftware.com>
	<55422096.8000500@redhat.com>
	<D167F961.1CBF7%henk.laracker@planonsoftware.com>
Message-ID: <5542319E.5090708@redhat.com>

i have no idea.  Basically this error is stating that the login response 
saml document has no assertions within it.  If there are no assertions, 
then there has been no identity data sent.

I'm looking now, but can you send me a link on how to set up Salesforce 
as an IDP?  Is one able to set up a free account and such?

On 4/30/2015 9:25 AM, Henk Laracker wrote:
> Hi Bill,
>
> I don?t know why I missed that, thanks! Salesforce respons know with the
> correct login page. After logging in in Salesforce, I?m redirected to
> keycloak again with a internal error:
>
> Caused by: org.keycloak.broker.provider.IdentityBrokerException: Could not
> process response from SAML identity provider.
> 	at
> org.keycloak.broker.saml.SAMLEndpoint$Binding.handleLoginResponse(SAMLEndpo
> int.java:299)
> 	at
> org.keycloak.broker.saml.SAMLEndpoint$Binding.handleSamlResponse(SAMLEndpoi
> nt.java:343)
> 	at
> org.keycloak.broker.saml.SAMLEndpoint$Binding.execute(SAMLEndpoint.java:169
> )
> 	at
> org.keycloak.broker.saml.SAMLEndpoint.postBinding(SAMLEndpoint.java:117)
> 	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
> [rt.jar:1.8.0_45]
> 	at
> sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:6
> 2) [rt.jar:1.8.0_45]
> 	at
> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImp
> l.java:43) [rt.jar:1.8.0_45]
> 	at java.lang.reflect.Method.invoke(Method.java:497) [rt.jar:1.8.0_45]
> 	at
> org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java:1
> 37) [resteasy-jaxrs-3.0.10.Final.jar:]
> 	at
> org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTarget(ResourceMethod
> Invoker.java:296) [resteasy-jaxrs-3.0.10.Final.jar:]
> 	at
> org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.
> java:250) [resteasy-jaxrs-3.0.10.Final.jar:]
> 	at
> org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(Resourc
> eLocatorInvoker.java:140) [resteasy-jaxrs-3.0.10.Final.jar:]
> 	at
> org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoke
> r.java:109) [resteasy-jaxrs-3.0.10.Final.jar:]
> 	at
> org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(Resourc
> eLocatorInvoker.java:135) [resteasy-jaxrs-3.0.10.Final.jar:]
> 	at
> org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoke
> r.java:103) [resteasy-jaxrs-3.0.10.Final.jar:]
> 	at
> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.
> java:356) [resteasy-jaxrs-3.0.10.Final.jar:]
> 	... 39 more
> Caused by: org.keycloak.broker.provider.IdentityBrokerException: No
> assertion from response.
> 	at
> org.keycloak.broker.saml.SAMLEndpoint$Binding.getAssertion(SAMLEndpoint.jav
> a:309)
> 	at
> org.keycloak.broker.saml.SAMLEndpoint$Binding.handleLoginResponse(SAMLEndpo
> int.java:264)
> 	... 54 more
>
> Any idea?
>
> Henk
>
>
>
>
> On 30/04/15 14:31, "Bill Burke" <bburke at redhat.com> wrote:
>
>> You want to chain keycloak server to Salesforce?
>>
>> If you create a SAMLv2 IdentityProvider in keycloak that points to
>> Salesforce, you;ll see after you create it, an Export button.  Click
>> that.  That will create an entity descriptor with all the information
>> you need.
>>
>> On 4/30/2015 2:45 AM, Henk Laracker wrote:
>>> Hi,
>>>
>>> I like to use Salesforce as Identity Provider, the metadata provided by
>>> salesforce can be imported.
>>> But I need to specify the Service Provider in salesforce, I have to fill
>>> in a couple of fields, but two of them I don?t understand (and are
>>> mandatory). Does someone have any clue
>>>
>>>   1. entity id , remark of salesforce : get this value from your
>>>      serviceprovider
>>>   2. ACS URL, remark of slaesforce : The assertion consumer service. Get
>>>      this value from your service provider.
>>>
>>> I have tried a lot of values but every-time I click the saml button on
>>> my app, it redirects to salesforce but I get a page with the error :
>>> Error: Unable to resolve request into a Service Provider
>>>
>>> Henk
>>>
>>>
>>> _______________________________________________
>>> keycloak-user mailing list
>>> keycloak-user at lists.jboss.org
>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>
>>
>> --
>> Bill Burke
>> JBoss, a division of Red Hat
>> http://bill.burkecentral.com
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

-- 
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com

From bburke at redhat.com  Thu Apr 30 11:39:45 2015
From: bburke at redhat.com (Bill Burke)
Date: Thu, 30 Apr 2015 11:39:45 -0400
Subject: [keycloak-user] IDP SAMLV2.0 with Salesforce
In-Reply-To: <5542319E.5090708@redhat.com>
References: <D1670D23.1CB26%henk.laracker@planonsoftware.com>	<55422096.8000500@redhat.com>	<D167F961.1CBF7%henk.laracker@planonsoftware.com>
	<5542319E.5090708@redhat.com>
Message-ID: <55424CC1.2010405@redhat.com>

I set up a salesforce example and looked at the login response SAML 
document.  Looks like no assertion data is being sent back at all by 
salesforce.

On 4/30/2015 9:43 AM, Bill Burke wrote:
> i have no idea.  Basically this error is stating that the login response
> saml document has no assertions within it.  If there are no assertions,
> then there has been no identity data sent.
>
> I'm looking now, but can you send me a link on how to set up Salesforce
> as an IDP?  Is one able to set up a free account and such?
>
> On 4/30/2015 9:25 AM, Henk Laracker wrote:
>> Hi Bill,
>>
>> I don?t know why I missed that, thanks! Salesforce respons know with the
>> correct login page. After logging in in Salesforce, I?m redirected to
>> keycloak again with a internal error:
>>
>> Caused by: org.keycloak.broker.provider.IdentityBrokerException: Could not
>> process response from SAML identity provider.
>> 	at
>> org.keycloak.broker.saml.SAMLEndpoint$Binding.handleLoginResponse(SAMLEndpo
>> int.java:299)
>> 	at
>> org.keycloak.broker.saml.SAMLEndpoint$Binding.handleSamlResponse(SAMLEndpoi
>> nt.java:343)
>> 	at
>> org.keycloak.broker.saml.SAMLEndpoint$Binding.execute(SAMLEndpoint.java:169
>> )
>> 	at
>> org.keycloak.broker.saml.SAMLEndpoint.postBinding(SAMLEndpoint.java:117)
>> 	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
>> [rt.jar:1.8.0_45]
>> 	at
>> sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:6
>> 2) [rt.jar:1.8.0_45]
>> 	at
>> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImp
>> l.java:43) [rt.jar:1.8.0_45]
>> 	at java.lang.reflect.Method.invoke(Method.java:497) [rt.jar:1.8.0_45]
>> 	at
>> org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java:1
>> 37) [resteasy-jaxrs-3.0.10.Final.jar:]
>> 	at
>> org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTarget(ResourceMethod
>> Invoker.java:296) [resteasy-jaxrs-3.0.10.Final.jar:]
>> 	at
>> org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.
>> java:250) [resteasy-jaxrs-3.0.10.Final.jar:]
>> 	at
>> org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(Resourc
>> eLocatorInvoker.java:140) [resteasy-jaxrs-3.0.10.Final.jar:]
>> 	at
>> org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoke
>> r.java:109) [resteasy-jaxrs-3.0.10.Final.jar:]
>> 	at
>> org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(Resourc
>> eLocatorInvoker.java:135) [resteasy-jaxrs-3.0.10.Final.jar:]
>> 	at
>> org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoke
>> r.java:103) [resteasy-jaxrs-3.0.10.Final.jar:]
>> 	at
>> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.
>> java:356) [resteasy-jaxrs-3.0.10.Final.jar:]
>> 	... 39 more
>> Caused by: org.keycloak.broker.provider.IdentityBrokerException: No
>> assertion from response.
>> 	at
>> org.keycloak.broker.saml.SAMLEndpoint$Binding.getAssertion(SAMLEndpoint.jav
>> a:309)
>> 	at
>> org.keycloak.broker.saml.SAMLEndpoint$Binding.handleLoginResponse(SAMLEndpo
>> int.java:264)
>> 	... 54 more
>>
>> Any idea?
>>
>> Henk
>>
>>
>>
>>
>> On 30/04/15 14:31, "Bill Burke" <bburke at redhat.com> wrote:
>>
>>> You want to chain keycloak server to Salesforce?
>>>
>>> If you create a SAMLv2 IdentityProvider in keycloak that points to
>>> Salesforce, you;ll see after you create it, an Export button.  Click
>>> that.  That will create an entity descriptor with all the information
>>> you need.
>>>
>>> On 4/30/2015 2:45 AM, Henk Laracker wrote:
>>>> Hi,
>>>>
>>>> I like to use Salesforce as Identity Provider, the metadata provided by
>>>> salesforce can be imported.
>>>> But I need to specify the Service Provider in salesforce, I have to fill
>>>> in a couple of fields, but two of them I don?t understand (and are
>>>> mandatory). Does someone have any clue
>>>>
>>>>    1. entity id , remark of salesforce : get this value from your
>>>>       serviceprovider
>>>>    2. ACS URL, remark of slaesforce : The assertion consumer service. Get
>>>>       this value from your service provider.
>>>>
>>>> I have tried a lot of values but every-time I click the saml button on
>>>> my app, it redirects to salesforce but I get a page with the error :
>>>> Error: Unable to resolve request into a Service Provider
>>>>
>>>> Henk
>>>>
>>>>
>>>> _______________________________________________
>>>> keycloak-user mailing list
>>>> keycloak-user at lists.jboss.org
>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>
>>>
>>> --
>>> Bill Burke
>>> JBoss, a division of Red Hat
>>> http://bill.burkecentral.com
>>> _______________________________________________
>>> keycloak-user mailing list
>>> keycloak-user at lists.jboss.org
>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>

-- 
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com

From bburke at redhat.com  Thu Apr 30 12:44:07 2015
From: bburke at redhat.com (Bill Burke)
Date: Thu, 30 Apr 2015 12:44:07 -0400
Subject: [keycloak-user] IDP SAMLV2.0 with Salesforce
In-Reply-To: <55424CC1.2010405@redhat.com>
References: <D1670D23.1CB26%henk.laracker@planonsoftware.com>	<55422096.8000500@redhat.com>	<D167F961.1CBF7%henk.laracker@planonsoftware.com>	<5542319E.5090708@redhat.com>
	<55424CC1.2010405@redhat.com>
Message-ID: <55425BD7.9020903@redhat.com>

Ok, I was able to get this to work.  The problem was I had to set a 
"profile" for the connected app on Salesforce.  I added a "System 
Adminstrator" profile to the Connected App and it worked.

I'm not sure how to upload a app certificate yet.  Not sure what format 
Salesforce is looking for.

On 4/30/2015 11:39 AM, Bill Burke wrote:
> I set up a salesforce example and looked at the login response SAML
> document.  Looks like no assertion data is being sent back at all by
> salesforce.
>
> On 4/30/2015 9:43 AM, Bill Burke wrote:
>> i have no idea.  Basically this error is stating that the login response
>> saml document has no assertions within it.  If there are no assertions,
>> then there has been no identity data sent.
>>
>> I'm looking now, but can you send me a link on how to set up Salesforce
>> as an IDP?  Is one able to set up a free account and such?
>>
>> On 4/30/2015 9:25 AM, Henk Laracker wrote:
>>> Hi Bill,
>>>
>>> I don?t know why I missed that, thanks! Salesforce respons know with the
>>> correct login page. After logging in in Salesforce, I?m redirected to
>>> keycloak again with a internal error:
>>>
>>> Caused by: org.keycloak.broker.provider.IdentityBrokerException: Could not
>>> process response from SAML identity provider.
>>> 	at
>>> org.keycloak.broker.saml.SAMLEndpoint$Binding.handleLoginResponse(SAMLEndpo
>>> int.java:299)
>>> 	at
>>> org.keycloak.broker.saml.SAMLEndpoint$Binding.handleSamlResponse(SAMLEndpoi
>>> nt.java:343)
>>> 	at
>>> org.keycloak.broker.saml.SAMLEndpoint$Binding.execute(SAMLEndpoint.java:169
>>> )
>>> 	at
>>> org.keycloak.broker.saml.SAMLEndpoint.postBinding(SAMLEndpoint.java:117)
>>> 	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
>>> [rt.jar:1.8.0_45]
>>> 	at
>>> sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:6
>>> 2) [rt.jar:1.8.0_45]
>>> 	at
>>> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImp
>>> l.java:43) [rt.jar:1.8.0_45]
>>> 	at java.lang.reflect.Method.invoke(Method.java:497) [rt.jar:1.8.0_45]
>>> 	at
>>> org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java:1
>>> 37) [resteasy-jaxrs-3.0.10.Final.jar:]
>>> 	at
>>> org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTarget(ResourceMethod
>>> Invoker.java:296) [resteasy-jaxrs-3.0.10.Final.jar:]
>>> 	at
>>> org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.
>>> java:250) [resteasy-jaxrs-3.0.10.Final.jar:]
>>> 	at
>>> org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(Resourc
>>> eLocatorInvoker.java:140) [resteasy-jaxrs-3.0.10.Final.jar:]
>>> 	at
>>> org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoke
>>> r.java:109) [resteasy-jaxrs-3.0.10.Final.jar:]
>>> 	at
>>> org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(Resourc
>>> eLocatorInvoker.java:135) [resteasy-jaxrs-3.0.10.Final.jar:]
>>> 	at
>>> org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoke
>>> r.java:103) [resteasy-jaxrs-3.0.10.Final.jar:]
>>> 	at
>>> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.
>>> java:356) [resteasy-jaxrs-3.0.10.Final.jar:]
>>> 	... 39 more
>>> Caused by: org.keycloak.broker.provider.IdentityBrokerException: No
>>> assertion from response.
>>> 	at
>>> org.keycloak.broker.saml.SAMLEndpoint$Binding.getAssertion(SAMLEndpoint.jav
>>> a:309)
>>> 	at
>>> org.keycloak.broker.saml.SAMLEndpoint$Binding.handleLoginResponse(SAMLEndpo
>>> int.java:264)
>>> 	... 54 more
>>>
>>> Any idea?
>>>
>>> Henk
>>>
>>>
>>>
>>>
>>> On 30/04/15 14:31, "Bill Burke" <bburke at redhat.com> wrote:
>>>
>>>> You want to chain keycloak server to Salesforce?
>>>>
>>>> If you create a SAMLv2 IdentityProvider in keycloak that points to
>>>> Salesforce, you;ll see after you create it, an Export button.  Click
>>>> that.  That will create an entity descriptor with all the information
>>>> you need.
>>>>
>>>> On 4/30/2015 2:45 AM, Henk Laracker wrote:
>>>>> Hi,
>>>>>
>>>>> I like to use Salesforce as Identity Provider, the metadata provided by
>>>>> salesforce can be imported.
>>>>> But I need to specify the Service Provider in salesforce, I have to fill
>>>>> in a couple of fields, but two of them I don?t understand (and are
>>>>> mandatory). Does someone have any clue
>>>>>
>>>>>     1. entity id , remark of salesforce : get this value from your
>>>>>        serviceprovider
>>>>>     2. ACS URL, remark of slaesforce : The assertion consumer service. Get
>>>>>        this value from your service provider.
>>>>>
>>>>> I have tried a lot of values but every-time I click the saml button on
>>>>> my app, it redirects to salesforce but I get a page with the error :
>>>>> Error: Unable to resolve request into a Service Provider
>>>>>
>>>>> Henk
>>>>>
>>>>>
>>>>> _______________________________________________
>>>>> keycloak-user mailing list
>>>>> keycloak-user at lists.jboss.org
>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>>
>>>>
>>>> --
>>>> Bill Burke
>>>> JBoss, a division of Red Hat
>>>> http://bill.burkecentral.com
>>>> _______________________________________________
>>>> keycloak-user mailing list
>>>> keycloak-user at lists.jboss.org
>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>
>>
>

-- 
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com

From fadiabdeen at gmail.com  Thu Apr 30 12:48:47 2015
From: fadiabdeen at gmail.com (Fadi Abdin)
Date: Thu, 30 Apr 2015 12:48:47 -0400
Subject: [keycloak-user] OAuth
Message-ID: <CABXXV0T-evnvWuC2o+t6wkWznaHgrJCv+76RVUa+G990Stz46w@mail.gmail.com>

I just created a simple javascript app to test my oauth keycloak
connections and implemented the calls to do the basic things ( except
revoke the token) .

My code is on github https://github.com/fadiabdeen/keycloak-oauth
<https://github.com/fadiabdeen/keycloak-oauth>

I was able to get a authorization code.
get a token
refresh the token
get the user information though validate
logout ( which only clears the session

I cant figure out how to revoke my access_token .. if anybody can help with
this then its great.

Thanks
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150430/b40aa83f/attachment.html 

From Henk.Laracker at planonsoftware.com  Thu Apr 30 14:51:31 2015
From: Henk.Laracker at planonsoftware.com (Henk Laracker)
Date: Thu, 30 Apr 2015 20:51:31 +0200
Subject: [keycloak-user] IDP SAMLV2.0 with Salesforce
In-Reply-To: <55425BD7.9020903@redhat.com>
References: <D1670D23.1CB26%henk.laracker@planonsoftware.com>
	<55422096.8000500@redhat.com>
	<D167F961.1CBF7%henk.laracker@planonsoftware.com>
	<5542319E.5090708@redhat.com> <55424CC1.2010405@redhat.com>
	<55425BD7.9020903@redhat.com>
Message-ID: <D16845F6.1CCCF%henk.laracker@planonsoftware.com>

Hi Bill,

Thank you this worked out! I user is created with my name
saml.henk.laracker at p***n.nl , do you have any idee why the ?saml? prefix
is added? 


Henk

On 30/04/15 18:44, "Bill Burke" <bburke at redhat.com> wrote:

>Ok, I was able to get this to work.  The problem was I had to set a
>"profile" for the connected app on Salesforce.  I added a "System
>Adminstrator" profile to the Connected App and it worked.
>
>I'm not sure how to upload a app certificate yet.  Not sure what format
>Salesforce is looking for.
>
>On 4/30/2015 11:39 AM, Bill Burke wrote:
>> I set up a salesforce example and looked at the login response SAML
>> document.  Looks like no assertion data is being sent back at all by
>> salesforce.
>>
>> On 4/30/2015 9:43 AM, Bill Burke wrote:
>>> i have no idea.  Basically this error is stating that the login
>>>response
>>> saml document has no assertions within it.  If there are no assertions,
>>> then there has been no identity data sent.
>>>
>>> I'm looking now, but can you send me a link on how to set up Salesforce
>>> as an IDP?  Is one able to set up a free account and such?
>>>
>>> On 4/30/2015 9:25 AM, Henk Laracker wrote:
>>>> Hi Bill,
>>>>
>>>> I don?t know why I missed that, thanks! Salesforce respons know with
>>>>the
>>>> correct login page. After logging in in Salesforce, I?m redirected to
>>>> keycloak again with a internal error:
>>>>
>>>> Caused by: org.keycloak.broker.provider.IdentityBrokerException:
>>>>Could not
>>>> process response from SAML identity provider.
>>>> 	at
>>>> 
>>>>org.keycloak.broker.saml.SAMLEndpoint$Binding.handleLoginResponse(SAMLE
>>>>ndpo
>>>> int.java:299)
>>>> 	at
>>>> 
>>>>org.keycloak.broker.saml.SAMLEndpoint$Binding.handleSamlResponse(SAMLEn
>>>>dpoi
>>>> nt.java:343)
>>>> 	at
>>>> 
>>>>org.keycloak.broker.saml.SAMLEndpoint$Binding.execute(SAMLEndpoint.java
>>>>:169
>>>> )
>>>> 	at
>>>> 
>>>>org.keycloak.broker.saml.SAMLEndpoint.postBinding(SAMLEndpoint.java:117
>>>>)
>>>> 	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
>>>> [rt.jar:1.8.0_45]
>>>> 	at
>>>> 
>>>>sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.ja
>>>>va:6
>>>> 2) [rt.jar:1.8.0_45]
>>>> 	at
>>>> 
>>>>sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccesso
>>>>rImp
>>>> l.java:43) [rt.jar:1.8.0_45]
>>>> 	at java.lang.reflect.Method.invoke(Method.java:497) [rt.jar:1.8.0_45]
>>>> 	at
>>>> 
>>>>org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.ja
>>>>va:1
>>>> 37) [resteasy-jaxrs-3.0.10.Final.jar:]
>>>> 	at
>>>> 
>>>>org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTarget(ResourceMe
>>>>thod
>>>> Invoker.java:296) [resteasy-jaxrs-3.0.10.Final.jar:]
>>>> 	at
>>>> 
>>>>org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvo
>>>>ker.
>>>> java:250) [resteasy-jaxrs-3.0.10.Final.jar:]
>>>> 	at
>>>> 
>>>>org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(Res
>>>>ourc
>>>> eLocatorInvoker.java:140) [resteasy-jaxrs-3.0.10.Final.jar:]
>>>> 	at
>>>> 
>>>>org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorIn
>>>>voke
>>>> r.java:109) [resteasy-jaxrs-3.0.10.Final.jar:]
>>>> 	at
>>>> 
>>>>org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(Res
>>>>ourc
>>>> eLocatorInvoker.java:135) [resteasy-jaxrs-3.0.10.Final.jar:]
>>>> 	at
>>>> 
>>>>org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorIn
>>>>voke
>>>> r.java:103) [resteasy-jaxrs-3.0.10.Final.jar:]
>>>> 	at
>>>> 
>>>>org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatc
>>>>her.
>>>> java:356) [resteasy-jaxrs-3.0.10.Final.jar:]
>>>> 	... 39 more
>>>> Caused by: org.keycloak.broker.provider.IdentityBrokerException: No
>>>> assertion from response.
>>>> 	at
>>>> 
>>>>org.keycloak.broker.saml.SAMLEndpoint$Binding.getAssertion(SAMLEndpoint
>>>>.jav
>>>> a:309)
>>>> 	at
>>>> 
>>>>org.keycloak.broker.saml.SAMLEndpoint$Binding.handleLoginResponse(SAMLE
>>>>ndpo
>>>> int.java:264)
>>>> 	... 54 more
>>>>
>>>> Any idea?
>>>>
>>>> Henk
>>>>
>>>>
>>>>
>>>>
>>>> On 30/04/15 14:31, "Bill Burke" <bburke at redhat.com> wrote:
>>>>
>>>>> You want to chain keycloak server to Salesforce?
>>>>>
>>>>> If you create a SAMLv2 IdentityProvider in keycloak that points to
>>>>> Salesforce, you;ll see after you create it, an Export button.  Click
>>>>> that.  That will create an entity descriptor with all the information
>>>>> you need.
>>>>>
>>>>> On 4/30/2015 2:45 AM, Henk Laracker wrote:
>>>>>> Hi,
>>>>>>
>>>>>> I like to use Salesforce as Identity Provider, the metadata
>>>>>>provided by
>>>>>> salesforce can be imported.
>>>>>> But I need to specify the Service Provider in salesforce, I have to
>>>>>>fill
>>>>>> in a couple of fields, but two of them I don?t understand (and are
>>>>>> mandatory). Does someone have any clue
>>>>>>
>>>>>>     1. entity id , remark of salesforce : get this value from your
>>>>>>        serviceprovider
>>>>>>     2. ACS URL, remark of slaesforce : The assertion consumer
>>>>>>service. Get
>>>>>>        this value from your service provider.
>>>>>>
>>>>>> I have tried a lot of values but every-time I click the saml button
>>>>>>on
>>>>>> my app, it redirects to salesforce but I get a page with the error :
>>>>>> Error: Unable to resolve request into a Service Provider
>>>>>>
>>>>>> Henk
>>>>>>
>>>>>>
>>>>>> _______________________________________________
>>>>>> keycloak-user mailing list
>>>>>> keycloak-user at lists.jboss.org
>>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>>>
>>>>>
>>>>> --
>>>>> Bill Burke
>>>>> JBoss, a division of Red Hat
>>>>> http://bill.burkecentral.com
>>>>> _______________________________________________
>>>>> keycloak-user mailing list
>>>>> keycloak-user at lists.jboss.org
>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>
>>>
>>
>
>-- 
>Bill Burke
>JBoss, a division of Red Hat
>http://bill.burkecentral.com
>_______________________________________________
>keycloak-user mailing list
>keycloak-user at lists.jboss.org
>https://lists.jboss.org/mailman/listinfo/keycloak-user



From bburke at redhat.com  Thu Apr 30 19:26:35 2015
From: bburke at redhat.com (Bill Burke)
Date: Thu, 30 Apr 2015 19:26:35 -0400
Subject: [keycloak-user] IDP SAMLV2.0 with Salesforce
In-Reply-To: <D16845F6.1CCCF%henk.laracker@planonsoftware.com>
References: <D1670D23.1CB26%henk.laracker@planonsoftware.com>
	<55422096.8000500@redhat.com>
	<D167F961.1CBF7%henk.laracker@planonsoftware.com>
	<5542319E.5090708@redhat.com> <55424CC1.2010405@redhat.com>
	<55425BD7.9020903@redhat.com>
	<D16845F6.1CCCF%henk.laracker@planonsoftware.com>
Message-ID: <5542BA2B.2010608@redhat.com>

Right now, the username is prefixed with the broker name.  THis is to
avoid name clashes if you are brokering multiple IDPS (i.e. multiple
social providers).

On 4/30/2015 2:51 PM, Henk Laracker wrote:
> Hi Bill,
> 
> Thank you this worked out! I user is created with my name
> saml.henk.laracker at p***n.nl , do you have any idee why the ?saml? prefix
> is added?
> 
> 
> Henk
> 
> On 30/04/15 18:44, "Bill Burke" <bburke at redhat.com> wrote:
> 
>> Ok, I was able to get this to work.  The problem was I had to set a
>> "profile" for the connected app on Salesforce.  I added a "System
>> Adminstrator" profile to the Connected App and it worked.
>>
>> I'm not sure how to upload a app certificate yet.  Not sure what format
>> Salesforce is looking for.
>>
>> On 4/30/2015 11:39 AM, Bill Burke wrote:
>>> I set up a salesforce example and looked at the login response SAML
>>> document.  Looks like no assertion data is being sent back at all by
>>> salesforce.
>>>
>>> On 4/30/2015 9:43 AM, Bill Burke wrote:
>>>> i have no idea.  Basically this error is stating that the login
>>>> response
>>>> saml document has no assertions within it.  If there are no assertions,
>>>> then there has been no identity data sent.
>>>>
>>>> I'm looking now, but can you send me a link on how to set up Salesforce
>>>> as an IDP?  Is one able to set up a free account and such?
>>>>
>>>> On 4/30/2015 9:25 AM, Henk Laracker wrote:
>>>>> Hi Bill,
>>>>>
>>>>> I don?t know why I missed that, thanks! Salesforce respons know with
>>>>> the
>>>>> correct login page. After logging in in Salesforce, I?m redirected to
>>>>> keycloak again with a internal error:
>>>>>
>>>>> Caused by: org.keycloak.broker.provider.IdentityBrokerException:
>>>>> Could not
>>>>> process response from SAML identity provider.
>>>>> 	at
>>>>>
>>>>> org.keycloak.broker.saml.SAMLEndpoint$Binding.handleLoginResponse(SAMLE
>>>>> ndpo
>>>>> int.java:299)
>>>>> 	at
>>>>>
>>>>> org.keycloak.broker.saml.SAMLEndpoint$Binding.handleSamlResponse(SAMLEn
>>>>> dpoi
>>>>> nt.java:343)
>>>>> 	at
>>>>>
>>>>> org.keycloak.broker.saml.SAMLEndpoint$Binding.execute(SAMLEndpoint.java
>>>>> :169
>>>>> )
>>>>> 	at
>>>>>
>>>>> org.keycloak.broker.saml.SAMLEndpoint.postBinding(SAMLEndpoint.java:117
>>>>> )
>>>>> 	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
>>>>> [rt.jar:1.8.0_45]
>>>>> 	at
>>>>>
>>>>> sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.ja
>>>>> va:6
>>>>> 2) [rt.jar:1.8.0_45]
>>>>> 	at
>>>>>
>>>>> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccesso
>>>>> rImp
>>>>> l.java:43) [rt.jar:1.8.0_45]
>>>>> 	at java.lang.reflect.Method.invoke(Method.java:497) [rt.jar:1.8.0_45]
>>>>> 	at
>>>>>
>>>>> org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.ja
>>>>> va:1
>>>>> 37) [resteasy-jaxrs-3.0.10.Final.jar:]
>>>>> 	at
>>>>>
>>>>> org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTarget(ResourceMe
>>>>> thod
>>>>> Invoker.java:296) [resteasy-jaxrs-3.0.10.Final.jar:]
>>>>> 	at
>>>>>
>>>>> org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvo
>>>>> ker.
>>>>> java:250) [resteasy-jaxrs-3.0.10.Final.jar:]
>>>>> 	at
>>>>>
>>>>> org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(Res
>>>>> ourc
>>>>> eLocatorInvoker.java:140) [resteasy-jaxrs-3.0.10.Final.jar:]
>>>>> 	at
>>>>>
>>>>> org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorIn
>>>>> voke
>>>>> r.java:109) [resteasy-jaxrs-3.0.10.Final.jar:]
>>>>> 	at
>>>>>
>>>>> org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(Res
>>>>> ourc
>>>>> eLocatorInvoker.java:135) [resteasy-jaxrs-3.0.10.Final.jar:]
>>>>> 	at
>>>>>
>>>>> org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorIn
>>>>> voke
>>>>> r.java:103) [resteasy-jaxrs-3.0.10.Final.jar:]
>>>>> 	at
>>>>>
>>>>> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatc
>>>>> her.
>>>>> java:356) [resteasy-jaxrs-3.0.10.Final.jar:]
>>>>> 	... 39 more
>>>>> Caused by: org.keycloak.broker.provider.IdentityBrokerException: No
>>>>> assertion from response.
>>>>> 	at
>>>>>
>>>>> org.keycloak.broker.saml.SAMLEndpoint$Binding.getAssertion(SAMLEndpoint
>>>>> .jav
>>>>> a:309)
>>>>> 	at
>>>>>
>>>>> org.keycloak.broker.saml.SAMLEndpoint$Binding.handleLoginResponse(SAMLE
>>>>> ndpo
>>>>> int.java:264)
>>>>> 	... 54 more
>>>>>
>>>>> Any idea?
>>>>>
>>>>> Henk
>>>>>
>>>>>
>>>>>
>>>>>
>>>>> On 30/04/15 14:31, "Bill Burke" <bburke at redhat.com> wrote:
>>>>>
>>>>>> You want to chain keycloak server to Salesforce?
>>>>>>
>>>>>> If you create a SAMLv2 IdentityProvider in keycloak that points to
>>>>>> Salesforce, you;ll see after you create it, an Export button.  Click
>>>>>> that.  That will create an entity descriptor with all the information
>>>>>> you need.
>>>>>>
>>>>>> On 4/30/2015 2:45 AM, Henk Laracker wrote:
>>>>>>> Hi,
>>>>>>>
>>>>>>> I like to use Salesforce as Identity Provider, the metadata
>>>>>>> provided by
>>>>>>> salesforce can be imported.
>>>>>>> But I need to specify the Service Provider in salesforce, I have to
>>>>>>> fill
>>>>>>> in a couple of fields, but two of them I don?t understand (and are
>>>>>>> mandatory). Does someone have any clue
>>>>>>>
>>>>>>>      1. entity id , remark of salesforce : get this value from your
>>>>>>>         serviceprovider
>>>>>>>      2. ACS URL, remark of slaesforce : The assertion consumer
>>>>>>> service. Get
>>>>>>>         this value from your service provider.
>>>>>>>
>>>>>>> I have tried a lot of values but every-time I click the saml button
>>>>>>> on
>>>>>>> my app, it redirects to salesforce but I get a page with the error :
>>>>>>> Error: Unable to resolve request into a Service Provider
>>>>>>>
>>>>>>> Henk
>>>>>>>
>>>>>>>
>>>>>>> _______________________________________________
>>>>>>> keycloak-user mailing list
>>>>>>> keycloak-user at lists.jboss.org
>>>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>>>>
>>>>>>
>>>>>> --
>>>>>> Bill Burke
>>>>>> JBoss, a division of Red Hat
>>>>>> http://bill.burkecentral.com
>>>>>> _______________________________________________
>>>>>> keycloak-user mailing list
>>>>>> keycloak-user at lists.jboss.org
>>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>>
>>>>
>>>
>>
>> -- 
>> Bill Burke
>> JBoss, a division of Red Hat
>> http://bill.burkecentral.com
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
> 

-- 
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com

From prabhalar at yahoo.com  Thu Apr 30 21:23:13 2015
From: prabhalar at yahoo.com (Raghu Prabhala)
Date: Fri, 1 May 2015 01:23:13 +0000 (UTC)
Subject: [keycloak-user] IDP SAMLV2.0 with Salesforce
In-Reply-To: <5542BA2B.2010608@redhat.com>
References: <5542BA2B.2010608@redhat.com>
Message-ID: <1970499048.89811.1430443394466.JavaMail.yahoo@mail.yahoo.com>

Bill - That would be an issue for us?as we cannot manipulate the values (especially username) sent by an external IDP which is the authoritative source of user information. We will have to figure out another way, perhaps, an internal KC user attribute that?can be made unique to prevent name clashes.
Thanks,Raghu
?      From: Bill Burke <bburke at redhat.com>
 To: Henk Laracker <Henk.Laracker at planonsoftware.com>; "keycloak-user at lists.jboss.org" <keycloak-user at lists.jboss.org> 
 Sent: Thursday, April 30, 2015 7:26 PM
 Subject: Re: [keycloak-user] IDP SAMLV2.0 with Salesforce
   
Right now, the username is prefixed with the broker name.? THis is to
avoid name clashes if you are brokering multiple IDPS (i.e. multiple
social providers).

On 4/30/2015 2:51 PM, Henk Laracker wrote:
> Hi Bill,
> 
> Thank you this worked out! I user is created with my name
> saml.henk.laracker at p***n.nl , do you have any idee why the ?saml? prefix
> is added?
> 
> 
> Henk
> 
> On 30/04/15 18:44, "Bill Burke" <bburke at redhat.com> wrote:
> 
>> Ok, I was able to get this to work.? The problem was I had to set a
>> "profile" for the connected app on Salesforce.? I added a "System
>> Adminstrator" profile to the Connected App and it worked.
>>
>> I'm not sure how to upload a app certificate yet.? Not sure what format
>> Salesforce is looking for.
>>
>> On 4/30/2015 11:39 AM, Bill Burke wrote:
>>> I set up a salesforce example and looked at the login response SAML
>>> document.? Looks like no assertion data is being sent back at all by
>>> salesforce.
>>>
>>> On 4/30/2015 9:43 AM, Bill Burke wrote:
>>>> i have no idea.? Basically this error is stating that the login
>>>> response
>>>> saml document has no assertions within it.? If there are no assertions,
>>>> then there has been no identity data sent.
>>>>
>>>> I'm looking now, but can you send me a link on how to set up Salesforce
>>>> as an IDP?? Is one able to set up a free account and such?
>>>>
>>>> On 4/30/2015 9:25 AM, Henk Laracker wrote:
>>>>> Hi Bill,
>>>>>
>>>>> I don?t know why I missed that, thanks! Salesforce respons know with
>>>>> the
>>>>> correct login page. After logging in in Salesforce, I?m redirected to
>>>>> keycloak again with a internal error:
>>>>>
>>>>> Caused by: org.keycloak.broker.provider.IdentityBrokerException:
>>>>> Could not
>>>>> process response from SAML identity provider.
>>>>> ??? at
>>>>>
>>>>> org.keycloak.broker.saml.SAMLEndpoint$Binding.handleLoginResponse(SAMLE
>>>>> ndpo
>>>>> int.java:299)
>>>>> ??? at
>>>>>
>>>>> org.keycloak.broker.saml.SAMLEndpoint$Binding.handleSamlResponse(SAMLEn
>>>>> dpoi
>>>>> nt.java:343)
>>>>> ??? at
>>>>>
>>>>> org.keycloak.broker.saml.SAMLEndpoint$Binding.execute(SAMLEndpoint.java
>>>>> :169
>>>>> )
>>>>> ??? at
>>>>>
>>>>> org.keycloak.broker.saml.SAMLEndpoint.postBinding(SAMLEndpoint.java:117
>>>>> )
>>>>> ??? at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
>>>>> [rt.jar:1.8.0_45]
>>>>> ??? at
>>>>>
>>>>> sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.ja
>>>>> va:6
>>>>> 2) [rt.jar:1.8.0_45]
>>>>> ??? at
>>>>>
>>>>> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccesso
>>>>> rImp
>>>>> l.java:43) [rt.jar:1.8.0_45]
>>>>> ??? at java.lang.reflect.Method.invoke(Method.java:497) [rt.jar:1.8.0_45]
>>>>> ??? at
>>>>>
>>>>> org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.ja
>>>>> va:1
>>>>> 37) [resteasy-jaxrs-3.0.10.Final.jar:]
>>>>> ??? at
>>>>>
>>>>> org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTarget(ResourceMe
>>>>> thod
>>>>> Invoker.java:296) [resteasy-jaxrs-3.0.10.Final.jar:]
>>>>> ??? at
>>>>>
>>>>> org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvo
>>>>> ker.
>>>>> java:250) [resteasy-jaxrs-3.0.10.Final.jar:]
>>>>> ??? at
>>>>>
>>>>> org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(Res
>>>>> ourc
>>>>> eLocatorInvoker.java:140) [resteasy-jaxrs-3.0.10.Final.jar:]
>>>>> ??? at
>>>>>
>>>>> org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorIn
>>>>> voke
>>>>> r.java:109) [resteasy-jaxrs-3.0.10.Final.jar:]
>>>>> ??? at
>>>>>
>>>>> org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(Res
>>>>> ourc
>>>>> eLocatorInvoker.java:135) [resteasy-jaxrs-3.0.10.Final.jar:]
>>>>> ??? at
>>>>>
>>>>> org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorIn
>>>>> voke
>>>>> r.java:103) [resteasy-jaxrs-3.0.10.Final.jar:]
>>>>> ??? at
>>>>>
>>>>> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatc
>>>>> her.
>>>>> java:356) [resteasy-jaxrs-3.0.10.Final.jar:]
>>>>> ??? ... 39 more
>>>>> Caused by: org.keycloak.broker.provider.IdentityBrokerException: No
>>>>> assertion from response.
>>>>> ??? at
>>>>>
>>>>> org.keycloak.broker.saml.SAMLEndpoint$Binding.getAssertion(SAMLEndpoint
>>>>> .jav
>>>>> a:309)
>>>>> ??? at
>>>>>
>>>>> org.keycloak.broker.saml.SAMLEndpoint$Binding.handleLoginResponse(SAMLE
>>>>> ndpo
>>>>> int.java:264)
>>>>> ??? ... 54 more
>>>>>
>>>>> Any idea?
>>>>>
>>>>> Henk
>>>>>
>>>>>
>>>>>
>>>>>
>>>>> On 30/04/15 14:31, "Bill Burke" <bburke at redhat.com> wrote:
>>>>>
>>>>>> You want to chain keycloak server to Salesforce?
>>>>>>
>>>>>> If you create a SAMLv2 IdentityProvider in keycloak that points to
>>>>>> Salesforce, you;ll see after you create it, an Export button.? Click
>>>>>> that.? That will create an entity descriptor with all the information
>>>>>> you need.
>>>>>>
>>>>>> On 4/30/2015 2:45 AM, Henk Laracker wrote:
>>>>>>> Hi,
>>>>>>>
>>>>>>> I like to use Salesforce as Identity Provider, the metadata
>>>>>>> provided by
>>>>>>> salesforce can be imported.
>>>>>>> But I need to specify the Service Provider in salesforce, I have to
>>>>>>> fill
>>>>>>> in a couple of fields, but two of them I don?t understand (and are
>>>>>>> mandatory). Does someone have any clue
>>>>>>>
>>>>>>>? ? ? 1. entity id , remark of salesforce : get this value from your
>>>>>>>? ? ? ? serviceprovider
>>>>>>>? ? ? 2. ACS URL, remark of slaesforce : The assertion consumer
>>>>>>> service. Get
>>>>>>>? ? ? ? this value from your service provider.
>>>>>>>
>>>>>>> I have tried a lot of values but every-time I click the saml button
>>>>>>> on
>>>>>>> my app, it redirects to salesforce but I get a page with the error :
>>>>>>> Error: Unable to resolve request into a Service Provider
>>>>>>>
>>>>>>> Henk
>>>>>>>
>>>>>>>
>>>>>>> _______________________________________________
>>>>>>> keycloak-user mailing list
>>>>>>> keycloak-user at lists.jboss.org
>>>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>>>>
>>>>>>
>>>>>> --
>>>>>> Bill Burke
>>>>>> JBoss, a division of Red Hat
>>>>>> http://bill.burkecentral.com


>>>>>> _______________________________________________
>>>>>> keycloak-user mailing list
>>>>>> keycloak-user at lists.jboss.org
>>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>>
>>>>
>>>
>>
>> -- 
>> Bill Burke
>> JBoss, a division of Red Hat
>> http://bill.burkecentral.com
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
> 

-- 
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com
_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user

  
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20150501/2db4a52b/attachment-0001.html