From pulkitsrivastavajd at gmail.com  Thu Nov  1 01:05:53 2018
From: pulkitsrivastavajd at gmail.com (Pulkit Srivastava)
Date: Thu, 1 Nov 2018 10:35:53 +0530
Subject: [keycloak-user] User Federation for Admin Users
In-Reply-To: <CAA-7KZ8YdoDgKjD++i9mdQXD6J2XexKVcPzhTrv4w2+HyA+oHA@mail.gmail.com>
References: <CAA-7KZ8YdoDgKjD++i9mdQXD6J2XexKVcPzhTrv4w2+HyA+oHA@mail.gmail.com>
Message-ID: <CAA-7KZ8bGh=dCuadWphFzrYSNQ0UODNC=-H0VY12NUgKzO_XTg@mail.gmail.com>

Any pointer on this.?

On Wed, Oct 24, 2018 at 10:28 AM Pulkit Srivastava <
pulkitsrivastavajd at gmail.com> wrote:

> Hi,
> Is it possible to use an external user federation for admin users in
> keycloak. These users should be able to login to keycloak admin.
>
> Thanks,
> Pulkit
>

From kkcmadhu at yahoo.com  Thu Nov  1 01:03:28 2018
From: kkcmadhu at yahoo.com (Madhu)
Date: Thu, 1 Nov 2018 05:03:28 +0000 (UTC)
Subject: [keycloak-user] keycloak not starting up and timing out on
 HHH000397: Using ASTQueryTranslatorFactory
In-Reply-To: <26978704.17718110.1540974608806@mail.yahoo.com>
References: <26978704.17718110.1540974608806.ref@mail.yahoo.com>
	<26978704.17718110.1540974608806@mail.yahoo.com>
Message-ID: <1349018991.18157268.1541048608516@mail.yahoo.com>

Any opinion from experts?

Sent from Yahoo Mail on Android 
 
  On Wed, 31 Oct 2018 at 2:00 PM, Madhu<kkcmadhu at yahoo.com> wrote:   Any idea whats going wrong here?
I have recently set up keycloak in HA and was able to bring up 2 nodes and things were working fine.
After a day or two , I stoped one node and was never to bring up keycloak back.
The start up of keycloak times out with here [org.hibernate.hql.internal.QueryTranslatorFactoryInitiator] (ServerService Thread Pool -- 57) HHH000397: Using ASTQueryTranslatorFactory

Steps tried :stopped the second node in cluster and tried bringing up both nodes again -> did not succeed (same error)tried bring up keycloak on standalone mode (not HA) -> did not succeed (same error)tried increasing the timeout to -Djboss.as.management.blocking.timeout=600? (same error)
I have about some 350 odd realms in my db (could that be the reason??)Will keycloak try to validate/migrate data etc on startup ?? I am asking this as i see these lines prior to the timeouts
08:17:25,264 INFO? [org.hibernate.Version] (ServerService Thread Pool -- 58) HHH000412: Hibernate Core {5.1.10.Final}08:17:25,266 INFO? [org.hibernate.cfg.Environment] (ServerService Thread Pool -- 58) HHH000206: hibernate.properties not found08:17:25,268 INFO? [org.hibernate.cfg.Environment] (ServerService Thread Pool -- 58) HHH000021: Bytecode provider name : javassist08:17:25,302 INFO? [org.hibernate.annotations.common.Version] (ServerService Thread Pool -- 58) HCANN000001: Hibernate Commons Annotations {5.0.1.Final}08:17:25,438 INFO? [org.hibernate.dialect.Dialect] (ServerService Thread Pool -- 58) HHH000400: Using dialect: org.hibernate.dialect.MySQL5Dialect08:17:25,485 INFO? [org.hibernate.envers.boot.internal.EnversServiceImpl] (ServerService Thread Pool -- 58) Envers integration enabled? : true08:17:26,026 INFO? [org.hibernate.validator.internal.util.Version] (ServerService Thread Pool -- 58) HV000001: Hibernate Validator 5.3.5.Final08:17:26,628 INFO? [org.hibernate.hql.internal.QueryTranslatorFactoryInitiator] (ServerService Thread Pool -- 58) HHH000397: Using ASTQueryTranslatorFactory

The actual exceptin is a 
Caused by: java.lang.RuntimeException: RESTEASY003325: Failed to construct public org.keycloak.services.resources.KeycloakApplication(javax.servlet.ServletContext,org.jboss.resteasy.core.Dispatcher)
with different cause each time (possibly based on what thread is doing at?


----------------------------Exception-----------------------------------------------------------------------------------------------------------------08:01:19,392 INFO? [org.hibernate.jpa.internal.util.LogHelper] (ServerService Thread Pool -- 57) HHH000204: Processing PersistenceUnitInfo [? ? ? ? name: keycloak-default? ? ? ? ...]08:01:19,440 INFO? [org.hibernate.Version] (ServerService Thread Pool -- 57) HHH000412: Hibernate Core {5.1.10.Final}08:01:19,442 INFO? [org.hibernate.cfg.Environment] (ServerService Thread Pool -- 57) HHH000206: hibernate.properties not found08:01:19,443 INFO? [org.hibernate.cfg.Environment] (ServerService Thread Pool -- 57) HHH000021: Bytecode provider name : javassist08:01:19,472 INFO? [org.hibernate.annotations.common.Version] (ServerService Thread Pool -- 57) HCANN000001: Hibernate Commons Annotations {5.0.1.Final}08:01:19,889 INFO? [org.hibernate.dialect.Dialect] (ServerService Thread Pool -- 57) HHH000400: Using dialect: org.hibernate.dialect.MySQL5Dialect08:01:19,936 INFO? [org.hibernate.envers.boot.internal.EnversServiceImpl] (ServerService Thread Pool -- 57) Envers integration enabled? : true08:01:20,425 INFO? [org.hibernate.validator.internal.util.Version] (ServerService Thread Pool -- 57) HV000001: Hibernate Validator 5.3.5.Final08:01:21,242 INFO? [org.hibernate.hql.internal.QueryTranslatorFactoryInitiator] (ServerService Thread Pool -- 57) HHH000397: Using ASTQueryTranslatorFactory08:06:16,695 WARN? [com.arjuna.ats.arjuna] (Transaction Reaper) ARJUNA012117: TransactionReaper::check timeout for TX 0:ffffac1f12aa:-1fdf5642:5bd9614a:e in state? RUN08:06:16,702 WARN? [org.hibernate.resource.transaction.backend.jta.internal.synchronization.SynchronizationCallbackCoordinatorTrackingImpl] (Transaction Reaper Worker 0) HHH000451: Transaction afterCompletion called by a background thread; delaying afterCompletion processing until the original thread can handle it. [status=4]08:06:16,703 WARN? [com.arjuna.ats.arjuna] (Transaction Reaper Worker 0) ARJUNA012121: TransactionReaper::doCancellations worker Thread[Transaction Reaper Worker 0,5,main] successfully canceled TX 0:ffffac1f12aa:-1fdf5642:5bd9614a:e08:06:22,093 WARN? [com.arjuna.ats.arjuna] (Transaction Reaper) ARJUNA012117: TransactionReaper::check timeout for TX 0:ffffac1f12aa:-1fdf5642:5bd9614a:19 in state? RUN08:06:22,094 WARN? [com.arjuna.ats.arjuna] (Transaction Reaper Worker 0) ARJUNA012095: Abort of action id 0:ffffac1f12aa:-1fdf5642:5bd9614a:19 invoked while multiple threads active within it.08:06:22,095 WARN? [com.arjuna.ats.arjuna] (Transaction Reaper Worker 0) ARJUNA012381: Action id 0:ffffac1f12aa:-1fdf5642:5bd9614a:19 completed with multiple threads - thread ServerService Thread Pool -- 57 was in progress with java.net.SocketInputStream.socketRead0(Native Method)java.net.SocketInputStream.socketRead(SocketInputStream.java:116)java.net.SocketInputStream.read(SocketInputStream.java:171)java.net.SocketInputStream.read(SocketInputStream.java:141)com.mysql.cj.protocol.ReadAheadInputStream.fill(ReadAheadInputStream.java:107)com.mysql.cj.protocol.ReadAheadInputStream.readFromUnderlyingStreamIfNecessary(ReadAheadInputStream.java:150)com.mysql.cj.protocol.ReadAheadInputStream.read(ReadAheadInputStream.java:180)java.io.FilterInputStream.read(FilterInputStream.java:133)com.mysql.cj.protocol.FullReadInputStream.readFully(FullReadInputStream.java:64)com.mysql.cj.protocol.a.SimplePacketReader.readHeader(SimplePacketReader.java:63)com.mysql.cj.protocol.a.SimplePacketReader.readHeader(SimplePacketReader.java:45)com.mysql.cj.protocol.a.TimeTrackingPacketReader.readHeader(TimeTrackingPacketReader.java:52)com.mysql.cj.protocol.a.TimeTrackingPacketReader.readHeader(TimeTrackingPacketReader.java:41)com.mysql.cj.protocol.a.MultiPacketReader.readHeader(MultiPacketReader.java:54)com.mysql.cj.protocol.a.MultiPacketReader.readHeader(MultiPacketReader.java:44)com.mysql.cj.protocol.a.NativeProtocol.readMessage(NativeProtocol.java:557)com.mysql.cj.protocol.a.NativeProtocol.checkErrorMessage(NativeProtocol.java:735)com.mysql.cj.protocol.a.NativeProtocol.sendCommand(NativeProtocol.java:674)com.mysql.cj.protocol.a.NativeProtocol.sendQueryPacket(NativeProtocol.java:966)com.mysql.cj.NativeSession.execSQL(NativeSession.java:1165)com.mysql.cj.jdbc.ClientPreparedStatement.executeInternal(ClientPreparedStatement.java:937)com.mysql.cj.jdbc.ClientPreparedStatement.executeQuery(ClientPreparedStatement.java:1019)org.jboss.jca.adapters.jdbc.WrappedPreparedStatement.executeQuery(WrappedPreparedStatement.java:504)org.hibernate.engine.jdbc.internal.ResultSetReturnImpl.extract(ResultSetReturnImpl.java:70)org.hibernate.loader.plan.exec.internal.AbstractLoadPlanBasedLoader.getResultSet(AbstractLoadPlanBasedLoader.java:434)org.hibernate.loader.plan.exec.internal.AbstractLoadPlanBasedLoader.executeQueryStatement(AbstractLoadPlanBasedLoader.java:186)org.hibernate.loader.plan.exec.internal.AbstractLoadPlanBasedLoader.executeLoad(AbstractLoadPlanBasedLoader.java:121)org.hibernate.loader.plan.exec.internal.AbstractLoadPlanBasedLoader.executeLoad(AbstractLoadPlanBasedLoader.java:86)org.hibernate.loader.collection.plan.AbstractLoadPlanBasedCollectionInitializer.initialize(AbstractLoadPlanBasedCollectionInitializer.java:88)org.hibernate.persister.collection.AbstractCollectionPersister.initialize(AbstractCollectionPersister.java:688)org.hibernate.event.internal.DefaultInitializeCollectionEventListener.onInitializeCollection(DefaultInitializeCollectionEventListener.java:75)org.hibernate.internal.SessionImpl.initializeCollection(SessionImpl.java:2004)org.hibernate.collection.internal.AbstractPersistentCollection$4.doWork(AbstractPersistentCollection.java:567)org.hibernate.collection.internal.AbstractPersistentCollection.withTemporarySessionIfNeeded(AbstractPersistentCollection.java:249)org.hibernate.collection.internal.AbstractPersistentCollection.initialize(AbstractPersistentCollection.java:563)org.hibernate.collection.internal.AbstractPersistentCollection.read(AbstractPersistentCollection.java:132)org.hibernate.collection.internal.AbstractPersistentCollection$1.doWork(AbstractPersistentCollection.java:161)org.hibernate.collection.internal.AbstractPersistentCollection$1.doWork(AbstractPersistentCollection.java:146)org.hibernate.collection.internal.AbstractPersistentCollection.withTemporarySessionIfNeeded(AbstractPersistentCollection.java:249)org.hibernate.collection.internal.AbstractPersistentCollection.readSize(AbstractPersistentCollection.java:145)org.hibernate.collection.internal.PersistentMap.size(PersistentMap.java:123)java.util.HashMap.putMapEntries(HashMap.java:501)java.util.HashMap.putAll(HashMap.java:785)org.keycloak.models.jpa.ClientScopeAdapter.getAttributes(ClientScopeAdapter.java:309)org.keycloak.models.cache.infinispan.entities.CachedClientScope.<init>(CachedClientScope.java:56)org.keycloak.models.cache.infinispan.RealmCacheSession.getClientScopeById(RealmCacheSession.java:1147)org.keycloak.models.jpa.RealmAdapter.getClientScopes(RealmAdapter.java:1779)org.keycloak.models.cache.infinispan.entities.CachedRealm.cacheClientScopes(CachedRealm.java:285)org.keycloak.models.cache.infinispan.entities.CachedRealm.<init>(CachedRealm.java:232)org.keycloak.models.cache.infinispan.RealmCacheSession.getRealm(RealmCacheSession.java:399)org.keycloak.models.jpa.JpaRealmProvider.getRealms(JpaRealmProvider.java:102)org.keycloak.models.cache.infinispan.RealmCacheSession.getRealms(RealmCacheSession.java:459)org.keycloak.services.managers.ApplianceBootstrap.isNewInstall(ApplianceBootstrap.java:46)org.keycloak.services.resources.KeycloakApplication.migrateAndBootstrap(KeycloakApplication.java:211)org.keycloak.services.resources.KeycloakApplication$1.run(KeycloakApplication.java:145)org.keycloak.models.utils.KeycloakModelUtils.runJobInTransaction(KeycloakModelUtils.java:227)org.keycloak.services.resources.KeycloakApplication.<init>(KeycloakApplication.java:136)sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)java.lang.reflect.Constructor.newInstance(Constructor.java:423)org.jboss.resteasy.core.ConstructorInjectorImpl.construct(ConstructorInjectorImpl.java:150)org.jboss.resteasy.spi.ResteasyProviderFactory.createProviderInstance(ResteasyProviderFactory.java:2298)org.jboss.resteasy.spi.ResteasyDeployment.createApplication(ResteasyDeployment.java:340)org.jboss.resteasy.spi.ResteasyDeployment.start(ResteasyDeployment.java:253)org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.init(ServletContainerDispatcher.java:120)org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.init(HttpServletDispatcher.java:36)io.undertow.servlet.core.LifecyleInterceptorInvocation.proceed(LifecyleInterceptorInvocation.java:117)org.wildfly.extension.undertow.security.RunAsLifecycleInterceptor.init(RunAsLifecycleInterceptor.java:78)io.undertow.servlet.core.LifecyleInterceptorInvocation.proceed(LifecyleInterceptorInvocation.java:103)io.undertow.servlet.core.ManagedServlet$DefaultInstanceStrategy.start(ManagedServlet.java:250)io.undertow.servlet.core.ManagedServlet.createServlet(ManagedServlet.java:133)io.undertow.servlet.core.DeploymentManagerImpl$2.call(DeploymentManagerImpl.java:565)io.undertow.servlet.core.DeploymentManagerImpl$2.call(DeploymentManagerImpl.java:536)io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:42)io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43)org.wildfly.extension.undertow.security.SecurityContextThreadSetupAction.lambda$create$0(SecurityContextThreadSetupAction.java:105)org.wildfly.extension.undertow.security.SecurityContextThreadSetupAction$$Lambda$807/210507936.call(Unknown Source)org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1508)org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction$$Lambda$808/1397988528.call(Unknown Source)org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1508)org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction$$Lambda$808/1397988528.call(Unknown Source)org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1508)org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction$$Lambda$808/1397988528.call(Unknown Source)org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1508)org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction$$Lambda$808/1397988528.call(Unknown Source)io.undertow.servlet.core.DeploymentManagerImpl.start(DeploymentManagerImpl.java:578)org.wildfly.extension.undertow.deployment.UndertowDeploymentService.startContext(UndertowDeploymentService.java:100)org.wildfly.extension.undertow.deployment.UndertowDeploymentService$1.run(UndertowDeploymentService.java:81)java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)java.util.concurrent.FutureTask.run(FutureTask.java:266)java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)java.lang.Thread.run(Thread.java:748)org.jboss.threads.JBossThread.run(JBossThread.java:320)
08:06:22,096 WARN? [com.arjuna.ats.arjuna] (Transaction Reaper Worker 0) ARJUNA012108: CheckedAction::check - atomic action 0:ffffac1f12aa:-1fdf5642:5bd9614a:19 aborting with 1 threads active!08:06:22,098 WARN? [org.hibernate.resource.transaction.backend.jta.internal.synchronization.SynchronizationCallbackCoordinatorTrackingImpl] (Transaction Reaper Worker 0) HHH000451: Transaction afterCompletion called by a background thread; delaying afterCompletion processing until the original thread can handle it. [status=4]08:06:22,099 WARN? [com.arjuna.ats.arjuna] (Transaction Reaper Worker 0) ARJUNA012121: TransactionReaper::doCancellations worker Thread[Transaction Reaper Worker 0,5,main] successfully canceled TX 0:ffffac1f12aa:-1fdf5642:5bd9614a:1908:06:22,101 WARN? [org.hibernate.engine.jdbc.spi.SqlExceptionHelper] (ServerService Thread Pool -- 57) SQL Error: 0, SQLState: null08:06:22,101 ERROR [org.hibernate.engine.jdbc.spi.SqlExceptionHelper] (ServerService Thread Pool -- 57) IJ031070: Transaction cannot proceed: STATUS_ROLLEDBACK08:06:22,103 WARN? [com.arjuna.ats.arjuna] (ServerService Thread Pool -- 57) ARJUNA012077: Abort called on already aborted atomic action 0:ffffac1f12aa:-1fdf5642:5bd9614a:1908:06:22,129 WARN? [com.arjuna.ats.arjuna] (ServerService Thread Pool -- 57) ARJUNA012077: Abort called on already aborted atomic action 0:ffffac1f12aa:-1fdf5642:5bd9614a:e08:06:22,135 ERROR [org.jboss.msc.service.fail] (ServerService Thread Pool -- 57) MSC000001: Failed to start service jboss.undertow.deployment.default-server.default-host./auth: org.jboss.msc.service.StartException in service jboss.undertow.deployment.default-server.default-host./auth: java.lang.RuntimeException: RESTEASY003325: Failed to construct public org.keycloak.services.resources.KeycloakApplication(javax.servlet.ServletContext,org.jboss.resteasy.core.Dispatcher)? ? ? ? at org.wildfly.extension.undertow.deployment.UndertowDeploymentService$1.run(UndertowDeploymentService.java:84)? ? ? ? at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)? ? ? ? at java.util.concurrent.FutureTask.run(FutureTask.java:266)? ? ? ? at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)? ? ? ? at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)? ? ? ? at java.lang.Thread.run(Thread.java:748)? ? ? ? at org.jboss.threads.JBossThread.run(JBossThread.java:320)Caused by: java.lang.RuntimeException: RESTEASY003325: Failed to construct public org.keycloak.services.resources.KeycloakApplication(javax.servlet.ServletContext,org.jboss.resteasy.core.Dispatcher)? ? ? ? at org.jboss.resteasy.core.ConstructorInjectorImpl.construct(ConstructorInjectorImpl.java:162)? ? ? ? at org.jboss.resteasy.spi.ResteasyProviderFactory.createProviderInstance(ResteasyProviderFactory.java:2298)? ? ? ? at org.jboss.resteasy.spi.ResteasyDeployment.createApplication(ResteasyDeployment.java:340)? ? ? ? at org.jboss.resteasy.spi.ResteasyDeployment.start(ResteasyDeployment.java:253)? ? ? ? at org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.init(ServletContainerDispatcher.java:120)? ? ? ? at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.init(HttpServletDispatcher.java:36)? ? ? ? at io.undertow.servlet.core.LifecyleInterceptorInvocation.proceed(LifecyleInterceptorInvocation.java:117)? ? ? ? at org.wildfly.extension.undertow.security.RunAsLifecycleInterceptor.init(RunAsLifecycleInterceptor.java:78)? ? ? ? at io.undertow.servlet.core.LifecyleInterceptorInvocation.proceed(LifecyleInterceptorInvocation.java:103)? ? ? ? at io.undertow.servlet.core.ManagedServlet$DefaultInstanceStrategy.start(ManagedServlet.java:250)? ? ? ? at io.undertow.servlet.core.ManagedServlet.createServlet(ManagedServlet.java:133)? ? ? ? at io.undertow.servlet.core.DeploymentManagerImpl$2.call(DeploymentManagerImpl.java:565)? ? ? ? at io.undertow.servlet.core.DeploymentManagerImpl$2.call(DeploymentManagerImpl.java:536)? ? ? ? at io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:42)? ? ? ? at io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43)? ? ? ? at org.wildfly.extension.undertow.security.SecurityContextThreadSetupAction.lambda$create$0(SecurityContextThreadSetupAction.java:105)? ? ? ? at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1508)? ? ? ? at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1508)? ? ? ? at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1508)? ? ? ? at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1508)? ? ? ? at io.undertow.servlet.core.DeploymentManagerImpl.start(DeploymentManagerImpl.java:578)? ? ? ? at org.wildfly.extension.undertow.deployment.UndertowDeploymentService.startContext(UndertowDeploymentService.java:100)? ? ? ? at org.wildfly.extension.undertow.deployment.UndertowDeploymentService$1.run(UndertowDeploymentService.java:81)? ? ? ? ... 6 moreCaused by: org.hibernate.exception.GenericJDBCException: could not prepare statement? ? ? ? at org.hibernate.exception.internal.StandardSQLExceptionConverter.convert(StandardSQLExceptionConverter.java:47)? ? ? ? at org.hibernate.engine.jdbc.spi.SqlExceptionHelper.convert(SqlExceptionHelper.java:111)? ? ? ? at org.hibernate.engine.jdbc.internal.StatementPreparerImpl$StatementPreparationTemplate.prepareStatement(StatementPreparerImpl.java:182)? ? ? ? at org.hibernate.engine.jdbc.internal.StatementPreparerImpl.prepareQueryStatement(StatementPreparerImpl.java:148)? ? ? ? at org.hibernate.loader.plan.exec.internal.AbstractLoadPlanBasedLoader.prepareQueryStatement(AbstractLoadPlanBasedLoader.java:241)? ? ? ? at org.hibernate.loader.plan.exec.internal.AbstractLoadPlanBasedLoader.executeQueryStatement(AbstractLoadPlanBasedLoader.java:185)? ? ? ? at org.hibernate.loader.plan.exec.internal.AbstractLoadPlanBasedLoader.executeLoad(AbstractLoadPlanBasedLoader.java:121)? ? ? ? at org.hibernate.loader.plan.exec.internal.AbstractLoadPlanBasedLoader.executeLoad(AbstractLoadPlanBasedLoader.java:86)? ? ? ? at org.hibernate.loader.collection.plan.AbstractLoadPlanBasedCollectionInitializer.initialize(AbstractLoadPlanBasedCollectionInitializer.java:88)? ? ? ? at org.hibernate.persister.collection.AbstractCollectionPersister.initialize(AbstractCollectionPersister.java:688)? ? ? ? at org.hibernate.event.internal.DefaultInitializeCollectionEventListener.onInitializeCollection(DefaultInitializeCollectionEventListener.java:75)? ? ? ? at org.hibernate.internal.SessionImpl.initializeCollection(SessionImpl.java:2004)? ? ? ? at org.hibernate.collection.internal.AbstractPersistentCollection$4.doWork(AbstractPersistentCollection.java:567)? ? ? ? at org.hibernate.collection.internal.AbstractPersistentCollection.withTemporarySessionIfNeeded(AbstractPersistentCollection.java:249)? ? ? ? at org.hibernate.collection.internal.AbstractPersistentCollection.initialize(AbstractPersistentCollection.java:563)? ? ? ? at org.hibernate.collection.internal.AbstractPersistentCollection.read(AbstractPersistentCollection.java:132)? ? ? ? at org.hibernate.collection.internal.PersistentBag.iterator(PersistentBag.java:277)? ? ? ? at org.keycloak.models.jpa.ClientScopeAdapter.getProtocolMappers(ClientScopeAdapter.java:104)? ? ? ? at org.keycloak.models.cache.infinispan.entities.CachedClientScope.<init>(CachedClientScope.java:50)? ? ? ? at org.keycloak.models.cache.infinispan.RealmCacheSession.getClientScopeById(RealmCacheSession.java:1147)? ? ? ? at org.keycloak.models.jpa.RealmAdapter.getClientScopes(RealmAdapter.java:1779)? ? ? ? at org.keycloak.models.cache.infinispan.entities.CachedRealm.cacheClientScopes(CachedRealm.java:285)? ? ? ? at org.keycloak.models.cache.infinispan.entities.CachedRealm.<init>(CachedRealm.java:232)? ? ? ? at org.keycloak.models.cache.infinispan.RealmCacheSession.getRealm(RealmCacheSession.java:399)? ? ? ? at org.keycloak.models.jpa.JpaRealmProvider.getRealms(JpaRealmProvider.java:102)? ? ? ? at org.keycloak.models.cache.infinispan.RealmCacheSession.getRealms(RealmCacheSession.java:459)? ? ? ? at org.keycloak.services.managers.ApplianceBootstrap.isNewInstall(ApplianceBootstrap.java:46)? ? ? ? at org.keycloak.services.resources.KeycloakApplication.migrateAndBootstrap(KeycloakApplication.java:211)? ? ? ? at org.keycloak.services.resources.KeycloakApplication$1.run(KeycloakApplication.java:145)? ? ? ? at org.keycloak.models.utils.KeycloakModelUtils.runJobInTransaction(KeycloakModelUtils.java:227)? ? ? ? at org.keycloak.services.resources.KeycloakApplication.<init>(KeycloakApplication.java:136)? ? ? ? at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)? ? ? ? at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)? ? ? ? at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)? ? ? ? at java.lang.reflect.Constructor.newInstance(Constructor.java:423)? ? ? ? at org.jboss.resteasy.core.ConstructorInjectorImpl.construct(ConstructorInjectorImpl.java:150)? ? ? ? ... 28 moreCaused by: java.sql.SQLException: IJ031070: Transaction cannot proceed: STATUS_ROLLEDBACK? ? ? ? at org.jboss.jca.adapters.jdbc.WrapperDataSource.checkTransactionActive(WrapperDataSource.java:245)? ? ? ? at org.jboss.jca.adapters.jdbc.WrappedConnection.checkTransactionActive(WrappedConnection.java:1928)? ? ? ? at org.jboss.jca.adapters.jdbc.WrappedConnection.checkStatus(WrappedConnection.java:1943)? ? ? ? at org.jboss.jca.adapters.jdbc.WrappedConnection.checkTransaction(WrappedConnection.java:1917)? ? ? ? at org.jboss.jca.adapters.jdbc.WrappedConnection.prepareStatement(WrappedConnection.java:447)? ? ? ? at org.hibernate.engine.jdbc.internal.StatementPreparerImpl$5.doPrepare(StatementPreparerImpl.java:146)? ? ? ? at org.hibernate.engine.jdbc.internal.StatementPreparerImpl$StatementPreparationTemplate.prepareStatement(StatementPreparerImpl.java:172)? ? ? ? ... 61 more
08:06:22,168 INFO? [org.jboss.as.server] (Thread-2) WFLYSRV0220: Server shutdown has been requested via an OS signal08:06:22,196 ERROR [org.jboss.as.controller.management-operation] (Controller Boot Thread) WFLYCTL0013: Operation ("add") failed - address: ([("deployment" => "keycloak-server.war")]) - failure description: {"WFLYCTL0080: Failed services" => {"jboss.undertow.deployment.default-server.default-host./auth" => "java.lang.RuntimeException: RESTEASY003325: Failed to construct public org.keycloak.services.resources.KeycloakApplication(javax.servlet.ServletContext,org.jboss.resteasy.core.Dispatcher)? ? Caused by: java.lang.RuntimeException: RESTEASY003325: Failed to construct public org.keycloak.services.resources.KeycloakApplication(javax.servlet.ServletContext,org.jboss.resteasy.core.Dispatcher)? ? Caused by: org.hibernate.exception.GenericJDBCException: could not prepare statement? ? Caused by: java.sql.SQLException: IJ031070: Transaction cannot proceed: STATUS_ROLLEDBACK"}}08:06:22,218 INFO? [org.jboss.as.connector.subsystems.datasources] (MSC service thread 1-2) WFLYJCA0010: Unbound data source [java:/jboss/datasources/KeycloakDS]
  

From yann.chen at gaiaworks.cn  Thu Nov  1 01:27:22 2018
From: yann.chen at gaiaworks.cn (Yann Chen)
Date: Thu, 1 Nov 2018 13:27:22 +0800
Subject: [keycloak-user] Keycloak get access token performance test
	encounter out of memory
Message-ID: <001201d471a3$917726e0$b46574a0$@gaiaworks.cn>+562B14D13D7C5FDF

Hello,

 

Below is my keycloak start parameters(domain):



 

I use jmeter to do the performance test by invoke the get accesstoken .

Concurrence 300 per second.

 

1st time I can see the QPS is around 1200 , but a few seconds later , it QPS
is down to 600.

 

Then I stop the test , and start the 2nd round test.

 

I found the QPS is only 400 , and also the value is always going down.

 

At last I saw the log out of memory error like below:

 



 

Is there any solution on this ?

 

Thanks & Best Regards

 

Yann Chen

 

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: image/png
Size: 22836 bytes
Desc: not available
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20181101/d33b87cd/attachment-0002.png 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: image/png
Size: 14766 bytes
Desc: not available
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20181101/d33b87cd/attachment-0003.png 

From csekar at redhat.com  Thu Nov  1 01:35:13 2018
From: csekar at redhat.com (K Chandra Sekar)
Date: Thu, 1 Nov 2018 11:05:13 +0530
Subject: [keycloak-user] Integration keycloak with application UI
Message-ID: <CAP1WPpQF0R9nPSyNAg1D20PBn0L-C1J6c9RYx=ghkf3hzTQwwg@mail.gmail.com>

Hey,

I want to integrate application with Keycloak IAM system.I am trying to use
KeyCloak to protect my application using OpenID connect.But I want to use
application's login UI and don't want to direct user to keycloak login UI
page to authenticate.Keycloak has Spring boot adapter which does the job it
still it directs to the keycloak UI for login.I searched for any api to use
from my app UI but i am nit getting anything and i am struck here.Kindly
suggest me a a workaround or solution so that i can move
forward.Anticipating a positive reply.

Thanks and regards,
K.Chandra Sekar

From bojan.milosavljevic95 at gmail.com  Thu Nov  1 05:27:58 2018
From: bojan.milosavljevic95 at gmail.com (=?UTF-8?Q?Bojan_Milosavljevi=C4=87?=)
Date: Thu, 1 Nov 2018 10:27:58 +0100
Subject: [keycloak-user] PKCE and Keycloak
In-Reply-To: <BL0PR07MB500962817B2F48AA74B9D2C1DACD0@BL0PR07MB5009.namprd07.prod.outlook.com>
References: <CAD2jAwNGLnZ33goi5Udoet2U-tsMNRHawA5-_ghZ3GJoJvAXKQ@mail.gmail.com>
	<BL0PR07MB500962817B2F48AA74B9D2C1DACD0@BL0PR07MB5009.namprd07.prod.outlook.com>
Message-ID: <CAD2jAwMY7VZKF1DYZdTVTpq-ssB3iZ_PXRjMWXA5fburWVw9NA@mail.gmail.com>

Great, thanks! This is fantastic! Thank you very much!
Wish you all the best,
Bojan

On Wed, Oct 31, 2018 at 6:48 PM Nalyvayko, Peter <pnalyvayko at agi.com> wrote:

> Hi Bojan,
> We've been using PKCE so yes, PKCE support is enabled by default
>
> -----Original Message-----
> From: keycloak-user-bounces at lists.jboss.org <
> keycloak-user-bounces at lists.jboss.org> On Behalf Of Bojan Milosavljevic
> Sent: Wednesday, October 31, 2018 5:59 AM
> To: keycloak-user at lists.jboss.org
> Subject: [keycloak-user] PKCE and Keycloak
>
> Hello,
> Is PKCE (if my adapter supports PKCE of course) automatically supported by
> default by Keycloak or do I have to implement it myself?
> Thank you.
> Kind regards,
> Bojan Milosavljevic.
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

From kuba at ufiseru.cz  Thu Nov  1 06:30:12 2018
From: kuba at ufiseru.cz (=?utf-8?B?SmFrdWIgRmnFoWVy?=)
Date: Thu, 01 Nov 2018 10:30:12 +0000
Subject: [keycloak-user] allow only specific group of users to be
 authenticated for a specific client
Message-ID: <41a4364a74f0cf493d24b21d7f9a116f@ufiseru.cz>

Hi,

I'm struggling with understanding of how authorization and permissions work in Keycloak.

Very simply put: in a single realm I have a number of Clients (also called Applications in the
Keycloak's user-facing account console). All Clients use OICD. I also have a number of Users. 

Clients are "dumb", i.e. they only consume the identity from Keycloak and have no authorization
mechanisms available. I want to have control over which subset of users can "use" specific Clients.
I want to authorize Users to use specific Clients (or authorize Clients to authenticate only
specific users) and I want all of this to be performed by Keycloak alone.

Example:

current state: two users ("uA" and "uB"), one Client ("cX"). Both users can see cX in their
respective application lists on their Keycloak account consoles (and the column "Granted
permissions" states "Full access") and both can authenticate (i.e. login) to the Client. Client
happily accepts both logins as it has no own authorization mechanism.

desired state: only user uA can login to cX, user uB cannot login to cX and does not see cX in his
application list, or at least does not have "Full access" in "Granted permissions". If user uB
tries to login to cX, the login fails somehow (graceful refusal would be nice but I'd be happy with
anything at the moment).

The best would be if I could control this through user groups, i.e. only users in group "gX" can
login to Client "cX".

I've been playing with roles, scopes, permissions, custom authentication scripts and I even tried
to superficially reverse engineer the difference between an admin user and a regular user, which is
the only case where I can see a difference in the Application list (i.e a regular user does not see
and cannot login to the "Security Admin Console" application) but have failed to achieve the
desired state or even approach it.

I know I'm probably thinking about this all wrong so I'd be happy even for a slight push into the
right direction.

thanks,

-jakub.

--
Jakub Fi?er
Linux | DevOps | Security


From henning.waack at codecentric.de  Thu Nov  1 07:00:10 2018
From: henning.waack at codecentric.de (Henning Waack)
Date: Thu, 1 Nov 2018 12:00:10 +0100
Subject: [keycloak-user] How to increase logging
In-Reply-To: <CAAeemDRe+OGQ_05SJwE8HqUAJMX0WRZDFoPieVG=s20PGmocuQ@mail.gmail.com>
References: <CAAeemDRe+OGQ_05SJwE8HqUAJMX0WRZDFoPieVG=s20PGmocuQ@mail.gmail.com>
Message-ID: <CAGqTYaw6s37WWcYsJb=HjC+jjs_mj4G7Ec_jGRbLDwhYi82cVA@mail.gmail.com>

Are you trying to increase Logging for Keycloak running on Wildfly? Or for
your application protected by some Keycloak Java Adapter?

Am Mi., 31. Okt. 2018 um 22:43 Uhr schrieb Saranya Mahalingam <
smahalingam at anaconda.com>:

> Hello,
>
> Authentication component is not coming up. I don't see any errors in logs.
> So thought of improving the logs using JAVA_OPTS like:
>
> name: JAVA_OPTS
> value:  -Dkeycloak.logging.level=debug
>
> But I don't see any changes in the logs even after setting the above value.
> Tried few other options too without success. Do you have any suggestions
> here? Let me know if you need any other information.
>
> Thanks,
> Saranya
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>


-- 

Henning Waack | IT Consultant


codecentric AG | Hochstra?e 11
<https://maps.google.com/?q=Hochstra%C3%9Fe+11%C2%A0+%7C+%C2%A0+42697+Solingen+%C2%A0%7CDeutschland&entry=gmail&source=g>
|
<https://maps.google.com/?q=Hochstra%C3%9Fe+11%C2%A0+%7C+%C2%A0+42697+Solingen+%C2%A0%7CDeutschland&entry=gmail&source=g>

<https://maps.google.com/?q=Hochstra%C3%9Fe+11%C2%A0+%7C+%C2%A0+42697+Solingen+%C2%A0%7CDeutschland&entry=gmail&source=g>42697
Solingen
<https://maps.google.com/?q=Hochstra%C3%9Fe+11%C2%A0+%7C+%C2%A0+42697+Solingen+%C2%A0%7CDeutschland&entry=gmail&source=g>
 |Deutschland
<https://maps.google.com/?q=Hochstra%C3%9Fe+11%C2%A0+%7C+%C2%A0+42697+Solingen+%C2%A0%7CDeutschland&entry=gmail&source=g>


tel: +49 (0)151 108 515 29

www.codecentric.de | blog.codecentric.de | www.meettheexperts.de

Sitz der Gesellschaft: Solingen | HRB 25917 | Amtsgericht Wuppertal

Vorstand: Michael Hochg?rtel . Ulrich K?hn . Rainer Vehns
Aufsichtsrat: Patric Fedlmeier (Vorsitzender) . Klaus J?ger . J?rgen Sch?tz

Diese E-Mail einschlie?lich evtl. beigef?gter Dateien enth?lt vertrauliche
und/oder rechtlich gesch?tzte Informationen. Wenn Sie nicht der richtige
Adressat sind oder diese E-Mail irrt?mlich erhalten haben, informieren Sie
bitte sofort den Absender und l?schen Sie diese E-Mail und evtl.
beigef?gter Dateien umgehend. Das unerlaubte Kopieren, Nutzen oder ?ffnen
evtl. beigef?gter Dateien sowie die unbefugte Weitergabe dieser E-Mail ist
nicht gestattet.

From henning.waack at codecentric.de  Thu Nov  1 07:26:34 2018
From: henning.waack at codecentric.de (Henning Waack)
Date: Thu, 1 Nov 2018 12:26:34 +0100
Subject: [keycloak-user] Integration keycloak with application UI
In-Reply-To: <CAP1WPpQF0R9nPSyNAg1D20PBn0L-C1J6c9RYx=ghkf3hzTQwwg@mail.gmail.com>
References: <CAP1WPpQF0R9nPSyNAg1D20PBn0L-C1J6c9RYx=ghkf3hzTQwwg@mail.gmail.com>
Message-ID: <CAGqTYaxBJpTB-QGjACPxXhCW3nrz5Ssgozc2jaRbQMbR6hAO+w@mail.gmail.com>

Hi Chandra.

It is not recommended to not use the KC login pages. OIDC is build on
browser redirects (for browser applications). So you should just theme your
KC pages so that it fits with your CD and leave things as they are. See
https://lists.jboss.org/pipermail/keycloak-user/2016-December/008873.html
for example.

Greetings

Henning

Am Do., 1. Nov. 2018 um 06:37 Uhr schrieb K Chandra Sekar <csekar at redhat.com
>:

> Hey,
>
> I want to integrate application with Keycloak IAM system.I am trying to use
> KeyCloak to protect my application using OpenID connect.But I want to use
> application's login UI and don't want to direct user to keycloak login UI
> page to authenticate.Keycloak has Spring boot adapter which does the job it
> still it directs to the keycloak UI for login.I searched for any api to use
> from my app UI but i am nit getting anything and i am struck here.Kindly
> suggest me a a workaround or solution so that i can move
> forward.Anticipating a positive reply.
>
> Thanks and regards,
> K.Chandra Sekar
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>


-- 

Henning Waack | IT Consultant


codecentric AG | Hochstra?e 11
<https://maps.google.com/?q=Hochstra%C3%9Fe+11%C2%A0+%7C+%C2%A0+42697+Solingen+%C2%A0%7CDeutschland&entry=gmail&source=g>
|
<https://maps.google.com/?q=Hochstra%C3%9Fe+11%C2%A0+%7C+%C2%A0+42697+Solingen+%C2%A0%7CDeutschland&entry=gmail&source=g>

<https://maps.google.com/?q=Hochstra%C3%9Fe+11%C2%A0+%7C+%C2%A0+42697+Solingen+%C2%A0%7CDeutschland&entry=gmail&source=g>42697
Solingen
<https://maps.google.com/?q=Hochstra%C3%9Fe+11%C2%A0+%7C+%C2%A0+42697+Solingen+%C2%A0%7CDeutschland&entry=gmail&source=g>
 |Deutschland
<https://maps.google.com/?q=Hochstra%C3%9Fe+11%C2%A0+%7C+%C2%A0+42697+Solingen+%C2%A0%7CDeutschland&entry=gmail&source=g>


tel: +49 (0)151 108 515 29

www.codecentric.de | blog.codecentric.de | www.meettheexperts.de

Sitz der Gesellschaft: Solingen | HRB 25917 | Amtsgericht Wuppertal

Vorstand: Michael Hochg?rtel . Ulrich K?hn . Rainer Vehns
Aufsichtsrat: Patric Fedlmeier (Vorsitzender) . Klaus J?ger . J?rgen Sch?tz

Diese E-Mail einschlie?lich evtl. beigef?gter Dateien enth?lt vertrauliche
und/oder rechtlich gesch?tzte Informationen. Wenn Sie nicht der richtige
Adressat sind oder diese E-Mail irrt?mlich erhalten haben, informieren Sie
bitte sofort den Absender und l?schen Sie diese E-Mail und evtl.
beigef?gter Dateien umgehend. Das unerlaubte Kopieren, Nutzen oder ?ffnen
evtl. beigef?gter Dateien sowie die unbefugte Weitergabe dieser E-Mail ist
nicht gestattet.

From psilva at redhat.com  Thu Nov  1 08:30:16 2018
From: psilva at redhat.com (Pedro Igor Silva)
Date: Thu, 1 Nov 2018 09:30:16 -0300
Subject: [keycloak-user] Keycloak get access token performance test
 encounter out of memory
In-Reply-To: <5bda8f41.1c69fb81.d93e1.d8eeSMTPIN_ADDED_BROKEN@mx.google.com>
References: <5bda8f41.1c69fb81.d93e1.d8eeSMTPIN_ADDED_BROKEN@mx.google.com>
Message-ID: <CAJrcDBdfOKCEe5DcQOiqvwdnrThQAH_2vYNdzzJD32-iHyNNvw@mail.gmail.com>

Hi,

Ideally, you should configure your JVM accordingly with the load you are
expecting/testing. I would suggest you to try/compare different results
with different settings before reporting any performance issue. If running
in a docker container, check your JVM ergonomics configuration.

Regards.
Pedro Igor

On Thu, Nov 1, 2018 at 2:29 AM Yann Chen <yann.chen at gaiaworks.cn> wrote:

> Hello,
>
>
>
> Below is my keycloak start parameters(domain):
>
>
>
>
>
> I use jmeter to do the performance test by invoke the get accesstoken .
>
> Concurrence 300 per second.
>
>
>
> 1st time I can see the QPS is around 1200 , but a few seconds later , it
> QPS
> is down to 600.
>
>
>
> Then I stop the test , and start the 2nd round test.
>
>
>
> I found the QPS is only 400 , and also the value is always going down.
>
>
>
> At last I saw the log out of memory error like below:
>
>
>
>
>
>
>
> Is there any solution on this ?
>
>
>
> Thanks & Best Regards
>
>
>
> Yann Chen
>
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From smahalingam at anaconda.com  Thu Nov  1 09:31:27 2018
From: smahalingam at anaconda.com (Saranya Mahalingam)
Date: Thu, 1 Nov 2018 08:31:27 -0500
Subject: [keycloak-user] How to increase logging
In-Reply-To: <CAGqTYaw6s37WWcYsJb=HjC+jjs_mj4G7Ec_jGRbLDwhYi82cVA@mail.gmail.com>
References: <CAAeemDRe+OGQ_05SJwE8HqUAJMX0WRZDFoPieVG=s20PGmocuQ@mail.gmail.com>
	<CAGqTYaw6s37WWcYsJb=HjC+jjs_mj4G7Ec_jGRbLDwhYi82cVA@mail.gmail.com>
Message-ID: <CAAeemDSxB7uOdvmbDRHyFhTy=O3YcRnM3tWVwbkoW7ChDoVcwA@mail.gmail.com>

Hello,

Thank you for getting back. Our application use Keycloak
<https://enterprise-docs.anaconda.com/en/docs-site-5.0/admin-guide/user-and-identity-management.html>
for Identity and Access Management.


On Thu, Nov 1, 2018 at 6:00 AM Henning Waack <henning.waack at codecentric.de>
wrote:

> Are you trying to increase Logging for Keycloak running on Wildfly? Or for
> your application protected by some Keycloak Java Adapter?
>
> Am Mi., 31. Okt. 2018 um 22:43 Uhr schrieb Saranya Mahalingam <
> smahalingam at anaconda.com>:
>
>> Hello,
>>
>> Authentication component is not coming up. I don't see any errors in logs.
>> So thought of improving the logs using JAVA_OPTS like:
>>
>> name: JAVA_OPTS
>> value:  -Dkeycloak.logging.level=debug
>>
>> But I don't see any changes in the logs even after setting the above
>> value.
>> Tried few other options too without success. Do you have any suggestions
>> here? Let me know if you need any other information.
>>
>> Thanks,
>> Saranya
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>
>
> --
>
> Henning Waack | IT Consultant
>
>
> codecentric AG | Hochstra?e 11
> <https://maps.google.com/?q=Hochstra%C3%9Fe+11%C2%A0+%7C+%C2%A0+42697+Solingen+%C2%A0%7CDeutschland&entry=gmail&source=g>
> |
> <https://maps.google.com/?q=Hochstra%C3%9Fe+11%C2%A0+%7C+%C2%A0+42697+Solingen+%C2%A0%7CDeutschland&entry=gmail&source=g>
>
> <https://maps.google.com/?q=Hochstra%C3%9Fe+11%C2%A0+%7C+%C2%A0+42697+Solingen+%C2%A0%7CDeutschland&entry=gmail&source=g>42697
> Solingen
> <https://maps.google.com/?q=Hochstra%C3%9Fe+11%C2%A0+%7C+%C2%A0+42697+Solingen+%C2%A0%7CDeutschland&entry=gmail&source=g>
>  |Deutschland
> <https://maps.google.com/?q=Hochstra%C3%9Fe+11%C2%A0+%7C+%C2%A0+42697+Solingen+%C2%A0%7CDeutschland&entry=gmail&source=g>
>
>
> tel: +49 (0)151 108 515 29
>
> www.codecentric.de | blog.codecentric.de | www.meettheexperts.de
>
> Sitz der Gesellschaft: Solingen | HRB 25917 | Amtsgericht Wuppertal
>
> Vorstand: Michael Hochg?rtel . Ulrich K?hn . Rainer Vehns
> Aufsichtsrat: Patric Fedlmeier (Vorsitzender) . Klaus J?ger . J?rgen Sch?tz
>
> Diese E-Mail einschlie?lich evtl. beigef?gter Dateien enth?lt vertrauliche
> und/oder rechtlich gesch?tzte Informationen. Wenn Sie nicht der richtige
> Adressat sind oder diese E-Mail irrt?mlich erhalten haben, informieren Sie
> bitte sofort den Absender und l?schen Sie diese E-Mail und evtl.
> beigef?gter Dateien umgehend. Das unerlaubte Kopieren, Nutzen oder ?ffnen
> evtl. beigef?gter Dateien sowie die unbefugte Weitergabe dieser E-Mail ist
> nicht gestattet.
>

From pnalyvayko at agi.com  Thu Nov  1 11:32:00 2018
From: pnalyvayko at agi.com (Nalyvayko, Peter)
Date: Thu, 1 Nov 2018 15:32:00 +0000
Subject: [keycloak-user] PKCE and Keycloak
In-Reply-To: <CAD2jAwMY7VZKF1DYZdTVTpq-ssB3iZ_PXRjMWXA5fburWVw9NA@mail.gmail.com>
References: <CAD2jAwNGLnZ33goi5Udoet2U-tsMNRHawA5-_ghZ3GJoJvAXKQ@mail.gmail.com>
	<BL0PR07MB500962817B2F48AA74B9D2C1DACD0@BL0PR07MB5009.namprd07.prod.outlook.com>,
	<CAD2jAwMY7VZKF1DYZdTVTpq-ssB3iZ_PXRjMWXA5fburWVw9NA@mail.gmail.com>
Message-ID: <BL0PR07MB5009381F1133C88D05386D25DACE0@BL0PR07MB5009.namprd07.prod.outlook.com>

FYI http://blog.keycloak.org/2017/04/keycloak-310cr1-released.html
________________________________________
From: Bojan Milosavljevi? [bojan.milosavljevic95 at gmail.com]
Sent: Thursday, November 1, 2018 5:27 AM
To: Nalyvayko, Peter
Cc: keycloak-user at lists.jboss.org
Subject: Re: [keycloak-user] PKCE and Keycloak

Great, thanks! This is fantastic! Thank you very much!
Wish you all the best,
Bojan

On Wed, Oct 31, 2018 at 6:48 PM Nalyvayko, Peter <pnalyvayko at agi.com<mailto:pnalyvayko at agi.com>> wrote:
Hi Bojan,
We've been using PKCE so yes, PKCE support is enabled by default

-----Original Message-----
From: keycloak-user-bounces at lists.jboss.org<mailto:keycloak-user-bounces at lists.jboss.org> <keycloak-user-bounces at lists.jboss.org<mailto:keycloak-user-bounces at lists.jboss.org>> On Behalf Of Bojan Milosavljevic
Sent: Wednesday, October 31, 2018 5:59 AM
To: keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>
Subject: [keycloak-user] PKCE and Keycloak

Hello,
Is PKCE (if my adapter supports PKCE of course) automatically supported by default by Keycloak or do I have to implement it myself?
Thank you.
Kind regards,
Bojan Milosavljevic.
_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user


From Kevin.Fox at pnnl.gov  Thu Nov  1 11:41:08 2018
From: Kevin.Fox at pnnl.gov (Fox, Kevin M)
Date: Thu, 1 Nov 2018 15:41:08 +0000
Subject: [keycloak-user] Integration keycloak with application UI
In-Reply-To: <CAGqTYaxBJpTB-QGjACPxXhCW3nrz5Ssgozc2jaRbQMbR6hAO+w@mail.gmail.com>
References: <CAP1WPpQF0R9nPSyNAg1D20PBn0L-C1J6c9RYx=ghkf3hzTQwwg@mail.gmail.com>,
	<CAGqTYaxBJpTB-QGjACPxXhCW3nrz5Ssgozc2jaRbQMbR6hAO+w@mail.gmail.com>
Message-ID: <1A3C52DFCD06494D8528644858247BF01C223E71@EX10MBOX03.pnnl.gov>

One of the big selling points of oidc is that it removes the need for most components to ever handle a password. It centralizes that part to only the component that must handle it does. This offers significant security benefits. I would not try and work around this. Its an important feature.

Thanks,
Kevin
________________________________________
From: keycloak-user-bounces at lists.jboss.org [keycloak-user-bounces at lists.jboss.org] on behalf of Henning Waack [henning.waack at codecentric.de]
Sent: Thursday, November 01, 2018 4:26 AM
To: csekar at redhat.com
Cc: keycloak-user at lists.jboss.org
Subject: Re: [keycloak-user] Integration keycloak with application UI

Hi Chandra.

It is not recommended to not use the KC login pages. OIDC is build on
browser redirects (for browser applications). So you should just theme your
KC pages so that it fits with your CD and leave things as they are. See
https://lists.jboss.org/pipermail/keycloak-user/2016-December/008873.html
for example.

Greetings

Henning

Am Do., 1. Nov. 2018 um 06:37 Uhr schrieb K Chandra Sekar <csekar at redhat.com
>:

> Hey,
>
> I want to integrate application with Keycloak IAM system.I am trying to use
> KeyCloak to protect my application using OpenID connect.But I want to use
> application's login UI and don't want to direct user to keycloak login UI
> page to authenticate.Keycloak has Spring boot adapter which does the job it
> still it directs to the keycloak UI for login.I searched for any api to use
> from my app UI but i am nit getting anything and i am struck here.Kindly
> suggest me a a workaround or solution so that i can move
> forward.Anticipating a positive reply.
>
> Thanks and regards,
> K.Chandra Sekar
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>


--

Henning Waack | IT Consultant


codecentric AG | Hochstra?e 11
<https://maps.google.com/?q=Hochstra%C3%9Fe+11%C2%A0+%7C+%C2%A0+42697+Solingen+%C2%A0%7CDeutschland&entry=gmail&source=g>
|
<https://maps.google.com/?q=Hochstra%C3%9Fe+11%C2%A0+%7C+%C2%A0+42697+Solingen+%C2%A0%7CDeutschland&entry=gmail&source=g>

<https://maps.google.com/?q=Hochstra%C3%9Fe+11%C2%A0+%7C+%C2%A0+42697+Solingen+%C2%A0%7CDeutschland&entry=gmail&source=g>42697
Solingen
<https://maps.google.com/?q=Hochstra%C3%9Fe+11%C2%A0+%7C+%C2%A0+42697+Solingen+%C2%A0%7CDeutschland&entry=gmail&source=g>
 |Deutschland
<https://maps.google.com/?q=Hochstra%C3%9Fe+11%C2%A0+%7C+%C2%A0+42697+Solingen+%C2%A0%7CDeutschland&entry=gmail&source=g>


tel: +49 (0)151 108 515 29

www.codecentric.de | blog.codecentric.de | www.meettheexperts.de

Sitz der Gesellschaft: Solingen | HRB 25917 | Amtsgericht Wuppertal

Vorstand: Michael Hochg?rtel . Ulrich K?hn . Rainer Vehns
Aufsichtsrat: Patric Fedlmeier (Vorsitzender) . Klaus J?ger . J?rgen Sch?tz

Diese E-Mail einschlie?lich evtl. beigef?gter Dateien enth?lt vertrauliche
und/oder rechtlich gesch?tzte Informationen. Wenn Sie nicht der richtige
Adressat sind oder diese E-Mail irrt?mlich erhalten haben, informieren Sie
bitte sofort den Absender und l?schen Sie diese E-Mail und evtl.
beigef?gter Dateien umgehend. Das unerlaubte Kopieren, Nutzen oder ?ffnen
evtl. beigef?gter Dateien sowie die unbefugte Weitergabe dieser E-Mail ist
nicht gestattet.
_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user


From pnalyvayko at agi.com  Thu Nov  1 13:17:00 2018
From: pnalyvayko at agi.com (Nalyvayko, Peter)
Date: Thu, 1 Nov 2018 17:17:00 +0000
Subject: [keycloak-user] Integration keycloak with application UI
In-Reply-To: <1A3C52DFCD06494D8528644858247BF01C223E71@EX10MBOX03.pnnl.gov>
References: <CAP1WPpQF0R9nPSyNAg1D20PBn0L-C1J6c9RYx=ghkf3hzTQwwg@mail.gmail.com>,
	<CAGqTYaxBJpTB-QGjACPxXhCW3nrz5Ssgozc2jaRbQMbR6hAO+w@mail.gmail.com>,
	<1A3C52DFCD06494D8528644858247BF01C223E71@EX10MBOX03.pnnl.gov>
Message-ID: <BL0PR07MB5009EC55AD4DF92385A38AF0DACE0@BL0PR07MB5009.namprd07.prod.outlook.com>

Chandra,

You may want to consider using resource owner password flow (direct grant in keycloak nomeclature) if you are absolutely bent on providing your own login pages. The flow is typically reserved for trusted clients so the users will have to trust your app 
My $0.02 
________________________________________
From: keycloak-user-bounces at lists.jboss.org [keycloak-user-bounces at lists.jboss.org] on behalf of Fox, Kevin M [Kevin.Fox at pnnl.gov]
Sent: Thursday, November 1, 2018 11:41 AM
To: Henning Waack; csekar at redhat.com
Cc: keycloak-user at lists.jboss.org
Subject: Re: [keycloak-user] Integration keycloak with application UI

One of the big selling points of oidc is that it removes the need for most components to ever handle a password. It centralizes that part to only the component that must handle it does. This offers significant security benefits. I would not try and work around this. Its an important feature.

Thanks,
Kevin
________________________________________
From: keycloak-user-bounces at lists.jboss.org [keycloak-user-bounces at lists.jboss.org] on behalf of Henning Waack [henning.waack at codecentric.de]
Sent: Thursday, November 01, 2018 4:26 AM
To: csekar at redhat.com
Cc: keycloak-user at lists.jboss.org
Subject: Re: [keycloak-user] Integration keycloak with application UI

Hi Chandra.

It is not recommended to not use the KC login pages. OIDC is build on
browser redirects (for browser applications). So you should just theme your
KC pages so that it fits with your CD and leave things as they are. See
https://lists.jboss.org/pipermail/keycloak-user/2016-December/008873.html
for example.

Greetings

Henning

Am Do., 1. Nov. 2018 um 06:37 Uhr schrieb K Chandra Sekar <csekar at redhat.com
>:

> Hey,
>
> I want to integrate application with Keycloak IAM system.I am trying to use
> KeyCloak to protect my application using OpenID connect.But I want to use
> application's login UI and don't want to direct user to keycloak login UI
> page to authenticate.Keycloak has Spring boot adapter which does the job it
> still it directs to the keycloak UI for login.I searched for any api to use
> from my app UI but i am nit getting anything and i am struck here.Kindly
> suggest me a a workaround or solution so that i can move
> forward.Anticipating a positive reply.
>
> Thanks and regards,
> K.Chandra Sekar
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>


--

Henning Waack | IT Consultant


codecentric AG | Hochstra?e 11
<https://maps.google.com/?q=Hochstra%C3%9Fe+11%C2%A0+%7C+%C2%A0+42697+Solingen+%C2%A0%7CDeutschland&entry=gmail&source=g>
|
<https://maps.google.com/?q=Hochstra%C3%9Fe+11%C2%A0+%7C+%C2%A0+42697+Solingen+%C2%A0%7CDeutschland&entry=gmail&source=g>

<https://maps.google.com/?q=Hochstra%C3%9Fe+11%C2%A0+%7C+%C2%A0+42697+Solingen+%C2%A0%7CDeutschland&entry=gmail&source=g>42697
Solingen
<https://maps.google.com/?q=Hochstra%C3%9Fe+11%C2%A0+%7C+%C2%A0+42697+Solingen+%C2%A0%7CDeutschland&entry=gmail&source=g>
 |Deutschland
<https://maps.google.com/?q=Hochstra%C3%9Fe+11%C2%A0+%7C+%C2%A0+42697+Solingen+%C2%A0%7CDeutschland&entry=gmail&source=g>


tel: +49 (0)151 108 515 29

www.codecentric.de | blog.codecentric.de | www.meettheexperts.de

Sitz der Gesellschaft: Solingen | HRB 25917 | Amtsgericht Wuppertal

Vorstand: Michael Hochg?rtel . Ulrich K?hn . Rainer Vehns
Aufsichtsrat: Patric Fedlmeier (Vorsitzender) . Klaus J?ger . J?rgen Sch?tz

Diese E-Mail einschlie?lich evtl. beigef?gter Dateien enth?lt vertrauliche
und/oder rechtlich gesch?tzte Informationen. Wenn Sie nicht der richtige
Adressat sind oder diese E-Mail irrt?mlich erhalten haben, informieren Sie
bitte sofort den Absender und l?schen Sie diese E-Mail und evtl.
beigef?gter Dateien umgehend. Das unerlaubte Kopieren, Nutzen oder ?ffnen
evtl. beigef?gter Dateien sowie die unbefugte Weitergabe dieser E-Mail ist
nicht gestattet.
_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user

_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user


From mandy.fung at tasktop.com  Thu Nov  1 16:02:31 2018
From: mandy.fung at tasktop.com (Mandy Fung)
Date: Thu, 1 Nov 2018 13:02:31 -0700
Subject: [keycloak-user] Cannot Migrate Database from 3.2.0 to 4.5.0
Message-ID: <CAEH7JKz5ko39VMaVt_qM0yZgi-aKo15q6+9a657zzRBy6kaYjg@mail.gmail.com>

 Hello Keycloakers,

We are currently running into an issue when upgrading Keycloak from 3.2.0
to 4.5.0 directly. The issue appears to be related to the database
migration specifically and from a change introduced in August 2018 which
references a previously dropped column.

Here is the Jira issue containing some more details with the error and some
more analysis: https://issues.jboss.org/browse/KEYCLOAK-8702

Is there anything we can do to help expedite the resolution of this issue
aside from the details we have provided on the ticket?

Best regards,
Mandy

-- 


*Mandy Fung **|* Software Engineer 1 *| *Tasktop

*email: *mandy.fung at tasktop.com

From rmbyrd at dstsystems.com  Thu Nov  1 17:39:08 2018
From: rmbyrd at dstsystems.com (Byrd, Rob M)
Date: Thu, 1 Nov 2018 21:39:08 +0000
Subject: [keycloak-user] Data filtering in SQL
Message-ID: <5BCF31B569C0A2468D7904C8E5839D690104C35356@DSKCMAIL1WC.ad.dstsystems.com>

I am comparing OPA authorization to Keycloak - how could I enforce Keycloak policy in the SQL closest to the data for good performance, including returning subsets of lists?  OPA discusses this at https://blog.openpolicyagent.org/write-policy-in-opa-enforce-policy-in-sql-d9d24db93bf4.

Thanks!

Rob Byrd
DST
Solutions Lead
SS&C Technologies Inc.   |   1055 Broadway, Kansas City, MO 64105
t: (816) 435-7286  | m (816) 509-0119
rmbyrd at dstsystems.com<mailto:rmbyrd at dstsystems.com>  |  www.ssctech.com<http://www.ssctech.com/>
Follow us: [cid:image001.png at 01D412C1.A14C5770] <https://www.linkedin.com/company/ss-c-technologies/>  |  [cid:image002.png at 01D412C1.A14C5770] <https://twitter.com/ssctechnologies>  |  [cid:image003.png at 01D412C1.A14C5770] <https://www.facebook.com/ssctechnologies/>



Please consider the environment before printing this email and any attachments.

This e-mail and any attachments are intended only for the individual or company to which it is addressed and may contain information which is privileged, confidential and prohibited from disclosure or unauthorized use under applicable law. If you are not the intended recipient of this e-mail, you are hereby notified that any use, dissemination, or copying of this e-mail or the information contained in this e-mail is strictly prohibited by the sender. If you have received this transmission in error, please return the material received to the sender and delete all copies from your system.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.png
Type: image/png
Size: 588 bytes
Desc: image001.png
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20181101/d4191353/attachment-0003.png 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image002.png
Type: image/png
Size: 607 bytes
Desc: image002.png
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20181101/d4191353/attachment-0004.png 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image003.png
Type: image/png
Size: 566 bytes
Desc: image003.png
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20181101/d4191353/attachment-0005.png 

From andreas.lau at outlook.com  Thu Nov  1 22:28:51 2018
From: andreas.lau at outlook.com (Andreas Lau)
Date: Fri, 2 Nov 2018 02:28:51 +0000
Subject: [keycloak-user] JBoss EAP 7.0 -
 keycloak-wildfly-adapter-dist-4.3.0.Final - KeycloakConfigResolver called
 on unprotected Resources
In-Reply-To: <09AC28A0-AC9B-43EF-8684-F20F6F4E69C7@outlook.com>
References: <09AC28A0-AC9B-43EF-8684-F20F6F4E69C7@outlook.com>
Message-ID: <VI1PR10MB0445F17DE5E4F125C727E7E0E4CF0@VI1PR10MB0445.EURPRD10.PROD.OUTLOOK.COM>

Hey,
I forgot to bounce back to the list. Sorry

________________________________
Von: Andreas Lau <andreas.lau at outlook.com>
Gesendet: 30. Oktober 2018 23:08:06 MEZ
An: Dmitry Telegin <dt at acutus.pro>
Betreff: Re: [keycloak-user] JBoss EAP 7.0 - keycloak-wildfly-adapter-dist-4.3.0.Final - KeycloakConfigResolver called on unprotected Resources

Hello Dmitry,

thanks for your response and informations. My problem with that many calls of the resolve methode was not a performance concern in first place. I was surprised for sure and I did indeed thought that I mad a mistake somewhere following the instructions.

As you pointed out the behavior is not wrong. The resolver should be called that many times. That's OK I'm fine with this.
The first call to the jsf page is not a problem at all, because in the URL we have set the parameter who determines which keycloak.json file has to be used. But I have a problem at the time where the jsf loading process starts to load the resources.
It fires get request with the URL to the resources the jsf needs. But now I have lost my scope because the URL used to load the resource has no identifier in it. How should I determine which keycloak.json I should take?

Cheers,
Andreas

Am 30. Oktober 2018 06:29:56 MEZ schrieb Dmitry Telegin <dt at acutus.pro>:

Hello Andreas,

I'm afraid this is by design - one of the reasons may be Java EE programmatic security [1], where the application can instigate login even from the resources not protected by web.xml security constraints.

But I don't think you should be bothered - in your resolver, there is a cache for KeycloakDeployments, and cache calls are cheap (and you will always have a cache hit, except for the very first invocation).

Even if there had been the code to determine whether the resolver should or should not kick in, according to web.xml rules, - this code would have been more expensive, let alone it would have broken programmatic security. If you are super determined, you can craft a simple performance test using e.g. Gatling [2] - I'm pretty sure the results for resolver vs. no resolver will differ insignificantly.

[1] https://docs.oracle.com/javaee/7/tutorial/security-webtier003.htm
[2] https://gatling.io/

Cheers,
Dmitry Telegin
CTO, Acutus s.r.o.
Keycloak Consulting and Training

Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
+42 (022) 888-30-71
E-mail: info at acutus.pro

On Sat, 2018-10-27 at 07:21 +0000, Andreas Lau wrote:
Hey guys, sorry for bouncing that topic again, but this issue currently is a show stopper for us. We need to have multi-tenancy for our application, but as it works now it is not feasible.
So we desparatly ask for your help.

Am 24. Oktober 2018 17:16:23 MESZ schrieb Andreas Lau <andreas.lau at outlook.com>:

Hello,
we deployed a jsf primfaces application on a JBoss EAP 7.0 System. We have to support multiple clients using multi tenancy. We followed the instructions of the documentation [1] to build up a CustomKeycloakConfigResolver.
We configured the web.xml like this:
[web.xml]
<web-app>
...
<security-constraint>
 <web-resource-collection>
  <web-resource-name>portal</web-resource-name>
  <url-pattern>/portal/*</url-pattern>
 </web-resource-collection>
 <auth-constraint>
  <role-name>user</role-name>
 </auth-constraint>
</security-constraint>
<security-constraint>
 <web-resource-collection>
  <web-resource-name>public</web-resource-name>
  <url-pattern>/portal/pages/willkommen.jsf</url-pattern>
  <url-pattern>/portal/pages/logout.jsf</url-pattern>
 </web-resource-collection>
</security-constraint>

<login-config>
 <auth-method>KEYCLOAK</auth-method>
</login-config>

<security-role>
 <role-name>user</role-name>
</security-role>
...
<context-param>
 <param-name>keycloak.config.resolver</param-name>
 <param-value>de.sample.security.MandantBasedKeycloakConfigResolver</param-value>
</context-param>
...
</web-app>

As you can see everything under portal is restricted with two exceptions. The code of MandantBasedKeycloakConfigResolver is straight forward and adapted to the example code [2]. In our example we consider that the url has a query parameter that provides an id which we can map to a corresponding keycloak.json file. A sample would be "https://localhost:8443/SampleApp/portal/pages/willkommen.jsf?kId=1".

After deployment I realized, that the KeycloakConfigResolver is called 44 times (see log entries [3]). As it turns out the KeycloakConfigResolver.resolve() methode is called for every resource that is loaded through get requests to display the site. I did not expect that many invocation, since the resources are not protected.

Can you please tell me if this behaviour is correct? What is my error in adopting the mulity tenancy sample? How can we prevent/workaround that many calls?
While researching I found a jira https://issues.jboss.org/browse/KEYCLOAK-8616 with a potentially similar problem. Here they use keycloak to secure a spring boot application and have troubles when a sso redirection occurs.

Regards,
Andreas

[1] https://www.keycloak.org/docs/latest/securing_apps/index.html#_multi_tenancy

[2] public KeycloakDeployment resolve(HttpFacade.Request request) {

        LOGGER.debug("MandantBasedKeycloakConfigResolver.resolve() - counter:" + counter++);
        final String mandantId = request.getFirstParam("kId");
        LOGGER.debug("MandantBasedKeycloakConfigResolver.resolve() - requestFirstParam(kId):" + mandantId);
        LOGGER.debug("MandantBasedKeycloakConfigResolver.resolve() - uri:" + request.getURI());

        if (mandantId == null || mandantId.isEmpty()) {
            // throw new IllegalStateException("Not able to resolve realm for parameter kId - Parameter not found!");
            return null;
        }

        KeycloakDeployment deployment = cache.get(mandantId);
        if (deployment == null) {

            String keycloakConfigFilename = resolveKeycloakConfigFilename(mandantId);

            InputStream is = getClass().getResourceAsStream("/" + keycloakConfigFilename);
            if (is == null) {
                // throw new IllegalStateException("Not able to find the file /" + keycloakConfigFilename);
                return null;
            }
            LOGGER.debug("MandantBasedKeycloakConfigResolver.resolve() - is IS==null?:" + (is == null));

            deployment = KeycloakDeploymentBuilder.build(is);
            cache.put(mandantId, deployment);
        }

        return deployment;
    }

[3]
17:28:43,281 DEBUG [de.sample.security.MandantBasedKeycloakConfigResolver] (default task-4) MandantBasedKeycloakConfigResolver.resolve() - counter:0
17:28:50,215 DEBUG [de.sample.security.MandantBasedKeycloakConfigResolver] (default task-4) MandantBasedKeycloakConfigResolver.resolve() - requestFirstParam(kId):3
17:28:50,228 DEBUG [de.sample.security.MandantBasedKeycloakConfigResolver] (default task-4) MandantBasedKeycloakConfigResolver.resolve() - uri:https://localhost:8443/SampleApp/portal/pages/willkommen.jsf?kId=3
17:28:50,229 DEBUG [de.sample.security.MandantBasedKeycloakConfigResolver] (default task-4) MandantBasedKeycloakConfigResolver.resolve() - is IS==null?:false
17:28:50,496 DEBUG [de.sample.security.MandantBasedKeycloakConfigResolver] (default task-4) MandantBasedKeycloakConfigResolver.resolve() - counter:1
17:28:50,496 DEBUG [de.sample.security.MandantBasedKeycloakConfigResolver] (default task-4) MandantBasedKeycloakConfigResolver.resolve() - requestFirstParam(kId):3
17:28:50,496 DEBUG [de.sample.security.MandantBasedKeycloakConfigResolver] (default task-4) MandantBasedKeycloakConfigResolver.resolve() - uri:https://localhost:8443/SampleApp/portal/pages/willkommen.jsf?kId=3
17:28:50,496 DEBUG [de.sample.security.MandantBasedKeycloakConfigResolver] (default task-4) MandantBasedKeycloakConfigResolver.resolve() - counter:2
17:28:50,496 DEBUG [de.sample.security.MandantBasedKeycloakConfigResolver] (default task-4) MandantBasedKeycloakConfigResolver.resolve() - requestFirstParam(kId):3
17:28:50,496 DEBUG [de.sample.security.MandantBasedKeycloakConfigResolver] (default task-4) MandantBasedKeycloakConfigResolver.resolve() - uri:https://localhost:8443/SampleApp/portal/pages/willkommen.jsf?kId=3
17:28:50,933 INFO  [stdout] (default task-4) INIT Willkommen
17:28:50,933 INFO  [stdout] (default task-4) initialized mandant <<<<<<<<<<<<<

17:28:51,168 DEBUG [de.sample.security.MandantBasedKeycloakConfigResolver] (default task-5) MandantBasedKeycloakConfigResolver.resolve() - counter:3
17:28:51,168 DEBUG [de.sample.security.MandantBasedKeycloakConfigResolver] (default task-5) MandantBasedKeycloakConfigResolver.resolve() - requestFirstParam(kId):null
17:28:51,168 DEBUG [de.sample.security.MandantBasedKeycloakConfigResolver] (default task-5) MandantBasedKeycloakConfigResolver.resolve() - uri:https://localhost:8443/SampleApp/javax.faces.resource/components.css.jsf;jsessionid=6YidBEhtdxxI3NAASHOPab5bdBN_JAOjgqf8qHeh.localhost?ln=primefaces&v=6.1
17:28:51,168 ERROR [io.undertow.request] (default task-5) UT005023: Exception handling request to /SampleApp/javax.faces.resource/components.css.jsf;jsessionid=6YidBEhtdxxI3NAASHOPab5bdBN_JAOjgqf8qHeh.localhost: java.lang.IllegalStateException: Not able to resolve realm for parameter kId - Parameter not found!
at de.sample.security.MandantBasedKeycloakConfigResolver.resolve(MandantBasedKeycloakConfigResolver.java:46) [classes:]
at org.keycloak.adapters.AdapterDeploymentContext.resolveDeployment(AdapterDeploymentContext.java:88) [keycloak-adapter-core-4.0.0.Final.jar:4.0.0.Final]
at org.keycloak.adapters.PreAuthActionsHandler.preflightCors(PreAuthActionsHandler.java:107) [keycloak-adapter-core-4.0.0.Final.jar:4.0.0.Final]
at org.keycloak.adapters.PreAuthActionsHandler.handleRequest(PreAuthActionsHandler.java:79) [keycloak-adapter-core-4.0.0.Final.jar:4.0.0.Final]
at org.keycloak.adapters.undertow.ServletPreAuthActionsHandler.handleRequest(ServletPreAuthActionsHandler.java:68) [keycloak-undertow-adapter-4.0.0.Final.jar:4.0.0.Final]
at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) [undertow-core-1.3.31.Final-redhat-3.jar:1.3.31.Final-redhat-3]
at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:285) [undertow-servlet-1.3.31.Final-redhat-3.jar:1.3.31.Final-redhat-3]
at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:264) [undertow-servlet-1.3.31.Final-redhat-3.jar:1.3.31.Final-redhat-3]
at io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81) [undertow-servlet-1.3.31.Final-redhat-3.jar:1.3.31.Final-redhat-3]
at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:175) [undertow-servlet-1.3.31.Final-redhat-3.jar:1.3.31.Final-redhat-3]
at io.undertow.server.Connectors.executeRootHandler(Connectors.java:324) [undertow-core-1.3.31.Final-redhat-3.jar:1.3.31.Final-redhat-3]
at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:803) [undertow-core-1.3.31.Final-redhat-3.jar:1.3.31.Final-redhat-3]
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) [rt.jar:1.8.0_112]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) [rt.jar:1.8.0_112]
at java.lang.Thread.run(Thread.java:745) [rt.jar:1.8.0_112]

.......

17:28:51,824 DEBUG [de.sample.security.MandantBasedKeycloakConfigResolver] (default task-50) MandantBasedKeycloakConfigResolver.resolve() - counter:43
17:28:51,825 DEBUG [de.sample.security.MandantBasedKeycloakConfigResolver] (default task-50) MandantBasedKeycloakConfigResolver.resolve() - requestFirstParam(kId):null
17:28:51,825 DEBUG [de.sample.security.MandantBasedKeycloakConfigResolver] (default task-50) MandantBasedKeycloakConfigResolver.resolve() - uri:https://localhost:8443/SampleApp/javax.faces.resource/customJs/customJavaScript.js.jsf;jsessionid=6YidBEhtdxxI3NAASHOPab5bdBN_JAOjgqf8qHeh.localhost?ln=ultima-layout
17:28:51,825 ERROR [io.undertow.request] (default task-50) UT005023: Exception handling request to /SampleApp/javax.faces.resource/customJs/customJavaScript.js.jsf;jsessionid=6YidBEhtdxxI3NAASHOPab5bdBN_JAOjgqf8qHeh.localhost: java.lang.IllegalStateException: Not able to resolve realm for parameter kId - Parameter not found!
at de.sample.security.MandantBasedKeycloakConfigResolver.resolve(MandantBasedKeycloakConfigResolver.java:46) [classes:]
at org.keycloak.adapters.AdapterDeploymentContext.resolveDeployment(AdapterDeploymentContext.java:88) [keycloak-adapter-core-4.0.0.Final.jar:4.0.0.Final]
at org.keycloak.adapters.PreAuthActionsHandler.preflightCors(PreAuthActionsHandler.java:107) [keycloak-adapter-core-4.0.0.Final.jar:4.0.0.Final]
at org.keycloak.adapters.PreAuthActionsHandler.handleRequest(PreAuthActionsHandler.java:79) [keycloak-adapter-core-4.0.0.Final.jar:4.0.0.Final]
at org.keycloak.adapters.undertow.ServletPreAuthActionsHandler.handleRequest(ServletPreAuthActionsHandler.java:68) [keycloak-undertow-adapter-4.0.0.Final.jar:4.0.0.Final]
at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) [undertow-core-1.3.31.Final-redhat-3.jar:1.3.31.Final-redhat-3]
at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:285) [undertow-servlet-1.3.31.Final-redhat-3.jar:1.3.31.Final-redhat-3]
at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:264) [undertow-servlet-1.3.31.Final-redhat-3.jar:1.3.31.Final-redhat-3]
at io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81) [undertow-servlet-1.3.31.Final-redhat-3.jar:1.3.31.Final-redhat-3]
at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:175) [undertow-servlet-1.3.31.Final-redhat-3.jar:1.3.31.Final-redhat-3]
at io.undertow.server.Connectors.executeRootHandler(Connectors.java:324) [undertow-core-1.3.31.Final-redhat-3.jar:1.3.31.Final-redhat-3]
at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:803) [undertow-core-1.3.31.Final-redhat-3.jar:1.3.31.Final-redhat-3]
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) [rt.jar:1.8.0_112]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) [rt.jar:1.8.0_112]
at java.lang.Thread.run(Thread.java:745) [rt.jar:1.8.0_112]
________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user

From dt at acutus.pro  Fri Nov  2 00:45:09 2018
From: dt at acutus.pro (Dmitry Telegin)
Date: Fri, 02 Nov 2018 07:45:09 +0300
Subject: [keycloak-user] JBoss EAP 7.0 -
 keycloak-wildfly-adapter-dist-4.3.0.Final - KeycloakConfigResolver called
 on unprotected Resources
In-Reply-To: <VI1PR10MB0445F17DE5E4F125C727E7E0E4CF0@VI1PR10MB0445.EURPRD10.PROD.OUTLOOK.COM>
References: <09AC28A0-AC9B-43EF-8684-F20F6F4E69C7@outlook.com>
	<VI1PR10MB0445F17DE5E4F125C727E7E0E4CF0@VI1PR10MB0445.EURPRD10.PROD.OUTLOOK.COM>
Message-ID: <1541133909.10131.1.camel@acutus.pro>

Andreas,

Could you please elaborate on the nature of the resources your JSF is accessing?

If those are static images/CSS/etc. and they do not require authentication, you can simply return new KeycloakDeployment(), a dummy unconfigured instance (you can't return null from the resolver as it will result in an NPE).

If those are REST resources that need authentication, you'll probably need to propagate kId somehow to that services, like in a HTTP header or URL param, and process it in the resolver.

Good luck,
Dmitry

On Fri, 2018-11-02 at 02:28 +0000, Andreas Lau wrote:
> Hey,
> I forgot to bounce back to the list. Sorry
> 
> ________________________________
> > Von: Andreas Lau <andreas.lau at outlook.com>
> Gesendet: 30. Oktober 2018 23:08:06 MEZ
> > An: Dmitry Telegin <dt at acutus.pro>
> Betreff: Re: [keycloak-user] JBoss EAP 7.0 - keycloak-wildfly-adapter-dist-4.3.0.Final - KeycloakConfigResolver called on unprotected Resources
> 
> Hello Dmitry,
> 
> thanks for your response and informations. My problem with that many calls of the resolve methode was not a performance concern in first place. I was surprised for sure and I did indeed thought that I mad a mistake somewhere following the instructions.
> 
> As you pointed out the behavior is not wrong. The resolver should be called that many times. That's OK I'm fine with this.
> The first call to the jsf page is not a problem at all, because in the URL we have set the parameter who determines which keycloak.json file has to be used. But I have a problem at the time where the jsf loading process starts to load the resources.
> It fires get request with the URL to the resources the jsf needs. But now I have lost my scope because the URL used to load the resource has no identifier in it. How should I determine which keycloak.json I should take?
> 
> Cheers,
> Andreas
> 
> Am 30. Oktober 2018 06:29:56 MEZ schrieb Dmitry Telegin <dt at acutus.pro>:
> 
> Hello Andreas,
> 
> I'm afraid this is by design - one of the reasons may be Java EE programmatic security [1], where the application can instigate login even from the resources not protected by web.xml security constraints.
> 
> But I don't think you should be bothered - in your resolver, there is a cache for KeycloakDeployments, and cache calls are cheap (and you will always have a cache hit, except for the very first invocation).
> 
> Even if there had been the code to determine whether the resolver should or should not kick in, according to web.xml rules, - this code would have been more expensive, let alone it would have broken programmatic security. If you are super determined, you can craft a simple performance test using e.g. Gatling [2] - I'm pretty sure the results for resolver vs. no resolver will differ insignificantly.
> 
> [1] https://docs.oracle.com/javaee/7/tutorial/security-webtier003.htm
> [2] https://gatling.io/
> 
> Cheers,
> Dmitry Telegin
> CTO, Acutus s.r.o.
> Keycloak Consulting and Training
> 
> Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
> +42 (022) 888-30-71
> E-mail: info at acutus.pro
> 
> On Sat, 2018-10-27 at 07:21 +0000, Andreas Lau wrote:
> Hey guys, sorry for bouncing that topic again, but this issue currently is a show stopper for us. We need to have multi-tenancy for our application, but as it works now it is not feasible.
> So we desparatly ask for your help.
> 
> Am 24. Oktober 2018 17:16:23 MESZ schrieb Andreas Lau <andreas.lau at outlook.com>:
> 
> Hello,
> we deployed a jsf primfaces application on a JBoss EAP 7.0 System. We have to support multiple clients using multi tenancy. We followed the instructions of the documentation [1] to build up a CustomKeycloakConfigResolver.
> We configured the web.xml like this:
> [web.xml]
> <web-app>
> ...
> <security-constraint>
> ?<web-resource-collection>
> ? <web-resource-name>portal</web-resource-name>
> ? <url-pattern>/portal/*</url-pattern>
> ?</web-resource-collection>
> ?<auth-constraint>
> ? <role-name>user</role-name>
> ?</auth-constraint>
> </security-constraint>
> <security-constraint>
> ?<web-resource-collection>
> ? <web-resource-name>public</web-resource-name>
> ? <url-pattern>/portal/pages/willkommen.jsf</url-pattern>
> ? <url-pattern>/portal/pages/logout.jsf</url-pattern>
> ?</web-resource-collection>
> </security-constraint>
> 
> <login-config>
> ?<auth-method>KEYCLOAK</auth-method>
> </login-config>
> 
> <security-role>
> ?<role-name>user</role-name>
> </security-role>
> ...
> <context-param>
> ?<param-name>keycloak.config.resolver</param-name>
> ?<param-value>de.sample.security.MandantBasedKeycloakConfigResolver</param-value>
> </context-param>
> ...
> </web-app>
> 
> As you can see everything under portal is restricted with two exceptions. The code of MandantBasedKeycloakConfigResolver is straight forward and adapted to the example code [2]. In our example we consider that the url has a query parameter that provides an id which we can map to a corresponding keycloak.json file. A sample would be "https://localhost:8443/SampleApp/portal/pages/willkommen.jsf?kId=1".
> 
> After deployment I realized, that the KeycloakConfigResolver is called 44 times (see log entries [3]). As it turns out the KeycloakConfigResolver.resolve() methode is called for every resource that is loaded through get requests to display the site. I did not expect that many invocation, since the resources are not protected.
> 
> Can you please tell me if this behaviour is correct? What is my error in adopting the mulity tenancy sample? How can we prevent/workaround that many calls?
> While researching I found a jira https://issues.jboss.org/browse/KEYCLOAK-8616 with a potentially similar problem. Here they use keycloak to secure a spring boot application and have troubles when a sso redirection occurs.
> 
> Regards,
> Andreas
> 
> [1] https://www.keycloak.org/docs/latest/securing_apps/index.html#_multi_tenancy
> 
> [2] public KeycloakDeployment resolve(HttpFacade.Request request) {
> 
> ????????LOGGER.debug("MandantBasedKeycloakConfigResolver.resolve() - counter:" + counter++);
> ????????final String mandantId = request.getFirstParam("kId");
> ????????LOGGER.debug("MandantBasedKeycloakConfigResolver.resolve() - requestFirstParam(kId):" + mandantId);
> ????????LOGGER.debug("MandantBasedKeycloakConfigResolver.resolve() - uri:" + request.getURI());
> 
> ????????if (mandantId == null || mandantId.isEmpty()) {
> ????????????// throw new IllegalStateException("Not able to resolve realm for parameter kId - Parameter not found!");
> ????????????return null;
> ????????}
> 
> ????????KeycloakDeployment deployment = cache.get(mandantId);
> ????????if (deployment == null) {
> 
> ????????????String keycloakConfigFilename = resolveKeycloakConfigFilename(mandantId);
> 
> ????????????InputStream is = getClass().getResourceAsStream("/" + keycloakConfigFilename);
> ????????????if (is == null) {
> ????????????????// throw new IllegalStateException("Not able to find the file /" + keycloakConfigFilename);
> ????????????????return null;
> ????????????}
> ????????????LOGGER.debug("MandantBasedKeycloakConfigResolver.resolve() - is IS==null?:" + (is == null));
> 
> ????????????deployment = KeycloakDeploymentBuilder.build(is);
> ????????????cache.put(mandantId, deployment);
> ????????}
> 
> ????????return deployment;
> ????}
> 
> [3]
> 17:28:43,281 DEBUG [de.sample.security.MandantBasedKeycloakConfigResolver] (default task-4) MandantBasedKeycloakConfigResolver.resolve() - counter:0
> 17:28:50,215 DEBUG [de.sample.security.MandantBasedKeycloakConfigResolver] (default task-4) MandantBasedKeycloakConfigResolver.resolve() - requestFirstParam(kId):3
> 17:28:50,228 DEBUG [de.sample.security.MandantBasedKeycloakConfigResolver] (default task-4) MandantBasedKeycloakConfigResolver.resolve() - uri:https://localhost:8443/SampleApp/portal/pages/willkommen.jsf?kId=3
> 17:28:50,229 DEBUG [de.sample.security.MandantBasedKeycloakConfigResolver] (default task-4) MandantBasedKeycloakConfigResolver.resolve() - is IS==null?:false
> 17:28:50,496 DEBUG [de.sample.security.MandantBasedKeycloakConfigResolver] (default task-4) MandantBasedKeycloakConfigResolver.resolve() - counter:1
> 17:28:50,496 DEBUG [de.sample.security.MandantBasedKeycloakConfigResolver] (default task-4) MandantBasedKeycloakConfigResolver.resolve() - requestFirstParam(kId):3
> 17:28:50,496 DEBUG [de.sample.security.MandantBasedKeycloakConfigResolver] (default task-4) MandantBasedKeycloakConfigResolver.resolve() - uri:https://localhost:8443/SampleApp/portal/pages/willkommen.jsf?kId=3
> 17:28:50,496 DEBUG [de.sample.security.MandantBasedKeycloakConfigResolver] (default task-4) MandantBasedKeycloakConfigResolver.resolve() - counter:2
> 17:28:50,496 DEBUG [de.sample.security.MandantBasedKeycloakConfigResolver] (default task-4) MandantBasedKeycloakConfigResolver.resolve() - requestFirstParam(kId):3
> 17:28:50,496 DEBUG [de.sample.security.MandantBasedKeycloakConfigResolver] (default task-4) MandantBasedKeycloakConfigResolver.resolve() - uri:https://localhost:8443/SampleApp/portal/pages/willkommen.jsf?kId=3
> 17:28:50,933 INFO??[stdout] (default task-4) INIT Willkommen
> 17:28:50,933 INFO??[stdout] (default task-4) initialized mandant <<<<<<<<<<<<<
> 
> 17:28:51,168 DEBUG [de.sample.security.MandantBasedKeycloakConfigResolver] (default task-5) MandantBasedKeycloakConfigResolver.resolve() - counter:3
> 17:28:51,168 DEBUG [de.sample.security.MandantBasedKeycloakConfigResolver] (default task-5) MandantBasedKeycloakConfigResolver.resolve() - requestFirstParam(kId):null
> 17:28:51,168 DEBUG [de.sample.security.MandantBasedKeycloakConfigResolver] (default task-5) MandantBasedKeycloakConfigResolver.resolve() - uri:https://localhost:8443/SampleApp/javax.faces.resource/components.css.jsf;jsessionid=6YidBEhtdxxI3NAASHOPab5bdBN_JAOjgqf8qHeh.localhost?ln=primefaces&v=6.1
> 17:28:51,168 ERROR [io.undertow.request] (default task-5) UT005023: Exception handling request to /SampleApp/javax.faces.resource/components.css.jsf;jsessionid=6YidBEhtdxxI3NAASHOPab5bdBN_JAOjgqf8qHeh.localhost: java.lang.IllegalStateException: Not able to resolve realm for parameter kId - Parameter not found!
> at de.sample.security.MandantBasedKeycloakConfigResolver.resolve(MandantBasedKeycloakConfigResolver.java:46) [classes:]
> at org.keycloak.adapters.AdapterDeploymentContext.resolveDeployment(AdapterDeploymentContext.java:88) [keycloak-adapter-core-4.0.0.Final.jar:4.0.0.Final]
> at org.keycloak.adapters.PreAuthActionsHandler.preflightCors(PreAuthActionsHandler.java:107) [keycloak-adapter-core-4.0.0.Final.jar:4.0.0.Final]
> at org.keycloak.adapters.PreAuthActionsHandler.handleRequest(PreAuthActionsHandler.java:79) [keycloak-adapter-core-4.0.0.Final.jar:4.0.0.Final]
> at org.keycloak.adapters.undertow.ServletPreAuthActionsHandler.handleRequest(ServletPreAuthActionsHandler.java:68) [keycloak-undertow-adapter-4.0.0.Final.jar:4.0.0.Final]
> at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) [undertow-core-1.3.31.Final-redhat-3.jar:1.3.31.Final-redhat-3]
> at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:285) [undertow-servlet-1.3.31.Final-redhat-3.jar:1.3.31.Final-redhat-3]
> at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:264) [undertow-servlet-1.3.31.Final-redhat-3.jar:1.3.31.Final-redhat-3]
> at io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81) [undertow-servlet-1.3.31.Final-redhat-3.jar:1.3.31.Final-redhat-3]
> at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:175) [undertow-servlet-1.3.31.Final-redhat-3.jar:1.3.31.Final-redhat-3]
> at io.undertow.server.Connectors.executeRootHandler(Connectors.java:324) [undertow-core-1.3.31.Final-redhat-3.jar:1.3.31.Final-redhat-3]
> at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:803) [undertow-core-1.3.31.Final-redhat-3.jar:1.3.31.Final-redhat-3]
> at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) [rt.jar:1.8.0_112]
> at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) [rt.jar:1.8.0_112]
> at java.lang.Thread.run(Thread.java:745) [rt.jar:1.8.0_112]
> 
> .......
> 
> 17:28:51,824 DEBUG [de.sample.security.MandantBasedKeycloakConfigResolver] (default task-50) MandantBasedKeycloakConfigResolver.resolve() - counter:43
> 17:28:51,825 DEBUG [de.sample.security.MandantBasedKeycloakConfigResolver] (default task-50) MandantBasedKeycloakConfigResolver.resolve() - requestFirstParam(kId):null
> 17:28:51,825 DEBUG [de.sample.security.MandantBasedKeycloakConfigResolver] (default task-50) MandantBasedKeycloakConfigResolver.resolve() - uri:https://localhost:8443/SampleApp/javax.faces.resource/customJs/customJavaScript.js.jsf;jsessionid=6YidBEhtdxxI3NAASHOPab5bdBN_JAOjgqf8qHeh.localhost?ln=ultima-layout
> 17:28:51,825 ERROR [io.undertow.request] (default task-50) UT005023: Exception handling request to /SampleApp/javax.faces.resource/customJs/customJavaScript.js.jsf;jsessionid=6YidBEhtdxxI3NAASHOPab5bdBN_JAOjgqf8qHeh.localhost: java.lang.IllegalStateException: Not able to resolve realm for parameter kId - Parameter not found!
> at de.sample.security.MandantBasedKeycloakConfigResolver.resolve(MandantBasedKeycloakConfigResolver.java:46) [classes:]
> at org.keycloak.adapters.AdapterDeploymentContext.resolveDeployment(AdapterDeploymentContext.java:88) [keycloak-adapter-core-4.0.0.Final.jar:4.0.0.Final]
> at org.keycloak.adapters.PreAuthActionsHandler.preflightCors(PreAuthActionsHandler.java:107) [keycloak-adapter-core-4.0.0.Final.jar:4.0.0.Final]
> at org.keycloak.adapters.PreAuthActionsHandler.handleRequest(PreAuthActionsHandler.java:79) [keycloak-adapter-core-4.0.0.Final.jar:4.0.0.Final]
> at org.keycloak.adapters.undertow.ServletPreAuthActionsHandler.handleRequest(ServletPreAuthActionsHandler.java:68) [keycloak-undertow-adapter-4.0.0.Final.jar:4.0.0.Final]
> at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) [undertow-core-1.3.31.Final-redhat-3.jar:1.3.31.Final-redhat-3]
> at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:285) [undertow-servlet-1.3.31.Final-redhat-3.jar:1.3.31.Final-redhat-3]
> at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:264) [undertow-servlet-1.3.31.Final-redhat-3.jar:1.3.31.Final-redhat-3]
> at io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81) [undertow-servlet-1.3.31.Final-redhat-3.jar:1.3.31.Final-redhat-3]
> at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:175) [undertow-servlet-1.3.31.Final-redhat-3.jar:1.3.31.Final-redhat-3]
> at io.undertow.server.Connectors.executeRootHandler(Connectors.java:324) [undertow-core-1.3.31.Final-redhat-3.jar:1.3.31.Final-redhat-3]
> at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:803) [undertow-core-1.3.31.Final-redhat-3.jar:1.3.31.Final-redhat-3]
> at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) [rt.jar:1.8.0_112]
> at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) [rt.jar:1.8.0_112]
> at java.lang.Thread.run(Thread.java:745) [rt.jar:1.8.0_112]
> ________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
> ________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From dt at acutus.pro  Fri Nov  2 00:49:27 2018
From: dt at acutus.pro (Dmitry Telegin)
Date: Fri, 02 Nov 2018 07:49:27 +0300
Subject: [keycloak-user] Multitenant KeycloakConfigResolver
In-Reply-To: <6545e127-cf80-befc-39ca-64e33f2a3232@gmail.com>
References: <6545e127-cf80-befc-39ca-64e33f2a3232@gmail.com>
Message-ID: <1541134167.10131.3.camel@acutus.pro>

Hello Vagelis,

Please see my answer to exactly the same question: http://lists.jboss.org/pipermail/keycloak-user/2018-October/016026.html

TL;DR: this is by design, but you shouldn't be worried. For unsecured URLs you can simply return new KeycloakDeployment() from your resolver.

Cheers,
Dmitry Telegin
CTO, Acutus s.r.o.
Keycloak Consulting and Training

Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
+42 (022) 888-30-71
E-mail: info at acutus.pro

On Tue, 2018-10-30 at 09:19 +0200, Vagelis Savvas wrote:
> Hello,
> 
> in a multitenant app on Wildfly 14.0.1 with a bearer-only REST API to?
> protect I would like some URLs
> to not be secured. So I would like my custom KeycloakConfigResolver?
> implementation
> to not be called when those URLs are hit but it is. The reason I don't?
> want my KeycloakConfigResolver to be called is simply because
> I have no clue as to what to return in that case: its a non-secured REST?
> endpoint so a Keycloak realm doesn't make sense in my understanding.
> My setup follows the docs: I've installed the adapter for Wildfly and?
> the web.xml has the necessary setup for not securing some URLs (no?
> auth-constraint for those URLs)
> Also in jboss-web.xml the security-domain element isn't defined,?
> although I don't know if that plays any role.
> My final goal is to have some URLs secured by using the JBoss specific?
> @SecurityDomain and the standard @RolesAllowed etc annotations.
> Can you please shed some light on this matter? I'd greatly appreciate?
> any detailed explanation of the mechanisms involved in this area.
> 
> Cheers,
> Vagelis
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From dt at acutus.pro  Fri Nov  2 01:21:58 2018
From: dt at acutus.pro (Dmitry Telegin)
Date: Fri, 02 Nov 2018 08:21:58 +0300
Subject: [keycloak-user] Data filtering in SQL
In-Reply-To: <5BCF31B569C0A2468D7904C8E5839D690104C35356@DSKCMAIL1WC.ad.dstsystems.com>
References: <5BCF31B569C0A2468D7904C8E5839D690104C35356@DSKCMAIL1WC.ad.dstsystems.com>
Message-ID: <1541136118.4390.1.camel@acutus.pro>

Hello Rob,

If I get it right, it's all about generating SQL WHERE clause from Keycloak policies? I think this is doable, as Keycloak has a well-defined object model for authorization policies, and it's easy to obtain policy definitions in JSON format. I think Pedro Igor will tell you more about that.

You should pay attention to the following:
- there are differences in semantics between OPA and Keycloak policies. For example, Keycloak policies do not operate HTTP methods but rather use more generic notion of scopes;
- not every policy type can be easily converted to a WHERE clause. It should be trivial for User/Group/Role policies, but is virtually impossible for Script and Rules, as they are just blackboxes that evaluate to true or false. Unless of course your DBMS has a built-in JavaScript engine :)

Good luck!
Dmitry Telegin
CTO, Acutus s.r.o.
Keycloak Consulting and Training

Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
+42 (022) 888-30-71
E-mail: info at acutus.pro

On Thu, 2018-11-01 at 21:39 +0000, Byrd, Rob M wrote:
> I am comparing OPA authorization to Keycloak - how could I enforce Keycloak policy in the SQL closest to the data for good performance, including returning subsets of lists???OPA discusses this at https://blog.openpolicyagent.org/write-policy-in-opa-enforce-policy-in-sql-d9d24db93bf4.
> 
> Thanks!
> 
> Rob Byrd
> DST
> Solutions Lead
> SS&C Technologies Inc.???|???1055 Broadway, Kansas City, MO 64105
> t: (816) 435-7286??| m (816) 509-0119
> rmbyrd at dstsystems.com<mailto:rmbyrd at dstsystems.com>??|??www.ssctech.com<http://www.ssctech.com/>;
> > > Follow us: [cid:image001.png at 01D412C1.A14C5770] <https://www.linkedin.com/company/ss-c-technologies/>??|??[cid:image002.png at 01D412C1.A14C5770] <https://twitter.com/ssctechnologies>??|??[cid:image003.png at 01D412C1.A14C5770] <https://www.facebook.com/ssctechnologies/>
> 
> 
> 
> Please consider the environment before printing this email and any attachments.
> 
> This e-mail and any attachments are intended only for the individual or company to which it is addressed and may contain information which is privileged, confidential and prohibited from disclosure or unauthorized use under applicable law. If you are not the intended recipient of this e-mail, you are hereby notified that any use, dissemination, or copying of this e-mail or the information contained in this e-mail is strictly prohibited by the sender. If you have received this transmission in error, please return the material received to the sender and delete all copies from your system.
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From testoauth55 at gmail.com  Fri Nov  2 03:28:11 2018
From: testoauth55 at gmail.com (Bruce Wings)
Date: Fri, 2 Nov 2018 12:58:11 +0530
Subject: [keycloak-user] Keycloak Javascript Adapter - Advisable to be used
	for confidential clients?
Message-ID: <CANAVTmMFV=E6OjG2RoSZFuSui9yQ8XR8BrgWJauJJLCyWYWAzA@mail.gmail.com>

I am referring to Keycloak Javascript adapter as mentioned in :
https://www.keycloak.org/docs/4.5/securing_apps/index.html#_javascript_adapter

I have a confidential client and I have downloaded keycloak-oidc.json
containing client secret. Now I am not sure how secure is it to keep this
file containing client-secret at the client side.

Am I being over concerned?

From vagelis.savvas at gmail.com  Fri Nov  2 05:09:37 2018
From: vagelis.savvas at gmail.com (Vagelis Savvas)
Date: Fri, 2 Nov 2018 11:09:37 +0200
Subject: [keycloak-user] Multitenant KeycloakConfigResolver
In-Reply-To: <1541134167.10131.3.camel@acutus.pro>
References: <6545e127-cf80-befc-39ca-64e33f2a3232@gmail.com>
	<1541134167.10131.3.camel@acutus.pro>
Message-ID: <2c40a114-7d04-ec2f-1887-860c220e5585@gmail.com>

Hello Dmitry,
thanx for the reply.
Currently I do indeed just return a new KeycloakDeployment() as you suggest.
This approach may stop working though, take a look at [1].
That said, I don't know if this code will be eventually included in 
Keycloak.

Cheers,
Vagelis

On 02/11/2018 06:49, Dmitry Telegin wrote:
> Hello Vagelis,
>
> Please see my answer to exactly the same question: http://lists.jboss.org/pipermail/keycloak-user/2018-October/016026.html
>
> TL;DR: this is by design, but you shouldn't be worried. For unsecured URLs you can simply return new KeycloakDeployment() from your resolver.
>
> Cheers,
> Dmitry Telegin
> CTO, Acutus s.r.o.
> Keycloak Consulting and Training
>
> Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
> +42 (022) 888-30-71
> E-mail: info at acutus.pro
>
> On Tue, 2018-10-30 at 09:19 +0200, Vagelis Savvas wrote:
>> Hello,
>>
>> in a multitenant app on Wildfly 14.0.1 with a bearer-only REST API to
>> protect I would like some URLs
>> to not be secured. So I would like my custom KeycloakConfigResolver
>> implementation
>> to not be called when those URLs are hit but it is. The reason I don't
>> want my KeycloakConfigResolver to be called is simply because
>> I have no clue as to what to return in that case: its a non-secured REST
>> endpoint so a Keycloak realm doesn't make sense in my understanding.
>> My setup follows the docs: I've installed the adapter for Wildfly and
>> the web.xml has the necessary setup for not securing some URLs (no
>> auth-constraint for those URLs)
>> Also in jboss-web.xml the security-domain element isn't defined,
>> although I don't know if that plays any role.
>> My final goal is to have some URLs secured by using the JBoss specific
>> @SecurityDomain and the standard @RolesAllowed etc annotations.
>> Can you please shed some light on this matter? I'd greatly appreciate
>> any detailed explanation of the mechanisms involved in this area.
>>
>> Cheers,
>> Vagelis
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user


From geoff at opticks.io  Fri Nov  2 05:32:00 2018
From: geoff at opticks.io (Geoffrey Cleaves)
Date: Fri, 2 Nov 2018 10:32:00 +0100
Subject: [keycloak-user] keycloak-gatekeeper bearer-only
In-Reply-To: <146EC91A-1009-4042-B839-25210CE33BD1@gmail.com>
References: <146EC91A-1009-4042-B839-25210CE33BD1@gmail.com>
Message-ID: <CAHzT=q9GpS4a17K+H4T4=gRwExHF9QZWE38Ywuf=K1SC+mq_+w@mail.gmail.com>

Hi Eric,

I'm a beginner like you so please consider my responses accordingly.

1. Often your scenario is similar to a front end app accessing the REST
API. You can find an example of how to do this here:
https://www.keycloak.org/docs/latest/securing_apps/index.html#_javascript_adapter.
First the user logs in to the front end app, which gets the token and uses
it for calls to the backend. IMPORTANT: You need to include the backend's
client id in the front end's aud claim:
https://bitbucket.org/snippets/gcleaves/5ebB58/sso-keycloak#file-notes.md

Another hurdle you might find using Gatekeeper in this AJAX setup is CORS.
I believe Gatekeeper has a bug and isn't sending the correct headers:
https://issues.jboss.org/browse/KEYCLOAK-8722

2. I have the same question as you. After reading the docs, I think the
answer is NO. If your back end stack does not have a Keycloak adapter (are
you using PHP like me?) then you would have to do all the UMA calls
"manually". There are UMA2 specifications out there which would guide us,
but I think it's a lot of work. There's also the Gluu oxd
<https://gluu.org/docs/oxd/> project which seems similar to Keycloak
Gatekeeper, but I doubt oxd is interoperable with Keycloak.

3. I think that normally a REST service should work with a bearer only
client, which expects the token and does not do authentication redirection.
You could instruct your API consumers to get the token directly from
Keycloak (using a confidential client?) before hitting your Gatekeeper
endpoint. Once again, keep in mind that by default the token retrieved from
one client won't work to hit a different client unless you set up the aud
claim properly.

Hopefully an expert will join and correct me.

Regards,
Geoffrey Cleaves







On Wed, 31 Oct 2018 at 23:00, Eric Boyd Ramirez <eric.ramirez.sv at gmail.com>
wrote:

> Dear All,
> I am trying to test Keycloak-gatekeeper, have read the docs I could find
> (keaycloak-proxy as well) but I still have a few questions:
>
> 1- I am trying to secure a number of REST APIs, configured behind
> bearer-only clients. I think I need to first get a access token trough a
> confidential client using a 'grant-type=password' request and then do a
> second request to the REST client resource. Is this the right approach, how
> would I implement this using Keycloak-Gatekeeper?.
>
> 2- Keycloak-Gatekeeper uses uri->methods->roles to manage resource access.
> Is there a way to use Keycloak's authorization settings to manage access to
> a client's resource  (i.e. policies, permissions, uma-ticket, etc.)?
>
> 3- How do I set up multiple clients, do I have to run and configure
> separate instances of Keycloak-Gatekeeper?
>
> Thanks in advance for your time and help.
>
> Regards,
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

From vagelis.savvas at gmail.com  Fri Nov  2 05:42:44 2018
From: vagelis.savvas at gmail.com (Vagelis Savvas)
Date: Fri, 2 Nov 2018 11:42:44 +0200
Subject: [keycloak-user] Multitenant KeycloakConfigResolver
In-Reply-To: <2c40a114-7d04-ec2f-1887-860c220e5585@gmail.com>
References: <6545e127-cf80-befc-39ca-64e33f2a3232@gmail.com>
	<1541134167.10131.3.camel@acutus.pro>
	<2c40a114-7d04-ec2f-1887-860c220e5585@gmail.com>
Message-ID: <135fae93-f0a1-6bf7-51cd-58016c0be0bf@gmail.com>

And the [1] as promised :-)

https://github.com/keycloak/keycloak/blob/master/adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/PreAuthActionsHandler.java#L63

On 02/11/2018 11:09, Vagelis Savvas wrote:
> Hello Dmitry,
> thanx for the reply.
> Currently I do indeed just return a new KeycloakDeployment() as you 
> suggest.
> This approach may stop working though, take a look at [1].
> That said, I don't know if this code will be eventually included in 
> Keycloak.
>
> Cheers,
> Vagelis
>
> On 02/11/2018 06:49, Dmitry Telegin wrote:
>> Hello Vagelis,
>>
>> Please see my answer to exactly the same question: 
>> http://lists.jboss.org/pipermail/keycloak-user/2018-October/016026.html
>>
>> TL;DR: this is by design, but you shouldn't be worried. For unsecured 
>> URLs you can simply return new KeycloakDeployment() from your resolver.
>>
>> Cheers,
>> Dmitry Telegin
>> CTO, Acutus s.r.o.
>> Keycloak Consulting and Training
>>
>> Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
>> +42 (022) 888-30-71
>> E-mail: info at acutus.pro
>>
>> On Tue, 2018-10-30 at 09:19 +0200, Vagelis Savvas wrote:
>>> Hello,
>>>
>>> in a multitenant app on Wildfly 14.0.1 with a bearer-only REST API to
>>> protect I would like some URLs
>>> to not be secured. So I would like my custom KeycloakConfigResolver
>>> implementation
>>> to not be called when those URLs are hit but it is. The reason I don't
>>> want my KeycloakConfigResolver to be called is simply because
>>> I have no clue as to what to return in that case: its a non-secured 
>>> REST
>>> endpoint so a Keycloak realm doesn't make sense in my understanding.
>>> My setup follows the docs: I've installed the adapter for Wildfly and
>>> the web.xml has the necessary setup for not securing some URLs (no
>>> auth-constraint for those URLs)
>>> Also in jboss-web.xml the security-domain element isn't defined,
>>> although I don't know if that plays any role.
>>> My final goal is to have some URLs secured by using the JBoss specific
>>> @SecurityDomain and the standard @RolesAllowed etc annotations.
>>> Can you please shed some light on this matter? I'd greatly appreciate
>>> any detailed explanation of the mechanisms involved in this area.
>>>
>>> Cheers,
>>> Vagelis
>>> _______________________________________________
>>> keycloak-user mailing list
>>> keycloak-user at lists.jboss.org
>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>


From ronald.demneri at amdtia.com  Fri Nov  2 06:30:39 2018
From: ronald.demneri at amdtia.com (Ronald Demneri)
Date: Fri, 2 Nov 2018 10:30:39 +0000
Subject: [keycloak-user] filter group claim in token per client
Message-ID: <VI1PR0402MB3696E4DCAFFE7EEEEB0EAF70E9CF0@VI1PR0402MB3696.eurprd04.prod.outlook.com>

Hello everyone,

Is there a way to filter the groups a user is a member of per client, based on clientId (which is part of the group name(s) in AD). Let's say that user Ronald is member of  group_client1, group_client2 and group_client3, so using a group mapper, the token will contain a claim like group:["group_client1", "group_client2", "group_client3"]. Upon logging in to client1 app, I want to customize the group claim so that it contains only the respective group_client1 value.

Thanks in advance,

Ronald

From bruno at abstractj.org  Fri Nov  2 11:05:34 2018
From: bruno at abstractj.org (Bruno Oliveira)
Date: Fri, 2 Nov 2018 12:05:34 -0300
Subject: [keycloak-user] keycloak-gatekeeper bearer-only
In-Reply-To: <146EC91A-1009-4042-B839-25210CE33BD1@gmail.com>
References: <146EC91A-1009-4042-B839-25210CE33BD1@gmail.com>
Message-ID: <CAM5SUC7Pe2bhtJ9=o0DGhjg=Z4wxtp+-WaSVAgL+wxD_036t8Q@mail.gmail.com>

Hi Eric, we're still polishing the docs and fixing some high priority
issues. The README files and the docs will change in the next release.
Few answers inline.

On Wed, Oct 31, 2018 at 6:57 PM Eric Boyd Ramirez
<eric.ramirez.sv at gmail.com> wrote:
>
> Dear All,
> I am trying to test Keycloak-gatekeeper, have read the docs I could find (keaycloak-proxy as well) but I still have a few questions:
>
> 1- I am trying to secure a number of REST APIs, configured behind bearer-only clients. I think I need to first get a access token trough a confidential client using a 'grant-type=password' request and then do a second request to the REST client resource. Is this the right approach, how would I implement this using Keycloak-Gatekeeper?.

I believe Geoffrey answered already. But I hope to include your
scenario to the quickstarts too.

>
> 2- Keycloak-Gatekeeper uses uri->methods->roles to manage resource access. Is there a way to use Keycloak's authorization settings to manage access to a client's resource  (i.e. policies, permissions, uma-ticket, etc.)?

Not at the moment, as far as I can tell. But I would appreciate if you
file a feature request. In this way we don't miss this.

>
> 3- How do I set up multiple clients, do I have to run and configure separate instances of Keycloak-Gatekeeper?

Yes, you have to configure and run multiple instances. Gatekeeper is
more like a sidecar, instead of a proxy.

>
> Thanks in advance for your time and help.
>
> Regards,
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user



-- 
- abstractj


From bruno at abstractj.org  Fri Nov  2 11:12:38 2018
From: bruno at abstractj.org (Bruno Oliveira)
Date: Fri, 2 Nov 2018 12:12:38 -0300
Subject: [keycloak-user] keycloak-gatekeeper bearer-only
In-Reply-To: <CAHzT=q9GpS4a17K+H4T4=gRwExHF9QZWE38Ywuf=K1SC+mq_+w@mail.gmail.com>
References: <146EC91A-1009-4042-B839-25210CE33BD1@gmail.com>
	<CAHzT=q9GpS4a17K+H4T4=gRwExHF9QZWE38Ywuf=K1SC+mq_+w@mail.gmail.com>
Message-ID: <CAM5SUC5wmRqkQCRw10fsfexMt5Kn6nKi4MxLez2NKpagZP6t2A@mail.gmail.com>

Hi Geoffrey,

On Fri, Nov 2, 2018 at 6:34 AM Geoffrey Cleaves <geoff at opticks.io> wrote:
>
> Hi Eric,
>
> I'm a beginner like you so please consider my responses accordingly.
>
> 1. Often your scenario is similar to a front end app accessing the REST
> API. You can find an example of how to do this here:
> https://www.keycloak.org/docs/latest/securing_apps/index.html#_javascript_adapter.
> First the user logs in to the front end app, which gets the token and uses
> it for calls to the backend. IMPORTANT: You need to include the backend's
> client id in the front end's aud claim:
> https://bitbucket.org/snippets/gcleaves/5ebB58/sso-keycloak#file-notes.md
>
> Another hurdle you might find using Gatekeeper in this AJAX setup is CORS.
> I believe Gatekeeper has a bug and isn't sending the correct headers:
> https://issues.jboss.org/browse/KEYCLOAK-8722
>
> 2. I have the same question as you. After reading the docs, I think the
> answer is NO. If your back end stack does not have a Keycloak adapter (are
> you using PHP like me?) then you would have to do all the UMA calls
> "manually". There are UMA2 specifications out there which would guide us,
> but I think it's a lot of work. There's also the Gluu oxd
> <https://gluu.org/docs/oxd/> project which seems similar to Keycloak
> Gatekeeper, but I doubt oxd is interoperable with Keycloak.

You are correct about this. It's a lot of work :) But nothing stops us
from planning an capture it on Jiras.
Feel free to do this if possible.

>
> 3. I think that normally a REST service should work with a bearer only
> client, which expects the token and does not do authentication redirection.
> You could instruct your API consumers to get the token directly from
> Keycloak (using a confidential client?) before hitting your Gatekeeper
> endpoint. Once again, keep in mind that by default the token retrieved from
> one client won't work to hit a different client unless you set up the aud
> claim properly.

Like I mentioned to Eric, the scope of gatekeeper is to act more as
sidecar, instead of a proxy. So you pretty
much need to deploy one gatekeeper per client.

>
> Hopefully an expert will join and correct me.
>
> Regards,
> Geoffrey Cleaves
>
>
>
>
>
>
>
> On Wed, 31 Oct 2018 at 23:00, Eric Boyd Ramirez <eric.ramirez.sv at gmail.com>
> wrote:
>
> > Dear All,
> > I am trying to test Keycloak-gatekeeper, have read the docs I could find
> > (keaycloak-proxy as well) but I still have a few questions:
> >
> > 1- I am trying to secure a number of REST APIs, configured behind
> > bearer-only clients. I think I need to first get a access token trough a
> > confidential client using a 'grant-type=password' request and then do a
> > second request to the REST client resource. Is this the right approach, how
> > would I implement this using Keycloak-Gatekeeper?.
> >
> > 2- Keycloak-Gatekeeper uses uri->methods->roles to manage resource access.
> > Is there a way to use Keycloak's authorization settings to manage access to
> > a client's resource  (i.e. policies, permissions, uma-ticket, etc.)?
> >
> > 3- How do I set up multiple clients, do I have to run and configure
> > separate instances of Keycloak-Gatekeeper?
> >
> > Thanks in advance for your time and help.
> >
> > Regards,
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
> >
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user



-- 
- abstractj

From bruno at abstractj.org  Fri Nov  2 11:14:24 2018
From: bruno at abstractj.org (Bruno Oliveira)
Date: Fri, 2 Nov 2018 12:14:24 -0300
Subject: [keycloak-user] Keycloak Gatekeeper CORS problem
In-Reply-To: <CAHzT=q-xo3HHSmw+xXJdFc9pJKD0KNsqJpjVxAQm7ZusBme-pg@mail.gmail.com>
References: <CAHzT=q-xo3HHSmw+xXJdFc9pJKD0KNsqJpjVxAQm7ZusBme-pg@mail.gmail.com>
Message-ID: <CAM5SUC6Ts=SORostOEoiztB3m+R4_xBk2BJY1oswJMWnzYKw5g@mail.gmail.com>

Thanks for reporting this Geoffrey. I marked you Jira issue for
triage, in this way we can investigate better.
On Wed, Oct 31, 2018 at 2:08 PM Geoffrey Cleaves <geoff at opticks.io> wrote:
>
> I'm having a problem accessing a REST service protected by Gatekeeper via
> AJAX. I have tried many different combinations of settings in the config
> file to no avail. I suspect the Gatekeeper has a bug.
>
> I can access the protected endpoint directly (via Gatekeeper) with no issue
> as there is no CORS. I can use the AJAX method successfully when I use a
> Chrome plugin to enable CORS for these endpoints.
>
> The message from Chrome is:
>
> Access to XMLHttpRequest at 'http://domain.com:3001/endpoint.php' from
> origin 'http://domain2.com:8888' has been blocked by CORS policy: Response
> to preflight request doesn't pass access control check: No
> 'Access-Control-Allow-Origin' header is present on the requested resource.
>
> I see that Chrome only sends an OPTIONS request to Gatekeeper, which does
> not respond with a Access-Control-Allow-Origin header at all, despite my
> config settings below.
>
>
> My config.yml file looks like this:
>
> client-id: {id}
> client-secret: {secret}
> discovery-url: {keyclock end point}
> enable-default-deny: true
> encryption_key: {32characters}
> listen: 0.0.0.0:3000
> redirection-url: http://domain2.com:3001
> upstream-url: http://localhost:8888
> secure-cookie: false
> verbose: true
> #preserve-host: true
> resources:
> - uri: /admin*
>   methods:
>   - GET
>   roles:
>   - test-php-api:test1
>   - client:test2
>   require-any-role: true
>   groups:
>   - admins
>   - users
> - uri: /endpoint.php
>   roles:
>   - test-php-api:test1
> - uri: /backend*
>   roles:
>   - test-php-api:test1
> - uri: /public/*
>   white-listed: true
> - uri: /favicon
>   white-listed: true
> - uri: /css/*
>   white-listed: true
> - uri: /img/*
>   white-listed: true
> cors-origins:
> - '*'
> cors-methods:
> - GET
> - POST
>
>
> Any ideas?
>
> Geoff
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user



-- 
- abstractj

From psilva at redhat.com  Fri Nov  2 11:27:40 2018
From: psilva at redhat.com (Pedro Igor Silva)
Date: Fri, 2 Nov 2018 12:27:40 -0300
Subject: [keycloak-user] keycloak-gatekeeper bearer-only
In-Reply-To: <CAHzT=q9GpS4a17K+H4T4=gRwExHF9QZWE38Ywuf=K1SC+mq_+w@mail.gmail.com>
References: <146EC91A-1009-4042-B839-25210CE33BD1@gmail.com>
	<CAHzT=q9GpS4a17K+H4T4=gRwExHF9QZWE38Ywuf=K1SC+mq_+w@mail.gmail.com>
Message-ID: <CAJrcDBfMXo5Pk8P=_JN6enCEZ_CXrv1DYVxcvWTA59zdVY98ig@mail.gmail.com>

On Fri, Nov 2, 2018 at 6:36 AM Geoffrey Cleaves <geoff at opticks.io> wrote:

> Hi Eric,
>
> I'm a beginner like you so please consider my responses accordingly.
>
> 1. Often your scenario is similar to a front end app accessing the REST
> API. You can find an example of how to do this here:
>
> https://www.keycloak.org/docs/latest/securing_apps/index.html#_javascript_adapter
> .
> First the user logs in to the front end app, which gets the token and uses
> it for calls to the backend. IMPORTANT: You need to include the backend's
> client id in the front end's aud claim:
> https://bitbucket.org/snippets/gcleaves/5ebB58/sso-keycloak#file-notes.md
>
> Another hurdle you might find using Gatekeeper in this AJAX setup is CORS.
> I believe Gatekeeper has a bug and isn't sending the correct headers:
> https://issues.jboss.org/browse/KEYCLOAK-8722
>
> 2. I have the same question as you. After reading the docs, I think the
> answer is NO. If your back end stack does not have a Keycloak adapter (are
> you using PHP like me?) then you would have to do all the UMA calls
> "manually". There are UMA2 specifications out there which would guide us,
> but I think it's a lot of work. There's also the Gluu oxd
> <https://gluu.org/docs/oxd/> project which seems similar to Keycloak
> Gatekeeper, but I doubt oxd is interoperable with Keycloak.
>

Yes, it is. We did recently a collaborative work with Gluu team to check
interoperability. In fact, they used oxd to check that both Gluu and
Keycloak ASs could be used to support UMA.


>
> 3. I think that normally a REST service should work with a bearer only
> client, which expects the token and does not do authentication redirection.
> You could instruct your API consumers to get the token directly from
> Keycloak (using a confidential client?) before hitting your Gatekeeper
> endpoint. Once again, keep in mind that by default the token retrieved from
> one client won't work to hit a different client unless you set up the aud
> claim properly.
>
> Hopefully an expert will join and correct me.
>
> Regards,
> Geoffrey Cleaves
>
>
>
>
>
>
>
> On Wed, 31 Oct 2018 at 23:00, Eric Boyd Ramirez <eric.ramirez.sv at gmail.com
> >
> wrote:
>
> > Dear All,
> > I am trying to test Keycloak-gatekeeper, have read the docs I could find
> > (keaycloak-proxy as well) but I still have a few questions:
> >
> > 1- I am trying to secure a number of REST APIs, configured behind
> > bearer-only clients. I think I need to first get a access token trough a
> > confidential client using a 'grant-type=password' request and then do a
> > second request to the REST client resource. Is this the right approach,
> how
> > would I implement this using Keycloak-Gatekeeper?.
> >
> > 2- Keycloak-Gatekeeper uses uri->methods->roles to manage resource
> access.
> > Is there a way to use Keycloak's authorization settings to manage access
> to
> > a client's resource  (i.e. policies, permissions, uma-ticket, etc.)?
> >
> > 3- How do I set up multiple clients, do I have to run and configure
> > separate instances of Keycloak-Gatekeeper?
> >
> > Thanks in advance for your time and help.
> >
> > Regards,
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
> >
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

From bruno at abstractj.org  Fri Nov  2 11:32:57 2018
From: bruno at abstractj.org (Bruno Oliveira)
Date: Fri, 2 Nov 2018 12:32:57 -0300
Subject: [keycloak-user] Keycloak Javascript Adapter - Advisable to be
 used for confidential clients?
In-Reply-To: <CANAVTmMFV=E6OjG2RoSZFuSui9yQ8XR8BrgWJauJJLCyWYWAzA@mail.gmail.com>
References: <CANAVTmMFV=E6OjG2RoSZFuSui9yQ8XR8BrgWJauJJLCyWYWAzA@mail.gmail.com>
Message-ID: <CAM5SUC4MGxD-yQPvmpspyijp7OTpjrB5VKSA6A-zk28=Zkhyog@mail.gmail.com>

I believe you're missing an important step from the docs. The docs
state that Javascript clients should be configured as public clients.
I don't think it's a good idea to store client secret into web apps,
it's really unsafe.

On Fri, Nov 2, 2018 at 4:28 AM Bruce Wings <testoauth55 at gmail.com> wrote:
>
> I am referring to Keycloak Javascript adapter as mentioned in :
> https://www.keycloak.org/docs/4.5/securing_apps/index.html#_javascript_adapter
>
> I have a confidential client and I have downloaded keycloak-oidc.json
> containing client secret. Now I am not sure how secure is it to keep this
> file containing client-secret at the client side.
>
> Am I being over concerned?
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user



-- 
- abstractj

From geoff at opticks.io  Fri Nov  2 11:35:49 2018
From: geoff at opticks.io (Geoffrey Cleaves)
Date: Fri, 2 Nov 2018 16:35:49 +0100
Subject: [keycloak-user] Ability for users to manage their own resources
Message-ID: <CAHzT=q8aBaFc7UFcmee8a_GgX73H4wFxDV4KbUeE7jGAixF1Ow@mail.gmail.com>

How can we enable the ability for users to manage their own resources as
described in section *8.3.3. Managing Access to Users Resources* at this
link
https://www.keycloak.org/docs/latest/authorization_services/index.html#_service_user_managed_access
? This picture looks so nice :
https://www.keycloak.org/docs/latest/authorization_services/keycloak-images/service/account-my-resource.png

I am using a confidential client with Authorization enabled on Keycloak
4.5.0 Final. I have used the UMA2 endpoints directly to create a resource
owned by a user, yet that user (me :) can't see the My Resources screen.

Any help is appreciated!

Geoff

From ulrik.sjolin at gmail.com  Fri Nov  2 11:39:44 2018
From: ulrik.sjolin at gmail.com (=?UTF-8?Q?Ulrik_Sj=C3=B6lin?=)
Date: Sat, 3 Nov 2018 00:39:44 +0900
Subject: [keycloak-user] Bug? Shared UMA resource not accessible
Message-ID: <CAP5c5mS9gtmLRRHGY3HDDM4zsYRkMuuKVACKCW4J0VtstdDC4g@mail.gmail.com>

Hello there,

I wonder if anyone is experiencing this problem and if anyone out
there has a workaround (I am running 4.5.0).

The problem I have comes up in a really simple situation:
JDoe has 1 resource (JDoeResource) that he shares with Alice (scope:
JDoeScope).

Alice tries to access that resource with
permission=JDoeResource#JDoeScope. This fails with a ?400 bad request?
when
it should return the resource in question. I wonder if this is
[KEYCLOAK-8448] that I am seeing.

When alice tries to access the resource with
permission=<JDoeResource-ID>#JDoeScope or by just specifying
permission=#JDoeScope
everything works fine.

Below there is a small script that recreates and demonstrates the problem.

Any help in this matter would be greatly appreciated.

Best Regards,

Ulrik Sj?lin


In order to run the script below you need to have the tools ?jwt-cli?
and ?jq? installed.

#!/bin/bash
export host=keycloak
export port=8080
export realm=myrealm
export resource_server_client_id=my-service
export resource_server_client_secret=88888888-8888-8888-8888-888888888888
export username=alice
export password=alice
export resource_owner=jdoe
export resource_name=JDoeResource
export scope=JDoeScope

export access_token=\
`curl --silent \
http://${host}:${port}/auth/realms/${realm}/protocol/openid-connect/token \
-d client_id=${resource_server_client_id} \
-d client_secret=${resource_server_client_secret} \
-d username=${username} \
-d password=${password} \
-d grant_type=password \
| jq -r ".access_token"`

export result=\
`curl --silent -X GET \
http://${host}:${port}/auth/realms/${realm}/authz/protection/resource_set?name=${resource_name}
\
-H "Authorization: Bearer ${access_token}" \
| jq -r ".[0]"`

if [ "$result" = "null" ]; then
export new_id=`curl --silent -X POST \
http://${host}:${port}/auth/realms/${realm}/authz/protection/resource_set \
-H "content-type: application/json" \
-H "Authorization: Bearer ${access_token}" \
--data @<(cat <{
"name":"${resource_name}",
"type":"Entities",
"owner":"${resource_owner}",
"ownerManagedAccess":"true",
"resource_scopes":["JDoeScope"]
}
EOF
) | jq -r "._id"`

echo "Created resource with id: ${new_id}"
echo "Log in with user ${resource_owner} into keycloak"
echo "and share ${resource_name} with ${username}"
echo "When that is done, run this script again"
else
echo "Found resource with id: ${result}"
resource_id=$result
fi

export result=\
`curl --silent -X POST \
http://${host}:${port}/auth/realms/${realm}/protocol/openid-connect/token \
-H "Authorization: Bearer ${access_token}" \
--data "grant_type=urn:ietf:params:oauth:grant-type:uma-ticket" \
--data "audience=${resource_server_client_id}" \
--data "permission=#${scope}" \
| jq -r ".access_token"`

export result=`jwt $result | grep ${resource_name}`
echo "permission=#${scope}: ${result}"

export result=\
`curl --silent -X POST \
http://${host}:${port}/auth/realms/${realm}/protocol/openid-connect/token \
-H "Authorization: Bearer ${access_token}" \
--data "grant_type=urn:ietf:params:oauth:grant-type:uma-ticket" \
--data "audience=${resource_server_client_id}" \
--data "permission=${resource_id}#${scope}" \
| jq -r ".access_token"`

export result=`jwt $result | grep ${resource_name}`
echo "permission=${resource_id}#${scope}: $result"

export result=\
`curl --silent -X POST \
http://${host}:${port}/auth/realms/${realm}/protocol/openid-connect/token \
-H "Authorization: Bearer ${access_token}" \
--data "grant_type=urn:ietf:params:oauth:grant-type:uma-ticket" \
--data "audience=${resource_server_client_id}" \
--data "permission=${resource_name}#${scope}" \
| jq -r ".access_token"`

export result=`jwt $result | grep ${resource_name}`
echo "permission=${resource_name}#${scope}: ${result}"


From psilva at redhat.com  Fri Nov  2 11:45:27 2018
From: psilva at redhat.com (Pedro Igor Silva)
Date: Fri, 2 Nov 2018 12:45:27 -0300
Subject: [keycloak-user] Ability for users to manage their own resources
In-Reply-To: <CAHzT=q8aBaFc7UFcmee8a_GgX73H4wFxDV4KbUeE7jGAixF1Ow@mail.gmail.com>
References: <CAHzT=q8aBaFc7UFcmee8a_GgX73H4wFxDV4KbUeE7jGAixF1Ow@mail.gmail.com>
Message-ID: <CAJrcDBe2H7kxM0P=6Xp6Lo3OVFmQ4LckVAWjKghDS+eBd2+BRA@mail.gmail.com>

Hi,

We should highlight this in docs, but "open the realm settings page in
Keycloak Administration Console and enable the User-Managed Access switch".

Regards.
Pedro Igor

On Fri, Nov 2, 2018 at 12:42 PM Geoffrey Cleaves <geoff at opticks.io> wrote:

> How can we enable the ability for users to manage their own resources as
> described in section *8.3.3. Managing Access to Users Resources* at this
> link
>
> https://www.keycloak.org/docs/latest/authorization_services/index.html#_service_user_managed_access
> ? This picture looks so nice :
>
> https://www.keycloak.org/docs/latest/authorization_services/keycloak-images/service/account-my-resource.png
>
> I am using a confidential client with Authorization enabled on Keycloak
> 4.5.0 Final. I have used the UMA2 endpoints directly to create a resource
> owned by a user, yet that user (me :) can't see the My Resources screen.
>
> Any help is appreciated!
>
> Geoff
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

From psilva at redhat.com  Fri Nov  2 11:50:11 2018
From: psilva at redhat.com (Pedro Igor Silva)
Date: Fri, 2 Nov 2018 12:50:11 -0300
Subject: [keycloak-user] Ability for users to manage their own resources
In-Reply-To: <CAHzT=q8aBaFc7UFcmee8a_GgX73H4wFxDV4KbUeE7jGAixF1Ow@mail.gmail.com>
References: <CAHzT=q8aBaFc7UFcmee8a_GgX73H4wFxDV4KbUeE7jGAixF1Ow@mail.gmail.com>
Message-ID: <CAJrcDBcOwJy46fWpGLFAeQZiuj9fs9rSF5jS8NH5xSkZjO+jhg@mail.gmail.com>

Btw, I know we can improve that page and that was the initial version we
wanted to push to our community. Please, let us know your ideas that could
improve UX.

There is some work going on with v2 of Account Service that is much neater,
hope to get back to this task soon...

On Fri, Nov 2, 2018 at 12:42 PM Geoffrey Cleaves <geoff at opticks.io> wrote:

> How can we enable the ability for users to manage their own resources as
> described in section *8.3.3. Managing Access to Users Resources* at this
> link
>
> https://www.keycloak.org/docs/latest/authorization_services/index.html#_service_user_managed_access
> ? This picture looks so nice :
>
> https://www.keycloak.org/docs/latest/authorization_services/keycloak-images/service/account-my-resource.png
>
> I am using a confidential client with Authorization enabled on Keycloak
> 4.5.0 Final. I have used the UMA2 endpoints directly to create a resource
> owned by a user, yet that user (me :) can't see the My Resources screen.
>
> Any help is appreciated!
>
> Geoff
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

From psilva at redhat.com  Fri Nov  2 11:53:20 2018
From: psilva at redhat.com (Pedro Igor Silva)
Date: Fri, 2 Nov 2018 12:53:20 -0300
Subject: [keycloak-user] Bug? Shared UMA resource not accessible
In-Reply-To: <CAP5c5mS9gtmLRRHGY3HDDM4zsYRkMuuKVACKCW4J0VtstdDC4g@mail.gmail.com>
References: <CAP5c5mS9gtmLRRHGY3HDDM4zsYRkMuuKVACKCW4J0VtstdDC4g@mail.gmail.com>
Message-ID: <CAJrcDBcoBJ5=A9c3x0dSefT_s4-52ScN_th6Ej2Re3nAf6FB3w@mail.gmail.com>

Hi,

For UMA protected resources you should use the resource id within the
"permission" parameter. The reason being that the server could not infer
the correct resource based on the name. Another option is using the regular
UMA flow with permission tickets.

Regards.
Pedro Igor

On Fri, Nov 2, 2018 at 12:49 PM Ulrik Sj?lin <ulrik.sjolin at gmail.com> wrote:

> Hello there,
>
> I wonder if anyone is experiencing this problem and if anyone out
> there has a workaround (I am running 4.5.0).
>
> The problem I have comes up in a really simple situation:
> JDoe has 1 resource (JDoeResource) that he shares with Alice (scope:
> JDoeScope).
>
> Alice tries to access that resource with
> permission=JDoeResource#JDoeScope. This fails with a ?400 bad request?
> when
> it should return the resource in question. I wonder if this is
> [KEYCLOAK-8448] that I am seeing.
>
> When alice tries to access the resource with
> permission=<JDoeResource-ID>#JDoeScope or by just specifying
> permission=#JDoeScope
> everything works fine.
>
> Below there is a small script that recreates and demonstrates the problem.
>
> Any help in this matter would be greatly appreciated.
>
> Best Regards,
>
> Ulrik Sj?lin
>
>
> In order to run the script below you need to have the tools ?jwt-cli?
> and ?jq? installed.
>
> #!/bin/bash
> export host=keycloak
> export port=8080
> export realm=myrealm
> export resource_server_client_id=my-service
> export resource_server_client_secret=88888888-8888-8888-8888-888888888888
> export username=alice
> export password=alice
> export resource_owner=jdoe
> export resource_name=JDoeResource
> export scope=JDoeScope
>
> export access_token=\
> `curl --silent \
> http://${host}:${port}/auth/realms/${realm}/protocol/openid-connect/token
> \
> -d client_id=${resource_server_client_id} \
> -d client_secret=${resource_server_client_secret} \
> -d username=${username} \
> -d password=${password} \
> -d grant_type=password \
> | jq -r ".access_token"`
>
> export result=\
> `curl --silent -X GET \
> http://
> ${host}:${port}/auth/realms/${realm}/authz/protection/resource_set?name=${resource_name}
> \
> -H "Authorization: Bearer ${access_token}" \
> | jq -r ".[0]"`
>
> if [ "$result" = "null" ]; then
> export new_id=`curl --silent -X POST \
> http://${host}:${port}/auth/realms/${realm}/authz/protection/resource_set
> \
> -H "content-type: application/json" \
> -H "Authorization: Bearer ${access_token}" \
> --data @<(cat <{
> "name":"${resource_name}",
> "type":"Entities",
> "owner":"${resource_owner}",
> "ownerManagedAccess":"true",
> "resource_scopes":["JDoeScope"]
> }
> EOF
> ) | jq -r "._id"`
>
> echo "Created resource with id: ${new_id}"
> echo "Log in with user ${resource_owner} into keycloak"
> echo "and share ${resource_name} with ${username}"
> echo "When that is done, run this script again"
> else
> echo "Found resource with id: ${result}"
> resource_id=$result
> fi
>
> export result=\
> `curl --silent -X POST \
> http://${host}:${port}/auth/realms/${realm}/protocol/openid-connect/token
> \
> -H "Authorization: Bearer ${access_token}" \
> --data "grant_type=urn:ietf:params:oauth:grant-type:uma-ticket" \
> --data "audience=${resource_server_client_id}" \
> --data "permission=#${scope}" \
> | jq -r ".access_token"`
>
> export result=`jwt $result | grep ${resource_name}`
> echo "permission=#${scope}: ${result}"
>
> export result=\
> `curl --silent -X POST \
> http://${host}:${port}/auth/realms/${realm}/protocol/openid-connect/token
> \
> -H "Authorization: Bearer ${access_token}" \
> --data "grant_type=urn:ietf:params:oauth:grant-type:uma-ticket" \
> --data "audience=${resource_server_client_id}" \
> --data "permission=${resource_id}#${scope}" \
> | jq -r ".access_token"`
>
> export result=`jwt $result | grep ${resource_name}`
> echo "permission=${resource_id}#${scope}: $result"
>
> export result=\
> `curl --silent -X POST \
> http://${host}:${port}/auth/realms/${realm}/protocol/openid-connect/token
> \
> -H "Authorization: Bearer ${access_token}" \
> --data "grant_type=urn:ietf:params:oauth:grant-type:uma-ticket" \
> --data "audience=${resource_server_client_id}" \
> --data "permission=${resource_name}#${scope}" \
> | jq -r ".access_token"`
>
> export result=`jwt $result | grep ${resource_name}`
> echo "permission=${resource_name}#${scope}: ${result}"
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From geoff at opticks.io  Fri Nov  2 11:54:00 2018
From: geoff at opticks.io (Geoffrey Cleaves)
Date: Fri, 2 Nov 2018 16:54:00 +0100
Subject: [keycloak-user] keycloak-gatekeeper bearer-only
In-Reply-To: <CAJrcDBfMXo5Pk8P=_JN6enCEZ_CXrv1DYVxcvWTA59zdVY98ig@mail.gmail.com>
References: <146EC91A-1009-4042-B839-25210CE33BD1@gmail.com>
	<CAHzT=q9GpS4a17K+H4T4=gRwExHF9QZWE38Ywuf=K1SC+mq_+w@mail.gmail.com>
	<CAJrcDBfMXo5Pk8P=_JN6enCEZ_CXrv1DYVxcvWTA59zdVY98ig@mail.gmail.com>
Message-ID: <CAHzT=q8tECWhNDtD28Jux48JJn8GUaRftsjVumqjbVjMO_L-Og@mail.gmail.com>

"Yes, it is. We did recently a collaborative work with Gluu team to check
interoperability. In fact, they used oxd to check that both Gluu and
Keycloak ASs could be used to support UMA."

That's very interesting, Pedro. oxd does appear have PHP adapters. In your
opinion, is it viable to use oxd as the missing Keycloak PHP adapter?

On Fri, 2 Nov 2018 at 16:27, Pedro Igor Silva <psilva at redhat.com> wrote:

>
>
>
>>
>>
> Yes, it is. We did recently a collaborative work with Gluu team to check
> interoperability. In fact, they used oxd to check that both Gluu and
> Keycloak ASs could be used to support UMA.
>
>
>>
>> 3. I think that normally a REST service should work with a bearer only
>> client, which expects the token and does not do authentication
>> redirection.
>> You could instruct your API consumers to get the token directly from
>> Keycloak (using a confidential client?) before hitting your Gatekeeper
>> endpoint. Once again, keep in mind that by default the token retrieved
>> from
>> one client won't work to hit a different client unless you set up the aud
>> claim properly.
>>
>> Hopefully an expert will join and correct me.
>>
>> Regards,
>> Geoffrey Cleaves
>>
>>
>>
>>
>>
>>
>>
>> On Wed, 31 Oct 2018 at 23:00, Eric Boyd Ramirez <
>> eric.ramirez.sv at gmail.com>
>> wrote:
>>
>> > Dear All,
>> > I am trying to test Keycloak-gatekeeper, have read the docs I could find
>> > (keaycloak-proxy as well) but I still have a few questions:
>> >
>> > 1- I am trying to secure a number of REST APIs, configured behind
>> > bearer-only clients. I think I need to first get a access token trough a
>> > confidential client using a 'grant-type=password' request and then do a
>> > second request to the REST client resource. Is this the right approach,
>> how
>> > would I implement this using Keycloak-Gatekeeper?.
>> >
>> > 2- Keycloak-Gatekeeper uses uri->methods->roles to manage resource
>> access.
>> > Is there a way to use Keycloak's authorization settings to manage
>> access to
>> > a client's resource  (i.e. policies, permissions, uma-ticket, etc.)?
>> >
>> > 3- How do I set up multiple clients, do I have to run and configure
>> > separate instances of Keycloak-Gatekeeper?
>> >
>> > Thanks in advance for your time and help.
>> >
>> > Regards,
>> > _______________________________________________
>> > keycloak-user mailing list
>> > keycloak-user at lists.jboss.org
>> > https://lists.jboss.org/mailman/listinfo/keycloak-user
>> >
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>

From testoauth55 at gmail.com  Fri Nov  2 12:43:46 2018
From: testoauth55 at gmail.com (Bruce Wings)
Date: Fri, 2 Nov 2018 22:13:46 +0530
Subject: [keycloak-user] Keycloak Javascript Adapter - Advisable to be
 used for confidential clients?
In-Reply-To: <CAM5SUC4MGxD-yQPvmpspyijp7OTpjrB5VKSA6A-zk28=Zkhyog@mail.gmail.com>
References: <CANAVTmMFV=E6OjG2RoSZFuSui9yQ8XR8BrgWJauJJLCyWYWAzA@mail.gmail.com>
	<CAM5SUC4MGxD-yQPvmpspyijp7OTpjrB5VKSA6A-zk28=Zkhyog@mail.gmail.com>
Message-ID: <CANAVTmMuVNXtHHTBWtWiedYoe0SyxabHzpA87td3wswxtC_edA@mail.gmail.com>

Bruno,

Thanks for the reply. However, my project contains Rest Apis that I have
secured with jetty adapter and confidential client ( as keycloak
Authorization works only for confidential client and not public clients).
My angular app is accessing these rest api. Therefore I used the same
confidential client oidc Json in my angular app too.

Am I approaching the keycloak setup in a wrong way?

On Friday, November 2, 2018, Bruno Oliveira <bruno at abstractj.org> wrote:

> I believe you're missing an important step from the docs. The docs
> state that Javascript clients should be configured as public clients.
> I don't think it's a good idea to store client secret into web apps,
> it's really unsafe.
>
> On Fri, Nov 2, 2018 at 4:28 AM Bruce Wings <testoauth55 at gmail.com> wrote:
> >
> > I am referring to Keycloak Javascript adapter as mentioned in :
> > https://www.keycloak.org/docs/4.5/securing_apps/index.html#_
> javascript_adapter
> >
> > I have a confidential client and I have downloaded keycloak-oidc.json
> > containing client secret. Now I am not sure how secure is it to keep this
> > file containing client-secret at the client side.
> >
> > Am I being over concerned?
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
>
>
>
> --
> - abstractj
>

From eric.ramirez.sv at gmail.com  Fri Nov  2 12:51:39 2018
From: eric.ramirez.sv at gmail.com (Eric Boyd Ramirez)
Date: Fri, 2 Nov 2018 10:51:39 -0600
Subject: [keycloak-user] Keycloak Javascript Adapter - Advisable to be
 used for confidential clients?
In-Reply-To: <CANAVTmMFV=E6OjG2RoSZFuSui9yQ8XR8BrgWJauJJLCyWYWAzA@mail.gmail.com>
References: <CANAVTmMFV=E6OjG2RoSZFuSui9yQ8XR8BrgWJauJJLCyWYWAzA@mail.gmail.com>
Message-ID: <8E6265AD-A055-4A7A-BDFD-9AB19E834819@gmail.com>

Hi Bruce,
I am fairly new to Keycloak myself, so I am giving my opinion in hopes some else can double check. 
The JS adapter is designed to work with Public clients, siting on the the client side, the idea is that the a user/person would have to enter his/her credentials to in order to login.

Confidential clients generate an installation JSON or XML configuration object which is meant to be installed on the server side/ Application server. The user accessing this application does not receive this configuration.    

Hope this helps.

> On Nov 2, 2018, at 1:28 AM, Bruce Wings <testoauth55 at gmail.com> wrote:
> 
> I am referring to Keycloak Javascript adapter as mentioned in :
> https://www.keycloak.org/docs/4.5/securing_apps/index.html#_javascript_adapter
> 
> I have a confidential client and I have downloaded keycloak-oidc.json
> containing client secret. Now I am not sure how secure is it to keep this
> file containing client-secret at the client side.
> 
> Am I being over concerned?
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user



From eric.ramirez.sv at gmail.com  Fri Nov  2 13:23:32 2018
From: eric.ramirez.sv at gmail.com (Eric Boyd Ramirez)
Date: Fri, 2 Nov 2018 11:23:32 -0600
Subject: [keycloak-user] keycloak-gatekeeper bearer-only
In-Reply-To: <CAJrcDBfMXo5Pk8P=_JN6enCEZ_CXrv1DYVxcvWTA59zdVY98ig@mail.gmail.com>
References: <146EC91A-1009-4042-B839-25210CE33BD1@gmail.com>
	<CAHzT=q9GpS4a17K+H4T4=gRwExHF9QZWE38Ywuf=K1SC+mq_+w@mail.gmail.com>
	<CAJrcDBfMXo5Pk8P=_JN6enCEZ_CXrv1DYVxcvWTA59zdVY98ig@mail.gmail.com>
Message-ID: <F7D08E93-E513-4EE7-800D-A6AB99F4D8D4@gmail.com>

Thanks everyone for your replies, it definitely cleared things up for me. It seems that as a ?generic?  adapter Keycloak-Gatekeeper has limited functionality, its a matter of finding the right use case to take advantage of this tool.

Regards, 

> On Nov 2, 2018, at 9:27 AM, Pedro Igor Silva <psilva at redhat.com> wrote:
> 
> 
> 
> On Fri, Nov 2, 2018 at 6:36 AM Geoffrey Cleaves <geoff at opticks.io <mailto:geoff at opticks.io>> wrote:
> Hi Eric,
> 
> I'm a beginner like you so please consider my responses accordingly.
> 
> 1. Often your scenario is similar to a front end app accessing the REST
> API. You can find an example of how to do this here:
> https://www.keycloak.org/docs/latest/securing_apps/index.html#_javascript_adapter <https://www.keycloak.org/docs/latest/securing_apps/index.html#_javascript_adapter>.
> First the user logs in to the front end app, which gets the token and uses
> it for calls to the backend. IMPORTANT: You need to include the backend's
> client id in the front end's aud claim:
> https://bitbucket.org/snippets/gcleaves/5ebB58/sso-keycloak#file-notes.md <https://bitbucket.org/snippets/gcleaves/5ebB58/sso-keycloak#file-notes.md>
> 
> Another hurdle you might find using Gatekeeper in this AJAX setup is CORS.
> I believe Gatekeeper has a bug and isn't sending the correct headers:
> https://issues.jboss.org/browse/KEYCLOAK-8722 <https://issues.jboss.org/browse/KEYCLOAK-8722>
> 
> 2. I have the same question as you. After reading the docs, I think the
> answer is NO. If your back end stack does not have a Keycloak adapter (are
> you using PHP like me?) then you would have to do all the UMA calls
> "manually". There are UMA2 specifications out there which would guide us,
> but I think it's a lot of work. There's also the Gluu oxd
> <https://gluu.org/docs/oxd/ <https://gluu.org/docs/oxd/>> project which seems similar to Keycloak
> Gatekeeper, but I doubt oxd is interoperable with Keycloak.
> 
> Yes, it is. We did recently a collaborative work with Gluu team to check interoperability. In fact, they used oxd to check that both Gluu and Keycloak ASs could be used to support UMA.
>  
> 
> 3. I think that normally a REST service should work with a bearer only
> client, which expects the token and does not do authentication redirection.
> You could instruct your API consumers to get the token directly from
> Keycloak (using a confidential client?) before hitting your Gatekeeper
> endpoint. Once again, keep in mind that by default the token retrieved from
> one client won't work to hit a different client unless you set up the aud
> claim properly.
> 
> Hopefully an expert will join and correct me.
> 
> Regards,
> Geoffrey Cleaves
> 
> 
> 
> 
> 
> 
> 
> On Wed, 31 Oct 2018 at 23:00, Eric Boyd Ramirez <eric.ramirez.sv at gmail.com <mailto:eric.ramirez.sv at gmail.com>>
> wrote:
> 
> > Dear All,
> > I am trying to test Keycloak-gatekeeper, have read the docs I could find
> > (keaycloak-proxy as well) but I still have a few questions:
> >
> > 1- I am trying to secure a number of REST APIs, configured behind
> > bearer-only clients. I think I need to first get a access token trough a
> > confidential client using a 'grant-type=password' request and then do a
> > second request to the REST client resource. Is this the right approach, how
> > would I implement this using Keycloak-Gatekeeper?.
> >
> > 2- Keycloak-Gatekeeper uses uri->methods->roles to manage resource access.
> > Is there a way to use Keycloak's authorization settings to manage access to
> > a client's resource  (i.e. policies, permissions, uma-ticket, etc.)?
> >
> > 3- How do I set up multiple clients, do I have to run and configure
> > separate instances of Keycloak-Gatekeeper?
> >
> > Thanks in advance for your time and help.
> >
> > Regards,
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org <mailto:keycloak-user at lists.jboss.org>
> > https://lists.jboss.org/mailman/listinfo/keycloak-user <https://lists.jboss.org/mailman/listinfo/keycloak-user>
> >
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org <mailto:keycloak-user at lists.jboss.org>
> https://lists.jboss.org/mailman/listinfo/keycloak-user <https://lists.jboss.org/mailman/listinfo/keycloak-user>

From andreas.lau at outlook.com  Fri Nov  2 15:25:27 2018
From: andreas.lau at outlook.com (Andreas Lau)
Date: Fri, 2 Nov 2018 19:25:27 +0000
Subject: [keycloak-user] JBoss EAP 7.0 -
 keycloak-wildfly-adapter-dist-4.3.0.Final - KeycloakConfigResolver called
 on unprotected Resources
In-Reply-To: <1541133909.10131.1.camel@acutus.pro>
References: <09AC28A0-AC9B-43EF-8684-F20F6F4E69C7@outlook.com>
	<VI1PR10MB0445F17DE5E4F125C727E7E0E4CF0@VI1PR10MB0445.EURPRD10.PROD.OUTLOOK.COM>
	<1541133909.10131.1.camel@acutus.pro>
Message-ID: <VI1PR10MB044560851E2E0E322F4A592CE4CF0@VI1PR10MB0445.EURPRD10.PROD.OUTLOOK.COM>

Hello Dmitry,

thanks for your help, this is exactly I was looking for and so simple :).
Yes the resources are just static stuff that is needed to display the site properly. Nothing that is relevant to security. It's simple if the main page is authenticated the resources don't have to be checked again.

Thinking more about it I would like to know if there is a way to recognize that the page, that gets called, is called from a logged in state. Actually we might be able to access the access token of the header right?

From my current understanding I would not need to get a particular config (so I could return the default new KeycloakDeployment()) if I am successfully logged in and call further pages from "within". Am I right?
Thanks again, regards
Andreas.

Am 2. November 2018 05:45:09 MEZ schrieb Dmitry Telegin <dt at acutus.pro>:

Andreas,

Could you please elaborate on the nature of the resources your JSF is accessing?

If those are static images/CSS/etc. and they do not require authentication, you can simply return new KeycloakDeployment(), a dummy unconfigured instance (you can't return null from the resolver as it will result in an NPE).

If those are REST resources that need authentication, you'll probably need to propagate kId somehow to that services, like in a HTTP header or URL param, and process it in the resolver.

Good luck,
Dmitry

On Fri, 2018-11-02 at 02:28 +0000, Andreas Lau wrote:
Hey,
I forgot to bounce back to the list. Sorry
________________________________
Von: Andreas Lau <andreas.lau at outlook.com>
Gesendet: 30. Oktober 2018 23:08:06 MEZ
An: Dmitry Telegin <dt at acutus.pro>
Betreff: Re: [keycloak-user] JBoss EAP 7.0 - keycloak-wildfly-adapter-dist-4.3.0.Final - KeycloakConfigResolver called on unprotected Resources

Hello Dmitry,

thanks for your response and informations. My problem with that many calls of the resolve methode was not a performance concern in first place. I was surprised for sure and I did indeed thought that I mad a mistake somewhere following the instructions.

As you pointed out the behavior is not wrong. The resolver should be called that many times. That's OK I'm fine with this.
The first call to the jsf page is not a problem at all, because in the URL we have set the parameter who determines which keycloak.json file has to be used. But I have a problem at the time where the jsf loading process starts to load the resources.
It fires get request with the URL to the resources the jsf needs. But now I have lost my scope because the URL used to load the resource has no identifier in it. How should I determine which keycloak.json I should take?

Cheers,
Andreas

Am 30. Oktober 2018 06:29:56 MEZ schrieb Dmitry Telegin <dt at acutus.pro>:

Hello Andreas,

I'm afraid this is by design - one of the reasons may be Java EE programmatic security [1], where the application can instigate login even from the resources not protected by web.xml security constraints.

But I don't think you should be bothered - in your resolver, there is a cache for KeycloakDeployments, and cache calls are cheap (and you will always have a cache hit, except for the very first invocation).

Even if there had been the code to determine whether the resolver should or should not kick in, according to web.xml rules, - this code would have been more expensive, let alone it would have broken programmatic security. If you are super determined, you can craft a simple performance test using e.g. Gatling [2] - I'm pretty sure the results for resolver vs. no resolver will differ insignificantly.

[1] https://docs.oracle.com/javaee/7/tutorial/security-webtier003.htm
[2] https://gatling.io/

Cheers,
Dmitry Telegin
CTO, Acutus s.r.o.
Keycloak Consulting and Training

Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
+42 (022) 888-30-71
E-mail: info at acutus.pro

On Sat, 2018-10-27 at 07:21 +0000, Andreas Lau wrote:
Hey guys, sorry for bouncing that topic again, but this issue currently is a show stopper for us. We need to have multi-tenancy for our application, but as it works now it is not feasible.
So we desparatly ask for your help.

Am 24. Oktober 2018 17:16:23 MESZ schrieb Andreas Lau <andreas.lau at outlook.com>:

Hello,
we deployed a jsf primfaces application on a JBoss EAP 7.0 System. We have to support multiple clients using multi tenancy. We followed the instructions of the documentation [1] to build up a CustomKeycloakConfigResolver.
We configured the web.xml like this:
[web.xml]
<web-app>
...
<security-constraint>
 <web-resource-collection>
  <web-resource-name>portal</web-resource-name>
  <url-pattern>/portal/*</url-pattern>
 </web-resource-collection>
 <auth-constraint>
  <role-name>user</role-name>
 </auth-constraint>
</security-constraint>
<security-constraint>
 <web-resource-collection>
  <web-resource-name>public</web-resource-name>
  <url-pattern>/portal/pages/willkommen.jsf</url-pattern>
  <url-pattern>/portal/pages/logout.jsf</url-pattern>
 </web-resource-collection>
</security-constraint>

<login-config>
 <auth-method>KEYCLOAK</auth-method>
</login-config>

<security-role>
 <role-name>user</role-name>
</security-role>
...
<context-param>
 <param-name>keycloak.config.resolver</param-name>
 <param-value>de.sample.security.MandantBasedKeycloakConfigResolver</param-value>
</context-param>
...
</web-app>

As you can see everything under portal is restricted with two exceptions. The code of MandantBasedKeycloakConfigResolver is straight forward and adapted to the example code [2]. In our example we consider that the url has a query parameter that provides an id which we can map to a corresponding keycloak.json file. A sample would be "https://localhost:8443/SampleApp/portal/pages/willkommen.jsf?kId=1".

After deployment I realized, that the KeycloakConfigResolver is called 44 times (see log entries [3]). As it turns out the KeycloakConfigResolver.resolve() methode is called for every resource that is loaded through get requests to display the site. I did not expect that many invocation, since the resources are not protected.

Can you please tell me if this behaviour is correct? What is my error in adopting the mulity tenancy sample? How can we prevent/workaround that many calls?
While researching I found a jira https://issues.jboss.org/browse/KEYCLOAK-8616 with a potentially similar problem. Here they use keycloak to secure a spring boot application and have troubles when a sso redirection occurs.

Regards,
Andreas

[1] https://www.keycloak.org/docs/latest/securing_apps/index.html#_multi_tenancy

[2] public KeycloakDeployment resolve(HttpFacade.Request request) {

        LOGGER.debug("MandantBasedKeycloakConfigResolver.resolve() - counter:" + counter++);
        final String mandantId = request.getFirstParam("kId");
        LOGGER.debug("MandantBasedKeycloakConfigResolver.resolve() - requestFirstParam(kId):" + mandantId);
        LOGGER.debug("MandantBasedKeycloakConfigResolver.resolve() - uri:" + request.getURI());

        if (mandantId == null || mandantId.isEmpty()) {
            // throw new IllegalStateException("Not able to resolve realm for parameter kId - Parameter not found!");
            return null;
        }

        KeycloakDeployment deployment = cache.get(mandantId);
        if (deployment == null) {

            String keycloakConfigFilename = resolveKeycloakConfigFilename(mandantId);

            InputStream is = getClass().getResourceAsStream("/" + keycloakConfigFilename);
            if (is == null) {
                // throw new IllegalStateException("Not able to find the file /" + keycloakConfigFilename);
                return null;
            }
            LOGGER.debug("MandantBasedKeycloakConfigResolver.resolve() - is IS==null?:" + (is == null));

            deployment = KeycloakDeploymentBuilder.build(is);
            cache.put(mandantId, deployment);
        }

        return deployment;
    }

[3]
17:28:43,281 DEBUG [de.sample.security.MandantBasedKeycloakConfigResolver] (default task-4) MandantBasedKeycloakConfigResolver.resolve() - counter:0
17:28:50,215 DEBUG [de.sample.security.MandantBasedKeycloakConfigResolver] (default task-4) MandantBasedKeycloakConfigResolver.resolve() - requestFirstParam(kId):3
17:28:50,228 DEBUG [de.sample.security.MandantBasedKeycloakConfigResolver] (default task-4) MandantBasedKeycloakConfigResolver.resolve() - uri:https://localhost:8443/SampleApp/portal/pages/willkommen.jsf?kId=3
17:28:50,229 DEBUG [de.sample.security.MandantBasedKeycloakConfigResolver] (default task-4) MandantBasedKeycloakConfigResolver.resolve() - is IS==null?:false
17:28:50,496 DEBUG [de.sample.security.MandantBasedKeycloakConfigResolver] (default task-4) MandantBasedKeycloakConfigResolver.resolve() - counter:1
17:28:50,496 DEBUG [de.sample.security.MandantBasedKeycloakConfigResolver] (default task-4) MandantBasedKeycloakConfigResolver.resolve() - requestFirstParam(kId):3
17:28:50,496 DEBUG [de.sample.security.MandantBasedKeycloakConfigResolver] (default task-4) MandantBasedKeycloakConfigResolver.resolve() - uri:https://localhost:8443/SampleApp/portal/pages/willkommen.jsf?kId=3
17:28:50,496 DEBUG [de.sample.security.MandantBasedKeycloakConfigResolver] (default task-4) MandantBasedKeycloakConfigResolver.resolve() - counter:2
17:28:50,496 DEBUG [de.sample.security.MandantBasedKeycloakConfigResolver] (default task-4) MandantBasedKeycloakConfigResolver.resolve() - requestFirstParam(kId):3
17:28:50,496 DEBUG [de.sample.security.MandantBasedKeycloakConfigResolver] (default task-4) MandantBasedKeycloakConfigResolver.resolve() - uri:https://localhost:8443/SampleApp/portal/pages/willkommen.jsf?kId=3
17:28:50,933 INFO  [stdout] (default task-4) INIT Willkommen
17:28:50,933 INFO  [stdout] (default task-4) initialized mandant <<<<<<<<<<<<<

17:28:51,168 DEBUG [de.sample.security.MandantBasedKeycloakConfigResolver] (default task-5) MandantBasedKeycloakConfigResolver.resolve() - counter:3
17:28:51,168 DEBUG [de.sample.security.MandantBasedKeycloakConfigResolver] (default task-5) MandantBasedKeycloakConfigResolver.resolve() - requestFirstParam(kId):null
17:28:51,168 DEBUG [de.sample.security.MandantBasedKeycloakConfigResolver] (default task-5) MandantBasedKeycloakConfigResolver.resolve() - uri:https://localhost:8443/SampleApp/javax.faces.resource/components.css.jsf;jsessionid=6YidBEhtdxxI3NAASHOPab5bdBN_JAOjgqf8qHeh.localhost?ln=primefaces&v=6.1
17:28:51,168 ERROR [io.undertow.request] (default task-5) UT005023: Exception handling request to /SampleApp/javax.faces.resource/components.css.jsf;jsessionid=6YidBEhtdxxI3NAASHOPab5bdBN_JAOjgqf8qHeh.localhost: java.lang.IllegalStateException: Not able to resolve realm for parameter kId - Parameter not found!
at de.sample.security.MandantBasedKeycloakConfigResolver.resolve(MandantBasedKeycloakConfigResolver.java:46) [classes:]
at org.keycloak.adapters.AdapterDeploymentContext.resolveDeployment(AdapterDeploymentContext.java:88) [keycloak-adapter-core-4.0.0.Final.jar:4.0.0.Final]
at org.keycloak.adapters.PreAuthActionsHandler.preflightCors(PreAuthActionsHandler.java:107) [keycloak-adapter-core-4.0.0.Final.jar:4.0.0.Final]
at org.keycloak.adapters.PreAuthActionsHandler.handleRequest(PreAuthActionsHandler.java:79) [keycloak-adapter-core-4.0.0.Final.jar:4.0.0.Final]
at org.keycloak.adapters.undertow.ServletPreAuthActionsHandler.handleRequest(ServletPreAuthActionsHandler.java:68) [keycloak-undertow-adapter-4.0.0.Final.jar:4.0.0.Final]
at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) [undertow-core-1.3.31.Final-redhat-3.jar:1.3.31.Final-redhat-3]
at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:285) [undertow-servlet-1.3.31.Final-redhat-3.jar:1.3.31.Final-redhat-3]
at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:264) [undertow-servlet-1.3.31.Final-redhat-3.jar:1.3.31.Final-redhat-3]
at io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81) [undertow-servlet-1.3.31.Final-redhat-3.jar:1.3.31.Final-redhat-3]
at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:175) [undertow-servlet-1.3.31.Final-redhat-3.jar:1.3.31.Final-redhat-3]
at io.undertow.server.Connectors.executeRootHandler(Connectors.java:324) [undertow-core-1.3.31.Final-redhat-3.jar:1.3.31.Final-redhat-3]
at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:803) [undertow-core-1.3.31.Final-redhat-3.jar:1.3.31.Final-redhat-3]
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) [rt.jar:1.8.0_112]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) [rt.jar:1.8.0_112]
at java.lang.Thread.run(Thread.java:745) [rt.jar:1.8.0_112]

.......

17:28:51,824 DEBUG [de.sample.security.MandantBasedKeycloakConfigResolver] (default task-50) MandantBasedKeycloakConfigResolver.resolve() - counter:43
17:28:51,825 DEBUG [de.sample.security.MandantBasedKeycloakConfigResolver] (default task-50) MandantBasedKeycloakConfigResolver.resolve() - requestFirstParam(kId):null
17:28:51,825 DEBUG [de.sample.security.MandantBasedKeycloakConfigResolver] (default task-50) MandantBasedKeycloakConfigResolver.resolve() - uri:https://localhost:8443/SampleApp/javax.faces.resource/customJs/customJavaScript.js.jsf;jsessionid=6YidBEhtdxxI3NAASHOPab5bdBN_JAOjgqf8qHeh.localhost?ln=ultima-layout
17:28:51,825 ERROR [io.undertow.request] (default task-50) UT005023: Exception handling request to /SampleApp/javax.faces.resource/customJs/customJavaScript.js.jsf;jsessionid=6YidBEhtdxxI3NAASHOPab5bdBN_JAOjgqf8qHeh.localhost: java.lang.IllegalStateException: Not able to resolve realm for parameter kId - Parameter not found!
at de.sample.security.MandantBasedKeycloakConfigResolver.resolve(MandantBasedKeycloakConfigResolver.java:46) [classes:]
at org.keycloak.adapters.AdapterDeploymentContext.resolveDeployment(AdapterDeploymentContext.java:88) [keycloak-adapter-core-4.0.0.Final.jar:4.0.0.Final]
at org.keycloak.adapters.PreAuthActionsHandler.preflightCors(PreAuthActionsHandler.java:107) [keycloak-adapter-core-4.0.0.Final.jar:4.0.0.Final]
at org.keycloak.adapters.PreAuthActionsHandler.handleRequest(PreAuthActionsHandler.java:79) [keycloak-adapter-core-4.0.0.Final.jar:4.0.0.Final]
at org.keycloak.adapters.undertow.ServletPreAuthActionsHandler.handleRequest(ServletPreAuthActionsHandler.java:68) [keycloak-undertow-adapter-4.0.0.Final.jar:4.0.0.Final]
at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) [undertow-core-1.3.31.Final-redhat-3.jar:1.3.31.Final-redhat-3]
at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:285) [undertow-servlet-1.3.31.Final-redhat-3.jar:1.3.31.Final-redhat-3]
at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:264) [undertow-servlet-1.3.31.Final-redhat-3.jar:1.3.31.Final-redhat-3]
at io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81) [undertow-servlet-1.3.31.Final-redhat-3.jar:1.3.31.Final-redhat-3]
at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:175) [undertow-servlet-1.3.31.Final-redhat-3.jar:1.3.31.Final-redhat-3]
at io.undertow.server.Connectors.executeRootHandler(Connectors.java:324) [undertow-core-1.3.31.Final-redhat-3.jar:1.3.31.Final-redhat-3]
at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:803) [undertow-core-1.3.31.Final-redhat-3.jar:1.3.31.Final-redhat-3]
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) [rt.jar:1.8.0_112]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) [rt.jar:1.8.0_112]
at java.lang.Thread.run(Thread.java:745) [rt.jar:1.8.0_112]
________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user

From testoauth55 at gmail.com  Fri Nov  2 20:33:15 2018
From: testoauth55 at gmail.com (Bruce Wings)
Date: Sat, 3 Nov 2018 06:03:15 +0530
Subject: [keycloak-user] Keycloak Javascript Adapter - Advisable to be
 used for confidential clients?
In-Reply-To: <8E6265AD-A055-4A7A-BDFD-9AB19E834819@gmail.com>
References: <CANAVTmMFV=E6OjG2RoSZFuSui9yQ8XR8BrgWJauJJLCyWYWAzA@mail.gmail.com>
	<8E6265AD-A055-4A7A-BDFD-9AB19E834819@gmail.com>
Message-ID: <CANAVTmMt=pVgdOGBrqYDk5-3PtFaGZqo9N3hARQxt53u6VBCcQ@mail.gmail.com>

Thanks Eric for the reply.

But If I use a separate public client for my angular app, I am not able to
access my Rest Api with the generated token, that's why I had to use
confidential client Json that I used to secure my server. Any idea, what is
the right approach in case of server client architecture?

 ( My project contains Rest Apis that I have secured with jetty adapter and
confidential client ( as keycloak Authorization works only for confidential
client and not public clients). My angular app is accessing these rest api.
Therefore I used the same confidential client oidc Json in my angular app
too. )



On Friday, November 2, 2018, Eric Boyd Ramirez <eric.ramirez.sv at gmail.com>
wrote:

> Hi Bruce,
> I am fairly new to Keycloak myself, so I am giving my opinion in hopes
> some else can double check.
> The JS adapter is designed to work with Public clients, siting on the the
> client side, the idea is that the a user/person would have to enter his/her
> credentials to in order to login.
>
> Confidential clients generate an installation JSON or XML configuration
> object which is meant to be installed on the server side/ Application
> server. The user accessing this application does not receive this
> configuration.
>
> Hope this helps.
>
> > On Nov 2, 2018, at 1:28 AM, Bruce Wings <testoauth55 at gmail.com> wrote:
> >
> > I am referring to Keycloak Javascript adapter as mentioned in :
> > https://www.keycloak.org/docs/4.5/securing_apps/index.html#_
> javascript_adapter
> >
> > I have a confidential client and I have downloaded keycloak-oidc.json
> > containing client secret. Now I am not sure how secure is it to keep this
> > file containing client-secret at the client side.
> >
> > Am I being over concerned?
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
>
>

From geoff at opticks.io  Sat Nov  3 04:06:03 2018
From: geoff at opticks.io (Geoffrey Cleaves)
Date: Sat, 3 Nov 2018 09:06:03 +0100
Subject: [keycloak-user] Keycloak Javascript Adapter - Advisable to be
 used for confidential clients?
In-Reply-To: <CANAVTmMt=pVgdOGBrqYDk5-3PtFaGZqo9N3hARQxt53u6VBCcQ@mail.gmail.com>
References: <CANAVTmMFV=E6OjG2RoSZFuSui9yQ8XR8BrgWJauJJLCyWYWAzA@mail.gmail.com>
	<8E6265AD-A055-4A7A-BDFD-9AB19E834819@gmail.com>
	<CANAVTmMt=pVgdOGBrqYDk5-3PtFaGZqo9N3hARQxt53u6VBCcQ@mail.gmail.com>
Message-ID: <CAHzT=q9LYO1ubdba3D61txk5cqAcjBnOkyK0E0nR2nw0o=0MDA@mail.gmail.com>

Bruce, here's how I fixed the issue you're describing. I think it's a
unfortunate omission in the docs (which are generally quite good). You need
to include the backend client ID in the front end clients aud claim.

https://bitbucket.org/snippets/gcleaves/5ebB58/sso-keycloak

On Sat, Nov 3, 2018, 01:45 Bruce Wings <testoauth55 at gmail.com wrote:

> Thanks Eric for the reply.
>
> But If I use a separate public client for my angular app, I am not able to
> access my Rest Api with the generated token, that's why I had to use
> confidential client Json that I used to secure my server. Any idea, what is
> the right approach in case of server client architecture?
>
>  ( My project contains Rest Apis that I have secured with jetty adapter and
> confidential client ( as keycloak Authorization works only for confidential
> client and not public clients). My angular app is accessing these rest api.
> Therefore I used the same confidential client oidc Json in my angular app
> too. )
>
>
>
> On Friday, November 2, 2018, Eric Boyd Ramirez <eric.ramirez.sv at gmail.com>
> wrote:
>
> > Hi Bruce,
> > I am fairly new to Keycloak myself, so I am giving my opinion in hopes
> > some else can double check.
> > The JS adapter is designed to work with Public clients, siting on the the
> > client side, the idea is that the a user/person would have to enter
> his/her
> > credentials to in order to login.
> >
> > Confidential clients generate an installation JSON or XML configuration
> > object which is meant to be installed on the server side/ Application
> > server. The user accessing this application does not receive this
> > configuration.
> >
> > Hope this helps.
> >
> > > On Nov 2, 2018, at 1:28 AM, Bruce Wings <testoauth55 at gmail.com> wrote:
> > >
> > > I am referring to Keycloak Javascript adapter as mentioned in :
> > > https://www.keycloak.org/docs/4.5/securing_apps/index.html#_
> > javascript_adapter
> > >
> > > I have a confidential client and I have downloaded keycloak-oidc.json
> > > containing client secret. Now I am not sure how secure is it to keep
> this
> > > file containing client-secret at the client side.
> > >
> > > Am I being over concerned?
> > > _______________________________________________
> > > keycloak-user mailing list
> > > keycloak-user at lists.jboss.org
> > > https://lists.jboss.org/mailman/listinfo/keycloak-user
> >
> >
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

From eric.ramirez.sv at gmail.com  Sat Nov  3 09:58:32 2018
From: eric.ramirez.sv at gmail.com (Eric Boyd Ramirez)
Date: Sat, 3 Nov 2018 07:58:32 -0600
Subject: [keycloak-user] Keycloak Javascript Adapter - Advisable to be
 used for confidential clients?
In-Reply-To: <CAHzT=q9LYO1ubdba3D61txk5cqAcjBnOkyK0E0nR2nw0o=0MDA@mail.gmail.com>
References: <CANAVTmMFV=E6OjG2RoSZFuSui9yQ8XR8BrgWJauJJLCyWYWAzA@mail.gmail.com>
	<8E6265AD-A055-4A7A-BDFD-9AB19E834819@gmail.com>
	<CANAVTmMt=pVgdOGBrqYDk5-3PtFaGZqo9N3hARQxt53u6VBCcQ@mail.gmail.com>
	<CAHzT=q9LYO1ubdba3D61txk5cqAcjBnOkyK0E0nR2nw0o=0MDA@mail.gmail.com>
Message-ID: <290B5BD5-8AD9-4947-AD8C-A92998B77F5E@gmail.com>

Hi Bruce, further to Geoffrey's reply this example should get you started: 
https://github.com/keycloak/keycloak-quickstarts/tree/latest/app-authz-rest-employee

> On Nov 3, 2018, at 2:06 AM, Geoffrey Cleaves <geoff at opticks.io> wrote:
> 
> Bruce, here's how I fixed the issue you're describing. I think it's a unfortunate omission in the docs (which are generally quite good). You need to include the backend client ID in the front end clients aud claim. 
> 
> https://bitbucket.org/snippets/gcleaves/5ebB58/sso-keycloak <https://bitbucket.org/snippets/gcleaves/5ebB58/sso-keycloak>
> On Sat, Nov 3, 2018, 01:45 Bruce Wings <testoauth55 at gmail.com <mailto:testoauth55 at gmail.com> wrote:
> Thanks Eric for the reply.
> 
> But If I use a separate public client for my angular app, I am not able to
> access my Rest Api with the generated token, that's why I had to use
> confidential client Json that I used to secure my server. Any idea, what is
> the right approach in case of server client architecture?
> 
>  ( My project contains Rest Apis that I have secured with jetty adapter and
> confidential client ( as keycloak Authorization works only for confidential
> client and not public clients). My angular app is accessing these rest api.
> Therefore I used the same confidential client oidc Json in my angular app
> too. )
> 
> 
> 
> On Friday, November 2, 2018, Eric Boyd Ramirez <eric.ramirez.sv at gmail.com <mailto:eric.ramirez.sv at gmail.com>>
> wrote:
> 
> > Hi Bruce,
> > I am fairly new to Keycloak myself, so I am giving my opinion in hopes
> > some else can double check.
> > The JS adapter is designed to work with Public clients, siting on the the
> > client side, the idea is that the a user/person would have to enter his/her
> > credentials to in order to login.
> >
> > Confidential clients generate an installation JSON or XML configuration
> > object which is meant to be installed on the server side/ Application
> > server. The user accessing this application does not receive this
> > configuration.
> >
> > Hope this helps.
> >
> > > On Nov 2, 2018, at 1:28 AM, Bruce Wings <testoauth55 at gmail.com <mailto:testoauth55 at gmail.com>> wrote:
> > >
> > > I am referring to Keycloak Javascript adapter as mentioned in :
> > > https://www.keycloak.org/docs/4.5/securing_apps/index.html#_ <https://www.keycloak.org/docs/4.5/securing_apps/index.html#_>
> > javascript_adapter
> > >
> > > I have a confidential client and I have downloaded keycloak-oidc.json
> > > containing client secret. Now I am not sure how secure is it to keep this
> > > file containing client-secret at the client side.
> > >
> > > Am I being over concerned?
> > > _______________________________________________
> > > keycloak-user mailing list
> > > keycloak-user at lists.jboss.org <mailto:keycloak-user at lists.jboss.org>
> > > https://lists.jboss.org/mailman/listinfo/keycloak-user <https://lists.jboss.org/mailman/listinfo/keycloak-user>
> >
> >
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org <mailto:keycloak-user at lists.jboss.org>
> https://lists.jboss.org/mailman/listinfo/keycloak-user <https://lists.jboss.org/mailman/listinfo/keycloak-user>


From testoauth55 at gmail.com  Sat Nov  3 12:41:10 2018
From: testoauth55 at gmail.com (Bruce Wings)
Date: Sat, 3 Nov 2018 22:11:10 +0530
Subject: [keycloak-user] Keycloak Javascript Adapter - Advisable to be
 used for confidential clients?
In-Reply-To: <CAHzT=q9LYO1ubdba3D61txk5cqAcjBnOkyK0E0nR2nw0o=0MDA@mail.gmail.com>
References: <CANAVTmMFV=E6OjG2RoSZFuSui9yQ8XR8BrgWJauJJLCyWYWAzA@mail.gmail.com>
	<8E6265AD-A055-4A7A-BDFD-9AB19E834819@gmail.com>
	<CANAVTmMt=pVgdOGBrqYDk5-3PtFaGZqo9N3hARQxt53u6VBCcQ@mail.gmail.com>
	<CAHzT=q9LYO1ubdba3D61txk5cqAcjBnOkyK0E0nR2nw0o=0MDA@mail.gmail.com>
Message-ID: <CANAVTmN40+pvjS3JfMdZfn+3mZTbaDBPfnEaCHMPX8ie-OmQbg@mail.gmail.com>

Thanks Geoffrey,

I believe this will solve my problem. However, I tried creating the mapper,
but maybe I missed something cause I am still getting 401 if I login with
front end.

In the attached image, I have shared my config, can you give it a quick
look and confirm this is how it is supposed to be?

Name of my backend client in keycloak JettyApp:

I have created Token claim name as - clientId and value as JettyApp.


[image: image.png]


On Sat, Nov 3, 2018 at 1:36 PM Geoffrey Cleaves <geoff at opticks.io> wrote:

> Bruce, here's how I fixed the issue you're describing. I think it's a
> unfortunate omission in the docs (which are generally quite good). You need
> to include the backend client ID in the front end clients aud claim.
>
> https://bitbucket.org/snippets/gcleaves/5ebB58/sso-keycloak
>
> On Sat, Nov 3, 2018, 01:45 Bruce Wings <testoauth55 at gmail.com wrote:
>
>> Thanks Eric for the reply.
>>
>> But If I use a separate public client for my angular app, I am not able to
>> access my Rest Api with the generated token, that's why I had to use
>> confidential client Json that I used to secure my server. Any idea, what
>> is
>> the right approach in case of server client architecture?
>>
>>  ( My project contains Rest Apis that I have secured with jetty adapter
>> and
>> confidential client ( as keycloak Authorization works only for
>> confidential
>> client and not public clients). My angular app is accessing these rest
>> api.
>> Therefore I used the same confidential client oidc Json in my angular app
>> too. )
>>
>>
>>
>> On Friday, November 2, 2018, Eric Boyd Ramirez <eric.ramirez.sv at gmail.com
>> >
>> wrote:
>>
>> > Hi Bruce,
>> > I am fairly new to Keycloak myself, so I am giving my opinion in hopes
>> > some else can double check.
>> > The JS adapter is designed to work with Public clients, siting on the
>> the
>> > client side, the idea is that the a user/person would have to enter
>> his/her
>> > credentials to in order to login.
>> >
>> > Confidential clients generate an installation JSON or XML configuration
>> > object which is meant to be installed on the server side/ Application
>> > server. The user accessing this application does not receive this
>> > configuration.
>> >
>> > Hope this helps.
>> >
>> > > On Nov 2, 2018, at 1:28 AM, Bruce Wings <testoauth55 at gmail.com>
>> wrote:
>> > >
>> > > I am referring to Keycloak Javascript adapter as mentioned in :
>> > > https://www.keycloak.org/docs/4.5/securing_apps/index.html#_
>> > javascript_adapter
>> > >
>> > > I have a confidential client and I have downloaded keycloak-oidc.json
>> > > containing client secret. Now I am not sure how secure is it to keep
>> this
>> > > file containing client-secret at the client side.
>> > >
>> > > Am I being over concerned?
>> > > _______________________________________________
>> > > keycloak-user mailing list
>> > > keycloak-user at lists.jboss.org
>> > > https://lists.jboss.org/mailman/listinfo/keycloak-user
>> >
>> >
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>
-------------- next part --------------

-------------- next part --------------
A non-text attachment was scrubbed...
Name: image.png
Type: image/png
Size: 57527 bytes
Desc: not available
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20181103/46e15784/attachment-0001.png 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: aud.JPG
Type: image/jpeg
Size: 53698 bytes
Desc: not available
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20181103/46e15784/attachment-0001.jpe 

From testoauth55 at gmail.com  Sat Nov  3 13:00:33 2018
From: testoauth55 at gmail.com (Bruce Wings)
Date: Sat, 3 Nov 2018 22:30:33 +0530
Subject: [keycloak-user] Keycloak Javascript Adapter - Advisable to be
 used for confidential clients?
In-Reply-To: <CANAVTmN40+pvjS3JfMdZfn+3mZTbaDBPfnEaCHMPX8ie-OmQbg@mail.gmail.com>
References: <CANAVTmMFV=E6OjG2RoSZFuSui9yQ8XR8BrgWJauJJLCyWYWAzA@mail.gmail.com>
	<8E6265AD-A055-4A7A-BDFD-9AB19E834819@gmail.com>
	<CANAVTmMt=pVgdOGBrqYDk5-3PtFaGZqo9N3hARQxt53u6VBCcQ@mail.gmail.com>
	<CAHzT=q9LYO1ubdba3D61txk5cqAcjBnOkyK0E0nR2nw0o=0MDA@mail.gmail.com>
	<CANAVTmN40+pvjS3JfMdZfn+3mZTbaDBPfnEaCHMPX8ie-OmQbg@mail.gmail.com>
Message-ID: <CANAVTmPrOTRFgUd5BUZZi+QatSKiQ9Cbs0G_4JTFuO1a3YJ99A@mail.gmail.com>

Geoffrey,

I was able to get the config right. I have received the aud:JettyApp in
generated token also, but I still get 401:Unauthorized for the backend app.
Anything else needs to be done?

Token (Partial):
"jti": "b7b07046-5417-40d6-9338-1851a0f5e1e5",
  "exp": 1541292863,
  "nbf": 0,
  "iat": 1541264063,
  "iss": "http://localhost:7200/auth/realms/MyRealm",
  *"aud": "JettyApp",*
  "sub": "c801fc43-e7d3-4229-869c-cef19d049389",
  "typ": "Bearer",
  "azp": "Webapps",
  "nonce": "3ec36116-c8a3-482c-828e-6458ad179270",
  "auth_time": 1541264063,
  "session_state": "0b40b785-6956-4234-bcb5-96ff8fdcb822",
  "acr": "1",


[image: image.png]

On Sat, Nov 3, 2018 at 10:11 PM Bruce Wings <testoauth55 at gmail.com> wrote:

> Thanks Geoffrey,
>
> I believe this will solve my problem. However, I tried creating the
> mapper, but maybe I missed something cause I am still getting 401 if I
> login with front end.
>
> In the attached image, I have shared my config, can you give it a quick
> look and confirm this is how it is supposed to be?
>
> Name of my backend client in keycloak JettyApp:
>
> I have created Token claim name as - clientId and value as JettyApp.
>
>
> [image: image.png]
>
>
> On Sat, Nov 3, 2018 at 1:36 PM Geoffrey Cleaves <geoff at opticks.io> wrote:
>
>> Bruce, here's how I fixed the issue you're describing. I think it's a
>> unfortunate omission in the docs (which are generally quite good). You need
>> to include the backend client ID in the front end clients aud claim.
>>
>> https://bitbucket.org/snippets/gcleaves/5ebB58/sso-keycloak
>>
>> On Sat, Nov 3, 2018, 01:45 Bruce Wings <testoauth55 at gmail.com wrote:
>>
>>> Thanks Eric for the reply.
>>>
>>> But If I use a separate public client for my angular app, I am not able
>>> to
>>> access my Rest Api with the generated token, that's why I had to use
>>> confidential client Json that I used to secure my server. Any idea, what
>>> is
>>> the right approach in case of server client architecture?
>>>
>>>  ( My project contains Rest Apis that I have secured with jetty adapter
>>> and
>>> confidential client ( as keycloak Authorization works only for
>>> confidential
>>> client and not public clients). My angular app is accessing these rest
>>> api.
>>> Therefore I used the same confidential client oidc Json in my angular app
>>> too. )
>>>
>>>
>>>
>>> On Friday, November 2, 2018, Eric Boyd Ramirez <
>>> eric.ramirez.sv at gmail.com>
>>> wrote:
>>>
>>> > Hi Bruce,
>>> > I am fairly new to Keycloak myself, so I am giving my opinion in hopes
>>> > some else can double check.
>>> > The JS adapter is designed to work with Public clients, siting on the
>>> the
>>> > client side, the idea is that the a user/person would have to enter
>>> his/her
>>> > credentials to in order to login.
>>> >
>>> > Confidential clients generate an installation JSON or XML configuration
>>> > object which is meant to be installed on the server side/ Application
>>> > server. The user accessing this application does not receive this
>>> > configuration.
>>> >
>>> > Hope this helps.
>>> >
>>> > > On Nov 2, 2018, at 1:28 AM, Bruce Wings <testoauth55 at gmail.com>
>>> wrote:
>>> > >
>>> > > I am referring to Keycloak Javascript adapter as mentioned in :
>>> > > https://www.keycloak.org/docs/4.5/securing_apps/index.html#_
>>> > javascript_adapter
>>> > >
>>> > > I have a confidential client and I have downloaded keycloak-oidc.json
>>> > > containing client secret. Now I am not sure how secure is it to keep
>>> this
>>> > > file containing client-secret at the client side.
>>> > >
>>> > > Am I being over concerned?
>>> > > _______________________________________________
>>> > > keycloak-user mailing list
>>> > > keycloak-user at lists.jboss.org
>>> > > https://lists.jboss.org/mailman/listinfo/keycloak-user
>>> >
>>> >
>>> _______________________________________________
>>> keycloak-user mailing list
>>> keycloak-user at lists.jboss.org
>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>
>>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image.png
Type: image/png
Size: 53646 bytes
Desc: not available
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20181103/c8b561ad/attachment-0002.png 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image.png
Type: image/png
Size: 57527 bytes
Desc: not available
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20181103/c8b561ad/attachment-0003.png 

From remy at grunblatt.org  Sat Nov  3 15:15:22 2018
From: remy at grunblatt.org (=?UTF-8?Q?R=c3=a9my_Gr=c3=bcnblatt?=)
Date: Sat, 3 Nov 2018 20:15:22 +0100
Subject: [keycloak-user] Backup strategies for Keycloak + Docker?
Message-ID: <4e7e07a1-e09f-4a5d-8c67-489e392a466c@grunblatt.org>

Hello,

I'm wondering: what are your backup strategies for keycloak?
I plan to use docker and keycloak, and of course I'll be backuping the data.
The backup for the database side is ok: just launching psql in the
container will do it.

But for the keycloak side: do I need any backup? In there,
https://www.keycloak.org/docs/2.5/server_admin/topics/export-import.html,
a method for backuping the ? entire database ? is mentioned, and I was
wondering if this would be useful in addition of the database
(container) backup.
I thought about modifying the entry point to include this backup (what I
have done), but saving it to a volume is tricky as it seems keycloak is
running with 1000/1000 uid/gid (which is the first non-root user on many
linux distribution?).

Any hints? How do you do it, in your production?


R?my


From geoff at opticks.io  Sat Nov  3 19:56:08 2018
From: geoff at opticks.io (Geoffrey Cleaves)
Date: Sun, 4 Nov 2018 00:56:08 +0100
Subject: [keycloak-user] How should my application users get a token to
	directly access my API?
Message-ID: <CAHzT=q_TgpWcoLZDAQKHsZeEHxhkgHPXvDB1P47Usjcg38jCsg@mail.gmail.com>

Let's say that in addition to letting my end users access my REST API via
the single page web app, I also want to let the end users access the REST
API in a machine-to-machine fashion. So that, for example, the end user
could run a report every night automatically via cron/curl instead of
generating the report via the front end SPA.

My SPA gets tokens using keycloak.js and the Authorizaton Code Flow. But I
don't think this is appropriate for the scenario above. Curl can't be
entering a username/password into Keycloak's login page when a session
expires. Are my end users to use the Resource Owner Password Credentials
Grant? If so, which clientid/secret should be used?

Thanks for shedding light on this.

Geoff

From info at patrick-hesse.de  Sun Nov  4 10:09:55 2018
From: info at patrick-hesse.de (Patrick Hesse)
Date: Sun, 04 Nov 2018 16:09:55 +0100
Subject: [keycloak-user] I need a Integrationtest example for keycloak 4.5
Message-ID: <5BDF0BC3.4080309@patrick-hesse.de>

Hi all,

i have her some sourcecode incl. IntegrationTests for a custom
authenticator. This code was written by some other people. Now i must
migrate this from Keycloak 3.0 to 4.5.

I have migrated the authenticator, bute the migration for the
IntegrationTests will not work.

Where can i find a demo integrationTests with Arquillian.

nice greetings
Patrick Hesse


From dt at acutus.pro  Sun Nov  4 23:58:00 2018
From: dt at acutus.pro (Dmitry Telegin)
Date: Mon, 05 Nov 2018 07:58:00 +0300
Subject: [keycloak-user] Backup strategies for Keycloak + Docker?
In-Reply-To: <4e7e07a1-e09f-4a5d-8c67-489e392a466c@grunblatt.org>
References: <4e7e07a1-e09f-4a5d-8c67-489e392a466c@grunblatt.org>
Message-ID: <1541393880.3650.1.camel@acutus.pro>

Hello R?my,

I think Keycloak-side export/import makes more sense when migrating between DB vendors, since the dump is in vendor-neutral JSON format.

For backup purposes, doing a DB-side backup should be sufficient (let alone it's normally much faster than its Keycloak-side counterpart).

Cheers,
Dmitry Telegin
CTO, Acutus s.r.o.
Keycloak Consulting and Training

Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
+42 (022) 888-30-71
E-mail: info at acutus.pro

On Sat, 2018-11-03 at 20:15 +0100, R?my Gr?nblatt wrote:
> Hello,
> 
> I'm wondering: what are your backup strategies for keycloak?
> I plan to use docker and keycloak, and of course I'll be backuping the data.
> The backup for the database side is ok: just launching psql in the
> container will do it.
> 
> But for the keycloak side: do I need any backup? In there,
> https://www.keycloak.org/docs/2.5/server_admin/topics/export-import.html,
> a method for backuping the ? entire database ? is mentioned, and I was
> wondering if this would be useful in addition of the database
> (container) backup.
> I thought about modifying the entry point to include this backup (what I
> have done), but saving it to a volume is tricky as it seems keycloak is
> running with 1000/1000 uid/gid (which is the first non-root user on many
> linux distribution?).
> 
> Any hints? How do you do it, in your production?
> 
> 
> R?my
> 
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From dt at acutus.pro  Mon Nov  5 00:36:17 2018
From: dt at acutus.pro (Dmitry Telegin)
Date: Mon, 05 Nov 2018 08:36:17 +0300
Subject: [keycloak-user] JBoss EAP 7.0 -
 keycloak-wildfly-adapter-dist-4.3.0.Final - KeycloakConfigResolver called
 on unprotected Resources
In-Reply-To: <VI1PR10MB044560851E2E0E322F4A592CE4CF0@VI1PR10MB0445.EURPRD10.PROD.OUTLOOK.COM>
References: <09AC28A0-AC9B-43EF-8684-F20F6F4E69C7@outlook.com>
	<VI1PR10MB0445F17DE5E4F125C727E7E0E4CF0@VI1PR10MB0445.EURPRD10.PROD.OUTLOOK.COM>
	<1541133909.10131.1.camel@acutus.pro>
	<VI1PR10MB044560851E2E0E322F4A592CE4CF0@VI1PR10MB0445.EURPRD10.PROD.OUTLOOK.COM>
Message-ID: <1541396177.3650.5.camel@acutus.pro>

Hi Andreas, you're welcome :) answers inline
On Fri, 2018-11-02 at 19:25 +0000, Andreas Lau wrote:
> Hello Dmitry,
> 
> 
> 
> thanks for your help, this is exactly I was looking for and so simple
> :).
> 
> Yes the resources are just static stuff that is needed to display the
> site properly. Nothing that is relevant to security. It's simple if
> the main page is authenticated the resources don't have to be checked
> again.
> 
> 
> 
> Thinking more about it I would like to know if there is a way to
> recognize that the page, that gets called, is called from a logged in
> state. Actually we might be able to access the access token of the
> header right?
> 
> 
> 
> From my current understanding I would not need to get a particular
> config (so I could return the default new KeycloakDeployment()) if I
> am successfully logged in and call further pages from "within". Am I
> right?

I don't think this is a good idea. How should you detect a logged-in
state from a resolver? Yep there is access token, but how would you
validate it? You need realm public keys for that, where do you get
them? If you return a dummy KeycloakDeployment, how should the
underlying adapter validate the logged-in session, in the absence of
realm config?
As you see, there are more questions than answers here. I'm afraid
you're risking to spend major time for minor optimizations. Remember,
"Premature optimization is the root of all evil" (C) Donald Knuth :)
Dmitry
> Thanks again, regards
> 
> Andreas.?
> 
> 
> 
> Am 2. November 2018 05:45:09 MEZ schrieb Dmitry Telegin <dt at acutus.pr
> o>:
> > Andreas,
> > 
> > Could you please elaborate on the nature of the resources your JSF
> > is accessing?
> > 
> > If those are static images/CSS/etc. and they do not require
> > authentication, you can simply return new KeycloakDeployment(), a
> > dummy unconfigured instance (you can't return null from the
> > resolver as it will result in an NPE).
> > 
> > If those are REST resources that need authentication, you'll
> > probably need to propagate kId somehow to that services, like in a
> > HTTP header or URL param, and process it in the resolver.
> > 
> > Good luck,
> > Dmitry
> > 
> > On Fri, 2018-11-02 at 02:28 +0000, Andreas Lau wrote:
> > > Hey,
> > > I forgot to bounce back to the list. Sorry
> > > > Von: Andreas Lau <andreas.lau at outlook.com>
> > > Gesendet: 30. Oktober 2018 23:08:06 MEZ
> > > > An: Dmitry Telegin <dt at acutus.pro>
> > > Betreff: Re: [keycloak-user] JBoss EAP 7.0 - keycloak-wildfly-
> > > adapter-dist-4.3.0.Final - KeycloakConfigResolver called on
> > > unprotected Resources
> > > 
> > > Hello Dmitry,
> > > 
> > > thanks for your response and informations. My problem with that
> > > many calls of the resolve methode was not a performance concern
> > > in first place. I was surprised for sure and I did indeed thought
> > > that I mad a mistake somewhere following the instructions.
> > > 
> > > As you pointed out the behavior is not wrong. The resolver should
> > > be called that many times. That's OK I'm fine with this.
> > > The first call to the jsf page is not a problem at all, because
> > > in the URL we have set the parameter who determines which
> > > keycloak.json file has to be used. But I have a problem at the
> > > time where the jsf loading process starts to load the resources.
> > > It fires get request with the URL to the resources the jsf needs.
> > > But now I have lost my scope because the URL used to load the
> > > resource has no identifier in it. How should I determine which
> > > keycloak.json I should take?
> > > 
> > > Cheers,
> > > Andreas
> > > 
> > > Am 30. Oktober 2018 06:29:56 MEZ schrieb Dmitry Telegin <dt at acutu
> > > s.pro>:
> > > 
> > > Hello Andreas,
> > > 
> > > I'm afraid this is by design - one of the reasons may be Java EE
> > > programmatic security [1], where the application can instigate
> > > login even from the resources not protected by web.xml security
> > > constraints.
> > > 
> > > But I don't think you should be bothered - in your resolver,
> > > there is a cache for KeycloakDeployments, and cache calls are
> > > cheap (and you will always have a cache hit, except for the very
> > > first invocation).
> > > 
> > > Even if there had been the code to determine whether the resolver
> > > should or should not kick in, according to web.xml rules, - this
> > > code would have been more expensive, let alone it would have
> > > broken programmatic security. If you are super determined, you
> > > can craft a simple performance test using e.g. Gatling [2] - I'm
> > > pretty sure the results for resolver vs. no resolver will differ
> > > insignificantly.
> > > 
> > > [1] https://docs.oracle.com/javaee/7/tutorial/security-webtier003
> > > .htm
> > > [2] https://gatling.io/
> > > 
> > > Cheers,
> > > Dmitry Telegin
> > > CTO, Acutus s.r.o.
> > > Keycloak Consulting and Training
> > > 
> > > Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
> > > +42 (022) 888-30-71
> > > E-mail: info at acutus.pro
> > > 
> > > On Sat, 2018-10-27 at 07:21 +0000, Andreas Lau wrote:
> > > Hey guys, sorry for bouncing that topic again, but this issue
> > > currently is a show stopper for us. We need to have multi-tenancy 
> > > for our application, but as it works now it is not feasible.
> > > So we desparatly ask for your help.
> > > 
> > > Am 24. Oktober 2018 17:16:23 MESZ schrieb Andreas Lau <andreas.la
> > > u at outlook.com>:
> > > 
> > > Hello,
> > > we deployed a jsf primfaces application on a JBoss EAP 7.0
> > > System. We have to support multiple clients using multi tenancy.
> > > We followed the instructions of the documentation [1] to build up
> > > a CustomKeycloakConfigResolver.
> > > We configured the web.xml like this:
> > > [web.xml]
> > > <web-app>
> > > ...
> > > <security-constraint>
> > > ?<web-resource-collection>
> > > ? <web-resource-name>portal</web-resource-name>
> > > ? <url-pattern>/portal/*</url-pattern>
> > > ?</web-resource-collection>
> > > ?<auth-constraint>
> > > ? <role-name>user</role-name>
> > > ?</auth-constraint>
> > > </security-constraint>
> > > <security-constraint>
> > > ?<web-resource-collection>
> > > ? <web-resource-name>public</web-resource-name>
> > > ? <url-pattern>/portal/pages/willkommen.jsf</url-pattern>
> > > ? <url-pattern>/portal/pages/logout.jsf</url-pattern>
> > > ?</web-resource-collection>
> > > </security-constraint>
> > > 
> > > <login-config>
> > > ?<auth-method>KEYCLOAK</auth-method>
> > > </login-config>
> > > 
> > > <security-role>
> > > ?<role-name>user</role-name>
> > > </security-role>
> > > ...
> > > <context-param>
> > > ?<param-name>keycloak.config.resolver</param-name>
> > > ?<param-
> > > value>de.sample.security.MandantBasedKeycloakConfigResolver</para
> > > m-value>
> > > </context-param>
> > > ...
> > > </web-app>
> > > 
> > > As you can see everything under portal is restricted with two
> > > exceptions. The code of MandantBasedKeycloakConfigResolver is
> > > straight forward and adapted to the example code [2]. In our
> > > example we consider that the url has a query parameter that
> > > provides an id which we can map to a corresponding keycloak.json
> > > file. A sample would be "https://localhost:8443/SampleApp/portal/
> > > pages/willkommen.jsf?kId=1".
> > > 
> > > After deployment I realized, that the KeycloakConfigResolver is
> > > called 44 times (see log entries [3]). As it turns out the
> > > KeycloakConfigResolver.resolve() methode is called for every
> > > resource that is loaded through get requests to display the site.
> > > I did not expect that many invocation, since the resources are
> > > not protected.
> > > 
> > > Can you please tell me if this behaviour is correct? What is my
> > > error in adopting the mulity tenancy sample? How can we
> > > prevent/workaround that many calls?
> > > While researching I found a jira https://issues.jboss.org/browse/
> > > KEYCLOAK-8616 with a potentially similar problem. Here they use
> > > keycloak to secure a spring boot application and have troubles
> > > when a sso redirection occurs.
> > > 
> > > Regards,
> > > Andreas
> > > 
> > > [1] https://www.keycloak.org/docs/latest/securing_apps/index.html
> > > #_multi_tenancy
> > > 
> > > [2] public KeycloakDeployment resolve(HttpFacade.Request request)
> > > {
> > > 
> > > ????????LOGGER.debug("MandantBasedKeycloakConfigResolver.resolve(
> > > ) - counter:" + counter++);
> > > ????????final String mandantId = request.getFirstParam("kId");
> > > ????????LOGGER.debug("MandantBasedKeycloakConfigResolver.resolve(
> > > ) - requestFirstParam(kId):" + mandantId);
> > > ????????LOGGER.debug("MandantBasedKeycloakConfigResolver.resolve(
> > > ) - uri:" + request.getURI());
> > > 
> > > ????????if (mandantId == null || mandantId.isEmpty()) {
> > > ????????????// throw new IllegalStateException("Not able to
> > > resolve realm for parameter kId - Parameter not found!");
> > > ????????????return null;
> > > ????????}
> > > 
> > > ????????KeycloakDeployment deployment = cache.get(mandantId);
> > > ????????if (deployment == null) {
> > > 
> > > ????????????String keycloakConfigFilename =
> > > resolveKeycloakConfigFilename(mandantId);
> > > 
> > > ????????????InputStream is = getClass().getResourceAsStream("/" +
> > > keycloakConfigFilename);
> > > ????????????if (is == null) {
> > > ????????????????// throw new IllegalStateException("Not able to
> > > find the file /" + keycloakConfigFilename);
> > > ????????????????return null;
> > > ????????????}
> > > ????????????LOGGER.debug("MandantBasedKeycloakConfigResolver.reso
> > > lve() - is IS==null?:" + (is == null));
> > > 
> > > ????????????deployment = KeycloakDeploymentBuilder.build(is);
> > > ????????????cache.put(mandantId, deployment);
> > > ????????}
> > > 
> > > ????????return deployment;
> > > ????}
> > > 
> > > [3]
> > > 17:28:43,281 DEBUG
> > > [de.sample.security.MandantBasedKeycloakConfigResolver] (default
> > > task-4) MandantBasedKeycloakConfigResolver.resolve() - counter:0
> > > 17:28:50,215 DEBUG
> > > [de.sample.security.MandantBasedKeycloakConfigResolver] (default
> > > task-4) MandantBasedKeycloakConfigResolver.resolve() -
> > > requestFirstParam(kId):3
> > > 17:28:50,228 DEBUG
> > > [de.sample.security.MandantBasedKeycloakConfigResolver] (default
> > > task-4) MandantBasedKeycloakConfigResolver.resolve() - uri:https:
> > > //localhost:8443/SampleApp/portal/pages/willkommen.jsf?kId=3
> > > 17:28:50,229 DEBUG
> > > [de.sample.security.MandantBasedKeycloakConfigResolver] (default
> > > task-4) MandantBasedKeycloakConfigResolver.resolve() - is
> > > IS==null?:false
> > > 17:28:50,496 DEBUG
> > > [de.sample.security.MandantBasedKeycloakConfigResolver] (default
> > > task-4) MandantBasedKeycloakConfigResolver.resolve() - counter:1
> > > 17:28:50,496 DEBUG
> > > [de.sample.security.MandantBasedKeycloakConfigResolver] (default
> > > task-4) MandantBasedKeycloakConfigResolver.resolve() -
> > > requestFirstParam(kId):3
> > > 17:28:50,496 DEBUG
> > > [de.sample.security.MandantBasedKeycloakConfigResolver] (default
> > > task-4) MandantBasedKeycloakConfigResolver.resolve() - uri:https:
> > > //localhost:8443/SampleApp/portal/pages/willkommen.jsf?kId=3
> > > 17:28:50,496 DEBUG
> > > [de.sample.security.MandantBasedKeycloakConfigResolver] (default
> > > task-4) MandantBasedKeycloakConfigResolver.resolve() - counter:2
> > > 17:28:50,496 DEBUG
> > > [de.sample.security.MandantBasedKeycloakConfigResolver] (default
> > > task-4) MandantBasedKeycloakConfigResolver.resolve() -
> > > requestFirstParam(kId):3
> > > 17:28:50,496 DEBUG
> > > [de.sample.security.MandantBasedKeycloakConfigResolver] (default
> > > task-4) MandantBasedKeycloakConfigResolver.resolve() - uri:https:
> > > //localhost:8443/SampleApp/portal/pages/willkommen.jsf?kId=3
> > > 17:28:50,933 INFO??[stdout] (default task-4) INIT Willkommen
> > > 17:28:50,933 INFO??[stdout] (default task-4) initialized mandant
> > > <<<<<<<<<<<<<
> > > 
> > > 17:28:51,168 DEBUG
> > > [de.sample.security.MandantBasedKeycloakConfigResolver] (default
> > > task-5) MandantBasedKeycloakConfigResolver.resolve() - counter:3
> > > 17:28:51,168 DEBUG
> > > [de.sample.security.MandantBasedKeycloakConfigResolver] (default
> > > task-5) MandantBasedKeycloakConfigResolver.resolve() -
> > > requestFirstParam(kId):null
> > > 17:28:51,168 DEBUG
> > > [de.sample.security.MandantBasedKeycloakConfigResolver] (default
> > > task-5) MandantBasedKeycloakConfigResolver.resolve() - uri:https:
> > > //localhost:8443/SampleApp/javax.faces.resource/components.css.js
> > > f;jsessionid=6YidBEhtdxxI3NAASHOPab5bdBN_JAOjgqf8qHeh.localhost?l
> > > n=primefaces&v=6.1
> > > 17:28:51,168 ERROR [io.undertow.request] (default task-5)
> > > UT005023: Exception handling request to
> > > /SampleApp/javax.faces.resource/components.css.jsf;jsessionid=6Yi
> > > dBEhtdxxI3NAASHOPab5bdBN_JAOjgqf8qHeh.localhost:
> > > java.lang.IllegalStateException: Not able to resolve realm for
> > > parameter kId - Parameter not found!
> > > at
> > > de.sample.security.MandantBasedKeycloakConfigResolver.resolve(Man
> > > dantBasedKeycloakConfigResolver.java:46) [classes:]
> > > at
> > > org.keycloak.adapters.AdapterDeploymentContext.resolveDeployment(
> > > AdapterDeploymentContext.java:88) [keycloak-adapter-core-
> > > 4.0.0.Final.jar:4.0.0.Final]
> > > at
> > > org.keycloak.adapters.PreAuthActionsHandler.preflightCors(PreAuth
> > > ActionsHandler.java:107) [keycloak-adapter-core-
> > > 4.0.0.Final.jar:4.0.0.Final]
> > > at
> > > org.keycloak.adapters.PreAuthActionsHandler.handleRequest(PreAuth
> > > ActionsHandler.java:79) [keycloak-adapter-core-
> > > 4.0.0.Final.jar:4.0.0.Final]
> > > at
> > > org.keycloak.adapters.undertow.ServletPreAuthActionsHandler.handl
> > > eRequest(ServletPreAuthActionsHandler.java:68) [keycloak-
> > > undertow-adapter-4.0.0.Final.jar:4.0.0.Final]
> > > at
> > > io.undertow.server.handlers.PredicateHandler.handleRequest(Predic
> > > ateHandler.java:43) [undertow-core-1.3.31.Final-redhat-
> > > 3.jar:1.3.31.Final-redhat-3]
> > > at
> > > io.undertow.servlet.handlers.ServletInitialHandler.handleFirstReq
> > > uest(ServletInitialHandler.java:285) [undertow-servlet-
> > > 1.3.31.Final-redhat-3.jar:1.3.31.Final-redhat-3]
> > > at
> > > io.undertow.servlet.handlers.ServletInitialHandler.dispatchReques
> > > t(ServletInitialHandler.java:264) [undertow-servlet-1.3.31.Final-
> > > redhat-3.jar:1.3.31.Final-redhat-3]
> > > at
> > > io.undertow.servlet.handlers.ServletInitialHandler.access$000(Ser
> > > vletInitialHandler.java:81) [undertow-servlet-1.3.31.Final-
> > > redhat-3.jar:1.3.31.Final-redhat-3]
> > > at
> > > io.undertow.servlet.handlers.ServletInitialHandler$1.handleReques
> > > t(ServletInitialHandler.java:175) [undertow-servlet-1.3.31.Final-
> > > redhat-3.jar:1.3.31.Final-redhat-3]
> > > at
> > > io.undertow.server.Connectors.executeRootHandler(Connectors.java:
> > > 324) [undertow-core-1.3.31.Final-redhat-3.jar:1.3.31.Final-
> > > redhat-3]
> > > at
> > > io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.ja
> > > va:803) [undertow-core-1.3.31.Final-redhat-3.jar:1.3.31.Final-
> > > redhat-3]
> > > at
> > > java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecu
> > > tor.java:1142) [rt.jar:1.8.0_112]
> > > at
> > > java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExec
> > > utor.java:617) [rt.jar:1.8.0_112]
> > > at java.lang.Thread.run(Thread.java:745) [rt.jar:1.8.0_112]
> > > 
> > > .......
> > > 
> > > 17:28:51,824 DEBUG
> > > [de.sample.security.MandantBasedKeycloakConfigResolver] (default
> > > task-50) MandantBasedKeycloakConfigResolver.resolve() -
> > > counter:43
> > > 17:28:51,825 DEBUG
> > > [de.sample.security.MandantBasedKeycloakConfigResolver] (default
> > > task-50) MandantBasedKeycloakConfigResolver.resolve() -
> > > requestFirstParam(kId):null
> > > 17:28:51,825 DEBUG
> > > [de.sample.security.MandantBasedKeycloakConfigResolver] (default
> > > task-50) MandantBasedKeycloakConfigResolver.resolve() - uri:https
> > > ://localhost:8443/SampleApp/javax.faces.resource/customJs/customJ
> > > avaScript.js.jsf;jsessionid=6YidBEhtdxxI3NAASHOPab5bdBN_JAOjgqf8q
> > > Heh.localhost?ln=ultima-layout
> > > 17:28:51,825 ERROR [io.undertow.request] (default task-50)
> > > UT005023: Exception handling request to
> > > /SampleApp/javax.faces.resource/customJs/customJavaScript.js.jsf;
> > > jsessionid=6YidBEhtdxxI3NAASHOPab5bdBN_JAOjgqf8qHeh.localhost:
> > > java.lang.IllegalStateException: Not able to resolve realm for
> > > parameter kId - Parameter not found!
> > > at
> > > de.sample.security.MandantBasedKeycloakConfigResolver.resolve(Man
> > > dantBasedKeycloakConfigResolver.java:46) [classes:]
> > > at
> > > org.keycloak.adapters.AdapterDeploymentContext.resolveDeployment(
> > > AdapterDeploymentContext.java:88) [keycloak-adapter-core-
> > > 4.0.0.Final.jar:4.0.0.Final]
> > > at
> > > org.keycloak.adapters.PreAuthActionsHandler.preflightCors(PreAuth
> > > ActionsHandler.java:107) [keycloak-adapter-core-
> > > 4.0.0.Final.jar:4.0.0.Final]
> > > at
> > > org.keycloak.adapters.PreAuthActionsHandler.handleRequest(PreAuth
> > > ActionsHandler.java:79) [keycloak-adapter-core-
> > > 4.0.0.Final.jar:4.0.0.Final]
> > > at
> > > org.keycloak.adapters.undertow.ServletPreAuthActionsHandler.handl
> > > eRequest(ServletPreAuthActionsHandler.java:68) [keycloak-
> > > undertow-adapter-4.0.0.Final.jar:4.0.0.Final]
> > > at
> > > io.undertow.server.handlers.PredicateHandler.handleRequest(Predic
> > > ateHandler.java:43) [undertow-core-1.3.31.Final-redhat-
> > > 3.jar:1.3.31.Final-redhat-3]
> > > at
> > > io.undertow.servlet.handlers.ServletInitialHandler.handleFirstReq
> > > uest(ServletInitialHandler.java:285) [undertow-servlet-
> > > 1.3.31.Final-redhat-3.jar:1.3.31.Final-redhat-3]
> > > at
> > > io.undertow.servlet.handlers.ServletInitialHandler.dispatchReques
> > > t(ServletInitialHandler.java:264) [undertow-servlet-1.3.31.Final-
> > > redhat-3.jar:1.3.31.Final-redhat-3]
> > > at
> > > io.undertow.servlet.handlers.ServletInitialHandler.access$000(Ser
> > > vletInitialHandler.java:81) [undertow-servlet-1.3.31.Final-
> > > redhat-3.jar:1.3.31.Final-redhat-3]
> > > at
> > > io.undertow.servlet.handlers.ServletInitialHandler$1.handleReques
> > > t(ServletInitialHandler.java:175) [undertow-servlet-1.3.31.Final-
> > > redhat-3.jar:1.3.31.Final-redhat-3]
> > > at
> > > io.undertow.server.Connectors.executeRootHandler(Connectors.java:
> > > 324) [undertow-core-1.3.31.Final-redhat-3.jar:1.3.31.Final-
> > > redhat-3]
> > > at
> > > io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.ja
> > > va:803) [undertow-core-1.3.31.Final-redhat-3.jar:1.3.31.Final-
> > > redhat-3]
> > > at
> > > java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecu
> > > tor.java:1142) [rt.jar:1.8.0_112]
> > > at
> > > java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExec
> > > utor.java:617) [rt.jar:1.8.0_112]
> > > at java.lang.Thread.run(Thread.java:745)
> > > [rt.jar:1.8.0_112]keycloak-user mailing list
> > > keycloak-user at lists.jboss.org
> > > https://lists.jboss.org/mailman/listinfo/keycloak-userkeycloak-us
> > > er mailing list
> > > keycloak-user at lists.jboss.org
> > > https://lists.jboss.org/mailman/listinfo/keycloak-userkeycloak-us
> > > er mailing list
> > > keycloak-user at lists.jboss.org
> > > https://lists.jboss.org/mailman/listinfo/keycloak-user
> 
> 
> 

From dt at acutus.pro  Mon Nov  5 00:54:25 2018
From: dt at acutus.pro (Dmitry Telegin)
Date: Mon, 05 Nov 2018 08:54:25 +0300
Subject: [keycloak-user] filter group claim in token per client
In-Reply-To: <VI1PR0402MB3696E4DCAFFE7EEEEB0EAF70E9CF0@VI1PR0402MB3696.eurprd04.prod.outlook.com>
References: <VI1PR0402MB3696E4DCAFFE7EEEEB0EAF70E9CF0@VI1PR0402MB3696.eurprd04.prod.outlook.com>
Message-ID: <1541397265.3650.7.camel@acutus.pro>

Hello Ronald,

As in the case with authentication, JavaScript is to the rescue again :) You can create a script mapper for groups that will do additional group filtering based on the client, and use it instead of the built-in one.

To avoid explicitly configuring it for each and every client, you can create a Client Scope (can be called "Client Template" depending on the KC version), define the mapper in the scope, and add it do default scopes.

Cheers,
Dmitry Telegin
CTO, Acutus s.r.o.
Keycloak Consulting and Training

Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
+42 (022) 888-30-71
E-mail: info at acutus.pro 

On Fri, 2018-11-02 at 10:30 +0000, Ronald Demneri wrote:
> Hello everyone,
> 
> Is there a way to filter the groups a user is a member of per client, based on clientId (which is part of the group name(s) in AD). Let's say that user Ronald is member of??group_client1, group_client2 and group_client3, so using a group mapper, the token will contain a claim like group:["group_client1", "group_client2", "group_client3"]. Upon logging in to client1 app, I want to customize the group claim so that it contains only the respective group_client1 value.
> 
> Thanks in advance,
> 
> Ronald
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From melissa.palmer at gmail.com  Mon Nov  5 01:49:56 2018
From: melissa.palmer at gmail.com (melissa.palmer at gmail.com)
Date: Sun, 4 Nov 2018 23:49:56 -0700 (MST)
Subject: [keycloak-user] Organization Based Accounts and Permissions
In-Reply-To: <6dffa6196ee54b9cbdb9748e49c307f5@vitblrex2013.viteos.com>
References: <BLU171-W65F10FDC204C4BD97CC5A4C1130@phx.gbl>
	<1771768436.5402397.1471472732212.JavaMail.zimbra@redhat.com>
	<429db618511e488db82ba3c37209b2d7@vitblrex2013.viteos.com>
	<1793616169.5522096.1471521295431.JavaMail.zimbra@redhat.com>
	<6dffa6196ee54b9cbdb9748e49c307f5@vitblrex2013.viteos.com>
Message-ID: <1541400596183-0.post@n6.nabble.com>

Hi, 

I cannot find the "authz/servlet-authz-app" quickstart am looking under: 
https://github.com/keycloak/keycloak-quickstarts
or 
https://github.com/keycloak/keycloak/tree/master/examples

Also on your comment of
"I'm really thinking about pushing a new example application with a
permission model similar to github, it will be fun :) "
this would be great!!! if you could do that. 

Thanks In Advance
Melissa




--
Sent from: http://keycloak-user.88327.x6.nabble.com/

From sthorger at redhat.com  Mon Nov  5 02:24:52 2018
From: sthorger at redhat.com (Stian Thorgersen)
Date: Mon, 5 Nov 2018 08:24:52 +0100
Subject: [keycloak-user] Turkish translation review needed
In-Reply-To: <CAJgngAdr53nXc6cHgC2yvnOp9WvApeYy-nKNT9JYmRzDC5XqTQ@mail.gmail.com>
References: <CAJgngAdr53nXc6cHgC2yvnOp9WvApeYy-nKNT9JYmRzDC5XqTQ@mail.gmail.com>
Message-ID: <CAJgngAe=HisS6m4J9M_-NAKwvi=1+vjDhdPv847=Zj7ONXFwuA@mail.gmail.com>

Anyone?

On Wed, 31 Oct 2018 at 06:37, Stian Thorgersen <sthorger at redhat.com> wrote:

> We have a PR for Turkish translations for Keycloak. Can someone from the
> community review this please?
>
> https://github.com/keycloak/keycloak/pull/5678
>

From sthorger at redhat.com  Mon Nov  5 02:25:05 2018
From: sthorger at redhat.com (Stian Thorgersen)
Date: Mon, 5 Nov 2018 08:25:05 +0100
Subject: [keycloak-user] Review Latvian translation
In-Reply-To: <CAJgngAcwS5bRXpN+cLtGi=fTExqsUJH_9yaJx4GL1d82d0r-AA@mail.gmail.com>
References: <CAJgngAcwS5bRXpN+cLtGi=fTExqsUJH_9yaJx4GL1d82d0r-AA@mail.gmail.com>
Message-ID: <CAJgngAdDd0Bo3QtS9ELa3KgLzFFDURKqESYwev+1KQvqpbujWA@mail.gmail.com>

Anyone?

On Wed, 31 Oct 2018 at 06:36, Stian Thorgersen <sthorger at redhat.com> wrote:

> We have a PR for Latvian translations for Keycloak. Can someone from the
> community review it please?
>
> https://github.com/keycloak/keycloak/pull/5676
>

From slaskawi at redhat.com  Mon Nov  5 04:46:07 2018
From: slaskawi at redhat.com (Sebastian Laskawiec)
Date: Mon, 5 Nov 2018 10:46:07 +0100
Subject: [keycloak-user] Java 11 (Docker container base)
In-Reply-To: <69c1088396cd4aa5aa8a661637dfcf37@zoomint.com>
References: <564d3037b9974039868327e2ed2bee3d@zoomint.com>
	<CAF83W6+3+gBGbcY+GHEw9zVcvAPNHf=TYC_mYnU4R2QRVuUaOw@mail.gmail.com>
	<1d8ec6c8800f46aa82e3ba96c8951086@zoomint.com>
	<CAA9R9O79OMxvX9pj9CDWeN4Xeug_KJ7f3W=iYKRfWQ71xVFRSA@mail.gmail.com>
	<69c1088396cd4aa5aa8a661637dfcf37@zoomint.com>
Message-ID: <CAA9R9O5Y-YZNR_JRQF6p4TOvrqp1+GYTqicjtYtUtR5yMjB7dQ@mail.gmail.com>

I believe using the commercial Hotspot JVM provided by Oracle will not be
an option. We will probably stick with OpenJDK.

BTW, all JDK LTS releases will receive much longer updates. Please see this
blog post for the reference:
https://developers.redhat.com/blog/2018/09/24/the-future-of-java-and-openjdk-updates-without-oracle-support/

On Thu, Oct 25, 2018 at 4:37 PM Pavel Micka <Pavel.Micka at zoomint.com> wrote:

> It was mainly a question about how the support/updates will be handled -
> if Keycloak will rely on ?community only? updates for Java 8 or if there
> will be switch to new Java (updated by Oracle in the half-year window).
>
> I am sure that our customers will ask in reviews, how we have the security
> updates are handled throughout our solution. And if all parts of our
> solution rely only on secure resources.
>
>
>
> So the question should more be: Will Java under Keycloak be periodically
> updated (without commercial support) after January 2019?
>
>
>
> Regards,
>
>
>
> Pavel
>
>
>
> *From:* Sebastian Laskawiec <slaskawi at redhat.com>
> *Sent:* Thursday, October 25, 2018 4:00 PM
> *To:* Pavel Micka <Pavel.Micka at zoomint.com>
> *Cc:* Meissa M'baye Sakho <msakho at redhat.com>; keycloak-user <
> keycloak-user at lists.jboss.org>
>
>
> *Subject:* Re: [keycloak-user] Java 11 (Docker container base)
>
>
>
> From the support perspective, Red Hat offers extended support till June
> 2023 [1].
>
>
>
> Our move towards JDK11 (LTS) relies heavily on Wildfly/EAP Team. I guess
> we still have plenty of time to do the switch, so I wouldn't rush things
> too much.
>
>
>
> BTW, why do you need JDK11, especially in the container?
>
>
>
> [1] https://access.redhat.com/articles/1299013
>
>
>
> On Tue, Oct 23, 2018 at 1:13 PM Pavel Micka <Pavel.Micka at zoomint.com>
> wrote:
>
> Sorry, end of january (my fault):
> https://www.oracle.com/technetwork/java/eol-135779.html. Then Oracle Java
> and OpenJDK will most probably start to diverge, as OpenJDK will not have
> access to Oracle repos (afaik). So the speed of security fixes will depend
> on willigness of community to fix the upcomming issues.
>
> Pavel
>
> From: Meissa M'baye Sakho <msakho at redhat.com>
> Sent: Tuesday, October 23, 2018 11:04 AM
> To: Pavel Micka <Pavel.Micka at zoomint.com>
> Cc: keycloak-user <keycloak-user at lists.jboss.org>
> Subject: Re: [keycloak-user] Java 11 (Docker container base)
>
> Hello,
> Pavel, where did you get the information that the official Java 8 support
> will cease at the end of december?
> https://access.redhat.com/articles/1299013
> https://www.oracle.com/technetwork/java/javase/eol-135779.html
> Meissa
>
> Le lun. 22 oct. 2018 ? 16:33, Pavel Micka <Pavel.Micka at zoomint.com<mailto:
> Pavel.Micka at zoomint.com>> a ?crit :
> Hello everyone,
>
> What is the plan for Java 11 support? The point is that current versions
> of Docker containers are based on OpenJDK 8, but the official Java 8
> support will cease at the end of December. Will Keycloak use Java 11 by
> that time or will it rely on updates provided by the community.
>
> This is important to us, as Keycloak is important part of our app security.
>
> Thanks,
>
> Pavel
>
> // I have found this ticket in Jira, but it does not provide too many
> details: https://issues.jboss.org/browse/KEYCLOAK-7811
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>
> https://lists.jboss.org/mailman/listinfo/keycloak-user
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
>

From ronald.demneri at amdtia.com  Mon Nov  5 05:00:00 2018
From: ronald.demneri at amdtia.com (Ronald Demneri)
Date: Mon, 5 Nov 2018 10:00:00 +0000
Subject: [keycloak-user] filter group claim in token per client
In-Reply-To: <1541397265.3650.7.camel@acutus.pro>
References: <VI1PR0402MB3696E4DCAFFE7EEEEB0EAF70E9CF0@VI1PR0402MB3696.eurprd04.prod.outlook.com>
	<1541397265.3650.7.camel@acutus.pro>
Message-ID: <VI1PR0402MB369663EA52F0699AF650CE58E9CA0@VI1PR0402MB3696.eurprd04.prod.outlook.com>

Hello Dmitry,

Thanks for the response. In fact I tried that before posting here, created a custom script mapper for the client that I have configured. The problem is that the script will return a list of objects, not an array of strings, which is what I am expecting.

What do I need to pay extra attention in order to solve this?


Thanks in advance and Regards,
Ronald

-----Original Message-----
From: Dmitry Telegin <dt at acutus.pro> 
Sent: 05.Nov.2018 6:54 AM
To: Ronald Demneri <ronald.demneri at amdtia.com>; keycloak-user at lists.jboss.org
Subject: Re: [keycloak-user] filter group claim in token per client

Hello Ronald,

As in the case with authentication, JavaScript is to the rescue again :) You can create a script mapper for groups that will do additional group filtering based on the client, and use it instead of the built-in one.

To avoid explicitly configuring it for each and every client, you can create a Client Scope (can be called "Client Template" depending on the KC version), define the mapper in the scope, and add it do default scopes.

Cheers,
Dmitry Telegin
CTO, Acutus s.r.o.
Keycloak Consulting and Training

Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
+42 (022) 888-30-71
E-mail: info at acutus.pro 

On Fri, 2018-11-02 at 10:30 +0000, Ronald Demneri wrote:
> Hello everyone,
> 
> Is there a way to filter the groups a user is a member of per client, based on clientId (which is part of the group name(s) in AD). Let's say that user Ronald is member of??group_client1, group_client2 and group_client3, so using a group mapper, the token will contain a claim like group:["group_client1", "group_client2", "group_client3"]. Upon logging in to client1 app, I want to customize the group claim so that it contains only the respective group_client1 value.
> 
> Thanks in advance,
> 
> Ronald
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user


From psilva at redhat.com  Mon Nov  5 06:10:06 2018
From: psilva at redhat.com (Pedro Igor Silva)
Date: Mon, 5 Nov 2018 09:10:06 -0200
Subject: [keycloak-user] Organization Based Accounts and Permissions
In-Reply-To: <1541400596183-0.post@n6.nabble.com>
References: <BLU171-W65F10FDC204C4BD97CC5A4C1130@phx.gbl>
	<1771768436.5402397.1471472732212.JavaMail.zimbra@redhat.com>
	<429db618511e488db82ba3c37209b2d7@vitblrex2013.viteos.com>
	<1793616169.5522096.1471521295431.JavaMail.zimbra@redhat.com>
	<6dffa6196ee54b9cbdb9748e49c307f5@vitblrex2013.viteos.com>
	<1541400596183-0.post@n6.nabble.com>
Message-ID: <CAJrcDBc8UdZ9J-RMH-A51frsn1WcxrSE8mpvqPo-JzYO5+_oig@mail.gmail.com>

This one
https://github.com/keycloak/keycloak-quickstarts/tree/latest/app-authz-jee-servlet
?

On Mon, Nov 5, 2018 at 7:47 AM melissa.palmer at gmail.com <
melissa.palmer at gmail.com> wrote:

> Hi,
>
> I cannot find the "authz/servlet-authz-app" quickstart am looking under:
> https://github.com/keycloak/keycloak-quickstarts
> or
> https://github.com/keycloak/keycloak/tree/master/examples
>
> Also on your comment of
> "I'm really thinking about pushing a new example application with a
> permission model similar to github, it will be fun :) "
> this would be great!!! if you could do that.
>
> Thanks In Advance
> Melissa
>
>
>
>
> --
> Sent from: http://keycloak-user.88327.x6.nabble.com/
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

From ronald.demneri at amdtia.com  Mon Nov  5 06:11:32 2018
From: ronald.demneri at amdtia.com (Ronald Demneri)
Date: Mon, 5 Nov 2018 11:11:32 +0000
Subject: [keycloak-user] filter group claim in token per client
In-Reply-To: <VI1PR0402MB369663EA52F0699AF650CE58E9CA0@VI1PR0402MB3696.eurprd04.prod.outlook.com>
References: <VI1PR0402MB3696E4DCAFFE7EEEEB0EAF70E9CF0@VI1PR0402MB3696.eurprd04.prod.outlook.com>
	<1541397265.3650.7.camel@acutus.pro>
	<VI1PR0402MB369663EA52F0699AF650CE58E9CA0@VI1PR0402MB3696.eurprd04.prod.outlook.com>
Message-ID: <VI1PR0402MB369672A317F1F66FE587E1F5E9CA0@VI1PR0402MB3696.eurprd04.prod.outlook.com>

Hello,

In the script authenticator there was authenticationSession which I used to get the clientId. There is no such variable in the script mapper, and If I define such mapper in the client template, I suppose I'd need some mechanism to get the client name and then make the filtering of the groups that need to be inserted in the token. How do I do that? Is there any documentation available for this online?


Thanks again for your support!
Ronald


-----Original Message-----
From: keycloak-user-bounces at lists.jboss.org <keycloak-user-bounces at lists.jboss.org> On Behalf Of Ronald Demneri
Sent: 05.Nov.2018 11:00 AM
To: Dmitry Telegin <dt at acutus.pro>; keycloak-user at lists.jboss.org
Subject: Re: [keycloak-user] filter group claim in token per client

Hello Dmitry,

Thanks for the response. In fact I tried that before posting here, created a custom script mapper for the client that I have configured. The problem is that the script will return a list of objects, not an array of strings, which is what I am expecting.

What do I need to pay extra attention in order to solve this?


Thanks in advance and Regards,
Ronald

-----Original Message-----
From: Dmitry Telegin <dt at acutus.pro> 
Sent: 05.Nov.2018 6:54 AM
To: Ronald Demneri <ronald.demneri at amdtia.com>; keycloak-user at lists.jboss.org
Subject: Re: [keycloak-user] filter group claim in token per client

Hello Ronald,

As in the case with authentication, JavaScript is to the rescue again :) You can create a script mapper for groups that will do additional group filtering based on the client, and use it instead of the built-in one.

To avoid explicitly configuring it for each and every client, you can create a Client Scope (can be called "Client Template" depending on the KC version), define the mapper in the scope, and add it do default scopes.

Cheers,
Dmitry Telegin
CTO, Acutus s.r.o.
Keycloak Consulting and Training

Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
+42 (022) 888-30-71
E-mail: info at acutus.pro 

On Fri, 2018-11-02 at 10:30 +0000, Ronald Demneri wrote:
> Hello everyone,
> 
> Is there a way to filter the groups a user is a member of per client, based on clientId (which is part of the group name(s) in AD). Let's say that user Ronald is member of??group_client1, group_client2 and group_client3, so using a group mapper, the token will contain a claim like group:["group_client1", "group_client2", "group_client3"]. Upon logging in to client1 app, I want to customize the group claim so that it contains only the respective group_client1 value.
> 
> Thanks in advance,
> 
> Ronald
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user


From melissa.palmer at gmail.com  Mon Nov  5 06:14:22 2018
From: melissa.palmer at gmail.com (Melissa Palmer)
Date: Mon, 5 Nov 2018 13:14:22 +0200
Subject: [keycloak-user] Organization Based Accounts and Permissions
In-Reply-To: <CAJrcDBc8UdZ9J-RMH-A51frsn1WcxrSE8mpvqPo-JzYO5+_oig@mail.gmail.com>
References: <BLU171-W65F10FDC204C4BD97CC5A4C1130@phx.gbl>
	<1771768436.5402397.1471472732212.JavaMail.zimbra@redhat.com>
	<429db618511e488db82ba3c37209b2d7@vitblrex2013.viteos.com>
	<1793616169.5522096.1471521295431.JavaMail.zimbra@redhat.com>
	<6dffa6196ee54b9cbdb9748e49c307f5@vitblrex2013.viteos.com>
	<1541400596183-0.post@n6.nabble.com>
	<CAJrcDBc8UdZ9J-RMH-A51frsn1WcxrSE8mpvqPo-JzYO5+_oig@mail.gmail.com>
Message-ID: <CAHTQH9+k36Ty4pteBMcQ_SSmd_u+rgh3PhKiFT+wuco1ZdmHuA@mail.gmail.com>

Thanks will take a look. Did you ever do a " example application with a
permission model similar to github" at all?

On Mon, 5 Nov 2018 at 13:10, Pedro Igor Silva <psilva at redhat.com> wrote:

> This one
> https://github.com/keycloak/keycloak-quickstarts/tree/latest/app-authz-jee-servlet
> ?
>
> On Mon, Nov 5, 2018 at 7:47 AM melissa.palmer at gmail.com <
> melissa.palmer at gmail.com> wrote:
>
>> Hi,
>>
>> I cannot find the "authz/servlet-authz-app" quickstart am looking under:
>> https://github.com/keycloak/keycloak-quickstarts
>> or
>> https://github.com/keycloak/keycloak/tree/master/examples
>>
>> Also on your comment of
>> "I'm really thinking about pushing a new example application with a
>> permission model similar to github, it will be fun :) "
>> this would be great!!! if you could do that.
>>
>> Thanks In Advance
>> Melissa
>>
>>
>>
>>
>> --
>> Sent from: http://keycloak-user.88327.x6.nabble.com/
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>

From me at mpouss.in  Mon Nov  5 06:17:18 2018
From: me at mpouss.in (Mathieu Poussin)
Date: Mon, 05 Nov 2018 12:17:18 +0100
Subject: [keycloak-user] Add CA certificates for LDAPS ?
In-Reply-To: <1541018026.2120.1.camel@acutus.pro>
References: <1662f626b66.d913c15131404.552465038631491981@mpouss.in>
	<9a8a4961-c5fb-87e9-661c-bfd87e10da09@redhat.com>
	<16633c8bd7b.1093feebf42029.2315606082414745027@mpouss.in>
	<CAF83W6KnqNr2fhtmcKHSQoJBx3saza0CGn75VG99nVeEGETPPA@mail.gmail.com>
	<1541018026.2120.1.camel@acutus.pro>
Message-ID: <166e3975670.edec95a619314.6696607516355464263@mpouss.in>

I confirm this fixed the issue :)

So simple that I didn't think about it...

Thank you

 ---- On Wed, 31 Oct 2018 21:33:46 +0100 Dmitry Telegin <dt at acutus.pro> wrote ---- 
 > Mathieu, Meissa, 
 >  
 > Starting from 4.5.0, the Keycloak Docker image uses standalone-ha.xml instead of standalone.xml by default. I guess this is why your truststore settings are being ignored. 
 >  
 > I've also tested Keycloak + LDAP + self-signed cert + truststore on a non-Docker deployment - it works pretty well, so definitely not a Keycloak bug per se. 
 >  
 > Good luck! 
 > Dmitry Telegin 
 > CTO, Acutus s.r.o. 
 > Keycloak Consulting and Training 
 >  
 > Pod lipami street 339/52, 130 00 Prague 3, Czech Republic 
 > +42 (022) 888-30-71 
 > E-mail: info at acutus.pro 
 >  
 > On Wed, 2018-10-31 at 11:05 +0100, Meissa M'baye Sakho wrote: 
 > > Hello Mathieu, 
 > > did you manage to make it work? 
 > > If yes, could you tell me how? 
 > > Meissa 
 > >  
 > > > Le mar. 2 oct. 2018 ? 10:01, Mathieu Poussin <me at mpouss.in> a ?crit : 
 > >  
 > > > Hello Marek. 
 > > >  
 > > > I've done that already but looks like it is completely ignored. 
 > > > I have my custom truststore that have all my CA certificates (2), but I'm 
 > > > still seeing the same issue. (SPI is enabled on the LDAPS settings on the 
 > > > admin) 
 > > > Is there a way to make sure it has been loaded correctly? (I don't see any 
 > > > error when the application starts but it's not working as expected) 
 > > >  
 > > > Thanks. 
 > > > Mathieu 
 > > >  
 > > >  
 > > >  ---- On Mon, 01 Oct 2018 20:14:22 +0200 Marek Posolda < 
 > > > mposolda at redhat.com> wrote ---- 
 > > >  > You can configure the Truststore SPI, which is mentioned in our docs 
 > > >  > here: 
 > > >  > 
 > > > https://www.keycloak.org/docs/latest/server_installation/index.html#_truststore 
 > > >  > 
 > > >  > Some additional notes around LDAP are here: 
 > > >  > 
 > > > https://www.keycloak.org/docs/latest/server_admin/index.html#connect-to-ldap-over-ssl 
 > > >  > 
 > > >  > Marek 
 > > >  > 
 > > >  > 
 > > >  > On 01/10/18 13:27, Mathieu Poussin wrote: 
 > > >  > > Hello. 
 > > >  > > 
 > > >  > > What would be the recommended way to add a custom CA certificates ? 
 > > > The documentation has a lot of different ways and so far none of them 
 > > > worked : 
 > > >  > > 
 > > >  > > - The X509_CA_BUNDLE env variable thing (It's running in a 
 > > > container), I can see the certificates in the JKS store  but looks like 
 > > > they are completely ignored by the app server. 
 > > >  > > - Added custom SPI to load a custom JKS store, same, no error at 
 > > > server start but they are completely ignored by the app server. 
 > > >  > > 
 > > >  > > This is the error I am getting : 
 > > >  > > 
 > > >  > > Caused by: sun.security.validator.ValidatorException: PKIX path 
 > > > building failed: 
 > > > sun.security.provider.certpath.SunCertPathBuilderException: unable to find 
 > > > valid certification path to requested target 
 > > >  > >          at 
 > > > sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:397) 
 > > >  > >          at 
 > > > sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:302) 
 > > >  > >          at 
 > > > sun.security.validator.Validator.validate(Validator.java:262) 
 > > >  > >          at 
 > > > sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:324) 
 > > >  
 > > >  > >          at 
 > > > sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:229) 
 > > >  
 > > >  > >          at 
 > > > sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:124) 
 > > >  
 > > >  > >          at 
 > > > sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1596) 
 > > >  
 > > >  > >          ... 99 more 
 > > >  > > Caused by: 
 > > > sun.security.provider.certpath.SunCertPathBuilderException: unable to find 
 > > > valid certification path to requested target 
 > > >  > >          at 
 > > > sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:141) 
 > > >  
 > > >  > >          at 
 > > > sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:126) 
 > > >  
 > > >  > >          at 
 > > > java.security.cert.CertPathBuilder.build(CertPathBuilder.java:280) 
 > > >  > >          at 
 > > > sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:392) 
 > > >  > >          ... 105 more 
 > > >  > > 
 > > >  > > 
 > > >  > > Another option would be to disable certificate verification on LDAPS 
 > > > as it's a trusted environment (last resort but well so far nothing else 
 > > > worked), would there be a way to do that? 
 > > >  > > Connecting over LDAP is not an option a this prevent some features to 
 > > > work like password reset. 
 > > >  > > 
 > > >  > > Thanks. 
 > > >  > > 
 > > >  > > 
 > > >  > > _______________________________________________ 
 > > >  > > keycloak-user mailing list 
 > > >  > > keycloak-user at lists.jboss.org 
 > > >  > > https://lists.jboss.org/mailman/listinfo/keycloak-user 
 > > >  > 
 > > >  > 
 > > >  > 
 > > >  
 > > >  
 > > > _______________________________________________ 
 > > > keycloak-user mailing list 
 > > > keycloak-user at lists.jboss.org 
 > > > https://lists.jboss.org/mailman/listinfo/keycloak-user 
 > > >  
 > >  
 > > _______________________________________________ 
 > > keycloak-user mailing list 
 > > keycloak-user at lists.jboss.org 
 > > https://lists.jboss.org/mailman/listinfo/keycloak-user 
 > 




From psilva at redhat.com  Mon Nov  5 06:31:10 2018
From: psilva at redhat.com (Pedro Igor Silva)
Date: Mon, 5 Nov 2018 09:31:10 -0200
Subject: [keycloak-user] Organization Based Accounts and Permissions
In-Reply-To: <CAHTQH9+k36Ty4pteBMcQ_SSmd_u+rgh3PhKiFT+wuco1ZdmHuA@mail.gmail.com>
References: <BLU171-W65F10FDC204C4BD97CC5A4C1130@phx.gbl>
	<1771768436.5402397.1471472732212.JavaMail.zimbra@redhat.com>
	<429db618511e488db82ba3c37209b2d7@vitblrex2013.viteos.com>
	<1793616169.5522096.1471521295431.JavaMail.zimbra@redhat.com>
	<6dffa6196ee54b9cbdb9748e49c307f5@vitblrex2013.viteos.com>
	<1541400596183-0.post@n6.nabble.com>
	<CAJrcDBc8UdZ9J-RMH-A51frsn1WcxrSE8mpvqPo-JzYO5+_oig@mail.gmail.com>
	<CAHTQH9+k36Ty4pteBMcQ_SSmd_u+rgh3PhKiFT+wuco1ZdmHuA@mail.gmail.com>
Message-ID: <CAJrcDBf5xjbVKkfFafEjnuG_R7Yo0wOh+gue70raG63hCegOvw@mail.gmail.com>

Not yet, oops ... :)

On Mon, Nov 5, 2018 at 9:15 AM Melissa Palmer <melissa.palmer at gmail.com>
wrote:

> Thanks will take a look. Did you ever do a " example application with a
> permission model similar to github" at all?
>
> On Mon, 5 Nov 2018 at 13:10, Pedro Igor Silva <psilva at redhat.com> wrote:
>
>> This one
>> https://github.com/keycloak/keycloak-quickstarts/tree/latest/app-authz-jee-servlet
>> ?
>>
>> On Mon, Nov 5, 2018 at 7:47 AM melissa.palmer at gmail.com <
>> melissa.palmer at gmail.com> wrote:
>>
>>> Hi,
>>>
>>> I cannot find the "authz/servlet-authz-app" quickstart am looking under:
>>> https://github.com/keycloak/keycloak-quickstarts
>>> or
>>> https://github.com/keycloak/keycloak/tree/master/examples
>>>
>>> Also on your comment of
>>> "I'm really thinking about pushing a new example application with a
>>> permission model similar to github, it will be fun :) "
>>> this would be great!!! if you could do that.
>>>
>>> Thanks In Advance
>>> Melissa
>>>
>>>
>>>
>>>
>>> --
>>> Sent from: http://keycloak-user.88327.x6.nabble.com/
>>> _______________________________________________
>>> keycloak-user mailing list
>>> keycloak-user at lists.jboss.org
>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>
>>

From jambo_mcd at yahoo.co.uk  Mon Nov  5 07:34:06 2018
From: jambo_mcd at yahoo.co.uk (Jamie McDowell)
Date: Mon, 5 Nov 2018 12:34:06 +0000 (UTC)
Subject: [keycloak-user] Keycloak realm certificates export
In-Reply-To: <1540869193.2121.3.camel@acutus.pro>
References: <366471873.18450736.1539868880248.ref@mail.yahoo.com>
	<366471873.18450736.1539868880248@mail.yahoo.com>
	<653502666.27637230.1540814185148@mail.yahoo.com>
	<1868981234.27918435.1540827277989@mail.yahoo.com>
	<1540869193.2121.3.camel@acutus.pro>
Message-ID: <226622624.1563056.1541421246300@mail.yahoo.com>

Hi Dmitry,
Thanks for your response. I can confirm that this does provides the certs however this seems to be encrypted.?
Do you know how we can recreate this to provide the value that is visible in Keycloak console? I need to be able to get the decrypted value of the cert so i can pass this over to another application.?
Regards,
Jamie 

    On Tuesday, 30 October 2018, 03:13:17 GMT, Dmitry Telegin <dt at acutus.pro> wrote:  
 
 Hello Jamie,

Just FYU, there is also certificate endpoint that does not require authentication:
http://localhost:8080/auth/realms/master/protocol/openid-connect/certs
(replace your server name, port and realm)

Cheers,
Dmitry Telegin
CTO, Acutus s.r.o.
Keycloak Consulting and Training

Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
+42 (022) 888-30-71
E-mail: info at acutus.pro


On Mon, 2018-10-29 at 15:34 +0000, Jamie McDowell wrote:
> I have managed to obtain just the certificate using the below command in case anyone needs this in future
> ?/opt/jboss/keycloak/bin/kcadm get keys \--server <url> \--realm master \--user <user> \--password <password> \-r <realm> | grep "certificate*"
> Regards,
> Jamie?
> 
> ????On Monday, 29 October 2018, 11:56:25 GMT, Jamie McDowell <jambo_mcd at yahoo.co.uk> wrote:??
> ?
> ?Hi,
> 
> I am trying to find a way to be able to retrieve a realm certificate which can then be passed to Knox. When a realm is deployed, it generates a new public key, therefore any Knox Configuration would have to be updated with new corresponding certificates.?
> Knox is used to decrypt singed JWT's.
> Is this something that can be achieved?
> I have tried running kcadm to pull the certificate details however i am unable to provide only the cert details which i would then want to output into another file.
> Examples of kcadm?
> /opt/jboss/keycloak/bin/kcadm get keys \--server <url> \--realm master \--user <user> \--password <password> \-r <realm>
> Regards,
> Jamie????
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
  

From ssilvert at redhat.com  Mon Nov  5 08:40:55 2018
From: ssilvert at redhat.com (Stan Silvert)
Date: Mon, 5 Nov 2018 08:40:55 -0500
Subject: [keycloak-user] Account Page Fields
In-Reply-To: <1540878764.3824.3.camel@acutus.pro>
References: <CAHj77GUKR+YwKA+9j_aKSMiK412ksttVQovfsqifA9gibquFRQ@mail.gmail.com>
	<1540878764.3824.3.camel@acutus.pro>
Message-ID: <811a3326-b848-39b5-1f74-68a550bb2d50@redhat.com>

On 10/30/2018 1:52 AM, Dmitry Telegin wrote:
> Hello Aaron,
>
> I don't think this is easily doable with the current account UI. However, there are chances we will have it in the forthcoming rewrite thereof [1]. The revamped account UI should use REST APIs and be extensible with the means of React.js.
>
> This topic is of particular interest to me, as we in Mageia Linux are planning to migrate our IDM to Keycloak, and one of the problems to solve is to allow the users to upload their SSH pubkeys via the account UI. We're pretty determined to solve it, and to solve it soon, so stay tuned :)
>
> [1] https://issues.jboss.org/browse/KEYCLOAK-8421
That's right.? A proof of concept has already been built and merged into 
the code base.? You will indeed be able to create your own React 
components as extensions for the account console.

It's hard to say when this will be ready for prime time, but I'm 
shooting for a code-complete version in the first quarter of 2019.
>
> Cheers,
> Dmitry Telegin
> CTO, Acutus s.r.o.
> Keycloak Consulting and Training
>
> Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
> +42 (022) 888-30-71
> E-mail: info at acutus.pro
>
> On Fri, 2018-10-26 at 15:35 -0700, Aaron Echols wrote:
>> Hello All,
>>
>> How hard is to modify or add fields that could be modified in the users
>> account page? It would be nice to add a personal email field to have be
>> able to send their password reset email to. Currently, they can only send
>> to their employee addresses, which if they forget their password, makes the
>> email a moot point. Thank in advance for any ideas. :)
>> --
>> *Aaron Echols*
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user



From ulrik.lejon at mollyware.se  Mon Nov  5 09:08:59 2018
From: ulrik.lejon at mollyware.se (Ulrik Lejon)
Date: Mon, 5 Nov 2018 15:08:59 +0100
Subject: [keycloak-user] WFLYRS0015: No Servlet declaration found for JAX-RS
	application
Message-ID: <CAG2z6=Q1rh+0AVO4bTae7yj7ZapKFu_8y=OfgmFtNRU7wyxbVg@mail.gmail.com>

Hi,

I'm currently investigating upgrading from version 3.3.0 to 3.4.2 (as a
part of in the end upgrading to the latest 4.5 version).
When I boot up version 3.4.2 on out test server I see the following warning
in the log:

WARN  [org.jboss.as.jaxrs] (MSC service thread 1-7) WFLYRS0015: No Servlet
declaration found for JAX-RS application.  In custom-rest-endpoing-1.7.war
either provide a class that extends javax.ws.rs.core.Application or declare
a servlet class in web.xml.

The custom-rest-endpoing.war is a realm-restapi-extension that we deploy to
our Keycloak instance. Indeed we haven't subclassed
javax.ws.rs.core.Application
nor have we any web.xml. However, looking at the rest provider example (
https://github.com/keycloak/keycloak/tree/master/examples/providers/rest) I
can't find anything about that there either. Is this warning anything I
need to pay attention to?

Cheers,
Ulrik

From lahari.guntha at tcs.com  Mon Nov  5 09:13:42 2018
From: lahari.guntha at tcs.com (Lahari  Guntha)
Date: Mon, 5 Nov 2018 14:13:42 +0000
Subject: [keycloak-user] Keycloak got into Excited state because of Garbage
	Collector Issue
Message-ID: <1541427223469.84685@tcs.com>

?Hi all,


We are Using Keycloak to have SSO enabled for different applications. It was working fine. All of a sudden we were unable to access keycloak.


After checking logs we came to know that "GC overhead limit exceeded".


May I know how to resolve this Issue?


Thanks and Regards,

Lahari G

=====-----=====-----=====
Notice: The information contained in this e-mail
message and/or attachments to it may contain 
confidential or privileged information. If you are 
not the intended recipient, any dissemination, use, 
review, distribution, printing or copying of the 
information contained in this e-mail message 
and/or attachments to it are strictly prohibited. If 
you have received this communication in error, 
please notify us by reply e-mail or telephone and 
immediately and permanently delete the message 
and any attachments. Thank you



From graham.nixon at maximuscanada.ca  Mon Nov  5 11:00:53 2018
From: graham.nixon at maximuscanada.ca (Graham Nixon)
Date: Mon, 5 Nov 2018 16:00:53 +0000
Subject: [keycloak-user] Active Directory LDAP Server Signing required
Message-ID: <d78eca47cf514b62b0f9ee8ec05eb3a7@Maximuscanada.ca>

Hi.  I'm new to Keycloak. A quick question on Keycloak version 4.3.0.  I've searched the online documentation and forums but can't find an answer.

Does Keycloak support Simple LDAP BIND over tcp 389 (no LDAPS/TLS) to Active Directory if the Active Directory Domain Controllers (the LDAP server) have LDAP server signing set to Require Signature?

Cheers

Graham Nixon
Senior Systems Architect

MAXIMUS Canada
DeltaWare Division
176 Great George Street, Suite 300
Charlottetown, PE, Canada C1A 4K9
Office: 902.628.4598
graham.nixon at maximuscanada.ca



Confidentiality Notice:
This electronic transmission, and any documents attached to it, may contain confidential information belonging to the sender. This information is intended solely for the use of the individual or entity named above. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution or the taking of any action in reliance upon the contents of this information is prohibited. If you have received this transmission in error, please notify the sender immediately and delete the message and all documents.

From ulrik.sjolin at gmail.com  Mon Nov  5 11:14:08 2018
From: ulrik.sjolin at gmail.com (=?UTF-8?Q?Ulrik_Sj=C3=B6lin?=)
Date: Mon, 5 Nov 2018 08:14:08 -0800
Subject: [keycloak-user] Delegating sharing responsibilities for UMA
	resources?
Message-ID: <CAP5c5mS-iGY919Ubd3Vf5tvpJ0O7eF82i99D1Y0E3YBfu4UH5Q@mail.gmail.com>

Hello,

I find the request-response mechanism of UMA very interesting and
think it would
be very useful where I work. But I have not found a way to scale it?

Is it possible for a resource owner to delegate the responsibilities
for sharing
resources to other users? Consider a large organisation that owns a
large set or
resources and has a large number of users. The organisation wants to
have a group
of admins to handle answering the?requests that comes in from the users asking
for access to different resources.

What is the best-practice way for handling a use case like this?
Is it possible to assign a group as resource owner?

Best Regards,

Ulrik Sj?lin


From oneal.kevin at gmail.com  Mon Nov  5 12:48:43 2018
From: oneal.kevin at gmail.com (KevinO)
Date: Mon, 5 Nov 2018 11:48:43 -0600
Subject: [keycloak-user] Disable Authentication for a Path Using the Spring
	Boot Adapter
Message-ID: <CAF9RioTxSN5KR1YRVSHenT3QzytdQB=cTt2134Hr2tdPwM5FCg@mail.gmail.com>

I've got a configuration setup similar to the doc
https://www.keycloak.org/docs/1.9/securing_apps_guide/topics/oidc/java/spring-boot-adapter.html

Is there a way to ignore security on certain paths? Eg

security:
  ignored: /foo/*

From psilva at redhat.com  Mon Nov  5 13:01:20 2018
From: psilva at redhat.com (Pedro Igor Silva)
Date: Mon, 5 Nov 2018 16:01:20 -0200
Subject: [keycloak-user] Delegating sharing responsibilities for UMA
	resources?
In-Reply-To: <CAP5c5mS-iGY919Ubd3Vf5tvpJ0O7eF82i99D1Y0E3YBfu4UH5Q@mail.gmail.com>
References: <CAP5c5mS-iGY919Ubd3Vf5tvpJ0O7eF82i99D1Y0E3YBfu4UH5Q@mail.gmail.com>
Message-ID: <CAJrcDBdCV0vwGODJy2qj0DBZm4=Siro-kSQtiAcg+PmsbNu8Pg@mail.gmail.com>

Currently, you can not set groups as resource owners. However we have a
User-Managed Policy API that can be used for what you are looking for.
Please, take a look at this doc [1].

It supports not only group policies, but user, role and more complex
policies using JS.

[1]
https://www.keycloak.org/docs/latest/authorization_services/index.html#_service_authorization_uma_policy_api

On Mon, Nov 5, 2018 at 2:24 PM Ulrik Sj?lin <ulrik.sjolin at gmail.com> wrote:

> Hello,
>
> I find the request-response mechanism of UMA very interesting and
> think it would
> be very useful where I work. But I have not found a way to scale it?
>
> Is it possible for a resource owner to delegate the responsibilities
> for sharing
> resources to other users? Consider a large organisation that owns a
> large set or
> resources and has a large number of users. The organisation wants to
> have a group
> of admins to handle answering the requests that comes in from the users
> asking
> for access to different resources.
>
> What is the best-practice way for handling a use case like this?
> Is it possible to assign a group as resource owner?
>
> Best Regards,
>
> Ulrik Sj?lin
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From slaskawi at redhat.com  Tue Nov  6 03:58:41 2018
From: slaskawi at redhat.com (Sebastian Laskawiec)
Date: Tue, 6 Nov 2018 09:58:41 +0100
Subject: [keycloak-user] Keycloak got into Excited state because of
 Garbage Collector Issue
In-Reply-To: <1541427223469.84685@tcs.com>
References: <1541427223469.84685@tcs.com>
Message-ID: <CAA9R9O6kMQm-aJ4y0EyDN11YRDarTbiN_m4No3221_+0aD1bYw@mail.gmail.com>

Keycloak uses Infinispan (an in-memory caching solution), which consumes
most of the heap for the JVM.

The "GC overhead limit exceeded" tells you that the JVM was fighting for
its live trying to release as much memory from the heap as it could and
didn't succeed in a certain amount of time.

The easiest solution is to increase your heap. Or a more complicated one -
tune the eviction parameter on your caches.

On Mon, Nov 5, 2018 at 3:23 PM Lahari Guntha <lahari.guntha at tcs.com> wrote:

> ?Hi all,
>
>
> We are Using Keycloak to have SSO enabled for different applications. It
> was working fine. All of a sudden we were unable to access keycloak.
>
>
> After checking logs we came to know that "GC overhead limit exceeded".
>
>
> May I know how to resolve this Issue?
>
>
> Thanks and Regards,
>
> Lahari G
>
> =====-----=====-----=====
> Notice: The information contained in this e-mail
> message and/or attachments to it may contain
> confidential or privileged information. If you are
> not the intended recipient, any dissemination, use,
> review, distribution, printing or copying of the
> information contained in this e-mail message
> and/or attachments to it are strictly prohibited. If
> you have received this communication in error,
> please notify us by reply e-mail or telephone and
> immediately and permanently delete the message
> and any attachments. Thank you
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

From testoauth55 at gmail.com  Tue Nov  6 04:13:56 2018
From: testoauth55 at gmail.com (Bruce Wings)
Date: Tue, 6 Nov 2018 14:43:56 +0530
Subject: [keycloak-user] Proxy support in policy enforcement/authorization
	services
Message-ID: <CANAVTmObp2PcW+reZo8CUTk1dGQ8Mm4C80EsOW5db5sTBfE2oA@mail.gmail.com>

As per the mailing list:
http://lists.jboss.org/pipermail/keycloak-user/2016-December/008876.html

There wasn't any support for proxy in case of policy enforcement. Since the
thread is quite old, can someone from Keycloak team kindly confirm whether
proxy support has been added yet or not?

From testoauth55 at gmail.com  Tue Nov  6 04:27:17 2018
From: testoauth55 at gmail.com (Bruce Wings)
Date: Tue, 6 Nov 2018 14:57:17 +0530
Subject: [keycloak-user] Proxy support in policy
	enforcement/authorization services
In-Reply-To: <CANAVTmObp2PcW+reZo8CUTk1dGQ8Mm4C80EsOW5db5sTBfE2oA@mail.gmail.com>
References: <CANAVTmObp2PcW+reZo8CUTk1dGQ8Mm4C80EsOW5db5sTBfE2oA@mail.gmail.com>
Message-ID: <CANAVTmPUn=sFu=WG00WaWZrU971V4CfgV+6NSujZxH9qqxcckw@mail.gmail.com>

I think I may have got my previous post slightly wrong. Problem I am facing
is that my keycloak server is running behind a proxy.
My keycloak server is running on *pc-bruce:8100*, but I am accessing it
through *pc-bruce:7100*.
And I am able to run Jetty adapter as well as Keycloak Installed adapter
with *pc-bruce:7100 *like this:

{
  "realm": "myRealm",
  "auth-server-url": "http://pc-bruce:7100/auth",
  "ssl-required": "external",
  "resource": "myClient",
  "credentials": {
    "secret": "***********"
  },
  "confidential-port": 0
}

But as soon as I put   *"policy-enforcer": {} *line in json to enable
authorization, I get *Could not obtain configuration from server. This
error does not come if either policy enforcer line is removed or if policy
enforcer line is kept and port is changed to 8100 (original keycloak port )*

Exception trace:

java.lang.RuntimeException: Could not obtain configuration from server [
http://pc-bruce:7100/auth/realms/ myRealm /.well-known/uma2-configuration].
at
org.keycloak.authorization.client.AuthzClient.<init>(AuthzClient.java:242)

at org.keycloak.authorization.client.AuthzClient.create(AuthzClient.java:85)
at
org.keycloak.adapters.authorization.PolicyEnforcer.<init>(PolicyEnforcer.java:66)



at
org.keycloak.adapters.KeycloakDeploymentBuilder.internalBuild(KeycloakDeploymentBuilder.java:144)

at
org.keycloak.adapters.KeycloakDeploymentBuilder.build(KeycloakDeploymentBuilder.java:170)

at
org.keycloak.adapters.jetty.core.AbstractKeycloakJettyAuthenticator.initializeKeycloak(AbstractKeycloakJettyAuthenticator.java:248)

at
org.keycloak.adapters.jetty.core.AbstractKeycloakJettyAuthenticator.setConfiguration(AbstractKeycloakJettyAuthenticator.java:174)

at
org.eclipse.jetty.security.SecurityHandler.doStart(SecurityHandler.java:384)

at
org.eclipse.jetty.security.ConstraintSecurityHandler.doStart(ConstraintSecurityHandler.java:449)

at
org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:68)

at
org.eclipse.jetty.util.component.ContainerLifeCycle.start(ContainerLifeCycle.java:132)

at
org.eclipse.jetty.util.component.ContainerLifeCycle.doStart(ContainerLifeCycle.java:114)

at
org.eclipse.jetty.server.handler.AbstractHandler.doStart(AbstractHandler.java:61)

at
org.eclipse.jetty.server.handler.ScopedHandler.doStart(ScopedHandler.java:120)

at
org.eclipse.jetty.server.session.SessionHandler.doStart(SessionHandler.java:116)

at
org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:68)

at
org.eclipse.jetty.util.component.ContainerLifeCycle.start(ContainerLifeCycle.java:132)

at
org.eclipse.jetty.util.component.ContainerLifeCycle.doStart(ContainerLifeCycle.java:114)

at
org.eclipse.jetty.server.handler.AbstractHandler.doStart(AbstractHandler.java:61)

at
org.eclipse.jetty.server.handler.ScopedHandler.doStart(ScopedHandler.java:120)

at
org.eclipse.jetty.server.handler.ContextHandler.startContext(ContextHandler.java:784)

at
org.eclipse.jetty.servlet.ServletContextHandler.startContext(ServletContextHandler.java:294)


at
org.eclipse.jetty.server.handler.ContextHandler.doStart(ContextHandler.java:741)
at
org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:68)

at
org.eclipse.jetty.util.component.ContainerLifeCycle.start(ContainerLifeCycle.java:132)

at
org.eclipse.jetty.util.component.ContainerLifeCycle.doStart(ContainerLifeCycle.java:114)

at
org.eclipse.jetty.server.handler.AbstractHandler.doStart(AbstractHandler.java:61)

at
org.eclipse.jetty.server.handler.ContextHandlerCollection.doStart(ContextHandlerCollection.java:163)

at
org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:68)

at
org.eclipse.jetty.util.component.ContainerLifeCycle.start(ContainerLifeCycle.java:132)

at
org.eclipse.jetty.util.component.ContainerLifeCycle.doStart(ContainerLifeCycle.java:114)

at
org.eclipse.jetty.server.handler.AbstractHandler.doStart(AbstractHandler.java:61)

at
org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:68)

at
org.eclipse.jetty.util.component.ContainerLifeCycle.start(ContainerLifeCycle.java:132)

at org.eclipse.jetty.server.Server.start(Server.java:387)

at
org.eclipse.jetty.util.component.ContainerLifeCycle.doStart(ContainerLifeCycle.java:114)

at
org.eclipse.jetty.server.handler.AbstractHandler.doStart(AbstractHandler.java:61)

at org.eclipse.jetty.server.Server.doStart(Server.java:354)

at
org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:68)




Caused by: java.lang.RuntimeException: Error executing http method
[org.apache.http.client.methods.RequestBuilder at 72ec16f8]. Response : null

at
org.keycloak.authorization.client.util.HttpMethod.execute(HttpMethod.java:106)

at
org.keycloak.authorization.client.util.HttpMethodResponse$2.execute(HttpMethodResponse.java:50)

at
org.keycloak.authorization.client.AuthzClient.<init>(AuthzClient.java:240)

... 43 more

Caused by: java.net.ConnectException: Connection refused: connect

at java.net.DualStackPlainSocketImpl.connect0(Native Method)

at
java.net.DualStackPlainSocketImpl.socketConnect(DualStackPlainSocketImpl.java:79)

at
java.net.AbstractPlainSocketImpl.doConnect(AbstractPlainSocketImpl.java:350)

at
java.net.AbstractPlainSocketImpl.connectToAddress(AbstractPlainSocketImpl.java:206)

at
java.net.AbstractPlainSocketImpl.connect(AbstractPlainSocketImpl.java:188)

at java.net.PlainSocketImpl.connect(PlainSocketImpl.java:172)

at java.net.SocksSocketImpl.connect(SocksSocketImpl.java:392)

at java.net.Socket.connect(Socket.java:589)


at
org.apache.http.conn.scheme.PlainSocketFactory.connectSocket(PlainSocketFactory.java:117)
at
org.apache.http.impl.conn.DefaultClientConnectionOperator.openConnection(DefaultClientConnectionOperator.java:177)

at
org.apache.http.impl.conn.AbstractPoolEntry.open(AbstractPoolEntry.java:144)

at
org.apache.http.impl.conn.AbstractPooledConnAdapter.open(AbstractPooledConnAdapter.java:131)

at
org.apache.http.impl.client.DefaultRequestDirector.tryConnect(DefaultRequestDirector.java:611)

at
org.apache.http.impl.client.DefaultRequestDirector.execute(DefaultRequestDirector.java:446)

at
org.apache.http.impl.client.AbstractHttpClient.doExecute(AbstractHttpClient.java:882)


at
org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:82)
at
org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:107)

at
org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:55)

at
org.keycloak.authorization.client.util.HttpMethod.execute(HttpMethod.java:84)





On Tue, Nov 6, 2018 at 2:43 PM Bruce Wings <testoauth55 at gmail.com> wrote:

> As per the mailing list:
> http://lists.jboss.org/pipermail/keycloak-user/2016-December/008876.html
>
> There wasn't any support for proxy in case of policy enforcement. Since
> the thread is quite old, can someone from Keycloak team kindly confirm
> whether proxy support has been added yet or not?
>

From nad.elbaba at gmail.com  Tue Nov  6 04:38:52 2018
From: nad.elbaba at gmail.com (Nadim Elbaba)
Date: Tue, 6 Nov 2018 10:38:52 +0100
Subject: [keycloak-user] Customize Execute Actions Email Subject
Message-ID: <CAAtzbJv-2hFWCu92c+dTuuyijNeiVoM=UEkoJxLMXRj5YFZGhw@mail.gmail.com>

Hello,

I would like to customize the subject of the emails sent using
"execute-actions-email" REST endpoint depending on the required actions,
e.g. :

   - "Update your password" when the UPDATE_PASSWORD action is present
   - "Verify your e-mail" when only the VERIFY_EMAIL action is present

The only solution I could think about was to provide a custom
EmailTemplateProvider implementation by extending the
FreeMarkerEmailTemplateProvider to override the "sendExecuteActions" method
in order to use different properties for the email subject.

Is there any simpler way ?

Anyway, thanks for this wonderful IAM solution !

Cheers,

Nadim

From lyderic.dubut at enalean.com  Tue Nov  6 04:54:09 2018
From: lyderic.dubut at enalean.com (Lyderic Dubut)
Date: Tue, 06 Nov 2018 10:54:09 +0100
Subject: [keycloak-user] Users/Groups access restrictions
Message-ID: <f30de906363761cd39b1413cfd65eba61a1c5dd2.camel@enalean.com>

Hi Keycloak peoples!

I'm slowly introduce keycloak in production environnement, but I still
do not Know how to restric permissions to users or groups.

To picture my words, 
I have 3 Applications A,B and C

All company people can access to the application A

For the application B I want prohibit access to non-admin group member.
So when a non-admin clic on OIDC button to login in app an redirect to
keycloak, I wan't a message like "you don't have permissions".


And for the application C all people can access except Bob because he
have broken twice this application :-)


It's posisble to do it? 


From ronald.demneri at amdtia.com  Tue Nov  6 05:05:02 2018
From: ronald.demneri at amdtia.com (Ronald Demneri)
Date: Tue, 6 Nov 2018 10:05:02 +0000
Subject: [keycloak-user] filter group claim in token per client
References: <VI1PR0402MB3696E4DCAFFE7EEEEB0EAF70E9CF0@VI1PR0402MB3696.eurprd04.prod.outlook.com>
	<1541397265.3650.7.camel@acutus.pro>
	<VI1PR0402MB369663EA52F0699AF650CE58E9CA0@VI1PR0402MB3696.eurprd04.prod.outlook.com>
Message-ID: <VI1PR0402MB3696963B02F116A378796EA9E9CB0@VI1PR0402MB3696.eurprd04.prod.outlook.com>

Hello Dmitry,

A colleague of mine helped solving the issue with the array, and I can see the filtered groups in the Access token. I also used token.getIssuedFor() to get the client name and make the evaluation of the filtered groups dynamic. The problem now is that this new claim is not present in the userinfo. This is the script that we came up with (configured both as client scopes (possibly define as a default client scope) as well as script mapper specific to this client for test purposes - claim names are different of course):

[kcadmin at keycloak bin]$ ./kcadm.sh get client-scopes
[ {
  "id" : "4ea94866-044e-4590-a2da-f25c980f08b4",
  "name" : "Filtered_Groups",
  "protocol" : "openid-connect",
  "attributes" : {
    "display.on.consent.screen" : "true"
  },
  "protocolMappers" : [ {
    "id" : "7d3c521a-b291-4f43-ad87-6891ed9584d3",
    "name" : "Filtered Groups",
    "protocol" : "openid-connect",
    "protocolMapper" : "oidc-script-based-protocol-mapper",
    "consentRequired" : false,
    "config" : {
      "multivalued" : "true",
      "userinfo.token.claim" : "true",
      "id.token.claim" : "true",
      "access.token.claim" : "true",
      "claim.name" : "fGroup",
      "jsonType.label" : "String",
      "script" : "/**
	* Available variables:
	* user - the current user
	* realm - the current realm
	* token - the current token
	* userSession - the current userSession
	* keycloakSession - the current userSession
	*/
	
	//insert your code here...

	//So, first we need to know, how many names should be added to the new claim,
	var username = user ? user.username : \"anonymous\";
	var groups = user.getGroups();
	var group_array = groups.toArray();
	//print(\"########################################## \" + username);

	var client = token.getIssuedFor();
	//print(\"############################################ \" + client);

	var clUp = client.toUpperCase();
	//print(clUp);

	var group_APP = \"APP-\" + clUp + \"-USERS\";
	var group_ROL = \"ROL_SSO-\" + clUp + \"-ADMIN\";

	var group_filtered = [];

	for (var i in group_array) {
		var gn = group_array[i].getName();
		var gnUp = gn.toUpperCase();
		if (gnUp === group_APP || gnUp === group_ROL) {
			group_filtered.push(\"/\" + gn);
			}
		}
	//Then we declare the new array.
	var l = group_filtered.length;
	var group_token = java.lang.reflect.Array.newInstance(java.lang.String.class, l);

	for (var f in group_filtered) {
		group_token[f] = group_filtered[f];
		//print(group_token[f]);
	}

	//And submit the array as token
	token.setOtherClaims(\"fGroup\", group_token);"
    }
  } ]
}

This is the userinfo data for my account:

{
  "sub": "bad7ff26-2a70-446f-a635-06fdbe1bec55",
  "Group": [
    "/APP-App1-Users/TGR-Team-ABC",
    "/APP-App1-Users/TGR-Team-DEF",
    "/APP-App1-Users",
    "/APP-MySmallApp-Users"
  ],
  "email_verified": false,
  "name": "Ronald Demneri",
  "preferred_username": "u151302",
  "given_name": "Ronald",
  "family_name": "Demneri"


The group claim is inserted by the group mapper created for this client, and the idea is to remove it once the script mapper works as expected.
What do you think is going on? Is this behavior normal?

Thanks in advance,
Ronald

-----Original Message-----
From: Ronald Demneri 
Sent: 05.Nov.2018 12:12 PM
To: 'Ronald Demneri' <ronald.demneri at amdtia.com>; Dmitry Telegin <dt at acutus.pro>; keycloak-user at lists.jboss.org
Subject: RE: [keycloak-user] filter group claim in token per client

Hello,

In the script authenticator there was authenticationSession which I used to get the clientId. There is no such variable in the script mapper, and If I define such mapper in the client template, I suppose I'd need some mechanism to get the client name and then make the filtering of the groups that need to be inserted in the token. How do I do that? Is there any documentation available for this online?


Thanks again for your support!
Ronald


-----Original Message-----
From: keycloak-user-bounces at lists.jboss.org <keycloak-user-bounces at lists.jboss.org> On Behalf Of Ronald Demneri
Sent: 05.Nov.2018 11:00 AM
To: Dmitry Telegin <dt at acutus.pro>; keycloak-user at lists.jboss.org
Subject: Re: [keycloak-user] filter group claim in token per client

Hello Dmitry,

Thanks for the response. In fact I tried that before posting here, created a custom script mapper for the client that I have configured. The problem is that the script will return a list of objects, not an array of strings, which is what I am expecting.

What do I need to pay extra attention in order to solve this?


Thanks in advance and Regards,
Ronald

-----Original Message-----
From: Dmitry Telegin <dt at acutus.pro> 
Sent: 05.Nov.2018 6:54 AM
To: Ronald Demneri <ronald.demneri at amdtia.com>; keycloak-user at lists.jboss.org
Subject: Re: [keycloak-user] filter group claim in token per client

Hello Ronald,

As in the case with authentication, JavaScript is to the rescue again :) You can create a script mapper for groups that will do additional group filtering based on the client, and use it instead of the built-in one.

To avoid explicitly configuring it for each and every client, you can create a Client Scope (can be called "Client Template" depending on the KC version), define the mapper in the scope, and add it do default scopes.

Cheers,
Dmitry Telegin
CTO, Acutus s.r.o.
Keycloak Consulting and Training

Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
+42 (022) 888-30-71
E-mail: info at acutus.pro 

On Fri, 2018-11-02 at 10:30 +0000, Ronald Demneri wrote:
> Hello everyone,
> 
> Is there a way to filter the groups a user is a member of per client, based on clientId (which is part of the group name(s) in AD). Let's say that user Ronald is member of??group_client1, group_client2 and group_client3, so using a group mapper, the token will contain a claim like group:["group_client1", "group_client2", "group_client3"]. Upon logging in to client1 app, I want to customize the group claim so that it contains only the respective group_client1 value.
> 
> Thanks in advance,
> 
> Ronald
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user


From ronald.demneri at amdtia.com  Tue Nov  6 06:00:36 2018
From: ronald.demneri at amdtia.com (Ronald Demneri)
Date: Tue, 6 Nov 2018 11:00:36 +0000
Subject: [keycloak-user] filter group claim in token per client
References: <VI1PR0402MB3696E4DCAFFE7EEEEB0EAF70E9CF0@VI1PR0402MB3696.eurprd04.prod.outlook.com>
	<1541397265.3650.7.camel@acutus.pro>
	<VI1PR0402MB369663EA52F0699AF650CE58E9CA0@VI1PR0402MB3696.eurprd04.prod.outlook.com>
Message-ID: <VI1PR0402MB3696D1D1312CB4F7A65920FAE9CB0@VI1PR0402MB3696.eurprd04.prod.outlook.com>

So, I am looking at the logs and receive the following when going to App1 > Client Scopes > Evaluate:

2018-11-06 10:51:42,407 INFO  [stdout] (default task-1892) ############################################ APP1
2018-11-06 10:51:42,407 INFO  [stdout] (default task-1892) ############################################
2018-11-06 10:51:42,407 INFO  [stdout] (default task-1892)  We are here!!!
2018-11-06 10:51:42,408 INFO  [stdout] (default task-1892) ############################################

But when trying to actually log in to the client, I receive the following:

2018-11-06 10:52:20,465 INFO  [stdout] (default task-1891) ############################################ APP1
2018-11-06 10:52:20,465 INFO  [stdout] (default task-1891) ############################################
2018-11-06 10:52:20,465 INFO  [stdout] (default task-1891)  We are here!!!
2018-11-06 10:52:20,466 INFO  [stdout] (default task-1891) ############################################
2018-11-06 10:52:20,474 INFO  [stdout] (default task-1891) ############################################ APP1
2018-11-06 10:52:20,474 INFO  [stdout] (default task-1891) ############################################
2018-11-06 10:52:20,474 INFO  [stdout] (default task-1891)  We are here!!!
2018-11-06 10:52:20,475 INFO  [stdout] (default task-1891) ############################################
2018-11-06 10:52:20,691 ERROR [org.keycloak.protocol.oidc.mappers.ScriptBasedOIDCProtocolMapper] (default task-1891) Error during execution of ProtocolMapper script: org.keycloak.scripting.ScriptExecutionException: Could not execute script 'token-mapper-script_filteredGroupsMapper' problem was: TypeError: null has no such function "toUpperCase" in <eval> at line number 31

Line 31 is as follows:

31:    var client = token.getIssuedFor().toUpperCase();
32:    print("############################################ " + client);

So why does it display an error, when in fact it also displays the correct form of the clientId in upper case? And why is the log entry duplicated? ATM, I removed the client scope mapper and have recreated the script mapper only for this client.


Regards,
Ronald


-----Original Message-----
From: Ronald Demneri 
Sent: 06.Nov.2018 11:05 AM
To: 'Ronald Demneri' <ronald.demneri at amdtia.com>; 'Dmitry Telegin' <dt at acutus.pro>; 'keycloak-user at lists.jboss.org' <keycloak-user at lists.jboss.org>
Subject: RE: [keycloak-user] filter group claim in token per client

Hello Dmitry,

A colleague of mine helped solving the issue with the array, and I can see the filtered groups in the Access token. I also used token.getIssuedFor() to get the client name and make the evaluation of the filtered groups dynamic. The problem now is that this new claim is not present in the userinfo. This is the script that we came up with (configured both as client scopes (possibly define as a default client scope) as well as script mapper specific to this client for test purposes - claim names are different of course):

[kcadmin at keycloak bin]$ ./kcadm.sh get client-scopes [ {
  "id" : "4ea94866-044e-4590-a2da-f25c980f08b4",
  "name" : "Filtered_Groups",
  "protocol" : "openid-connect",
  "attributes" : {
    "display.on.consent.screen" : "true"
  },
  "protocolMappers" : [ {
    "id" : "7d3c521a-b291-4f43-ad87-6891ed9584d3",
    "name" : "Filtered Groups",
    "protocol" : "openid-connect",
    "protocolMapper" : "oidc-script-based-protocol-mapper",
    "consentRequired" : false,
    "config" : {
      "multivalued" : "true",
      "userinfo.token.claim" : "true",
      "id.token.claim" : "true",
      "access.token.claim" : "true",
      "claim.name" : "fGroup",
      "jsonType.label" : "String",
      "script" : "/**
	* Available variables:
	* user - the current user
	* realm - the current realm
	* token - the current token
	* userSession - the current userSession
	* keycloakSession - the current userSession
	*/
	
	//insert your code here...

	//So, first we need to know, how many names should be added to the new claim,
	var username = user ? user.username : \"anonymous\";
	var groups = user.getGroups();
	var group_array = groups.toArray();
	//print(\"########################################## \" + username);

	var client = token.getIssuedFor();
	//print(\"############################################ \" + client);

	var clUp = client.toUpperCase();
	//print(clUp);

	var group_APP = \"APP-\" + clUp + \"-USERS\";
	var group_ROL = \"ROL_SSO-\" + clUp + \"-ADMIN\";

	var group_filtered = [];

	for (var i in group_array) {
		var gn = group_array[i].getName();
		var gnUp = gn.toUpperCase();
		if (gnUp === group_APP || gnUp === group_ROL) {
			group_filtered.push(\"/\" + gn);
			}
		}
	//Then we declare the new array.
	var l = group_filtered.length;
	var group_token = java.lang.reflect.Array.newInstance(java.lang.String.class, l);

	for (var f in group_filtered) {
		group_token[f] = group_filtered[f];
		//print(group_token[f]);
	}

	//And submit the array as token
	token.setOtherClaims(\"fGroup\", group_token);"
    }
  } ]
}

This is the userinfo data for my account:

{
  "sub": "bad7ff26-2a70-446f-a635-06fdbe1bec55",
  "Group": [
    "/APP-App1-Users/TGR-Team-ABC",
    "/APP-App1-Users/TGR-Team-DEF",
    "/APP-App1-Users",
    "/APP-MySmallApp-Users"
  ],
  "email_verified": false,
  "name": "Ronald Demneri",
  "preferred_username": "u151302",
  "given_name": "Ronald",
  "family_name": "Demneri"


The group claim is inserted by the group mapper created for this client, and the idea is to remove it once the script mapper works as expected.
What do you think is going on? Is this behavior normal?

Thanks in advance,
Ronald

-----Original Message-----
From: Ronald Demneri
Sent: 05.Nov.2018 12:12 PM
To: 'Ronald Demneri' <ronald.demneri at amdtia.com>; Dmitry Telegin <dt at acutus.pro>; keycloak-user at lists.jboss.org
Subject: RE: [keycloak-user] filter group claim in token per client

Hello,

In the script authenticator there was authenticationSession which I used to get the clientId. There is no such variable in the script mapper, and If I define such mapper in the client template, I suppose I'd need some mechanism to get the client name and then make the filtering of the groups that need to be inserted in the token. How do I do that? Is there any documentation available for this online?


Thanks again for your support!
Ronald


-----Original Message-----
From: keycloak-user-bounces at lists.jboss.org <keycloak-user-bounces at lists.jboss.org> On Behalf Of Ronald Demneri
Sent: 05.Nov.2018 11:00 AM
To: Dmitry Telegin <dt at acutus.pro>; keycloak-user at lists.jboss.org
Subject: Re: [keycloak-user] filter group claim in token per client

Hello Dmitry,

Thanks for the response. In fact I tried that before posting here, created a custom script mapper for the client that I have configured. The problem is that the script will return a list of objects, not an array of strings, which is what I am expecting.

What do I need to pay extra attention in order to solve this?


Thanks in advance and Regards,
Ronald

-----Original Message-----
From: Dmitry Telegin <dt at acutus.pro>
Sent: 05.Nov.2018 6:54 AM
To: Ronald Demneri <ronald.demneri at amdtia.com>; keycloak-user at lists.jboss.org
Subject: Re: [keycloak-user] filter group claim in token per client

Hello Ronald,

As in the case with authentication, JavaScript is to the rescue again :) You can create a script mapper for groups that will do additional group filtering based on the client, and use it instead of the built-in one.

To avoid explicitly configuring it for each and every client, you can create a Client Scope (can be called "Client Template" depending on the KC version), define the mapper in the scope, and add it do default scopes.

Cheers,
Dmitry Telegin
CTO, Acutus s.r.o.
Keycloak Consulting and Training

Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
+42 (022) 888-30-71
E-mail: info at acutus.pro 

On Fri, 2018-11-02 at 10:30 +0000, Ronald Demneri wrote:
> Hello everyone,
> 
> Is there a way to filter the groups a user is a member of per client, based on clientId (which is part of the group name(s) in AD). Let's say that user Ronald is member of??group_client1, group_client2 and group_client3, so using a group mapper, the token will contain a claim like group:["group_client1", "group_client2", "group_client3"]. Upon logging in to client1 app, I want to customize the group claim so that it contains only the respective group_client1 value.
> 
> Thanks in advance,
> 
> Ronald
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user


From sakodiya at grepruby.com  Tue Nov  6 06:41:07 2018
From: sakodiya at grepruby.com (Shubham Akodiya)
Date: Tue, 6 Nov 2018 17:11:07 +0530
Subject: [keycloak-user] Create user API in keycloak with default password
Message-ID: <CAN2cN6eziF-e0yQq9x_20dNWCPTrHis7hycFKfPLE5KEaqOJ_w@mail.gmail.com>

Hi Team,

Is there any API available for creating the user with default password ?
I've gone through the API - POST /{realm}/users
<https://www.keycloak.org/docs-api/4.5/rest-api/index.html#_users_resource> but
didn't find the password setting field for new user.


Thanks,
Shubham Akodiya

From geoff at opticks.io  Tue Nov  6 07:03:36 2018
From: geoff at opticks.io (Geoffrey Cleaves)
Date: Tue, 6 Nov 2018 13:03:36 +0100
Subject: [keycloak-user] Create user API in keycloak with default
	password
In-Reply-To: <CAN2cN6eziF-e0yQq9x_20dNWCPTrHis7hycFKfPLE5KEaqOJ_w@mail.gmail.com>
References: <CAN2cN6eziF-e0yQq9x_20dNWCPTrHis7hycFKfPLE5KEaqOJ_w@mail.gmail.com>
Message-ID: <CAHzT=q8WuuPRJ-9FgqawyqYt-PrLhpqhzZEgYxSMQ_=gS3dQ9g@mail.gmail.com>

Hi. I see in the link you provided a reference to a UserRepresentation,
which in turn makes reference to CredentialRepresentation. Can you use that?

Regards,
Geoffrey Cleaves







On Tue, 6 Nov 2018 at 12:47, Shubham Akodiya <sakodiya at grepruby.com> wrote:

> Hi Team,
>
> Is there any API available for creating the user with default password ?
> I've gone through the API - POST /{realm}/users
> <https://www.keycloak.org/docs-api/4.5/rest-api/index.html#_users_resource>
> but
> didn't find the password setting field for new user.
>
>
> Thanks,
> Shubham Akodiya
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

From geoff at opticks.io  Tue Nov  6 07:13:03 2018
From: geoff at opticks.io (Geoffrey Cleaves)
Date: Tue, 6 Nov 2018 13:13:03 +0100
Subject: [keycloak-user] RPT endpoint responds unexpectedly for resources
 created with an explicit _id
Message-ID: <CAHzT=q-L9dgVViEYoz1ZDh8Q7eFu2+xHRoqhb2f2nfczJ2vANA@mail.gmail.com>

The token endpoint sends an unexpected response while using grant_type
urn:ietf:params:oauth:grant-type:uma-ticket and a ticket with permissions
to a resource created via the resource UMA endpoint that has an explicit
_id.

When access is denied, endpoint sends a HTTP 400 and invalid_resource /
Resource with id [resource2] does not exist. instead of sending 403. The
same test but using a resource which has the Keycloak-assigned _id returns
403 as expected.

I believe the key point here is that the resource has been created using
the resource_set endpoint and had the _id set explicitly instead of letting
Keycloak assign the id.

Could the issue be related the fact that my Keycloak Docker install began
as 4.3.0.Final with the database being Postgres, and then I upgraded
Keycloak to 4.5.0.Final by downloading the latest Docker image? Could any
DB migrations have been missed which could cause this issue?

To reproduce the issue, try the following: Create resources rA and rB via
the resource_set endpoint. When creating rB, include a explicit _id. Then,
using an auth_token which does not have access to rB, try getting a RPT
which includes permissions to rB. Token end point will respond with 400
resource_not_found. But in fact the resource exists.

I have opened Jira ticket: https://issues.jboss.org/browse/KEYCLOAK-8729

From t.rademacher at gmx.de  Tue Nov  6 07:20:35 2018
From: t.rademacher at gmx.de (Tim Rademacher)
Date: Tue, 6 Nov 2018 13:20:35 +0100
Subject: [keycloak-user] CEK key for alg:dir
Message-ID: <061701d475cb$1f1aadc0$5d500940$@gmx.de>

Hi all,

 

I am somewhat struggling with Keycloak (Version 4.5.0) and I would like to
view the data return from an authorization request. I retrieve the token and
would like to look into it.

 

I see, there are 5 parts:

 

1.	Header
2.	CEK
3.	Init Vector
4.	Content (encrypted)
5.	Auth Tag

 

The header mentions the Algorithm to be DIR and the Encryption Algorithm tob
e A128CBC-HS256.

 

The RFC7518 says, that DIR means "Direct use of a shared symmetric key as
the CEK".

 

So I wonder, how would the shared key come to the client to decrypt the
content?

 

How would I be able to decrypt the token (where would I get the token from)?

 

Thank you very much!

 

Tim


From jannes.vandepitte at gmail.com  Tue Nov  6 08:17:44 2018
From: jannes.vandepitte at gmail.com (Jannes Vandepitte)
Date: Tue, 6 Nov 2018 05:17:44 -0800
Subject: [keycloak-user] API Create user
Message-ID: <CAJP3zPur3eyyK7rNc46DEZEmw0a5OWifMBGCdRkWP0GcX3fPAw@mail.gmail.com>

Hi,

I?m having trouble with usage of the API. When creating a user via POST on
the /users resource I can add a user no problem. But when I try to create a
user and set it?s role/groups at the same time, it just ignores the
provided roles and groups.

Body:

{
"username": "testerrr",
"email": "testt at aptus.bee",
    "realmRoles": ["0085814a-b946-494b-924d-c8bd20fe077c"],
    "groups":["098d95a5-9875-4e3c-90ab-cfacdef70fed"]
}

I gave the user that uses the api realm-admin roles just to make sure it
wasn?t a permission problem.


Any ideas on how to fix this (without adding 2 extra calls for adding the
group and the role)

Thanks in advance,

Jannes V

From psilva at redhat.com  Tue Nov  6 08:25:29 2018
From: psilva at redhat.com (Pedro Igor Silva)
Date: Tue, 6 Nov 2018 11:25:29 -0200
Subject: [keycloak-user] RPT endpoint responds unexpectedly for
 resources created with an explicit _id
In-Reply-To: <CAHzT=q-L9dgVViEYoz1ZDh8Q7eFu2+xHRoqhb2f2nfczJ2vANA@mail.gmail.com>
References: <CAHzT=q-L9dgVViEYoz1ZDh8Q7eFu2+xHRoqhb2f2nfczJ2vANA@mail.gmail.com>
Message-ID: <CAJrcDBdX6rPCFXoHypug8ZbvFyOd3MrKAhyjCwCbR09XSTUCJQ@mail.gmail.com>

I think I know what is happening.

Although we support setting the _id when creating a resource, our code
assumes that ids have the same format as when auto-generated by Keycloak.

In order to avoid unnecessary hits to the database when querying a resource
by name, we have a specific point in the code that only tries to fetch the
resource by id if it contains a "-". Otherwise, query by name. That is why
it is failing for you.

If you try to change the id value to "resource-2" you should get things
working as expected. Can you try it out?

Regards.
Pedro Igor

On Tue, Nov 6, 2018 at 10:26 AM Geoffrey Cleaves <geoff at opticks.io> wrote:

> The token endpoint sends an unexpected response while using grant_type
> urn:ietf:params:oauth:grant-type:uma-ticket and a ticket with permissions
> to a resource created via the resource UMA endpoint that has an explicit
> _id.
>
> When access is denied, endpoint sends a HTTP 400 and invalid_resource /
> Resource with id [resource2] does not exist. instead of sending 403. The
> same test but using a resource which has the Keycloak-assigned _id returns
> 403 as expected.
>
> I believe the key point here is that the resource has been created using
> the resource_set endpoint and had the _id set explicitly instead of letting
> Keycloak assign the id.
>
> Could the issue be related the fact that my Keycloak Docker install began
> as 4.3.0.Final with the database being Postgres, and then I upgraded
> Keycloak to 4.5.0.Final by downloading the latest Docker image? Could any
> DB migrations have been missed which could cause this issue?
>
> To reproduce the issue, try the following: Create resources rA and rB via
> the resource_set endpoint. When creating rB, include a explicit _id. Then,
> using an auth_token which does not have access to rB, try getting a RPT
> which includes permissions to rB. Token end point will respond with 400
> resource_not_found. But in fact the resource exists.
>
> I have opened Jira ticket: https://issues.jboss.org/browse/KEYCLOAK-8729
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

From miguel at lebane.se  Tue Nov  6 08:27:17 2018
From: miguel at lebane.se (Miguel Haber)
Date: Tue, 6 Nov 2018 15:27:17 +0200
Subject: [keycloak-user] Notify Keycloak Bearer Clients on Admin Actions
Message-ID: <CAOg2aVA8nR3V7cEyMtRDvFPXfsBv4z6AxwmEVq+aSTZREjZHtA@mail.gmail.com>

Hi,

I'm just wondering about one scenario where I'm running:

- Keycloak server (using it as a user base, and for
authentication/authorization)
- 3 resource servers connected to the Keycloak as bearer-only clients

These resource servers store separate information about users.

One use case I need to investigate:

- Keycloak admin logs in, deletes one user that has data in all 3 resource
servers

Questions:

1) Do the 3 resource servers get notified at the moment in order to purge
the user data from their DBs?
2) What if 1 resource server is offline, does it get notified as soon as it
goes back online?

Thanks

From anneke at breust.de  Tue Nov  6 08:31:12 2018
From: anneke at breust.de (Anneke Breust)
Date: Tue, 6 Nov 2018 14:31:12 +0100
Subject: [keycloak-user] EVENTTYPE for a temporarily disabled user
Message-ID: <4dc8e3ce-50da-497a-6db0-c4142beeb756@breust.de>

Hi,

in context with customized Prometheus metrics I am looking for an Event, 
which is emitted whenever a user is temporarily disabled (and a 
counterpart, which is emitted when the disabled user is enabled again). 
The goal is to be able to monitor the number of currently disabled users 
as well as how many times in a specific time span a user has been 
disabled. I looked through the EventTypes here 
https://www.keycloak.org/docs-api/3.2/javadocs/org/keycloak/events/EventType.html 
but I didn't find anything useful- did I overlook something?


Thanks in advance,

Anneke




From msakho at redhat.com  Tue Nov  6 08:32:49 2018
From: msakho at redhat.com (Meissa M'baye Sakho)
Date: Tue, 6 Nov 2018 14:32:49 +0100
Subject: [keycloak-user] remote debugging keycloak docker image
Message-ID: <CAF83W6+X2OUhrYMYAz73KVWGZZpMSgDr-Zp6YiP_osLizA6snw@mail.gmail.com>

Hello everyone,
I need to enable remote debugging on keycloak docker image. I'm using a
vanilla kubernetes.
Any input on that?
Regards,
Meissa

From psilva at redhat.com  Tue Nov  6 08:37:44 2018
From: psilva at redhat.com (Pedro Igor Silva)
Date: Tue, 6 Nov 2018 11:37:44 -0200
Subject: [keycloak-user] the admin rest api for realm import is not
 importing realm
In-Reply-To: <CANAVTmMR_qxY6vwhgDg5CZBDgmEz4_-d+Typ=ddG-svay2BAYg@mail.gmail.com>
References: <CANAVTmMR_qxY6vwhgDg5CZBDgmEz4_-d+Typ=ddG-svay2BAYg@mail.gmail.com>
Message-ID: <CAJrcDBfo5PxRJZofCV=J5ky4p12zTSrGYM0M_Rktju_CKqhv0w@mail.gmail.com>

Hi Bruce,

The best way to reproduce these issues is sending a step by step, if
possible using cUrl comands or script, with some JSON representing a realm
that we can import to run into the issue.

It is hard to tell what is wrong here, but I would say it is related with
the way you are preparing/sending requests to the server.

Regards.
Pedro Igor

On Thu, Oct 18, 2018 at 8:25 AM Bruce Wings <testoauth55 at gmail.com> wrote:

> As mentioned in docs:
>
>
> https://www.keycloak.org/docs-api/4.4/rest-api/index.html#_realms_admin_resource
>
> I have created a post request via postman and the response is 200 OK, but
> when I go and check on the admin console, new realm is not visible.
>
> Moreover, when I perform the same operation via an invalid token, then also
> the response is 200 OK. Am I missing something here?
>
> Attached screenshot of postman request. (In the body I have copy pasted
> entire contents of realm json file that was exported from another server)
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From msakho at redhat.com  Tue Nov  6 08:50:59 2018
From: msakho at redhat.com (Meissa M'baye Sakho)
Date: Tue, 6 Nov 2018 14:50:59 +0100
Subject: [keycloak-user] Add CA certificates for LDAPS ?
In-Reply-To: <166e3975670.edec95a619314.6696607516355464263@mpouss.in>
References: <1662f626b66.d913c15131404.552465038631491981@mpouss.in>
	<9a8a4961-c5fb-87e9-661c-bfd87e10da09@redhat.com>
	<16633c8bd7b.1093feebf42029.2315606082414745027@mpouss.in>
	<CAF83W6KnqNr2fhtmcKHSQoJBx3saza0CGn75VG99nVeEGETPPA@mail.gmail.com>
	<1541018026.2120.1.camel@acutus.pro>
	<166e3975670.edec95a619314.6696607516355464263@mpouss.in>
Message-ID: <CAF83W6+qmRGF0PyCr7NbOmEqBzS4emjMq0fGU1YNTC-yuKXH6Q@mail.gmail.com>

My LDAPS configuration did also work fine with keycloak 3.3.5 docker image
My question was related to the The X509_CA_BUNDLE env variable that comes
with the keycloak 4.4.x docker image.
I would like to use it and wanted to know if it work.
Do I understand that it's working fine for you Mathieu?
Meissa

Le lun. 5 nov. 2018 ? 12:17, Mathieu Poussin <me at mpouss.in> a ?crit :

> I confirm this fixed the issue :)
>
> So simple that I didn't think about it...
>
> Thank you
>
>  ---- On Wed, 31 Oct 2018 21:33:46 +0100 Dmitry Telegin <dt at acutus.pro>
> wrote ----
>  > Mathieu, Meissa,
>  >
>  > Starting from 4.5.0, the Keycloak Docker image uses standalone-ha.xml
> instead of standalone.xml by default. I guess this is why your truststore
> settings are being ignored.
>  >
>  > I've also tested Keycloak + LDAP + self-signed cert + truststore on a
> non-Docker deployment - it works pretty well, so definitely not a Keycloak
> bug per se.
>  >
>  > Good luck!
>  > Dmitry Telegin
>  > CTO, Acutus s.r.o.
>  > Keycloak Consulting and Training
>  >
>  > Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
>  > +42 (022) 888-30-71
>  > E-mail: info at acutus.pro
>  >
>  > On Wed, 2018-10-31 at 11:05 +0100, Meissa M'baye Sakho wrote:
>  > > Hello Mathieu,
>  > > did you manage to make it work?
>  > > If yes, could you tell me how?
>  > > Meissa
>  > >
>  > > > Le mar. 2 oct. 2018 ? 10:01, Mathieu Poussin <me at mpouss.in> a
> ?crit :
>  > >
>  > > > Hello Marek.
>  > > >
>  > > > I've done that already but looks like it is completely ignored.
>  > > > I have my custom truststore that have all my CA certificates (2),
> but I'm
>  > > > still seeing the same issue. (SPI is enabled on the LDAPS settings
> on the
>  > > > admin)
>  > > > Is there a way to make sure it has been loaded correctly? (I don't
> see any
>  > > > error when the application starts but it's not working as expected)
>  > > >
>  > > > Thanks.
>  > > > Mathieu
>  > > >
>  > > >
>  > > >  ---- On Mon, 01 Oct 2018 20:14:22 +0200 Marek Posolda <
>  > > > mposolda at redhat.com> wrote ----
>  > > >  > You can configure the Truststore SPI, which is mentioned in our
> docs
>  > > >  > here:
>  > > >  >
>  > > >
> https://www.keycloak.org/docs/latest/server_installation/index.html#_truststore
>  > > >  >
>  > > >  > Some additional notes around LDAP are here:
>  > > >  >
>  > > >
> https://www.keycloak.org/docs/latest/server_admin/index.html#connect-to-ldap-over-ssl
>  > > >  >
>  > > >  > Marek
>  > > >  >
>  > > >  >
>  > > >  > On 01/10/18 13:27, Mathieu Poussin wrote:
>  > > >  > > Hello.
>  > > >  > >
>  > > >  > > What would be the recommended way to add a custom CA
> certificates ?
>  > > > The documentation has a lot of different ways and so far none of
> them
>  > > > worked :
>  > > >  > >
>  > > >  > > - The X509_CA_BUNDLE env variable thing (It's running in a
>  > > > container), I can see the certificates in the JKS store  but looks
> like
>  > > > they are completely ignored by the app server.
>  > > >  > > - Added custom SPI to load a custom JKS store, same, no error
> at
>  > > > server start but they are completely ignored by the app server.
>  > > >  > >
>  > > >  > > This is the error I am getting :
>  > > >  > >
>  > > >  > > Caused by: sun.security.validator.ValidatorException: PKIX
> path
>  > > > building failed:
>  > > > sun.security.provider.certpath.SunCertPathBuilderException: unable
> to find
>  > > > valid certification path to requested target
>  > > >  > >          at
>  > > >
> sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:397)
>  > > >  > >          at
>  > > >
> sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:302)
>  > > >  > >          at
>  > > > sun.security.validator.Validator.validate(Validator.java:262)
>  > > >  > >          at
>  > > >
> sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:324)
>
>  > > >
>  > > >  > >          at
>  > > >
> sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:229)
>
>  > > >
>  > > >  > >          at
>  > > >
> sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:124)
>
>  > > >
>  > > >  > >          at
>  > > >
> sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1596)
>
>  > > >
>  > > >  > >          ... 99 more
>  > > >  > > Caused by:
>  > > > sun.security.provider.certpath.SunCertPathBuilderException: unable
> to find
>  > > > valid certification path to requested target
>  > > >  > >          at
>  > > >
> sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:141)
>
>  > > >
>  > > >  > >          at
>  > > >
> sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:126)
>
>  > > >
>  > > >  > >          at
>  > > > java.security.cert.CertPathBuilder.build(CertPathBuilder.java:280)
>  > > >  > >          at
>  > > >
> sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:392)
>  > > >  > >          ... 105 more
>  > > >  > >
>  > > >  > >
>  > > >  > > Another option would be to disable certificate verification on
> LDAPS
>  > > > as it's a trusted environment (last resort but well so far nothing
> else
>  > > > worked), would there be a way to do that?
>  > > >  > > Connecting over LDAP is not an option a this prevent some
> features to
>  > > > work like password reset.
>  > > >  > >
>  > > >  > > Thanks.
>  > > >  > >
>  > > >  > >
>  > > >  > > _______________________________________________
>  > > >  > > keycloak-user mailing list
>  > > >  > > keycloak-user at lists.jboss.org
>  > > >  > > https://lists.jboss.org/mailman/listinfo/keycloak-user
>  > > >  >
>  > > >  >
>  > > >  >
>  > > >
>  > > >
>  > > > _______________________________________________
>  > > > keycloak-user mailing list
>  > > > keycloak-user at lists.jboss.org
>  > > > https://lists.jboss.org/mailman/listinfo/keycloak-user
>  > > >
>  > >
>  > > _______________________________________________
>  > > keycloak-user mailing list
>  > > keycloak-user at lists.jboss.org
>  > > https://lists.jboss.org/mailman/listinfo/keycloak-user
>  >
>
>
>

From msakho at redhat.com  Tue Nov  6 08:54:07 2018
From: msakho at redhat.com (Meissa M'baye Sakho)
Date: Tue, 6 Nov 2018 14:54:07 +0100
Subject: [keycloak-user] Java 11 (Docker container base)
In-Reply-To: <CAA9R9O5Y-YZNR_JRQF6p4TOvrqp1+GYTqicjtYtUtR5yMjB7dQ@mail.gmail.com>
References: <564d3037b9974039868327e2ed2bee3d@zoomint.com>
	<CAF83W6+3+gBGbcY+GHEw9zVcvAPNHf=TYC_mYnU4R2QRVuUaOw@mail.gmail.com>
	<1d8ec6c8800f46aa82e3ba96c8951086@zoomint.com>
	<CAA9R9O79OMxvX9pj9CDWeN4Xeug_KJ7f3W=iYKRfWQ71xVFRSA@mail.gmail.com>
	<69c1088396cd4aa5aa8a661637dfcf37@zoomint.com>
	<CAA9R9O5Y-YZNR_JRQF6p4TOvrqp1+GYTqicjtYtUtR5yMjB7dQ@mail.gmail.com>
Message-ID: <CAF83W6JLnYLAMZ7+GX09xBb64Q=YDaQTOzSwmVde_Pd313kV8A@mail.gmail.com>

Openjdk 11 has been released. You'll need to have rhel 7.6

Le lun. 5 nov. 2018 ? 10:46, Sebastian Laskawiec <slaskawi at redhat.com> a
?crit :

> I believe using the commercial Hotspot JVM provided by Oracle will not be
> an option. We will probably stick with OpenJDK.
>
> BTW, all JDK LTS releases will receive much longer updates. Please see
> this blog post for the reference:
> https://developers.redhat.com/blog/2018/09/24/the-future-of-java-and-openjdk-updates-without-oracle-support/
>
> On Thu, Oct 25, 2018 at 4:37 PM Pavel Micka <Pavel.Micka at zoomint.com>
> wrote:
>
>> It was mainly a question about how the support/updates will be handled -
>> if Keycloak will rely on ?community only? updates for Java 8 or if there
>> will be switch to new Java (updated by Oracle in the half-year window).
>>
>> I am sure that our customers will ask in reviews, how we have the
>> security updates are handled throughout our solution. And if all parts of
>> our solution rely only on secure resources.
>>
>>
>>
>> So the question should more be: Will Java under Keycloak be periodically
>> updated (without commercial support) after January 2019?
>>
>>
>>
>> Regards,
>>
>>
>>
>> Pavel
>>
>>
>>
>> *From:* Sebastian Laskawiec <slaskawi at redhat.com>
>> *Sent:* Thursday, October 25, 2018 4:00 PM
>> *To:* Pavel Micka <Pavel.Micka at zoomint.com>
>> *Cc:* Meissa M'baye Sakho <msakho at redhat.com>; keycloak-user <
>> keycloak-user at lists.jboss.org>
>>
>>
>> *Subject:* Re: [keycloak-user] Java 11 (Docker container base)
>>
>>
>>
>> From the support perspective, Red Hat offers extended support till June
>> 2023 [1].
>>
>>
>>
>> Our move towards JDK11 (LTS) relies heavily on Wildfly/EAP Team. I guess
>> we still have plenty of time to do the switch, so I wouldn't rush things
>> too much.
>>
>>
>>
>> BTW, why do you need JDK11, especially in the container?
>>
>>
>>
>> [1] https://access.redhat.com/articles/1299013
>>
>>
>>
>> On Tue, Oct 23, 2018 at 1:13 PM Pavel Micka <Pavel.Micka at zoomint.com>
>> wrote:
>>
>> Sorry, end of january (my fault):
>> https://www.oracle.com/technetwork/java/eol-135779.html. Then Oracle
>> Java and OpenJDK will most probably start to diverge, as OpenJDK will not
>> have access to Oracle repos (afaik). So the speed of security fixes will
>> depend on willigness of community to fix the upcomming issues.
>>
>> Pavel
>>
>> From: Meissa M'baye Sakho <msakho at redhat.com>
>> Sent: Tuesday, October 23, 2018 11:04 AM
>> To: Pavel Micka <Pavel.Micka at zoomint.com>
>> Cc: keycloak-user <keycloak-user at lists.jboss.org>
>> Subject: Re: [keycloak-user] Java 11 (Docker container base)
>>
>> Hello,
>> Pavel, where did you get the information that the official Java 8 support
>> will cease at the end of december?
>> https://access.redhat.com/articles/1299013
>> https://www.oracle.com/technetwork/java/javase/eol-135779.html
>> Meissa
>>
>> Le lun. 22 oct. 2018 ? 16:33, Pavel Micka <Pavel.Micka at zoomint.com
>> <mailto:Pavel.Micka at zoomint.com>> a ?crit :
>> Hello everyone,
>>
>> What is the plan for Java 11 support? The point is that current versions
>> of Docker containers are based on OpenJDK 8, but the official Java 8
>> support will cease at the end of December. Will Keycloak use Java 11 by
>> that time or will it rely on updates provided by the community.
>>
>> This is important to us, as Keycloak is important part of our app
>> security.
>>
>> Thanks,
>>
>> Pavel
>>
>> // I have found this ticket in Jira, but it does not provide too many
>> details: https://issues.jboss.org/browse/KEYCLOAK-7811
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>>

From geoff at opticks.io  Tue Nov  6 09:32:22 2018
From: geoff at opticks.io (Geoffrey Cleaves)
Date: Tue, 6 Nov 2018 15:32:22 +0100
Subject: [keycloak-user] RPT endpoint responds unexpectedly for
 resources created with an explicit _id
In-Reply-To: <CAJrcDBdX6rPCFXoHypug8ZbvFyOd3MrKAhyjCwCbR09XSTUCJQ@mail.gmail.com>
References: <CAHzT=q-L9dgVViEYoz1ZDh8Q7eFu2+xHRoqhb2f2nfczJ2vANA@mail.gmail.com>
	<CAJrcDBdX6rPCFXoHypug8ZbvFyOd3MrKAhyjCwCbR09XSTUCJQ@mail.gmail.com>
Message-ID: <CAHzT=q-iGvt9OKj+emUWQ8TxOjetVmNE_MoTS0y87fjd+ixyyg@mail.gmail.com>

The following attempt to change the _id results in 500 Server Error:

curl -X PUT \
  https://domain.com/realms/realm/authz/protection/resource_set/resource2 \
  -H 'Authorization: Bearer 123' \
  -H 'Content-Type: application/json' \
  -H 'cache-control: no-cache' \
  -d '{
     "_id":"resource-2"
}'

But creating a new resource "resource-3" with the dash does resolve the
issue. Now I get access_denied.

Thanks

On Tue, 6 Nov 2018 at 14:25, Pedro Igor Silva <psilva at redhat.com> wrote:

> I think I know what is happening.
>
> Although we support setting the _id when creating a resource, our code
> assumes that ids have the same format as when auto-generated by Keycloak.
>
> In order to avoid unnecessary hits to the database when querying a
> resource by name, we have a specific point in the code that only tries to
> fetch the resource by id if it contains a "-". Otherwise, query by name.
> That is why it is failing for you.
>
> If you try to change the id value to "resource-2" you should get things
> working as expected. Can you try it out?
>
> Regards.
> Pedro Igor
>
> On Tue, Nov 6, 2018 at 10:26 AM Geoffrey Cleaves <geoff at opticks.io> wrote:
>
>> The token endpoint sends an unexpected response while using grant_type
>> urn:ietf:params:oauth:grant-type:uma-ticket and a ticket with permissions
>> to a resource created via the resource UMA endpoint that has an explicit
>> _id.
>>
>> When access is denied, endpoint sends a HTTP 400 and invalid_resource /
>> Resource with id [resource2] does not exist. instead of sending 403. The
>> same test but using a resource which has the Keycloak-assigned _id returns
>> 403 as expected.
>>
>> I believe the key point here is that the resource has been created using
>> the resource_set endpoint and had the _id set explicitly instead of
>> letting
>> Keycloak assign the id.
>>
>> Could the issue be related the fact that my Keycloak Docker install began
>> as 4.3.0.Final with the database being Postgres, and then I upgraded
>> Keycloak to 4.5.0.Final by downloading the latest Docker image? Could any
>> DB migrations have been missed which could cause this issue?
>>
>> To reproduce the issue, try the following: Create resources rA and rB via
>> the resource_set endpoint. When creating rB, include a explicit _id. Then,
>> using an auth_token which does not have access to rB, try getting a RPT
>> which includes permissions to rB. Token end point will respond with 400
>> resource_not_found. But in fact the resource exists.
>>
>> I have opened Jira ticket: https://issues.jboss.org/browse/KEYCLOAK-8729
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>

From ronald.demneri at amdtia.com  Tue Nov  6 10:08:01 2018
From: ronald.demneri at amdtia.com (Ronald Demneri)
Date: Tue, 6 Nov 2018 15:08:01 +0000
Subject: [keycloak-user] filter group claim in token per client
In-Reply-To: <VI1PR0402MB3696D1D1312CB4F7A65920FAE9CB0@VI1PR0402MB3696.eurprd04.prod.outlook.com>
References: <VI1PR0402MB3696E4DCAFFE7EEEEB0EAF70E9CF0@VI1PR0402MB3696.eurprd04.prod.outlook.com>
	<1541397265.3650.7.camel@acutus.pro>
	<VI1PR0402MB369663EA52F0699AF650CE58E9CA0@VI1PR0402MB3696.eurprd04.prod.outlook.com>
	<VI1PR0402MB3696D1D1312CB4F7A65920FAE9CB0@VI1PR0402MB3696.eurprd04.prod.outlook.com>
Message-ID: <VI1PR0402MB36967CDFF7608457E6AB73BFE9CB0@VI1PR0402MB3696.eurprd04.prod.outlook.com>

Hello again,

Upon testing login and experimenting where the claim should be inserted, I found out that the duplicate print() is a result of including the claim in both ID access tokens. The error comes as a result of including the claim in the userinfo token, and probably that is why the userinfo endpoint does not contain the claim when the client application requests it.

Any idea how to solve it?


Thanks in advance,
Ronald

-----Original Message-----
From: Ronald Demneri 
Sent: 06.Nov.2018 12:01 PM
To: Ronald Demneri <ronald.demneri at amdtia.com>; Dmitry Telegin <dt at acutus.pro>; keycloak-user at lists.jboss.org
Subject: RE: [keycloak-user] filter group claim in token per client

So, I am looking at the logs and receive the following when going to App1 > Client Scopes > Evaluate:

2018-11-06 10:51:42,407 INFO  [stdout] (default task-1892) ############################################ APP1
2018-11-06 10:51:42,407 INFO  [stdout] (default task-1892) ############################################
2018-11-06 10:51:42,407 INFO  [stdout] (default task-1892)  We are here!!!
2018-11-06 10:51:42,408 INFO  [stdout] (default task-1892) ############################################

But when trying to actually log in to the client, I receive the following:

2018-11-06 10:52:20,465 INFO  [stdout] (default task-1891) ############################################ APP1
2018-11-06 10:52:20,465 INFO  [stdout] (default task-1891) ############################################
2018-11-06 10:52:20,465 INFO  [stdout] (default task-1891)  We are here!!!
2018-11-06 10:52:20,466 INFO  [stdout] (default task-1891) ############################################
2018-11-06 10:52:20,474 INFO  [stdout] (default task-1891) ############################################ APP1
2018-11-06 10:52:20,474 INFO  [stdout] (default task-1891) ############################################
2018-11-06 10:52:20,474 INFO  [stdout] (default task-1891)  We are here!!!
2018-11-06 10:52:20,475 INFO  [stdout] (default task-1891) ############################################
2018-11-06 10:52:20,691 ERROR [org.keycloak.protocol.oidc.mappers.ScriptBasedOIDCProtocolMapper] (default task-1891) Error during execution of ProtocolMapper script: org.keycloak.scripting.ScriptExecutionException: Could not execute script 'token-mapper-script_filteredGroupsMapper' problem was: TypeError: null has no such function "toUpperCase" in <eval> at line number 31

Line 31 is as follows:

31:    var client = token.getIssuedFor().toUpperCase();
32:    print("############################################ " + client);

So why does it display an error, when in fact it also displays the correct form of the clientId in upper case? And why is the log entry duplicated? ATM, I removed the client scope mapper and have recreated the script mapper only for this client.


Regards,
Ronald


-----Original Message-----
From: Ronald Demneri 
Sent: 06.Nov.2018 11:05 AM
To: 'Ronald Demneri' <ronald.demneri at amdtia.com>; 'Dmitry Telegin' <dt at acutus.pro>; 'keycloak-user at lists.jboss.org' <keycloak-user at lists.jboss.org>
Subject: RE: [keycloak-user] filter group claim in token per client

Hello Dmitry,

A colleague of mine helped solving the issue with the array, and I can see the filtered groups in the Access token. I also used token.getIssuedFor() to get the client name and make the evaluation of the filtered groups dynamic. The problem now is that this new claim is not present in the userinfo. This is the script that we came up with (configured both as client scopes (possibly define as a default client scope) as well as script mapper specific to this client for test purposes - claim names are different of course):

[kcadmin at keycloak bin]$ ./kcadm.sh get client-scopes [ {
  "id" : "4ea94866-044e-4590-a2da-f25c980f08b4",
  "name" : "Filtered_Groups",
  "protocol" : "openid-connect",
  "attributes" : {
    "display.on.consent.screen" : "true"
  },
  "protocolMappers" : [ {
    "id" : "7d3c521a-b291-4f43-ad87-6891ed9584d3",
    "name" : "Filtered Groups",
    "protocol" : "openid-connect",
    "protocolMapper" : "oidc-script-based-protocol-mapper",
    "consentRequired" : false,
    "config" : {
      "multivalued" : "true",
      "userinfo.token.claim" : "true",
      "id.token.claim" : "true",
      "access.token.claim" : "true",
      "claim.name" : "fGroup",
      "jsonType.label" : "String",
      "script" : "/**
	* Available variables:
	* user - the current user
	* realm - the current realm
	* token - the current token
	* userSession - the current userSession
	* keycloakSession - the current userSession
	*/
	
	//insert your code here...

	//So, first we need to know, how many names should be added to the new claim,
	var username = user ? user.username : \"anonymous\";
	var groups = user.getGroups();
	var group_array = groups.toArray();
	//print(\"########################################## \" + username);

	var client = token.getIssuedFor();
	//print(\"############################################ \" + client);

	var clUp = client.toUpperCase();
	//print(clUp);

	var group_APP = \"APP-\" + clUp + \"-USERS\";
	var group_ROL = \"ROL_SSO-\" + clUp + \"-ADMIN\";

	var group_filtered = [];

	for (var i in group_array) {
		var gn = group_array[i].getName();
		var gnUp = gn.toUpperCase();
		if (gnUp === group_APP || gnUp === group_ROL) {
			group_filtered.push(\"/\" + gn);
			}
		}
	//Then we declare the new array.
	var l = group_filtered.length;
	var group_token = java.lang.reflect.Array.newInstance(java.lang.String.class, l);

	for (var f in group_filtered) {
		group_token[f] = group_filtered[f];
		//print(group_token[f]);
	}

	//And submit the array as token
	token.setOtherClaims(\"fGroup\", group_token);"
    }
  } ]
}

This is the userinfo data for my account:

{
  "sub": "bad7ff26-2a70-446f-a635-06fdbe1bec55",
  "Group": [
    "/APP-App1-Users/TGR-Team-ABC",
    "/APP-App1-Users/TGR-Team-DEF",
    "/APP-App1-Users",
    "/APP-MySmallApp-Users"
  ],
  "email_verified": false,
  "name": "Ronald Demneri",
  "preferred_username": "u151302",
  "given_name": "Ronald",
  "family_name": "Demneri"


The group claim is inserted by the group mapper created for this client, and the idea is to remove it once the script mapper works as expected.
What do you think is going on? Is this behavior normal?

Thanks in advance,
Ronald

-----Original Message-----
From: Ronald Demneri
Sent: 05.Nov.2018 12:12 PM
To: 'Ronald Demneri' <ronald.demneri at amdtia.com>; Dmitry Telegin <dt at acutus.pro>; keycloak-user at lists.jboss.org
Subject: RE: [keycloak-user] filter group claim in token per client

Hello,

In the script authenticator there was authenticationSession which I used to get the clientId. There is no such variable in the script mapper, and If I define such mapper in the client template, I suppose I'd need some mechanism to get the client name and then make the filtering of the groups that need to be inserted in the token. How do I do that? Is there any documentation available for this online?


Thanks again for your support!
Ronald


-----Original Message-----
From: keycloak-user-bounces at lists.jboss.org <keycloak-user-bounces at lists.jboss.org> On Behalf Of Ronald Demneri
Sent: 05.Nov.2018 11:00 AM
To: Dmitry Telegin <dt at acutus.pro>; keycloak-user at lists.jboss.org
Subject: Re: [keycloak-user] filter group claim in token per client

Hello Dmitry,

Thanks for the response. In fact I tried that before posting here, created a custom script mapper for the client that I have configured. The problem is that the script will return a list of objects, not an array of strings, which is what I am expecting.

What do I need to pay extra attention in order to solve this?


Thanks in advance and Regards,
Ronald

-----Original Message-----
From: Dmitry Telegin <dt at acutus.pro>
Sent: 05.Nov.2018 6:54 AM
To: Ronald Demneri <ronald.demneri at amdtia.com>; keycloak-user at lists.jboss.org
Subject: Re: [keycloak-user] filter group claim in token per client

Hello Ronald,

As in the case with authentication, JavaScript is to the rescue again :) You can create a script mapper for groups that will do additional group filtering based on the client, and use it instead of the built-in one.

To avoid explicitly configuring it for each and every client, you can create a Client Scope (can be called "Client Template" depending on the KC version), define the mapper in the scope, and add it do default scopes.

Cheers,
Dmitry Telegin
CTO, Acutus s.r.o.
Keycloak Consulting and Training

Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
+42 (022) 888-30-71
E-mail: info at acutus.pro 

On Fri, 2018-11-02 at 10:30 +0000, Ronald Demneri wrote:
> Hello everyone,
> 
> Is there a way to filter the groups a user is a member of per client, based on clientId (which is part of the group name(s) in AD). Let's say that user Ronald is member of??group_client1, group_client2 and group_client3, so using a group mapper, the token will contain a claim like group:["group_client1", "group_client2", "group_client3"]. Upon logging in to client1 app, I want to customize the group claim so that it contains only the respective group_client1 value.
> 
> Thanks in advance,
> 
> Ronald
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user


From t.rademacher at gmx.de  Tue Nov  6 10:20:50 2018
From: t.rademacher at gmx.de (Tim Rademacher)
Date: Tue, 6 Nov 2018 16:20:50 +0100
Subject: [keycloak-user] CEK key for alg:dir
Message-ID: <063c01d475e4$4d424910$e7c6db30$@gmx.de>

...I suddenly had the idea, that the auth request returns the auth code that
is then used to get an access token. So the auth code is just returned to
its origin. So the "share secret" CEK is not a shared secret, but only known
by the Keycloak server. So it makes sense, that I could not find the
information, where to get the CEK, since the Keycloak server is the only one
who needs it.

 

Could someone please confirm?

 

Thanks

 

Tim

 

Von: Tim Rademacher <t.rademacher at gmx.de> 
Gesendet: Dienstag, 6. November 2018 13:21
An: 'keycloak-user at lists.jboss.org' <keycloak-user at lists.jboss.org>
Betreff: CEK key for alg:dir

 

Hi all,

 

I am somewhat struggling with Keycloak (Version 4.5.0) and I would like to
view the data return from an authorization request. I retrieve the token and
would like to look into it.

 

I see, there are 5 parts:

 

1.	Header
2.	CEK
3.	Init Vector
4.	Content (encrypted)
5.	Auth Tag

 

The header mentions the Algorithm to be DIR and the Encryption Algorithm tob
e A128CBC-HS256.

 

The RFC7518 says, that DIR means "Direct use of a shared symmetric key as
the CEK".

 

So I wonder, how would the shared key come to the client to decrypt the
content?

 

How would I be able to decrypt the token (where would I get the token from)?

 

Thank you very much!

 

Tim


From Don.Reynolds at quest.com  Tue Nov  6 10:27:17 2018
From: Don.Reynolds at quest.com (Don Reynolds (dreynold))
Date: Tue, 6 Nov 2018 15:27:17 +0000
Subject: [keycloak-user] Create user API in keycloak with default
 password
In-Reply-To: <CAN2cN6eziF-e0yQq9x_20dNWCPTrHis7hycFKfPLE5KEaqOJ_w@mail.gmail.com>
References: <CAN2cN6eziF-e0yQq9x_20dNWCPTrHis7hycFKfPLE5KEaqOJ_w@mail.gmail.com>
Message-ID: <FBCEE17468E1D4449681E2CAA54D054E5C9A100F@ALVMBXW01.prod.quest.corp>

Hello Shubham,

Yes, this can be done.  Easiest way to see is to turn on developer tools in the browser and watch the network traffic as you use "Users->Credentials" tab in the Keycloak admin console to set a non-temporary password for a user.

Once you have created the user via the api, you can then call a second api call to " reset-password " to set the password.
It should looks something like this:

PUT
PUT /admin/realms/{realm}/users/{id}/reset-password

Request payload:
{"type":"password","value":"Password01","temporary":false}

The key is to set "temporary" to false.  Otherwise the user will be prompted to change their password next time they log in.

Hope that helps,
Don


> -----Original Message-----
> From: keycloak-user-bounces at lists.jboss.org <keycloak-user-
> bounces at lists.jboss.org> On Behalf Of Shubham Akodiya
> Sent: Tuesday, November 6, 2018 6:41 AM
> To: keycloak-user at lists.jboss.org
> Subject: [keycloak-user] Create user API in keycloak with default password
> 
> Hi Team,
> 
> Is there any API available for creating the user with default password ?
> I've gone through the API - POST /{realm}/users
> <https://www.keycloak.org/docs-api/4.5/rest-
> api/index.html#_users_resource> but didn't find the password setting field for
> new user.
> 
> 
> Thanks,
> Shubham Akodiya
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user


From wolfgang.weber at bearingpoint.com  Tue Nov  6 10:50:09 2018
From: wolfgang.weber at bearingpoint.com (Weber, Wolfgang)
Date: Tue, 6 Nov 2018 15:50:09 +0000
Subject: [keycloak-user] Keycloak 5.4.0.Final: No enum constant
 org.keycloak.common.Profile.Feature.AUTHORIZATION
In-Reply-To: <VI1PR01MB436655DCB473E1A9D37AC3E6F9CB0@VI1PR01MB4366.eurprd01.prod.exchangelabs.com>
References: <VI1PR01MB436655DCB473E1A9D37AC3E6F9CB0@VI1PR01MB4366.eurprd01.prod.exchangelabs.com>
Message-ID: <VI1PR01MB4366270AD1B4A5948237DA50F9CB0@VI1PR01MB4366.eurprd01.prod.exchangelabs.com>

The last hours I tried to deploy keycloak 4.5.0.Final without any success.  Startup fail with "No enum constant org.keycloak.common.Profile.Feature.AUTHORIZATION". I did not find any information if this is a common Issue or if I missed something in my config. An installation of 4.4.0.Final starts without any issues.

For me it seems to be related to [KEYCLOAK-8289] - Remove authorization services from product preview profile #5587

Exception:

15:45:43,248 ERROR [org.jboss.msc.service.fail] (ServerService Thread Pool -- 51) MSC000001: Failed to start service jboss.undertow.deployment.default-server.default-host./auth: org.jboss.msc.service.StartException in service jboss.undertow.deployment.default-server.default-host./auth: java.lang.RuntimeException: RESTEASY003325: Failed to construct public org.keycloak.services.resources.KeycloakApplication(javax.servlet.ServletContext,org.jboss.resteasy.core.Dispatcher)
        at org.wildfly.extension.undertow.deployment.UndertowDeploymentService$1.run(UndertowDeploymentService.java:81)
        at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
        at java.util.concurrent.FutureTask.run(FutureTask.java:266)
        at org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35)
        at org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1985)
        at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1487)
        at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1378)
        at java.lang.Thread.run(Thread.java:748)
        at org.jboss.threads.JBossThread.run(JBossThread.java:485)
Caused by: java.lang.RuntimeException: RESTEASY003325: Failed to construct public org.keycloak.services.resources.KeycloakApplication(javax.servlet.ServletContext,org.jboss.resteasy.core.Dispatcher)
        at org.jboss.resteasy.core.ConstructorInjectorImpl.construct(ConstructorInjectorImpl.java:162)
        at org.jboss.resteasy.spi.ResteasyProviderFactory.createProviderInstance(ResteasyProviderFactory.java:2676)
        at org.jboss.resteasy.spi.ResteasyDeployment.createApplication(ResteasyDeployment.java:361)
        at org.jboss.resteasy.spi.ResteasyDeployment.startInternal(ResteasyDeployment.java:274)
        at org.jboss.resteasy.spi.ResteasyDeployment.start(ResteasyDeployment.java:86)
        at org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.init(ServletContainerDispatcher.java:119)
        at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.init(HttpServletDispatcher.java:36)
        at io.undertow.servlet.core.LifecyleInterceptorInvocation.proceed(LifecyleInterceptorInvocation.java:117)
        at org.wildfly.extension.undertow.security.RunAsLifecycleInterceptor.init(RunAsLifecycleInterceptor.java:78)
        at io.undertow.servlet.core.LifecyleInterceptorInvocation.proceed(LifecyleInterceptorInvocation.java:103)
        at io.undertow.servlet.core.ManagedServlet$DefaultInstanceStrategy.start(ManagedServlet.java:300)
        at io.undertow.servlet.core.ManagedServlet.createServlet(ManagedServlet.java:140)
        at io.undertow.servlet.core.DeploymentManagerImpl$2.call(DeploymentManagerImpl.java:584)
        at io.undertow.servlet.core.DeploymentManagerImpl$2.call(DeploymentManagerImpl.java:555)
        at io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:42)
        at io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43)
        at org.wildfly.extension.undertow.security.SecurityContextThreadSetupAction.lambda$create$0(SecurityContextThreadSetupAction.java:105)
        at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1514)
        at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1514)
        at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1514)
        at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1514)
        at io.undertow.servlet.core.DeploymentManagerImpl.start(DeploymentManagerImpl.java:597)
        at org.wildfly.extension.undertow.deployment.UndertowDeploymentService.startContext(UndertowDeploymentService.java:97)
        at org.wildfly.extension.undertow.deployment.UndertowDeploymentService$1.run(UndertowDeploymentService.java:78)
        ... 8 more
Caused by: java.lang.ExceptionInInitializerError
        at org.keycloak.protocol.docker.DockerAuthV2ProtocolFactory.isSupported(DockerAuthV2ProtocolFactory.java:76)
        at org.keycloak.services.DefaultKeycloakSessionFactory.isEnabled(DefaultKeycloakSessionFactory.java:238)
        at org.keycloak.services.DefaultKeycloakSessionFactory.loadFactories(DefaultKeycloakSessionFactory.java:216)
        at org.keycloak.services.DefaultKeycloakSessionFactory.init(DefaultKeycloakSessionFactory.java:78)
        at org.keycloak.services.resources.KeycloakApplication.createSessionFactory(KeycloakApplication.java:326)
        at org.keycloak.services.resources.KeycloakApplication.<init>(KeycloakApplication.java:117)
        at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
        at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
        at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
        at java.lang.reflect.Constructor.newInstance(Constructor.java:423)
        at org.jboss.resteasy.core.ConstructorInjectorImpl.construct(ConstructorInjectorImpl.java:150)
        ... 31 more
Caused by: java.lang.RuntimeException: java.lang.IllegalArgumentException: No enum constant org.keycloak.common.Profile.Feature.AUTHORIZATION
        at org.keycloak.common.Profile.<init>(Profile.java:120)
        at org.keycloak.common.Profile.<clinit>(Profile.java:68)
        ... 42 more
Caused by: java.lang.IllegalArgumentException: No enum constant org.keycloak.common.Profile.Feature.AUTHORIZATION
        at java.lang.Enum.valueOf(Enum.java:238)
        at org.keycloak.common.Profile$Feature.valueOf(Profile.java:35)
        at org.keycloak.common.Profile.<init>(Profile.java:111)
        ... 43 more


Yours,
Wolfgang
________________________________
BearingPoint Technology GmbH
Sitz: Premst?tten bei Graz
Firmenbuchgericht: Landesgericht f?r ZRS Graz
Firmenbuchnummer: FN 44354b

The information in this email is confidential and may be legally privileged. If you are not the intended recipient of this message, any review, disclosure, copying, distribution, retention, or any action taken or omitted to be taken in reliance on it is prohibited and may be unlawful. If you are not the intended recipient, please reply to or forward a copy of this message to the sender and delete the message, any attachments, and any copies thereof from your system.

From fabio.ebner at lumera.com.br  Tue Nov  6 11:10:03 2018
From: fabio.ebner at lumera.com.br (Fabio Ebner)
Date: Tue, 6 Nov 2018 14:10:03 -0200
Subject: [keycloak-user] How to refresh token
Message-ID: <CAFxMZbbKznroNsksJ3F9vBNqbwBvLj+4p54bJsbQrnQS=3AtJQ@mail.gmail.com>

Hown can I refresh a token? after he expires?

tks

From psilva at redhat.com  Tue Nov  6 11:14:16 2018
From: psilva at redhat.com (Pedro Igor Silva)
Date: Tue, 6 Nov 2018 14:14:16 -0200
Subject: [keycloak-user] Keycloak 5.4.0.Final: No enum constant
	org.keycloak.common.Profile.Feature.AUTHORIZATION
In-Reply-To: <VI1PR01MB4366270AD1B4A5948237DA50F9CB0@VI1PR01MB4366.eurprd01.prod.exchangelabs.com>
References: <VI1PR01MB436655DCB473E1A9D37AC3E6F9CB0@VI1PR01MB4366.eurprd01.prod.exchangelabs.com>
	<VI1PR01MB4366270AD1B4A5948237DA50F9CB0@VI1PR01MB4366.eurprd01.prod.exchangelabs.com>
Message-ID: <CAJrcDBeeX-S1oFuLzmqnC1VX8d3Q84r6+K+uyhguasD4mNL=PA@mail.gmail.com>

Please, remove AUTHORIZATION from the list of profile features. I'll update
docs accordingly.

On Tue, Nov 6, 2018 at 1:58 PM Weber, Wolfgang <
wolfgang.weber at bearingpoint.com> wrote:

> The last hours I tried to deploy keycloak 4.5.0.Final without any
> success.  Startup fail with "No enum constant
> org.keycloak.common.Profile.Feature.AUTHORIZATION". I did not find any
> information if this is a common Issue or if I missed something in my
> config. An installation of 4.4.0.Final starts without any issues.
>
> For me it seems to be related to [KEYCLOAK-8289] - Remove authorization
> services from product preview profile #5587
>
> Exception:
>
> 15:45:43,248 ERROR [org.jboss.msc.service.fail] (ServerService Thread Pool
> -- 51) MSC000001: Failed to start service
> jboss.undertow.deployment.default-server.default-host./auth:
> org.jboss.msc.service.StartException in service
> jboss.undertow.deployment.default-server.default-host./auth:
> java.lang.RuntimeException: RESTEASY003325: Failed to construct public
> org.keycloak.services.resources.KeycloakApplication(javax.servlet.ServletContext,org.jboss.resteasy.core.Dispatcher)
>         at
> org.wildfly.extension.undertow.deployment.UndertowDeploymentService$1.run(UndertowDeploymentService.java:81)
>         at
> java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
>         at java.util.concurrent.FutureTask.run(FutureTask.java:266)
>         at
> org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35)
>         at
> org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1985)
>         at
> org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1487)
>         at
> org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1378)
>         at java.lang.Thread.run(Thread.java:748)
>         at org.jboss.threads.JBossThread.run(JBossThread.java:485)
> Caused by: java.lang.RuntimeException: RESTEASY003325: Failed to construct
> public
> org.keycloak.services.resources.KeycloakApplication(javax.servlet.ServletContext,org.jboss.resteasy.core.Dispatcher)
>         at
> org.jboss.resteasy.core.ConstructorInjectorImpl.construct(ConstructorInjectorImpl.java:162)
>         at
> org.jboss.resteasy.spi.ResteasyProviderFactory.createProviderInstance(ResteasyProviderFactory.java:2676)
>         at
> org.jboss.resteasy.spi.ResteasyDeployment.createApplication(ResteasyDeployment.java:361)
>         at
> org.jboss.resteasy.spi.ResteasyDeployment.startInternal(ResteasyDeployment.java:274)
>         at
> org.jboss.resteasy.spi.ResteasyDeployment.start(ResteasyDeployment.java:86)
>         at
> org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.init(ServletContainerDispatcher.java:119)
>         at
> org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.init(HttpServletDispatcher.java:36)
>         at
> io.undertow.servlet.core.LifecyleInterceptorInvocation.proceed(LifecyleInterceptorInvocation.java:117)
>         at
> org.wildfly.extension.undertow.security.RunAsLifecycleInterceptor.init(RunAsLifecycleInterceptor.java:78)
>         at
> io.undertow.servlet.core.LifecyleInterceptorInvocation.proceed(LifecyleInterceptorInvocation.java:103)
>         at
> io.undertow.servlet.core.ManagedServlet$DefaultInstanceStrategy.start(ManagedServlet.java:300)
>         at
> io.undertow.servlet.core.ManagedServlet.createServlet(ManagedServlet.java:140)
>         at
> io.undertow.servlet.core.DeploymentManagerImpl$2.call(DeploymentManagerImpl.java:584)
>         at
> io.undertow.servlet.core.DeploymentManagerImpl$2.call(DeploymentManagerImpl.java:555)
>         at
> io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:42)
>         at
> io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43)
>         at
> org.wildfly.extension.undertow.security.SecurityContextThreadSetupAction.lambda$create$0(SecurityContextThreadSetupAction.java:105)
>         at
> org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1514)
>         at
> org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1514)
>         at
> org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1514)
>         at
> org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1514)
>         at
> io.undertow.servlet.core.DeploymentManagerImpl.start(DeploymentManagerImpl.java:597)
>         at
> org.wildfly.extension.undertow.deployment.UndertowDeploymentService.startContext(UndertowDeploymentService.java:97)
>         at
> org.wildfly.extension.undertow.deployment.UndertowDeploymentService$1.run(UndertowDeploymentService.java:78)
>         ... 8 more
> Caused by: java.lang.ExceptionInInitializerError
>         at
> org.keycloak.protocol.docker.DockerAuthV2ProtocolFactory.isSupported(DockerAuthV2ProtocolFactory.java:76)
>         at
> org.keycloak.services.DefaultKeycloakSessionFactory.isEnabled(DefaultKeycloakSessionFactory.java:238)
>         at
> org.keycloak.services.DefaultKeycloakSessionFactory.loadFactories(DefaultKeycloakSessionFactory.java:216)
>         at
> org.keycloak.services.DefaultKeycloakSessionFactory.init(DefaultKeycloakSessionFactory.java:78)
>         at
> org.keycloak.services.resources.KeycloakApplication.createSessionFactory(KeycloakApplication.java:326)
>         at
> org.keycloak.services.resources.KeycloakApplication.<init>(KeycloakApplication.java:117)
>         at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native
> Method)
>         at
> sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
>         at
> sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
>         at java.lang.reflect.Constructor.newInstance(Constructor.java:423)
>         at
> org.jboss.resteasy.core.ConstructorInjectorImpl.construct(ConstructorInjectorImpl.java:150)
>         ... 31 more
> Caused by: java.lang.RuntimeException: java.lang.IllegalArgumentException:
> No enum constant org.keycloak.common.Profile.Feature.AUTHORIZATION
>         at org.keycloak.common.Profile.<init>(Profile.java:120)
>         at org.keycloak.common.Profile.<clinit>(Profile.java:68)
>         ... 42 more
> Caused by: java.lang.IllegalArgumentException: No enum constant
> org.keycloak.common.Profile.Feature.AUTHORIZATION
>         at java.lang.Enum.valueOf(Enum.java:238)
>         at org.keycloak.common.Profile$Feature.valueOf(Profile.java:35)
>         at org.keycloak.common.Profile.<init>(Profile.java:111)
>         ... 43 more
>
>
> Yours,
> Wolfgang
> ________________________________
> BearingPoint Technology GmbH
> Sitz: Premst?tten bei Graz
> Firmenbuchgericht: Landesgericht f?r ZRS Graz
> Firmenbuchnummer: FN 44354b
>
> The information in this email is confidential and may be legally
> privileged. If you are not the intended recipient of this message, any
> review, disclosure, copying, distribution, retention, or any action taken
> or omitted to be taken in reliance on it is prohibited and may be unlawful.
> If you are not the intended recipient, please reply to or forward a copy of
> this message to the sender and delete the message, any attachments, and any
> copies thereof from your system.
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

From uo67113 at gmail.com  Tue Nov  6 11:16:51 2018
From: uo67113 at gmail.com (=?UTF-8?Q?Luis_Rodr=C3=ADguez_Fern=C3=A1ndez?=)
Date: Tue, 6 Nov 2018 17:16:51 +0100
Subject: [keycloak-user] remote debugging keycloak docker image
In-Reply-To: <CAF83W6+X2OUhrYMYAz73KVWGZZpMSgDr-Zp6YiP_osLizA6snw@mail.gmail.com>
References: <CAF83W6+X2OUhrYMYAz73KVWGZZpMSgDr-Zp6YiP_osLizA6snw@mail.gmail.com>
Message-ID: <CACp70M=7qbi_RvQXgPSDWzn9AHbbyGRgb=5qjoOpE94rDqnSGA@mail.gmail.com>

Hello Meissa,

At the end of the day there should be no difference among debugging
keycloak or any other java process. In essence is just about to expose the
debug port outside your k8s cluster. This article [1] explains it very well.

Hope it helps,

Luis

[1]
https://itnext.io/remote-debugging-spring-boot-on-kubernetes-a5f96a40e5c0



El mar., 6 nov. 2018 a las 15:21, Meissa M'baye Sakho (<msakho at redhat.com>)
escribi?:

> Hello everyone,
> I need to enable remote debugging on keycloak docker image. I'm using a
> vanilla kubernetes.
> Any input on that?
> Regards,
> Meissa
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>


-- 

"Ever tried. Ever failed. No matter. Try Again. Fail again. Fail better."

- Samuel Beckett

From Rajib.Mitra at bedag.ch  Tue Nov  6 11:26:34 2018
From: Rajib.Mitra at bedag.ch (Mitra Rajib, Bedag)
Date: Tue, 6 Nov 2018 16:26:34 +0000
Subject: [keycloak-user] Welcome Email after Verification Success
Message-ID: <a37b2c9ec0c6466f8da31509479ef2fd@bedag.ch>

Hi!

I use Keycloak for User-Registration and would like to send a realm-customized "Welcome"-Email after the user verified his email-account.

The doc at https://www.keycloak.org/docs/3.2/server_admin/topics/events/login.html mentions 4 different type of email events, but none of these events fit my use-case.
Is there any other way I can (easily) implement such a functionality ?

Thanks,
Rajib


From rmbyrd at dstsystems.com  Tue Nov  6 11:28:00 2018
From: rmbyrd at dstsystems.com (Byrd, Rob M)
Date: Tue, 6 Nov 2018 16:28:00 +0000
Subject: [keycloak-user] Data filtering in SQL
In-Reply-To: <1541136118.4390.1.camel@acutus.pro>
References: <5BCF31B569C0A2468D7904C8E5839D690104C35356@DSKCMAIL1WC.ad.dstsystems.com>
	<1541136118.4390.1.camel@acutus.pro>
Message-ID: <5BCF31B569C0A2468D7904C8E5839D690104C368EF@DSKCMAIL1WC.ad.dstsystems.com>

(Hope this is the correct way to reply - let me know if not)

Thanks.  So my concern is really with the whole idea that an Enterprise Application's security constraints could really be all implemented based on url-patterns, is that what you guys are thinking?

For example, mostly a user can visit most features (urls) in an application, but it is the subset of things they can see/do within the feature that is the crux of the security issue - and it does not seem feasible to architect urls in such a way that they can be used as the key to security.  Thoughts?

Thanks!

Rob Byrd
DST
Solutions Lead
SS&C Technologies Inc.?? |?? 1055 Broadway, Kansas City, MO 64105
t: (816) 435-7286??| m?(816) 509-0119
rmbyrd at dstsystems.com??|? www.ssctech.com
Follow us: ?|? ?|? 

-----Original Message-----
From: Dmitry Telegin [mailto:dt at acutus.pro] 
Sent: Friday, November 2, 2018 12:22 AM
To: Byrd, Rob M <rmbyrd at dstsystems.com>; keycloak-user at lists.jboss.org
Subject: Re: [keycloak-user] Data filtering in SQL

Hello Rob,

If I get it right, it's all about generating SQL WHERE clause from Keycloak policies? I think this is doable, as Keycloak has a well-defined object model for authorization policies, and it's easy to obtain policy definitions in JSON format. I think Pedro Igor will tell you more about that.

You should pay attention to the following:
- there are differences in semantics between OPA and Keycloak policies. For example, Keycloak policies do not operate HTTP methods but rather use more generic notion of scopes;
- not every policy type can be easily converted to a WHERE clause. It should be trivial for User/Group/Role policies, but is virtually impossible for Script and Rules, as they are just blackboxes that evaluate to true or false. Unless of course your DBMS has a built-in JavaScript engine :)

Good luck!
Dmitry Telegin
CTO, Acutus s.r.o.
Keycloak Consulting and Training

Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
+42 (022) 888-30-71
E-mail: info at acutus.pro

On Thu, 2018-11-01 at 21:39 +0000, Byrd, Rob M wrote:
> I am comparing OPA authorization to Keycloak - how could I enforce Keycloak policy in the SQL closest to the data for good performance, including returning subsets of lists???OPA discusses this at https://blog.openpolicyagent.org/write-policy-in-opa-enforce-policy-in-sql-d9d24db93bf4.
> 
> Thanks!
> 
> Rob Byrd
> DST
> Solutions Lead
> SS&C Technologies Inc.???|???1055 Broadway, Kansas City, MO 64105
> t: (816) 435-7286??| m (816) 509-0119
> rmbyrd at dstsystems.com<mailto:rmbyrd at dstsystems.com>??|??www.ssctech.com<http://www.ssctech.com/>;
> > > Follow us: [cid:image001.png at 01D412C1.A14C5770] <https://www.linkedin.com/company/ss-c-technologies/>??|??[cid:image002.png at 01D412C1.A14C5770] <https://twitter.com/ssctechnologies>??|??[cid:image003.png at 01D412C1.A14C5770] <https://www.facebook.com/ssctechnologies/>
> 
> 
> 
> Please consider the environment before printing this email and any attachments.
> 
> This e-mail and any attachments are intended only for the individual or company to which it is addressed and may contain information which is privileged, confidential and prohibited from disclosure or unauthorized use under applicable law. If you are not the intended recipient of this e-mail, you are hereby notified that any use, dissemination, or copying of this e-mail or the information contained in this e-mail is strictly prohibited by the sender. If you have received this transmission in error, please return the material received to the sender and delete all copies from your system.
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user


Please consider the environment before printing this email and any attachments.

This e-mail and any attachments are intended only for the individual or company to which it is addressed and may contain information which is privileged, confidential and prohibited from disclosure or unauthorized use under applicable law. If you are not the intended recipient of this e-mail, you are hereby notified that any use, dissemination, or copying of this e-mail or the information contained in this e-mail is strictly prohibited by the sender. If you have received this transmission in error, please return the material received to the sender and delete all copies from your system.


From geoff at opticks.io  Tue Nov  6 12:34:22 2018
From: geoff at opticks.io (Geoffrey Cleaves)
Date: Tue, 6 Nov 2018 18:34:22 +0100
Subject: [keycloak-user] How to refresh token
In-Reply-To: <CAFxMZbbKznroNsksJ3F9vBNqbwBvLj+4p54bJsbQrnQS=3AtJQ@mail.gmail.com>
References: <CAFxMZbbKznroNsksJ3F9vBNqbwBvLj+4p54bJsbQrnQS=3AtJQ@mail.gmail.com>
Message-ID: <CAHzT=q8JEyJa_1kQECst_5j6SQcfsAqEd=J9zENXUbXVXsh1bg@mail.gmail.com>

curl -X POST \
  https://{domain}/auth/realms/{realm}/protocol/openid-connect/token \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d
'grant_type=refresh_token&client_id={client_id}&client_secret={secret}&refresh_token={refresh_token}'


On Tue, 6 Nov 2018 at 17:13, Fabio Ebner <fabio.ebner at lumera.com.br> wrote:

> Hown can I refresh a token? after he expires?
>
> tks
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

From nomb85 at gmail.com  Tue Nov  6 15:31:34 2018
From: nomb85 at gmail.com (Nathan McBride)
Date: Tue, 06 Nov 2018 15:31:34 -0500
Subject: [keycloak-user] Error Being Thrown with MySql
Message-ID: <81FB9C4C-1758-4E6C-8656-5EB32A40DA8F@gmail.com>

Hello everyone,

 

Thank you for taking the time to read this and trying to help me. I?m new to KeyCloak as well as JBOSS.

 

I created an AWS Lightsail account, the $5 / month plan, and am trying to use it for a KeyCloak server. I chose CentOS 7 as the operating system.

 

I have been following the guide located here: http://www.pimwiddershoven.nl/entry/install-keycloak-on-centos-7-with-mysql-backend

 

I have followed all the steps and am at the point where KeyCloak is supposed to be started. But when I start it, it errors and it looks like it is a problem with the mysql connection. However, I have tested the credentials both locally and connecting remote with DataGrip and I?m not really sure what I did wrong.

 

Any help is greatly appreciated.


Thank you,


Nate

 

Here are the errors:

 

20:26:28,925 ERROR [org.jboss.msc.service.fail] (ServerService Thread Pool -- 56) MSC000001: Failed to start service jboss.undertow.deployment.default-server.default-host./auth: org.jboss.msc.service.StartException in service jboss.undertow.deployment.default-server.default-host./auth: java.lang.RuntimeException: RESTEASY003325: Failed to construct public org.keycloak.services.resources.KeycloakApplication(javax.servlet.ServletContext,org.jboss.resteasy.core.Dispatcher)

??????????????? at org.wildfly.extension.undertow.deployment.UndertowDeploymentService$1.run(UndertowDeploymentService.java:81)

??????????????? at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)

??????????????? at java.util.concurrent.FutureTask.run(FutureTask.java:266)

??????????????? at org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35)

??????????????? at org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1985)

??????????????? at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1487)

??????????????? at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1378)

??????????????? at java.lang.Thread.run(Thread.java:748)

??????????????? at org.jboss.threads.JBossThread.run(JBossThread.java:485)

Caused by: java.lang.RuntimeException: RESTEASY003325: Failed to construct public org.keycloak.services.resources.KeycloakApplication(javax.servlet.ServletContext,org.jboss.resteasy.core.Dispatcher)

??????????????? at org.jboss.resteasy.core.ConstructorInjectorImpl.construct(ConstructorInjectorImpl.java:162)

??????????????? at org.jboss.resteasy.spi.ResteasyProviderFactory.createProviderInstance(ResteasyProviderFactory.java:2676)

??????????????? at org.jboss.resteasy.spi.ResteasyDeployment.createApplication(ResteasyDeployment.java:361)

??????????????? at org.jboss.resteasy.spi.ResteasyDeployment.startInternal(ResteasyDeployment.java:274)

??????????????? at org.jboss.resteasy.spi.ResteasyDeployment.start(ResteasyDeployment.java:86)

??????????????? at org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.init(ServletContainerDispatcher.java:119)

??????????????? at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.init(HttpServletDispatcher.java:36)

??????????????? at io.undertow.servlet.core.LifecyleInterceptorInvocation.proceed(LifecyleInterceptorInvocation.java:117)

??????????????? at org.wildfly.extension.undertow.security.RunAsLifecycleInterceptor.init(RunAsLifecycleInterceptor.java:78)

??????????????? at io.undertow.servlet.core.LifecyleInterceptorInvocation.proceed(LifecyleInterceptorInvocation.java:103)

??????????????? at io.undertow.servlet.core.ManagedServlet$DefaultInstanceStrategy.start(ManagedServlet.java:300)

??????????????? at io.undertow.servlet.core.ManagedServlet.createServlet(ManagedServlet.java:140)

??????????????? at io.undertow.servlet.core.DeploymentManagerImpl$2.call(DeploymentManagerImpl.java:584)

??????????????? at io.undertow.servlet.core.DeploymentManagerImpl$2.call(DeploymentManagerImpl.java:555)

??????????????? at io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:42)

??????????????? at io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43)

??????????????? at org.wildfly.extension.undertow.security.SecurityContextThreadSetupAction.lambda$create$0(SecurityContextThreadSetupAction.java:105)

??????????????? at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1514)

??????????????? at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1514)

??????????????? at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1514)

??????????????? at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1514)

??????????????? at io.undertow.servlet.core.DeploymentManagerImpl.start(DeploymentManagerImpl.java:597)

??????????????? at org.wildfly.extension.undertow.deployment.UndertowDeploymentService.startContext(UndertowDeploymentService.java:97)

??????????????? at org.wildfly.extension.undertow.deployment.UndertowDeploymentService$1.run(UndertowDeploymentService.java:78)

??????????????? ... 8 more

Caused by: java.lang.RuntimeException: Failed to connect to database

??????????????? at org.keycloak.connections.jpa.DefaultJpaConnectionProviderFactory.getConnection(DefaultJpaConnectionProviderFactory.java:373)

??????????????? at org.keycloak.connections.jpa.updater.liquibase.lock.LiquibaseDBLockProvider.lazyInit(LiquibaseDBLockProvider.java:65)

??????????????? at org.keycloak.connections.jpa.updater.liquibase.lock.LiquibaseDBLockProvider.lambda$waitForLock$0(LiquibaseDBLockProvider.java:97)

??????????????? at org.keycloak.models.utils.KeycloakModelUtils.suspendJtaTransaction(KeycloakModelUtils.java:611)

??????????????? at org.keycloak.connections.jpa.updater.liquibase.lock.LiquibaseDBLockProvider.waitForLock(LiquibaseDBLockProvider.java:95)

??????????????? at org.keycloak.services.resources.KeycloakApplication$1.run(KeycloakApplication.java:143)

??????????????? at org.keycloak.models.utils.KeycloakModelUtils.runJobInTransaction(KeycloakModelUtils.java:227)

??????????????? at org.keycloak.services.resources.KeycloakApplication.<init>(KeycloakApplication.java:136)

??????????????? at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)

??????????????? at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)

??????????????? at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)

??????????????? at java.lang.reflect.Constructor.newInstance(Constructor.java:423)

??????????????? at org.jboss.resteasy.core.ConstructorInjectorImpl.construct(ConstructorInjectorImpl.java:150)

??????????????? ... 31 more

Caused by: javax.naming.NameNotFoundException: datasources/KeycloakDS [Root exception is java.lang.IllegalStateException]

??????????????? at org.jboss.as.naming.ServiceBasedNamingStore.lookup(ServiceBasedNamingStore.java:153)

??????????????? at org.jboss.as.naming.ServiceBasedNamingStore.lookup(ServiceBasedNamingStore.java:83)

??????????????? at org.jboss.as.naming.NamingContext.lookup(NamingContext.java:207)

??????????????? at org.jboss.as.naming.NamingContext.lookup(NamingContext.java:184)

??????????????? at org.jboss.as.naming.InitialContext$DefaultInitialContext.lookup(InitialContext.java:239)

??????????????? at org.jboss.as.naming.NamingContext.lookup(NamingContext.java:193)

??????????????? at org.jboss.as.naming.NamingContext.lookup(NamingContext.java:189)

??????????????? at javax.naming.InitialContext.lookup(InitialContext.java:417)

??????????????? at javax.naming.InitialContext.lookup(InitialContext.java:417)

??????????????? at org.keycloak.connections.jpa.DefaultJpaConnectionProviderFactory.getConnection(DefaultJpaConnectionProviderFactory.java:366)

??????????????? ... 43 more

Caused by: java.lang.IllegalStateException

??????????????? at org.jboss.msc.value.InjectedValue.getValue(InjectedValue.java:50)

??????????????? at org.jboss.as.naming.service.BinderService.getValue(BinderService.java:148)

??????????????? at org.jboss.as.naming.service.BinderService.getValue(BinderService.java:46)

??????????????? at org.jboss.msc.service.ServiceControllerImpl.getValue(ServiceControllerImpl.java:1110)

??????????????? at org.jboss.as.naming.ServiceBasedNamingStore.lookup(ServiceBasedNamingStore.java:131)

??????????????? ... 52 more

 

20:26:28,938 INFO? [org.jboss.as.server] (Thread-2) WFLYSRV0220: Server shutdown has been requested via an OS signal

20:26:28,953 INFO? [org.jboss.as.connector.deployers.jdbc] (MSC service thread 1-1) WFLYJCA0019: Stopped Driver service with driver-name = mysql

20:26:28,991 ERROR [org.jboss.as.controller.management-operation] (Controller Boot Thread) WFLYCTL0013: Operation ("add") failed - address: ([("deployment" => "keycloak-server.war")]) - failure description: {"WFLYCTL0080: Failed services" => {"jboss.undertow.deployment.default-server.default-host./auth" => "java.lang.RuntimeException: RESTEASY003325: Failed to construct public org.keycloak.services.resources.KeycloakApplication(javax.servlet.ServletContext,org.jboss.resteasy.core.Dispatcher)

??? Caused by: java.lang.RuntimeException: RESTEASY003325: Failed to construct public org.keycloak.services.resources.KeycloakApplication(javax.servlet.ServletContext,org.jboss.resteasy.core.Dispatcher)

??? Caused by: java.lang.RuntimeException: Failed to connect to database

??? Caused by: javax.naming.NameNotFoundException: datasources/KeycloakDS [Root exception is java.lang.IllegalStateException]

??? Caused by: java.lang.IllegalStateException"}}

20:26:29,011 INFO? [org.wildfly.extension.undertow] (MSC service thread 1-2) WFLYUT0008: Undertow HTTPS listener https suspending

20:26:29,014 INFO? [org.wildfly.extension.undertow] (MSC service thread 1-2) WFLYUT0007: Undertow HTTPS listener https stopped, was bound to 0.0.0.0:8443

20:26:29,017 INFO? [org.wildfly.extension.undertow] (MSC service thread 1-2) WFLYUT0019: Host default-host stopping

20:26:29,021 INFO? [org.jboss.as.connector.subsystems.datasources] (MSC service thread 1-2) WFLYJCA0010: Unbound data source [java:jboss/datasources/ExampleDS]

20:26:29,029 INFO? [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 54) WFLYCLINF0003: Stopped realms cache from keycloak container

20:26:29,030 INFO? [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 58) WFLYCLINF0003: Stopped offlineClientSessions cache from keycloak container

20:26:29,030 INFO? [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 50) WFLYCLINF0003: Stopped users cache from keycloak container

20:26:29,031 INFO? [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 57) WFLYCLINF0003: Stopped clientSessions cache from keycloak container

20:26:29,032 INFO? [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 48) WFLYCLINF0003: Stopped authenticationSessions cache from keycloak container

20:26:29,032 INFO? [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 46) WFLYCLINF0003: Stopped sessions cache from keycloak container

20:26:29,033 INFO? [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 47) WFLYCLINF0003: Stopped authorization cache from keycloak container

20:26:29,034 INFO? [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 51) WFLYCLINF0003: Stopped loginFailures cache from keycloak container

20:26:29,034 INFO? [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 52) WFLYCLINF0003: Stopped actionTokens cache from keycloak container

20:26:29,035 INFO? [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 55) WFLYCLINF0003: Stopped offlineSessions cache from keycloak container

20:26:29,038 INFO? [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 55) WFLYCLINF0003: Stopped keys cache from keycloak container

20:26:29,062 INFO? [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 59) WFLYCLINF0003: Stopped work cache from keycloak container

20:26:29,068 INFO? [org.jboss.as.connector.deployers.jdbc] (MSC service thread 1-2) WFLYJCA0019: Stopped Driver service with driver-name = h2

20:26:29,088 INFO? [org.wildfly.extension.undertow] (MSC service thread 1-2) WFLYUT0008: Undertow HTTP listener default suspending

20:26:29,089 INFO? [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 56) WFLYCLINF0003: Stopped client-mappings cache from ejb container

20:26:29,089 INFO? [org.wildfly.extension.undertow] (MSC service thread 1-2) WFLYUT0007: Undertow HTTP listener default stopped, was bound to 0.0.0.0:8080

20:26:29,091 INFO? [org.wildfly.extension.undertow] (MSC service thread 1-2) WFLYUT0004: Undertow 2.0.9.Final stopping

20:26:29,100 INFO? [org.jboss.as.clustering.infinispan] (MSC service thread 1-1) WFLYCLINF0003: Stopped authorizationRevisions cache from keycloak container

20:26:29,106 INFO? [org.jboss.as.clustering.infinispan] (MSC service thread 1-1) WFLYCLINF0003: Stopped realmRevisions cache from keycloak container

20:26:29,110 INFO? [org.jboss.as.clustering.infinispan] (MSC service thread 1-1) WFLYCLINF0003: Stopped userRevisions cache from keycloak container

20:26:29,111 INFO? [org.jboss.as.server.deployment] (MSC service thread 1-1) WFLYSRV0028: Stopped deployment keycloak-server.war (runtime-name: keycloak-server.war) in 170ms

20:26:29,149 INFO? [org.jboss.as.server] (ServerService Thread Pool -- 37) WFLYSRV0010: Deployed "keycloak-server.war" (runtime-name : "keycloak-server.war")

20:26:29,282 ERROR [org.jboss.as.server] (Controller Boot Thread) WFLYSRV0055: Caught exception during boot: java.lang.NullPointerException

??????????????? at org.jboss.as.controller.AbstractControllerService.finishBoot(AbstractControllerService.java:534)

??????????????? at org.jboss.as.server.ServerService.finishBoot(ServerService.java:418)

??????????????? at org.jboss.as.server.ServerService.boot(ServerService.java:388)

??????????????? at org.jboss.as.controller.AbstractControllerService$1.run(AbstractControllerService.java:372)

??????????????? at java.lang.Thread.run(Thread.java:748)

 


From geoff at opticks.io  Tue Nov  6 15:48:47 2018
From: geoff at opticks.io (Geoffrey Cleaves)
Date: Tue, 6 Nov 2018 21:48:47 +0100
Subject: [keycloak-user] Error Being Thrown with MySql
In-Reply-To: <81FB9C4C-1758-4E6C-8656-5EB32A40DA8F@gmail.com>
References: <81FB9C4C-1758-4E6C-8656-5EB32A40DA8F@gmail.com>
Message-ID: <CAHzT=q-1erMvKaocQP28VCRyk0HCsRgWUB3FiKiTquuuLzt+rA@mail.gmail.com>

I believe there is an unresolved (and un admitted) incompatibility with
Mysql. Use postgres.

On Tue, Nov 6, 2018, 21:40 Nathan McBride <nomb85 at gmail.com wrote:

> Hello everyone,
>
>
>
> Thank you for taking the time to read this and trying to help me. I?m new
> to KeyCloak as well as JBOSS.
>
>
>
> I created an AWS Lightsail account, the $5 / month plan, and am trying to
> use it for a KeyCloak server. I chose CentOS 7 as the operating system.
>
>
>
> I have been following the guide located here:
> http://www.pimwiddershoven.nl/entry/install-keycloak-on-centos-7-with-mysql-backend
>
>
>
> I have followed all the steps and am at the point where KeyCloak is
> supposed to be started. But when I start it, it errors and it looks like it
> is a problem with the mysql connection. However, I have tested the
> credentials both locally and connecting remote with DataGrip and I?m not
> really sure what I did wrong.
>
>
>
> Any help is greatly appreciated.
>
>
> Thank you,
>
>
> Nate
>
>
>
> Here are the errors:
>
>
>
> 20:26:28,925 ERROR [org.jboss.msc.service.fail] (ServerService Thread Pool
> -- 56) MSC000001: Failed to start service
> jboss.undertow.deployment.default-server.default-host./auth:
> org.jboss.msc.service.StartException in service
> jboss.undertow.deployment.default-server.default-host./auth:
> java.lang.RuntimeException: RESTEASY003325: Failed to construct public
> org.keycloak.services.resources.KeycloakApplication(javax.servlet.ServletContext,org.jboss.resteasy.core.Dispatcher)
>
>                 at
> org.wildfly.extension.undertow.deployment.UndertowDeploymentService$1.run(UndertowDeploymentService.java:81)
>
>                 at
> java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
>
>                 at java.util.concurrent.FutureTask.run(FutureTask.java:266)
>
>                 at
> org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35)
>
>                 at
> org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1985)
>
>                 at
> org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1487)
>
>                 at
> org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1378)
>
>                 at java.lang.Thread.run(Thread.java:748)
>
>                 at org.jboss.threads.JBossThread.run(JBossThread.java:485)
>
> Caused by: java.lang.RuntimeException: RESTEASY003325: Failed to construct
> public
> org.keycloak.services.resources.KeycloakApplication(javax.servlet.ServletContext,org.jboss.resteasy.core.Dispatcher)
>
>                 at
> org.jboss.resteasy.core.ConstructorInjectorImpl.construct(ConstructorInjectorImpl.java:162)
>
>                 at
> org.jboss.resteasy.spi.ResteasyProviderFactory.createProviderInstance(ResteasyProviderFactory.java:2676)
>
>                 at
> org.jboss.resteasy.spi.ResteasyDeployment.createApplication(ResteasyDeployment.java:361)
>
>                 at
> org.jboss.resteasy.spi.ResteasyDeployment.startInternal(ResteasyDeployment.java:274)
>
>                 at
> org.jboss.resteasy.spi.ResteasyDeployment.start(ResteasyDeployment.java:86)
>
>                 at
> org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.init(ServletContainerDispatcher.java:119)
>
>                 at
> org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.init(HttpServletDispatcher.java:36)
>
>                 at
> io.undertow.servlet.core.LifecyleInterceptorInvocation.proceed(LifecyleInterceptorInvocation.java:117)
>
>                 at
> org.wildfly.extension.undertow.security.RunAsLifecycleInterceptor.init(RunAsLifecycleInterceptor.java:78)
>
>                 at
> io.undertow.servlet.core.LifecyleInterceptorInvocation.proceed(LifecyleInterceptorInvocation.java:103)
>
>                 at
> io.undertow.servlet.core.ManagedServlet$DefaultInstanceStrategy.start(ManagedServlet.java:300)
>
>                 at
> io.undertow.servlet.core.ManagedServlet.createServlet(ManagedServlet.java:140)
>
>                 at
> io.undertow.servlet.core.DeploymentManagerImpl$2.call(DeploymentManagerImpl.java:584)
>
>                 at
> io.undertow.servlet.core.DeploymentManagerImpl$2.call(DeploymentManagerImpl.java:555)
>
>                 at
> io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:42)
>
>                 at
> io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43)
>
>                 at
> org.wildfly.extension.undertow.security.SecurityContextThreadSetupAction.lambda$create$0(SecurityContextThreadSetupAction.java:105)
>
>                 at
> org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1514)
>
>                 at
> org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1514)
>
>                 at
> org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1514)
>
>                 at
> org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1514)
>
>                 at
> io.undertow.servlet.core.DeploymentManagerImpl.start(DeploymentManagerImpl.java:597)
>
>                 at
> org.wildfly.extension.undertow.deployment.UndertowDeploymentService.startContext(UndertowDeploymentService.java:97)
>
>                 at
> org.wildfly.extension.undertow.deployment.UndertowDeploymentService$1.run(UndertowDeploymentService.java:78)
>
>                 ... 8 more
>
> Caused by: java.lang.RuntimeException: Failed to connect to database
>
>                 at
> org.keycloak.connections.jpa.DefaultJpaConnectionProviderFactory.getConnection(DefaultJpaConnectionProviderFactory.java:373)
>
>                 at
> org.keycloak.connections.jpa.updater.liquibase.lock.LiquibaseDBLockProvider.lazyInit(LiquibaseDBLockProvider.java:65)
>
>                 at
> org.keycloak.connections.jpa.updater.liquibase.lock.LiquibaseDBLockProvider.lambda$waitForLock$0(LiquibaseDBLockProvider.java:97)
>
>                 at
> org.keycloak.models.utils.KeycloakModelUtils.suspendJtaTransaction(KeycloakModelUtils.java:611)
>
>                 at
> org.keycloak.connections.jpa.updater.liquibase.lock.LiquibaseDBLockProvider.waitForLock(LiquibaseDBLockProvider.java:95)
>
>                 at
> org.keycloak.services.resources.KeycloakApplication$1.run(KeycloakApplication.java:143)
>
>                 at
> org.keycloak.models.utils.KeycloakModelUtils.runJobInTransaction(KeycloakModelUtils.java:227)
>
>                 at
> org.keycloak.services.resources.KeycloakApplication.<init>(KeycloakApplication.java:136)
>
>                 at
> sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
>
>                 at
> sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
>
>                 at
> sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
>
>                 at
> java.lang.reflect.Constructor.newInstance(Constructor.java:423)
>
>                 at
> org.jboss.resteasy.core.ConstructorInjectorImpl.construct(ConstructorInjectorImpl.java:150)
>
>                 ... 31 more
>
> Caused by: javax.naming.NameNotFoundException: datasources/KeycloakDS
> [Root exception is java.lang.IllegalStateException]
>
>                 at
> org.jboss.as.naming.ServiceBasedNamingStore.lookup(ServiceBasedNamingStore.java:153)
>
>                 at
> org.jboss.as.naming.ServiceBasedNamingStore.lookup(ServiceBasedNamingStore.java:83)
>
>                 at
> org.jboss.as.naming.NamingContext.lookup(NamingContext.java:207)
>
>                 at
> org.jboss.as.naming.NamingContext.lookup(NamingContext.java:184)
>
>                 at
> org.jboss.as.naming.InitialContext$DefaultInitialContext.lookup(InitialContext.java:239)
>
>                 at
> org.jboss.as.naming.NamingContext.lookup(NamingContext.java:193)
>
>                 at
> org.jboss.as.naming.NamingContext.lookup(NamingContext.java:189)
>
>                 at
> javax.naming.InitialContext.lookup(InitialContext.java:417)
>
>                 at
> javax.naming.InitialContext.lookup(InitialContext.java:417)
>
>                 at
> org.keycloak.connections.jpa.DefaultJpaConnectionProviderFactory.getConnection(DefaultJpaConnectionProviderFactory.java:366)
>
>                 ... 43 more
>
> Caused by: java.lang.IllegalStateException
>
>                 at
> org.jboss.msc.value.InjectedValue.getValue(InjectedValue.java:50)
>
>                 at
> org.jboss.as.naming.service.BinderService.getValue(BinderService.java:148)
>
>                 at
> org.jboss.as.naming.service.BinderService.getValue(BinderService.java:46)
>
>                 at
> org.jboss.msc.service.ServiceControllerImpl.getValue(ServiceControllerImpl.java:1110)
>
>                 at
> org.jboss.as.naming.ServiceBasedNamingStore.lookup(ServiceBasedNamingStore.java:131)
>
>                 ... 52 more
>
>
>
> 20:26:28,938 INFO  [org.jboss.as.server] (Thread-2) WFLYSRV0220: Server
> shutdown has been requested via an OS signal
>
> 20:26:28,953 INFO  [org.jboss.as.connector.deployers.jdbc] (MSC service
> thread 1-1) WFLYJCA0019: Stopped Driver service with driver-name = mysql
>
> 20:26:28,991 ERROR [org.jboss.as.controller.management-operation]
> (Controller Boot Thread) WFLYCTL0013: Operation ("add") failed - address:
> ([("deployment" => "keycloak-server.war")]) - failure description:
> {"WFLYCTL0080: Failed services" =>
> {"jboss.undertow.deployment.default-server.default-host./auth" =>
> "java.lang.RuntimeException: RESTEASY003325: Failed to construct public
> org.keycloak.services.resources.KeycloakApplication(javax.servlet.ServletContext,org.jboss.resteasy.core.Dispatcher)
>
>     Caused by: java.lang.RuntimeException: RESTEASY003325: Failed to
> construct public
> org.keycloak.services.resources.KeycloakApplication(javax.servlet.ServletContext,org.jboss.resteasy.core.Dispatcher)
>
>     Caused by: java.lang.RuntimeException: Failed to connect to database
>
>     Caused by: javax.naming.NameNotFoundException: datasources/KeycloakDS
> [Root exception is java.lang.IllegalStateException]
>
>     Caused by: java.lang.IllegalStateException"}}
>
> 20:26:29,011 INFO  [org.wildfly.extension.undertow] (MSC service thread
> 1-2) WFLYUT0008: Undertow HTTPS listener https suspending
>
> 20:26:29,014 INFO  [org.wildfly.extension.undertow] (MSC service thread
> 1-2) WFLYUT0007: Undertow HTTPS listener https stopped, was bound to
> 0.0.0.0:8443
>
> 20:26:29,017 INFO  [org.wildfly.extension.undertow] (MSC service thread
> 1-2) WFLYUT0019: Host default-host stopping
>
> 20:26:29,021 INFO  [org.jboss.as.connector.subsystems.datasources] (MSC
> service thread 1-2) WFLYJCA0010: Unbound data source
> [java:jboss/datasources/ExampleDS]
>
> 20:26:29,029 INFO  [org.jboss.as.clustering.infinispan] (ServerService
> Thread Pool -- 54) WFLYCLINF0003: Stopped realms cache from keycloak
> container
>
> 20:26:29,030 INFO  [org.jboss.as.clustering.infinispan] (ServerService
> Thread Pool -- 58) WFLYCLINF0003: Stopped offlineClientSessions cache from
> keycloak container
>
> 20:26:29,030 INFO  [org.jboss.as.clustering.infinispan] (ServerService
> Thread Pool -- 50) WFLYCLINF0003: Stopped users cache from keycloak
> container
>
> 20:26:29,031 INFO  [org.jboss.as.clustering.infinispan] (ServerService
> Thread Pool -- 57) WFLYCLINF0003: Stopped clientSessions cache from
> keycloak container
>
> 20:26:29,032 INFO  [org.jboss.as.clustering.infinispan] (ServerService
> Thread Pool -- 48) WFLYCLINF0003: Stopped authenticationSessions cache from
> keycloak container
>
> 20:26:29,032 INFO  [org.jboss.as.clustering.infinispan] (ServerService
> Thread Pool -- 46) WFLYCLINF0003: Stopped sessions cache from keycloak
> container
>
> 20:26:29,033 INFO  [org.jboss.as.clustering.infinispan] (ServerService
> Thread Pool -- 47) WFLYCLINF0003: Stopped authorization cache from keycloak
> container
>
> 20:26:29,034 INFO  [org.jboss.as.clustering.infinispan] (ServerService
> Thread Pool -- 51) WFLYCLINF0003: Stopped loginFailures cache from keycloak
> container
>
> 20:26:29,034 INFO  [org.jboss.as.clustering.infinispan] (ServerService
> Thread Pool -- 52) WFLYCLINF0003: Stopped actionTokens cache from keycloak
> container
>
> 20:26:29,035 INFO  [org.jboss.as.clustering.infinispan] (ServerService
> Thread Pool -- 55) WFLYCLINF0003: Stopped offlineSessions cache from
> keycloak container
>
> 20:26:29,038 INFO  [org.jboss.as.clustering.infinispan] (ServerService
> Thread Pool -- 55) WFLYCLINF0003: Stopped keys cache from keycloak container
>
> 20:26:29,062 INFO  [org.jboss.as.clustering.infinispan] (ServerService
> Thread Pool -- 59) WFLYCLINF0003: Stopped work cache from keycloak container
>
> 20:26:29,068 INFO  [org.jboss.as.connector.deployers.jdbc] (MSC service
> thread 1-2) WFLYJCA0019: Stopped Driver service with driver-name = h2
>
> 20:26:29,088 INFO  [org.wildfly.extension.undertow] (MSC service thread
> 1-2) WFLYUT0008: Undertow HTTP listener default suspending
>
> 20:26:29,089 INFO  [org.jboss.as.clustering.infinispan] (ServerService
> Thread Pool -- 56) WFLYCLINF0003: Stopped client-mappings cache from ejb
> container
>
> 20:26:29,089 INFO  [org.wildfly.extension.undertow] (MSC service thread
> 1-2) WFLYUT0007: Undertow HTTP listener default stopped, was bound to
> 0.0.0.0:8080
>
> 20:26:29,091 INFO  [org.wildfly.extension.undertow] (MSC service thread
> 1-2) WFLYUT0004: Undertow 2.0.9.Final stopping
>
> 20:26:29,100 INFO  [org.jboss.as.clustering.infinispan] (MSC service
> thread 1-1) WFLYCLINF0003: Stopped authorizationRevisions cache from
> keycloak container
>
> 20:26:29,106 INFO  [org.jboss.as.clustering.infinispan] (MSC service
> thread 1-1) WFLYCLINF0003: Stopped realmRevisions cache from keycloak
> container
>
> 20:26:29,110 INFO  [org.jboss.as.clustering.infinispan] (MSC service
> thread 1-1) WFLYCLINF0003: Stopped userRevisions cache from keycloak
> container
>
> 20:26:29,111 INFO  [org.jboss.as.server.deployment] (MSC service thread
> 1-1) WFLYSRV0028: Stopped deployment keycloak-server.war (runtime-name:
> keycloak-server.war) in 170ms
>
> 20:26:29,149 INFO  [org.jboss.as.server] (ServerService Thread Pool -- 37)
> WFLYSRV0010: Deployed "keycloak-server.war" (runtime-name :
> "keycloak-server.war")
>
> 20:26:29,282 ERROR [org.jboss.as.server] (Controller Boot Thread)
> WFLYSRV0055: Caught exception during boot: java.lang.NullPointerException
>
>                 at
> org.jboss.as.controller.AbstractControllerService.finishBoot(AbstractControllerService.java:534)
>
>                 at
> org.jboss.as.server.ServerService.finishBoot(ServerService.java:418)
>
>                 at
> org.jboss.as.server.ServerService.boot(ServerService.java:388)
>
>                 at
> org.jboss.as.controller.AbstractControllerService$1.run(AbstractControllerService.java:372)
>
>                 at java.lang.Thread.run(Thread.java:748)
>
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From nomb85 at gmail.com  Tue Nov  6 15:51:06 2018
From: nomb85 at gmail.com (Nate M)
Date: Tue, 6 Nov 2018 15:51:06 -0500
Subject: [keycloak-user] Error Being Thrown with MySql
In-Reply-To: <CAHzT=q-1erMvKaocQP28VCRyk0HCsRgWUB3FiKiTquuuLzt+rA@mail.gmail.com>
References: <81FB9C4C-1758-4E6C-8656-5EB32A40DA8F@gmail.com>
	<CAHzT=q-1erMvKaocQP28VCRyk0HCsRgWUB3FiKiTquuuLzt+rA@mail.gmail.com>
Message-ID: <CAByjsFmmfqfL89XJEets4qpE7uioOAPv7nocR8m-4CV7qbAohw@mail.gmail.com>

I was really only able to get this far because of the guide. Do you have
the steps to convert the setup to postgres?

Thanks,

Nate

On Tue, Nov 6, 2018 at 3:49 PM Geoffrey Cleaves <geoff at opticks.io> wrote:

> I believe there is an unresolved (and un admitted) incompatibility with
> Mysql. Use postgres.
>
> On Tue, Nov 6, 2018, 21:40 Nathan McBride <nomb85 at gmail.com wrote:
>
>> Hello everyone,
>>
>>
>>
>> Thank you for taking the time to read this and trying to help me. I?m new
>> to KeyCloak as well as JBOSS.
>>
>>
>>
>> I created an AWS Lightsail account, the $5 / month plan, and am trying to
>> use it for a KeyCloak server. I chose CentOS 7 as the operating system.
>>
>>
>>
>> I have been following the guide located here:
>> http://www.pimwiddershoven.nl/entry/install-keycloak-on-centos-7-with-mysql-backend
>>
>>
>>
>> I have followed all the steps and am at the point where KeyCloak is
>> supposed to be started. But when I start it, it errors and it looks like it
>> is a problem with the mysql connection. However, I have tested the
>> credentials both locally and connecting remote with DataGrip and I?m not
>> really sure what I did wrong.
>>
>>
>>
>> Any help is greatly appreciated.
>>
>>
>> Thank you,
>>
>>
>> Nate
>>
>>
>>
>> Here are the errors:
>>
>>
>>
>> 20:26:28,925 ERROR [org.jboss.msc.service.fail] (ServerService Thread
>> Pool -- 56) MSC000001: Failed to start service
>> jboss.undertow.deployment.default-server.default-host./auth:
>> org.jboss.msc.service.StartException in service
>> jboss.undertow.deployment.default-server.default-host./auth:
>> java.lang.RuntimeException: RESTEASY003325: Failed to construct public
>> org.keycloak.services.resources.KeycloakApplication(javax.servlet.ServletContext,org.jboss.resteasy.core.Dispatcher)
>>
>>                 at
>> org.wildfly.extension.undertow.deployment.UndertowDeploymentService$1.run(UndertowDeploymentService.java:81)
>>
>>                 at
>> java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
>>
>>                 at
>> java.util.concurrent.FutureTask.run(FutureTask.java:266)
>>
>>                 at
>> org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35)
>>
>>                 at
>> org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1985)
>>
>>                 at
>> org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1487)
>>
>>                 at
>> org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1378)
>>
>>                 at java.lang.Thread.run(Thread.java:748)
>>
>>                 at org.jboss.threads.JBossThread.run(JBossThread.java:485)
>>
>> Caused by: java.lang.RuntimeException: RESTEASY003325: Failed to
>> construct public
>> org.keycloak.services.resources.KeycloakApplication(javax.servlet.ServletContext,org.jboss.resteasy.core.Dispatcher)
>>
>>                 at
>> org.jboss.resteasy.core.ConstructorInjectorImpl.construct(ConstructorInjectorImpl.java:162)
>>
>>                 at
>> org.jboss.resteasy.spi.ResteasyProviderFactory.createProviderInstance(ResteasyProviderFactory.java:2676)
>>
>>                 at
>> org.jboss.resteasy.spi.ResteasyDeployment.createApplication(ResteasyDeployment.java:361)
>>
>>                 at
>> org.jboss.resteasy.spi.ResteasyDeployment.startInternal(ResteasyDeployment.java:274)
>>
>>                 at
>> org.jboss.resteasy.spi.ResteasyDeployment.start(ResteasyDeployment.java:86)
>>
>>                 at
>> org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.init(ServletContainerDispatcher.java:119)
>>
>>                 at
>> org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.init(HttpServletDispatcher.java:36)
>>
>>                 at
>> io.undertow.servlet.core.LifecyleInterceptorInvocation.proceed(LifecyleInterceptorInvocation.java:117)
>>
>>                 at
>> org.wildfly.extension.undertow.security.RunAsLifecycleInterceptor.init(RunAsLifecycleInterceptor.java:78)
>>
>>                 at
>> io.undertow.servlet.core.LifecyleInterceptorInvocation.proceed(LifecyleInterceptorInvocation.java:103)
>>
>>                 at
>> io.undertow.servlet.core.ManagedServlet$DefaultInstanceStrategy.start(ManagedServlet.java:300)
>>
>>                 at
>> io.undertow.servlet.core.ManagedServlet.createServlet(ManagedServlet.java:140)
>>
>>                 at
>> io.undertow.servlet.core.DeploymentManagerImpl$2.call(DeploymentManagerImpl.java:584)
>>
>>                 at
>> io.undertow.servlet.core.DeploymentManagerImpl$2.call(DeploymentManagerImpl.java:555)
>>
>>                 at
>> io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:42)
>>
>>                 at
>> io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43)
>>
>>                 at
>> org.wildfly.extension.undertow.security.SecurityContextThreadSetupAction.lambda$create$0(SecurityContextThreadSetupAction.java:105)
>>
>>                 at
>> org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1514)
>>
>>                 at
>> org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1514)
>>
>>                 at
>> org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1514)
>>
>>                 at
>> org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1514)
>>
>>                 at
>> io.undertow.servlet.core.DeploymentManagerImpl.start(DeploymentManagerImpl.java:597)
>>
>>                 at
>> org.wildfly.extension.undertow.deployment.UndertowDeploymentService.startContext(UndertowDeploymentService.java:97)
>>
>>                 at
>> org.wildfly.extension.undertow.deployment.UndertowDeploymentService$1.run(UndertowDeploymentService.java:78)
>>
>>                 ... 8 more
>>
>> Caused by: java.lang.RuntimeException: Failed to connect to database
>>
>>                 at
>> org.keycloak.connections.jpa.DefaultJpaConnectionProviderFactory.getConnection(DefaultJpaConnectionProviderFactory.java:373)
>>
>>                 at
>> org.keycloak.connections.jpa.updater.liquibase.lock.LiquibaseDBLockProvider.lazyInit(LiquibaseDBLockProvider.java:65)
>>
>>                 at
>> org.keycloak.connections.jpa.updater.liquibase.lock.LiquibaseDBLockProvider.lambda$waitForLock$0(LiquibaseDBLockProvider.java:97)
>>
>>                 at
>> org.keycloak.models.utils.KeycloakModelUtils.suspendJtaTransaction(KeycloakModelUtils.java:611)
>>
>>                 at
>> org.keycloak.connections.jpa.updater.liquibase.lock.LiquibaseDBLockProvider.waitForLock(LiquibaseDBLockProvider.java:95)
>>
>>                 at
>> org.keycloak.services.resources.KeycloakApplication$1.run(KeycloakApplication.java:143)
>>
>>                 at
>> org.keycloak.models.utils.KeycloakModelUtils.runJobInTransaction(KeycloakModelUtils.java:227)
>>
>>                 at
>> org.keycloak.services.resources.KeycloakApplication.<init>(KeycloakApplication.java:136)
>>
>>                 at
>> sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
>>
>>                 at
>> sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
>>
>>                 at
>> sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
>>
>>                 at
>> java.lang.reflect.Constructor.newInstance(Constructor.java:423)
>>
>>                 at
>> org.jboss.resteasy.core.ConstructorInjectorImpl.construct(ConstructorInjectorImpl.java:150)
>>
>>                 ... 31 more
>>
>> Caused by: javax.naming.NameNotFoundException: datasources/KeycloakDS
>> [Root exception is java.lang.IllegalStateException]
>>
>>                 at
>> org.jboss.as.naming.ServiceBasedNamingStore.lookup(ServiceBasedNamingStore.java:153)
>>
>>                 at
>> org.jboss.as.naming.ServiceBasedNamingStore.lookup(ServiceBasedNamingStore.java:83)
>>
>>                 at
>> org.jboss.as.naming.NamingContext.lookup(NamingContext.java:207)
>>
>>                 at
>> org.jboss.as.naming.NamingContext.lookup(NamingContext.java:184)
>>
>>                 at
>> org.jboss.as.naming.InitialContext$DefaultInitialContext.lookup(InitialContext.java:239)
>>
>>                 at
>> org.jboss.as.naming.NamingContext.lookup(NamingContext.java:193)
>>
>>                 at
>> org.jboss.as.naming.NamingContext.lookup(NamingContext.java:189)
>>
>>                 at
>> javax.naming.InitialContext.lookup(InitialContext.java:417)
>>
>>                 at
>> javax.naming.InitialContext.lookup(InitialContext.java:417)
>>
>>                 at
>> org.keycloak.connections.jpa.DefaultJpaConnectionProviderFactory.getConnection(DefaultJpaConnectionProviderFactory.java:366)
>>
>>                 ... 43 more
>>
>> Caused by: java.lang.IllegalStateException
>>
>>                 at
>> org.jboss.msc.value.InjectedValue.getValue(InjectedValue.java:50)
>>
>>                 at
>> org.jboss.as.naming.service.BinderService.getValue(BinderService.java:148)
>>
>>                 at
>> org.jboss.as.naming.service.BinderService.getValue(BinderService.java:46)
>>
>>                 at
>> org.jboss.msc.service.ServiceControllerImpl.getValue(ServiceControllerImpl.java:1110)
>>
>>                 at
>> org.jboss.as.naming.ServiceBasedNamingStore.lookup(ServiceBasedNamingStore.java:131)
>>
>>                 ... 52 more
>>
>>
>>
>> 20:26:28,938 INFO  [org.jboss.as.server] (Thread-2) WFLYSRV0220: Server
>> shutdown has been requested via an OS signal
>>
>> 20:26:28,953 INFO  [org.jboss.as.connector.deployers.jdbc] (MSC service
>> thread 1-1) WFLYJCA0019: Stopped Driver service with driver-name = mysql
>>
>> 20:26:28,991 ERROR [org.jboss.as.controller.management-operation]
>> (Controller Boot Thread) WFLYCTL0013: Operation ("add") failed - address:
>> ([("deployment" => "keycloak-server.war")]) - failure description:
>> {"WFLYCTL0080: Failed services" =>
>> {"jboss.undertow.deployment.default-server.default-host./auth" =>
>> "java.lang.RuntimeException: RESTEASY003325: Failed to construct public
>> org.keycloak.services.resources.KeycloakApplication(javax.servlet.ServletContext,org.jboss.resteasy.core.Dispatcher)
>>
>>     Caused by: java.lang.RuntimeException: RESTEASY003325: Failed to
>> construct public
>> org.keycloak.services.resources.KeycloakApplication(javax.servlet.ServletContext,org.jboss.resteasy.core.Dispatcher)
>>
>>     Caused by: java.lang.RuntimeException: Failed to connect to database
>>
>>     Caused by: javax.naming.NameNotFoundException: datasources/KeycloakDS
>> [Root exception is java.lang.IllegalStateException]
>>
>>     Caused by: java.lang.IllegalStateException"}}
>>
>> 20:26:29,011 INFO  [org.wildfly.extension.undertow] (MSC service thread
>> 1-2) WFLYUT0008: Undertow HTTPS listener https suspending
>>
>> 20:26:29,014 INFO  [org.wildfly.extension.undertow] (MSC service thread
>> 1-2) WFLYUT0007: Undertow HTTPS listener https stopped, was bound to
>> 0.0.0.0:8443
>>
>> 20:26:29,017 INFO  [org.wildfly.extension.undertow] (MSC service thread
>> 1-2) WFLYUT0019: Host default-host stopping
>>
>> 20:26:29,021 INFO  [org.jboss.as.connector.subsystems.datasources] (MSC
>> service thread 1-2) WFLYJCA0010: Unbound data source
>> [java:jboss/datasources/ExampleDS]
>>
>> 20:26:29,029 INFO  [org.jboss.as.clustering.infinispan] (ServerService
>> Thread Pool -- 54) WFLYCLINF0003: Stopped realms cache from keycloak
>> container
>>
>> 20:26:29,030 INFO  [org.jboss.as.clustering.infinispan] (ServerService
>> Thread Pool -- 58) WFLYCLINF0003: Stopped offlineClientSessions cache from
>> keycloak container
>>
>> 20:26:29,030 INFO  [org.jboss.as.clustering.infinispan] (ServerService
>> Thread Pool -- 50) WFLYCLINF0003: Stopped users cache from keycloak
>> container
>>
>> 20:26:29,031 INFO  [org.jboss.as.clustering.infinispan] (ServerService
>> Thread Pool -- 57) WFLYCLINF0003: Stopped clientSessions cache from
>> keycloak container
>>
>> 20:26:29,032 INFO  [org.jboss.as.clustering.infinispan] (ServerService
>> Thread Pool -- 48) WFLYCLINF0003: Stopped authenticationSessions cache from
>> keycloak container
>>
>> 20:26:29,032 INFO  [org.jboss.as.clustering.infinispan] (ServerService
>> Thread Pool -- 46) WFLYCLINF0003: Stopped sessions cache from keycloak
>> container
>>
>> 20:26:29,033 INFO  [org.jboss.as.clustering.infinispan] (ServerService
>> Thread Pool -- 47) WFLYCLINF0003: Stopped authorization cache from keycloak
>> container
>>
>> 20:26:29,034 INFO  [org.jboss.as.clustering.infinispan] (ServerService
>> Thread Pool -- 51) WFLYCLINF0003: Stopped loginFailures cache from keycloak
>> container
>>
>> 20:26:29,034 INFO  [org.jboss.as.clustering.infinispan] (ServerService
>> Thread Pool -- 52) WFLYCLINF0003: Stopped actionTokens cache from keycloak
>> container
>>
>> 20:26:29,035 INFO  [org.jboss.as.clustering.infinispan] (ServerService
>> Thread Pool -- 55) WFLYCLINF0003: Stopped offlineSessions cache from
>> keycloak container
>>
>> 20:26:29,038 INFO  [org.jboss.as.clustering.infinispan] (ServerService
>> Thread Pool -- 55) WFLYCLINF0003: Stopped keys cache from keycloak container
>>
>> 20:26:29,062 INFO  [org.jboss.as.clustering.infinispan] (ServerService
>> Thread Pool -- 59) WFLYCLINF0003: Stopped work cache from keycloak container
>>
>> 20:26:29,068 INFO  [org.jboss.as.connector.deployers.jdbc] (MSC service
>> thread 1-2) WFLYJCA0019: Stopped Driver service with driver-name = h2
>>
>> 20:26:29,088 INFO  [org.wildfly.extension.undertow] (MSC service thread
>> 1-2) WFLYUT0008: Undertow HTTP listener default suspending
>>
>> 20:26:29,089 INFO  [org.jboss.as.clustering.infinispan] (ServerService
>> Thread Pool -- 56) WFLYCLINF0003: Stopped client-mappings cache from ejb
>> container
>>
>> 20:26:29,089 INFO  [org.wildfly.extension.undertow] (MSC service thread
>> 1-2) WFLYUT0007: Undertow HTTP listener default stopped, was bound to
>> 0.0.0.0:8080
>>
>> 20:26:29,091 INFO  [org.wildfly.extension.undertow] (MSC service thread
>> 1-2) WFLYUT0004: Undertow 2.0.9.Final stopping
>>
>> 20:26:29,100 INFO  [org.jboss.as.clustering.infinispan] (MSC service
>> thread 1-1) WFLYCLINF0003: Stopped authorizationRevisions cache from
>> keycloak container
>>
>> 20:26:29,106 INFO  [org.jboss.as.clustering.infinispan] (MSC service
>> thread 1-1) WFLYCLINF0003: Stopped realmRevisions cache from keycloak
>> container
>>
>> 20:26:29,110 INFO  [org.jboss.as.clustering.infinispan] (MSC service
>> thread 1-1) WFLYCLINF0003: Stopped userRevisions cache from keycloak
>> container
>>
>> 20:26:29,111 INFO  [org.jboss.as.server.deployment] (MSC service thread
>> 1-1) WFLYSRV0028: Stopped deployment keycloak-server.war (runtime-name:
>> keycloak-server.war) in 170ms
>>
>> 20:26:29,149 INFO  [org.jboss.as.server] (ServerService Thread Pool --
>> 37) WFLYSRV0010: Deployed "keycloak-server.war" (runtime-name :
>> "keycloak-server.war")
>>
>> 20:26:29,282 ERROR [org.jboss.as.server] (Controller Boot Thread)
>> WFLYSRV0055: Caught exception during boot: java.lang.NullPointerException
>>
>>                 at
>> org.jboss.as.controller.AbstractControllerService.finishBoot(AbstractControllerService.java:534)
>>
>>                 at
>> org.jboss.as.server.ServerService.finishBoot(ServerService.java:418)
>>
>>                 at
>> org.jboss.as.server.ServerService.boot(ServerService.java:388)
>>
>>                 at
>> org.jboss.as.controller.AbstractControllerService$1.run(AbstractControllerService.java:372)
>>
>>                 at java.lang.Thread.run(Thread.java:748)
>>
>>
>>
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
>

From ronald.demneri at amdtia.com  Tue Nov  6 15:51:57 2018
From: ronald.demneri at amdtia.com (Ronald Demneri)
Date: Tue, 6 Nov 2018 20:51:57 +0000
Subject: [keycloak-user] filter group claim in token per client
In-Reply-To: <VI1PR0402MB36967CDFF7608457E6AB73BFE9CB0@VI1PR0402MB3696.eurprd04.prod.outlook.com>
References: <VI1PR0402MB3696E4DCAFFE7EEEEB0EAF70E9CF0@VI1PR0402MB3696.eurprd04.prod.outlook.com>
	<1541397265.3650.7.camel@acutus.pro>
	<VI1PR0402MB369663EA52F0699AF650CE58E9CA0@VI1PR0402MB3696.eurprd04.prod.outlook.com>
	<VI1PR0402MB3696D1D1312CB4F7A65920FAE9CB0@VI1PR0402MB3696.eurprd04.prod.outlook.com>,
	<VI1PR0402MB36967CDFF7608457E6AB73BFE9CB0@VI1PR0402MB3696.eurprd04.prod.outlook.com>
Message-ID: <VI1PR0402MB36962E1029F6BB26BC168EA4E9CB0@VI1PR0402MB3696.eurprd04.prod.outlook.com>

I configured the client to not use the userinfo endpoint for the group mapping.  Instead I used the id token,  and everything looks good now (no errors in the log,  and the client gets the claim, and assigns permissions accordingly) . Anyhow,  the question remains,  is there a way to get the client id using the script mapper?

Thanks in advance,
Ronald

Sent from my HTC

----- Reply message -----
From: "Ronald Demneri" <ronald.demneri at amdtia.com>
To: "Ronald Demneri" <ronald.demneri at amdtia.com>, "Dmitry Telegin" <dt at acutus.pro>, "keycloak-user at lists.jboss.org" <keycloak-user at lists.jboss.org>
Subject: [keycloak-user] filter group claim in token per client
Date: Tue, Nov 6, 2018 16:08

Hello again,

Upon testing login and experimenting where the claim should be inserted, I found out that the duplicate print() is a result of including the claim in both ID access tokens. The error comes as a result of including the claim in the userinfo token, and probably that is why the userinfo endpoint does not contain the claim when the client application requests it.

Any idea how to solve it?


Thanks in advance,
Ronald

-----Original Message-----
From: Ronald Demneri
Sent: 06.Nov.2018 12:01 PM
To: Ronald Demneri <ronald.demneri at amdtia.com>; Dmitry Telegin <dt at acutus.pro>; keycloak-user at lists.jboss.org
Subject: RE: [keycloak-user] filter group claim in token per client

So, I am looking at the logs and receive the following when going to App1 > Client Scopes > Evaluate:

2018-11-06 10:51:42,407 INFO  [stdout] (default task-1892) ############################################ APP1
2018-11-06 10:51:42,407 INFO  [stdout] (default task-1892) ############################################
2018-11-06 10:51:42,407 INFO  [stdout] (default task-1892)  We are here!!!
2018-11-06 10:51:42,408 INFO  [stdout] (default task-1892) ############################################

But when trying to actually log in to the client, I receive the following:

2018-11-06 10:52:20,465 INFO  [stdout] (default task-1891) ############################################ APP1
2018-11-06 10:52:20,465 INFO  [stdout] (default task-1891) ############################################
2018-11-06 10:52:20,465 INFO  [stdout] (default task-1891)  We are here!!!
2018-11-06 10:52:20,466 INFO  [stdout] (default task-1891) ############################################
2018-11-06 10:52:20,474 INFO  [stdout] (default task-1891) ############################################ APP1
2018-11-06 10:52:20,474 INFO  [stdout] (default task-1891) ############################################
2018-11-06 10:52:20,474 INFO  [stdout] (default task-1891)  We are here!!!
2018-11-06 10:52:20,475 INFO  [stdout] (default task-1891) ############################################
2018-11-06 10:52:20,691 ERROR [org.keycloak.protocol.oidc.mappers.ScriptBasedOIDCProtocolMapper] (default task-1891) Error during execution of ProtocolMapper script: org.keycloak.scripting.ScriptExecutionException: Could not execute script 'token-mapper-script_filteredGroupsMapper' problem was: TypeError: null has no such function "toUpperCase" in <eval> at line number 31

Line 31 is as follows:

31:    var client = token.getIssuedFor().toUpperCase();
32:    print("############################################ " + client);

So why does it display an error, when in fact it also displays the correct form of the clientId in upper case? And why is the log entry duplicated? ATM, I removed the client scope mapper and have recreated the script mapper only for this client.


Regards,
Ronald


-----Original Message-----
From: Ronald Demneri
Sent: 06.Nov.2018 11:05 AM
To: 'Ronald Demneri' <ronald.demneri at amdtia.com>; 'Dmitry Telegin' <dt at acutus.pro>; 'keycloak-user at lists.jboss.org' <keycloak-user at lists.jboss.org>
Subject: RE: [keycloak-user] filter group claim in token per client

Hello Dmitry,

A colleague of mine helped solving the issue with the array, and I can see the filtered groups in the Access token. I also used token.getIssuedFor() to get the client name and make the evaluation of the filtered groups dynamic. The problem now is that this new claim is not present in the userinfo. This is the script that we came up with (configured both as client scopes (possibly define as a default client scope) as well as script mapper specific to this client for test purposes - claim names are different of course):

[kcadmin at keycloak bin]$ ./kcadm.sh get client-scopes [ {
  "id" : "4ea94866-044e-4590-a2da-f25c980f08b4",
  "name" : "Filtered_Groups",
  "protocol" : "openid-connect",
  "attributes" : {
    "display.on.consent.screen" : "true"
  },
  "protocolMappers" : [ {
    "id" : "7d3c521a-b291-4f43-ad87-6891ed9584d3",
    "name" : "Filtered Groups",
    "protocol" : "openid-connect",
    "protocolMapper" : "oidc-script-based-protocol-mapper",
    "consentRequired" : false,
    "config" : {
      "multivalued" : "true",
      "userinfo.token.claim" : "true",
      "id.token.claim" : "true",
      "access.token.claim" : "true",
      "claim.name" : "fGroup",
      "jsonType.label" : "String",
      "script" : "/**
        * Available variables:
        * user - the current user
        * realm - the current realm
        * token - the current token
        * userSession - the current userSession
        * keycloakSession - the current userSession
        */

        //insert your code here...

        //So, first we need to know, how many names should be added to the new claim,
        var username = user ? user.username : \"anonymous\";
        var groups = user.getGroups();
        var group_array = groups.toArray();
        //print(\"########################################## \" + username);

        var client = token.getIssuedFor();
        //print(\"############################################ \" + client);

        var clUp = client.toUpperCase();
        //print(clUp);

        var group_APP = \"APP-\" + clUp + \"-USERS\";
        var group_ROL = \"ROL_SSO-\" + clUp + \"-ADMIN\";

        var group_filtered = [];

        for (var i in group_array) {
                var gn = group_array[i].getName();
                var gnUp = gn.toUpperCase();
                if (gnUp === group_APP || gnUp === group_ROL) {
                        group_filtered.push(\"/\" + gn);
                        }
                }
        //Then we declare the new array.
        var l = group_filtered.length;
        var group_token = java.lang.reflect.Array.newInstance(java.lang.String.class, l);

        for (var f in group_filtered) {
                group_token[f] = group_filtered[f];
                //print(group_token[f]);
        }

        //And submit the array as token
        token.setOtherClaims(\"fGroup\", group_token);"
    }
  } ]
}

This is the userinfo data for my account:

{
  "sub": "bad7ff26-2a70-446f-a635-06fdbe1bec55",
  "Group": [
    "/APP-App1-Users/TGR-Team-ABC",
    "/APP-App1-Users/TGR-Team-DEF",
    "/APP-App1-Users",
    "/APP-MySmallApp-Users"
  ],
  "email_verified": false,
  "name": "Ronald Demneri",
  "preferred_username": "u151302",
  "given_name": "Ronald",
  "family_name": "Demneri"


The group claim is inserted by the group mapper created for this client, and the idea is to remove it once the script mapper works as expected.
What do you think is going on? Is this behavior normal?

Thanks in advance,
Ronald

-----Original Message-----
From: Ronald Demneri
Sent: 05.Nov.2018 12:12 PM
To: 'Ronald Demneri' <ronald.demneri at amdtia.com>; Dmitry Telegin <dt at acutus.pro>; keycloak-user at lists.jboss.org
Subject: RE: [keycloak-user] filter group claim in token per client

Hello,

In the script authenticator there was authenticationSession which I used to get the clientId. There is no such variable in the script mapper, and If I define such mapper in the client template, I suppose I'd need some mechanism to get the client name and then make the filtering of the groups that need to be inserted in the token. How do I do that? Is there any documentation available for this online?


Thanks again for your support!
Ronald


-----Original Message-----
From: keycloak-user-bounces at lists.jboss.org <keycloak-user-bounces at lists.jboss.org> On Behalf Of Ronald Demneri
Sent: 05.Nov.2018 11:00 AM
To: Dmitry Telegin <dt at acutus.pro>; keycloak-user at lists.jboss.org
Subject: Re: [keycloak-user] filter group claim in token per client

Hello Dmitry,

Thanks for the response. In fact I tried that before posting here, created a custom script mapper for the client that I have configured. The problem is that the script will return a list of objects, not an array of strings, which is what I am expecting.

What do I need to pay extra attention in order to solve this?


Thanks in advance and Regards,
Ronald

-----Original Message-----
From: Dmitry Telegin <dt at acutus.pro>
Sent: 05.Nov.2018 6:54 AM
To: Ronald Demneri <ronald.demneri at amdtia.com>; keycloak-user at lists.jboss.org
Subject: Re: [keycloak-user] filter group claim in token per client

Hello Ronald,

As in the case with authentication, JavaScript is to the rescue again :) You can create a script mapper for groups that will do additional group filtering based on the client, and use it instead of the built-in one.

To avoid explicitly configuring it for each and every client, you can create a Client Scope (can be called "Client Template" depending on the KC version), define the mapper in the scope, and add it do default scopes.

Cheers,
Dmitry Telegin
CTO, Acutus s.r.o.
Keycloak Consulting and Training

Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
+42 (022) 888-30-71
E-mail: info at acutus.pro

On Fri, 2018-11-02 at 10:30 +0000, Ronald Demneri wrote:
> Hello everyone,
>
> Is there a way to filter the groups a user is a member of per client, based on clientId (which is part of the group name(s) in AD). Let's say that user Ronald is member of  group_client1, group_client2 and group_client3, so using a group mapper, the token will contain a claim like group:["group_client1", "group_client2", "group_client3"]. Upon logging in to client1 app, I want to customize the group claim so that it contains only the respective group_client1 value.
>
> Thanks in advance,
>
> Ronald
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user

From geoff at opticks.io  Tue Nov  6 15:58:42 2018
From: geoff at opticks.io (Geoffrey Cleaves)
Date: Tue, 6 Nov 2018 21:58:42 +0100
Subject: [keycloak-user] Error Being Thrown with MySql
In-Reply-To: <CAByjsFmmfqfL89XJEets4qpE7uioOAPv7nocR8m-4CV7qbAohw@mail.gmail.com>
References: <81FB9C4C-1758-4E6C-8656-5EB32A40DA8F@gmail.com>
	<CAHzT=q-1erMvKaocQP28VCRyk0HCsRgWUB3FiKiTquuuLzt+rA@mail.gmail.com>
	<CAByjsFmmfqfL89XJEets4qpE7uioOAPv7nocR8m-4CV7qbAohw@mail.gmail.com>
Message-ID: <CAHzT=q9ThKpGh4zCi0FZ7JxaZaiU2FGETdy38FqhJ6vjMXOfbg@mail.gmail.com>

Well, I now see that the guide is quite recent. Maybe the mysql issue has
been resolved. Sorry I can't be of more help.

On Tue, Nov 6, 2018, 21:51 Nate M <nomb85 at gmail.com wrote:

> I was really only able to get this far because of the guide. Do you have
> the steps to convert the setup to postgres?
>
> Thanks,
>
> Nate
>
> On Tue, Nov 6, 2018 at 3:49 PM Geoffrey Cleaves <geoff at opticks.io> wrote:
>
>> I believe there is an unresolved (and un admitted) incompatibility with
>> Mysql. Use postgres.
>>
>> On Tue, Nov 6, 2018, 21:40 Nathan McBride <nomb85 at gmail.com wrote:
>>
>>> Hello everyone,
>>>
>>>
>>>
>>> Thank you for taking the time to read this and trying to help me. I?m
>>> new to KeyCloak as well as JBOSS.
>>>
>>>
>>>
>>> I created an AWS Lightsail account, the $5 / month plan, and am trying
>>> to use it for a KeyCloak server. I chose CentOS 7 as the operating system.
>>>
>>>
>>>
>>> I have been following the guide located here:
>>> http://www.pimwiddershoven.nl/entry/install-keycloak-on-centos-7-with-mysql-backend
>>>
>>>
>>>
>>> I have followed all the steps and am at the point where KeyCloak is
>>> supposed to be started. But when I start it, it errors and it looks like it
>>> is a problem with the mysql connection. However, I have tested the
>>> credentials both locally and connecting remote with DataGrip and I?m not
>>> really sure what I did wrong.
>>>
>>>
>>>
>>> Any help is greatly appreciated.
>>>
>>>
>>> Thank you,
>>>
>>>
>>> Nate
>>>
>>>
>>>
>>> Here are the errors:
>>>
>>>
>>>
>>> 20:26:28,925 ERROR [org.jboss.msc.service.fail] (ServerService Thread
>>> Pool -- 56) MSC000001: Failed to start service
>>> jboss.undertow.deployment.default-server.default-host./auth:
>>> org.jboss.msc.service.StartException in service
>>> jboss.undertow.deployment.default-server.default-host./auth:
>>> java.lang.RuntimeException: RESTEASY003325: Failed to construct public
>>> org.keycloak.services.resources.KeycloakApplication(javax.servlet.ServletContext,org.jboss.resteasy.core.Dispatcher)
>>>
>>>                 at
>>> org.wildfly.extension.undertow.deployment.UndertowDeploymentService$1.run(UndertowDeploymentService.java:81)
>>>
>>>                 at
>>> java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
>>>
>>>                 at
>>> java.util.concurrent.FutureTask.run(FutureTask.java:266)
>>>
>>>                 at
>>> org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35)
>>>
>>>                 at
>>> org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1985)
>>>
>>>                 at
>>> org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1487)
>>>
>>>                 at
>>> org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1378)
>>>
>>>                 at java.lang.Thread.run(Thread.java:748)
>>>
>>>                 at
>>> org.jboss.threads.JBossThread.run(JBossThread.java:485)
>>>
>>> Caused by: java.lang.RuntimeException: RESTEASY003325: Failed to
>>> construct public
>>> org.keycloak.services.resources.KeycloakApplication(javax.servlet.ServletContext,org.jboss.resteasy.core.Dispatcher)
>>>
>>>                 at
>>> org.jboss.resteasy.core.ConstructorInjectorImpl.construct(ConstructorInjectorImpl.java:162)
>>>
>>>                 at
>>> org.jboss.resteasy.spi.ResteasyProviderFactory.createProviderInstance(ResteasyProviderFactory.java:2676)
>>>
>>>                 at
>>> org.jboss.resteasy.spi.ResteasyDeployment.createApplication(ResteasyDeployment.java:361)
>>>
>>>                 at
>>> org.jboss.resteasy.spi.ResteasyDeployment.startInternal(ResteasyDeployment.java:274)
>>>
>>>                 at
>>> org.jboss.resteasy.spi.ResteasyDeployment.start(ResteasyDeployment.java:86)
>>>
>>>                 at
>>> org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.init(ServletContainerDispatcher.java:119)
>>>
>>>                 at
>>> org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.init(HttpServletDispatcher.java:36)
>>>
>>>                 at
>>> io.undertow.servlet.core.LifecyleInterceptorInvocation.proceed(LifecyleInterceptorInvocation.java:117)
>>>
>>>                 at
>>> org.wildfly.extension.undertow.security.RunAsLifecycleInterceptor.init(RunAsLifecycleInterceptor.java:78)
>>>
>>>                 at
>>> io.undertow.servlet.core.LifecyleInterceptorInvocation.proceed(LifecyleInterceptorInvocation.java:103)
>>>
>>>                 at
>>> io.undertow.servlet.core.ManagedServlet$DefaultInstanceStrategy.start(ManagedServlet.java:300)
>>>
>>>                 at
>>> io.undertow.servlet.core.ManagedServlet.createServlet(ManagedServlet.java:140)
>>>
>>>                 at
>>> io.undertow.servlet.core.DeploymentManagerImpl$2.call(DeploymentManagerImpl.java:584)
>>>
>>>                 at
>>> io.undertow.servlet.core.DeploymentManagerImpl$2.call(DeploymentManagerImpl.java:555)
>>>
>>>                 at
>>> io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:42)
>>>
>>>                 at
>>> io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43)
>>>
>>>                 at
>>> org.wildfly.extension.undertow.security.SecurityContextThreadSetupAction.lambda$create$0(SecurityContextThreadSetupAction.java:105)
>>>
>>>                 at
>>> org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1514)
>>>
>>>                 at
>>> org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1514)
>>>
>>>                 at
>>> org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1514)
>>>
>>>                 at
>>> org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1514)
>>>
>>>                 at
>>> io.undertow.servlet.core.DeploymentManagerImpl.start(DeploymentManagerImpl.java:597)
>>>
>>>                 at
>>> org.wildfly.extension.undertow.deployment.UndertowDeploymentService.startContext(UndertowDeploymentService.java:97)
>>>
>>>                 at
>>> org.wildfly.extension.undertow.deployment.UndertowDeploymentService$1.run(UndertowDeploymentService.java:78)
>>>
>>>                 ... 8 more
>>>
>>> Caused by: java.lang.RuntimeException: Failed to connect to database
>>>
>>>                 at
>>> org.keycloak.connections.jpa.DefaultJpaConnectionProviderFactory.getConnection(DefaultJpaConnectionProviderFactory.java:373)
>>>
>>>                 at
>>> org.keycloak.connections.jpa.updater.liquibase.lock.LiquibaseDBLockProvider.lazyInit(LiquibaseDBLockProvider.java:65)
>>>
>>>                 at
>>> org.keycloak.connections.jpa.updater.liquibase.lock.LiquibaseDBLockProvider.lambda$waitForLock$0(LiquibaseDBLockProvider.java:97)
>>>
>>>                 at
>>> org.keycloak.models.utils.KeycloakModelUtils.suspendJtaTransaction(KeycloakModelUtils.java:611)
>>>
>>>                 at
>>> org.keycloak.connections.jpa.updater.liquibase.lock.LiquibaseDBLockProvider.waitForLock(LiquibaseDBLockProvider.java:95)
>>>
>>>                 at
>>> org.keycloak.services.resources.KeycloakApplication$1.run(KeycloakApplication.java:143)
>>>
>>>                 at
>>> org.keycloak.models.utils.KeycloakModelUtils.runJobInTransaction(KeycloakModelUtils.java:227)
>>>
>>>                 at
>>> org.keycloak.services.resources.KeycloakApplication.<init>(KeycloakApplication.java:136)
>>>
>>>                 at
>>> sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
>>>
>>>                 at
>>> sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
>>>
>>>                 at
>>> sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
>>>
>>>                 at
>>> java.lang.reflect.Constructor.newInstance(Constructor.java:423)
>>>
>>>                 at
>>> org.jboss.resteasy.core.ConstructorInjectorImpl.construct(ConstructorInjectorImpl.java:150)
>>>
>>>                 ... 31 more
>>>
>>> Caused by: javax.naming.NameNotFoundException: datasources/KeycloakDS
>>> [Root exception is java.lang.IllegalStateException]
>>>
>>>                 at
>>> org.jboss.as.naming.ServiceBasedNamingStore.lookup(ServiceBasedNamingStore.java:153)
>>>
>>>                 at
>>> org.jboss.as.naming.ServiceBasedNamingStore.lookup(ServiceBasedNamingStore.java:83)
>>>
>>>                 at
>>> org.jboss.as.naming.NamingContext.lookup(NamingContext.java:207)
>>>
>>>                 at
>>> org.jboss.as.naming.NamingContext.lookup(NamingContext.java:184)
>>>
>>>                 at
>>> org.jboss.as.naming.InitialContext$DefaultInitialContext.lookup(InitialContext.java:239)
>>>
>>>                 at
>>> org.jboss.as.naming.NamingContext.lookup(NamingContext.java:193)
>>>
>>>                 at
>>> org.jboss.as.naming.NamingContext.lookup(NamingContext.java:189)
>>>
>>>                 at
>>> javax.naming.InitialContext.lookup(InitialContext.java:417)
>>>
>>>                 at
>>> javax.naming.InitialContext.lookup(InitialContext.java:417)
>>>
>>>                 at
>>> org.keycloak.connections.jpa.DefaultJpaConnectionProviderFactory.getConnection(DefaultJpaConnectionProviderFactory.java:366)
>>>
>>>                 ... 43 more
>>>
>>> Caused by: java.lang.IllegalStateException
>>>
>>>                 at
>>> org.jboss.msc.value.InjectedValue.getValue(InjectedValue.java:50)
>>>
>>>                 at
>>> org.jboss.as.naming.service.BinderService.getValue(BinderService.java:148)
>>>
>>>                 at
>>> org.jboss.as.naming.service.BinderService.getValue(BinderService.java:46)
>>>
>>>                 at
>>> org.jboss.msc.service.ServiceControllerImpl.getValue(ServiceControllerImpl.java:1110)
>>>
>>>                 at
>>> org.jboss.as.naming.ServiceBasedNamingStore.lookup(ServiceBasedNamingStore.java:131)
>>>
>>>                 ... 52 more
>>>
>>>
>>>
>>> 20:26:28,938 INFO  [org.jboss.as.server] (Thread-2) WFLYSRV0220: Server
>>> shutdown has been requested via an OS signal
>>>
>>> 20:26:28,953 INFO  [org.jboss.as.connector.deployers.jdbc] (MSC service
>>> thread 1-1) WFLYJCA0019: Stopped Driver service with driver-name = mysql
>>>
>>> 20:26:28,991 ERROR [org.jboss.as.controller.management-operation]
>>> (Controller Boot Thread) WFLYCTL0013: Operation ("add") failed - address:
>>> ([("deployment" => "keycloak-server.war")]) - failure description:
>>> {"WFLYCTL0080: Failed services" =>
>>> {"jboss.undertow.deployment.default-server.default-host./auth" =>
>>> "java.lang.RuntimeException: RESTEASY003325: Failed to construct public
>>> org.keycloak.services.resources.KeycloakApplication(javax.servlet.ServletContext,org.jboss.resteasy.core.Dispatcher)
>>>
>>>     Caused by: java.lang.RuntimeException: RESTEASY003325: Failed to
>>> construct public
>>> org.keycloak.services.resources.KeycloakApplication(javax.servlet.ServletContext,org.jboss.resteasy.core.Dispatcher)
>>>
>>>     Caused by: java.lang.RuntimeException: Failed to connect to database
>>>
>>>     Caused by: javax.naming.NameNotFoundException:
>>> datasources/KeycloakDS [Root exception is java.lang.IllegalStateException]
>>>
>>>     Caused by: java.lang.IllegalStateException"}}
>>>
>>> 20:26:29,011 INFO  [org.wildfly.extension.undertow] (MSC service thread
>>> 1-2) WFLYUT0008: Undertow HTTPS listener https suspending
>>>
>>> 20:26:29,014 INFO  [org.wildfly.extension.undertow] (MSC service thread
>>> 1-2) WFLYUT0007: Undertow HTTPS listener https stopped, was bound to
>>> 0.0.0.0:8443
>>>
>>> 20:26:29,017 INFO  [org.wildfly.extension.undertow] (MSC service thread
>>> 1-2) WFLYUT0019: Host default-host stopping
>>>
>>> 20:26:29,021 INFO  [org.jboss.as.connector.subsystems.datasources] (MSC
>>> service thread 1-2) WFLYJCA0010: Unbound data source
>>> [java:jboss/datasources/ExampleDS]
>>>
>>> 20:26:29,029 INFO  [org.jboss.as.clustering.infinispan] (ServerService
>>> Thread Pool -- 54) WFLYCLINF0003: Stopped realms cache from keycloak
>>> container
>>>
>>> 20:26:29,030 INFO  [org.jboss.as.clustering.infinispan] (ServerService
>>> Thread Pool -- 58) WFLYCLINF0003: Stopped offlineClientSessions cache from
>>> keycloak container
>>>
>>> 20:26:29,030 INFO  [org.jboss.as.clustering.infinispan] (ServerService
>>> Thread Pool -- 50) WFLYCLINF0003: Stopped users cache from keycloak
>>> container
>>>
>>> 20:26:29,031 INFO  [org.jboss.as.clustering.infinispan] (ServerService
>>> Thread Pool -- 57) WFLYCLINF0003: Stopped clientSessions cache from
>>> keycloak container
>>>
>>> 20:26:29,032 INFO  [org.jboss.as.clustering.infinispan] (ServerService
>>> Thread Pool -- 48) WFLYCLINF0003: Stopped authenticationSessions cache from
>>> keycloak container
>>>
>>> 20:26:29,032 INFO  [org.jboss.as.clustering.infinispan] (ServerService
>>> Thread Pool -- 46) WFLYCLINF0003: Stopped sessions cache from keycloak
>>> container
>>>
>>> 20:26:29,033 INFO  [org.jboss.as.clustering.infinispan] (ServerService
>>> Thread Pool -- 47) WFLYCLINF0003: Stopped authorization cache from keycloak
>>> container
>>>
>>> 20:26:29,034 INFO  [org.jboss.as.clustering.infinispan] (ServerService
>>> Thread Pool -- 51) WFLYCLINF0003: Stopped loginFailures cache from keycloak
>>> container
>>>
>>> 20:26:29,034 INFO  [org.jboss.as.clustering.infinispan] (ServerService
>>> Thread Pool -- 52) WFLYCLINF0003: Stopped actionTokens cache from keycloak
>>> container
>>>
>>> 20:26:29,035 INFO  [org.jboss.as.clustering.infinispan] (ServerService
>>> Thread Pool -- 55) WFLYCLINF0003: Stopped offlineSessions cache from
>>> keycloak container
>>>
>>> 20:26:29,038 INFO  [org.jboss.as.clustering.infinispan] (ServerService
>>> Thread Pool -- 55) WFLYCLINF0003: Stopped keys cache from keycloak container
>>>
>>> 20:26:29,062 INFO  [org.jboss.as.clustering.infinispan] (ServerService
>>> Thread Pool -- 59) WFLYCLINF0003: Stopped work cache from keycloak container
>>>
>>> 20:26:29,068 INFO  [org.jboss.as.connector.deployers.jdbc] (MSC service
>>> thread 1-2) WFLYJCA0019: Stopped Driver service with driver-name = h2
>>>
>>> 20:26:29,088 INFO  [org.wildfly.extension.undertow] (MSC service thread
>>> 1-2) WFLYUT0008: Undertow HTTP listener default suspending
>>>
>>> 20:26:29,089 INFO  [org.jboss.as.clustering.infinispan] (ServerService
>>> Thread Pool -- 56) WFLYCLINF0003: Stopped client-mappings cache from ejb
>>> container
>>>
>>> 20:26:29,089 INFO  [org.wildfly.extension.undertow] (MSC service thread
>>> 1-2) WFLYUT0007: Undertow HTTP listener default stopped, was bound to
>>> 0.0.0.0:8080
>>>
>>> 20:26:29,091 INFO  [org.wildfly.extension.undertow] (MSC service thread
>>> 1-2) WFLYUT0004: Undertow 2.0.9.Final stopping
>>>
>>> 20:26:29,100 INFO  [org.jboss.as.clustering.infinispan] (MSC service
>>> thread 1-1) WFLYCLINF0003: Stopped authorizationRevisions cache from
>>> keycloak container
>>>
>>> 20:26:29,106 INFO  [org.jboss.as.clustering.infinispan] (MSC service
>>> thread 1-1) WFLYCLINF0003: Stopped realmRevisions cache from keycloak
>>> container
>>>
>>> 20:26:29,110 INFO  [org.jboss.as.clustering.infinispan] (MSC service
>>> thread 1-1) WFLYCLINF0003: Stopped userRevisions cache from keycloak
>>> container
>>>
>>> 20:26:29,111 INFO  [org.jboss.as.server.deployment] (MSC service thread
>>> 1-1) WFLYSRV0028: Stopped deployment keycloak-server.war (runtime-name:
>>> keycloak-server.war) in 170ms
>>>
>>> 20:26:29,149 INFO  [org.jboss.as.server] (ServerService Thread Pool --
>>> 37) WFLYSRV0010: Deployed "keycloak-server.war" (runtime-name :
>>> "keycloak-server.war")
>>>
>>> 20:26:29,282 ERROR [org.jboss.as.server] (Controller Boot Thread)
>>> WFLYSRV0055: Caught exception during boot: java.lang.NullPointerException
>>>
>>>                 at
>>> org.jboss.as.controller.AbstractControllerService.finishBoot(AbstractControllerService.java:534)
>>>
>>>                 at
>>> org.jboss.as.server.ServerService.finishBoot(ServerService.java:418)
>>>
>>>                 at
>>> org.jboss.as.server.ServerService.boot(ServerService.java:388)
>>>
>>>                 at
>>> org.jboss.as.controller.AbstractControllerService$1.run(AbstractControllerService.java:372)
>>>
>>>                 at java.lang.Thread.run(Thread.java:748)
>>>
>>>
>>>
>>> _______________________________________________
>>> keycloak-user mailing list
>>> keycloak-user at lists.jboss.org
>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>>

From psilva at redhat.com  Tue Nov  6 16:04:24 2018
From: psilva at redhat.com (Pedro Igor Silva)
Date: Tue, 6 Nov 2018 19:04:24 -0200
Subject: [keycloak-user] Data filtering in SQL
In-Reply-To: <5BCF31B569C0A2468D7904C8E5839D690104C368EF@DSKCMAIL1WC.ad.dstsystems.com>
References: <5BCF31B569C0A2468D7904C8E5839D690104C35356@DSKCMAIL1WC.ad.dstsystems.com>
	<1541136118.4390.1.camel@acutus.pro>
	<5BCF31B569C0A2468D7904C8E5839D690104C368EF@DSKCMAIL1WC.ad.dstsystems.com>
Message-ID: <CAJrcDBdtbsopdpsJ9jA5HHbrzyHHtPLLSX-L8hcfxpVuC9irww@mail.gmail.com>

This not among the use cases we are trying to solve with Keycloak
Authorization Services.

But looking at one of the examples from that article:

?Pet owners can access their own pet?s profiles.?
?Veterinarians can access pet profiles from devices at the clinic.?

You could have the same behavior if you API is designed in a way that you
can enforce access to individual resources, in that case, the "pets". You
can write policies saying that "Only Owner" can access
"/api/petclinic/pet/{id}", as well make sure "Only Veterinarians" can
access certain pets.

You could even delegate to pet owners complete control over the permissions
that govern access to information about their pets by using UMA.

Note that we are resource-based, so you are basically telling Keycloak the
resources you are protecting. Where they can represent the actual resource
(e.g.: Pet Foo) or a generic resource representing a set of one or more
resources (e.g.: Pet). What I mean is that you are not forced to create a
resource in Keycloak for every single resource you want to protect, but
just a single resource representing all resources you are protecting. Of
course, as long as they share the same access policies.

Regards.
Pedro Igor

On Tue, Nov 6, 2018 at 2:38 PM Byrd, Rob M <rmbyrd at dstsystems.com> wrote:

> (Hope this is the correct way to reply - let me know if not)
>
> Thanks.  So my concern is really with the whole idea that an Enterprise
> Application's security constraints could really be all implemented based on
> url-patterns, is that what you guys are thinking?
>
> For example, mostly a user can visit most features (urls) in an
> application, but it is the subset of things they can see/do within the
> feature that is the crux of the security issue - and it does not seem
> feasible to architect urls in such a way that they can be used as the key
> to security.  Thoughts?
>
> Thanks!
>
> Rob Byrd
> DST
> Solutions Lead
> SS&C Technologies Inc.   |   1055 Broadway, Kansas City, MO 64105
> t: (816) 435-7286  | m (816) 509-0119
> rmbyrd at dstsystems.com  |  www.ssctech.com
> Follow us:  |   |
>
> -----Original Message-----
> From: Dmitry Telegin [mailto:dt at acutus.pro]
> Sent: Friday, November 2, 2018 12:22 AM
> To: Byrd, Rob M <rmbyrd at dstsystems.com>; keycloak-user at lists.jboss.org
> Subject: Re: [keycloak-user] Data filtering in SQL
>
> Hello Rob,
>
> If I get it right, it's all about generating SQL WHERE clause from
> Keycloak policies? I think this is doable, as Keycloak has a well-defined
> object model for authorization policies, and it's easy to obtain policy
> definitions in JSON format. I think Pedro Igor will tell you more about
> that.
>
> You should pay attention to the following:
> - there are differences in semantics between OPA and Keycloak policies.
> For example, Keycloak policies do not operate HTTP methods but rather use
> more generic notion of scopes;
> - not every policy type can be easily converted to a WHERE clause. It
> should be trivial for User/Group/Role policies, but is virtually impossible
> for Script and Rules, as they are just blackboxes that evaluate to true or
> false. Unless of course your DBMS has a built-in JavaScript engine :)
>
> Good luck!
> Dmitry Telegin
> CTO, Acutus s.r.o.
> Keycloak Consulting and Training
>
> Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
> +42 (022) 888-30-71
> E-mail: info at acutus.pro
>
> On Thu, 2018-11-01 at 21:39 +0000, Byrd, Rob M wrote:
> > I am comparing OPA authorization to Keycloak - how could I enforce
> Keycloak policy in the SQL closest to the data for good performance,
> including returning subsets of lists?  OPA discusses this at
> https://blog.openpolicyagent.org/write-policy-in-opa-enforce-policy-in-sql-d9d24db93bf4
> .
> >
> > Thanks!
> >
> > Rob Byrd
> > DST
> > Solutions Lead
> > SS&C Technologies Inc.   |   1055 Broadway, Kansas City, MO 64105
> > t: (816) 435-7286  | m (816) 509-0119
> > rmbyrd at dstsystems.com<mailto:rmbyrd at dstsystems.com>  |  www.ssctech.com<
> http://www.ssctech.com/>;
> > > > Follow us: [cid:image001.png at 01D412C1.A14C5770] <
> https://www.linkedin.com/company/ss-c-technologies/
> >  |  [cid:image002.png at 01D412C1.A14C5770] <
> https://twitter.com/ssctechnologies
> >  |  [cid:image003.png at 01D412C1.A14C5770] <
> https://www.facebook.com/ssctechnologies/>
> >
> >
> >
> > Please consider the environment before printing this email and any
> attachments.
> >
> > This e-mail and any attachments are intended only for the individual or
> company to which it is addressed and may contain information which is
> privileged, confidential and prohibited from disclosure or unauthorized use
> under applicable law. If you are not the intended recipient of this e-mail,
> you are hereby notified that any use, dissemination, or copying of this
> e-mail or the information contained in this e-mail is strictly prohibited
> by the sender. If you have received this transmission in error, please
> return the material received to the sender and delete all copies from your
> system.
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
>
>
> Please consider the environment before printing this email and any
> attachments.
>
> This e-mail and any attachments are intended only for the individual or
> company to which it is addressed and may contain information which is
> privileged, confidential and prohibited from disclosure or unauthorized use
> under applicable law. If you are not the intended recipient of this e-mail,
> you are hereby notified that any use, dissemination, or copying of this
> e-mail or the information contained in this e-mail is strictly prohibited
> by the sender. If you have received this transmission in error, please
> return the material received to the sender and delete all copies from your
> system.
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From vramik at redhat.com  Tue Nov  6 18:02:00 2018
From: vramik at redhat.com (Vlasta Ramik)
Date: Wed, 7 Nov 2018 00:02:00 +0100
Subject: [keycloak-user] Error Being Thrown with MySql
In-Reply-To: <81FB9C4C-1758-4E6C-8656-5EB32A40DA8F@gmail.com>
References: <81FB9C4C-1758-4E6C-8656-5EB32A40DA8F@gmail.com>
Message-ID: <08363100-ac9a-15fe-dfa0-a3c61590ea4f@redhat.com>

Hello,

Can you check $JBOSS_HOME/standalone/configuration/standalone.xml if 
there is something like this

<datasource jndi-name="java:jboss/datasources/KeycloakDS" pool-name="KeycloakDS" enabled="true" use-java-context="true">

within datasources subsystem?


On 11/6/18 9:31 PM, Nathan McBride wrote:
> Hello everyone,
>
>   
>
> Thank you for taking the time to read this and trying to help me. I?m new to KeyCloak as well as JBOSS.
>
>   
>
> I created an AWS Lightsail account, the $5 / month plan, and am trying to use it for a KeyCloak server. I chose CentOS 7 as the operating system.
>
>   
>
> I have been following the guide located here: http://www.pimwiddershoven.nl/entry/install-keycloak-on-centos-7-with-mysql-backend
>
>   
>
> I have followed all the steps and am at the point where KeyCloak is supposed to be started. But when I start it, it errors and it looks like it is a problem with the mysql connection. However, I have tested the credentials both locally and connecting remote with DataGrip and I?m not really sure what I did wrong.
>
>   
>
> Any help is greatly appreciated.
>
>
> Thank you,
>
>
> Nate
>
>   
>
> Here are the errors:
>
>   
>
> 20:26:28,925 ERROR [org.jboss.msc.service.fail] (ServerService Thread Pool -- 56) MSC000001: Failed to start service jboss.undertow.deployment.default-server.default-host./auth: org.jboss.msc.service.StartException in service jboss.undertow.deployment.default-server.default-host./auth: java.lang.RuntimeException: RESTEASY003325: Failed to construct public org.keycloak.services.resources.KeycloakApplication(javax.servlet.ServletContext,org.jboss.resteasy.core.Dispatcher)
>
>  ??????????????? at org.wildfly.extension.undertow.deployment.UndertowDeploymentService$1.run(UndertowDeploymentService.java:81)
>
>  ??????????????? at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
>
>  ??????????????? at java.util.concurrent.FutureTask.run(FutureTask.java:266)
>
>  ??????????????? at org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35)
>
>  ??????????????? at org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1985)
>
>  ??????????????? at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1487)
>
>  ??????????????? at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1378)
>
>  ??????????????? at java.lang.Thread.run(Thread.java:748)
>
>  ??????????????? at org.jboss.threads.JBossThread.run(JBossThread.java:485)
>
> Caused by: java.lang.RuntimeException: RESTEASY003325: Failed to construct public org.keycloak.services.resources.KeycloakApplication(javax.servlet.ServletContext,org.jboss.resteasy.core.Dispatcher)
>
>  ??????????????? at org.jboss.resteasy.core.ConstructorInjectorImpl.construct(ConstructorInjectorImpl.java:162)
>
>  ??????????????? at org.jboss.resteasy.spi.ResteasyProviderFactory.createProviderInstance(ResteasyProviderFactory.java:2676)
>
>  ??????????????? at org.jboss.resteasy.spi.ResteasyDeployment.createApplication(ResteasyDeployment.java:361)
>
>  ??????????????? at org.jboss.resteasy.spi.ResteasyDeployment.startInternal(ResteasyDeployment.java:274)
>
>  ??????????????? at org.jboss.resteasy.spi.ResteasyDeployment.start(ResteasyDeployment.java:86)
>
>  ??????????????? at org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.init(ServletContainerDispatcher.java:119)
>
>  ??????????????? at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.init(HttpServletDispatcher.java:36)
>
>  ??????????????? at io.undertow.servlet.core.LifecyleInterceptorInvocation.proceed(LifecyleInterceptorInvocation.java:117)
>
>  ??????????????? at org.wildfly.extension.undertow.security.RunAsLifecycleInterceptor.init(RunAsLifecycleInterceptor.java:78)
>
>  ??????????????? at io.undertow.servlet.core.LifecyleInterceptorInvocation.proceed(LifecyleInterceptorInvocation.java:103)
>
>  ??????????????? at io.undertow.servlet.core.ManagedServlet$DefaultInstanceStrategy.start(ManagedServlet.java:300)
>
>  ??????????????? at io.undertow.servlet.core.ManagedServlet.createServlet(ManagedServlet.java:140)
>
>  ??????????????? at io.undertow.servlet.core.DeploymentManagerImpl$2.call(DeploymentManagerImpl.java:584)
>
>  ??????????????? at io.undertow.servlet.core.DeploymentManagerImpl$2.call(DeploymentManagerImpl.java:555)
>
>  ??????????????? at io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:42)
>
>  ??????????????? at io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43)
>
>  ??????????????? at org.wildfly.extension.undertow.security.SecurityContextThreadSetupAction.lambda$create$0(SecurityContextThreadSetupAction.java:105)
>
>  ??????????????? at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1514)
>
>  ??????????????? at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1514)
>
>  ??????????????? at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1514)
>
>  ??????????????? at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1514)
>
>  ??????????????? at io.undertow.servlet.core.DeploymentManagerImpl.start(DeploymentManagerImpl.java:597)
>
>  ??????????????? at org.wildfly.extension.undertow.deployment.UndertowDeploymentService.startContext(UndertowDeploymentService.java:97)
>
>  ??????????????? at org.wildfly.extension.undertow.deployment.UndertowDeploymentService$1.run(UndertowDeploymentService.java:78)
>
>  ??????????????? ... 8 more
>
> Caused by: java.lang.RuntimeException: Failed to connect to database
>
>  ??????????????? at org.keycloak.connections.jpa.DefaultJpaConnectionProviderFactory.getConnection(DefaultJpaConnectionProviderFactory.java:373)
>
>  ??????????????? at org.keycloak.connections.jpa.updater.liquibase.lock.LiquibaseDBLockProvider.lazyInit(LiquibaseDBLockProvider.java:65)
>
>  ??????????????? at org.keycloak.connections.jpa.updater.liquibase.lock.LiquibaseDBLockProvider.lambda$waitForLock$0(LiquibaseDBLockProvider.java:97)
>
>  ??????????????? at org.keycloak.models.utils.KeycloakModelUtils.suspendJtaTransaction(KeycloakModelUtils.java:611)
>
>  ??????????????? at org.keycloak.connections.jpa.updater.liquibase.lock.LiquibaseDBLockProvider.waitForLock(LiquibaseDBLockProvider.java:95)
>
>  ??????????????? at org.keycloak.services.resources.KeycloakApplication$1.run(KeycloakApplication.java:143)
>
>  ??????????????? at org.keycloak.models.utils.KeycloakModelUtils.runJobInTransaction(KeycloakModelUtils.java:227)
>
>  ??????????????? at org.keycloak.services.resources.KeycloakApplication.<init>(KeycloakApplication.java:136)
>
>  ??????????????? at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
>
>  ??????????????? at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
>
>  ??????????????? at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
>
>  ??????????????? at java.lang.reflect.Constructor.newInstance(Constructor.java:423)
>
>  ??????????????? at org.jboss.resteasy.core.ConstructorInjectorImpl.construct(ConstructorInjectorImpl.java:150)
>
>  ??????????????? ... 31 more
>
> Caused by: javax.naming.NameNotFoundException: datasources/KeycloakDS [Root exception is java.lang.IllegalStateException]
>
>  ??????????????? at org.jboss.as.naming.ServiceBasedNamingStore.lookup(ServiceBasedNamingStore.java:153)
>
>  ??????????????? at org.jboss.as.naming.ServiceBasedNamingStore.lookup(ServiceBasedNamingStore.java:83)
>
>  ??????????????? at org.jboss.as.naming.NamingContext.lookup(NamingContext.java:207)
>
>  ??????????????? at org.jboss.as.naming.NamingContext.lookup(NamingContext.java:184)
>
>  ??????????????? at org.jboss.as.naming.InitialContext$DefaultInitialContext.lookup(InitialContext.java:239)
>
>  ??????????????? at org.jboss.as.naming.NamingContext.lookup(NamingContext.java:193)
>
>  ??????????????? at org.jboss.as.naming.NamingContext.lookup(NamingContext.java:189)
>
>  ??????????????? at javax.naming.InitialContext.lookup(InitialContext.java:417)
>
>  ??????????????? at javax.naming.InitialContext.lookup(InitialContext.java:417)
>
>  ??????????????? at org.keycloak.connections.jpa.DefaultJpaConnectionProviderFactory.getConnection(DefaultJpaConnectionProviderFactory.java:366)
>
>  ??????????????? ... 43 more
>
> Caused by: java.lang.IllegalStateException
>
>  ??????????????? at org.jboss.msc.value.InjectedValue.getValue(InjectedValue.java:50)
>
>  ??????????????? at org.jboss.as.naming.service.BinderService.getValue(BinderService.java:148)
>
>  ??????????????? at org.jboss.as.naming.service.BinderService.getValue(BinderService.java:46)
>
>  ??????????????? at org.jboss.msc.service.ServiceControllerImpl.getValue(ServiceControllerImpl.java:1110)
>
>  ??????????????? at org.jboss.as.naming.ServiceBasedNamingStore.lookup(ServiceBasedNamingStore.java:131)
>
>  ??????????????? ... 52 more
>
>   
>
> 20:26:28,938 INFO? [org.jboss.as.server] (Thread-2) WFLYSRV0220: Server shutdown has been requested via an OS signal
>
> 20:26:28,953 INFO? [org.jboss.as.connector.deployers.jdbc] (MSC service thread 1-1) WFLYJCA0019: Stopped Driver service with driver-name = mysql
>
> 20:26:28,991 ERROR [org.jboss.as.controller.management-operation] (Controller Boot Thread) WFLYCTL0013: Operation ("add") failed - address: ([("deployment" => "keycloak-server.war")]) - failure description: {"WFLYCTL0080: Failed services" => {"jboss.undertow.deployment.default-server.default-host./auth" => "java.lang.RuntimeException: RESTEASY003325: Failed to construct public org.keycloak.services.resources.KeycloakApplication(javax.servlet.ServletContext,org.jboss.resteasy.core.Dispatcher)
>
>  ??? Caused by: java.lang.RuntimeException: RESTEASY003325: Failed to construct public org.keycloak.services.resources.KeycloakApplication(javax.servlet.ServletContext,org.jboss.resteasy.core.Dispatcher)
>
>  ??? Caused by: java.lang.RuntimeException: Failed to connect to database
>
>  ??? Caused by: javax.naming.NameNotFoundException: datasources/KeycloakDS [Root exception is java.lang.IllegalStateException]
>
>  ??? Caused by: java.lang.IllegalStateException"}}
>
> 20:26:29,011 INFO? [org.wildfly.extension.undertow] (MSC service thread 1-2) WFLYUT0008: Undertow HTTPS listener https suspending
>
> 20:26:29,014 INFO? [org.wildfly.extension.undertow] (MSC service thread 1-2) WFLYUT0007: Undertow HTTPS listener https stopped, was bound to 0.0.0.0:8443
>
> 20:26:29,017 INFO? [org.wildfly.extension.undertow] (MSC service thread 1-2) WFLYUT0019: Host default-host stopping
>
> 20:26:29,021 INFO? [org.jboss.as.connector.subsystems.datasources] (MSC service thread 1-2) WFLYJCA0010: Unbound data source [java:jboss/datasources/ExampleDS]
>
> 20:26:29,029 INFO? [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 54) WFLYCLINF0003: Stopped realms cache from keycloak container
>
> 20:26:29,030 INFO? [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 58) WFLYCLINF0003: Stopped offlineClientSessions cache from keycloak container
>
> 20:26:29,030 INFO? [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 50) WFLYCLINF0003: Stopped users cache from keycloak container
>
> 20:26:29,031 INFO? [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 57) WFLYCLINF0003: Stopped clientSessions cache from keycloak container
>
> 20:26:29,032 INFO? [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 48) WFLYCLINF0003: Stopped authenticationSessions cache from keycloak container
>
> 20:26:29,032 INFO? [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 46) WFLYCLINF0003: Stopped sessions cache from keycloak container
>
> 20:26:29,033 INFO? [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 47) WFLYCLINF0003: Stopped authorization cache from keycloak container
>
> 20:26:29,034 INFO? [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 51) WFLYCLINF0003: Stopped loginFailures cache from keycloak container
>
> 20:26:29,034 INFO? [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 52) WFLYCLINF0003: Stopped actionTokens cache from keycloak container
>
> 20:26:29,035 INFO? [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 55) WFLYCLINF0003: Stopped offlineSessions cache from keycloak container
>
> 20:26:29,038 INFO? [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 55) WFLYCLINF0003: Stopped keys cache from keycloak container
>
> 20:26:29,062 INFO? [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 59) WFLYCLINF0003: Stopped work cache from keycloak container
>
> 20:26:29,068 INFO? [org.jboss.as.connector.deployers.jdbc] (MSC service thread 1-2) WFLYJCA0019: Stopped Driver service with driver-name = h2
>
> 20:26:29,088 INFO? [org.wildfly.extension.undertow] (MSC service thread 1-2) WFLYUT0008: Undertow HTTP listener default suspending
>
> 20:26:29,089 INFO? [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 56) WFLYCLINF0003: Stopped client-mappings cache from ejb container
>
> 20:26:29,089 INFO? [org.wildfly.extension.undertow] (MSC service thread 1-2) WFLYUT0007: Undertow HTTP listener default stopped, was bound to 0.0.0.0:8080
>
> 20:26:29,091 INFO? [org.wildfly.extension.undertow] (MSC service thread 1-2) WFLYUT0004: Undertow 2.0.9.Final stopping
>
> 20:26:29,100 INFO? [org.jboss.as.clustering.infinispan] (MSC service thread 1-1) WFLYCLINF0003: Stopped authorizationRevisions cache from keycloak container
>
> 20:26:29,106 INFO? [org.jboss.as.clustering.infinispan] (MSC service thread 1-1) WFLYCLINF0003: Stopped realmRevisions cache from keycloak container
>
> 20:26:29,110 INFO? [org.jboss.as.clustering.infinispan] (MSC service thread 1-1) WFLYCLINF0003: Stopped userRevisions cache from keycloak container
>
> 20:26:29,111 INFO? [org.jboss.as.server.deployment] (MSC service thread 1-1) WFLYSRV0028: Stopped deployment keycloak-server.war (runtime-name: keycloak-server.war) in 170ms
>
> 20:26:29,149 INFO? [org.jboss.as.server] (ServerService Thread Pool -- 37) WFLYSRV0010: Deployed "keycloak-server.war" (runtime-name : "keycloak-server.war")
>
> 20:26:29,282 ERROR [org.jboss.as.server] (Controller Boot Thread) WFLYSRV0055: Caught exception during boot: java.lang.NullPointerException
>
>  ??????????????? at org.jboss.as.controller.AbstractControllerService.finishBoot(AbstractControllerService.java:534)
>
>  ??????????????? at org.jboss.as.server.ServerService.finishBoot(ServerService.java:418)
>
>  ??????????????? at org.jboss.as.server.ServerService.boot(ServerService.java:388)
>
>  ??????????????? at org.jboss.as.controller.AbstractControllerService$1.run(AbstractControllerService.java:372)
>
>  ??????????????? at java.lang.Thread.run(Thread.java:748)
>
>   
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From vramik at redhat.com  Tue Nov  6 18:24:04 2018
From: vramik at redhat.com (Vlasta Ramik)
Date: Wed, 7 Nov 2018 00:24:04 +0100
Subject: [keycloak-user] I need a Integrationtest example for keycloak
	4.5
In-Reply-To: <5BDF0BC3.4080309@patrick-hesse.de>
References: <5BDF0BC3.4080309@patrick-hesse.de>
Message-ID: <064a0019-3606-50d7-344c-028b51d01a25@redhat.com>

Hello Patrick,

you can find some information about arquillian tests here: 
https://github.com/keycloak/keycloak/tree/master/testsuite/integration-arquillian

On 11/4/18 4:09 PM, Patrick Hesse wrote:
> Hi all,
>
> i have her some sourcecode incl. IntegrationTests for a custom
> authenticator. This code was written by some other people. Now i must
> migrate this from Keycloak 3.0 to 4.5.
>
> I have migrated the authenticator, bute the migration for the
> IntegrationTests will not work.
>
> Where can i find a demo integrationTests with Arquillian.
>
> nice greetings
> Patrick Hesse
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From nomb85 at gmail.com  Tue Nov  6 18:38:06 2018
From: nomb85 at gmail.com (Nathan McBride)
Date: Tue, 06 Nov 2018 18:38:06 -0500
Subject: [keycloak-user] Error Being Thrown with MySql
In-Reply-To: <08363100-ac9a-15fe-dfa0-a3c61590ea4f@redhat.com>
References: <81FB9C4C-1758-4E6C-8656-5EB32A40DA8F@gmail.com>
	<08363100-ac9a-15fe-dfa0-a3c61590ea4f@redhat.com>
Message-ID: <7291B312-93AC-4AE5-99DB-4DA9E51D4A6B@gmail.com>

Yes there is. Here is the parts of my configuration that pertain to mysql.

I?m not worried about the passwords on here as it?s a lab box and will be changed anyway.

 

<subsystem xmlns="urn:jboss:domain:datasources:5.0">

??????????? <datasources>

??????????????? <datasource jndi-name="java:jboss/datasources/ExampleDS" pool-name="ExampleDS" enabled="true" use-java-context="true">

??????????????????? <connection-url>jdbc:h2:mem:test;DB_CLOSE_DELAY=-1;DB_CLOSE_ON_EXIT=FALSE</connection-url>

??????????????????? <driver>h2</driver>

??????????????????? <security>

? ??????????????????????<user-name>sa</user-name>

??????????????????????? <password>sa</password>

??????????????????? </security>

??????????????? </datasource>

??????????????? <datasource jndi-name="java:/jboss/datasources/KeycloakDS" pool-name="KeycloakDS" enabled="true" use-java-context="true">

??????????????????? <connection-url>jdbc:mysql://localhost:3306/keycloak?useSSL=false&amp;amp;useLegacyDatetimeCode=false&amp;amp;serverTimezone=Europe/Amsterdam&amp;amp;characterEncoding=UTF-8</connection-url>

??????????????????? <driver>org.mysql</driver>

??????????????????? <security>

??????????????????????? <user-name>keycloak</user-name>

??????????????????????? <password>38Je*T/kGk]hVEU;86D6{BPUx</password>

??????????????????? </security>

??????????????????? <validation>

??????????????????????? <valid-connection-checker class-name="org.jboss.jca.adapters.jdbc.extensions.mysql.MySQLValidConnectionChecker"/>

?????????? ?????????????<validate-on-match>true</validate-on-match>

??????????????????????? <exception-sorter class-name="org.jboss.jca.adapters.jdbc.extensions.mysql.MySQLValidConnectionChecker"/>

??????????????????? </validation>

??????????????? </datasource>

???? ???????????<drivers>

??????????????????? <driver name="h2" module="com.h2database.h2">

??????????????????????? <xa-datasource-class>org.h2.jdbcx.JdbcDataSource</xa-datasource-class>

??????????????????? </driver>

??????????????????? <driver name="mysql" module="org.mysql">

??????????????????????? <driver-class>com.mysql.jdbc.Driver</driver-class>

??????????????????? </driver>

??????????????? </drivers>

??????????? </datasources>

??????? </subsystem>

 

Thank you. 

 

Nate

 

From: Vlasta Ramik <vramik at redhat.com>
Date: Tuesday, November 6, 2018 at 6:02 PM
To: Nathan McBride <nomb85 at gmail.com>
Cc: <keycloak-user at lists.jboss.org>
Subject: Re: [keycloak-user] Error Being Thrown with MySql

 

Hello, 

Can you check $JBOSS_HOME/standalone/configuration/standalone.xml if there is something like this 
<datasource jndi-name="java:jboss/datasources/KeycloakDS" pool-name="KeycloakDS" enabled="true" use-java-context="true"> 
within datasources subsystem?

 

On 11/6/18 9:31 PM, Nathan McBride wrote:
Hello everyone,
 
 
 
Thank you for taking the time to read this and trying to help me. I?m new to KeyCloak as well as JBOSS.
 
 
 
I created an AWS Lightsail account, the $5 / month plan, and am trying to use it for a KeyCloak server. I chose CentOS 7 as the operating system.
 
 
 
I have been following the guide located here: http://www.pimwiddershoven.nl/entry/install-keycloak-on-centos-7-with-mysql-backend
 
 
 
I have followed all the steps and am at the point where KeyCloak is supposed to be started. But when I start it, it errors and it looks like it is a problem with the mysql connection. However, I have tested the credentials both locally and connecting remote with DataGrip and I?m not really sure what I did wrong.
 
 
 
Any help is greatly appreciated.
 
 
Thank you,
 
 
Nate
 
 
 
Here are the errors:
 
 
 
20:26:28,925 ERROR [org.jboss.msc.service.fail] (ServerService Thread Pool -- 56) MSC000001: Failed to start service jboss.undertow.deployment.default-server.default-host./auth: org.jboss.msc.service.StartException in service jboss.undertow.deployment.default-server.default-host./auth: java.lang.RuntimeException: RESTEASY003325: Failed to construct public org.keycloak.services.resources.KeycloakApplication(javax.servlet.ServletContext,org.jboss.resteasy.core.Dispatcher)
 
                at org.wildfly.extension.undertow.deployment.UndertowDeploymentService$1.run(UndertowDeploymentService.java:81)
 
                at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
 
                at java.util.concurrent.FutureTask.run(FutureTask.java:266)
 
                at org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35)
 
                at org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1985)
 
                at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1487)
 
                at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1378)
 
                at java.lang.Thread.run(Thread.java:748)
 
                at org.jboss.threads.JBossThread.run(JBossThread.java:485)
 
Caused by: java.lang.RuntimeException: RESTEASY003325: Failed to construct public org.keycloak.services.resources.KeycloakApplication(javax.servlet.ServletContext,org.jboss.resteasy.core.Dispatcher)
 
                at org.jboss.resteasy.core.ConstructorInjectorImpl.construct(ConstructorInjectorImpl.java:162)
 
                at org.jboss.resteasy.spi.ResteasyProviderFactory.createProviderInstance(ResteasyProviderFactory.java:2676)
 
                at org.jboss.resteasy.spi.ResteasyDeployment.createApplication(ResteasyDeployment.java:361)
 
                at org.jboss.resteasy.spi.ResteasyDeployment.startInternal(ResteasyDeployment.java:274)
 
                at org.jboss.resteasy.spi.ResteasyDeployment.start(ResteasyDeployment.java:86)
 
                at org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.init(ServletContainerDispatcher.java:119)
 
                at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.init(HttpServletDispatcher.java:36)
 
                at io.undertow.servlet.core.LifecyleInterceptorInvocation.proceed(LifecyleInterceptorInvocation.java:117)
 
                at org.wildfly.extension.undertow.security.RunAsLifecycleInterceptor.init(RunAsLifecycleInterceptor.java:78)
 
                at io.undertow.servlet.core.LifecyleInterceptorInvocation.proceed(LifecyleInterceptorInvocation.java:103)
 
                at io.undertow.servlet.core.ManagedServlet$DefaultInstanceStrategy.start(ManagedServlet.java:300)
 
                at io.undertow.servlet.core.ManagedServlet.createServlet(ManagedServlet.java:140)
 
                at io.undertow.servlet.core.DeploymentManagerImpl$2.call(DeploymentManagerImpl.java:584)
 
                at io.undertow.servlet.core.DeploymentManagerImpl$2.call(DeploymentManagerImpl.java:555)
 
                at io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:42)
 
                at io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43)
 
                at org.wildfly.extension.undertow.security.SecurityContextThreadSetupAction.lambda$create$0(SecurityContextThreadSetupAction.java:105)
 
                at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1514)
 
                at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1514)
 
                at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1514)
 
                at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1514)
 
                at io.undertow.servlet.core.DeploymentManagerImpl.start(DeploymentManagerImpl.java:597)
 
                at org.wildfly.extension.undertow.deployment.UndertowDeploymentService.startContext(UndertowDeploymentService.java:97)
 
                at org.wildfly.extension.undertow.deployment.UndertowDeploymentService$1.run(UndertowDeploymentService.java:78)
 
                ... 8 more
 
Caused by: java.lang.RuntimeException: Failed to connect to database
 
                at org.keycloak.connections.jpa.DefaultJpaConnectionProviderFactory.getConnection(DefaultJpaConnectionProviderFactory.java:373)
 
                at org.keycloak.connections.jpa.updater.liquibase.lock.LiquibaseDBLockProvider.lazyInit(LiquibaseDBLockProvider.java:65)
 
                at org.keycloak.connections.jpa.updater.liquibase.lock.LiquibaseDBLockProvider.lambda$waitForLock$0(LiquibaseDBLockProvider.java:97)
 
                at org.keycloak.models.utils.KeycloakModelUtils.suspendJtaTransaction(KeycloakModelUtils.java:611)
 
                at org.keycloak.connections.jpa.updater.liquibase.lock.LiquibaseDBLockProvider.waitForLock(LiquibaseDBLockProvider.java:95)
 
                at org.keycloak.services.resources.KeycloakApplication$1.run(KeycloakApplication.java:143)
 
                at org.keycloak.models.utils.KeycloakModelUtils.runJobInTransaction(KeycloakModelUtils.java:227)
 
                at org.keycloak.services.resources.KeycloakApplication.<init>(KeycloakApplication.java:136)
 
                at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
 
                at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
 
                at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
 
                at java.lang.reflect.Constructor.newInstance(Constructor.java:423)
 
                at org.jboss.resteasy.core.ConstructorInjectorImpl.construct(ConstructorInjectorImpl.java:150)
 
                ... 31 more
 
Caused by: javax.naming.NameNotFoundException: datasources/KeycloakDS [Root exception is java.lang.IllegalStateException]
 
                at org.jboss.as.naming.ServiceBasedNamingStore.lookup(ServiceBasedNamingStore.java:153)
 
                at org.jboss.as.naming.ServiceBasedNamingStore.lookup(ServiceBasedNamingStore.java:83)
 
                at org.jboss.as.naming.NamingContext.lookup(NamingContext.java:207)
 
                at org.jboss.as.naming.NamingContext.lookup(NamingContext.java:184)
 
                at org.jboss.as.naming.InitialContext$DefaultInitialContext.lookup(InitialContext.java:239)
 
                at org.jboss.as.naming.NamingContext.lookup(NamingContext.java:193)
 
                at org.jboss.as.naming.NamingContext.lookup(NamingContext.java:189)
 
                at javax.naming.InitialContext.lookup(InitialContext.java:417)
 
                at javax.naming.InitialContext.lookup(InitialContext.java:417)
 
                at org.keycloak.connections.jpa.DefaultJpaConnectionProviderFactory.getConnection(DefaultJpaConnectionProviderFactory.java:366)
 
                ... 43 more
 
Caused by: java.lang.IllegalStateException
 
                at org.jboss.msc.value.InjectedValue.getValue(InjectedValue.java:50)
 
                at org.jboss.as.naming.service.BinderService.getValue(BinderService.java:148)
 
                at org.jboss.as.naming.service.BinderService.getValue(BinderService.java:46)
 
                at org.jboss.msc.service.ServiceControllerImpl.getValue(ServiceControllerImpl.java:1110)
 
                at org.jboss.as.naming.ServiceBasedNamingStore.lookup(ServiceBasedNamingStore.java:131)
 
                ... 52 more
 
 
 
20:26:28,938 INFO  [org.jboss.as.server] (Thread-2) WFLYSRV0220: Server shutdown has been requested via an OS signal
 
20:26:28,953 INFO  [org.jboss.as.connector.deployers.jdbc] (MSC service thread 1-1) WFLYJCA0019: Stopped Driver service with driver-name = mysql
 
20:26:28,991 ERROR [org.jboss.as.controller.management-operation] (Controller Boot Thread) WFLYCTL0013: Operation ("add") failed - address: ([("deployment" => "keycloak-server.war")]) - failure description: {"WFLYCTL0080: Failed services" => {"jboss.undertow.deployment.default-server.default-host./auth" => "java.lang.RuntimeException: RESTEASY003325: Failed to construct public org.keycloak.services.resources.KeycloakApplication(javax.servlet.ServletContext,org.jboss.resteasy.core.Dispatcher)
 
    Caused by: java.lang.RuntimeException: RESTEASY003325: Failed to construct public org.keycloak.services.resources.KeycloakApplication(javax.servlet.ServletContext,org.jboss.resteasy.core.Dispatcher)
 
    Caused by: java.lang.RuntimeException: Failed to connect to database
 
    Caused by: javax.naming.NameNotFoundException: datasources/KeycloakDS [Root exception is java.lang.IllegalStateException]
 
    Caused by: java.lang.IllegalStateException"}}
 
20:26:29,011 INFO  [org.wildfly.extension.undertow] (MSC service thread 1-2) WFLYUT0008: Undertow HTTPS listener https suspending
 
20:26:29,014 INFO  [org.wildfly.extension.undertow] (MSC service thread 1-2) WFLYUT0007: Undertow HTTPS listener https stopped, was bound to 0.0.0.0:8443
 
20:26:29,017 INFO  [org.wildfly.extension.undertow] (MSC service thread 1-2) WFLYUT0019: Host default-host stopping
 
20:26:29,021 INFO  [org.jboss.as.connector.subsystems.datasources] (MSC service thread 1-2) WFLYJCA0010: Unbound data source [java:jboss/datasources/ExampleDS]
 
20:26:29,029 INFO  [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 54) WFLYCLINF0003: Stopped realms cache from keycloak container
 
20:26:29,030 INFO  [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 58) WFLYCLINF0003: Stopped offlineClientSessions cache from keycloak container
 
20:26:29,030 INFO  [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 50) WFLYCLINF0003: Stopped users cache from keycloak container
 
20:26:29,031 INFO  [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 57) WFLYCLINF0003: Stopped clientSessions cache from keycloak container
 
20:26:29,032 INFO  [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 48) WFLYCLINF0003: Stopped authenticationSessions cache from keycloak container
 
20:26:29,032 INFO  [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 46) WFLYCLINF0003: Stopped sessions cache from keycloak container
 
20:26:29,033 INFO  [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 47) WFLYCLINF0003: Stopped authorization cache from keycloak container
 
20:26:29,034 INFO  [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 51) WFLYCLINF0003: Stopped loginFailures cache from keycloak container
 
20:26:29,034 INFO  [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 52) WFLYCLINF0003: Stopped actionTokens cache from keycloak container
 
20:26:29,035 INFO  [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 55) WFLYCLINF0003: Stopped offlineSessions cache from keycloak container
 
20:26:29,038 INFO  [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 55) WFLYCLINF0003: Stopped keys cache from keycloak container
 
20:26:29,062 INFO  [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 59) WFLYCLINF0003: Stopped work cache from keycloak container
 
20:26:29,068 INFO  [org.jboss.as.connector.deployers.jdbc] (MSC service thread 1-2) WFLYJCA0019: Stopped Driver service with driver-name = h2
 
20:26:29,088 INFO  [org.wildfly.extension.undertow] (MSC service thread 1-2) WFLYUT0008: Undertow HTTP listener default suspending
 
20:26:29,089 INFO  [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 56) WFLYCLINF0003: Stopped client-mappings cache from ejb container
 
20:26:29,089 INFO  [org.wildfly.extension.undertow] (MSC service thread 1-2) WFLYUT0007: Undertow HTTP listener default stopped, was bound to 0.0.0.0:8080
 
20:26:29,091 INFO  [org.wildfly.extension.undertow] (MSC service thread 1-2) WFLYUT0004: Undertow 2.0.9.Final stopping
 
20:26:29,100 INFO  [org.jboss.as.clustering.infinispan] (MSC service thread 1-1) WFLYCLINF0003: Stopped authorizationRevisions cache from keycloak container
 
20:26:29,106 INFO  [org.jboss.as.clustering.infinispan] (MSC service thread 1-1) WFLYCLINF0003: Stopped realmRevisions cache from keycloak container
 
20:26:29,110 INFO  [org.jboss.as.clustering.infinispan] (MSC service thread 1-1) WFLYCLINF0003: Stopped userRevisions cache from keycloak container
 
20:26:29,111 INFO  [org.jboss.as.server.deployment] (MSC service thread 1-1) WFLYSRV0028: Stopped deployment keycloak-server.war (runtime-name: keycloak-server.war) in 170ms
 
20:26:29,149 INFO  [org.jboss.as.server] (ServerService Thread Pool -- 37) WFLYSRV0010: Deployed "keycloak-server.war" (runtime-name : "keycloak-server.war")
 
20:26:29,282 ERROR [org.jboss.as.server] (Controller Boot Thread) WFLYSRV0055: Caught exception during boot: java.lang.NullPointerException
 
                at org.jboss.as.controller.AbstractControllerService.finishBoot(AbstractControllerService.java:534)
 
                at org.jboss.as.server.ServerService.finishBoot(ServerService.java:418)
 
                at org.jboss.as.server.ServerService.boot(ServerService.java:388)
 
                at org.jboss.as.controller.AbstractControllerService$1.run(AbstractControllerService.java:372)
 
                at java.lang.Thread.run(Thread.java:748)
 
 
 
_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user


From vramik at redhat.com  Tue Nov  6 18:41:54 2018
From: vramik at redhat.com (Vlasta Ramik)
Date: Wed, 7 Nov 2018 00:41:54 +0100
Subject: [keycloak-user] Error Being Thrown with MySql
In-Reply-To: <7291B312-93AC-4AE5-99DB-4DA9E51D4A6B@gmail.com>
References: <81FB9C4C-1758-4E6C-8656-5EB32A40DA8F@gmail.com>
	<08363100-ac9a-15fe-dfa0-a3c61590ea4f@redhat.com>
	<7291B312-93AC-4AE5-99DB-4DA9E51D4A6B@gmail.com>
Message-ID: <df046eb7-f24c-095d-2722-d785b28ad4e5@redhat.com>

The issue might be in driver definition. Can you check that, please? See 
inline.

On 11/7/18 12:38 AM, Nathan McBride wrote:
>
> Yes there is. Here is the parts of my configuration that pertain to mysql.
>
> I?m not worried about the passwords on here as it?s a lab box and will 
> be changed anyway.
>
> <subsystem xmlns="urn:jboss:domain:datasources:5.0">
>
> ??????????? <datasources>
>
> ??????????????? <datasource 
> jndi-name="java:jboss/datasources/ExampleDS" pool-name="ExampleDS" 
> enabled="true" use-java-context="true">
>
> <connection-url>jdbc:h2:mem:test;DB_CLOSE_DELAY=-1;DB_CLOSE_ON_EXIT=FALSE</connection-url>
>
> <driver>h2</driver>
>
> ??????????????????? <security>
>
> ??????????????????????<user-name>sa</user-name>
>
> <password>sa</password>
>
> ??????????????????? </security>
>
> ??????????????? </datasource>
>
> ??????????????? <datasource 
> jndi-name="java:/jboss/datasources/KeycloakDS" pool-name="KeycloakDS" 
> enabled="true" use-java-context="true">
>
> <connection-url>jdbc:mysql://localhost:3306/keycloak?useSSL=false&amp;amp;useLegacyDatetimeCode=false&amp;amp;serverTimezone=Europe/Amsterdam&amp;amp;characterEncoding=UTF-8</connection-url>
>
> <driver>org.mysql</driver>
>
driver should be "mysql", not "org.mysql", it refers to driver name 
attribute below
>
> ??????????????????? <security>
>
> <user-name>keycloak</user-name>
>
> <password>38Je*T/kGk]hVEU;86D6{BPUx</password>
>
> ??????????????????? </security>
>
> ??????????????????? <validation>
>
> <valid-connection-checker 
> class-name="org.jboss.jca.adapters.jdbc.extensions.mysql.MySQLValidConnectionChecker"/>
>
> ?????????????<validate-on-match>true</validate-on-match>
>
> <exception-sorter 
> class-name="org.jboss.jca.adapters.jdbc.extensions.mysql.MySQLValidConnectionChecker"/>
>
> ??????????????????? </validation>
>
> ??????????????? </datasource>
>
> ???? ???????????<drivers>
>
> ??????????????????? <driver name="h2" module="com.h2database.h2">
>
> <xa-datasource-class>org.h2.jdbcx.JdbcDataSource</xa-datasource-class>
>
> ??????????????????? </driver>
>
> ??????????????????? <driver name="mysql" module="org.mysql">
>
> <driver-class>com.mysql.jdbc.Driver</driver-class>
>
> ??????????????????? </driver>
>
> ??????????????? </drivers>
>
> ??????????? </datasources>
>
> ??????? </subsystem>
>
> Thank you.
>
> Nate
>
> *From: *Vlasta Ramik <vramik at redhat.com>
> *Date: *Tuesday, November 6, 2018 at 6:02 PM
> *To: *Nathan McBride <nomb85 at gmail.com>
> *Cc: *<keycloak-user at lists.jboss.org>
> *Subject: *Re: [keycloak-user] Error Being Thrown with MySql
>
> Hello,
>
> Can you check $JBOSS_HOME/standalone/configuration/standalone.xml if 
> there is something like this
>
> <datasource jndi-name="java:jboss/datasources/KeycloakDS" pool-name="KeycloakDS" enabled="true" use-java-context="true">
>
> within datasources subsystem?
>
> On 11/6/18 9:31 PM, Nathan McBride wrote:
>
>     Hello everyone,
>
>       
>
>     Thank you for taking the time to read this and trying to help me. I?m new to KeyCloak as well as JBOSS.
>
>       
>
>     I created an AWS Lightsail account, the $5 / month plan, and am trying to use it for a KeyCloak server. I chose CentOS 7 as the operating system.
>
>       
>
>     I have been following the guide located here:http://www.pimwiddershoven.nl/entry/install-keycloak-on-centos-7-with-mysql-backend
>
>       
>
>     I have followed all the steps and am at the point where KeyCloak is supposed to be started. But when I start it, it errors and it looks like it is a problem with the mysql connection. However, I have tested the credentials both locally and connecting remote with DataGrip and I?m not really sure what I did wrong.
>
>       
>
>     Any help is greatly appreciated.
>
>     Thank you,
>
>     Nate
>
>       
>
>     Here are the errors:
>
>       
>
>     20:26:28,925 ERROR [org.jboss.msc.service.fail] (ServerService Thread Pool -- 56) MSC000001: Failed to start service jboss.undertow.deployment.default-server.default-host./auth: org.jboss.msc.service.StartException in service jboss.undertow.deployment.default-server.default-host./auth: java.lang.RuntimeException: RESTEASY003325: Failed to construct public org.keycloak.services.resources.KeycloakApplication(javax.servlet.ServletContext,org.jboss.resteasy.core.Dispatcher)
>
>      ??????????????? at org.wildfly.extension.undertow.deployment.UndertowDeploymentService$1.run(UndertowDeploymentService.java:81)
>
>      ??????????????? at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
>
>      ??????????????? at java.util.concurrent.FutureTask.run(FutureTask.java:266)
>
>      ??????????????? at org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35)
>
>      ??????????????? at org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1985)
>
>      ??????????????? at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1487)
>
>      ??????????????? at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1378)
>
>      ??????????????? at java.lang.Thread.run(Thread.java:748)
>
>      ??????????????? at org.jboss.threads.JBossThread.run(JBossThread.java:485)
>
>     Caused by: java.lang.RuntimeException: RESTEASY003325: Failed to construct public org.keycloak.services.resources.KeycloakApplication(javax.servlet.ServletContext,org.jboss.resteasy.core.Dispatcher)
>
>      ??????????????? at org.jboss.resteasy.core.ConstructorInjectorImpl.construct(ConstructorInjectorImpl.java:162)
>
>      ??????????????? at org.jboss.resteasy.spi.ResteasyProviderFactory.createProviderInstance(ResteasyProviderFactory.java:2676)
>
>      ??????????????? at org.jboss.resteasy.spi.ResteasyDeployment.createApplication(ResteasyDeployment.java:361)
>
>      ??????????????? at org.jboss.resteasy.spi.ResteasyDeployment.startInternal(ResteasyDeployment.java:274)
>
>      ??????????????? at org.jboss.resteasy.spi.ResteasyDeployment.start(ResteasyDeployment.java:86)
>
>      ??????????????? at org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.init(ServletContainerDispatcher.java:119)
>
>      ??????????????? at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.init(HttpServletDispatcher.java:36)
>
>      ??????????????? at io.undertow.servlet.core.LifecyleInterceptorInvocation.proceed(LifecyleInterceptorInvocation.java:117)
>
>      ??????????????? at org.wildfly.extension.undertow.security.RunAsLifecycleInterceptor.init(RunAsLifecycleInterceptor.java:78)
>
>      ??????????????? at io.undertow.servlet.core.LifecyleInterceptorInvocation.proceed(LifecyleInterceptorInvocation.java:103)
>
>      ??????????????? at io.undertow.servlet.core.ManagedServlet$DefaultInstanceStrategy.start(ManagedServlet.java:300)
>
>      ??????????????? at io.undertow.servlet.core.ManagedServlet.createServlet(ManagedServlet.java:140)
>
>      ??????????????? at io.undertow.servlet.core.DeploymentManagerImpl$2.call(DeploymentManagerImpl.java:584)
>
>      ??????????????? at io.undertow.servlet.core.DeploymentManagerImpl$2.call(DeploymentManagerImpl.java:555)
>
>      ??????????????? at io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:42)
>
>      ??????????????? at io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43)
>
>      ??????????????? at org.wildfly.extension.undertow.security.SecurityContextThreadSetupAction.lambda$create$0(SecurityContextThreadSetupAction.java:105)
>
>      ??????????????? at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1514)
>
>      ??????????????? at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1514)
>
>      ??????????????? at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1514)
>
>      ??????????????? at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1514)
>
>      ??????????????? at io.undertow.servlet.core.DeploymentManagerImpl.start(DeploymentManagerImpl.java:597)
>
>      ??????????????? at org.wildfly.extension.undertow.deployment.UndertowDeploymentService.startContext(UndertowDeploymentService.java:97)
>
>      ??????????????? at org.wildfly.extension.undertow.deployment.UndertowDeploymentService$1.run(UndertowDeploymentService.java:78)
>
>      ??????????????? ... 8 more
>
>     Caused by: java.lang.RuntimeException: Failed to connect to database
>
>      ??????????????? at org.keycloak.connections.jpa.DefaultJpaConnectionProviderFactory.getConnection(DefaultJpaConnectionProviderFactory.java:373)
>
>      ??????????????? at org.keycloak.connections.jpa.updater.liquibase.lock.LiquibaseDBLockProvider.lazyInit(LiquibaseDBLockProvider.java:65)
>
>      ??????????????? at org.keycloak.connections.jpa.updater.liquibase.lock.LiquibaseDBLockProvider.lambda$waitForLock$0(LiquibaseDBLockProvider.java:97)
>
>      ??????????????? at org.keycloak.models.utils.KeycloakModelUtils.suspendJtaTransaction(KeycloakModelUtils.java:611)
>
>      ??????????????? at org.keycloak.connections.jpa.updater.liquibase.lock.LiquibaseDBLockProvider.waitForLock(LiquibaseDBLockProvider.java:95)
>
>      ??????????????? at org.keycloak.services.resources.KeycloakApplication$1.run(KeycloakApplication.java:143)
>
>      ??????????????? at org.keycloak.models.utils.KeycloakModelUtils.runJobInTransaction(KeycloakModelUtils.java:227)
>
>      ??????????????? at org.keycloak.services.resources.KeycloakApplication.<init>(KeycloakApplication.java:136)
>
>      ??????????????? at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
>
>      ??????????????? at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
>
>      ??????????????? at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
>
>      ??????????????? at java.lang.reflect.Constructor.newInstance(Constructor.java:423)
>
>      ??????????????? at org.jboss.resteasy.core.ConstructorInjectorImpl.construct(ConstructorInjectorImpl.java:150)
>
>      ??????????????? ... 31 more
>
>     Caused by: javax.naming.NameNotFoundException: datasources/KeycloakDS [Root exception is java.lang.IllegalStateException]
>
>      ??????????????? at org.jboss.as.naming.ServiceBasedNamingStore.lookup(ServiceBasedNamingStore.java:153)
>
>      ??????????????? at org.jboss.as.naming.ServiceBasedNamingStore.lookup(ServiceBasedNamingStore.java:83)
>
>      ??????????????? at org.jboss.as.naming.NamingContext.lookup(NamingContext.java:207)
>
>      ??????????????? at org.jboss.as.naming.NamingContext.lookup(NamingContext.java:184)
>
>      ??????????????? at org.jboss.as.naming.InitialContext$DefaultInitialContext.lookup(InitialContext.java:239)
>
>      ??????????????? at org.jboss.as.naming.NamingContext.lookup(NamingContext.java:193)
>
>      ??????????????? at org.jboss.as.naming.NamingContext.lookup(NamingContext.java:189)
>
>      ??????????????? at javax.naming.InitialContext.lookup(InitialContext.java:417)
>
>      ??????????????? at javax.naming.InitialContext.lookup(InitialContext.java:417)
>
>      ??????????????? at org.keycloak.connections.jpa.DefaultJpaConnectionProviderFactory.getConnection(DefaultJpaConnectionProviderFactory.java:366)
>
>      ??????????????? ... 43 more
>
>     Caused by: java.lang.IllegalStateException
>
>      ??????????????? at org.jboss.msc.value.InjectedValue.getValue(InjectedValue.java:50)
>
>      ??????????????? at org.jboss.as.naming.service.BinderService.getValue(BinderService.java:148)
>
>      ??????????????? at org.jboss.as.naming.service.BinderService.getValue(BinderService.java:46)
>
>      ??????????????? at org.jboss.msc.service.ServiceControllerImpl.getValue(ServiceControllerImpl.java:1110)
>
>      ??????????????? at org.jboss.as.naming.ServiceBasedNamingStore.lookup(ServiceBasedNamingStore.java:131)
>
>      ??????????????? ... 52 more
>
>       
>
>     20:26:28,938 INFO? [org.jboss.as.server] (Thread-2) WFLYSRV0220: Server shutdown has been requested via an OS signal
>
>     20:26:28,953 INFO? [org.jboss.as.connector.deployers.jdbc] (MSC service thread 1-1) WFLYJCA0019: Stopped Driver service with driver-name = mysql
>
>     20:26:28,991 ERROR [org.jboss.as.controller.management-operation] (Controller Boot Thread) WFLYCTL0013: Operation ("add") failed - address: ([("deployment" => "keycloak-server.war")]) - failure description: {"WFLYCTL0080: Failed services" => {"jboss.undertow.deployment.default-server.default-host./auth" => "java.lang.RuntimeException: RESTEASY003325: Failed to construct public org.keycloak.services.resources.KeycloakApplication(javax.servlet.ServletContext,org.jboss.resteasy.core.Dispatcher)
>
>      ??? Caused by: java.lang.RuntimeException: RESTEASY003325: Failed to construct public org.keycloak.services.resources.KeycloakApplication(javax.servlet.ServletContext,org.jboss.resteasy.core.Dispatcher)
>
>      ??? Caused by: java.lang.RuntimeException: Failed to connect to database
>
>      ??? Caused by: javax.naming.NameNotFoundException: datasources/KeycloakDS [Root exception is java.lang.IllegalStateException]
>
>      ??? Caused by: java.lang.IllegalStateException"}}
>
>     20:26:29,011 INFO? [org.wildfly.extension.undertow] (MSC service thread 1-2) WFLYUT0008: Undertow HTTPS listener https suspending
>
>     20:26:29,014 INFO? [org.wildfly.extension.undertow] (MSC service thread 1-2) WFLYUT0007: Undertow HTTPS listener https stopped, was bound to 0.0.0.0:8443
>
>     20:26:29,017 INFO? [org.wildfly.extension.undertow] (MSC service thread 1-2) WFLYUT0019: Host default-host stopping
>
>     20:26:29,021 INFO? [org.jboss.as.connector.subsystems.datasources] (MSC service thread 1-2) WFLYJCA0010: Unbound data source [java:jboss/datasources/ExampleDS]
>
>     20:26:29,029 INFO? [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 54) WFLYCLINF0003: Stopped realms cache from keycloak container
>
>     20:26:29,030 INFO? [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 58) WFLYCLINF0003: Stopped offlineClientSessions cache from keycloak container
>
>     20:26:29,030 INFO? [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 50) WFLYCLINF0003: Stopped users cache from keycloak container
>
>     20:26:29,031 INFO? [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 57) WFLYCLINF0003: Stopped clientSessions cache from keycloak container
>
>     20:26:29,032 INFO? [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 48) WFLYCLINF0003: Stopped authenticationSessions cache from keycloak container
>
>     20:26:29,032 INFO? [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 46) WFLYCLINF0003: Stopped sessions cache from keycloak container
>
>     20:26:29,033 INFO? [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 47) WFLYCLINF0003: Stopped authorization cache from keycloak container
>
>     20:26:29,034 INFO? [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 51) WFLYCLINF0003: Stopped loginFailures cache from keycloak container
>
>     20:26:29,034 INFO? [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 52) WFLYCLINF0003: Stopped actionTokens cache from keycloak container
>
>     20:26:29,035 INFO? [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 55) WFLYCLINF0003: Stopped offlineSessions cache from keycloak container
>
>     20:26:29,038 INFO? [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 55) WFLYCLINF0003: Stopped keys cache from keycloak container
>
>     20:26:29,062 INFO? [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 59) WFLYCLINF0003: Stopped work cache from keycloak container
>
>     20:26:29,068 INFO? [org.jboss.as.connector.deployers.jdbc] (MSC service thread 1-2) WFLYJCA0019: Stopped Driver service with driver-name = h2
>
>     20:26:29,088 INFO? [org.wildfly.extension.undertow] (MSC service thread 1-2) WFLYUT0008: Undertow HTTP listener default suspending
>
>     20:26:29,089 INFO? [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 56) WFLYCLINF0003: Stopped client-mappings cache from ejb container
>
>     20:26:29,089 INFO? [org.wildfly.extension.undertow] (MSC service thread 1-2) WFLYUT0007: Undertow HTTP listener default stopped, was bound to 0.0.0.0:8080
>
>     20:26:29,091 INFO? [org.wildfly.extension.undertow] (MSC service thread 1-2) WFLYUT0004: Undertow 2.0.9.Final stopping
>
>     20:26:29,100 INFO? [org.jboss.as.clustering.infinispan] (MSC service thread 1-1) WFLYCLINF0003: Stopped authorizationRevisions cache from keycloak container
>
>     20:26:29,106 INFO? [org.jboss.as.clustering.infinispan] (MSC service thread 1-1) WFLYCLINF0003: Stopped realmRevisions cache from keycloak container
>
>     20:26:29,110 INFO? [org.jboss.as.clustering.infinispan] (MSC service thread 1-1) WFLYCLINF0003: Stopped userRevisions cache from keycloak container
>
>     20:26:29,111 INFO? [org.jboss.as.server.deployment] (MSC service thread 1-1) WFLYSRV0028: Stopped deployment keycloak-server.war (runtime-name: keycloak-server.war) in 170ms
>
>     20:26:29,149 INFO? [org.jboss.as.server] (ServerService Thread Pool -- 37) WFLYSRV0010: Deployed "keycloak-server.war" (runtime-name : "keycloak-server.war")
>
>     20:26:29,282 ERROR [org.jboss.as.server] (Controller Boot Thread) WFLYSRV0055: Caught exception during boot: java.lang.NullPointerException
>
>      ??????????????? at org.jboss.as.controller.AbstractControllerService.finishBoot(AbstractControllerService.java:534)
>
>      ??????????????? at org.jboss.as.server.ServerService.finishBoot(ServerService.java:418)
>
>      ??????????????? at org.jboss.as.server.ServerService.boot(ServerService.java:388)
>
>      ??????????????? at org.jboss.as.controller.AbstractControllerService$1.run(AbstractControllerService.java:372)
>
>      ??????????????? at java.lang.Thread.run(Thread.java:748)
>
>       
>
>     _______________________________________________
>
>     keycloak-user mailing list
>
>     keycloak-user at lists.jboss.org  <mailto:keycloak-user at lists.jboss.org>
>
>     https://lists.jboss.org/mailman/listinfo/keycloak-user
>

From robstyle1234 at gmail.com  Wed Nov  7 03:23:20 2018
From: robstyle1234 at gmail.com (ola rob)
Date: Wed, 7 Nov 2018 13:53:20 +0530
Subject: [keycloak-user] How can I use Keycloak to support my architecture?
Message-ID: <CAN7vkfgmADkTH9Z008WaCSXdGE0Xw_8ap5Sa+a_=zA4P17hr2Q@mail.gmail.com>

Hi,

I need some help in securing my applications with keycloak:

I have couple of grails applications (App1 and App2) using spring security.
However, currently I am using keycloak REST API to authenticate users by
passing username and password and receive token without registering these
applications as clients in the keycloak.  But this approach seems to be
inefficient when we want to support SSO, kerberos and other lot of powerful
features that Keycloak offers.
So I came up with the below approach to support SSO/kerberos but wanted to
know if Keycloak can solve our problem.

"Create a new spring boot master application (App3) and register with
Keycloak and redirect the login page to Keycloak. Once login is successful,
use the token that keycloak provides and pass it on to App1 and App2 and
tweak my existing code flow to handle this. Can this be possible because I
am not registering/creating any clients for app1 and app2 in keycloak here
but only creating for app3 which is the master application and using the
access token? Is it mandatory to register/create all clients in Keycloak to
support SSO?"

Any help would be highly appreciated.

Thanks in advance!

From msakho at redhat.com  Wed Nov  7 07:55:59 2018
From: msakho at redhat.com (Meissa M'baye Sakho)
Date: Wed, 7 Nov 2018 13:55:59 +0100
Subject: [keycloak-user] remote debugging keycloak docker image
In-Reply-To: <CACp70M=7qbi_RvQXgPSDWzn9AHbbyGRgb=5qjoOpE94rDqnSGA@mail.gmail.com>
References: <CAF83W6+X2OUhrYMYAz73KVWGZZpMSgDr-Zp6YiP_osLizA6snw@mail.gmail.com>
	<CACp70M=7qbi_RvQXgPSDWzn9AHbbyGRgb=5qjoOpE94rDqnSGA@mail.gmail.com>
Message-ID: <CAF83W6+EkARrZoCtRLnxbFf4E2J2kEATbbautXhA6Wn14iKVMA@mail.gmail.com>

Thanks Louis,
It helps. I had to pass the DEBUG env variable to true and expose the debug
port. It works for me.
Meissa

Le mar. 6 nov. 2018 ? 17:24, Luis Rodr?guez Fern?ndez <uo67113 at gmail.com> a
?crit :

> Hello Meissa,
>
> At the end of the day there should be no difference among debugging
> keycloak or any other java process. In essence is just about to expose the
> debug port outside your k8s cluster. This article [1] explains it very
> well.
>
> Hope it helps,
>
> Luis
>
> [1]
> https://itnext.io/remote-debugging-spring-boot-on-kubernetes-a5f96a40e5c0
>
>
>
> El mar., 6 nov. 2018 a las 15:21, Meissa M'baye Sakho (<msakho at redhat.com
> >)
> escribi?:
>
> > Hello everyone,
> > I need to enable remote debugging on keycloak docker image. I'm using a
> > vanilla kubernetes.
> > Any input on that?
> > Regards,
> > Meissa
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
> >
>
>
> --
>
> "Ever tried. Ever failed. No matter. Try Again. Fail again. Fail better."
>
> - Samuel Beckett
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From pcfleischer at outlook.com  Wed Nov  7 10:12:08 2018
From: pcfleischer at outlook.com (Phillip Fleischer)
Date: Wed, 7 Nov 2018 15:12:08 +0000
Subject: [keycloak-user] http connection/session timeout
Message-ID: <SN2PR0801MB22853502583434EBD107A746A6C40@SN2PR0801MB2285.namprd08.prod.outlook.com>

Hi,

We use new relic APM to monitor keycloak and seems that on occasion there will be transactions running for ~30min which seems to be exceptionally long.  We already lowered our database transaction timeouts, but thinking we should also add/change the wildly servlet timeout timeout from the default of 30 minutes.


<servlet-container name="default" default-session-timeout="1">
    <jsp-config/>
    <websockets/>
</servlet-container>

I can?t see this being related to any of the ?keycloak session? timeouts, just wondering if anyone would know if this is a terrible idea??

? Phil

From nocquidant at gmail.com  Wed Nov  7 12:17:34 2018
From: nocquidant at gmail.com (Nicolas Ocquidant)
Date: Wed, 7 Nov 2018 18:17:34 +0100
Subject: [keycloak-user] Shared datastore?
Message-ID: <CABS93FQoYAW5trxmEww9j8RsyCSmiNAxxopnvj6iHvDNM4qtjg@mail.gmail.com>

Hi,

According to Infinispan, when passivation is disabled, every update to the
cache should always write to the store.

But I can't manage to get it work with Keycloak. If I disable passivation,
my SQL store (Postgres) stays empty, even if the cache is full.

So, if passivation is needed for Keycloak to write to the DB, it means that
the use of a shared DB is not possible...

But this leads to another issue for me. Enable passivation without a shared
DB seems to imply that either 'fetch-state' or 'purge' should be enabled on
startup, in order for the cache to not contain stale entries.

15:27:44,626 WARN
[org.infinispan.configuration.cache.AbstractStoreConfigurationBuilder] (MSC
service thread 1-6) ISPN000149: Fetch persistent state and purge on startup
are both disabled, cache may contain stale entries on startup

As I need to keep millions of sessions, this will considerably slow down
the startup of my node (when started again after a crash for instance).

So, is shared datastore allowed in Keycloak? If yes, how to enable it?
Otherwise what other options do I have to improve my startup time, if
millions of sessions are in the store?

Thanks
--nick

From ljbanii at gmail.com  Wed Nov  7 15:25:13 2018
From: ljbanii at gmail.com (Joe Livu)
Date: Thu, 8 Nov 2018 07:25:13 +1100
Subject: [keycloak-user] Mobile app authentication flow
Message-ID: <CAJjftGBnXVKALrSCAbtjy3Emcq2BJtkDftfgJ471AOT+HKJmUw@mail.gmail.com>

Hi,

I came across KeyCloak while searching for a security provider and was
immediately impressed.

I am planning on building a REST API using ASP.NET <http://asp.net/> Core
Web API to be consumed by a mobile application to be built using Google's
Flutter framework. I have a few questions.

1. Would KeyCloak be suitable for securing my REST API Whig is built using
C# (ASP.NET <http://asp.net/> Core Web API)? If so, can I get a brief
explanation and steps that need to be taken to achieve this?

2. Now I need my mobile app to consume the REST API secured by KeyCloak.
For authenticating users (e.g., via login screen using username/password
credentials), how would this be done? Which grant type and flow will be
suitable? The Web application demos shows a redirect to the KeyCloak server
for authentication and then back to the app. It seems this cannot be
applied for mobile apps (correct me if am wrong), so what would be the best
approach for a mobile application? I would think KeyCloak would provide a
REST API for such cases but I can only find an Admin REST API for admin
purposes only Any help regarding this would very much appreciated.

Kind regards,

Joe Livu

From marco.lamina at sap.com  Wed Nov  7 17:27:38 2018
From: marco.lamina at sap.com (Lamina, Marco)
Date: Wed, 7 Nov 2018 22:27:38 +0000
Subject: [keycloak-user] Policy Evaluation for Service Account shows
	unexpected behavior
Message-ID: <B182625C-8181-4C9C-BAC5-0D534A683602@sap.com>

Hi,
I am using the Protection API to create resources in Keycloak. Some of those resources are created by service accounts, some by regular users. I also have a JS policy that grants access to a resource if the given identity is the resource owner (it was an example from the documentation):

var context = $evaluation.getContext();
var identity = context.getIdentity();
var permission = $evaluation.getPermission();
if (permission.resource !== null && permission.resource.owner == identity.id) {
        $evaluation.grant();
    }

The problem is that the policy fails to execute. Using the evaluation tool in the admin console, it produces the following stack trace: https://pastebin.com/2XXHQkNf .
The policy works fine for regular users. In addition to that, trying to list the account?s permissions using the token endpoint (as described in [1]) fails with a 403.
Am I missing something or is that a bug in Keycloak?

[1] https://www.keycloak.org/docs/latest/authorization_services/index.html#_service_obtaining_permissions

Thanks,
Marco


From dt at acutus.pro  Wed Nov  7 17:44:46 2018
From: dt at acutus.pro (Dmitry Telegin)
Date: Thu, 08 Nov 2018 01:44:46 +0300
Subject: [keycloak-user] Data filtering in SQL
In-Reply-To: <5BCF31B569C0A2468D7904C8E5839D690104C368EF@DSKCMAIL1WC.ad.dstsystems.com>
References: <5BCF31B569C0A2468D7904C8E5839D690104C35356@DSKCMAIL1WC.ad.dstsystems.com>
	<1541136118.4390.1.camel@acutus.pro>
	<5BCF31B569C0A2468D7904C8E5839D690104C368EF@DSKCMAIL1WC.ad.dstsystems.com>
Message-ID: <1541630686.2778.1.camel@acutus.pro>

Hi Rob,

On Tue, 2018-11-06 at 16:28 +0000, Byrd, Rob M wrote:
> (Hope this is the correct way to reply - let me know if not)
> 
> Thanks.??So my concern is really with the whole idea that an Enterprise Application's security constraints could really be all implemented based on url-patterns, is that what you guys are thinking?

Cannot speak for Keycloak guys, but will put in my 2? as an architect - URL-based (or rather resource-based) authorization covers only one aspect of the application security. Data filtering is equally important, but it's just another facet of the problem, and needs to be solved accordingly.
Indeed, Keycloak doesn't provide OOTB any means for automatically limiting subsets of data shown to the user, as Keycloak has a completely different scope (namely Web SSO/IDM solution).

However, you can still use Keycloak as a central warehouse for your security (meta)data, and use it the way you want. Like I said before, nothing stops you from defining some policies in Keycloak, then retrieving them and converting to a WHERE clause for your SQL/JPQL/NoSQL query.

Speaking of NoSQL - this might be not directly relevant to your problem, but still interesting. A similar problem has surfaced in the discussion following my talk on Apache Sling + Keycloak [1] earlier this year; the central point was: "okay, we can have Keycloak path-based authorization in Sling, but how do we limit the content visible to the user?"
That time we came up with some sort of hybrid solution, like path-based security + JCR ACLs and/or application-level rules; but now I think this might be something similar, like generating JCR's equivalent to the WHERE clause based on Keycloak policy definition.

Just to make sure I understand the case, let's imagine:
- there are users and groups (live in Keycloak);
- there are, say, "projects" (live in business tier + DB);
- there is a policy in Keycloak saying "projects should be accessible only to the members of the respective groups";
- based on that:
 - GET /projects/<project> should return 200 + representation if the user is a member of the group, 403 otherwise;
 - GET /projects should return the list of projects the current user has access to.

Is this correct?

[1] https://adapt.to/2018/en/schedule/modern-authentication-in-sling-with-openid-connect-and-keycloak.html

Cheers,
Dmitry Telegin
CTO, Acutus s.r.o.
Keycloak Consulting and Training

Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
+42 (022) 888-30-71
E-mail: info at acutus.pro

> 
> For example, mostly a user can visit most features (urls) in an application, but it is the subset of things they can see/do within the feature that is the crux of the security issue - and it does not seem feasible to architect urls in such a way that they can be used as the key to security.??Thoughts?
> 
> Thanks!
> 
> Rob Byrd
> DST
> Solutions Lead
> SS&C Technologies Inc.?? |?? 1055 Broadway, Kansas City, MO 64105
> t: (816) 435-7286??| m?(816) 509-0119
> rmbyrd at dstsystems.com??|? www.ssctech.com
> Follow us: ?|? ?|??
> 
> -----Original Message-----
> > From: Dmitry Telegin [mailto:dt at acutus.pro]?
> Sent: Friday, November 2, 2018 12:22 AM
> > To: Byrd, Rob M <rmbyrd at dstsystems.com>; keycloak-user at lists.jboss.org
> Subject: Re: [keycloak-user] Data filtering in SQL
> 
> Hello Rob,
> 
> If I get it right, it's all about generating SQL WHERE clause from Keycloak policies? I think this is doable, as Keycloak has a well-defined object model for authorization policies, and it's easy to obtain policy definitions in JSON format. I think Pedro Igor will tell you more about that.
> 
> You should pay attention to the following:
> - there are differences in semantics between OPA and Keycloak policies. For example, Keycloak policies do not operate HTTP methods but rather use more generic notion of scopes;
> - not every policy type can be easily converted to a WHERE clause. It should be trivial for User/Group/Role policies, but is virtually impossible for Script and Rules, as they are just blackboxes that evaluate to true or false. Unless of course your DBMS has a built-in JavaScript engine :)
> 
> Good luck!
> Dmitry Telegin
> CTO, Acutus s.r.o.
> Keycloak Consulting and Training
> 
> Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
> +42 (022) 888-30-71
> E-mail: info at acutus.pro
> 
> On Thu, 2018-11-01 at 21:39 +0000, Byrd, Rob M wrote:
> > I am comparing OPA authorization to Keycloak - how could I enforce Keycloak policy in the SQL closest to the data for good performance, including returning subsets of lists???OPA discusses this at https://blog.openpolicyagent.org/write-policy-in-opa-enforce-policy-in-sql-d9d24db93bf4.
> > 
> > Thanks!
> > 
> > Rob Byrd
> > DST
> > Solutions Lead
> > SS&C Technologies Inc.???|???1055 Broadway, Kansas City, MO 64105
> > t: (816) 435-7286??| m (816) 509-0119
> > rmbyrd at dstsystems.com<mailto:rmbyrd at dstsystems.com>??|??www.ssctech.com<http://www.ssctech.com/>;;
> > > > Follow us: [cid:image001.png at 01D412C1.A14C5770] <https://www.linkedin.com/company/ss-c-technologies/>??|??[cid:image002.png at 01D412C1.A14C5770] <https://twitter.com/ssctechnologies>??|??[cid:image003.png at 01D412C1.A14C5770] <https://www.facebook.com/ssctechnologies/>
> > 
> > 
> > 
> > Please consider the environment before printing this email and any attachments.
> > 
> > This e-mail and any attachments are intended only for the individual or company to which it is addressed and may contain information which is privileged, confidential and prohibited from disclosure or unauthorized use under applicable law. If you are not the intended recipient of this e-mail, you are hereby notified that any use, dissemination, or copying of this e-mail or the information contained in this e-mail is strictly prohibited by the sender. If you have received this transmission in error, please return the material received to the sender and delete all copies from your system.
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
> 
> 
> Please consider the environment before printing this email and any attachments.
> 
> This e-mail and any attachments are intended only for the individual or company to which it is addressed and may contain information which is privileged, confidential and prohibited from disclosure or unauthorized use under applicable law. If you are not the intended recipient of this e-mail, you are hereby notified that any use, dissemination, or copying of this e-mail or the information contained in this e-mail is strictly prohibited by the sender. If you have received this transmission in error, please return the material received to the sender and delete all copies from your system.

From psilva at redhat.com  Wed Nov  7 17:55:29 2018
From: psilva at redhat.com (Pedro Igor Silva)
Date: Wed, 7 Nov 2018 20:55:29 -0200
Subject: [keycloak-user] Policy Evaluation for Service Account shows
 unexpected behavior
In-Reply-To: <B182625C-8181-4C9C-BAC5-0D534A683602@sap.com>
References: <B182625C-8181-4C9C-BAC5-0D534A683602@sap.com>
Message-ID: <CAJrcDBfkum2uPc5GgDsc9Y5foE5vvnZNDX9CeTODr7zxezLLzA@mail.gmail.com>

Hi,

It should be a bug. I've created
https://issues.jboss.org/browse/KEYCLOAK-8768.

I need to check if we are properly working with sessions when identity is a
service account. Could you add a comment to that JIRA with an example of an
authorization request to the token endpoint ?

Thanks.

On Wed, Nov 7, 2018 at 8:29 PM Lamina, Marco <marco.lamina at sap.com> wrote:

> Hi,
> I am using the Protection API to create resources in Keycloak. Some of
> those resources are created by service accounts, some by regular users. I
> also have a JS policy that grants access to a resource if the given
> identity is the resource owner (it was an example from the documentation):
>
> var context = $evaluation.getContext();
> var identity = context.getIdentity();
> var permission = $evaluation.getPermission();
> if (permission.resource !== null && permission.resource.owner ==
> identity.id) {
>         $evaluation.grant();
>     }
>
> The problem is that the policy fails to execute. Using the evaluation tool
> in the admin console, it produces the following stack trace:
> https://pastebin.com/2XXHQkNf .
> The policy works fine for regular users. In addition to that, trying to
> list the account?s permissions using the token endpoint (as described in
> [1]) fails with a 403.
> Am I missing something or is that a bug in Keycloak?
>
> [1]
> https://www.keycloak.org/docs/latest/authorization_services/index.html#_service_obtaining_permissions
>
> Thanks,
> Marco
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From llivezking at gmail.com  Wed Nov  7 21:40:56 2018
From: llivezking at gmail.com (Ilya Korol)
Date: Thu, 8 Nov 2018 12:40:56 +1000
Subject: [keycloak-user] JTA and UserStorageProvider implementations
Message-ID: <ad8d695c-5661-610a-1fe8-47f6b61ff748@gmail.com>

Hi. I'm trying to realize how should i configure our datasources from 
JTA point of view. As far as i know default settings (that also 
described in docs) don't include any JTA capabilities, so keycloak will 
work in local transactions mode. (There is also a thing that confused me 
a little: in Wildfly Admin Console all datasources have 'JTA' option 
enabled by default). So the question is: what settings should i use if i 
add UserStorageProvider implementation which uses separate DataSource. 
As far as i understand JTA should be enabled for such case, so how 
should i configure datasources. For example:

- KeycloakDS [Oracle] - datasource for keycloak itself

- ExternalDS [Oracle] - datasource for external user storage

Should both datasource be XA and JTA capable? And what about 
EntityManager that i would use for user data extraction? I refer to 
example implementation of User Storage Provider from documentation:|
|

|@Stateful||@Local(EjbExampleUserStorageProvider.class)||public class EjbExampleUserStorageProvider implements UserStorageProvider,||??? ??? UserLookupProvider, UserRegistrationProvider, 
UserQueryProvider, CredentialInputUpdater, CredentialInputValidator, 
OnUserCache { @PersistenceContext protected EntityManager em; protected 
ComponentModel model; protected KeycloakSession session; public void 
setModel(ComponentModel model) { this.model = model; } public void 
setSession(KeycloakSession session) { this.session = session; } @Remove 
@Override public void close() {} }|

||

||

|Does transaction context of this entity manager same as transaction 
context of Keycloak Session? |


From prashant.bapat at thetradedesk.com  Thu Nov  8 04:04:32 2018
From: prashant.bapat at thetradedesk.com (Prashant Bapat)
Date: Thu, 8 Nov 2018 09:04:32 +0000
Subject: [keycloak-user] Restrict access to clients based on Group membership
Message-ID: <149FA3D4-A92D-4B87-995C-FD2D6746AEC4@thetradedesk.com>

Hi,

In our Keycloak setup (ver 4.4.0) we have a master realm configured to authenticate users in a Windows AD. We heavily use SAML and OIDC and both work great.

Is there a way to restrict access to a OIDC client based on a group membership ? I?ve been reading up the docs and trying to get this working without success.

For example, let?s say we have 2 clients;
client-dev-api
client-prod-api
Can I configure Keycloak to issue JWT token for client-dev-api to members of AD group ?Developers? and client-prod-api to members AD group ?Production? ?

Any guidance on getting this to work would be appreciated.

Thanks.
--Prashant

From uo67113 at gmail.com  Thu Nov  8 04:07:52 2018
From: uo67113 at gmail.com (=?UTF-8?Q?Luis_Rodr=C3=ADguez_Fern=C3=A1ndez?=)
Date: Thu, 8 Nov 2018 10:07:52 +0100
Subject: [keycloak-user] How can I use Keycloak to support my
	architecture?
In-Reply-To: <CAN7vkfgmADkTH9Z008WaCSXdGE0Xw_8ap5Sa+a_=zA4P17hr2Q@mail.gmail.com>
References: <CAN7vkfgmADkTH9Z008WaCSXdGE0Xw_8ap5Sa+a_=zA4P17hr2Q@mail.gmail.com>
Message-ID: <CACp70Mk5efBJ6yLTMs-yRUUguj+1Pk=heTb5DdPHxsBpSZtHnw@mail.gmail.com>

Hello Ola,

I've tested exactly the same approach as yours. In my case I am using SAML:

1. /login-module with
org.keycloak.adapters.saml.tomcat.SamlAuthenticatorValve registered in IdP.
It declares a <security-constraint> for "/*" [1]
2. Any request to /login-module pass through a filter [2] that looks in the
request for a secret (cookie). If there is no secret the request is
redirected to a servlet [3]. If the user has a valid session in the IdP the
secret is created and it is redirected to the original request.
3. The rest of the modules are "protected" by the custom filter [4]

Answering your questions:

- Can this be possible...? Yes it can, but personally I do not like it
- It is mandatory to register...? I do believe that it is preferrable

I developed this PoC for this scenario: I have a big legacy enterprise app
(.ear) with several modules that make requests between them for getting
protected resources. E.g. /module1 requests /module2/images/calendar.gif or
/module1/ requests /module2/search. I do this because I want to avoid to
touch the legacy and sometimes obscure code of the ear app :)

Probably to use OAUTH2/OpenId Connect would be a better idea for these kind
of scenarios.

Hope it helps,

Luis

[1] https://gist.github.com/lurodrig/deb2e086fa425f2d64111b325caf1b96
[2] https://gist.github.com/lurodrig/7b157e6ebcfe857c86218eabd8063c6d
[3] https://gist.github.com/lurodrig/e1a20f480f3c4202c083a091ed68b0d7
[4] https://gist.github.com/lurodrig/84c0bf35f184059fe27bb47e377f09af








El jue., 8 nov. 2018 a las 8:15, ola rob (<robstyle1234 at gmail.com>)
escribi?:

> Hi,
>
> I need some help in securing my applications with keycloak:
>
> I have couple of grails applications (App1 and App2) using spring security.
> However, currently I am using keycloak REST API to authenticate users by
> passing username and password and receive token without registering these
> applications as clients in the keycloak.  But this approach seems to be
> inefficient when we want to support SSO, kerberos and other lot of powerful
> features that Keycloak offers.
> So I came up with the below approach to support SSO/kerberos but wanted to
> know if Keycloak can solve our problem.
>
> "Create a new spring boot master application (App3) and register with
> Keycloak and redirect the login page to Keycloak. Once login is successful,
> use the token that keycloak provides and pass it on to App1 and App2 and
> tweak my existing code flow to handle this. Can this be possible because I
> am not registering/creating any clients for app1 and app2 in keycloak here
> but only creating for app3 which is the master application and using the
> access token? Is it mandatory to register/create all clients in Keycloak to
> support SSO?"
>
> Any help would be highly appreciated.
>
> Thanks in advance!
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>


-- 

"Ever tried. Ever failed. No matter. Try Again. Fail again. Fail better."

- Samuel Beckett

From karsten.honsack at zurich.com  Thu Nov  8 04:50:05 2018
From: karsten.honsack at zurich.com (Karsten Honsack)
Date: Thu, 8 Nov 2018 09:50:05 +0000
Subject: [keycloak-user] Login via SAML RESPONSE from an IdP
Message-ID: <ce084148ab0043aab89c665f24f57744@CEEXC0523.ZURMWS.CSCMWS.COM>

Hello everybody,

I am trying to figure out if Keycloak is capable to fulfil the following requirement. I read through the documentation but was not able to figure it out.

Scenario:
A user is on a website where he has the possibility to jump to web applications of different partners via SSO. The website provider only supports IdP Initiated SSO and the button links provided are SAML Assertion Consumer URLs. The flow describes what should be happening for my understanding:

Flow:
1. User login on website.
2. User clicks on button.
3. Website creates an encrypted SAML RESPONSE using its STS, redirects user to Keycloak's SAML Assertion Consumer URL and POSTs the SAML RESPONSE there.
4. Keycloak decrypts/validates SAML RESPONSE and authenticates the user.
5. Keycloak redirects user to the application.
6. User uses application.

Is this possible? How has it to be configured? Do you need any more information to help me? Thank you in advance!

Best regards

Karsten Honsack

**************************************



From uo67113 at gmail.com  Thu Nov  8 05:10:09 2018
From: uo67113 at gmail.com (=?UTF-8?Q?Luis_Rodr=C3=ADguez_Fern=C3=A1ndez?=)
Date: Thu, 8 Nov 2018 11:10:09 +0100
Subject: [keycloak-user] Login via SAML RESPONSE from an IdP
In-Reply-To: <ce084148ab0043aab89c665f24f57744@CEEXC0523.ZURMWS.CSCMWS.COM>
References: <ce084148ab0043aab89c665f24f57744@CEEXC0523.ZURMWS.CSCMWS.COM>
Message-ID: <CACp70MmFo93v3r=MRhHQhku5uCm+B4CawzbVVgnJWVv01gx2oA@mail.gmail.com>

Hello Karsten,

Yes it is possible, please have a look here [1]. Of course you will need to
confire your SP with your specific SAML adapter [2]

Hope it helps,

Luis

ps: just for the records: I always use SP initiated login, it looks more
"natural" to me :)

[1]
https://www.keycloak.org/docs/latest/server_admin/index.html#idp-initiated-login
[2]
https://www.keycloak.org/docs/latest/securing_apps/index.html#_saml-general-config


El jue., 8 nov. 2018 a las 10:51, Karsten Honsack (<
karsten.honsack at zurich.com>) escribi?:

> Hello everybody,
>
> I am trying to figure out if Keycloak is capable to fulfil the following
> requirement. I read through the documentation but was not able to figure it
> out.
>
> Scenario:
> A user is on a website where he has the possibility to jump to web
> applications of different partners via SSO. The website provider only
> supports IdP Initiated SSO and the button links provided are SAML Assertion
> Consumer URLs. The flow describes what should be happening for my
> understanding:
>
> Flow:
> 1. User login on website.
> 2. User clicks on button.
> 3. Website creates an encrypted SAML RESPONSE using its STS, redirects
> user to Keycloak's SAML Assertion Consumer URL and POSTs the SAML RESPONSE
> there.
> 4. Keycloak decrypts/validates SAML RESPONSE and authenticates the user.
> 5. Keycloak redirects user to the application.
> 6. User uses application.
>
> Is this possible? How has it to be configured? Do you need any more
> information to help me? Thank you in advance!
>
> Best regards
>
> Karsten Honsack
>
> **************************************
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>


-- 

"Ever tried. Ever failed. No matter. Try Again. Fail again. Fail better."

- Samuel Beckett

From Gregor.Tudan at cofinpro.de  Thu Nov  8 05:30:47 2018
From: Gregor.Tudan at cofinpro.de (Gregor Tudan)
Date: Thu, 8 Nov 2018 10:30:47 +0000
Subject: [keycloak-user] Email-Event UPDATE-PASSWORD
Message-ID: <B31D602E-3E32-491A-8AE3-5BA96362232A@cofinpro.de>

Hi,

We?re trying to send an email to a user if his/her password was changed. The Email-Event UPDATE-PASSWORD looks exactly like what we want.

https://github.com/keycloak/keycloak/blob/master/services/src/main/java/org/keycloak/events/email/EmailEventListenerProvider.java <https://github.com/keycloak/keycloak/blob/master/services/src/main/java/org/keycloak/events/email/EmailEventListenerProvider.java>

There?s one catch: the email seems to only get sent if the user has a verified email address. Email-Verification is not activated on the realm.
Is there a reason why email-verification is required for those emails?

Thanks,
Gregor
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: Message signed with OpenPGP
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20181108/d48320e1/attachment.bin 

From karsten.honsack at zurich.com  Thu Nov  8 05:28:42 2018
From: karsten.honsack at zurich.com (Karsten Honsack)
Date: Thu, 8 Nov 2018 10:28:42 +0000
Subject: [keycloak-user] Login via SAML RESPONSE from an IdP
In-Reply-To: <CACp70MmFo93v3r=MRhHQhku5uCm+B4CawzbVVgnJWVv01gx2oA@mail.gmail.com>
References: <ce084148ab0043aab89c665f24f57744@CEEXC0523.ZURMWS.CSCMWS.COM>
	<CACp70MmFo93v3r=MRhHQhku5uCm+B4CawzbVVgnJWVv01gx2oA@mail.gmail.com>
Message-ID: <074494c35fd045d48d1c14abff14e78d@CEEXC0523.ZURMWS.CSCMWS.COM>

Hi Luis,

thank you for the fast help! I was looking at the brokering section. That was totally wrong in this case. I will build a test scenario and try this out.

Best regards

Karsten Honsack


-----Urspr?ngliche Nachricht-----
Von: keycloak-user-bounces at lists.jboss.org <keycloak-user-bounces at lists.jboss.org> Im Auftrag von Luis Rodr?guez Fern?ndez
Gesendet: Donnerstag, 8. November 2018 11:10
An: keycloak-user <keycloak-user at lists.jboss.org>
Betreff: [EXTERNAL] Re: [keycloak-user] Login via SAML RESPONSE from an IdP

Hello Karsten,

Yes it is possible, please have a look here [1]. Of course you will need to confire your SP with your specific SAML adapter [2]

Hope it helps,

Luis

ps: just for the records: I always use SP initiated login, it looks more "natural" to me :)

[1]
https://urldefense.proofpoint.com/v2/url?u=https-3A__www.keycloak.org_docs_latest_server-5Fadmin_index.html-23idp-2Dinitiated-2Dlogin&d=DwIGaQ&c=DgzfCyvE4m33Nb8jT6Zstq7mstX2IJrYfaJl8Ak-0_8&r=tEV5NbaAf1DsefwaP5VV_SYeWZQslIoxTN6j5CE93Hg&m=qspAgpvVTTvc9t-nOM1flvxotmIZxnKAdMYyScv58Ig&s=oEDTuu1cY-giNJjcutXqA9wXxhDbrlomVmbvSFDZlXQ&e=
[2]
https://urldefense.proofpoint.com/v2/url?u=https-3A__www.keycloak.org_docs_latest_securing-5Fapps_index.html-23-5Fsaml-2Dgeneral-2Dconfig&d=DwIGaQ&c=DgzfCyvE4m33Nb8jT6Zstq7mstX2IJrYfaJl8Ak-0_8&r=tEV5NbaAf1DsefwaP5VV_SYeWZQslIoxTN6j5CE93Hg&m=qspAgpvVTTvc9t-nOM1flvxotmIZxnKAdMYyScv58Ig&s=LjEqAXudmP1sML3rguSEQSe5LcIyRTIgycnszoHEGBM&e=


El jue., 8 nov. 2018 a las 10:51, Karsten Honsack (<
karsten.honsack at zurich.com>) escribi?:

> Hello everybody,
>
> I am trying to figure out if Keycloak is capable to fulfil the
> following requirement. I read through the documentation but was not
> able to figure it out.
>
> Scenario:
> A user is on a website where he has the possibility to jump to web
> applications of different partners via SSO. The website provider only
> supports IdP Initiated SSO and the button links provided are SAML
> Assertion Consumer URLs. The flow describes what should be happening
> for my
> understanding:
>
> Flow:
> 1. User login on website.
> 2. User clicks on button.
> 3. Website creates an encrypted SAML RESPONSE using its STS, redirects
> user to Keycloak's SAML Assertion Consumer URL and POSTs the SAML
> RESPONSE there.
> 4. Keycloak decrypts/validates SAML RESPONSE and authenticates the user.
> 5. Keycloak redirects user to the application.
> 6. User uses application.
>
> Is this possible? How has it to be configured? Do you need any more
> information to help me? Thank you in advance!
>
> Best regards
>
> Karsten Honsack
>
> **************************************
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://urldefense.proofpoint.com/v2/url?u=https-3A__lists.jboss.org_m
> ailman_listinfo_keycloak-2Duser&d=DwIGaQ&c=DgzfCyvE4m33Nb8jT6Zstq7mstX
> 2IJrYfaJl8Ak-0_8&r=tEV5NbaAf1DsefwaP5VV_SYeWZQslIoxTN6j5CE93Hg&m=qspAg
> pvVTTvc9t-nOM1flvxotmIZxnKAdMYyScv58Ig&s=sRIEtNz_hzeZ7pWSAjmi6kartlN-g
> eNm1PiImgC9pPQ&e=
>


--

"Ever tried. Ever failed. No matter. Try Again. Fail again. Fail better."

- Samuel Beckett
_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org
https://urldefense.proofpoint.com/v2/url?u=https-3A__lists.jboss.org_mailman_listinfo_keycloak-2Duser&d=DwIGaQ&c=DgzfCyvE4m33Nb8jT6Zstq7mstX2IJrYfaJl8Ak-0_8&r=tEV5NbaAf1DsefwaP5VV_SYeWZQslIoxTN6j5CE93Hg&m=qspAgpvVTTvc9t-nOM1flvxotmIZxnKAdMYyScv58Ig&s=sRIEtNz_hzeZ7pWSAjmi6kartlN-geNm1PiImgC9pPQ&e=

**************************************



From psilva at redhat.com  Thu Nov  8 07:42:11 2018
From: psilva at redhat.com (Pedro Igor Silva)
Date: Thu, 8 Nov 2018 10:42:11 -0200
Subject: [keycloak-user] Data filtering in SQL
In-Reply-To: <1541630686.2778.1.camel@acutus.pro>
References: <5BCF31B569C0A2468D7904C8E5839D690104C35356@DSKCMAIL1WC.ad.dstsystems.com>
	<1541136118.4390.1.camel@acutus.pro>
	<5BCF31B569C0A2468D7904C8E5839D690104C368EF@DSKCMAIL1WC.ad.dstsystems.com>
	<1541630686.2778.1.camel@acutus.pro>
Message-ID: <CAJrcDBffVsLL2_HPjeEBo1OrM__YYmf5s2q8M2m7YtzXEcisFw@mail.gmail.com>

Hi Dmitry,

Agree with you when you mention application vs data security. I also agree
that Keycloak can also solve data security problems.

Privacy is one of the main reasons behind our UMA support a very important
aspect of data security. In addition to privacy, we also added extensions
to UMA and OAuth2 standards to enable applications to use Keycloak as a
Policy Decision Point, mainly target for application security.

As PDP (and PAP), Keycloak allows you to govern access to protected
resources and to obtain authorization decisions as a result of the
evaluation of policies associated with these resources. Being based on UMA
and OAuth2 we support token-based authorization but also access control
based on the permissions granted by the server. So, yeah, it should be
possible to filter data based on those permissions as well dynamically
create WHERE clauses.

My main concerns about data security are scalability and manageability, two
aspects that are closely related to how much fine-grained you want to be.
Like I said, in Keycloak you can protect a set of one or more resources as
well as scope specific permissions, which can span access decisions for one
or more resources.

We are using data security when you enable permissions to users or groups,
where results are filtered based on the evaluation of these permissions.
Performance wise, evaluation is quite satisfactory, being the main
challenges the trade-off between usability vs performance. Recently we had
important changes to improve the performance of our token endpoint and
policy evaluation engine and I think we can perform well when fetching
permissions from the server for a set of one or more resources.

I'm happy to discuss how we can leverage what we have for data security if
the community is interested.

Regards.
Pedro Igor

On Wed, Nov 7, 2018 at 8:47 PM Dmitry Telegin <dt at acutus.pro> wrote:

> Hi Rob,
>
> On Tue, 2018-11-06 at 16:28 +0000, Byrd, Rob M wrote:
> > (Hope this is the correct way to reply - let me know if not)
> >
> > Thanks.  So my concern is really with the whole idea that an Enterprise
> Application's security constraints could really be all implemented based on
> url-patterns, is that what you guys are thinking?
>
> Cannot speak for Keycloak guys, but will put in my 2? as an architect -
> URL-based (or rather resource-based) authorization covers only one aspect
> of the application security. Data filtering is equally important, but it's
> just another facet of the problem, and needs to be solved accordingly.
> Indeed, Keycloak doesn't provide OOTB any means for automatically limiting
> subsets of data shown to the user, as Keycloak has a completely different
> scope (namely Web SSO/IDM solution).
>
> However, you can still use Keycloak as a central warehouse for your
> security (meta)data, and use it the way you want. Like I said before,
> nothing stops you from defining some policies in Keycloak, then retrieving
> them and converting to a WHERE clause for your SQL/JPQL/NoSQL query.
>
> Speaking of NoSQL - this might be not directly relevant to your problem,
> but still interesting. A similar problem has surfaced in the discussion
> following my talk on Apache Sling + Keycloak [1] earlier this year; the
> central point was: "okay, we can have Keycloak path-based authorization in
> Sling, but how do we limit the content visible to the user?"
> That time we came up with some sort of hybrid solution, like path-based
> security + JCR ACLs and/or application-level rules; but now I think this
> might be something similar, like generating JCR's equivalent to the WHERE
> clause based on Keycloak policy definition.
>
> Just to make sure I understand the case, let's imagine:
> - there are users and groups (live in Keycloak);
> - there are, say, "projects" (live in business tier + DB);
> - there is a policy in Keycloak saying "projects should be accessible only
> to the members of the respective groups";
> - based on that:
>  - GET /projects/<project> should return 200 + representation if the user
> is a member of the group, 403 otherwise;
>  - GET /projects should return the list of projects the current user has
> access to.
>
> Is this correct?
>
> [1]
> https://adapt.to/2018/en/schedule/modern-authentication-in-sling-with-openid-connect-and-keycloak.html
>
> Cheers,
> Dmitry Telegin
> CTO, Acutus s.r.o.
> Keycloak Consulting and Training
>
> Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
> +42 (022) 888-30-71
> E-mail: info at acutus.pro
>
> >
> > For example, mostly a user can visit most features (urls) in an
> application, but it is the subset of things they can see/do within the
> feature that is the crux of the security issue - and it does not seem
> feasible to architect urls in such a way that they can be used as the key
> to security.  Thoughts?
> >
> > Thanks!
> >
> > Rob Byrd
> > DST
> > Solutions Lead
> > SS&C Technologies Inc.   |   1055 Broadway, Kansas City, MO 64105
> > t: (816) 435-7286  | m (816) 509-0119
> > rmbyrd at dstsystems.com  |  www.ssctech.com
> > Follow us:  |   |
> >
> > -----Original Message-----
> > > From: Dmitry Telegin [mailto:dt at acutus.pro]
> > Sent: Friday, November 2, 2018 12:22 AM
> > > To: Byrd, Rob M <rmbyrd at dstsystems.com>; keycloak-user at lists.jboss.org
> > Subject: Re: [keycloak-user] Data filtering in SQL
> >
> > Hello Rob,
> >
> > If I get it right, it's all about generating SQL WHERE clause from
> Keycloak policies? I think this is doable, as Keycloak has a well-defined
> object model for authorization policies, and it's easy to obtain policy
> definitions in JSON format. I think Pedro Igor will tell you more about
> that.
> >
> > You should pay attention to the following:
> > - there are differences in semantics between OPA and Keycloak policies.
> For example, Keycloak policies do not operate HTTP methods but rather use
> more generic notion of scopes;
> > - not every policy type can be easily converted to a WHERE clause. It
> should be trivial for User/Group/Role policies, but is virtually impossible
> for Script and Rules, as they are just blackboxes that evaluate to true or
> false. Unless of course your DBMS has a built-in JavaScript engine :)
> >
> > Good luck!
> > Dmitry Telegin
> > CTO, Acutus s.r.o.
> > Keycloak Consulting and Training
> >
> > Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
> > +42 (022) 888-30-71
> > E-mail: info at acutus.pro
> >
> > On Thu, 2018-11-01 at 21:39 +0000, Byrd, Rob M wrote:
> > > I am comparing OPA authorization to Keycloak - how could I enforce
> Keycloak policy in the SQL closest to the data for good performance,
> including returning subsets of lists?  OPA discusses this at
> https://blog.openpolicyagent.org/write-policy-in-opa-enforce-policy-in-sql-d9d24db93bf4
> .
> > >
> > > Thanks!
> > >
> > > Rob Byrd
> > > DST
> > > Solutions Lead
> > > SS&C Technologies Inc.   |   1055 Broadway, Kansas City, MO 64105
> > > t: (816) 435-7286  | m (816) 509-0119
> > > rmbyrd at dstsystems.com<mailto:rmbyrd at dstsystems.com>  |
> www.ssctech.com<http://www.ssctech.com/>;;
> > > > > Follow us: [cid:image001.png at 01D412C1.A14C5770] <
> https://www.linkedin.com/company/ss-c-technologies/
> >  |  [cid:image002.png at 01D412C1.A14C5770] <
> https://twitter.com/ssctechnologies
> >  |  [cid:image003.png at 01D412C1.A14C5770] <
> https://www.facebook.com/ssctechnologies/>
> > >
> > >
> > >
> > > Please consider the environment before printing this email and any
> attachments.
> > >
> > > This e-mail and any attachments are intended only for the individual
> or company to which it is addressed and may contain information which is
> privileged, confidential and prohibited from disclosure or unauthorized use
> under applicable law. If you are not the intended recipient of this e-mail,
> you are hereby notified that any use, dissemination, or copying of this
> e-mail or the information contained in this e-mail is strictly prohibited
> by the sender. If you have received this transmission in error, please
> return the material received to the sender and delete all copies from your
> system.
> > > _______________________________________________
> > > keycloak-user mailing list
> > > keycloak-user at lists.jboss.org
> > > https://lists.jboss.org/mailman/listinfo/keycloak-user
> >
> >
> > Please consider the environment before printing this email and any
> attachments.
> >
> > This e-mail and any attachments are intended only for the individual or
> company to which it is addressed and may contain information which is
> privileged, confidential and prohibited from disclosure or unauthorized use
> under applicable law. If you are not the intended recipient of this e-mail,
> you are hereby notified that any use, dissemination, or copying of this
> e-mail or the information contained in this e-mail is strictly prohibited
> by the sender. If you have received this transmission in error, please
> return the material received to the sender and delete all copies from your
> system.
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From fabrizio.usai at cjsm.vlaanderen.be  Thu Nov  8 09:13:59 2018
From: fabrizio.usai at cjsm.vlaanderen.be (Usai, Fabrizio)
Date: Thu, 8 Nov 2018 14:13:59 +0000
Subject: [keycloak-user] OpenID Java Adapter: configuring keycloak to use an
 IDP different then Keycloak Server
Message-ID: <1541686439063.37605@cjsm.vlaanderen.be>

Dear,


We are using Keycloak Java adapter 4.5.0 in combination with EAP7.1. When we configure our keycloak.json we have for auth-server-url the url https://authentication.country.com/op/v1/auth (the original url is changed for privacy reasons). So far so good.

When we navigate to our application, we are forwarded to https://authentication.country.com/op/v1/auth/realms/KeycloakOIDCRealm/protocol/openid-connect/auth?response_type=code&client_id=fac9d161-d27d-493d-uze896zed78&redirect_uri=.....

This is not good, since we use our own identity provider. Removing the realms/KeycloakOIDCRealm/protocol/openid-connect/ part of the url, forwards it correctly to the identity provider. So the Keycloak adapter adds it by default, assuming we will always use Keycloak as an identity provider. Before we were using SAML and didn't had this issue.

How can we configure the keycloak.json for the adapter to leave out the addition of realms/KeycloakOIDCRealm/protocol/openid-connect/?

We don't understand why with SAML we didn't had this issue at all, and now with OpenID it seems very difficult to solve this issue. Our current guess to solve this, is to overwrite some Keycloak Java class and make sure the url is built the correct way. Although it is a bit dirty, we could accept this as solution (if it is possible), but we prefer to do this via configuration.


Kind regards,

Fabrizio Usai

From Paolo.Tedesco at cern.ch  Thu Nov  8 09:37:08 2018
From: Paolo.Tedesco at cern.ch (Paolo Tedesco)
Date: Thu, 8 Nov 2018 14:37:08 +0000
Subject: [keycloak-user] Refreshing exchanged token
Message-ID: <6D320D40264A8545A9C25EC79DE1E32501ECD41B3F@CERNXCHG41.cern.ch>

Hi all,

I have a problem refreshing an exchanged token, and I would need some help to understand if I'm doing something wrong.

I have two test confidential clients, client_1 and client_2, and client_1 is allowed to exchange tokens for client_2.

First, I get a token for client_1, then I use token exchange to get a token for client_2. The token that I have at this point looks like this (snipped):

session_state: 30b295b9-7278-4c9e-b5c4-0927e111a676
token_type: bearer
access_token (decoded claims) :
    aud = client_2
    clientId = client_1
refresh_token (decoded claims) :
    aud = client_2
    azp = client_1

So far, everything is fine, but the problem is when I try to refresh the token for client_2 I got from the previous call.
The call I'm making is

POST https://<server>/auth/realms/master/protocol/openid-connect/token

client_id = client_1
client_secret = <client secret for client_1>
grant_type = refresh_token
refresh_token = <the refresh_token string from the exchanged token>

What I would expect is to get a new token with aud = client_2, instead I get a new token with aud = client_1:

session_state: 30b295b9-7278-4c9e-b5c4-0927e111a676
token_type: bearer
access_token:
    aud = client_1
    clientId = client_1
refresh_token:
    aud = client_1
    azp = client_1

Is this correct? Should I just get a new token through token exchange in this case, instead of refreshing the existing one?

Thanks,
Paolo Tedesco

From nocquidant at gmail.com  Thu Nov  8 11:35:49 2018
From: nocquidant at gmail.com (Nicolas Ocquidant)
Date: Thu, 8 Nov 2018 17:35:49 +0100
Subject: [keycloak-user] Shared datastore?
In-Reply-To: <CABS93FQoYAW5trxmEww9j8RsyCSmiNAxxopnvj6iHvDNM4qtjg@mail.gmail.com>
References: <CABS93FQoYAW5trxmEww9j8RsyCSmiNAxxopnvj6iHvDNM4qtjg@mail.gmail.com>
Message-ID: <CABS93FTjHkHaZRFWKuXsFoQ50u4fAN1EFyXoTsyJRtXf4HmS3w@mail.gmail.com>

My requirements are the following: store tokens emitted by KC during one
year.

I don't know how many users there are, but here are the number I get:
  * the number of connections a week is about 700k.
  * the number of session refresh a week is about 200k.

I approximated around 1M of sessions a week, thus 52M a year.
In memory, a user session has been estimated around 4KB (about 1KB in
file/DB).

But I guess a refresh does not create another session isn't it? And maybe
it's possible to ask KC to delete previous emitted tokens when a new one is
created for a same user?

If yes, my estimation is probably a little bit too high here, but I
certainly have several millions of tokens to keep (and maybe dozens of
millions).

Thanks
--nick

Le mer. 7 nov. 2018 ? 18:17, Nicolas Ocquidant <nocquidant at gmail.com> a
?crit :

> Hi,
>
> According to Infinispan, when passivation is disabled, every update to the
> cache should always write to the store.
>
> But I can't manage to get it work with Keycloak. If I disable passivation,
> my SQL store (Postgres) stays empty, even if the cache is full.
>
> So, if passivation is needed for Keycloak to write to the DB, it means
> that the use of a shared DB is not possible...
>
> But this leads to another issue for me. Enable passivation without a
> shared DB seems to imply that either 'fetch-state' or 'purge' should be
> enabled on startup, in order for the cache to not contain stale entries.
>
> 15:27:44,626 WARN
> [org.infinispan.configuration.cache.AbstractStoreConfigurationBuilder] (MSC
> service thread 1-6) ISPN000149: Fetch persistent state and purge on startup
> are both disabled, cache may contain stale entries on startup
>
> As I need to keep millions of sessions, this will considerably slow down
> the startup of my node (when started again after a crash for instance).
>
> So, is shared datastore allowed in Keycloak? If yes, how to enable it?
> Otherwise what other options do I have to improve my startup time, if
> millions of sessions are in the store?
>
> Thanks
> --nick
>

From slaskawi at redhat.com  Thu Nov  8 12:33:47 2018
From: slaskawi at redhat.com (Sebastian Laskawiec)
Date: Thu, 8 Nov 2018 18:33:47 +0100
Subject: [keycloak-user] Shared datastore?
In-Reply-To: <CABS93FTjHkHaZRFWKuXsFoQ50u4fAN1EFyXoTsyJRtXf4HmS3w@mail.gmail.com>
References: <CABS93FQoYAW5trxmEww9j8RsyCSmiNAxxopnvj6iHvDNM4qtjg@mail.gmail.com>
	<CABS93FTjHkHaZRFWKuXsFoQ50u4fAN1EFyXoTsyJRtXf4HmS3w@mail.gmail.com>
Message-ID: <CAA9R9O5OKgZqrkCXbifNoHEYOfKKV52ujycoHMOMBvq7jzNFLQ@mail.gmail.com>

So I think there are at least two ways to address this problem. This first
one is to use Offline Tokens [1]. I'm not sure if that fits into your
application since it requires your client applications to store the token.
In other words you can simply delegate this problem one layer below in your
system.

If that doesn't work for you, yes passivation is a way to go. Frankly, I
haven't used passivation but from the manual I see it works hand in hand
with eviction [2][3]. Will (on CC) can probably correct me here, but my
understanding is that whenever an entry gets evicted, the passivation
mechanism picks it up and stores somewhere.

[1] http://blog.keycloak.org/2015/12/offline-tokens-in-keycloak.html
[2]
http://infinispan.org/docs/stable/user_guide/user_guide.html#cache_passivation
[3]
https://github.com/infinispan/infinispan/blob/master/core/src/test/java/org/infinispan/eviction/impl/EvictionWithPassivationTest.java#L61-L69

On Thu, Nov 8, 2018 at 5:40 PM Nicolas Ocquidant <nocquidant at gmail.com>
wrote:

> My requirements are the following: store tokens emitted by KC during one
> year.
>
> I don't know how many users there are, but here are the number I get:
>   * the number of connections a week is about 700k.
>   * the number of session refresh a week is about 200k.
>
> I approximated around 1M of sessions a week, thus 52M a year.
> In memory, a user session has been estimated around 4KB (about 1KB in
> file/DB).
>
> But I guess a refresh does not create another session isn't it? And maybe
> it's possible to ask KC to delete previous emitted tokens when a new one is
> created for a same user?
>
> If yes, my estimation is probably a little bit too high here, but I
> certainly have several millions of tokens to keep (and maybe dozens of
> millions).
>
> Thanks
> --nick
>
> Le mer. 7 nov. 2018 ? 18:17, Nicolas Ocquidant <nocquidant at gmail.com> a
> ?crit :
>
> > Hi,
> >
> > According to Infinispan, when passivation is disabled, every update to
> the
> > cache should always write to the store.
> >
> > But I can't manage to get it work with Keycloak. If I disable
> passivation,
> > my SQL store (Postgres) stays empty, even if the cache is full.
> >
> > So, if passivation is needed for Keycloak to write to the DB, it means
> > that the use of a shared DB is not possible...
> >
> > But this leads to another issue for me. Enable passivation without a
> > shared DB seems to imply that either 'fetch-state' or 'purge' should be
> > enabled on startup, in order for the cache to not contain stale entries.
> >
> > 15:27:44,626 WARN
> > [org.infinispan.configuration.cache.AbstractStoreConfigurationBuilder]
> (MSC
> > service thread 1-6) ISPN000149: Fetch persistent state and purge on
> startup
> > are both disabled, cache may contain stale entries on startup
> >
> > As I need to keep millions of sessions, this will considerably slow down
> > the startup of my node (when started again after a crash for instance).
> >
> > So, is shared datastore allowed in Keycloak? If yes, how to enable it?
> > Otherwise what other options do I have to improve my startup time, if
> > millions of sessions are in the store?
> >
> > Thanks
> > --nick
> >
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From ionel.gardais at tech-advantage.com  Thu Nov  8 14:04:48 2018
From: ionel.gardais at tech-advantage.com (GARDAIS Ionel)
Date: Thu, 8 Nov 2018 20:04:48 +0100 (CET)
Subject: [keycloak-user] Email-Event UPDATE-PASSWORD
In-Reply-To: <B31D602E-3E32-491A-8AE3-5BA96362232A@cofinpro.de>
References: <B31D602E-3E32-491A-8AE3-5BA96362232A@cofinpro.de>
Message-ID: <1879433522.649.1541703888436.JavaMail.zimbra@tech-advantage.com>

Hi Gregor,

I had the same questioning about other email-events.
My guess is that not verified email could be wrong and than lead to keycloak spamming the world.
It would be useless implement and maintain bounce logic whereas there is a verification process available, and thus to use a verified email for this purpose.

One may ask : should verified-email be reconfirmed on a periodic schedule so abandoned addresses be unused ?

-- 
Ionel GARDAIS
Tech'Advantage CIO - IT Team manager

----- Mail original -----
De: "Gregor Tudan" <Gregor.Tudan at cofinpro.de>
?: "keycloak-user" <keycloak-user at lists.jboss.org>
Envoy?: Jeudi 8 Novembre 2018 11:30:47
Objet: [FGTSPAM] [keycloak-user] Email-Event UPDATE-PASSWORD

Hi,

We?re trying to send an email to a user if his/her password was changed. The Email-Event UPDATE-PASSWORD looks exactly like what we want.

https://github.com/keycloak/keycloak/blob/master/services/src/main/java/org/keycloak/events/email/EmailEventListenerProvider.java <https://github.com/keycloak/keycloak/blob/master/services/src/main/java/org/keycloak/events/email/EmailEventListenerProvider.java>

There?s one catch: the email seems to only get sent if the user has a verified email address. Email-Verification is not activated on the realm.
Is there a reason why email-verification is required for those emails?

Thanks,
Gregor

_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
--
232 avenue Napoleon BONAPARTE 92500 RUEIL MALMAISON
Capital EUR 219 300,00 - RCS Nanterre B 408 832 301 - TVA FR 09 408 832 301



From rmbyrd at dstsystems.com  Thu Nov  8 14:44:00 2018
From: rmbyrd at dstsystems.com (Byrd, Rob M)
Date: Thu, 8 Nov 2018 19:44:00 +0000
Subject: [keycloak-user] Data filtering in SQL
In-Reply-To: <CAJrcDBffVsLL2_HPjeEBo1OrM__YYmf5s2q8M2m7YtzXEcisFw@mail.gmail.com>
References: <5BCF31B569C0A2468D7904C8E5839D690104C35356@DSKCMAIL1WC.ad.dstsystems.com>
	<1541136118.4390.1.camel@acutus.pro>
	<5BCF31B569C0A2468D7904C8E5839D690104C368EF@DSKCMAIL1WC.ad.dstsystems.com>
	<1541630686.2778.1.camel@acutus.pro>
	<CAJrcDBffVsLL2_HPjeEBo1OrM__YYmf5s2q8M2m7YtzXEcisFw@mail.gmail.com>
Message-ID: <5BCF31B569C0A2468D7904C8E5839D690104C3759B@DSKCMAIL1WC.ad.dstsystems.com>

Thanks Dmitry and Pedro,

Pardon my simple-minded response below, but I am wondering how these specific items would work?  Dmitry, yes I agree your GET /projects/<project> and GET /projects scenario is on point for the issue ? I hope my questions below can further clarify the discussion.  Here, I will have to make a ?go or no-go? decision in about a week. ?  I would love to take on the challenge of searching for the ?holy grail? in this, but atm will need to figure out what Keycloak (or OPA, etc.) can confidently do today.

Thanks for the great discussion and continued help!

Questions
1) Simple role-based authorization policy seems doable.

  *   Ex: ?Only veterinarians are allowed to read pet profiles.?


2) But how to answer once more context is needed, such as one resource?s affinity to another?  Literally how does the application figure it out?  Like the below example would need a pet-veterinarian mapping resolved somehow, it seems:

  *   ?Only the treating veterinarian is allowed to read a pet?s profile.?


3) Keycloak has taken an example of ?Pet owners can access their own pet?s profiles.? and said we can write policies saying that "Only Owner" can access "/api/petservice/pet/{id}".  But how does the policy engine figure out who is the owner of /pet/2 vs /pet/3?
4) Similarly, an OPA blog https://blog.openpolicyagent.org/write-policy-in-opa-enforce-policy-in-sql-d9d24db93bf4 gives the example where ?Only the treating veterinarian is allowed to read a pet?s profile, and only when signed in from a device at the pet?s clinic?.  Again, it is easy enough to provide the OPA engine the target pet and the current device location, but how exactly is it determined who is the treating veterinarian of that pet and what clinic the pet belongs to?
5) In general, the security difficulty is constraining what a user can see/do in a particular feature, so how exactly would a policy engine bring back a subset of records that particular user can see (based on their affiliated company, etc.)?
6) Similarly, how exactly would a policy engine bring back all records but not the fields a user should not see (such as employee salary field, unless the user is a HR VIP)?  These last two could be likened to @PostAuth post-filtering in spring security.


Rob Byrd
DST
Solutions Lead
SS&C Technologies Inc.   |   1055 Broadway, Kansas City, MO 64105
t: (816) 435-7286  | m (816) 509-0119
rmbyrd at dstsystems.com<mailto:rmbyrd at dstsystems.com>  |  www.ssctech.com<http://www.ssctech.com/>
Follow us: [cid:image001.png at 01D412C1.A14C5770] <https://www.linkedin.com/company/ss-c-technologies/>  |  [cid:image002.png at 01D412C1.A14C5770] <https://twitter.com/ssctechnologies>  |  [cid:image003.png at 01D412C1.A14C5770] <https://www.facebook.com/ssctechnologies/>

From: Pedro Igor Silva [mailto:psilva at redhat.com]
Sent: Thursday, November 8, 2018 6:42 AM
To: Dmitry Telegin <dt at acutus.pro>
Cc: Byrd, Rob M <rmbyrd at dstsystems.com>; keycloak-user <keycloak-user at lists.jboss.org>
Subject: Re: [keycloak-user] Data filtering in SQL

Hi Dmitry,

Agree with you when you mention application vs data security. I also agree that Keycloak can also solve data security problems.

Privacy is one of the main reasons behind our UMA support a very important aspect of data security. In addition to privacy, we also added extensions to UMA and OAuth2 standards to enable applications to use Keycloak as a Policy Decision Point, mainly target for application security.

As PDP (and PAP), Keycloak allows you to govern access to protected resources and to obtain authorization decisions as a result of the evaluation of policies associated with these resources. Being based on UMA and OAuth2 we support token-based authorization but also access control based on the permissions granted by the server. So, yeah, it should be possible to filter data based on those permissions as well dynamically create WHERE clauses.

My main concerns about data security are scalability and manageability, two aspects that are closely related to how much fine-grained you want to be. Like I said, in Keycloak you can protect a set of one or more resources as well as scope specific permissions, which can span access decisions for one or more resources.

We are using data security when you enable permissions to users or groups, where results are filtered based on the evaluation of these permissions. Performance wise, evaluation is quite satisfactory, being the main challenges the trade-off between usability vs performance. Recently we had important changes to improve the performance of our token endpoint and policy evaluation engine and I think we can perform well when fetching permissions from the server for a set of one or more resources.

I'm happy to discuss how we can leverage what we have for data security if the community is interested.

Regards.
Pedro Igor

On Wed, Nov 7, 2018 at 8:47 PM Dmitry Telegin <dt at acutus.pro<mailto:dt at acutus.pro>> wrote:
Hi Rob,

On Tue, 2018-11-06 at 16:28 +0000, Byrd, Rob M wrote:
> (Hope this is the correct way to reply - let me know if not)
>
> Thanks.  So my concern is really with the whole idea that an Enterprise Application's security constraints could really be all implemented based on url-patterns, is that what you guys are thinking?

Cannot speak for Keycloak guys, but will put in my 2? as an architect - URL-based (or rather resource-based) authorization covers only one aspect of the application security. Data filtering is equally important, but it's just another facet of the problem, and needs to be solved accordingly.
Indeed, Keycloak doesn't provide OOTB any means for automatically limiting subsets of data shown to the user, as Keycloak has a completely different scope (namely Web SSO/IDM solution).

However, you can still use Keycloak as a central warehouse for your security (meta)data, and use it the way you want. Like I said before, nothing stops you from defining some policies in Keycloak, then retrieving them and converting to a WHERE clause for your SQL/JPQL/NoSQL query.

Speaking of NoSQL - this might be not directly relevant to your problem, but still interesting. A similar problem has surfaced in the discussion following my talk on Apache Sling + Keycloak [1] earlier this year; the central point was: "okay, we can have Keycloak path-based authorization in Sling, but how do we limit the content visible to the user?"
That time we came up with some sort of hybrid solution, like path-based security + JCR ACLs and/or application-level rules; but now I think this might be something similar, like generating JCR's equivalent to the WHERE clause based on Keycloak policy definition.

Just to make sure I understand the case, let's imagine:
- there are users and groups (live in Keycloak);
- there are, say, "projects" (live in business tier + DB);
- there is a policy in Keycloak saying "projects should be accessible only to the members of the respective groups";
- based on that:
 - GET /projects/<project> should return 200 + representation if the user is a member of the group, 403 otherwise;
 - GET /projects should return the list of projects the current user has access to.

Is this correct?

[1] https://adapt.to/2018/en/schedule/modern-authentication-in-sling-with-openid-connect-and-keycloak.html

Cheers,
Dmitry Telegin
CTO, Acutus s.r.o.
Keycloak Consulting and Training

Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
+42 (022) 888-30-71
E-mail: info at acutus.pro<mailto:info at acutus.pro>

>
> For example, mostly a user can visit most features (urls) in an application, but it is the subset of things they can see/do within the feature that is the crux of the security issue - and it does not seem feasible to architect urls in such a way that they can be used as the key to security.  Thoughts?
>
> Thanks!
>
> Rob Byrd
> DST
> Solutions Lead
> SS&C Technologies Inc.   |   1055 Broadway, Kansas City, MO 64105
> t: (816) 435-7286  | m (816) 509-0119
> rmbyrd at dstsystems.com<mailto:rmbyrd at dstsystems.com>  |  www.ssctech.com<http://www.ssctech.com>
> Follow us:  |   |
>
> -----Original Message-----
> > From: Dmitry Telegin [mailto:dt at acutus.pro<mailto:dt at acutus.pro>]
> Sent: Friday, November 2, 2018 12:22 AM
> > To: Byrd, Rob M <rmbyrd at dstsystems.com<mailto:rmbyrd at dstsystems.com>>; keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>
> Subject: Re: [keycloak-user] Data filtering in SQL
>
> Hello Rob,
>
> If I get it right, it's all about generating SQL WHERE clause from Keycloak policies? I think this is doable, as Keycloak has a well-defined object model for authorization policies, and it's easy to obtain policy definitions in JSON format. I think Pedro Igor will tell you more about that.
>
> You should pay attention to the following:
> - there are differences in semantics between OPA and Keycloak policies. For example, Keycloak policies do not operate HTTP methods but rather use more generic notion of scopes;
> - not every policy type can be easily converted to a WHERE clause. It should be trivial for User/Group/Role policies, but is virtually impossible for Script and Rules, as they are just blackboxes that evaluate to true or false. Unless of course your DBMS has a built-in JavaScript engine :)
>
> Good luck!
> Dmitry Telegin
> CTO, Acutus s.r.o.
> Keycloak Consulting and Training
>
> Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
> +42 (022) 888-30-71
> E-mail: info at acutus.pro<mailto:info at acutus.pro>
>
> On Thu, 2018-11-01 at 21:39 +0000, Byrd, Rob M wrote:
> > I am comparing OPA authorization to Keycloak - how could I enforce Keycloak policy in the SQL closest to the data for good performance, including returning subsets of lists?  OPA discusses this at https://blog.openpolicyagent.org/write-policy-in-opa-enforce-policy-in-sql-d9d24db93bf4.
> >
> > Thanks!
> >
> > Rob Byrd
> > DST
> > Solutions Lead
> > SS&C Technologies Inc.   |   1055 Broadway, Kansas City, MO 64105
> > t: (816) 435-7286  | m (816) 509-0119
> > rmbyrd at dstsystems.com<mailto:rmbyrd at dstsystems.com><mailto:rmbyrd at dstsystems.com<mailto:rmbyrd at dstsystems.com>>  |  www.ssctech.com<http://www.ssctech.com><http://www.ssctech.com/>;;
> > > > Follow us: [cid:image001.png at 01D412C1.A14C5770] <https://www.linkedin.com/company/ss-c-technologies/>  |  [cid:image002.png at 01D412C1.A14C5770] <https://twitter.com/ssctechnologies>  |  [cid:image003.png at 01D412C1.A14C5770] <https://www.facebook.com/ssctechnologies/>
> >
> >
> >
> > Please consider the environment before printing this email and any attachments.
> >
> > This e-mail and any attachments are intended only for the individual or company to which it is addressed and may contain information which is privileged, confidential and prohibited from disclosure or unauthorized use under applicable law. If you are not the intended recipient of this e-mail, you are hereby notified that any use, dissemination, or copying of this e-mail or the information contained in this e-mail is strictly prohibited by the sender. If you have received this transmission in error, please return the material received to the sender and delete all copies from your system.
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
>
>
> Please consider the environment before printing this email and any attachments.
>
> This e-mail and any attachments are intended only for the individual or company to which it is addressed and may contain information which is privileged, confidential and prohibited from disclosure or unauthorized use under applicable law. If you are not the intended recipient of this e-mail, you are hereby notified that any use, dissemination, or copying of this e-mail or the information contained in this e-mail is strictly prohibited by the sender. If you have received this transmission in error, please return the material received to the sender and delete all copies from your system.
_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user


Please consider the environment before printing this email and any attachments.

This e-mail and any attachments are intended only for the individual or company to which it is addressed and may contain information which is privileged, confidential and prohibited from disclosure or unauthorized use under applicable law. If you are not the intended recipient of this e-mail, you are hereby notified that any use, dissemination, or copying of this e-mail or the information contained in this e-mail is strictly prohibited by the sender. If you have received this transmission in error, please return the material received to the sender and delete all copies from your system.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.png
Type: image/png
Size: 588 bytes
Desc: image001.png
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20181108/d9f2d33f/attachment-0003.png 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image002.png
Type: image/png
Size: 607 bytes
Desc: image002.png
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20181108/d9f2d33f/attachment-0004.png 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image003.png
Type: image/png
Size: 566 bytes
Desc: image003.png
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20181108/d9f2d33f/attachment-0005.png 

From psilva at redhat.com  Thu Nov  8 15:20:13 2018
From: psilva at redhat.com (Pedro Igor Silva)
Date: Thu, 8 Nov 2018 18:20:13 -0200
Subject: [keycloak-user] Data filtering in SQL
In-Reply-To: <5BCF31B569C0A2468D7904C8E5839D690104C3759B@DSKCMAIL1WC.ad.dstsystems.com>
References: <5BCF31B569C0A2468D7904C8E5839D690104C35356@DSKCMAIL1WC.ad.dstsystems.com>
	<1541136118.4390.1.camel@acutus.pro>
	<5BCF31B569C0A2468D7904C8E5839D690104C368EF@DSKCMAIL1WC.ad.dstsystems.com>
	<1541630686.2778.1.camel@acutus.pro>
	<CAJrcDBffVsLL2_HPjeEBo1OrM__YYmf5s2q8M2m7YtzXEcisFw@mail.gmail.com>
	<5BCF31B569C0A2468D7904C8E5839D690104C3759B@DSKCMAIL1WC.ad.dstsystems.com>
Message-ID: <CAJrcDBfZoVb0LLhqUqNzNAR2otTvnVWkkaWxvNar80fs9ncYiQ@mail.gmail.com>

On Thu, Nov 8, 2018 at 5:44 PM Byrd, Rob M <rmbyrd at dstsystems.com> wrote:

> Thanks Dmitry and Pedro,
>
>
>
> Pardon my simple-minded response below, but I am wondering how these
> specific items would work?  Dmitry, yes I agree your GET
> /projects/<project> and GET /projects scenario is on point for the issue ?
> I hope my questions below can further clarify the discussion.  Here, I will
> have to make a ?go or no-go? decision in about a week. J  I would love to
> take on the challenge of searching for the ?holy grail? in this, but atm
> will need to figure out what Keycloak (or OPA, etc.) can confidently do
> today.
>
>
>
> Thanks for the great discussion and continued help!
>
>
>
> Questions
>
> 1) Simple role-based authorization policy seems doable.
>
>    - Ex: ?Only veterinarians are allowed to read pet profiles.?
>
>
>
> 2) But how to answer once more context is needed, such as one resource?s
> affinity to another?  Literally how does the application figure it out?
> Like the below example would need a pet-veterinarian mapping resolved
> somehow, it seems:
>
>    - ?Only the treating veterinarian is allowed to read a pet?s profile.?
>
> Just like in OPA, but using a different approach, you can also push
information (the input in OPA) to your policies. We call this "pushing
claims" [1]. In our policy enforcer we also have the concept of a Claim
Information Point [2] (similar concent as a PIP) which you can configure to
automatically push claims to your policies when checking access for a
particular resource. There is also a CIP that allows you to fetch claims
from external services.

Besides, a resource in Keycloak has attributes, which can be anything you
want. So you could, for instance, have a Pet Foo resources in Keycloak and
update a "veterinarian" attribute associated with it. So you could have a
policy that checks if the user making the request is the same defined in
the attribute.

[1]
https://www.keycloak.org/docs/latest/authorization_services/index.html#_service_pushing_claims
[2]
https://www.keycloak.org/docs/latest/authorization_services/index.html#_enforcer_claim_information_point


>
>    -
>
>
>
> 3) Keycloak has taken an example of ?Pet owners can access their own pet?s
> profiles.? and said we can write policies saying that "Only Owner" can
> access "/api/petservice/pet/{id}".  But how does the policy engine figure
> out who is the owner of /pet/2 vs /pet/3?
>
 I can think two options. Like I mentioned before, we are resource-based
and resources have an owner. So you can write policies that check if the
resource owner is the user making the authorization request. Another option
is to push claims.

> 4) Similarly, an OPA blog
> https://blog.openpolicyagent.org/write-policy-in-opa-enforce-policy-in-sql-d9d24db93bf4
> gives the example where ?Only the treating veterinarian is allowed to read
> a pet?s profile, and only when signed in from a device at the pet?s
> clinic?.  Again, it is easy enough to provide the OPA engine the target pet
> and the current device location, but how exactly is it determined who is
> the treating veterinarian of that pet and what clinic the pet belongs to?
>
5) In general, the security difficulty is constraining what a user can
> see/do in a particular feature, so how exactly would a policy engine bring
> back a subset of records that particular user can see (based on their
> affiliated company, etc.)?
>
> 6) Similarly, how exactly would a policy engine bring back all records but
> not the fields a user should not see (such as employee salary field, unless
> the user is a HR VIP)?  These last two could be likened to @PostAuth
> post-filtering in spring security.
>
You can have all those resources protected by Keycloak and make
authorization requests to obtain the resources a user has access. We
provide a REST API to create resources. And that is the point I tried to
make when I said that data security is not really among the use cases we
are trying to solve. Although it is possible. Keycloak allows you to send a
"give me all" permission request. That means returning permissions for any
resource, managed by Keycloak, that an user can access. But yeah, depending
on how many resources you have you may end up with a huge response and a
bad performance.

Another approach is define a single Employee resource with a Salary scope
to represent all your employees. So you could enforce access to your real
employees and their salary based on the decisions made by the server for
this single resource.

The decision for one approach or another really depends on how fine grained
you want to be, like I mentioned before. Do you need to manage indivudual
employees or they all share the same access policies ?

See this
https://github.com/keycloak/keycloak-quickstarts/tree/master/app-authz-rest-employee
.

Regarding  fields (e.g: salary) you could consider it as a scope associated
with a resource. In Keycloak you can define permissions for scopes, not
only for resources.

>
>
>
>
> Rob Byrd
>
> DST
>
> Solutions Lead
>
> SS&C Technologies Inc.   |   1055 Broadway, Kansas City, MO 64105
>
> t: (816) 435-7286  *| *m (816) 509-0119
>
> *rmbyrd at dstsystems.com <rmbyrd at dstsystems.com>*  |  *www.ssctech.com
> <http://www.ssctech.com/>*
>
> Follow us: [image: cid:image001.png at 01D412C1.A14C5770]
> <https://www.linkedin.com/company/ss-c-technologies/> |  [image:
> cid:image002.png at 01D412C1.A14C5770] <https://twitter.com/ssctechnologies> |
> [image: cid:image003.png at 01D412C1.A14C5770]
> <https://www.facebook.com/ssctechnologies/>
>
>
>
> *From:* Pedro Igor Silva [mailto:psilva at redhat.com]
> *Sent:* Thursday, November 8, 2018 6:42 AM
> *To:* Dmitry Telegin <dt at acutus.pro>
> *Cc:* Byrd, Rob M <rmbyrd at dstsystems.com>; keycloak-user <
> keycloak-user at lists.jboss.org>
> *Subject:* Re: [keycloak-user] Data filtering in SQL
>
>
>
> Hi Dmitry,
>
>
>
> Agree with you when you mention application vs data security. I also agree
> that Keycloak can also solve data security problems.
>
>
>
> Privacy is one of the main reasons behind our UMA support a very important
> aspect of data security. In addition to privacy, we also added extensions
> to UMA and OAuth2 standards to enable applications to use Keycloak as a
> Policy Decision Point, mainly target for application security.
>
>
>
> As PDP (and PAP), Keycloak allows you to govern access to protected
> resources and to obtain authorization decisions as a result of the
> evaluation of policies associated with these resources. Being based on UMA
> and OAuth2 we support token-based authorization but also access control
> based on the permissions granted by the server. So, yeah, it should be
> possible to filter data based on those permissions as well dynamically
> create WHERE clauses.
>
>
>
> My main concerns about data security are scalability and manageability,
> two aspects that are closely related to how much fine-grained you want to
> be. Like I said, in Keycloak you can protect a set of one or more resources
> as well as scope specific permissions, which can span access decisions for
> one or more resources.
>
>
>
> We are using data security when you enable permissions to users or groups,
> where results are filtered based on the evaluation of these permissions.
> Performance wise, evaluation is quite satisfactory, being the main
> challenges the trade-off between usability vs performance. Recently we had
> important changes to improve the performance of our token endpoint and
> policy evaluation engine and I think we can perform well when fetching
> permissions from the server for a set of one or more resources.
>
>
>
> I'm happy to discuss how we can leverage what we have for data security if
> the community is interested.
>
>
>
> Regards.
>
> Pedro Igor
>
>
>
> On Wed, Nov 7, 2018 at 8:47 PM Dmitry Telegin <dt at acutus.pro> wrote:
>
> Hi Rob,
>
> On Tue, 2018-11-06 at 16:28 +0000, Byrd, Rob M wrote:
> > (Hope this is the correct way to reply - let me know if not)
> >
> > Thanks.  So my concern is really with the whole idea that an Enterprise
> Application's security constraints could really be all implemented based on
> url-patterns, is that what you guys are thinking?
>
> Cannot speak for Keycloak guys, but will put in my 2? as an architect -
> URL-based (or rather resource-based) authorization covers only one aspect
> of the application security. Data filtering is equally important, but it's
> just another facet of the problem, and needs to be solved accordingly.
> Indeed, Keycloak doesn't provide OOTB any means for automatically limiting
> subsets of data shown to the user, as Keycloak has a completely different
> scope (namely Web SSO/IDM solution).
>
> However, you can still use Keycloak as a central warehouse for your
> security (meta)data, and use it the way you want. Like I said before,
> nothing stops you from defining some policies in Keycloak, then retrieving
> them and converting to a WHERE clause for your SQL/JPQL/NoSQL query.
>
> Speaking of NoSQL - this might be not directly relevant to your problem,
> but still interesting. A similar problem has surfaced in the discussion
> following my talk on Apache Sling + Keycloak [1] earlier this year; the
> central point was: "okay, we can have Keycloak path-based authorization in
> Sling, but how do we limit the content visible to the user?"
> That time we came up with some sort of hybrid solution, like path-based
> security + JCR ACLs and/or application-level rules; but now I think this
> might be something similar, like generating JCR's equivalent to the WHERE
> clause based on Keycloak policy definition.
>
> Just to make sure I understand the case, let's imagine:
> - there are users and groups (live in Keycloak);
> - there are, say, "projects" (live in business tier + DB);
> - there is a policy in Keycloak saying "projects should be accessible only
> to the members of the respective groups";
> - based on that:
>  - GET /projects/<project> should return 200 + representation if the user
> is a member of the group, 403 otherwise;
>  - GET /projects should return the list of projects the current user has
> access to.
>
> Is this correct?
>
> [1]
> https://adapt.to/2018/en/schedule/modern-authentication-in-sling-with-openid-connect-and-keycloak.html
>
> Cheers,
> Dmitry Telegin
> CTO, Acutus s.r.o.
> Keycloak Consulting and Training
>
> Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
> +42 (022) 888-30-71
> E-mail: info at acutus.pro
>
> >
> > For example, mostly a user can visit most features (urls) in an
> application, but it is the subset of things they can see/do within the
> feature that is the crux of the security issue - and it does not seem
> feasible to architect urls in such a way that they can be used as the key
> to security.  Thoughts?
> >
> > Thanks!
> >
> > Rob Byrd
> > DST
> > Solutions Lead
> > SS&C Technologies Inc.   |   1055 Broadway, Kansas City, MO 64105
> > t: (816) 435-7286  | m (816) 509-0119
> > rmbyrd at dstsystems.com  |  www.ssctech.com
> > Follow us:  |   |
> >
> > -----Original Message-----
> > > From: Dmitry Telegin [mailto:dt at acutus.pro]
> > Sent: Friday, November 2, 2018 12:22 AM
> > > To: Byrd, Rob M <rmbyrd at dstsystems.com>; keycloak-user at lists.jboss.org
> > Subject: Re: [keycloak-user] Data filtering in SQL
> >
> > Hello Rob,
> >
> > If I get it right, it's all about generating SQL WHERE clause from
> Keycloak policies? I think this is doable, as Keycloak has a well-defined
> object model for authorization policies, and it's easy to obtain policy
> definitions in JSON format. I think Pedro Igor will tell you more about
> that.
> >
> > You should pay attention to the following:
> > - there are differences in semantics between OPA and Keycloak policies.
> For example, Keycloak policies do not operate HTTP methods but rather use
> more generic notion of scopes;
> > - not every policy type can be easily converted to a WHERE clause. It
> should be trivial for User/Group/Role policies, but is virtually impossible
> for Script and Rules, as they are just blackboxes that evaluate to true or
> false. Unless of course your DBMS has a built-in JavaScript engine :)
> >
> > Good luck!
> > Dmitry Telegin
> > CTO, Acutus s.r.o.
> > Keycloak Consulting and Training
> >
> > Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
> > +42 (022) 888-30-71
> > E-mail: info at acutus.pro
> >
> > On Thu, 2018-11-01 at 21:39 +0000, Byrd, Rob M wrote:
> > > I am comparing OPA authorization to Keycloak - how could I enforce
> Keycloak policy in the SQL closest to the data for good performance,
> including returning subsets of lists?  OPA discusses this at
> https://blog.openpolicyagent.org/write-policy-in-opa-enforce-policy-in-sql-d9d24db93bf4
> .
> > >
> > > Thanks!
> > >
> > > Rob Byrd
> > > DST
> > > Solutions Lead
> > > SS&C Technologies Inc.   |   1055 Broadway, Kansas City, MO 64105
> > > t: (816) 435-7286  | m (816) 509-0119
> > > rmbyrd at dstsystems.com<mailto:rmbyrd at dstsystems.com>  |
> www.ssctech.com<http://www.ssctech.com/>;;
> > > > > Follow us: [cid:image001.png at 01D412C1.A14C5770] <
> https://www.linkedin.com/company/ss-c-technologies/>  |  [
> cid:image002.png at 01D412C1.A14C5770] <https://twitter.com/ssctechnologies
> >  |  [cid:image003.png at 01D412C1.A14C5770] <
> https://www.facebook.com/ssctechnologies/>
> > >
> > >
> > >
> > > Please consider the environment before printing this email and any
> attachments.
> > >
> > > This e-mail and any attachments are intended only for the individual
> or company to which it is addressed and may contain information which is
> privileged, confidential and prohibited from disclosure or unauthorized use
> under applicable law. If you are not the intended recipient of this e-mail,
> you are hereby notified that any use, dissemination, or copying of this
> e-mail or the information contained in this e-mail is strictly prohibited
> by the sender. If you have received this transmission in error, please
> return the material received to the sender and delete all copies from your
> system.
> > > _______________________________________________
> > > keycloak-user mailing list
> > > keycloak-user at lists.jboss.org
> > > https://lists.jboss.org/mailman/listinfo/keycloak-user
> >
> >
> > Please consider the environment before printing this email and any
> attachments.
> >
> > This e-mail and any attachments are intended only for the individual or
> company to which it is addressed and may contain information which is
> privileged, confidential and prohibited from disclosure or unauthorized use
> under applicable law. If you are not the intended recipient of this e-mail,
> you are hereby notified that any use, dissemination, or copying of this
> e-mail or the information contained in this e-mail is strictly prohibited
> by the sender. If you have received this transmission in error, please
> return the material received to the sender and delete all copies from your
> system.
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
> ------------------------------
> Please consider the environment before printing this email and any
> attachments.
>
> This e-mail and any attachments are intended only for the individual or
> company to which it is addressed and may contain information which is
> privileged, confidential and prohibited from disclosure or unauthorized use
> under applicable law. If you are not the intended recipient of this e-mail,
> you are hereby notified that any use, dissemination, or copying of this
> e-mail or the information contained in this e-mail is strictly prohibited
> by the sender. If you have received this transmission in error, please
> return the material received to the sender and delete all copies from your
> system.
>
>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.png
Type: image/png
Size: 588 bytes
Desc: not available
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20181108/6e5f4505/attachment.png 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image002.png
Type: image/png
Size: 607 bytes
Desc: not available
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20181108/6e5f4505/attachment-0001.png 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image003.png
Type: image/png
Size: 566 bytes
Desc: not available
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20181108/6e5f4505/attachment-0002.png 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.png
Type: image/png
Size: 588 bytes
Desc: not available
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20181108/6e5f4505/attachment-0003.png 

From rmbyrd at dstsystems.com  Thu Nov  8 18:26:50 2018
From: rmbyrd at dstsystems.com (Byrd, Rob M)
Date: Thu, 8 Nov 2018 23:26:50 +0000
Subject: [keycloak-user] Data filtering in SQL
In-Reply-To: <CAJrcDBfZoVb0LLhqUqNzNAR2otTvnVWkkaWxvNar80fs9ncYiQ@mail.gmail.com>
References: <5BCF31B569C0A2468D7904C8E5839D690104C35356@DSKCMAIL1WC.ad.dstsystems.com>
	<1541136118.4390.1.camel@acutus.pro>
	<5BCF31B569C0A2468D7904C8E5839D690104C368EF@DSKCMAIL1WC.ad.dstsystems.com>
	<1541630686.2778.1.camel@acutus.pro>
	<CAJrcDBffVsLL2_HPjeEBo1OrM__YYmf5s2q8M2m7YtzXEcisFw@mail.gmail.com>
	<5BCF31B569C0A2468D7904C8E5839D690104C3759B@DSKCMAIL1WC.ad.dstsystems.com>
	<CAJrcDBfZoVb0LLhqUqNzNAR2otTvnVWkkaWxvNar80fs9ncYiQ@mail.gmail.com>
Message-ID: <5BCF31B569C0A2468D7904C8E5839D690104C378C5@DSKCMAIL1WC.ad.dstsystems.com>

Pedro,



That is helping my understanding some, thank you.  I understand your recommendations on dealing with separating the employee's Salary field in my example too.  Please see follow-up questions below.



String resource attributes statically in keycloak:

2.1) I had been thinking of Resource as a type of resource to this point not a specific instance.  But now I don't see how your suggestion of basically using the resource attribute to store a foreign key (ie. pet's veterinarian) will work unless we are talking about each individual pet instance being a keycloak resource.  Similarly it was mentioned pet 1 and pet 2 could have a meaningful Owner in keycloak, which again is making me think that instances are being suggested to store along with entity-relationships basically.  So, should I instead be thinking of keycloak resources as storing single instances of items in our system?

2.2) This relatively static storage of resources plus extra attributes like foreign keys seems to basically push/duplicate our business model of data into keycloak, to some degree, correct?  And the more keycloak needs to decide, the more gets duplicated into keycloak?



Push claims:

2.3) The push claim alternative seems to be having application logic fetch more context as needed for the permission evaluation.  This might work okay when going after a single entity or asking singular questions of the application logic ? but for lists, such as a user seeing his list of 100 transaction history records amongst the 1 million transaction history records on the system, would a question be asked for each of the 1 million records, one at a time?



Post-filtering of records:

2.4) A use case I still seek clarification on is the "post-filtering of records", which I was trying to get at with my previous question #5.  Stated in another way - say a financial database has 1 million transaction records across thousands of users. Every user is allowed to see transaction history records view, but only the ones they transacted.  So, a single user viewing all transactions of the transaction history feature/resource should (obviously) only be able to see all HIS transactions, not all 1 million on the database.  Spring Security would have @PostAuth for this (though its drawback is slow db performance on first query that does a db table scan and brings back everything to the middle tier, which then inefficiently whittles it down to just what pertains to the user).  My question is what ways would this post-filtering of records be handled in Keycloak?  With what I know so far, I am guessing at keycloak basic options:

a) Have each of 1mil transaction records managed by Keycloak, add a "creator" attribute for who instigated the transaction, and have that user identifier stored on each record so Keycloak can do the filtering down to the 100 correct records

b) Receive a push claim, for each of the 1mil transaction records, indicating who the "creator" is, so it may be matched against the current user and thus filter down to the 100 correct records

c) During evaluation, the policy engine can call out to a service somewhere to get the primary keys of the subset of records this user can see (this may be like a Claim Information Point), then whittle the full list down to just those matching primary keys (kind of like sending an IN list of primary keys in a SQL WHERE clause)

d) Something more like the ?partial evaluation? that OPA blog and Dmitry has been talking about



General:

2.5) In general, it seems to me the bigger the chunks of extra context provided by application logic to the policy engine, the less detail about the actual constraints being enforced you have controlled and visible in the policy layer? somewhat defeating the purpose of the policy layer.  Does that sound correct?  I could see us offloading a ton of detail to the push claims ? rather than, say, duplicating more of our business model in keycloak ? and then realizing very little of our actual policy permission details are visible or controllable in the policy layer.  So I am not sure what we are getting at that point.

                a) An answer might be drawing the line at only role-based access control in the policy layer since that affinity is more easily provided as input (thought that could even be debated)

                b) Maybe we try to define and draw the line at ?resource-based? controls only in the policy layer

                c) Maybe we make the unit of work for each push claim so granular that truly all of the policy rules that are occurring are basically expressed in the policy layer (thus allowing control, flexibility and visibility in one consolidated place)



Thanks for your time.

Rob Byrd
DST
Solutions Lead
SS&C Technologies Inc.   |   1055 Broadway, Kansas City, MO 64105
t: (816) 435-7286  | m (816) 509-0119
rmbyrd at dstsystems.com<mailto:rmbyrd at dstsystems.com>  |  www.ssctech.com<http://www.ssctech.com/>
Follow us: [cid:image001.png at 01D412C1.A14C5770] <https://www.linkedin.com/company/ss-c-technologies/>  |  [cid:image002.png at 01D412C1.A14C5770] <https://twitter.com/ssctechnologies>  |  [cid:image003.png at 01D412C1.A14C5770] <https://www.facebook.com/ssctechnologies/>

From: Pedro Igor Silva [mailto:psilva at redhat.com]
Sent: Thursday, November 8, 2018 2:20 PM
To: Byrd, Rob M <rmbyrd at dstsystems.com>
Cc: Dmitry Telegin <dt at acutus.pro>; keycloak-user <keycloak-user at lists.jboss.org>
Subject: Re: [keycloak-user] Data filtering in SQL


On Thu, Nov 8, 2018 at 5:44 PM Byrd, Rob M <rmbyrd at dstsystems.com<mailto:rmbyrd at dstsystems.com>> wrote:
Thanks Dmitry and Pedro,

Pardon my simple-minded response below, but I am wondering how these specific items would work?  Dmitry, yes I agree your GET /projects/<project> and GET /projects scenario is on point for the issue ? I hope my questions below can further clarify the discussion.  Here, I will have to make a ?go or no-go? decision in about a week. ?  I would love to take on the challenge of searching for the ?holy grail? in this, but atm will need to figure out what Keycloak (or OPA, etc.) can confidently do today.

Thanks for the great discussion and continued help!

Questions
1) Simple role-based authorization policy seems doable.

  *   Ex: ?Only veterinarians are allowed to read pet profiles.?


2) But how to answer once more context is needed, such as one resource?s affinity to another?  Literally how does the application figure it out?  Like the below example would need a pet-veterinarian mapping resolved somehow, it seems:

  *   ?Only the treating veterinarian is allowed to read a pet?s profile.?
Just like in OPA, but using a different approach, you can also push information (the input in OPA) to your policies. We call this "pushing claims" [1]. In our policy enforcer we also have the concept of a Claim Information Point [2] (similar concent as a PIP) which you can configure to automatically push claims to your policies when checking access for a particular resource. There is also a CIP that allows you to fetch claims from external services.

Besides, a resource in Keycloak has attributes, which can be anything you want. So you could, for instance, have a Pet Foo resources in Keycloak and update a "veterinarian" attribute associated with it. So you could have a policy that checks if the user making the request is the same defined in the attribute.

[1] https://www.keycloak.org/docs/latest/authorization_services/index.html#_service_pushing_claims
[2] https://www.keycloak.org/docs/latest/authorization_services/index.html#_enforcer_claim_information_point


  *


3) Keycloak has taken an example of ?Pet owners can access their own pet?s profiles.? and said we can write policies saying that "Only Owner" can access "/api/petservice/pet/{id}".  But how does the policy engine figure out who is the owner of /pet/2 vs /pet/3?
 I can think two options. Like I mentioned before, we are resource-based and resources have an owner. So you can write policies that check if the resource owner is the user making the authorization request. Another option is to push claims.
4) Similarly, an OPA blog https://blog.openpolicyagent.org/write-policy-in-opa-enforce-policy-in-sql-d9d24db93bf4 gives the example where ?Only the treating veterinarian is allowed to read a pet?s profile, and only when signed in from a device at the pet?s clinic?.  Again, it is easy enough to provide the OPA engine the target pet and the current device location, but how exactly is it determined who is the treating veterinarian of that pet and what clinic the pet belongs to?
5) In general, the security difficulty is constraining what a user can see/do in a particular feature, so how exactly would a policy engine bring back a subset of records that particular user can see (based on their affiliated company, etc.)?
6) Similarly, how exactly would a policy engine bring back all records but not the fields a user should not see (such as employee salary field, unless the user is a HR VIP)?  These last two could be likened to @PostAuth post-filtering in spring security.
You can have all those resources protected by Keycloak and make authorization requests to obtain the resources a user has access. We provide a REST API to create resources. And that is the point I tried to make when I said that data security is not really among the use cases we are trying to solve. Although it is possible. Keycloak allows you to send a "give me all" permission request. That means returning permissions for any resource, managed by Keycloak, that an user can access. But yeah, depending on how many resources you have you may end up with a huge response and a bad performance.

Another approach is define a single Employee resource with a Salary scope to represent all your employees. So you could enforce access to your real employees and their salary based on the decisions made by the server for this single resource.

The decision for one approach or another really depends on how fine grained you want to be, like I mentioned before. Do you need to manage indivudual employees or they all share the same access policies ?

See this https://github.com/keycloak/keycloak-quickstarts/tree/master/app-authz-rest-employee.

Regarding  fields (e.g: salary) you could consider it as a scope associated with a resource. In Keycloak you can define permissions for scopes, not only for resources.


Rob Byrd
DST
Solutions Lead
SS&C Technologies Inc.   |   1055 Broadway, Kansas City, MO 64105
t: (816) 435-7286  | m (816) 509-0119
rmbyrd at dstsystems.com<mailto:rmbyrd at dstsystems.com>  |  www.ssctech.com<http://www.ssctech.com/>
Follow us: [cid:image001.png at 01D412C1.A14C5770] <https://www.linkedin.com/company/ss-c-technologies/>  |  [cid:image002.png at 01D412C1.A14C5770] <https://twitter.com/ssctechnologies>  |  [cid:image003.png at 01D412C1.A14C5770] <https://www.facebook.com/ssctechnologies/>

From: Pedro Igor Silva [mailto:psilva at redhat.com<mailto:psilva at redhat.com>]
Sent: Thursday, November 8, 2018 6:42 AM
To: Dmitry Telegin <dt at acutus.pro<mailto:dt at acutus.pro>>
Cc: Byrd, Rob M <rmbyrd at dstsystems.com<mailto:rmbyrd at dstsystems.com>>; keycloak-user <keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>>
Subject: Re: [keycloak-user] Data filtering in SQL

Hi Dmitry,

Agree with you when you mention application vs data security. I also agree that Keycloak can also solve data security problems.

Privacy is one of the main reasons behind our UMA support a very important aspect of data security. In addition to privacy, we also added extensions to UMA and OAuth2 standards to enable applications to use Keycloak as a Policy Decision Point, mainly target for application security.

As PDP (and PAP), Keycloak allows you to govern access to protected resources and to obtain authorization decisions as a result of the evaluation of policies associated with these resources. Being based on UMA and OAuth2 we support token-based authorization but also access control based on the permissions granted by the server. So, yeah, it should be possible to filter data based on those permissions as well dynamically create WHERE clauses.

My main concerns about data security are scalability and manageability, two aspects that are closely related to how much fine-grained you want to be. Like I said, in Keycloak you can protect a set of one or more resources as well as scope specific permissions, which can span access decisions for one or more resources.

We are using data security when you enable permissions to users or groups, where results are filtered based on the evaluation of these permissions. Performance wise, evaluation is quite satisfactory, being the main challenges the trade-off between usability vs performance. Recently we had important changes to improve the performance of our token endpoint and policy evaluation engine and I think we can perform well when fetching permissions from the server for a set of one or more resources.

I'm happy to discuss how we can leverage what we have for data security if the community is interested.

Regards.
Pedro Igor

On Wed, Nov 7, 2018 at 8:47 PM Dmitry Telegin <dt at acutus.pro<mailto:dt at acutus.pro>> wrote:
Hi Rob,

On Tue, 2018-11-06 at 16:28 +0000, Byrd, Rob M wrote:
> (Hope this is the correct way to reply - let me know if not)
>
> Thanks.  So my concern is really with the whole idea that an Enterprise Application's security constraints could really be all implemented based on url-patterns, is that what you guys are thinking?

Cannot speak for Keycloak guys, but will put in my 2? as an architect - URL-based (or rather resource-based) authorization covers only one aspect of the application security. Data filtering is equally important, but it's just another facet of the problem, and needs to be solved accordingly.
Indeed, Keycloak doesn't provide OOTB any means for automatically limiting subsets of data shown to the user, as Keycloak has a completely different scope (namely Web SSO/IDM solution).

However, you can still use Keycloak as a central warehouse for your security (meta)data, and use it the way you want. Like I said before, nothing stops you from defining some policies in Keycloak, then retrieving them and converting to a WHERE clause for your SQL/JPQL/NoSQL query.

Speaking of NoSQL - this might be not directly relevant to your problem, but still interesting. A similar problem has surfaced in the discussion following my talk on Apache Sling + Keycloak [1] earlier this year; the central point was: "okay, we can have Keycloak path-based authorization in Sling, but how do we limit the content visible to the user?"
That time we came up with some sort of hybrid solution, like path-based security + JCR ACLs and/or application-level rules; but now I think this might be something similar, like generating JCR's equivalent to the WHERE clause based on Keycloak policy definition.

Just to make sure I understand the case, let's imagine:
- there are users and groups (live in Keycloak);
- there are, say, "projects" (live in business tier + DB);
- there is a policy in Keycloak saying "projects should be accessible only to the members of the respective groups";
- based on that:
 - GET /projects/<project> should return 200 + representation if the user is a member of the group, 403 otherwise;
 - GET /projects should return the list of projects the current user has access to.

Is this correct?

[1] https://adapt.to/2018/en/schedule/modern-authentication-in-sling-with-openid-connect-and-keycloak.html

Cheers,
Dmitry Telegin
CTO, Acutus s.r.o.
Keycloak Consulting and Training

Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
+42 (022) 888-30-71
E-mail: info at acutus.pro<mailto:info at acutus.pro>

>
> For example, mostly a user can visit most features (urls) in an application, but it is the subset of things they can see/do within the feature that is the crux of the security issue - and it does not seem feasible to architect urls in such a way that they can be used as the key to security.  Thoughts?
>
> Thanks!
>
> Rob Byrd
> DST
> Solutions Lead
> SS&C Technologies Inc.   |   1055 Broadway, Kansas City, MO 64105
> t: (816) 435-7286  | m (816) 509-0119
> rmbyrd at dstsystems.com<mailto:rmbyrd at dstsystems.com>  |  www.ssctech.com<http://www.ssctech.com>
> Follow us:  |   |
>
> -----Original Message-----
> > From: Dmitry Telegin [mailto:dt at acutus.pro<mailto:dt at acutus.pro>]
> Sent: Friday, November 2, 2018 12:22 AM
> > To: Byrd, Rob M <rmbyrd at dstsystems.com<mailto:rmbyrd at dstsystems.com>>; keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>
> Subject: Re: [keycloak-user] Data filtering in SQL
>
> Hello Rob,
>
> If I get it right, it's all about generating SQL WHERE clause from Keycloak policies? I think this is doable, as Keycloak has a well-defined object model for authorization policies, and it's easy to obtain policy definitions in JSON format. I think Pedro Igor will tell you more about that.
>
> You should pay attention to the following:
> - there are differences in semantics between OPA and Keycloak policies. For example, Keycloak policies do not operate HTTP methods but rather use more generic notion of scopes;
> - not every policy type can be easily converted to a WHERE clause. It should be trivial for User/Group/Role policies, but is virtually impossible for Script and Rules, as they are just blackboxes that evaluate to true or false. Unless of course your DBMS has a built-in JavaScript engine :)
>
> Good luck!
> Dmitry Telegin
> CTO, Acutus s.r.o.
> Keycloak Consulting and Training
>
> Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
> +42 (022) 888-30-71
> E-mail: info at acutus.pro<mailto:info at acutus.pro>
>
> On Thu, 2018-11-01 at 21:39 +0000, Byrd, Rob M wrote:
> > I am comparing OPA authorization to Keycloak - how could I enforce Keycloak policy in the SQL closest to the data for good performance, including returning subsets of lists?  OPA discusses this at https://blog.openpolicyagent.org/write-policy-in-opa-enforce-policy-in-sql-d9d24db93bf4.
> >
> > Thanks!
> >
> > Rob Byrd
> > DST
> > Solutions Lead
> > SS&C Technologies Inc.   |   1055 Broadway, Kansas City, MO 64105
> > t: (816) 435-7286  | m (816) 509-0119
> > rmbyrd at dstsystems.com<mailto:rmbyrd at dstsystems.com><mailto:rmbyrd at dstsystems.com<mailto:rmbyrd at dstsystems.com>>  |  www.ssctech.com<http://www.ssctech.com><http://www.ssctech.com/>;;
> > > > Follow us: [cid:image001.png at 01D412C1.A14C5770] <https://www.linkedin.com/company/ss-c-technologies/>  |  [cid:image002.png at 01D412C1.A14C5770] <https://twitter.com/ssctechnologies>  |  [cid:image003.png at 01D412C1.A14C5770] <https://www.facebook.com/ssctechnologies/>
> >
> >
> >
> > Please consider the environment before printing this email and any attachments.
> >
> > This e-mail and any attachments are intended only for the individual or company to which it is addressed and may contain information which is privileged, confidential and prohibited from disclosure or unauthorized use under applicable law. If you are not the intended recipient of this e-mail, you are hereby notified that any use, dissemination, or copying of this e-mail or the information contained in this e-mail is strictly prohibited by the sender. If you have received this transmission in error, please return the material received to the sender and delete all copies from your system.
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
>
>
> Please consider the environment before printing this email and any attachments.
>
> This e-mail and any attachments are intended only for the individual or company to which it is addressed and may contain information which is privileged, confidential and prohibited from disclosure or unauthorized use under applicable law. If you are not the intended recipient of this e-mail, you are hereby notified that any use, dissemination, or copying of this e-mail or the information contained in this e-mail is strictly prohibited by the sender. If you have received this transmission in error, please return the material received to the sender and delete all copies from your system.
_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user
________________________________
Please consider the environment before printing this email and any attachments.

This e-mail and any attachments are intended only for the individual or company to which it is addressed and may contain information which is privileged, confidential and prohibited from disclosure or unauthorized use under applicable law. If you are not the intended recipient of this e-mail, you are hereby notified that any use, dissemination, or copying of this e-mail or the information contained in this e-mail is strictly prohibited by the sender. If you have received this transmission in error, please return the material received to the sender and delete all copies from your system.


Please consider the environment before printing this email and any attachments.

This e-mail and any attachments are intended only for the individual or company to which it is addressed and may contain information which is privileged, confidential and prohibited from disclosure or unauthorized use under applicable law. If you are not the intended recipient of this e-mail, you are hereby notified that any use, dissemination, or copying of this e-mail or the information contained in this e-mail is strictly prohibited by the sender. If you have received this transmission in error, please return the material received to the sender and delete all copies from your system.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.png
Type: image/png
Size: 588 bytes
Desc: image001.png
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20181108/6cab18f1/attachment-0003.png 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image002.png
Type: image/png
Size: 607 bytes
Desc: image002.png
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20181108/6cab18f1/attachment-0004.png 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image003.png
Type: image/png
Size: 566 bytes
Desc: image003.png
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20181108/6cab18f1/attachment-0005.png 

From aechols at bfcsaz.com  Thu Nov  8 19:54:58 2018
From: aechols at bfcsaz.com (Aaron Echols)
Date: Thu, 8 Nov 2018 17:54:58 -0700
Subject: [keycloak-user] Account Page Fields
In-Reply-To: <811a3326-b848-39b5-1f74-68a550bb2d50@redhat.com>
References: <CAHj77GUKR+YwKA+9j_aKSMiK412ksttVQovfsqifA9gibquFRQ@mail.gmail.com>
	<1540878764.3824.3.camel@acutus.pro>
	<811a3326-b848-39b5-1f74-68a550bb2d50@redhat.com>
Message-ID: <CAHj77GXPdQoJCckkvgVGpG=Kp0ZAgA9itjnPV5zNuYYf=3sY5g@mail.gmail.com>

Oh, this is excellent news! Thanks :)
--
*Aaron Echols*

On Mon, Nov 5, 2018 at 6:40 AM Stan Silvert <ssilvert at redhat.com> wrote:

> On 10/30/2018 1:52 AM, Dmitry Telegin wrote:
> > Hello Aaron,
> >
> > I don't think this is easily doable with the current account UI.
> However, there are chances we will have it in the forthcoming rewrite
> thereof [1]. The revamped account UI should use REST APIs and be extensible
> with the means of React.js.
> >
> > This topic is of particular interest to me, as we in Mageia Linux are
> planning to migrate our IDM to Keycloak, and one of the problems to solve
> is to allow the users to upload their SSH pubkeys via the account UI. We're
> pretty determined to solve it, and to solve it soon, so stay tuned :)
> >
> > [1] https://issues.jboss.org/browse/KEYCLOAK-8421
> That's right.  A proof of concept has already been built and merged into
> the code base.  You will indeed be able to create your own React
> components as extensions for the account console.
>
> It's hard to say when this will be ready for prime time, but I'm
> shooting for a code-complete version in the first quarter of 2019.
> >
> > Cheers,
> > Dmitry Telegin
> > CTO, Acutus s.r.o.
> > Keycloak Consulting and Training
> >
> > Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
> > +42 (022) 888-30-71
> > E-mail: info at acutus.pro
> >
> > On Fri, 2018-10-26 at 15:35 -0700, Aaron Echols wrote:
> >> Hello All,
> >>
> >> How hard is to modify or add fields that could be modified in the users
> >> account page? It would be nice to add a personal email field to have be
> >> able to send their password reset email to. Currently, they can only
> send
> >> to their employee addresses, which if they forget their password, makes
> the
> >> email a moot point. Thank in advance for any ideas. :)
> >> --
> >> *Aaron Echols*
> >> _______________________________________________
> >> keycloak-user mailing list
> >> keycloak-user at lists.jboss.org
> >> https://lists.jboss.org/mailman/listinfo/keycloak-user
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
>
>
>

From dt at acutus.pro  Thu Nov  8 22:45:55 2018
From: dt at acutus.pro (Dmitry Telegin)
Date: Fri, 09 Nov 2018 06:45:55 +0300
Subject: [keycloak-user] OpenID Java Adapter: configuring keycloak to
 use an IDP different then Keycloak Server
In-Reply-To: <1541686439063.37605@cjsm.vlaanderen.be>
References: <1541686439063.37605@cjsm.vlaanderen.be>
Message-ID: <1541735155.15117.3.camel@acutus.pro>

Hello Fabrizio,

Indeed, string templates like "/realms/{realm-name}/protocol/openid-connect/auth" are hardcoded into Keycloak adapters [1] [2].

Luckily, there seems to be a workaround. In Keycloak, there is a mechanism for multitenancy [3]; it requires you to supply a resolver that would return a KeycloakDeployment instance based on request parameters.
One of its bonus features is that you can completely redefine the behavior of KeycloakDeployment. For example, you can extend org.keycloak.adapters.KeycloakDeployment and override its resolveUrls() method, to make the URLs point to your 3rd party IDP.

This approach doesn't require any modifications to the adapter code, so I'd recommend you start with it. However, I wouldn't rule out further incompatibilities that could pop up.

Another option is installing an intermediary Keycloak (server), configuring brokering to 3rd party IDP and pointing your adapter to Keycloak. Though sounds like an overkill, it's a bulletproof solution that should work 100% (and it also has some other benefits).

There are of course other options like using 3rd party IDP's equivalent for Keycloak adapter (is it Intuit BTW?), or using other OpenID Connect Java libraries [4], or even proxy-level adapters like apache-mod_auth_openidc [5] or Keycloak Gatekeeper [6]. But I understand that this would probably require code rewrite, so you should consider these options only as the last resort.

As for SAML and why it used to work: Keycloak adapter uses standard SAML SP metadata for configuration, which defines URLs strictly and unambiguously; here we need to admit that SAML is more mature and feature-complete.

OIDC, on the contrary, allows for some freedom. At the moment, Keycloak OIDC adapter doesn't use any standard metadata, but rather generates URLs using hardcoded templates. I think Keycloak adapter could use OIDC's rough equivalent for SAML metadata, namely "well-known" URLs.

You can experiment with your IDP and append ".well-known/openid-configuration" to its URL. If my conjecture about Intuit is correct, then it should look like this:
https://oauth.platform.intuit.com/op/v1/.well-known/openid-configuration

In theory, Keycloak OIDC adapter could ingest this metadata instead of hardcoding URL templates. To me, this could be a valuable addition, but surprisingly I don't see any?related JIRA issue. Maybe Keycloak developers could give us some feedback.

Cheers,
Dmitry Telegin
CTO, Acutus s.r.o.
Keycloak Consulting and Training

Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
+42 (022) 888-30-71
E-mail: info at acutus.pro

[1] https://github.com/keycloak/keycloak/blob/master/core/src/main/java/org/keycloak/constants/ServiceUrlConstants.java#L26
[2] https://github.com/keycloak/keycloak/blob/master/adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/KeycloakDeployment.java#L161
[3] https://www.keycloak.org/docs/latest/securing_apps/index.html#_multi_tenancy
[4] https://openid.net/developers/certified/
[5] https://github.com/zmartzone/mod_auth_openidc
[6] https://github.com/keycloak/keycloak-gatekeeper

On Thu, 2018-11-08 at 14:13 +0000, Usai, Fabrizio wrote:
> Dear,
> 
> 
> > We are using Keycloak Java adapter 4.5.0 in combination with EAP7.1. When we configure our keycloak.json we have for auth-server-url the url https://authentication.country.com/op/v1/auth (the original url is changed for privacy reasons). So far so good.
> 
> When we navigate to our application, we are forwarded to https://authentication.country.com/op/v1/auth/realms/KeycloakOIDCRealm/protocol/openid-connect/auth?response_type=code&client_id=fac9d161-d27d-493d-uze896zed78&redirect_uri=.....
> 
> This is not good, since we use our own identity provider. Removing the realms/KeycloakOIDCRealm/protocol/openid-connect/ part of the url, forwards it correctly to the identity provider. So the Keycloak adapter adds it by default, assuming we will always use Keycloak as an identity provider. Before we were using SAML and didn't had this issue.
> 
> How can we configure the keycloak.json for the adapter to leave out the addition of realms/KeycloakOIDCRealm/protocol/openid-connect/?
> 
> We don't understand why with SAML we didn't had this issue at all, and now with OpenID it seems very difficult to solve this issue. Our current guess to solve this, is to overwrite some Keycloak Java class and make sure the url is built the correct way. Although it is a bit dirty, we could accept this as solution (if it is possible), but we prefer to do this via configuration.
> 
> 
> Kind regards,
> 
> Fabrizio Usai
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From dt at acutus.pro  Thu Nov  8 23:13:56 2018
From: dt at acutus.pro (Dmitry Telegin)
Date: Fri, 09 Nov 2018 07:13:56 +0300
Subject: [keycloak-user] Login via SAML RESPONSE from an IdP
In-Reply-To: <ce084148ab0043aab89c665f24f57744@CEEXC0523.ZURMWS.CSCMWS.COM>
References: <ce084148ab0043aab89c665f24f57744@CEEXC0523.ZURMWS.CSCMWS.COM>
Message-ID: <1541736836.15117.5.camel@acutus.pro>

Hello Karsten,

Just to add to Luis's answer below. In SAML terms, this is called "Unsolicited SAML response", meaning that it hasn't been preceded by any AuthnRequest.

While configuring your partner webapp in the 3rd party IdP, make sure that your ACS URL is in the following form:
/auth/realms/{broker-realm}/broker/{idp-name}/endpoint/clients/{client-id}

where {client-id} is the value of the "IDP Initiated SSO URL Name" in the broker definition. It's a common mistake to use Keycloak SAML endpoint (/auth/realms/{realm}/protocol/saml/endpoint) as ACS for IdP-initiated SSO. This won't work as generic SAML endpoint doesn't accept unsolicited responses, only client-specific endpoints do.

By the way, what's that 3rd party IdP? Keycloak is known to work with Okta and PingFederate and theoretically should work with any SAML 2.0 compliant IdP.

Cheers,
Dmitry Telegin
CTO, Acutus s.r.o.
Keycloak Consulting and Training

Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
+42 (022) 888-30-71
E-mail: info at acutus.pro

On Thu, 2018-11-08 at 09:50 +0000, Karsten Honsack wrote:
> Hello everybody,
> 
> I am trying to figure out if Keycloak is capable to fulfil the following requirement. I read through the documentation but was not able to figure it out.
> 
> Scenario:
> A user is on a website where he has the possibility to jump to web applications of different partners via SSO. The website provider only supports IdP Initiated SSO and the button links provided are SAML Assertion Consumer URLs. The flow describes what should be happening for my understanding:
> 
> Flow:
> 1. User login on website.
> 2. User clicks on button.
> 3. Website creates an encrypted SAML RESPONSE using its STS, redirects user to Keycloak's SAML Assertion Consumer URL and POSTs the SAML RESPONSE there.
> 4. Keycloak decrypts/validates SAML RESPONSE and authenticates the user.
> 5. Keycloak redirects user to the application.
> 6. User uses application.
> 
> Is this possible? How has it to be configured? Do you need any more information to help me? Thank you in advance!
> 
> Best regards
> 
> Karsten Honsack
> 
> **************************************
> 
> 
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From prsrivas at redhat.com  Fri Nov  9 01:55:56 2018
From: prsrivas at redhat.com (Pritha Srivastava)
Date: Fri, 9 Nov 2018 01:55:56 -0500 (EST)
Subject: [keycloak-user] Running Keycloak examples
In-Reply-To: <1284645545.32184112.1541745735175.JavaMail.zimbra@redhat.com>
Message-ID: <257635183.32186267.1541746556969.JavaMail.zimbra@redhat.com>

Hi All,

I am trying to setup a Keycloak server and run the examples, for which I did the following:

1. Downloaded 4.5.0.Final Standalone Server distribution, and started the server using ./standalone.sh, which worked fine.
2. Downlaoded keycloak-examples-4.5.0.Final, and for the preconfigured-demo, I did a mvn clean install and mvn wildfly:deploy and the second step gave me this error - UT010039: Unknown authentication mechanism KEYCLOAK
3. To solve the error in 2.0, I downloaded the wildfly adapter keycloak-wildfly-adapter-dist-4.5.0.Final.zip, and ran this command - ./bin/jboss-cli.sh --file=adapter-install.cli --connect --controller=127.0.0.1:9990 which gave the following response:
{"outcome" => "success"}
{
    "outcome" => "success",
    "response-headers" => {
        "operation-requires-reload" => true,
        "process-state" => "reload-required"
    }
}
{
    "outcome" => "failed",
    "failure-description" => "WFLYCTL0310: Extension module org.keycloak.keycloak-adapter-subsystem not found",
    "rolled-back" => true,
    "response-headers" => {"process-state" => "reload-required"}
}

I am not sure how to solve the above problem. Any help is greatly appreciated.

P.S.: I am completely new to Jboss, Wildfly etc.

Thanks,
Pritha


From vramik at redhat.com  Fri Nov  9 03:22:02 2018
From: vramik at redhat.com (Vlasta Ramik)
Date: Fri, 9 Nov 2018 09:22:02 +0100
Subject: [keycloak-user] Running Keycloak examples
In-Reply-To: <257635183.32186267.1541746556969.JavaMail.zimbra@redhat.com>
References: <257635183.32186267.1541746556969.JavaMail.zimbra@redhat.com>
Message-ID: <0cb2a458-a741-8858-f339-9ddb3b75a442@redhat.com>

Hello,

inline

On 11/9/18 7:55 AM, Pritha Srivastava wrote:
> Hi All,
>
> I am trying to setup a Keycloak server and run the examples, for which I did the following:
>
> 1. Downloaded 4.5.0.Final Standalone Server distribution, and started the server using ./standalone.sh, which worked fine.
> 2. Downlaoded keycloak-examples-4.5.0.Final, and for the preconfigured-demo, I did a mvn clean install and mvn wildfly:deploy and the second step gave me this error - UT010039: Unknown authentication mechanism KEYCLOAK
> 3. To solve the error in 2.0, I downloaded the wildfly adapter keycloak-wildfly-adapter-dist-4.5.0.Final.zip, and ran this command - ./bin/jboss-cli.sh --file=adapter-install.cli --connect --controller=127.0.0.1:9990 which gave the following response:

can you please try the following to install adapter?

./bin/jboss-cli.sh --file=adapter-elytron-install-offline.cli

> {"outcome" => "success"}
> {
>      "outcome" => "success",
>      "response-headers" => {
>          "operation-requires-reload" => true,
>          "process-state" => "reload-required"
>      }
> }
> {
>      "outcome" => "failed",
>      "failure-description" => "WFLYCTL0310: Extension module org.keycloak.keycloak-adapter-subsystem not found",
>      "rolled-back" => true,
>      "response-headers" => {"process-state" => "reload-required"}
> }
>
> I am not sure how to solve the above problem. Any help is greatly appreciated.
>
> P.S.: I am completely new to Jboss, Wildfly etc.
>
> Thanks,
> Pritha
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From prsrivas at redhat.com  Fri Nov  9 03:52:56 2018
From: prsrivas at redhat.com (Pritha Srivastava)
Date: Fri, 9 Nov 2018 03:52:56 -0500 (EST)
Subject: [keycloak-user] Running Keycloak examples
In-Reply-To: <0cb2a458-a741-8858-f339-9ddb3b75a442@redhat.com>
References: <257635183.32186267.1541746556969.JavaMail.zimbra@redhat.com>
	<0cb2a458-a741-8858-f339-9ddb3b75a442@redhat.com>
Message-ID: <1107344991.32206816.1541753576533.JavaMail.zimbra@redhat.com>

I still get the same error:

./bin/jboss-cli.sh --file=adapter-elytron-install-offline.cli

{
    "outcome" => "failed",
    "failure-description" => "WFLYCTL0310: Extension module org.keycloak.keycloak-adapter-subsystem not found",
    "rolled-back" => true
}


Thanks,
Pritha

----- Original Message -----
> From: "Vlasta Ramik" <vramik at redhat.com>
> To: keycloak-user at lists.jboss.org
> Sent: Friday, November 9, 2018 1:52:02 PM
> Subject: Re: [keycloak-user] Running Keycloak examples
> 
> Hello,
> 
> inline
> 
> On 11/9/18 7:55 AM, Pritha Srivastava wrote:
> > Hi All,
> >
> > I am trying to setup a Keycloak server and run the examples, for which I
> > did the following:
> >
> > 1. Downloaded 4.5.0.Final Standalone Server distribution, and started the
> > server using ./standalone.sh, which worked fine.
> > 2. Downlaoded keycloak-examples-4.5.0.Final, and for the
> > preconfigured-demo, I did a mvn clean install and mvn wildfly:deploy and
> > the second step gave me this error - UT010039: Unknown authentication
> > mechanism KEYCLOAK
> > 3. To solve the error in 2.0, I downloaded the wildfly adapter
> > keycloak-wildfly-adapter-dist-4.5.0.Final.zip, and ran this command -
> > ./bin/jboss-cli.sh --file=adapter-install.cli --connect
> > --controller=127.0.0.1:9990 which gave the following response:
> 
> can you please try the following to install adapter?
> 
> ./bin/jboss-cli.sh --file=adapter-elytron-install-offline.cli
> 
> > {"outcome" => "success"}
> > {
> >      "outcome" => "success",
> >      "response-headers" => {
> >          "operation-requires-reload" => true,
> >          "process-state" => "reload-required"
> >      }
> > }
> > {
> >      "outcome" => "failed",
> >      "failure-description" => "WFLYCTL0310: Extension module
> >      org.keycloak.keycloak-adapter-subsystem not found",
> >      "rolled-back" => true,
> >      "response-headers" => {"process-state" => "reload-required"}
> > }
> >
> > I am not sure how to solve the above problem. Any help is greatly
> > appreciated.
> >
> > P.S.: I am completely new to Jboss, Wildfly etc.
> >
> > Thanks,
> > Pritha
> >
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
> 

From ulrik.sjolin at gmail.com  Fri Nov  9 04:15:07 2018
From: ulrik.sjolin at gmail.com (=?UTF-8?Q?Ulrik_Sj=C3=B6lin?=)
Date: Fri, 9 Nov 2018 01:15:07 -0800
Subject: [keycloak-user] /authz/protection/permission/ticket usage?
Message-ID: <CAP5c5mRbK_Y0LMJw_oUFJ4A9gLhG1qxeNK5C9=ue7ZWVV3C_Tw@mail.gmail.com>

Hello,

I have a question on how to use the API:?/authz/protection/permission/ticket

I can call the endpoint successfully if I do the call with only ids:

curl --silent -X POST \
? http://${host}:${port}/auth/realms/${realm}/authz/protection/permission/ticket
\
? -H "Authorization: Bearer ${service_access_token}" \
? -H "Content-Type: application/json" \
? -d "{
? ? ? ? \"resource\":\"${resource_id}\",
? ? ? ? \"scope\":\"40065a35-02d5-4db9-be46-02566cf7a666\",
? ? ? ? \"requester\":\"79ae9a5a-0304-41ec-b721-d57a09d419cb\",
? ? ? ? \"granted\":\"true\"
? ? }?

It would however be a lot more workable for me if I could use names like:

curl --silent -X POST \
? http://${host}:${port}/auth/realms/${realm}/authz/protection/permission/ticket
\
? -H "Authorization: Bearer ${service_access_token}" \
? -H "Content-Type: application/json" \
? -d "{
? ? ? ? \"resource\":\"${resource_id}\",
? ? ? ? \"scope\":\?Read\",
? ? ? ? \"requester\":\?alice\",
? ? ? ? \"granted\":\"true\"
? ? }?

But when I do this I get:

{"error":"invalid_scope","error_description":"Scope [Read] is invalid?}
{"error":"invalid_permission","error_description":"Requester does not
exists in this server as user.?}

Looking at the code there seems to be lookups from names to id, but
for some reason it fails. What
am I doing wrong? Any help is greatly appreciated.

Best Regards,

Ulrik Sj?lin


From msakho at redhat.com  Fri Nov  9 04:18:24 2018
From: msakho at redhat.com (Meissa M'baye Sakho)
Date: Fri, 9 Nov 2018 10:18:24 +0100
Subject: [keycloak-user] Add CA certificates for LDAPS ?
In-Reply-To: <CAF83W6+qmRGF0PyCr7NbOmEqBzS4emjMq0fGU1YNTC-yuKXH6Q@mail.gmail.com>
References: <1662f626b66.d913c15131404.552465038631491981@mpouss.in>
	<9a8a4961-c5fb-87e9-661c-bfd87e10da09@redhat.com>
	<16633c8bd7b.1093feebf42029.2315606082414745027@mpouss.in>
	<CAF83W6KnqNr2fhtmcKHSQoJBx3saza0CGn75VG99nVeEGETPPA@mail.gmail.com>
	<1541018026.2120.1.camel@acutus.pro>
	<166e3975670.edec95a619314.6696607516355464263@mpouss.in>
	<CAF83W6+qmRGF0PyCr7NbOmEqBzS4emjMq0fGU1YNTC-yuKXH6Q@mail.gmail.com>
Message-ID: <CAF83W6J8v03WtJ49aBwDrAZDmn6HODDn3bVwG-n6ow15k5VDfw@mail.gmail.com>

Hi Mathieu,
Regarding your statement below:
- *The X509_CA_BUNDLE env variable thing (It's running in a container), I
can see the certificates in the JKS store *
Could you please tell me how you managed to see the certificates in the JKS
store?
Regards,
Meissa

Le mar. 6 nov. 2018 ? 14:50, Meissa M'baye Sakho <msakho at redhat.com> a
?crit :

> My LDAPS configuration did also work fine with keycloak 3.3.5 docker image
> My question was related to the The X509_CA_BUNDLE env variable that comes
> with the keycloak 4.4.x docker image.
> I would like to use it and wanted to know if it work.
> Do I understand that it's working fine for you Mathieu?
> Meissa
>
> Le lun. 5 nov. 2018 ? 12:17, Mathieu Poussin <me at mpouss.in> a ?crit :
>
>> I confirm this fixed the issue :)
>>
>> So simple that I didn't think about it...
>>
>> Thank you
>>
>>  ---- On Wed, 31 Oct 2018 21:33:46 +0100 Dmitry Telegin <dt at acutus.pro>
>> wrote ----
>>  > Mathieu, Meissa,
>>  >
>>  > Starting from 4.5.0, the Keycloak Docker image uses standalone-ha.xml
>> instead of standalone.xml by default. I guess this is why your truststore
>> settings are being ignored.
>>  >
>>  > I've also tested Keycloak + LDAP + self-signed cert + truststore on a
>> non-Docker deployment - it works pretty well, so definitely not a Keycloak
>> bug per se.
>>  >
>>  > Good luck!
>>  > Dmitry Telegin
>>  > CTO, Acutus s.r.o.
>>  > Keycloak Consulting and Training
>>  >
>>  > Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
>>  > +42 (022) 888-30-71
>>  > E-mail: info at acutus.pro
>>  >
>>  > On Wed, 2018-10-31 at 11:05 +0100, Meissa M'baye Sakho wrote:
>>  > > Hello Mathieu,
>>  > > did you manage to make it work?
>>  > > If yes, could you tell me how?
>>  > > Meissa
>>  > >
>>  > > > Le mar. 2 oct. 2018 ? 10:01, Mathieu Poussin <me at mpouss.in> a
>> ?crit :
>>  > >
>>  > > > Hello Marek.
>>  > > >
>>  > > > I've done that already but looks like it is completely ignored.
>>  > > > I have my custom truststore that have all my CA certificates (2),
>> but I'm
>>  > > > still seeing the same issue. (SPI is enabled on the LDAPS settings
>> on the
>>  > > > admin)
>>  > > > Is there a way to make sure it has been loaded correctly? (I don't
>> see any
>>  > > > error when the application starts but it's not working as
>> expected)
>>  > > >
>>  > > > Thanks.
>>  > > > Mathieu
>>  > > >
>>  > > >
>>  > > >  ---- On Mon, 01 Oct 2018 20:14:22 +0200 Marek Posolda <
>>  > > > mposolda at redhat.com> wrote ----
>>  > > >  > You can configure the Truststore SPI, which is mentioned in our
>> docs
>>  > > >  > here:
>>  > > >  >
>>  > > >
>> https://www.keycloak.org/docs/latest/server_installation/index.html#_truststore
>>  > > >  >
>>  > > >  > Some additional notes around LDAP are here:
>>  > > >  >
>>  > > >
>> https://www.keycloak.org/docs/latest/server_admin/index.html#connect-to-ldap-over-ssl
>>  > > >  >
>>  > > >  > Marek
>>  > > >  >
>>  > > >  >
>>  > > >  > On 01/10/18 13:27, Mathieu Poussin wrote:
>>  > > >  > > Hello.
>>  > > >  > >
>>  > > >  > > What would be the recommended way to add a custom CA
>> certificates ?
>>  > > > The documentation has a lot of different ways and so far none of
>> them
>>  > > > worked :
>>  > > >  > >
>>  > > >  > > - The X509_CA_BUNDLE env variable thing (It's running in a
>>  > > > container), I can see the certificates in the JKS store  but looks
>> like
>>  > > > they are completely ignored by the app server.
>>  > > >  > > - Added custom SPI to load a custom JKS store, same, no error
>> at
>>  > > > server start but they are completely ignored by the app server.
>>  > > >  > >
>>  > > >  > > This is the error I am getting :
>>  > > >  > >
>>  > > >  > > Caused by: sun.security.validator.ValidatorException: PKIX
>> path
>>  > > > building failed:
>>  > > > sun.security.provider.certpath.SunCertPathBuilderException: unable
>> to find
>>  > > > valid certification path to requested target
>>  > > >  > >          at
>>  > > >
>> sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:397)
>>  > > >  > >          at
>>  > > >
>> sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:302)
>>  > > >  > >          at
>>  > > > sun.security.validator.Validator.validate(Validator.java:262)
>>  > > >  > >          at
>>  > > >
>> sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:324)
>>
>>  > > >
>>  > > >  > >          at
>>  > > >
>> sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:229)
>>
>>  > > >
>>  > > >  > >          at
>>  > > >
>> sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:124)
>>
>>  > > >
>>  > > >  > >          at
>>  > > >
>> sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1596)
>>
>>  > > >
>>  > > >  > >          ... 99 more
>>  > > >  > > Caused by:
>>  > > > sun.security.provider.certpath.SunCertPathBuilderException: unable
>> to find
>>  > > > valid certification path to requested target
>>  > > >  > >          at
>>  > > >
>> sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:141)
>>
>>  > > >
>>  > > >  > >          at
>>  > > >
>> sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:126)
>>
>>  > > >
>>  > > >  > >          at
>>  > > > java.security.cert.CertPathBuilder.build(CertPathBuilder.java:280)
>>  > > >  > >          at
>>  > > >
>> sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:392)
>>  > > >  > >          ... 105 more
>>  > > >  > >
>>  > > >  > >
>>  > > >  > > Another option would be to disable certificate verification
>> on LDAPS
>>  > > > as it's a trusted environment (last resort but well so far nothing
>> else
>>  > > > worked), would there be a way to do that?
>>  > > >  > > Connecting over LDAP is not an option a this prevent some
>> features to
>>  > > > work like password reset.
>>  > > >  > >
>>  > > >  > > Thanks.
>>  > > >  > >
>>  > > >  > >
>>  > > >  > > _______________________________________________
>>  > > >  > > keycloak-user mailing list
>>  > > >  > > keycloak-user at lists.jboss.org
>>  > > >  > > https://lists.jboss.org/mailman/listinfo/keycloak-user
>>  > > >  >
>>  > > >  >
>>  > > >  >
>>  > > >
>>  > > >
>>  > > > _______________________________________________
>>  > > > keycloak-user mailing list
>>  > > > keycloak-user at lists.jboss.org
>>  > > > https://lists.jboss.org/mailman/listinfo/keycloak-user
>>  > > >
>>  > >
>>  > > _______________________________________________
>>  > > keycloak-user mailing list
>>  > > keycloak-user at lists.jboss.org
>>  > > https://lists.jboss.org/mailman/listinfo/keycloak-user
>>  >
>>
>>
>>

From geoff at opticks.io  Fri Nov  9 05:03:30 2018
From: geoff at opticks.io (Geoffrey Cleaves)
Date: Fri, 9 Nov 2018 11:03:30 +0100
Subject: [keycloak-user] Bulk Resource Delete?
Message-ID: <CAHzT=q9bm-vYVFkj=brq9opjUKBva+-wmUj2EFNFTw9FzKhGdw@mail.gmail.com>

I want to delete thousands of resources. Must I do it 1 by 1 or is there a
trick to delete multiple items with a single REST call?

Or maybe a SQL delete would do the trick?

From psilva at redhat.com  Fri Nov  9 05:12:46 2018
From: psilva at redhat.com (Pedro Igor Silva)
Date: Fri, 9 Nov 2018 08:12:46 -0200
Subject: [keycloak-user] Bulk Resource Delete?
In-Reply-To: <CAHzT=q9bm-vYVFkj=brq9opjUKBva+-wmUj2EFNFTw9FzKhGdw@mail.gmail.com>
References: <CAHzT=q9bm-vYVFkj=brq9opjUKBva+-wmUj2EFNFTw9FzKhGdw@mail.gmail.com>
Message-ID: <CAJrcDBcnqmUmCwJ2esnXL0hvQ654_1tJiYsy1Fd7J55Qdv4Udw@mail.gmail.com>

There is no operation for bulk delete. Would you mind creating an RFE in
JIRA?

Regards.
Pedro Igor

On Fri, Nov 9, 2018 at 8:06 AM Geoffrey Cleaves <geoff at opticks.io> wrote:

> I want to delete thousands of resources. Must I do it 1 by 1 or is there a
> trick to delete multiple items with a single REST call?
>
> Or maybe a SQL delete would do the trick?
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

From fabrizio.usai at cjsm.vlaanderen.be  Fri Nov  9 05:49:39 2018
From: fabrizio.usai at cjsm.vlaanderen.be (Usai, Fabrizio)
Date: Fri, 9 Nov 2018 10:49:39 +0000
Subject: [keycloak-user] OpenID Java Adapter: configuring keycloak to
 use an IDP different then Keycloak Server
In-Reply-To: <1541735155.15117.3.camel@acutus.pro>
References: <1541686439063.37605@cjsm.vlaanderen.be>,
	<1541735155.15117.3.camel@acutus.pro>
Message-ID: <1541760579107.82395@cjsm.vlaanderen.be>

Hi Dmitry,

thanks a lot for this elaborate clarification. :) It is clear to us what roads we can follow now.

First, I asked this question before on stackoverflow. https://stackoverflow.com/questions/53192776/how-to-change-authentication-url-generated-by-keycloak-openid-connect-java-adapt.  Is it ok if I add your reply as an answer there (I will only put there relevant parts)? I believe there will be other people asking the same question...

Secondly, considering your recommended way (we love bulletproof solutions ;-)), a Keycloak server, I see I have two options: the full server or the Wildfly add-on. We use EAP 7.1. Can we use the add-on on our server? I also noticed that on the download page you do not recommend this for production use. So I was taking into consideration to install the full Keycloak server. But can we use this server then also to deploy our application? It seems to me that it should be possible since the Keycloak server has a fully featured standalone folder... Of course, we want to avoid to run two EAP instances, if possible ;)

Regarding the Intuit question, I am not sure. It is another department who is responsible for this, I am just in the development team. But it could be they use Intuit behind the scenes. We only receive stuff like authentication url, clientId and secret and so on and we have to make it work :-) The well-known configuration we received from them, does look a lot like yours. 

Thirdly, I will make a JIRA issue for this. Or should I wait first a reply from the Keycloak developers? To be honest, it's the first time I use a mailing list... No idea who can reply on this email.

KR,

Fabrizio Usai

________________________________________
Van: Dmitry Telegin <dt at acutus.pro>
Verzonden: vrijdag 9 november 2018 04:45
Aan: Usai, Fabrizio; keycloak-user at lists.jboss.org
Onderwerp: Re: [keycloak-user] OpenID Java Adapter: configuring keycloak to use an IDP different then Keycloak Server

Hello Fabrizio,

Indeed, string templates like "/realms/{realm-name}/protocol/openid-connect/auth" are hardcoded into Keycloak adapters [1] [2].

Luckily, there seems to be a workaround. In Keycloak, there is a mechanism for multitenancy [3]; it requires you to supply a resolver that would return a KeycloakDeployment instance based on request parameters.
One of its bonus features is that you can completely redefine the behavior of KeycloakDeployment. For example, you can extend org.keycloak.adapters.KeycloakDeployment and override its resolveUrls() method, to make the URLs point to your 3rd party IDP.

This approach doesn't require any modifications to the adapter code, so I'd recommend you start with it. However, I wouldn't rule out further incompatibilities that could pop up.

Another option is installing an intermediary Keycloak (server), configuring brokering to 3rd party IDP and pointing your adapter to Keycloak. Though sounds like an overkill, it's a bulletproof solution that should work 100% (and it also has some other benefits).

There are of course other options like using 3rd party IDP's equivalent for Keycloak adapter (is it Intuit BTW?), or using other OpenID Connect Java libraries [4], or even proxy-level adapters like apache-mod_auth_openidc [5] or Keycloak Gatekeeper [6]. But I understand that this would probably require code rewrite, so you should consider these options only as the last resort.

As for SAML and why it used to work: Keycloak adapter uses standard SAML SP metadata for configuration, which defines URLs strictly and unambiguously; here we need to admit that SAML is more mature and feature-complete.

OIDC, on the contrary, allows for some freedom. At the moment, Keycloak OIDC adapter doesn't use any standard metadata, but rather generates URLs using hardcoded templates. I think Keycloak adapter could use OIDC's rough equivalent for SAML metadata, namely "well-known" URLs.

You can experiment with your IDP and append ".well-known/openid-configuration" to its URL. If my conjecture about Intuit is correct, then it should look like this:
https://oauth.platform.intuit.com/op/v1/.well-known/openid-configuration

In theory, Keycloak OIDC adapter could ingest this metadata instead of hardcoding URL templates. To me, this could be a valuable addition, but surprisingly I don't see any related JIRA issue. Maybe Keycloak developers could give us some feedback.

Cheers,
Dmitry Telegin
CTO, Acutus s.r.o.
Keycloak Consulting and Training

Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
+42 (022) 888-30-71
E-mail: info at acutus.pro

[1] https://github.com/keycloak/keycloak/blob/master/core/src/main/java/org/keycloak/constants/ServiceUrlConstants.java#L26
[2] https://github.com/keycloak/keycloak/blob/master/adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/KeycloakDeployment.java#L161
[3] https://www.keycloak.org/docs/latest/securing_apps/index.html#_multi_tenancy
[4] https://openid.net/developers/certified/
[5] https://github.com/zmartzone/mod_auth_openidc
[6] https://github.com/keycloak/keycloak-gatekeeper

On Thu, 2018-11-08 at 14:13 +0000, Usai, Fabrizio wrote:
> Dear,
>
>
> > We are using Keycloak Java adapter 4.5.0 in combination with EAP7.1. When we configure our keycloak.json we have for auth-server-url the url https://authentication.country.com/op/v1/auth (the original url is changed for privacy reasons). So far so good.
>
> When we navigate to our application, we are forwarded to https://authentication.country.com/op/v1/auth/realms/KeycloakOIDCRealm/protocol/openid-connect/auth?response_type=code&client_id=fac9d161-d27d-493d-uze896zed78&redirect_uri=.....
>
> This is not good, since we use our own identity provider. Removing the realms/KeycloakOIDCRealm/protocol/openid-connect/ part of the url, forwards it correctly to the identity provider. So the Keycloak adapter adds it by default, assuming we will always use Keycloak as an identity provider. Before we were using SAML and didn't had this issue.
>
> How can we configure the keycloak.json for the adapter to leave out the addition of realms/KeycloakOIDCRealm/protocol/openid-connect/?
>
> We don't understand why with SAML we didn't had this issue at all, and now with OpenID it seems very difficult to solve this issue. Our current guess to solve this, is to overwrite some Keycloak Java class and make sure the url is built the correct way. Although it is a bit dirty, we could accept this as solution (if it is possible), but we prefer to do this via configuration.
>
>
> Kind regards,
>
> Fabrizio Usai
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From nocquidant at gmail.com  Fri Nov  9 05:55:30 2018
From: nocquidant at gmail.com (Nicolas Ocquidant)
Date: Fri, 9 Nov 2018 11:55:30 +0100
Subject: [keycloak-user] Set sessions lifespan by realm?
Message-ID: <CABS93FQ4LGOEaozhao0my=e0beUk_JEN+N40g-w0irwBT3mUNw@mail.gmail.com>

Hello

Would it be possible to have several cache "sessions" with different
configurations associated with different realms?

I mean, I need to configure different lifespans for sessions, for different
realm. How could I do that?

Does the "SSO Session Max" entry from the GUI override the definition from
the file standalone-ha.xml, for each realm:

<distributed-cache name="sessions" owners="2" statistics-enabled="true">
<binary-memory eviction-type="COUNT" size="10000"/>
<expiration lifespan="1800000"/>
...

I yes, does it mean I need to set expiration lifespan in standalone-ha.xml
as the maximum of all  "SSO Session Max" GUI entries?

Thanks a lot for clarification
--nick

From psilva at redhat.com  Fri Nov  9 07:29:00 2018
From: psilva at redhat.com (Pedro Igor Silva)
Date: Fri, 9 Nov 2018 10:29:00 -0200
Subject: [keycloak-user] Data filtering in SQL
In-Reply-To: <5BCF31B569C0A2468D7904C8E5839D690104C378C5@DSKCMAIL1WC.ad.dstsystems.com>
References: <5BCF31B569C0A2468D7904C8E5839D690104C35356@DSKCMAIL1WC.ad.dstsystems.com>
	<1541136118.4390.1.camel@acutus.pro>
	<5BCF31B569C0A2468D7904C8E5839D690104C368EF@DSKCMAIL1WC.ad.dstsystems.com>
	<1541630686.2778.1.camel@acutus.pro>
	<CAJrcDBffVsLL2_HPjeEBo1OrM__YYmf5s2q8M2m7YtzXEcisFw@mail.gmail.com>
	<5BCF31B569C0A2468D7904C8E5839D690104C3759B@DSKCMAIL1WC.ad.dstsystems.com>
	<CAJrcDBfZoVb0LLhqUqNzNAR2otTvnVWkkaWxvNar80fs9ncYiQ@mail.gmail.com>
	<5BCF31B569C0A2468D7904C8E5839D690104C378C5@DSKCMAIL1WC.ad.dstsystems.com>
Message-ID: <CAJrcDBeHerSRkn1t1fgTDgNs35-80BqUnigkaNg47remLcGRBw@mail.gmail.com>

On Thu, Nov 8, 2018 at 9:27 PM Byrd, Rob M <rmbyrd at dstsystems.com> wrote:

> Pedro,
>
>
>
> That is helping my understanding some, thank you.  I understand your
> recommendations on dealing with separating the employee's Salary field in
> my example too.  Please see follow-up questions below.
>
>
>
> String resource attributes statically in keycloak:
>
> 2.1) I had been thinking of Resource as a *type* of resource to this
> point not a specific instance.  But now I don't see how your suggestion of
> basically using the resource attribute to store a foreign key (ie. pet's
> veterinarian) will work unless we are talking about each individual pet
> instance being a keycloak resource.  Similarly it was mentioned pet 1 and
> pet 2 could have a meaningful Owner in keycloak, which again is making me
> think that *instances* are being suggested to store along with
> entity-relationships basically.  So, should I instead be thinking of
> keycloak resources as storing single instances of items in our system?
>
You should not think of Keycloak as storing *only* single instances, but
with the necessary support to store single instances. That was my point
when I mentioned that you can have a 1:1 or 1:N mapping between keycloak
resources and your resources.

The work to manage resources in Keycloak is quite trivial, keep them in
sync with your real resources too. Performance of authorization requests
for specific resources is quite good. It is a trade-off, the flexibility we
give regarding governing access to individual resources vs the drawbacks of
managing these resources in Keycloak. But again, you are not forced to use
this approach, it really depends on your requirements. For instance, we
support privacy through User-Managed Access (UMA), users are allowed to
manage permissions for their own resources, share resources with others,
allow/approve access to specific scopes/actions, and revoke access, where
you have loosely coupled clients and resource servers, resource servers in
control over the context that a permission should be granted, etc.

I'm not pushing you to any specific solution but trying to clarify what we
have, what we can do, what we can improve and how we could help "data
filtering" use cases. Btw, thanks you and Dmitry for starting this.

> 2.2) This relatively static storage of resources plus extra attributes
> like foreign keys seems to basically push/duplicate our business model of
> data into keycloak, to some degree, correct?  And the more keycloak needs
> to decide, the more gets duplicated into keycloak?
>
Not really, but true for data filtering. That is another
point/drawback/concern that I tried to make when I said that data filtering
is not among our target use cases. We can support it, but not something we
discussed in the details like we are doing in this thread.

Attributes can be used to define specific security related data associated
with a resource which are not part of your business model. Thus, allowing
you to keep your business model decoupled from security aspects that govern
access to your resources.

>
>
> Push claims:
>
> 2.3) The push claim alternative seems to be having application logic fetch
> more context as needed for the permission evaluation.  This might work okay
> when going after a single entity or asking singular questions of the
> application logic ? but for lists, such as a user seeing his list of 100
> transaction history records amongst the 1 million transaction history
> records on the system, would a question be asked for each of the 1 million
> records, one at a time?
>
Pushing claims is not the correct approach to solve this problem.

First, Keycloak is optmized to only evaluate policies for resources where
the subject is the owner. So, considering that I decided to manage all 1
million resources in Keycloak, each resource would have a user as the
resource owner. During evaluation the policy engine is going to evaluate
permissions fo 100 resources, not 1 million.

You may ask now, would that scale ? Depends on how you obtain permissions
from the server. If you are asking the server for all permissions and users
can have 1 million resources over time, it won't scale. However, if you ask
permissions for individual transactions or a small set of transactions, it
will scale.

>
>
> Post-filtering of records:
>
> 2.4) A use case I still seek clarification on is the "post-filtering of
> records", which I was trying to get at with my previous question #5.
> Stated in another way - say a financial database has 1 million transaction
> records across thousands of users. Every user is allowed to see transaction
> history records view, but only the ones they transacted.  So, a single user
> viewing all transactions of the transaction history feature/resource should
> (obviously) only be able to see all HIS transactions, not all 1 million on
> the database.  Spring Security would have @PostAuth for this (though its
> drawback is slow db performance on first query that does a db table scan
> and brings back everything to the middle tier, which then inefficiently
> whittles it down to just what pertains to the user).  My question is what
> ways would this post-filtering of records be handled in Keycloak?  With
> what I know so far, I am guessing at keycloak basic options:
>
> a) Have each of 1mil transaction records managed by Keycloak, add a
> "creator" attribute for who instigated the transaction, and have that user
> identifier stored on each record so Keycloak can do the filtering down to
> the 100 correct records
>
b) Receive a push claim, for each of the 1mil transaction records,
> indicating who the "creator" is, so it may be matched against the current
> user and thus filter down to the 100 correct records
>
> c) During evaluation, the policy engine can call out to a service
> somewhere to get the primary keys of the subset of records this user can
> see (this may be like a Claim Information Point), then whittle the full
> list down to just those matching primary keys (kind of like sending an IN
> list of primary keys in a SQL WHERE clause)
>
> d) Something more like the ?partial evaluation? that OPA blog and Dmitry
> has been talking about
>
You don't need to create a "creator" attribute. Resources in Keycloak
always have a owner. It can be the resource server (the application) itself
or some user in your realm. See
https://www.keycloak.org/docs/latest/authorization_services/index.html#_resource_overview
.

I just realized that we have another option in Keycloak that might be
helpful to solve data filtering. I think it is similar to what you linked
from OPA docs. Some background first about the capability that may help
with that.

In Keycloak, policies are allowed to push back claims to resource server
(the application protecting the resources you want to access). Quite
similar to Advice/Obligation in XACML. The idea is push back additional
constratins to the application in order to indicate additional checks that
should be performed by the policy enforcer. As a note, our CIPs do that in
order to reinforce access to resources based on any claim pushed to
Keycloak when evaluating permissions.

Let me give you an example. Consider a Transaction resource that you
created in Keycloak. This is a generic resource representing all your
transactions. Suppose you have a specific scope that represents an
operation that lists all user transactions. Let's call this scope
"transaction:list". This scope is associated with the Transaction resource.
So you have:

Resource: Transaction
Scopes: transaction:list

Now, in addition to any other policy that applies to the Transaction
resource (role, group, whatever) you have a specific permissions that
govern access to the "transaction:list" scope. This permissions is granted
by a "List Transaction Policy" as follows:

var permission = $evaluation.getPermission();
var identity = $evaluation.getContext().getIdentity();

permission.addClaim('data.filter.userId', identity.getId());

$evaluation.grant();

Now, the client application acting on behalf of your user tries to access
your application at "/api/v1/transaction" using HTTP GET. You know that GET
method on that endpoint is associated with the "transaction:list" scope, so
you ask Keycloak for permissions to "Transaction" resources +
"transaction:list" scope.

As a result, Keycloak will give you a response as follows:

"permissions": [
      {
        "scopes": [
          "album:list"
        ],
        "claims": {
          "data.filter.userId": [
            "e68fa92d-6167-438f-844b-78c7abfc0dd2"
          ]
        },
        "rsid": "d3aaaf68-50cf-4c5c-97b9-99910a7bfb27",
        "rsname": "Transaction Resource"
      }
]

In your application you can use the permission granted above, and the
"data.filter.userId" claim to create a query in your database as follows:

StringBuilder filter = new StringBuilder();
Map<String, Object> queryParams = new HashMap<String, Object>();

for (Map.Entry<String, Set<String>> entry : permission.getClaims().entrySet()) {

    if (filter.length() != 0) {
        filter.append(" and ");
    }

    String key = entry.getKey();

    if (key.startsWith("data.filter")) {
        String left = key.substring(key.lastIndexOf('.') + 1);
        filter.append(left).append(" = :").append(left);
        queryParams.put(left, entry.getValue());
    }
};

Query query = this.entityManager.createQuery("from Transaction where "
+ filter.toString());

for (Map.Entry<String, Object> entry : queryParams.entrySet()) {
    query.setParameter(entry.getKey(), entry.getValue());
}

The key points here are:

* You are using a single resource to represent all transactions in your system

* You are using a specific policy to protect the "transaction:list"
operation by pushing back to your application how access should be
enforced

* Access management is still centralized and you can push back the
"data.filter" claim with any information you want in order to indicate
to the application how data must be filtered

* Your policies are using information already available from the
eluvation context (like user id, user attributes, user roles, groups)
without being forced to push any claim to the server

In fact, I can use this in one of our quickstarts that is using a
database and protecting data. So we could introduce something similar
to this in order to filter recors in addition to protect API
endpoints.

How that sounds to you ?


>
> General:
>
> 2.5) In general, it seems to me the bigger the chunks of extra context
> provided by application logic to the policy engine, the less detail about
> the actual constraints being enforced you have controlled and visible in
> the policy layer? somewhat defeating the purpose of the policy layer.  Does
> that sound correct?  I could see us offloading a ton of detail to the push
> claims ? rather than, say, duplicating more of our business model in
> keycloak ? and then realizing very little of our actual policy permission
> details are visible or controllable in the policy layer.  So I am not sure
> what we are getting at that point.
>
>                 a) An answer might be drawing the line at only role-based
> access control in the policy layer since that affinity is more easily
> provided as input (thought that could even be debated)
>
>                 b) Maybe we try to define and draw the line at
> ?resource-based? controls only in the policy layer
>
>                 c) Maybe we make the unit of work for each push claim so
> granular that truly all of the policy rules that are occurring are
> basically expressed in the policy layer (thus allowing control, flexibility
> and visibility in one consolidated place)
>
>
>
> Thanks for your time.
>
>
>
> Rob Byrd
>
> DST
>
> Solutions Lead
>
> SS&C Technologies Inc.   |   1055 Broadway, Kansas City, MO 64105
>
> t: (816) 435-7286  *| *m (816) 509-0119
>
> *rmbyrd at dstsystems.com <rmbyrd at dstsystems.com>*  |  *www.ssctech.com
> <http://www.ssctech.com/>*
>
> Follow us: [image: cid:image001.png at 01D412C1.A14C5770]
> <https://www.linkedin.com/company/ss-c-technologies/> |  [image:
> cid:image002.png at 01D412C1.A14C5770] <https://twitter.com/ssctechnologies> |
> [image: cid:image003.png at 01D412C1.A14C5770]
> <https://www.facebook.com/ssctechnologies/>
>
>
>
> *From:* Pedro Igor Silva [mailto:psilva at redhat.com]
> *Sent:* Thursday, November 8, 2018 2:20 PM
> *To:* Byrd, Rob M <rmbyrd at dstsystems.com>
> *Cc:* Dmitry Telegin <dt at acutus.pro>; keycloak-user <
> keycloak-user at lists.jboss.org>
> *Subject:* Re: [keycloak-user] Data filtering in SQL
>
>
>
>
>
> On Thu, Nov 8, 2018 at 5:44 PM Byrd, Rob M <rmbyrd at dstsystems.com> wrote:
>
> Thanks Dmitry and Pedro,
>
>
>
> Pardon my simple-minded response below, but I am wondering how these
> specific items would work?  Dmitry, yes I agree your GET
> /projects/<project> and GET /projects scenario is on point for the issue ?
> I hope my questions below can further clarify the discussion.  Here, I will
> have to make a ?go or no-go? decision in about a week. J  I would love to
> take on the challenge of searching for the ?holy grail? in this, but atm
> will need to figure out what Keycloak (or OPA, etc.) can confidently do
> today.
>
>
>
> Thanks for the great discussion and continued help!
>
>
>
> Questions
>
> 1) Simple role-based authorization policy seems doable.
>
>    - Ex: ?Only veterinarians are allowed to read pet profiles.?
>
>
>
> 2) But how to answer once more context is needed, such as one resource?s
> affinity to another?  Literally how does the application figure it out?
> Like the below example would need a pet-veterinarian mapping resolved
> somehow, it seems:
>
>    - ?Only the treating veterinarian is allowed to read a pet?s profile.?
>
> Just like in OPA, but using a different approach, you can also push
> information (the input in OPA) to your policies. We call this "pushing
> claims" [1]. In our policy enforcer we also have the concept of a Claim
> Information Point [2] (similar concent as a PIP) which you can configure to
> automatically push claims to your policies when checking access for a
> particular resource. There is also a CIP that allows you to fetch claims
> from external services.
>
>
>
> Besides, a resource in Keycloak has attributes, which can be anything you
> want. So you could, for instance, have a Pet Foo resources in Keycloak and
> update a "veterinarian" attribute associated with it. So you could have a
> policy that checks if the user making the request is the same defined in
> the attribute.
>
>
>
> [1]
> https://www.keycloak.org/docs/latest/authorization_services/index.html#_service_pushing_claims
>
> [2]
> https://www.keycloak.org/docs/latest/authorization_services/index.html#_enforcer_claim_information_point
>
>
>
>
>    -
>
>
>
> 3) Keycloak has taken an example of ?Pet owners can access their own pet?s
> profiles.? and said we can write policies saying that "Only Owner" can
> access "/api/petservice/pet/{id}".  But how does the policy engine figure
> out who is the owner of /pet/2 vs /pet/3?
>
>  I can think two options. Like I mentioned before, we are resource-based
> and resources have an owner. So you can write policies that check if the
> resource owner is the user making the authorization request. Another option
> is to push claims.
>
> 4) Similarly, an OPA blog
> https://blog.openpolicyagent.org/write-policy-in-opa-enforce-policy-in-sql-d9d24db93bf4
> gives the example where ?Only the treating veterinarian is allowed to read
> a pet?s profile, and only when signed in from a device at the pet?s
> clinic?.  Again, it is easy enough to provide the OPA engine the target pet
> and the current device location, but how exactly is it determined who is
> the treating veterinarian of that pet and what clinic the pet belongs to?
>
> 5) In general, the security difficulty is constraining what a user can
> see/do in a particular feature, so how exactly would a policy engine bring
> back a subset of records that particular user can see (based on their
> affiliated company, etc.)?
>
> 6) Similarly, how exactly would a policy engine bring back all records but
> not the fields a user should not see (such as employee salary field, unless
> the user is a HR VIP)?  These last two could be likened to @PostAuth
> post-filtering in spring security.
>
> You can have all those resources protected by Keycloak and make
> authorization requests to obtain the resources a user has access. We
> provide a REST API to create resources. And that is the point I tried to
> make when I said that data security is not really among the use cases we
> are trying to solve. Although it is possible. Keycloak allows you to send a
> "give me all" permission request. That means returning permissions for any
> resource, managed by Keycloak, that an user can access. But yeah, depending
> on how many resources you have you may end up with a huge response and a
> bad performance.
>
>
>
> Another approach is define a single Employee resource with a Salary scope
> to represent all your employees. So you could enforce access to your real
> employees and their salary based on the decisions made by the server for
> this single resource.
>
>
>
> The decision for one approach or another really depends on how fine
> grained you want to be, like I mentioned before. Do you need to manage
> indivudual employees or they all share the same access policies ?
>
>
>
> See this
> https://github.com/keycloak/keycloak-quickstarts/tree/master/app-authz-rest-employee
> .
>
>
>
> Regarding  fields (e.g: salary) you could consider it as a scope
> associated with a resource. In Keycloak you can define permissions for
> scopes, not only for resources.
>
>
>
>
>
> Rob Byrd
>
> DST
>
> Solutions Lead
>
> SS&C Technologies Inc.   |   1055 Broadway, Kansas City, MO 64105
>
> t: (816) 435-7286  *| *m (816) 509-0119
>
> *rmbyrd at dstsystems.com <rmbyrd at dstsystems.com>*  |  *www.ssctech.com
> <http://www.ssctech.com/>*
>
> Follow us: [image: cid:image001.png at 01D412C1.A14C5770]
> <https://www.linkedin.com/company/ss-c-technologies/> |  [image:
> cid:image002.png at 01D412C1.A14C5770] <https://twitter.com/ssctechnologies> |
> [image: cid:image003.png at 01D412C1.A14C5770]
> <https://www.facebook.com/ssctechnologies/>
>
>
>
> *From:* Pedro Igor Silva [mailto:psilva at redhat.com]
> *Sent:* Thursday, November 8, 2018 6:42 AM
> *To:* Dmitry Telegin <dt at acutus.pro>
> *Cc:* Byrd, Rob M <rmbyrd at dstsystems.com>; keycloak-user <
> keycloak-user at lists.jboss.org>
> *Subject:* Re: [keycloak-user] Data filtering in SQL
>
>
>
> Hi Dmitry,
>
>
>
> Agree with you when you mention application vs data security. I also agree
> that Keycloak can also solve data security problems.
>
>
>
> Privacy is one of the main reasons behind our UMA support a very important
> aspect of data security. In addition to privacy, we also added extensions
> to UMA and OAuth2 standards to enable applications to use Keycloak as a
> Policy Decision Point, mainly target for application security.
>
>
>
> As PDP (and PAP), Keycloak allows you to govern access to protected
> resources and to obtain authorization decisions as a result of the
> evaluation of policies associated with these resources. Being based on UMA
> and OAuth2 we support token-based authorization but also access control
> based on the permissions granted by the server. So, yeah, it should be
> possible to filter data based on those permissions as well dynamically
> create WHERE clauses.
>
>
>
> My main concerns about data security are scalability and manageability,
> two aspects that are closely related to how much fine-grained you want to
> be. Like I said, in Keycloak you can protect a set of one or more resources
> as well as scope specific permissions, which can span access decisions for
> one or more resources.
>
>
>
> We are using data security when you enable permissions to users or groups,
> where results are filtered based on the evaluation of these permissions.
> Performance wise, evaluation is quite satisfactory, being the main
> challenges the trade-off between usability vs performance. Recently we had
> important changes to improve the performance of our token endpoint and
> policy evaluation engine and I think we can perform well when fetching
> permissions from the server for a set of one or more resources.
>
>
>
> I'm happy to discuss how we can leverage what we have for data security if
> the community is interested.
>
>
>
> Regards.
>
> Pedro Igor
>
>
>
> On Wed, Nov 7, 2018 at 8:47 PM Dmitry Telegin <dt at acutus.pro> wrote:
>
> Hi Rob,
>
> On Tue, 2018-11-06 at 16:28 +0000, Byrd, Rob M wrote:
> > (Hope this is the correct way to reply - let me know if not)
> >
> > Thanks.  So my concern is really with the whole idea that an Enterprise
> Application's security constraints could really be all implemented based on
> url-patterns, is that what you guys are thinking?
>
> Cannot speak for Keycloak guys, but will put in my 2? as an architect -
> URL-based (or rather resource-based) authorization covers only one aspect
> of the application security. Data filtering is equally important, but it's
> just another facet of the problem, and needs to be solved accordingly.
> Indeed, Keycloak doesn't provide OOTB any means for automatically limiting
> subsets of data shown to the user, as Keycloak has a completely different
> scope (namely Web SSO/IDM solution).
>
> However, you can still use Keycloak as a central warehouse for your
> security (meta)data, and use it the way you want. Like I said before,
> nothing stops you from defining some policies in Keycloak, then retrieving
> them and converting to a WHERE clause for your SQL/JPQL/NoSQL query.
>
> Speaking of NoSQL - this might be not directly relevant to your problem,
> but still interesting. A similar problem has surfaced in the discussion
> following my talk on Apache Sling + Keycloak [1] earlier this year; the
> central point was: "okay, we can have Keycloak path-based authorization in
> Sling, but how do we limit the content visible to the user?"
> That time we came up with some sort of hybrid solution, like path-based
> security + JCR ACLs and/or application-level rules; but now I think this
> might be something similar, like generating JCR's equivalent to the WHERE
> clause based on Keycloak policy definition.
>
> Just to make sure I understand the case, let's imagine:
> - there are users and groups (live in Keycloak);
> - there are, say, "projects" (live in business tier + DB);
> - there is a policy in Keycloak saying "projects should be accessible only
> to the members of the respective groups";
> - based on that:
>  - GET /projects/<project> should return 200 + representation if the user
> is a member of the group, 403 otherwise;
>  - GET /projects should return the list of projects the current user has
> access to.
>
> Is this correct?
>
> [1]
> https://adapt.to/2018/en/schedule/modern-authentication-in-sling-with-openid-connect-and-keycloak.html
>
> Cheers,
> Dmitry Telegin
> CTO, Acutus s.r.o.
> Keycloak Consulting and Training
>
> Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
> +42 (022) 888-30-71
> E-mail: info at acutus.pro
>
> >
> > For example, mostly a user can visit most features (urls) in an
> application, but it is the subset of things they can see/do within the
> feature that is the crux of the security issue - and it does not seem
> feasible to architect urls in such a way that they can be used as the key
> to security.  Thoughts?
> >
> > Thanks!
> >
> > Rob Byrd
> > DST
> > Solutions Lead
> > SS&C Technologies Inc.   |   1055 Broadway, Kansas City, MO 64105
> > t: (816) 435-7286  | m (816) 509-0119
> > rmbyrd at dstsystems.com  |  www.ssctech.com
> > Follow us:  |   |
> >
> > -----Original Message-----
> > > From: Dmitry Telegin [mailto:dt at acutus.pro]
> > Sent: Friday, November 2, 2018 12:22 AM
> > > To: Byrd, Rob M <rmbyrd at dstsystems.com>; keycloak-user at lists.jboss.org
> > Subject: Re: [keycloak-user] Data filtering in SQL
> >
> > Hello Rob,
> >
> > If I get it right, it's all about generating SQL WHERE clause from
> Keycloak policies? I think this is doable, as Keycloak has a well-defined
> object model for authorization policies, and it's easy to obtain policy
> definitions in JSON format. I think Pedro Igor will tell you more about
> that.
> >
> > You should pay attention to the following:
> > - there are differences in semantics between OPA and Keycloak policies.
> For example, Keycloak policies do not operate HTTP methods but rather use
> more generic notion of scopes;
> > - not every policy type can be easily converted to a WHERE clause. It
> should be trivial for User/Group/Role policies, but is virtually impossible
> for Script and Rules, as they are just blackboxes that evaluate to true or
> false. Unless of course your DBMS has a built-in JavaScript engine :)
> >
> > Good luck!
> > Dmitry Telegin
> > CTO, Acutus s.r.o.
> > Keycloak Consulting and Training
> >
> > Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
> > +42 (022) 888-30-71
> > E-mail: info at acutus.pro
> >
> > On Thu, 2018-11-01 at 21:39 +0000, Byrd, Rob M wrote:
> > > I am comparing OPA authorization to Keycloak - how could I enforce
> Keycloak policy in the SQL closest to the data for good performance,
> including returning subsets of lists?  OPA discusses this at
> https://blog.openpolicyagent.org/write-policy-in-opa-enforce-policy-in-sql-d9d24db93bf4
> .
> > >
> > > Thanks!
> > >
> > > Rob Byrd
> > > DST
> > > Solutions Lead
> > > SS&C Technologies Inc.   |   1055 Broadway, Kansas City, MO 64105
> > > t: (816) 435-7286  | m (816) 509-0119
> > > rmbyrd at dstsystems.com<mailto:rmbyrd at dstsystems.com>  |
> www.ssctech.com<http://www.ssctech.com/>;;
> > > > > Follow us: [cid:image001.png at 01D412C1.A14C5770] <
> https://www.linkedin.com/company/ss-c-technologies/>  |  [
> cid:image002.png at 01D412C1.A14C5770] <https://twitter.com/ssctechnologies
> >  |  [cid:image003.png at 01D412C1.A14C5770] <
> https://www.facebook.com/ssctechnologies/>
> > >
> > >
> > >
> > > Please consider the environment before printing this email and any
> attachments.
> > >
> > > This e-mail and any attachments are intended only for the individual
> or company to which it is addressed and may contain information which is
> privileged, confidential and prohibited from disclosure or unauthorized use
> under applicable law. If you are not the intended recipient of this e-mail,
> you are hereby notified that any use, dissemination, or copying of this
> e-mail or the information contained in this e-mail is strictly prohibited
> by the sender. If you have received this transmission in error, please
> return the material received to the sender and delete all copies from your
> system.
> > > _______________________________________________
> > > keycloak-user mailing list
> > > keycloak-user at lists.jboss.org
> > > https://lists.jboss.org/mailman/listinfo/keycloak-user
> >
> >
> > Please consider the environment before printing this email and any
> attachments.
> >
> > This e-mail and any attachments are intended only for the individual or
> company to which it is addressed and may contain information which is
> privileged, confidential and prohibited from disclosure or unauthorized use
> under applicable law. If you are not the intended recipient of this e-mail,
> you are hereby notified that any use, dissemination, or copying of this
> e-mail or the information contained in this e-mail is strictly prohibited
> by the sender. If you have received this transmission in error, please
> return the material received to the sender and delete all copies from your
> system.
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
> ------------------------------
>
> Please consider the environment before printing this email and any
> attachments.
>
> This e-mail and any attachments are intended only for the individual or
> company to which it is addressed and may contain information which is
> privileged, confidential and prohibited from disclosure or unauthorized use
> under applicable law. If you are not the intended recipient of this e-mail,
> you are hereby notified that any use, dissemination, or copying of this
> e-mail or the information contained in this e-mail is strictly prohibited
> by the sender. If you have received this transmission in error, please
> return the material received to the sender and delete all copies from your
> system.
>
> ------------------------------
> Please consider the environment before printing this email and any
> attachments.
>
> This e-mail and any attachments are intended only for the individual or
> company to which it is addressed and may contain information which is
> privileged, confidential and prohibited from disclosure or unauthorized use
> under applicable law. If you are not the intended recipient of this e-mail,
> you are hereby notified that any use, dissemination, or copying of this
> e-mail or the information contained in this e-mail is strictly prohibited
> by the sender. If you have received this transmission in error, please
> return the material received to the sender and delete all copies from your
> system.
>
>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.png
Type: image/png
Size: 588 bytes
Desc: not available
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20181109/846bddbb/attachment-0004.png 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image002.png
Type: image/png
Size: 607 bytes
Desc: not available
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20181109/846bddbb/attachment-0005.png 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image003.png
Type: image/png
Size: 566 bytes
Desc: not available
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20181109/846bddbb/attachment-0006.png 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.png
Type: image/png
Size: 588 bytes
Desc: not available
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20181109/846bddbb/attachment-0007.png 

From wburns at redhat.com  Fri Nov  9 08:05:58 2018
From: wburns at redhat.com (William Burns)
Date: Fri, 9 Nov 2018 08:05:58 -0500 (EST)
Subject: [keycloak-user] Shared datastore?
In-Reply-To: <CAA9R9O5OKgZqrkCXbifNoHEYOfKKV52ujycoHMOMBvq7jzNFLQ@mail.gmail.com>
References: <CABS93FQoYAW5trxmEww9j8RsyCSmiNAxxopnvj6iHvDNM4qtjg@mail.gmail.com>
	<CABS93FTjHkHaZRFWKuXsFoQ50u4fAN1EFyXoTsyJRtXf4HmS3w@mail.gmail.com>
	<CAA9R9O5OKgZqrkCXbifNoHEYOfKKV52ujycoHMOMBvq7jzNFLQ@mail.gmail.com>
Message-ID: <996899230.66401575.1541768758407.JavaMail.zimbra@redhat.com>



----- Original Message -----
> From: "Sebastian Laskawiec" <slaskawi at redhat.com>
> To: "Nicolas Ocquidant" <nocquidant at gmail.com>
> Cc: keycloak-user at lists.jboss.org, "Will Burns Rosenquist Burns" <wburns at redhat.com>
> Sent: Thursday, November 8, 2018 12:33:47 PM
> Subject: Re: [keycloak-user] Shared datastore?
> 
> So I think there are at least two ways to address this problem. This first
> one is to use Offline Tokens [1]. I'm not sure if that fits into your
> application since it requires your client applications to store the token.
> In other words you can simply delegate this problem one layer below in your
> system.
> 
> If that doesn't work for you, yes passivation is a way to go. Frankly, I
> haven't used passivation but from the manual I see it works hand in hand
> with eviction [2][3]. Will (on CC) can probably correct me here, but my
> understanding is that whenever an entry gets evicted, the passivation
> mechanism picks it up and stores somewhere.

It does and it works, the problem is that passivation doesn't play well with shared stores in Infinispan. We prevent this configuration in 9.4 or newer even.

I recommended that Nicolas just use eviction and a shared store without passivation. However it seems that entries are not written to the store in this configuration. My guess is that KeyCloak performs write operations with the SKIP_CACHE_STORE flag and assumes entries will only be written to the store due to passivation. Is there a reason for that?

> 
> [1] http://blog.keycloak.org/2015/12/offline-tokens-in-keycloak.html
> [2]
> http://infinispan.org/docs/stable/user_guide/user_guide.html#cache_passivation
> [3]
> https://github.com/infinispan/infinispan/blob/master/core/src/test/java/org/infinispan/eviction/impl/EvictionWithPassivationTest.java#L61-L69
> 
> On Thu, Nov 8, 2018 at 5:40 PM Nicolas Ocquidant <nocquidant at gmail.com>
> wrote:
> 
> > My requirements are the following: store tokens emitted by KC during one
> > year.
> >
> > I don't know how many users there are, but here are the number I get:
> >   * the number of connections a week is about 700k.
> >   * the number of session refresh a week is about 200k.
> >
> > I approximated around 1M of sessions a week, thus 52M a year.
> > In memory, a user session has been estimated around 4KB (about 1KB in
> > file/DB).
> >
> > But I guess a refresh does not create another session isn't it? And maybe
> > it's possible to ask KC to delete previous emitted tokens when a new one is
> > created for a same user?
> >
> > If yes, my estimation is probably a little bit too high here, but I
> > certainly have several millions of tokens to keep (and maybe dozens of
> > millions).
> >
> > Thanks
> > --nick
> >
> > Le mer. 7 nov. 2018 ? 18:17, Nicolas Ocquidant <nocquidant at gmail.com> a
> > ?crit :
> >
> > > Hi,
> > >
> > > According to Infinispan, when passivation is disabled, every update to
> > the
> > > cache should always write to the store.
> > >
> > > But I can't manage to get it work with Keycloak. If I disable
> > passivation,
> > > my SQL store (Postgres) stays empty, even if the cache is full.
> > >
> > > So, if passivation is needed for Keycloak to write to the DB, it means
> > > that the use of a shared DB is not possible...
> > >
> > > But this leads to another issue for me. Enable passivation without a
> > > shared DB seems to imply that either 'fetch-state' or 'purge' should be
> > > enabled on startup, in order for the cache to not contain stale entries.
> > >
> > > 15:27:44,626 WARN
> > > [org.infinispan.configuration.cache.AbstractStoreConfigurationBuilder]
> > (MSC
> > > service thread 1-6) ISPN000149: Fetch persistent state and purge on
> > startup
> > > are both disabled, cache may contain stale entries on startup
> > >
> > > As I need to keep millions of sessions, this will considerably slow down
> > > the startup of my node (when started again after a crash for instance).
> > >
> > > So, is shared datastore allowed in Keycloak? If yes, how to enable it?
> > > Otherwise what other options do I have to improve my startup time, if
> > > millions of sessions are in the store?
> > >
> > > Thanks
> > > --nick
> > >
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
> 


From slaskawi at redhat.com  Fri Nov  9 08:29:43 2018
From: slaskawi at redhat.com (Sebastian Laskawiec)
Date: Fri, 9 Nov 2018 14:29:43 +0100
Subject: [keycloak-user] Shared datastore?
In-Reply-To: <1408145257.66131813.1541706517375.JavaMail.zimbra@redhat.com>
References: <CABS93FQoYAW5trxmEww9j8RsyCSmiNAxxopnvj6iHvDNM4qtjg@mail.gmail.com>
	<CABS93FTjHkHaZRFWKuXsFoQ50u4fAN1EFyXoTsyJRtXf4HmS3w@mail.gmail.com>
	<CAA9R9O5OKgZqrkCXbifNoHEYOfKKV52ujycoHMOMBvq7jzNFLQ@mail.gmail.com>
	<1408145257.66131813.1541706517375.JavaMail.zimbra@redhat.com>
Message-ID: <CAA9R9O4GmBwUrbOGDmWRyUUaduFOc0t0fDKN1qb_ZTJiysRMtg@mail.gmail.com>

Yes, I think that could be case, I see a plenty of places where we
use SKIP_CACHE_STORE.

Let me ask Marek for help here since it has been implemented long before I
joined the team and I don't know the history behind it...

On Thu, Nov 8, 2018 at 8:48 PM William Burns <wburns at redhat.com> wrote:

>
>
> ----- Original Message -----
> > From: "Sebastian Laskawiec" <slaskawi at redhat.com>
> > To: "Nicolas Ocquidant" <nocquidant at gmail.com>
> > Cc: keycloak-user at lists.jboss.org, "Will Burns Rosenquist Burns" <
> wburns at redhat.com>
> > Sent: Thursday, November 8, 2018 12:33:47 PM
> > Subject: Re: [keycloak-user] Shared datastore?
> >
> > So I think there are at least two ways to address this problem. This
> first
> > one is to use Offline Tokens [1]. I'm not sure if that fits into your
> > application since it requires your client applications to store the
> token.
> > In other words you can simply delegate this problem one layer below in
> your
> > system.
> >
> > If that doesn't work for you, yes passivation is a way to go. Frankly, I
> > haven't used passivation but from the manual I see it works hand in hand
> > with eviction [2][3]. Will (on CC) can probably correct me here, but my
> > understanding is that whenever an entry gets evicted, the passivation
> > mechanism picks it up and stores somewhere.
>
> It does and it works, the problem is that passivation doesn't play well
> with shared stores in Infinispan. We prevent this configuration in 9.4 or
> newer even.
>
> I recommended that Nicolas just use eviction and a shared store without
> passivation. However it seems that entries are not written to the store in
> this configuration. My guess is that KeyCloak performs write operations
> with the SKIP_CACHE_STORE flag and assumes entries will only be written to
> the store due to passivation. Is there a reason for that?
>
> >
> > [1] http://blog.keycloak.org/2015/12/offline-tokens-in-keycloak.html
> > [2]
> >
> http://infinispan.org/docs/stable/user_guide/user_guide.html#cache_passivation
> > [3]
> >
> https://github.com/infinispan/infinispan/blob/master/core/src/test/java/org/infinispan/eviction/impl/EvictionWithPassivationTest.java#L61-L69
> >
> > On Thu, Nov 8, 2018 at 5:40 PM Nicolas Ocquidant <nocquidant at gmail.com>
> > wrote:
> >
> > > My requirements are the following: store tokens emitted by KC during
> one
> > > year.
> > >
> > > I don't know how many users there are, but here are the number I get:
> > >   * the number of connections a week is about 700k.
> > >   * the number of session refresh a week is about 200k.
> > >
> > > I approximated around 1M of sessions a week, thus 52M a year.
> > > In memory, a user session has been estimated around 4KB (about 1KB in
> > > file/DB).
> > >
> > > But I guess a refresh does not create another session isn't it? And
> maybe
> > > it's possible to ask KC to delete previous emitted tokens when a new
> one is
> > > created for a same user?
> > >
> > > If yes, my estimation is probably a little bit too high here, but I
> > > certainly have several millions of tokens to keep (and maybe dozens of
> > > millions).
> > >
> > > Thanks
> > > --nick
> > >
> > > Le mer. 7 nov. 2018 ? 18:17, Nicolas Ocquidant <nocquidant at gmail.com>
> a
> > > ?crit :
> > >
> > > > Hi,
> > > >
> > > > According to Infinispan, when passivation is disabled, every update
> to
> > > the
> > > > cache should always write to the store.
> > > >
> > > > But I can't manage to get it work with Keycloak. If I disable
> > > passivation,
> > > > my SQL store (Postgres) stays empty, even if the cache is full.
> > > >
> > > > So, if passivation is needed for Keycloak to write to the DB, it
> means
> > > > that the use of a shared DB is not possible...
> > > >
> > > > But this leads to another issue for me. Enable passivation without a
> > > > shared DB seems to imply that either 'fetch-state' or 'purge' should
> be
> > > > enabled on startup, in order for the cache to not contain stale
> entries.
> > > >
> > > > 15:27:44,626 WARN
> > > >
> [org.infinispan.configuration.cache.AbstractStoreConfigurationBuilder]
> > > (MSC
> > > > service thread 1-6) ISPN000149: Fetch persistent state and purge on
> > > startup
> > > > are both disabled, cache may contain stale entries on startup
> > > >
> > > > As I need to keep millions of sessions, this will considerably slow
> down
> > > > the startup of my node (when started again after a crash for
> instance).
> > > >
> > > > So, is shared datastore allowed in Keycloak? If yes, how to enable
> it?
> > > > Otherwise what other options do I have to improve my startup time, if
> > > > millions of sessions are in the store?
> > > >
> > > > Thanks
> > > > --nick
> > > >
> > > _______________________________________________
> > > keycloak-user mailing list
> > > keycloak-user at lists.jboss.org
> > > https://lists.jboss.org/mailman/listinfo/keycloak-user
> >
>

From psilva at redhat.com  Fri Nov  9 08:36:49 2018
From: psilva at redhat.com (Pedro Igor Silva)
Date: Fri, 9 Nov 2018 11:36:49 -0200
Subject: [keycloak-user] /authz/protection/permission/ticket usage?
In-Reply-To: <CAP5c5mRbK_Y0LMJw_oUFJ4A9gLhG1qxeNK5C9=ue7ZWVV3C_Tw@mail.gmail.com>
References: <CAP5c5mRbK_Y0LMJw_oUFJ4A9gLhG1qxeNK5C9=ue7ZWVV3C_Tw@mail.gmail.com>
Message-ID: <CAJrcDBeE9UTNCimSRQQy3BOHoqZEbB8Y5a4QNR_=qhfG5tmEjg@mail.gmail.com>

Hi,

You can use "scopeName" and "requesterName" properties for that. Take a
look here
https://github.com/keycloak/keycloak/blob/5cbe595fe3094aae8135b8f2c729e9af0cbdd076/core/src/main/java/org/keycloak/representations/idm/authorization/PermissionTicketRepresentation.java#L22
.

Regards.
Pedro Igor

On Fri, Nov 9, 2018 at 7:18 AM Ulrik Sj?lin <ulrik.sjolin at gmail.com> wrote:

> Hello,
>
> I have a question on how to use the
> API: /authz/protection/permission/ticket
>
> I can call the endpoint successfully if I do the call with only ids:
>
> curl --silent -X POST \
>   http://
> ${host}:${port}/auth/realms/${realm}/authz/protection/permission/ticket
> \
>   -H "Authorization: Bearer ${service_access_token}" \
>   -H "Content-Type: application/json" \
>   -d "{
>         \"resource\":\"${resource_id}\",
>         \"scope\":\"40065a35-02d5-4db9-be46-02566cf7a666\",
>         \"requester\":\"79ae9a5a-0304-41ec-b721-d57a09d419cb\",
>         \"granted\":\"true\"
>     }?
>
> It would however be a lot more workable for me if I could use names like:
>
> curl --silent -X POST \
>   http://
> ${host}:${port}/auth/realms/${realm}/authz/protection/permission/ticket
> \
>   -H "Authorization: Bearer ${service_access_token}" \
>   -H "Content-Type: application/json" \
>   -d "{
>         \"resource\":\"${resource_id}\",
>         \"scope\":\?Read\",
>         \"requester\":\?alice\",
>         \"granted\":\"true\"
>     }?
>
> But when I do this I get:
>
> {"error":"invalid_scope","error_description":"Scope [Read] is invalid?}
> {"error":"invalid_permission","error_description":"Requester does not
> exists in this server as user.?}
>
> Looking at the code there seems to be lookups from names to id, but
> for some reason it fails. What
> am I doing wrong? Any help is greatly appreciated.
>
> Best Regards,
>
> Ulrik Sj?lin
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From robstyle1234 at gmail.com  Fri Nov  9 12:33:43 2018
From: robstyle1234 at gmail.com (ola rob)
Date: Fri, 9 Nov 2018 23:03:43 +0530
Subject: [keycloak-user] How can I use Keycloak to support my
	architecture?
Message-ID: <CAN7vkfib5QcMfTDwesbjRZqZz6uxqbkS5SxG98bhEwBPnZ2vRw@mail.gmail.com>

Thanks Luis for quick help! Can you please relate to my example? I mean
login-module is App3?

Also, how can I get the token once login is successful after redirected
back to my App3?

From uo67113 at gmail.com  Fri Nov  9 14:01:15 2018
From: uo67113 at gmail.com (=?UTF-8?Q?Luis_Rodr=C3=ADguez_Fern=C3=A1ndez?=)
Date: Fri, 9 Nov 2018 20:01:15 +0100
Subject: [keycloak-user] How can I use Keycloak to support my
	architecture?
In-Reply-To: <CAN7vkfib5QcMfTDwesbjRZqZz6uxqbkS5SxG98bhEwBPnZ2vRw@mail.gmail.com>
References: <CAN7vkfib5QcMfTDwesbjRZqZz6uxqbkS5SxG98bhEwBPnZ2vRw@mail.gmail.com>
Message-ID: <CACp70Mmu710boJDTcHzwohF2aDx14bxKu53rPsFxqUPGmuwQVw@mail.gmail.com>

Hello Ola,

Sorry for confusing you. Yes my /login-module would be your App3 one.

In App3 Once you are back from a successful login you have to:
 1. Create the token (cookie for path "/")
 2. Redirect the request to the original request
The code is in [1]

In my implementation APP3 is registered uses the tomcat SAML adapter, so is
the one that deals with the keycloak authentication server requests &
responses.

Hope it helps,

Luis

[1] https://gist.github.com/lurodrig/e1a20f480f3c4202c083a091ed68b0d7
[2]
https://www.keycloak.org/docs/latest/securing_apps/index.html#_saml-tomcat-adapter




El vie., 9 nov. 2018 a las 18:46, ola rob (<robstyle1234 at gmail.com>)
escribi?:

> Thanks Luis for quick help! Can you please relate to my example? I mean
> login-module is App3?
>
> Also, how can I get the token once login is successful after redirected
> back to my App3?
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>


-- 

"Ever tried. Ever failed. No matter. Try Again. Fail again. Fail better."

- Samuel Beckett

From t.rademacher at gmx.de  Fri Nov  9 14:01:50 2018
From: t.rademacher at gmx.de (Tim Rademacher)
Date: Fri, 9 Nov 2018 20:01:50 +0100
Subject: [keycloak-user] Verification of Access Token failed
Message-ID: <005501d4785e$ac2e4740$048ad5c0$@gmx.de>

Hi all,

 

I am struggling with access token verification.

 

So here is what I am doing (using Keycloak 4.5):

 

1.	Generate an offline auth code from Client A.
2.	Generate a refresh token from Client A.
3.	Generate an access token from Client A. This token has an *ES256*
Signatur.

 

When using this token, I got an error from my Spring Boot application, that
the used public key was not available: "Didn't find publicKey for specified
kid".

 

I set the public-key-cache-ttl to 1 sec and the log level to debug and could
see, that only one pubilc key was retrieved for my configured Client: "Realm
public keys successfully retrieved for client xxxxxxxxxx. New kids:
[xxxxx]".

 

As I could see in the realm settings, the key was created using *RS256*.

 

When I force the Client A to just use RS256 signature by setting the "Access
Token Signature Algorithm", then it works fine. But I wonder, how I could
also use other signature algorithms!? Release notes are stating, that both
(and more) algorithms are supported.

 

Thanks for your help!

 

Regards

 

Tim


From cmelean at gmail.com  Fri Nov  9 15:51:14 2018
From: cmelean at gmail.com (=?utf-8?Q?Calixto_Mele=C3=A1n?=)
Date: Fri, 9 Nov 2018 15:51:14 -0500
Subject: [keycloak-user] There is already a httpSessionManager
Message-ID: <9700A518-4D16-4EEB-A7AC-18B650F0D2C2@gmail.com>

I?m doing a simple tutorial with SpringBoot 2.1.0 and KeyCloack 4.5.0. When I start the app, I am getting the following error:

org.springframework.beans.factory.support.BeanDefinitionOverrideException: Invalid bean definition with name 'httpSessionManager' defined in class path resource [com/example/demo/configuration/SecurityConfig.class]: Cannot register bean definition [Root bean: class [null]; scope=; abstract=false; lazyInit=false; autowireMode=3; dependencyCheck=0; autowireCandidate=true; primary=false; factoryBeanName=securityConfig; factoryMethodName=httpSessionManager; initMethodName=null; destroyMethodName=(inferred); defined in class path resource [com/example/demo/configuration/SecurityConfig.class]] for bean 'httpSessionManager': There is already [Generic bean: class [org.keycloak.adapters.springsecurity.management.HttpSessionManager]; scope=singleton; abstract=false; lazyInit=false; autowireMode=0; dependencyCheck=0; autowireCandidate=true; primary=false; factoryBeanName=null; factoryMethodName=null; initMethodName=null; destroyMethodName=null; defined in URL [jar:file:/Users/bigcat/.m!
2/repository/org/keycloak/keycloak-spring-security-adapter/4.5.0.Final/keycloak-spring-security-adapter-4.5.0.Final.jar!/org/keycloak/adapters/springsecurity/management/HttpSessionManager.class]] bound.

Relevant maven dependencies I have are:

<dependency>
  <groupId>org.keycloak</groupId>
  <artifactId>keycloak-spring-boot-starter</artifactId>
  <version>${keycloak.version}</version>
</dependency>

<dependency>
  <groupId>org.springframework.boot</groupId>
  <artifactId>spring-boot-starter-security</artifactId>
</dependency>

SecurityConfig.class is:

@KeycloakConfiguration
public class SecurityConfig extends KeycloakWebSecurityConfigurerAdapter {

   @Bean
   public KeycloakConfigResolver KeycloakConfigResolver() {
       return new KeycloakSpringBootConfigResolver();
   }

   /**
    * Registers the KeycloakAuthenticationProvider with the authentication manager.
    */
   @Autowired
   public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
       auth.authenticationProvider(keycloakAuthenticationProvider());
   }

   /**
    * Defines the session authentication strategy.
    */
   @Bean
   @Override
   protected SessionAuthenticationStrategy sessionAuthenticationStrategy() {
       return new RegisterSessionAuthenticationStrategy(new SessionRegistryImpl());
   }

   @Override
   protected void configure(HttpSecurity http) throws Exception
   {
       super.configure(http);
       http
               .authorizeRequests()
               .antMatchers("/customers*").hasRole("pharmacist")
               .anyRequest().permitAll();
   }
}


Appreciate any help. Thanks

From dt at acutus.pro  Fri Nov  9 18:04:24 2018
From: dt at acutus.pro (Dmitry Telegin)
Date: Sat, 10 Nov 2018 02:04:24 +0300
Subject: [keycloak-user] group mapper per client
In-Reply-To: <VI1PR0402MB36964959EF7BB327906859D5E9CC0@VI1PR0402MB3696.eurprd04.prod.outlook.com>
References: <VI1PR0402MB3696F22D057049DF4B800480E9F30@VI1PR0402MB3696.eurprd04.prod.outlook.com>
	<1540868804.2121.1.camel@acutus.pro>
	<VI1PR0402MB36964959EF7BB327906859D5E9CC0@VI1PR0402MB3696.eurprd04.prod.outlook.com>
Message-ID: <1541804664.2031.1.camel@acutus.pro>

Ronald, sorry for late response,

You can use the following snippet:

function invalidGroup(context) {
    return context.form()
            .setError("Invalid group membership", []).createLogin();
}

function authenticate(context) {

    ...

    if (authShouldFail) {
        var challengeResponse = invalidGroup(context);
//        context.failure(AuthenticationFlowError.INVALID_USER);
        context.failureChallenge(AuthenticationFlowError.INVALID_CREDENTIALS, challengeResponse);
        return;
    }

    context.success();

}

Just FYI, I used the source code of Keycloak stock authenticators as a reference, like this one [1].

[1] https://github.com/keycloak/keycloak/blob/master/services/src/main/java/org/keycloak/authentication/authenticators/browser/AbstractUsernameFormAuthenticator.java#L203

Good luck,
Dmitry Telegin
CTO, Acutus s.r.o.
Keycloak Consulting and Training

Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
+42 (022) 888-30-71
E-mail: info at acutus.pro

On Tue, 2018-10-30 at 14:47 +0000, Ronald Demneri wrote:
> Almost forgot, If I set a static group name to compare against (which is not our goal, but just for testing), it works correctly if the account is member of that group. If the user is not a member, then it'll display an error like "Invalid username or password". Is it possible to modify the response in such cases, stating that the account is not a member of required groups, or at least have it like "Invalid group membership".
> 
> 
> Looking forward to hearing from you!
> 
> 
> Regards,
> Ronald
> 
> -----Original Message-----
> > From: Dmitry Telegin <dt at acutus.pro>?
> Sent: 30.Oct.2018 4:07 AM
> > To: Ronald Demneri <ronald.demneri at amdtia.com>; keycloak-user at lists.jboss.org
> Subject: Re: [keycloak-user] group mapper per client
> 
> Hello Ronald,
> 
> If there is a literal correspondence between your AD group names and client names (like e.g. if the client is named "foo", and the corresponding AD group is "AD_group_foo"), you can do the following trick:
> - make sure you have group-ldap-mapper configured in LDAP mappers, i.e. AD groups are synced to Keycloak groups;
> - create a Javascript authenticator that would check client name against user's groups, and add it to your authentication flow. If the user tries to authenticate against the client without being a member of the corresponding group, the authenticator should deny login.
> 
> If there is no such correspondence (e.g. the client is named "foo", and the group is "AD_group_bar"), you still have the following options:
> - map AD groups to Keycloak roles using role-ldap-mapper, then use your adapter's configuration to restrict access only to the users with this role (e.g. <security-constraint> in web.xml);
> - or map AD groups to Keycloak groups, enable authorization services and use group policy (if your client adapter supports authorization, of course).
> 
> This, however, will need to be configured per each client, on the contrary to the first approach (configured once per realm).
> 
> Let me know if you need further explanations, Dmitry Telegin CTO, Acutus s.r.o.
> Keycloak Consulting and Training
> 
> Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
> +42 (022) 888-30-71
> E-mail: info at acutus.pro
> 
> On Mon, 2018-10-29 at 15:35 +0000, Ronald Demneri wrote:
> > Hello everyone,
> > 
> > Please forgive me if this was already asked previously. After creating the LDAP connection (read-only) and some LDAP mappers, I am trying to figure out a way how to allow login to clients for users in respective groups in AD, for example for client app1 allow login to users that are members of AD_group_app1; if account is not a member of the app1 group in AD, then he should not be allowed to login. Is it also possible to do it via role mappings? Please note that we'd like to avoid modification of AD at all costs.
> > 
> > 
> > Thanks in advance,
> > Ronald
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user

From dt at acutus.pro  Fri Nov  9 18:18:32 2018
From: dt at acutus.pro (Dmitry Telegin)
Date: Sat, 10 Nov 2018 02:18:32 +0300
Subject: [keycloak-user] group mapper per client
In-Reply-To: <VI1PR0402MB3696AC0B264006DEB14A50EDE9CD0@VI1PR0402MB3696.eurprd04.prod.outlook.com>
References: <VI1PR0402MB3696F22D057049DF4B800480E9F30@VI1PR0402MB3696.eurprd04.prod.outlook.com>
	<1540868804.2121.1.camel@acutus.pro>
	<VI1PR0402MB3696AC0B264006DEB14A50EDE9CD0@VI1PR0402MB3696.eurprd04.prod.outlook.com>
Message-ID: <1541805512.2031.3.camel@acutus.pro>

Ronald, glad to hear it worked,

There is however an important moment regarding potential security issue with your authenticator.

Imagine the following scenario:
1. a user?with the correct group membership logs into the client app A;
2. the same user tries to access client B (for which he/she doesn't have group membership);
3. client B redirects the user to Keycloak for authentication;
4. due to cookie-based SSO, Keycloak decides that the user is already authenticated and logs him/her in client B.

To avoid this, you should turn off cookie-based auth for your restricted clients. Go to Authentication, create a copy of your browser flow (which should already have your script authenticator), remove Cookie, then go to your clients' settings and configure Authentication Flow Overrides for browser flow.

This will actually disable SSO to your clients. If this is not acceptable, there are some other options to consider (however more complex).

You should also make sure you don't enable token exchange between clients [1] (this is disabled by default).

[1] https://www.keycloak.org/docs/latest/securing_apps/index.html#internal-token-to-internal-token-exchange

Good luck,
Dmitry Telegin
CTO, Acutus s.r.o.
Keycloak Consulting and Training

Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
+42 (022) 888-30-71
E-mail: info at acutus.pro

On Wed, 2018-10-31 at 13:49 +0000, Ronald Demneri wrote:
> Hello everyone,
> 
> So, thankfully, after some careful reading, I managed to solve the first issue regarding clientSession.client.clientId, which in fact shoud be authenticationSession.client.clientId (there was a mention on using loginSession.client.clientId in place of clientSession.client.clientId on this link https://issues.jboss.org/browse/KEYCLOAK-4505, which I tried to use, without success).
> 
> 
> Regards,
> Ronald
> 
> -----Original Message-----
> From: Ronald Demneri?
> Sent: 30.Oct.2018 3:48 PM
> > To: 'Dmitry Telegin' <dt at acutus.pro>; keycloak-user at lists.jboss.org
> Subject: RE: [keycloak-user] group mapper per client
> 
> Almost forgot, If I set a static group name to compare against (which is not our goal, but just for testing), it works correctly if the account is member of that group. If the user is not a member, then it'll display an error like "Invalid username or password". Is it possible to modify the response in such cases, stating that the account is not a member of required groups, or at least have it like "Invalid group membership".
> 
> 
> Looking forward to hearing from you!
> 
> 
> Regards,
> Ronald
> 
> -----Original Message-----
> > From: Dmitry Telegin <dt at acutus.pro>?
> Sent: 30.Oct.2018 4:07 AM
> > To: Ronald Demneri <ronald.demneri at amdtia.com>; keycloak-user at lists.jboss.org
> Subject: Re: [keycloak-user] group mapper per client
> 
> Hello Ronald,
> 
> If there is a literal correspondence between your AD group names and client names (like e.g. if the client is named "foo", and the corresponding AD group is "AD_group_foo"), you can do the following trick:
> - make sure you have group-ldap-mapper configured in LDAP mappers, i.e. AD groups are synced to Keycloak groups;
> - create a Javascript authenticator that would check client name against user's groups, and add it to your authentication flow. If the user tries to authenticate against the client without being a member of the corresponding group, the authenticator should deny login.
> 
> If there is no such correspondence (e.g. the client is named "foo", and the group is "AD_group_bar"), you still have the following options:
> - map AD groups to Keycloak roles using role-ldap-mapper, then use your adapter's configuration to restrict access only to the users with this role (e.g. <security-constraint> in web.xml);
> - or map AD groups to Keycloak groups, enable authorization services and use group policy (if your client adapter supports authorization, of course).
> 
> This, however, will need to be configured per each client, on the contrary to the first approach (configured once per realm).
> 
> Let me know if you need further explanations, Dmitry Telegin CTO, Acutus s.r.o.
> Keycloak Consulting and Training
> 
> Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
> +42 (022) 888-30-71
> E-mail: info at acutus.pro
> 
> On Mon, 2018-10-29 at 15:35 +0000, Ronald Demneri wrote:
> > Hello everyone,
> > 
> > Please forgive me if this was already asked previously. After creating the LDAP connection (read-only) and some LDAP mappers, I am trying to figure out a way how to allow login to clients for users in respective groups in AD, for example for client app1 allow login to users that are members of AD_group_app1; if account is not a member of the app1 group in AD, then he should not be allowed to login. Is it also possible to do it via role mappings? Please note that we'd like to avoid modification of AD at all costs.
> > 
> > 
> > Thanks in advance,
> > Ronald
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user

From dt at acutus.pro  Fri Nov  9 18:34:16 2018
From: dt at acutus.pro (Dmitry Telegin)
Date: Sat, 10 Nov 2018 02:34:16 +0300
Subject: [keycloak-user] filter group claim in token per client
In-Reply-To: <VI1PR0402MB36962E1029F6BB26BC168EA4E9CB0@VI1PR0402MB3696.eurprd04.prod.outlook.com>
References: <VI1PR0402MB3696E4DCAFFE7EEEEB0EAF70E9CF0@VI1PR0402MB3696.eurprd04.prod.outlook.com>
	<1541397265.3650.7.camel@acutus.pro>
	<VI1PR0402MB369663EA52F0699AF650CE58E9CA0@VI1PR0402MB3696.eurprd04.prod.outlook.com>
	<VI1PR0402MB3696D1D1312CB4F7A65920FAE9CB0@VI1PR0402MB3696.eurprd04.prod.outlook.com>
	,
	<VI1PR0402MB36967CDFF7608457E6AB73BFE9CB0@VI1PR0402MB3696.eurprd04.prod.outlook.com>
	<VI1PR0402MB36962E1029F6BB26BC168EA4E9CB0@VI1PR0402MB3696.eurprd04.prod.outlook.com>
Message-ID: <1541806456.2031.5.camel@acutus.pro>

Ronald,

Here are some Pro Tips(tm) for you :)

- use keycloakSession.context.client.clientId to retrieve client ID (works for both tokens and userinfo);
- use Java.from() and Java.to() to convert objects and arrays from Java to JavaScript and vice versa;
- use more JavaScript-fu like map() and filter() to avoid looping over arrays;
- use RegExp for generic case-insensitive pattern matching.

With the above, your whole mapper could look as simple as this:

==========================================
/**
 * Available variables: 
 * user - the current user
 * realm - the current realm
 * token - the current token
 * userSession - the current userSession
 * keycloakSession - the current userSession
 */

var client = keycloakSession.context.client.clientId;

var groups = Java.from(user.groups)
    .map(function(group) {
        return group.name;
    })
    .filter(function(name) {
        return RegExp("(\\w+)-" + client + "-(\\w+)", "i").test(name);
    })

token.setOtherClaims("fGroup", Java.to(groups, "java.lang.String[]"))
==========================================

Please also read my earlier reply about the potential security issue with the script authenticator and how to mitigate it.

In fact, this problem (restricting access to clients based on group membership) has surfaced here at least three times during last month, so I think I'd write an article with the solution walkthrough. Stay tuned and good luck :)

Dmitry Telegin
CTO, Acutus s.r.o.
Keycloak Consulting and Training

Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
+42 (022) 888-30-71
E-mail: info at acutus.pro

On Tue, 2018-11-06 at 20:51 +0000, Ronald Demneri wrote:
> I configured the client to not use the userinfo endpoint for the group mapping.? Instead I used the id token,? and everything looks good now (no errors in the log,? and the client gets the claim, and assigns permissions accordingly) . Anyhow,? the question remains,? is there a way to get the client id using the script mapper?
> 
> Thanks in advance,?
> Ronald
> 
> Sent from my HTC
> 
> ----- Reply message -----
> > From: "Ronald Demneri" <ronald.demneri at amdtia.com>
> > > To: "Ronald Demneri" <ronald.demneri at amdtia.com>, "Dmitry Telegin" <dt at acutus.pro>, "keycloak-user at lists.jboss.org" <keycloak-user at lists.jboss.org>
> Subject: [keycloak-user] filter group claim in token per client
> Date: Tue, Nov 6, 2018 16:08
> 
> Hello again,
> 
> Upon testing login and experimenting where the claim should be inserted, I found out that the duplicate print() is a result of including the claim in both ID access tokens. The error comes as a result of including the claim in the userinfo token, and probably that is why the userinfo endpoint does not contain the claim when the client application requests it.
> 
> Any idea how to solve it?
> 
> 
> Thanks in advance,
> Ronald
> 
> -----Original Message-----
> From: Ronald Demneri?
> Sent: 06.Nov.2018 12:01 PM
> > To: Ronald Demneri <ronald.demneri at amdtia.com>; Dmitry Telegin <dt at acutus.pro>; keycloak-user at lists.jboss.org
> Subject: RE: [keycloak-user] filter group claim in token per client
> 
> So, I am looking at the logs and receive the following when going to App1 > Client Scopes > Evaluate:
> 
> 2018-11-06 10:51:42,407 INFO? [stdout] (default task-1892) ############################################ APP1
> 2018-11-06 10:51:42,407 INFO? [stdout] (default task-1892) ############################################
> 2018-11-06 10:51:42,407 INFO? [stdout] (default task-1892)? We are here!!!
> 2018-11-06 10:51:42,408 INFO? [stdout] (default task-1892) ############################################
> 
> But when trying to actually log in to the client, I receive the following:
> 
> 2018-11-06 10:52:20,465 INFO? [stdout] (default task-1891) ############################################ APP1
> 2018-11-06 10:52:20,465 INFO? [stdout] (default task-1891) ############################################
> 2018-11-06 10:52:20,465 INFO? [stdout] (default task-1891)? We are here!!!
> 2018-11-06 10:52:20,466 INFO? [stdout] (default task-1891) ############################################
> 2018-11-06 10:52:20,474 INFO? [stdout] (default task-1891) ############################################ APP1
> 2018-11-06 10:52:20,474 INFO? [stdout] (default task-1891) ############################################
> 2018-11-06 10:52:20,474 INFO? [stdout] (default task-1891)? We are here!!!
> 2018-11-06 10:52:20,475 INFO? [stdout] (default task-1891) ############################################
> 2018-11-06 10:52:20,691 ERROR [org.keycloak.protocol.oidc.mappers.ScriptBasedOIDCProtocolMapper] (default task-1891) Error during execution of ProtocolMapper script: org.keycloak.scripting.ScriptExecutionException: Could not execute script 'token-mapper-script_filteredGroupsMapper' problem was: TypeError: null has no such function "toUpperCase" in <eval> at line number 31
> 
> Line 31 is as follows:
> 
> 31:??? var client = token.getIssuedFor().toUpperCase();
> 32:??? print("############################################ " + client);
> 
> So why does it display an error, when in fact it also displays the correct form of the clientId in upper case? And why is the log entry duplicated? ATM, I removed the client scope mapper and have recreated the script mapper only for this client.
> 
> 
> Regards,
> Ronald
> 
> 
> -----Original Message-----
> From: Ronald Demneri?
> Sent: 06.Nov.2018 11:05 AM
> > > To: 'Ronald Demneri' <ronald.demneri at amdtia.com>; 'Dmitry Telegin' <dt at acutus.pro>; 'keycloak-user at lists.jboss.org' <keycloak-user at lists.jboss.org>
> Subject: RE: [keycloak-user] filter group claim in token per client
> 
> Hello Dmitry,
> 
> A colleague of mine helped solving the issue with the array, and I can see the filtered groups in the Access token. I also used token.getIssuedFor() to get the client name and make the evaluation of the filtered groups dynamic. The problem now is that this new claim is not present in the userinfo. This is the script that we came up with (configured both as client scopes (possibly define as a default client scope) as well as script mapper specific to this client for test purposes - claim names are different of course):
> 
> > [kcadmin at keycloak bin]$ ./kcadm.sh get client-scopes [ {
> ? "id" : "4ea94866-044e-4590-a2da-f25c980f08b4",
> ? "name" : "Filtered_Groups",
> ? "protocol" : "openid-connect",
> ? "attributes" : {
> ??? "display.on.consent.screen" : "true"
> ? },
> ? "protocolMappers" : [ {
> ??? "id" : "7d3c521a-b291-4f43-ad87-6891ed9584d3",
> ??? "name" : "Filtered Groups",
> ??? "protocol" : "openid-connect",
> ??? "protocolMapper" : "oidc-script-based-protocol-mapper",
> ??? "consentRequired" : false,
> ??? "config" : {
> ????? "multivalued" : "true",
> ????? "userinfo.token.claim" : "true",
> ????? "id.token.claim" : "true",
> ????? "access.token.claim" : "true",
> ????? "claim.name" : "fGroup",
> ????? "jsonType.label" : "String",
> ????? "script" : "/**
> ??????? * Available variables:
> ??????? * user - the current user
> ??????? * realm - the current realm
> ??????? * token - the current token
> ??????? * userSession - the current userSession
> ??????? * keycloakSession - the current userSession
> ??????? */
> ????????
> ??????? //insert your code here...
> 
> ??????? //So, first we need to know, how many names should be added to the new claim,
> ??????? var username = user ? user.username : \"anonymous\";
> ??????? var groups = user.getGroups();
> ??????? var group_array = groups.toArray();
> ??????? //print(\"########################################## \" + username);
> 
> ??????? var client = token.getIssuedFor();
> ??????? //print(\"############################################ \" + client);
> 
> ??????? var clUp = client.toUpperCase();
> ??????? //print(clUp);
> 
> ??????? var group_APP = \"APP-\" + clUp + \"-USERS\";
> ??????? var group_ROL = \"ROL_SSO-\" + clUp + \"-ADMIN\";
> 
> ??????? var group_filtered = [];
> 
> ??????? for (var i in group_array) {
> ??????????????? var gn = group_array[i].getName();
> ??????????????? var gnUp = gn.toUpperCase();
> ??????????????? if (gnUp === group_APP || gnUp === group_ROL) {
> ??????????????????????? group_filtered.push(\"/\" + gn);
> ??????????????????????? }
> ??????????????? }
> ??????? //Then we declare the new array.
> ??????? var l = group_filtered.length;
> ??????? var group_token = java.lang.reflect.Array.newInstance(java.lang.String.class, l);
> 
> ??????? for (var f in group_filtered) {
> ??????????????? group_token[f] = group_filtered[f];
> ??????????????? //print(group_token[f]);
> ??????? }
> 
> ??????? //And submit the array as token
> ??????? token.setOtherClaims(\"fGroup\", group_token);"
> ??? }
> ? } ]
> }
> 
> This is the userinfo data for my account:
> 
> {
> ? "sub": "bad7ff26-2a70-446f-a635-06fdbe1bec55",
> ? "Group": [
> ??? "/APP-App1-Users/TGR-Team-ABC",
> ??? "/APP-App1-Users/TGR-Team-DEF",
> ??? "/APP-App1-Users",
> ??? "/APP-MySmallApp-Users"
> ? ],
> ? "email_verified": false,
> ? "name": "Ronald Demneri",
> ? "preferred_username": "u151302",
> ? "given_name": "Ronald",
> ? "family_name": "Demneri"
> 
> 
> The group claim is inserted by the group mapper created for this client, and the idea is to remove it once the script mapper works as expected.
> What do you think is going on? Is this behavior normal?
> 
> Thanks in advance,
> Ronald
> 
> -----Original Message-----
> From: Ronald Demneri
> Sent: 05.Nov.2018 12:12 PM
> > To: 'Ronald Demneri' <ronald.demneri at amdtia.com>; Dmitry Telegin <dt at acutus.pro>; keycloak-user at lists.jboss.org
> Subject: RE: [keycloak-user] filter group claim in token per client
> 
> Hello,
> 
> In the script authenticator there was authenticationSession which I used to get the clientId. There is no such variable in the script mapper, and If I define such mapper in the client template, I suppose I'd need some mechanism to get the client name and then make the filtering of the groups that need to be inserted in the token. How do I do that? Is there any documentation available for this online?
> 
> 
> Thanks again for your support!
> Ronald
> 
> 
> -----Original Message-----
> > From: keycloak-user-bounces at lists.jboss.org <keycloak-user-bounces at lists.jboss.org> On Behalf Of Ronald Demneri
> Sent: 05.Nov.2018 11:00 AM
> > To: Dmitry Telegin <dt at acutus.pro>; keycloak-user at lists.jboss.org
> Subject: Re: [keycloak-user] filter group claim in token per client
> 
> Hello Dmitry,
> 
> Thanks for the response. In fact I tried that before posting here, created a custom script mapper for the client that I have configured. The problem is that the script will return a list of objects, not an array of strings, which is what I am expecting.
> 
> What do I need to pay extra attention in order to solve this?
> 
> 
> Thanks in advance and Regards,
> Ronald
> 
> -----Original Message-----
> > From: Dmitry Telegin <dt at acutus.pro>
> Sent: 05.Nov.2018 6:54 AM
> > To: Ronald Demneri <ronald.demneri at amdtia.com>; keycloak-user at lists.jboss.org
> Subject: Re: [keycloak-user] filter group claim in token per client
> 
> Hello Ronald,
> 
> As in the case with authentication, JavaScript is to the rescue again :) You can create a script mapper for groups that will do additional group filtering based on the client, and use it instead of the built-in one.
> 
> To avoid explicitly configuring it for each and every client, you can create a Client Scope (can be called "Client Template" depending on the KC version), define the mapper in the scope, and add it do default scopes.
> 
> Cheers,
> Dmitry Telegin
> CTO, Acutus s.r.o.
> Keycloak Consulting and Training
> 
> Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
> +42 (022) 888-30-71
> > E-mail: info at acutus.pro?
> 
> On Fri, 2018-11-02 at 10:30 +0000, Ronald Demneri wrote:
> > Hello everyone,
> >?
> > Is there a way to filter the groups a user is a member of per client, based on clientId (which is part of the group name(s) in AD). Let's say that user Ronald is member of??group_client1, group_client2 and group_client3, so using a group mapper, the token will contain a claim like group:["group_client1", "group_client2", "group_client3"]. Upon logging in to client1 app, I want to customize the group claim so that it contains only the respective group_client1 value.
> >?
> > Thanks in advance,
> >?
> > Ronald
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
> 
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From robstyle1234 at gmail.com  Sat Nov 10 09:15:28 2018
From: robstyle1234 at gmail.com (ola rob)
Date: Sat, 10 Nov 2018 19:45:28 +0530
Subject: [keycloak-user] How to enable keycloak for Embedded Jetty 9.3 server
Message-ID: <CAN7vkfhLoeDS4EbeLoNmDXexreEoz0kGJ60vSP6E-+D5pm4wzw@mail.gmail.com>

Hi,

I wanted to use jetty 9.3 adapter to secure my applications using keycloak.
But I see that keycloak doc talks about configuration on standalone jetty
servers but not on embedded jetty servers:
java -jar $JETTY_HOME/start.jar --add-to-startd=keycloak
My application uses embedded jetty server. Can you please provide steps to
enable keycloak module for embedded jetty server?

Thanks in advance!

From craig at baseventure.com  Sat Nov 10 10:00:37 2018
From: craig at baseventure.com (Craig Setera)
Date: Sat, 10 Nov 2018 09:00:37 -0600
Subject: [keycloak-user] Adding attributes during login
Message-ID: <CAPVdwjoF3W8C8xmJmapCNErL-Ey8b+bt4p-g-fe4WhFEeSKhDw@mail.gmail.com>

We have an attribute we use to allow customers to to "scope" or "namespace"
a users interaction with our system (a "partner code" that is known to our
system).  In our previous proprietary Java session-based security system,
this value was stored in the Java session at the time of login and used by
the authorization engine to further restrict what the user was allowed to
see.

As we transition to using Keycloak for authentication, I'm wondering if
there is a way to use Keycloak to manage this partner code during a login
session?  Some way to send the value during the Keycloak login sequence and
then later retrieve it based on the access token?

Thanks for any insights.
Craig

=================================
*Craig Setera*

*Chief Technology Officer*

From balazskov at gmail.com  Sat Nov 10 11:52:46 2018
From: balazskov at gmail.com (Balazs Kovacs)
Date: Sat, 10 Nov 2018 17:52:46 +0100
Subject: [keycloak-user] TLS configuration issues with 4.5.0
Message-ID: <CAPsZmKT6DwK8uQ9pLM=Dc8pJRrUCfMPLUCXDyjzGq97GsD9S5A@mail.gmail.com>

Hi,

I run a test instance of keycloak from public docker hub.

I'm able to set up the server with TLS on default port 8443 up until KC
4.3.0 with my own certificates. I did not try with 4.4.0, but 4.5.0 never
succeeds and ends up with a auto-generated self-signed certificate in any
case.

I attached the standalone.xml configuration I use. When I turn on DEBUG log
level, I get the below suspicious error that I thought is related:

ESC[0mESC[32m10:07:51,880 DEBUG [org.jboss.as.domain.management] (MSC
service thread 1-2) Starting 'ApplicationRealm' Security Realm Service
ESC[0mESC[32m10:07:52,028 DEBUG [org.jboss.modcluster] (MSC service thread
1-1) MODCLUSTER000005: Received add context event for
default-host:/wildfly-services
ESC[0mESC[32m10:07:52,032 DEBUG [org.jboss.modcluster] (MSC service thread
1-1) MODCLUSTER000007: Received start context event for
default-host:/wildfly-services
ESC[0mESC[32m10:07:52,124 DEBUG [io.undertow] (MSC service thread 1-1) JDK9
ALPN not supported: java.lang.NoSuchMethodException:
javax.net.ssl.SSLParameters.setApplicationProtocols([Ljava.lang.String;)
        at java.lang.Class.getMethod(Class.java:1786)
        at
io.undertow.protocols.alpn.JDK9AlpnProvider$1.run(JDK9AlpnProvider.java:47)
        at
io.undertow.protocols.alpn.JDK9AlpnProvider$1.run(JDK9AlpnProvider.java:43)
        at java.security.AccessController.doPrivileged(Native Method)
        at
io.undertow.protocols.alpn.JDK9AlpnProvider.<clinit>(JDK9AlpnProvider.java:43)
        at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native
Method)
        at
sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
        at
sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
        at java.lang.reflect.Constructor.newInstance(Constructor.java:423)
        at java.lang.Class.newInstance(Class.java:442)
        at
java.util.ServiceLoader$LazyIterator.nextService(ServiceLoader.java:380)
        at java.util.ServiceLoader$LazyIterator.next(ServiceLoader.java:404)
        at java.util.ServiceLoader$1.next(ServiceLoader.java:480)
        at
io.undertow.protocols.alpn.ALPNManager.<init>(ALPNManager.java:40)
        at
io.undertow.protocols.alpn.ALPNManager.<clinit>(ALPNManager.java:35)
        at
io.undertow.server.protocol.http.AlpnOpenListener.<init>(AlpnOpenListener.java:68)
        at
io.undertow.server.protocol.http.AlpnOpenListener.<init>(AlpnOpenListener.java:94)
        at
org.wildfly.extension.undertow.HttpsListenerService.createAlpnOpenListener(HttpsListenerService.java:123)
        at
org.wildfly.extension.undertow.HttpsListenerService.createOpenListener(HttpsListenerService.java:108)
        at
org.wildfly.extension.undertow.ListenerService.start(ListenerService.java:177)
        at
org.jboss.msc.service.ServiceControllerImpl$StartTask.startService(ServiceControllerImpl.java:1736)
        at
org.jboss.msc.service.ServiceControllerImpl$StartTask.execute(ServiceControllerImpl.java:1698)
        at
org.jboss.msc.service.ServiceControllerImpl$ControllerTask.run(ServiceControllerImpl.java:1556)
        at
org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35)
        at
org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1985)
        at
org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1487)
        at
org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1364)
        at java.lang.Thread.run(Thread.java:748)

Any idea what's going wrong with this version of keycloak docker image and
TLS setup?

Thanks,
Balazs
-------------- next part --------------
A non-text attachment was scrubbed...
Name: standalone-4.5.0.xml
Type: text/xml
Size: 32110 bytes
Desc: not available
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20181110/9bc9b821/attachment-0001.xml 

From dt at acutus.pro  Sat Nov 10 14:49:16 2018
From: dt at acutus.pro (Dmitry Telegin)
Date: Sat, 10 Nov 2018 22:49:16 +0300
Subject: [keycloak-user] Adding attributes during login
In-Reply-To: <CAPVdwjoF3W8C8xmJmapCNErL-Ey8b+bt4p-g-fe4WhFEeSKhDw@mail.gmail.com>
References: <CAPVdwjoF3W8C8xmJmapCNErL-Ey8b+bt4p-g-fe4WhFEeSKhDw@mail.gmail.com>
Message-ID: <1541879356.3515.1.camel@acutus.pro>

Hell Craig,

Do you mean the user should enter a "partner code" along with login+password? (either as a 3rd field or in a separate screen)
Or only once during registration / upon the first login?

Cheers,
Dmitry Telegin
CTO, Acutus s.r.o.
Keycloak Consulting and Training

Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
+42 (022) 888-30-71
E-mail: info at acutus.pro 

On Sat, 2018-11-10 at 09:00 -0600, Craig Setera wrote:
> We have an attribute we use to allow customers to to "scope" or "namespace"
> a users interaction with our system (a "partner code" that is known to our
> system).??In our previous proprietary Java session-based security system,
> this value was stored in the Java session at the time of login and used by
> the authorization engine to further restrict what the user was allowed to
> see.
> 
> As we transition to using Keycloak for authentication, I'm wondering if
> there is a way to use Keycloak to manage this partner code during a login
> session???Some way to send the value during the Keycloak login sequence and
> then later retrieve it based on the access token?
> 
> Thanks for any insights.
> Craig
> 
> =================================
> *Craig Setera*
> 
> *Chief Technology Officer*
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From craig at baseventure.com  Sat Nov 10 15:01:37 2018
From: craig at baseventure.com (Craig Setera)
Date: Sat, 10 Nov 2018 14:01:37 -0600
Subject: [keycloak-user] Adding attributes during login
In-Reply-To: <1541879356.3515.1.camel@acutus.pro>
References: <CAPVdwjoF3W8C8xmJmapCNErL-Ey8b+bt4p-g-fe4WhFEeSKhDw@mail.gmail.com>
	<1541879356.3515.1.camel@acutus.pro>
Message-ID: <CAPVdwjqYaxLiK4MTdupBgtw1W3+AFVWOnwCKRgk5_RHLjiyKhA@mail.gmail.com>

Dmitry,

Thanks for responding and sorry for not being more clear.

The circumstance is that a username may be associated with multiple
different companies in our system.  However, if the user is logging in from
a link that originated from company X, we want to limit what they are
authorized to view based on the incoming link to preserve the view of
separate tenancy.  So, the partner code is provided (hidden) for each
login.  The hope would be that it would be part of the initial login URL as
a query parameter, be captured in Keycloak and then made available
throughout the "session" associated with the access/refresh tokens.

Thanks!
Craig


=================================
*Craig Setera*

*Chief Technology Officer*

*415-324-5861**craig at baseventure.com <craig at baseventure.com>*




On Sat, Nov 10, 2018 at 1:49 PM Dmitry Telegin <dt at acutus.pro> wrote:

> Hell Craig,
>
> Do you mean the user should enter a "partner code" along with
> login+password? (either as a 3rd field or in a separate screen)
> Or only once during registration / upon the first login?
>
> Cheers,
> Dmitry Telegin
> CTO, Acutus s.r.o.
> Keycloak Consulting and Training
>
> Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
> +42 (022) 888-30-71
> E-mail: info at acutus.pro
>
> On Sat, 2018-11-10 at 09:00 -0600, Craig Setera wrote:
> > We have an attribute we use to allow customers to to "scope" or
> "namespace"
> > a users interaction with our system (a "partner code" that is known to
> our
> > system).  In our previous proprietary Java session-based security system,
> > this value was stored in the Java session at the time of login and used
> by
> > the authorization engine to further restrict what the user was allowed to
> > see.
> >
> > As we transition to using Keycloak for authentication, I'm wondering if
> > there is a way to use Keycloak to manage this partner code during a login
> > session?  Some way to send the value during the Keycloak login sequence
> and
> > then later retrieve it based on the access token?
> >
> > Thanks for any insights.
> > Craig
> >
> > =================================
> > *Craig Setera*
> >
> > *Chief Technology Officer*
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
>

From dt at acutus.pro  Sat Nov 10 15:11:14 2018
From: dt at acutus.pro (Dmitry Telegin)
Date: Sat, 10 Nov 2018 23:11:14 +0300
Subject: [keycloak-user] TLS configuration issues with 4.5.0
In-Reply-To: <CAPsZmKT6DwK8uQ9pLM=Dc8pJRrUCfMPLUCXDyjzGq97GsD9S5A@mail.gmail.com>
References: <CAPsZmKT6DwK8uQ9pLM=Dc8pJRrUCfMPLUCXDyjzGq97GsD9S5A@mail.gmail.com>
Message-ID: <1541880674.3515.4.camel@acutus.pro>

Hello Balasz,

Just FYI, Keycloak Docker image uses standalone-ha.xml by default starting from version 4.5.0, so you should use it instead of standalone.xml.

The warning in the log is unrelated, as it is caused by Keycloak runtime trying to discover some optional SSL features found in Java 9 only.

Cheers,
Dmitry Telegin
CTO, Acutus s.r.o.
Keycloak Consulting and Training

Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
+42 (022) 888-30-71
E-mail: info at acutus.pro

On Sat, 2018-11-10 at 17:52 +0100, Balazs Kovacs wrote:
> Hi,
> 
> I run a test instance of keycloak from public docker hub.
> 
> I'm able to set up the server with TLS on default port 8443 up until KC
> 4.3.0 with my own certificates. I did not try with 4.4.0, but 4.5.0 never
> succeeds and ends up with a auto-generated self-signed certificate in any
> case.
> 
> I attached the standalone.xml configuration I use. When I turn on DEBUG log
> level, I get the below suspicious error that I thought is related:
> 
> ESC[0mESC[32m10:07:51,880 DEBUG [org.jboss.as.domain.management] (MSC
> service thread 1-2) Starting 'ApplicationRealm' Security Realm Service
> ESC[0mESC[32m10:07:52,028 DEBUG [org.jboss.modcluster] (MSC service thread
> 1-1) MODCLUSTER000005: Received add context event for
> default-host:/wildfly-services
> ESC[0mESC[32m10:07:52,032 DEBUG [org.jboss.modcluster] (MSC service thread
> 1-1) MODCLUSTER000007: Received start context event for
> default-host:/wildfly-services
> ESC[0mESC[32m10:07:52,124 DEBUG [io.undertow] (MSC service thread 1-1) JDK9
> ALPN not supported: java.lang.NoSuchMethodException:
> javax.net.ssl.SSLParameters.setApplicationProtocols([Ljava.lang.String;)
> ????????at java.lang.Class.getMethod(Class.java:1786)
> ????????at
> io.undertow.protocols.alpn.JDK9AlpnProvider$1.run(JDK9AlpnProvider.java:47)
> ????????at
> io.undertow.protocols.alpn.JDK9AlpnProvider$1.run(JDK9AlpnProvider.java:43)
> ????????at java.security.AccessController.doPrivileged(Native Method)
> ????????at
> io.undertow.protocols.alpn.JDK9AlpnProvider.<clinit>(JDK9AlpnProvider.java:43)
> ????????at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native
> Method)
> ????????at
> sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
> ????????at
> sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
> ????????at java.lang.reflect.Constructor.newInstance(Constructor.java:423)
> ????????at java.lang.Class.newInstance(Class.java:442)
> ????????at
> java.util.ServiceLoader$LazyIterator.nextService(ServiceLoader.java:380)
> ????????at java.util.ServiceLoader$LazyIterator.next(ServiceLoader.java:404)
> ????????at java.util.ServiceLoader$1.next(ServiceLoader.java:480)
> ????????at
> io.undertow.protocols.alpn.ALPNManager.<init>(ALPNManager.java:40)
> ????????at
> io.undertow.protocols.alpn.ALPNManager.<clinit>(ALPNManager.java:35)
> ????????at
> io.undertow.server.protocol.http.AlpnOpenListener.<init>(AlpnOpenListener.java:68)
> ????????at
> io.undertow.server.protocol.http.AlpnOpenListener.<init>(AlpnOpenListener.java:94)
> ????????at
> org.wildfly.extension.undertow.HttpsListenerService.createAlpnOpenListener(HttpsListenerService.java:123)
> ????????at
> org.wildfly.extension.undertow.HttpsListenerService.createOpenListener(HttpsListenerService.java:108)
> ????????at
> org.wildfly.extension.undertow.ListenerService.start(ListenerService.java:177)
> ????????at
> org.jboss.msc.service.ServiceControllerImpl$StartTask.startService(ServiceControllerImpl.java:1736)
> ????????at
> org.jboss.msc.service.ServiceControllerImpl$StartTask.execute(ServiceControllerImpl.java:1698)
> ????????at
> org.jboss.msc.service.ServiceControllerImpl$ControllerTask.run(ServiceControllerImpl.java:1556)
> ????????at
> org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35)
> ????????at
> org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1985)
> ????????at
> org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1487)
> ????????at
> org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1364)
> ????????at java.lang.Thread.run(Thread.java:748)
> 
> Any idea what's going wrong with this version of keycloak docker image and
> TLS setup?
> 
> Thanks,
> Balazs
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From dt at acutus.pro  Sun Nov 11 00:31:08 2018
From: dt at acutus.pro (Dmitry Telegin)
Date: Sun, 11 Nov 2018 08:31:08 +0300
Subject: [keycloak-user] Adding attributes during login
In-Reply-To: <CAPVdwjqYaxLiK4MTdupBgtw1W3+AFVWOnwCKRgk5_RHLjiyKhA@mail.gmail.com>
References: <CAPVdwjoF3W8C8xmJmapCNErL-Ey8b+bt4p-g-fe4WhFEeSKhDw@mail.gmail.com>
	<1541879356.3515.1.camel@acutus.pro>
	<CAPVdwjqYaxLiK4MTdupBgtw1W3+AFVWOnwCKRgk5_RHLjiyKhA@mail.gmail.com>
Message-ID: <1541914268.3830.1.camel@acutus.pro>

Hello Craig,

Thanks for the explanation, it's pretty clear now. I guess that "partner code" is the same parameter you use to dynamically brand your login themes, right?

First, you need to extract it from your request parameters. In Keycloak, you can do this with a script authenticator. Things are a bit complicated by the fact that the initial incoming link (protocol/openid-connect/auth) does a POST to another endpoint (login-actions/authenticate), and the script authenticator is able introspect only the second request. Query parameters do not survive POST, but still can be found in the Referer header; therefore, you need to fish them out of there. (NB this will only work unless sending this header is disabled in the browser by a paranoid user :)

Create it as the last authenticator in the flow and make it "required". It's up to you how to handle the case where there is no "foo" parameter in the initial link.

===================================================
function authenticate(context) {

    var username = user ? user.username : "anonymous";

    var uri = new java.net.URI(httpRequest.httpHeaders.getHeaderString("Referer"));
    LOG.info(uri);
    var uriInfo = new org.jboss.resteasy.spi.ResteasyUriInfo(uri);
    var _foo = uriInfo.queryParameters['foo'];
    if (_foo !== null ){
        var foo = _foo[0]; // uriInfo.queryParameters is a multivalued map
        LOG.info(script.name + ": " + username + " foo=" + foo);
        authenticationSession.setUserSessionNote("foo", foo);
    }
    
    context.success();
    
}
===================================================

(Quick remark on terminology: in Keycloak's terms, "attributes" are persistent pieces of data attached to a user, group or realm; you can find them in the corresponding GUI tabs. Transient data is called "[session] notes".)

Next, you will need to propagate it to the tokens. Again, JavaScript to the rescue, this time in the form of script mapper (client -> Mappers):

===================================================
var foo = userSession.notes["foo"];

if (foo !== null) {
  token.setOtherClaims("foo", foo);    
}
===================================================

And voil?, your query parameter is now in the tokens :)

Good luck!
Dmitry Telegin
CTO, Acutus s.r.o.
Keycloak Consulting and Training

Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
+42 (022) 888-30-71
E-mail: info at acutus.pro

On Sat, 2018-11-10 at 14:01 -0600, Craig Setera wrote:
> Dmitry,
> 
> Thanks for responding and sorry for not being more clear.??
> 
> The circumstance is that a username may be associated with multiple different companies in our system.? However, if the user is logging in from a link that originated from company X, we want to limit what they are authorized to view based on the incoming link to preserve the view of separate tenancy.? So, the partner code is provided (hidden) for each login.? The hope would be that it would be part of the initial login URL as a query parameter, be captured in Keycloak and then made available throughout the "session" associated with the access/refresh tokens.
> 
> Thanks!
> Craig
> 
> 
> =================================
> Craig Setera
> Chief Technology Officer
> 415-324-5861
> craig at baseventure.com
> 
> 
> 
> 
> > On Sat, Nov 10, 2018 at 1:49 PM Dmitry Telegin <dt at acutus.pro> wrote:
> > Hell Craig,
> > 
> > Do you mean the user should enter a "partner code" along with login+password? (either as a 3rd field or in a separate screen)
> > Or only once during registration / upon the first login?
> > 
> > Cheers,
> > Dmitry Telegin
> > CTO, Acutus s.r.o.
> > Keycloak Consulting and Training
> > 
> > Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
> > +42 (022) 888-30-71
> > > > E-mail: info at acutus.pro?
> > 
> > On Sat, 2018-11-10 at 09:00 -0600, Craig Setera wrote:
> > > We have an attribute we use to allow customers to to "scope" or "namespace"
> > > a users interaction with our system (a "partner code" that is known to our
> > > system).??In our previous proprietary Java session-based security system,
> > > this value was stored in the Java session at the time of login and used by
> > > the authorization engine to further restrict what the user was allowed to
> > > see.
> > >?
> > > As we transition to using Keycloak for authentication, I'm wondering if
> > > there is a way to use Keycloak to manage this partner code during a login
> > > session???Some way to send the value during the Keycloak login sequence and
> > > then later retrieve it based on the access token?
> > >?
> > > Thanks for any insights.
> > > Craig
> > >?
> > > =================================
> > > *Craig Setera*
> > >?
> > > *Chief Technology Officer*
> > > _______________________________________________
> > > keycloak-user mailing list
> > > keycloak-user at lists.jboss.org
> > > https://lists.jboss.org/mailman/listinfo/keycloak-user
> > 

From craig at baseventure.com  Sun Nov 11 07:56:44 2018
From: craig at baseventure.com (Craig Setera)
Date: Sun, 11 Nov 2018 06:56:44 -0600
Subject: [keycloak-user] Adding attributes during login
In-Reply-To: <1541914268.3830.1.camel@acutus.pro>
References: <CAPVdwjoF3W8C8xmJmapCNErL-Ey8b+bt4p-g-fe4WhFEeSKhDw@mail.gmail.com>
	<1541879356.3515.1.camel@acutus.pro>
	<CAPVdwjqYaxLiK4MTdupBgtw1W3+AFVWOnwCKRgk5_RHLjiyKhA@mail.gmail.com>
	<1541914268.3830.1.camel@acutus.pro>
Message-ID: <CAPVdwjp-ajdwm0Ey4M0W-tuDZMMTp91a=jxF8aRc6WP0C2tKxQ@mail.gmail.com>

Wow!  This is great.  Thanks so much.  I will have to give this a try this
week and see if I can make it work.  You are correct that this is also the
code that we want to use to drive our branding.  Are the session notes or
token claims available to the theme engine?

=================================
*Craig Setera*

*Chief Technology Officer*

*415-324-5861**craig at baseventure.com <craig at baseventure.com>*




On Sat, Nov 10, 2018 at 11:31 PM Dmitry Telegin <dt at acutus.pro> wrote:

> Hello Craig,
>
> Thanks for the explanation, it's pretty clear now. I guess that "partner
> code" is the same parameter you use to dynamically brand your login themes,
> right?
>
> First, you need to extract it from your request parameters. In Keycloak,
> you can do this with a script authenticator. Things are a bit complicated
> by the fact that the initial incoming link (protocol/openid-connect/auth)
> does a POST to another endpoint (login-actions/authenticate), and the
> script authenticator is able introspect only the second request. Query
> parameters do not survive POST, but still can be found in the Referer
> header; therefore, you need to fish them out of there. (NB this will only
> work unless sending this header is disabled in the browser by a paranoid
> user :)
>
> Create it as the last authenticator in the flow and make it "required".
> It's up to you how to handle the case where there is no "foo" parameter in
> the initial link.
>
> ===================================================
> function authenticate(context) {
>
>     var username = user ? user.username : "anonymous";
>
>     var uri = new
> java.net.URI(httpRequest.httpHeaders.getHeaderString("Referer"));
>     LOG.info(uri);
>     var uriInfo = new org.jboss.resteasy.spi.ResteasyUriInfo(uri);
>     var _foo = uriInfo.queryParameters['foo'];
>     if (_foo !== null ){
>         var foo = _foo[0]; // uriInfo.queryParameters is a multivalued map
>         LOG.info(script.name + ": " + username + " foo=" + foo);
>         authenticationSession.setUserSessionNote("foo", foo);
>     }
>
>     context.success();
>
> }
> ===================================================
>
> (Quick remark on terminology: in Keycloak's terms, "attributes" are
> persistent pieces of data attached to a user, group or realm; you can find
> them in the corresponding GUI tabs. Transient data is called "[session]
> notes".)
>
> Next, you will need to propagate it to the tokens. Again, JavaScript to
> the rescue, this time in the form of script mapper (client -> Mappers):
>
> ===================================================
> var foo = userSession.notes["foo"];
>
> if (foo !== null) {
>   token.setOtherClaims("foo", foo);
> }
> ===================================================
>
> And voil?, your query parameter is now in the tokens :)
>
> Good luck!
> Dmitry Telegin
> CTO, Acutus s.r.o.
> Keycloak Consulting and Training
>
> Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
> +42 (022) 888-30-71
> E-mail: info at acutus.pro
>
> On Sat, 2018-11-10 at 14:01 -0600, Craig Setera wrote:
> > Dmitry,
> >
> > Thanks for responding and sorry for not being more clear.
> >
> > The circumstance is that a username may be associated with multiple
> different companies in our system.  However, if the user is logging in from
> a link that originated from company X, we want to limit what they are
> authorized to view based on the incoming link to preserve the view of
> separate tenancy.  So, the partner code is provided (hidden) for each
> login.  The hope would be that it would be part of the initial login URL as
> a query parameter, be captured in Keycloak and then made available
> throughout the "session" associated with the access/refresh tokens.
> >
> > Thanks!
> > Craig
> >
> >
> > =================================
> > Craig Setera
> > Chief Technology Officer
> > 415-324-5861
> > craig at baseventure.com
> >
> >
> >
> >
> > > On Sat, Nov 10, 2018 at 1:49 PM Dmitry Telegin <dt at acutus.pro> wrote:
> > > Hell Craig,
> > >
> > > Do you mean the user should enter a "partner code" along with
> login+password? (either as a 3rd field or in a separate screen)
> > > Or only once during registration / upon the first login?
> > >
> > > Cheers,
> > > Dmitry Telegin
> > > CTO, Acutus s.r.o.
> > > Keycloak Consulting and Training
> > >
> > > Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
> > > +42 (022) 888-30-71
> > > > > E-mail: info at acutus.pro
> > >
> > > On Sat, 2018-11-10 at 09:00 -0600, Craig Setera wrote:
> > > > We have an attribute we use to allow customers to to "scope" or
> "namespace"
> > > > a users interaction with our system (a "partner code" that is known
> to our
> > > > system).  In our previous proprietary Java session-based security
> system,
> > > > this value was stored in the Java session at the time of login and
> used by
> > > > the authorization engine to further restrict what the user was
> allowed to
> > > > see.
> > > >
> > > > As we transition to using Keycloak for authentication, I'm wondering
> if
> > > > there is a way to use Keycloak to manage this partner code during a
> login
> > > > session?  Some way to send the value during the Keycloak login
> sequence and
> > > > then later retrieve it based on the access token?
> > > >
> > > > Thanks for any insights.
> > > > Craig
> > > >
> > > > =================================
> > > > *Craig Setera*
> > > >
> > > > *Chief Technology Officer*
> > > > _______________________________________________
> > > > keycloak-user mailing list
> > > > keycloak-user at lists.jboss.org
> > > > https://lists.jboss.org/mailman/listinfo/keycloak-user
> > >
>

From dt at acutus.pro  Sun Nov 11 18:47:08 2018
From: dt at acutus.pro (Dmitry Telegin)
Date: Mon, 12 Nov 2018 02:47:08 +0300
Subject: [keycloak-user] Adding attributes during login
In-Reply-To: <CAPVdwjp-ajdwm0Ey4M0W-tuDZMMTp91a=jxF8aRc6WP0C2tKxQ@mail.gmail.com>
References: <CAPVdwjoF3W8C8xmJmapCNErL-Ey8b+bt4p-g-fe4WhFEeSKhDw@mail.gmail.com>
	<1541879356.3515.1.camel@acutus.pro>
	<CAPVdwjqYaxLiK4MTdupBgtw1W3+AFVWOnwCKRgk5_RHLjiyKhA@mail.gmail.com>
	<1541914268.3830.1.camel@acutus.pro>
	<CAPVdwjp-ajdwm0Ey4M0W-tuDZMMTp91a=jxF8aRc6WP0C2tKxQ@mail.gmail.com>
Message-ID: <1541980028.2048.1.camel@acutus.pro>

Hi Craig, you're welcome :)

As for "theme engine", in fact there are five types thereof in Keycloak:
- Welcome theme
- Login theme
- Admin console theme
- Email theme
- Account theme

Which one is most relevant to your problem? And, more generally, what are you trying to achieve?

Cheers,
Dmitry

On Sun, 2018-11-11 at 06:56 -0600, Craig Setera wrote:
> Wow!? This is great.? Thanks so much.? I will have to give this a try this week and see if I can make it work.? You are correct that this is also the code that we want to use to drive our branding.? Are the session notes or token claims available to the theme engine???
> 
> =================================
> Craig Setera
> Chief Technology Officer
> 415-324-5861
> craig at baseventure.com
> 
> 
> 
> 
> > On Sat, Nov 10, 2018 at 11:31 PM Dmitry Telegin <dt at acutus.pro> wrote:
> > Hello Craig,
> > 
> > Thanks for the explanation, it's pretty clear now. I guess that "partner code" is the same parameter you use to dynamically brand your login themes, right?
> > 
> > First, you need to extract it from your request parameters. In Keycloak, you can do this with a script authenticator. Things are a bit complicated by the fact that the initial incoming link (protocol/openid-connect/auth) does a POST to another endpoint (login-actions/authenticate), and the script authenticator is able introspect only the second request. Query parameters do not survive POST, but still can be found in the Referer header; therefore, you need to fish them out of there. (NB this will only work unless sending this header is disabled in the browser by a paranoid user :)
> > 
> > Create it as the last authenticator in the flow and make it "required". It's up to you how to handle the case where there is no "foo" parameter in the initial link.
> > 
> > ===================================================
> > function authenticate(context) {
> > 
> > ? ? var username = user ? user.username : "anonymous";
> > 
> > ? ? var uri = new java.net.URI(httpRequest.httpHeaders.getHeaderString("Referer"));
> > ? ? LOG.info(uri);
> > ? ? var uriInfo = new org.jboss.resteasy.spi.ResteasyUriInfo(uri);
> > ? ? var _foo = uriInfo.queryParameters['foo'];
> > ? ? if (_foo !== null ){
> > ? ? ? ? var foo = _foo[0]; // uriInfo.queryParameters is a multivalued map
> > ? ? ? ? LOG.info(script.name + ": " + username + " foo=" + foo);
> > ? ? ? ? authenticationSession.setUserSessionNote("foo", foo);
> > ? ? }
> > 
> > ? ? context.success();
> > 
> > }
> > ===================================================
> > 
> > (Quick remark on terminology: in Keycloak's terms, "attributes" are persistent pieces of data attached to a user, group or realm; you can find them in the corresponding GUI tabs. Transient data is called "[session] notes".)
> > 
> > Next, you will need to propagate it to the tokens. Again, JavaScript to the rescue, this time in the form of script mapper (client -> Mappers):
> > 
> > ===================================================
> > var foo = userSession.notes["foo"];
> > 
> > if (foo !== null) {
> > ? token.setOtherClaims("foo", foo);? ??
> > }
> > ===================================================
> > 
> > And voil?, your query parameter is now in the tokens :)
> > 
> > Good luck!
> > Dmitry Telegin
> > CTO, Acutus s.r.o.
> > Keycloak Consulting and Training
> > 
> > Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
> > +42 (022) 888-30-71
> > E-mail: info at acutus.pro
> > 
> > On Sat, 2018-11-10 at 14:01 -0600, Craig Setera wrote:
> > > Dmitry,
> > >?
> > > Thanks for responding and sorry for not being more clear.??
> > >?
> > > The circumstance is that a username may be associated with multiple different companies in our system.? However, if the user is logging in from a link that originated from company X, we want to limit what they are authorized to view based on the incoming link to preserve the view of separate tenancy.? So, the partner code is provided (hidden) for each login.? The hope would be that it would be part of the initial login URL as a query parameter, be captured in Keycloak and then made available throughout the "session" associated with the access/refresh tokens.
> > >?
> > > Thanks!
> > > Craig
> > >?
> > >?
> > > =================================
> > > Craig Setera
> > > Chief Technology Officer
> > > 415-324-5861
> > > craig at baseventure.com
> > >?
> > >?
> > >?
> > >?
> > > > > > On Sat, Nov 10, 2018 at 1:49 PM Dmitry Telegin <dt at acutus.pro> wrote:
> > > > Hell Craig,
> > > >?
> > > > Do you mean the user should enter a "partner code" along with login+password? (either as a 3rd field or in a separate screen)
> > > > Or only once during registration / upon the first login?
> > > >?
> > > > Cheers,
> > > > Dmitry Telegin
> > > > CTO, Acutus s.r.o.
> > > > Keycloak Consulting and Training
> > > >?
> > > > Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
> > > > +42 (022) 888-30-71
> > > > > > > > E-mail: info at acutus.pro?
> > > >?
> > > > On Sat, 2018-11-10 at 09:00 -0600, Craig Setera wrote:
> > > > > We have an attribute we use to allow customers to to "scope" or "namespace"
> > > > > a users interaction with our system (a "partner code" that is known to our
> > > > > system).??In our previous proprietary Java session-based security system,
> > > > > this value was stored in the Java session at the time of login and used by
> > > > > the authorization engine to further restrict what the user was allowed to
> > > > > see.
> > > > >?
> > > > > As we transition to using Keycloak for authentication, I'm wondering if
> > > > > there is a way to use Keycloak to manage this partner code during a login
> > > > > session???Some way to send the value during the Keycloak login sequence and
> > > > > then later retrieve it based on the access token?
> > > > >?
> > > > > Thanks for any insights.
> > > > > Craig
> > > > >?
> > > > > =================================
> > > > > *Craig Setera*
> > > > >?
> > > > > *Chief Technology Officer*
> > > > > _______________________________________________
> > > > > keycloak-user mailing list
> > > > > keycloak-user at lists.jboss.org
> > > > > https://lists.jboss.org/mailman/listinfo/keycloak-user
> > > >?
> > 

From craig at baseventure.com  Sun Nov 11 20:12:50 2018
From: craig at baseventure.com (Craig Setera)
Date: Sun, 11 Nov 2018 19:12:50 -0600
Subject: [keycloak-user] Adding attributes during login
In-Reply-To: <1541980028.2048.1.camel@acutus.pro>
References: <CAPVdwjoF3W8C8xmJmapCNErL-Ey8b+bt4p-g-fe4WhFEeSKhDw@mail.gmail.com>
	<1541879356.3515.1.camel@acutus.pro>
	<CAPVdwjqYaxLiK4MTdupBgtw1W3+AFVWOnwCKRgk5_RHLjiyKhA@mail.gmail.com>
	<1541914268.3830.1.camel@acutus.pro>
	<CAPVdwjp-ajdwm0Ey4M0W-tuDZMMTp91a=jxF8aRc6WP0C2tKxQ@mail.gmail.com>
	<1541980028.2048.1.camel@acutus.pro>
Message-ID: <CAPVdwjrMsAZ1q25ueyT7odjGQ8N12phFTCVhxQwRKO9bncBONw@mail.gmail.com>

We want to "brand" (color and logo) the user-facing parts of the
application based on the partner code.  I think that means:

- Login theme
- Email theme
- Account theme

Craig

=================================
*Craig Setera*

*Chief Technology Officer*




On Sun, Nov 11, 2018 at 5:47 PM Dmitry Telegin <dt at acutus.pro> wrote:

> Hi Craig, you're welcome :)
>
> As for "theme engine", in fact there are five types thereof in Keycloak:
> - Welcome theme
> - Login theme
> - Admin console theme
> - Email theme
> - Account theme
>
> Which one is most relevant to your problem? And, more generally, what are
> you trying to achieve?
>
> Cheers,
> Dmitry
>
> On Sun, 2018-11-11 at 06:56 -0600, Craig Setera wrote:
> > Wow!  This is great.  Thanks so much.  I will have to give this a try
> this week and see if I can make it work.  You are correct that this is also
> the code that we want to use to drive our branding.  Are the session notes
> or token claims available to the theme engine?
> >
> > =================================
> > Craig Setera
> > Chief Technology Officer
> > 415-324-5861
> > craig at baseventure.com
> >
> >
> >
> >
> > > On Sat, Nov 10, 2018 at 11:31 PM Dmitry Telegin <dt at acutus.pro> wrote:
> > > Hello Craig,
> > >
> > > Thanks for the explanation, it's pretty clear now. I guess that
> "partner code" is the same parameter you use to dynamically brand your
> login themes, right?
> > >
> > > First, you need to extract it from your request parameters. In
> Keycloak, you can do this with a script authenticator. Things are a bit
> complicated by the fact that the initial incoming link
> (protocol/openid-connect/auth) does a POST to another endpoint
> (login-actions/authenticate), and the script authenticator is able
> introspect only the second request. Query parameters do not survive POST,
> but still can be found in the Referer header; therefore, you need to fish
> them out of there. (NB this will only work unless sending this header is
> disabled in the browser by a paranoid user :)
> > >
> > > Create it as the last authenticator in the flow and make it
> "required". It's up to you how to handle the case where there is no "foo"
> parameter in the initial link.
> > >
> > > ===================================================
> > > function authenticate(context) {
> > >
> > >     var username = user ? user.username : "anonymous";
> > >
> > >     var uri = new
> java.net.URI(httpRequest.httpHeaders.getHeaderString("Referer"));
> > >     LOG.info(uri);
> > >     var uriInfo = new org.jboss.resteasy.spi.ResteasyUriInfo(uri);
> > >     var _foo = uriInfo.queryParameters['foo'];
> > >     if (_foo !== null ){
> > >         var foo = _foo[0]; // uriInfo.queryParameters is a multivalued
> map
> > >         LOG.info(script.name + ": " + username + " foo=" + foo);
> > >         authenticationSession.setUserSessionNote("foo", foo);
> > >     }
> > >
> > >     context.success();
> > >
> > > }
> > > ===================================================
> > >
> > > (Quick remark on terminology: in Keycloak's terms, "attributes" are
> persistent pieces of data attached to a user, group or realm; you can find
> them in the corresponding GUI tabs. Transient data is called "[session]
> notes".)
> > >
> > > Next, you will need to propagate it to the tokens. Again, JavaScript
> to the rescue, this time in the form of script mapper (client -> Mappers):
> > >
> > > ===================================================
> > > var foo = userSession.notes["foo"];
> > >
> > > if (foo !== null) {
> > >   token.setOtherClaims("foo", foo);
> > > }
> > > ===================================================
> > >
> > > And voil?, your query parameter is now in the tokens :)
> > >
> > > Good luck!
> > > Dmitry Telegin
> > > CTO, Acutus s.r.o.
> > > Keycloak Consulting and Training
> > >
> > > Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
> > > +42 (022) 888-30-71
> > > E-mail: info at acutus.pro
> > >
> > > On Sat, 2018-11-10 at 14:01 -0600, Craig Setera wrote:
> > > > Dmitry,
> > > >
> > > > Thanks for responding and sorry for not being more clear.
> > > >
> > > > The circumstance is that a username may be associated with multiple
> different companies in our system.  However, if the user is logging in from
> a link that originated from company X, we want to limit what they are
> authorized to view based on the incoming link to preserve the view of
> separate tenancy.  So, the partner code is provided (hidden) for each
> login.  The hope would be that it would be part of the initial login URL as
> a query parameter, be captured in Keycloak and then made available
> throughout the "session" associated with the access/refresh tokens.
> > > >
> > > > Thanks!
> > > > Craig
> > > >
> > > >
> > > > =================================
> > > > Craig Setera
> > > > Chief Technology Officer
> > > > 415-324-5861
> > > > craig at baseventure.com
> > > >
> > > >
> > > >
> > > >
> > > > > > > On Sat, Nov 10, 2018 at 1:49 PM Dmitry Telegin <dt at acutus.pro>
> wrote:
> > > > > Hell Craig,
> > > > >
> > > > > Do you mean the user should enter a "partner code" along with
> login+password? (either as a 3rd field or in a separate screen)
> > > > > Or only once during registration / upon the first login?
> > > > >
> > > > > Cheers,
> > > > > Dmitry Telegin
> > > > > CTO, Acutus s.r.o.
> > > > > Keycloak Consulting and Training
> > > > >
> > > > > Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
> > > > > +42 (022) 888-30-71
> > > > > > > > > E-mail: info at acutus.pro
> > > > >
> > > > > On Sat, 2018-11-10 at 09:00 -0600, Craig Setera wrote:
> > > > > > We have an attribute we use to allow customers to to "scope" or
> "namespace"
> > > > > > a users interaction with our system (a "partner code" that is
> known to our
> > > > > > system).  In our previous proprietary Java session-based
> security system,
> > > > > > this value was stored in the Java session at the time of login
> and used by
> > > > > > the authorization engine to further restrict what the user was
> allowed to
> > > > > > see.
> > > > > >
> > > > > > As we transition to using Keycloak for authentication, I'm
> wondering if
> > > > > > there is a way to use Keycloak to manage this partner code
> during a login
> > > > > > session?  Some way to send the value during the Keycloak login
> sequence and
> > > > > > then later retrieve it based on the access token?
> > > > > >
> > > > > > Thanks for any insights.
> > > > > > Craig
> > > > > >
> > > > > > =================================
> > > > > > *Craig Setera*
> > > > > >
> > > > > > *Chief Technology Officer*
> > > > > > _______________________________________________
> > > > > > keycloak-user mailing list
> > > > > > keycloak-user at lists.jboss.org
> > > > > > https://lists.jboss.org/mailman/listinfo/keycloak-user
> > > > >
> > >
>

From dt at acutus.pro  Sun Nov 11 22:22:18 2018
From: dt at acutus.pro (Dmitry Telegin)
Date: Mon, 12 Nov 2018 06:22:18 +0300
Subject: [keycloak-user] OpenID Java Adapter: configuring keycloak to
 use an IDP different then Keycloak Server
In-Reply-To: <1541760579107.82395@cjsm.vlaanderen.be>
References: <1541686439063.37605@cjsm.vlaanderen.be>
	,<1541735155.15117.3.camel@acutus.pro>
	<1541760579107.82395@cjsm.vlaanderen.be>
Message-ID: <1541992938.2048.3.camel@acutus.pro>

Hi Fabrizio,

On Fri, 2018-11-09 at 10:49 +0000, Usai, Fabrizio wrote:
> Hi Dmitry,
> 
> thanks a lot for this elaborate clarification. :) It is clear to us what roads we can follow now.

You're welcome :)

> First, I asked this question before on stackoverflow. https://stackoverflow.com/questions/53192776/how-to-change-authentication-url-generated-by-keycloak-openid-connect-java-adapt.??Is it ok if I add your reply as an answer there (I will only put there relevant parts)? I believe there will be other people asking the same question...

Sure. I think?I'll even write an article / blog post on that. Stay tuned :)

> Secondly, considering your recommended way (we love bulletproof solutions ;-)), a Keycloak server, I see I have two options: the full server or the Wildfly add-on. We use EAP 7.1. Can we use the add-on on our server? I also noticed that on the download page you do not recommend this for production use. So I was taking into consideration to install the full Keycloak server. But can we use this server then also to deploy our application? It seems to me that it should be possible since the Keycloak server has a fully featured standalone folder... Of course, we want to avoid to run two EAP instances, if possible ;)

So, if you want just a single server, there are basically two options:
1) install?Keycloak add-on on top of existing Wildfly/EAP;
2) use Keycloak (in fact, the underlying Wildfly) as an application server.

Both methods are not recommended for production :) I think this is mainly because they are not tested as thoroughly as the stock Keycloak+Wildfly bundle. But you are free to become a tester :)

There are however things to consider. If you go with add-on, you should install it on top of exactly the same Wildfly version that official standalone Keycloak is built on top of; otherwise, the results will be unpredictable. Cannot tell anything about EAP either.
If you choose the second variant, please remember that Keycloak's Wildfly is somewhat stripped-down, with modules like webservices and weld excluded from the default configuration.

> 
> Regarding the Intuit question, I am not sure. It is another department who is responsible for this, I am just in the development team. But it could be they use Intuit behind the scenes. We only receive stuff like authentication url, clientId and secret and so on and we have to make it work :-) The well-known configuration we received from them, does look a lot like yours.?
> 
> Thirdly, I will make a JIRA issue for this. Or should I wait first a reply from the Keycloak developers? To be honest, it's the first time I use a mailing list... No idea who can reply on this email.

Let's start with the posting to keycloak-dev mailing list. I'll put you in CC.

Cheers,
Dmitry Telegin
CTO, Acutus s.r.o.
Keycloak Consulting and Training

Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
+42 (022) 888-30-71
E-mail: info at acutus.pro

> 
> KR,
> 
> Fabrizio Usai
> 
> ________________________________________
> > Van: Dmitry Telegin <dt at acutus.pro>
> Verzonden: vrijdag 9 november 2018 04:45
> Aan: Usai, Fabrizio; keycloak-user at lists.jboss.org
> Onderwerp: Re: [keycloak-user] OpenID Java Adapter: configuring keycloak to use an IDP different then Keycloak Server
> 
> Hello Fabrizio,
> 
> Indeed, string templates like "/realms/{realm-name}/protocol/openid-connect/auth" are hardcoded into Keycloak adapters [1] [2].
> 
> Luckily, there seems to be a workaround. In Keycloak, there is a mechanism for multitenancy [3]; it requires you to supply a resolver that would return a KeycloakDeployment instance based on request parameters.
> One of its bonus features is that you can completely redefine the behavior of KeycloakDeployment. For example, you can extend org.keycloak.adapters.KeycloakDeployment and override its resolveUrls() method, to make the URLs point to your 3rd party IDP.
> 
> This approach doesn't require any modifications to the adapter code, so I'd recommend you start with it. However, I wouldn't rule out further incompatibilities that could pop up.
> 
> Another option is installing an intermediary Keycloak (server), configuring brokering to 3rd party IDP and pointing your adapter to Keycloak. Though sounds like an overkill, it's a bulletproof solution that should work 100% (and it also has some other benefits).
> 
> There are of course other options like using 3rd party IDP's equivalent for Keycloak adapter (is it Intuit BTW?), or using other OpenID Connect Java libraries [4], or even proxy-level adapters like apache-mod_auth_openidc [5] or Keycloak Gatekeeper [6]. But I understand that this would probably require code rewrite, so you should consider these options only as the last resort.
> 
> As for SAML and why it used to work: Keycloak adapter uses standard SAML SP metadata for configuration, which defines URLs strictly and unambiguously; here we need to admit that SAML is more mature and feature-complete.
> 
> OIDC, on the contrary, allows for some freedom. At the moment, Keycloak OIDC adapter doesn't use any standard metadata, but rather generates URLs using hardcoded templates. I think Keycloak adapter could use OIDC's rough equivalent for SAML metadata, namely "well-known" URLs.
> 
> You can experiment with your IDP and append ".well-known/openid-configuration" to its URL. If my conjecture about Intuit is correct, then it should look like this:
> https://oauth.platform.intuit.com/op/v1/.well-known/openid-configuration
> 
> In theory, Keycloak OIDC adapter could ingest this metadata instead of hardcoding URL templates. To me, this could be a valuable addition, but surprisingly I don't see any related JIRA issue. Maybe Keycloak developers could give us some feedback.
> 
> Cheers,
> Dmitry Telegin
> CTO, Acutus s.r.o.
> Keycloak Consulting and Training
> 
> Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
> +42 (022) 888-30-71
> E-mail: info at acutus.pro
> 
> [1] https://github.com/keycloak/keycloak/blob/master/core/src/main/java/org/keycloak/constants/ServiceUrlConstants.java#L26
> [2] https://github.com/keycloak/keycloak/blob/master/adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/KeycloakDeployment.java#L161
> [3] https://www.keycloak.org/docs/latest/securing_apps/index.html#_multi_tenancy
> [4] https://openid.net/developers/certified/
> [5] https://github.com/zmartzone/mod_auth_openidc
> [6] https://github.com/keycloak/keycloak-gatekeeper
> 
> On Thu, 2018-11-08 at 14:13 +0000, Usai, Fabrizio wrote:
> > Dear,
> > 
> > 
> > > We are using Keycloak Java adapter 4.5.0 in combination with EAP7.1. When we configure our keycloak.json we have for auth-server-url the url https://authentication.country.com/op/v1/auth (the original url is changed for privacy reasons). So far so good.
> > 
> > When we navigate to our application, we are forwarded to https://authentication.country.com/op/v1/auth/realms/KeycloakOIDCRealm/protocol/openid-connect/auth?response_type=code&client_id=fac9d161-d27d-493d-uze896zed78&redirect_uri=.....
> > 
> > This is not good, since we use our own identity provider. Removing the realms/KeycloakOIDCRealm/protocol/openid-connect/ part of the url, forwards it correctly to the identity provider. So the Keycloak adapter adds it by default, assuming we will always use Keycloak as an identity provider. Before we were using SAML and didn't had this issue.
> > 
> > How can we configure the keycloak.json for the adapter to leave out the addition of realms/KeycloakOIDCRealm/protocol/openid-connect/?
> > 
> > We don't understand why with SAML we didn't had this issue at all, and now with OpenID it seems very difficult to solve this issue. Our current guess to solve this, is to overwrite some Keycloak Java class and make sure the url is built the correct way. Although it is a bit dirty, we could accept this as solution (if it is possible), but we prefer to do this via configuration.
> > 
> > 
> > Kind regards,
> > 
> > Fabrizio Usai
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user

From testoauth55 at gmail.com  Mon Nov 12 00:16:35 2018
From: testoauth55 at gmail.com (Bruce Wings)
Date: Mon, 12 Nov 2018 10:46:35 +0530
Subject: [keycloak-user] Keycloak Javascript Adapter - Advisable to be
 used for confidential clients?
In-Reply-To: <CANAVTmPrOTRFgUd5BUZZi+QatSKiQ9Cbs0G_4JTFuO1a3YJ99A@mail.gmail.com>
References: <CANAVTmMFV=E6OjG2RoSZFuSui9yQ8XR8BrgWJauJJLCyWYWAzA@mail.gmail.com>
	<8E6265AD-A055-4A7A-BDFD-9AB19E834819@gmail.com>
	<CANAVTmMt=pVgdOGBrqYDk5-3PtFaGZqo9N3hARQxt53u6VBCcQ@mail.gmail.com>
	<CAHzT=q9LYO1ubdba3D61txk5cqAcjBnOkyK0E0nR2nw0o=0MDA@mail.gmail.com>
	<CANAVTmN40+pvjS3JfMdZfn+3mZTbaDBPfnEaCHMPX8ie-OmQbg@mail.gmail.com>
	<CANAVTmPrOTRFgUd5BUZZi+QatSKiQ9Cbs0G_4JTFuO1a3YJ99A@mail.gmail.com>
Message-ID: <CANAVTmO_qsuFr-js4R5+7EqtUgmLQFZ6Jd0s1SxPWXCxzH8nXw@mail.gmail.com>

The solution that worked for me was suggested by Jim Talbut <
jtalbut at spudsoft.co.uk>. He was unable to post on the mailing list, so
posting on his behalf.

You need to create a ScriptMapper because it lets you put multiple values,
so you can use that to overwrite the aud with both the desired values. In
below example, JettyApp is my confidential client and Webapp is public
client.


   - Protocol: openid-connect
   - Name: aud
   - Mapper Type: Script Mapper
   - Script: new java.util.ArrayList(["Jettyapp","Webapp"]);
   - Multivalued: ON
   - Token Claim Name: aud
   - Claim JSON Type: String


On Sat, Nov 3, 2018 at 10:30 PM Bruce Wings <testoauth55 at gmail.com> wrote:

> Geoffrey,
>
> I was able to get the config right. I have received the aud:JettyApp in
> generated token also, but I still get 401:Unauthorized for the backend app.
> Anything else needs to be done?
>
> Token (Partial):
> "jti": "b7b07046-5417-40d6-9338-1851a0f5e1e5",
>   "exp": 1541292863,
>   "nbf": 0,
>   "iat": 1541264063,
>   "iss": "http://localhost:7200/auth/realms/MyRealm",
>   *"aud": "JettyApp",*
>   "sub": "c801fc43-e7d3-4229-869c-cef19d049389",
>   "typ": "Bearer",
>   "azp": "Webapps",
>   "nonce": "3ec36116-c8a3-482c-828e-6458ad179270",
>   "auth_time": 1541264063,
>   "session_state": "0b40b785-6956-4234-bcb5-96ff8fdcb822",
>   "acr": "1",
>
>
> [image: image.png]
>
> On Sat, Nov 3, 2018 at 10:11 PM Bruce Wings <testoauth55 at gmail.com> wrote:
>
>> Thanks Geoffrey,
>>
>> I believe this will solve my problem. However, I tried creating the
>> mapper, but maybe I missed something cause I am still getting 401 if I
>> login with front end.
>>
>> In the attached image, I have shared my config, can you give it a quick
>> look and confirm this is how it is supposed to be?
>>
>> Name of my backend client in keycloak JettyApp:
>>
>> I have created Token claim name as - clientId and value as JettyApp.
>>
>>
>> [image: image.png]
>>
>>
>> On Sat, Nov 3, 2018 at 1:36 PM Geoffrey Cleaves <geoff at opticks.io> wrote:
>>
>>> Bruce, here's how I fixed the issue you're describing. I think it's a
>>> unfortunate omission in the docs (which are generally quite good). You need
>>> to include the backend client ID in the front end clients aud claim.
>>>
>>> https://bitbucket.org/snippets/gcleaves/5ebB58/sso-keycloak
>>>
>>> On Sat, Nov 3, 2018, 01:45 Bruce Wings <testoauth55 at gmail.com wrote:
>>>
>>>> Thanks Eric for the reply.
>>>>
>>>> But If I use a separate public client for my angular app, I am not able
>>>> to
>>>> access my Rest Api with the generated token, that's why I had to use
>>>> confidential client Json that I used to secure my server. Any idea,
>>>> what is
>>>> the right approach in case of server client architecture?
>>>>
>>>>  ( My project contains Rest Apis that I have secured with jetty adapter
>>>> and
>>>> confidential client ( as keycloak Authorization works only for
>>>> confidential
>>>> client and not public clients). My angular app is accessing these rest
>>>> api.
>>>> Therefore I used the same confidential client oidc Json in my angular
>>>> app
>>>> too. )
>>>>
>>>>
>>>>
>>>> On Friday, November 2, 2018, Eric Boyd Ramirez <
>>>> eric.ramirez.sv at gmail.com>
>>>> wrote:
>>>>
>>>> > Hi Bruce,
>>>> > I am fairly new to Keycloak myself, so I am giving my opinion in hopes
>>>> > some else can double check.
>>>> > The JS adapter is designed to work with Public clients, siting on the
>>>> the
>>>> > client side, the idea is that the a user/person would have to enter
>>>> his/her
>>>> > credentials to in order to login.
>>>> >
>>>> > Confidential clients generate an installation JSON or XML
>>>> configuration
>>>> > object which is meant to be installed on the server side/ Application
>>>> > server. The user accessing this application does not receive this
>>>> > configuration.
>>>> >
>>>> > Hope this helps.
>>>> >
>>>> > > On Nov 2, 2018, at 1:28 AM, Bruce Wings <testoauth55 at gmail.com>
>>>> wrote:
>>>> > >
>>>> > > I am referring to Keycloak Javascript adapter as mentioned in :
>>>> > > https://www.keycloak.org/docs/4.5/securing_apps/index.html#_
>>>> > javascript_adapter
>>>> > >
>>>> > > I have a confidential client and I have downloaded
>>>> keycloak-oidc.json
>>>> > > containing client secret. Now I am not sure how secure is it to
>>>> keep this
>>>> > > file containing client-secret at the client side.
>>>> > >
>>>> > > Am I being over concerned?
>>>> > > _______________________________________________
>>>> > > keycloak-user mailing list
>>>> > > keycloak-user at lists.jboss.org
>>>> > > https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>> >
>>>> >
>>>> _______________________________________________
>>>> keycloak-user mailing list
>>>> keycloak-user at lists.jboss.org
>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>
>>>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image.png
Type: image/png
Size: 53646 bytes
Desc: not available
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20181112/b659d806/attachment-0002.png 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image.png
Type: image/png
Size: 57527 bytes
Desc: not available
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20181112/b659d806/attachment-0003.png 

From dt at acutus.pro  Mon Nov 12 01:15:23 2018
From: dt at acutus.pro (Dmitry Telegin)
Date: Mon, 12 Nov 2018 09:15:23 +0300
Subject: [keycloak-user] How can I use Keycloak to support my
 architecture?
In-Reply-To: <CAN7vkfgmADkTH9Z008WaCSXdGE0Xw_8ap5Sa+a_=zA4P17hr2Q@mail.gmail.com>
References: <CAN7vkfgmADkTH9Z008WaCSXdGE0Xw_8ap5Sa+a_=zA4P17hr2Q@mail.gmail.com>
Message-ID: <1542003323.7421.3.camel@acutus.pro>

Hi Ola,

Just my 2?: are your App1/App2 classic web applications, or are they SPAs using REST APIs and token bearer authorization?

AFAIK the second scenario doesn't mandate that you register you apps as clients. You can simply reuse tokens issued for another application, in your case App3.

But if those are classical webapps and you want to Keycloak-enable them, then you will need to register them, because Keycloak's interactive authentication is client-based.

Either way, I'd recommend you to register your apps with Keycloak, because it will give you other benefits beyond SSO, like using custom flows per client, manipulating token claims, using authorization services etc.

Cheers,
Dmitry Telegin
CTO, Acutus s.r.o.
Keycloak Consulting and Training

Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
+42 (022) 888-30-71
E-mail: info at acutus.pro

On Wed, 2018-11-07 at 13:53 +0530, ola rob wrote:
> Hi,
> 
> I need some help in securing my applications with keycloak:
> 
> I have couple of grails applications (App1 and App2) using spring security.
> However, currently I am using keycloak REST API to authenticate users by
> passing username and password and receive token without registering these
> applications as clients in the keycloak.??But this approach seems to be
> inefficient when we want to support SSO, kerberos and other lot of powerful
> features that Keycloak offers.
> So I came up with the below approach to support SSO/kerberos but wanted to
> know if Keycloak can solve our problem.
> 
> "Create a new spring boot master application (App3) and register with
> Keycloak and redirect the login page to Keycloak. Once login is successful,
> use the token that keycloak provides and pass it on to App1 and App2 and
> tweak my existing code flow to handle this. Can this be possible because I
> am not registering/creating any clients for app1 and app2 in keycloak here
> but only creating for app3 which is the master application and using the
> access token? Is it mandatory to register/create all clients in Keycloak to
> support SSO?"
> 
> Any help would be highly appreciated.
> 
> Thanks in advance!
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From dt at acutus.pro  Mon Nov 12 01:24:49 2018
From: dt at acutus.pro (Dmitry Telegin)
Date: Mon, 12 Nov 2018 09:24:49 +0300
Subject: [keycloak-user] Restrict access to clients based on Group
 membership
In-Reply-To: <149FA3D4-A92D-4B87-995C-FD2D6746AEC4@thetradedesk.com>
References: <149FA3D4-A92D-4B87-995C-FD2D6746AEC4@thetradedesk.com>
Message-ID: <1542003889.7421.7.camel@acutus.pro>

Hello Prashant,

Your case seems very similar to this one (please read the whole thread):
http://lists.jboss.org/pipermail/keycloak-user/2018-November/016092.html

In your case, however, there is no literal correspondence between client names and group names, so you can't infer one from another. But you can make use of group attributes and place the name(s) of allowed clients there. The rest of the implementation remains roughly the same.

If you don't want to use script authenticator (this has limitations), you can simply map groups to roles in your JWT tokens and then configure client adapters to restrict access to the given role only.

Good luck,
Dmitry Telegin
CTO, Acutus s.r.o.
Keycloak Consulting and Training

Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
+42 (022) 888-30-71
E-mail: info at acutus.pro

On Thu, 2018-11-08 at 09:04 +0000, Prashant Bapat wrote:
> Hi,
> 
> In our Keycloak setup (ver 4.4.0) we have a master realm configured to authenticate users in a Windows AD. We heavily use SAML and OIDC and both work great.
> 
> Is there a way to restrict access to a OIDC client based on a group membership ? I?ve been reading up the docs and trying to get this working without success.
> 
> For example, let?s say we have 2 clients;
> client-dev-api
> client-prod-api
> Can I configure Keycloak to issue JWT token for client-dev-api to members of AD group ?Developers? and client-prod-api to members AD group ?Production? ?
> 
> Any guidance on getting this to work would be appreciated.
> 
> Thanks.
> --Prashant
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From dt at acutus.pro  Mon Nov 12 01:36:21 2018
From: dt at acutus.pro (Dmitry Telegin)
Date: Mon, 12 Nov 2018 09:36:21 +0300
Subject: [keycloak-user] Mobile app authentication flow
In-Reply-To: <CAJjftGBnXVKALrSCAbtjy3Emcq2BJtkDftfgJ471AOT+HKJmUw@mail.gmail.com>
References: <CAJjftGBnXVKALrSCAbtjy3Emcq2BJtkDftfgJ471AOT+HKJmUw@mail.gmail.com>
Message-ID: <1542004581.7421.9.camel@acutus.pro>

Hello Joe, answers inline,

On Thu, 2018-11-08 at 07:25 +1100, Joe Livu wrote:
> Hi,
> 
> I came across KeyCloak while searching for a security provider and was
> immediately impressed.
> 
> > I am planning on building a REST API using ASP.NET <http://asp.net/> Core
> Web API to be consumed by a mobile application to be built using Google's
> Flutter framework. I have a few questions.
> 
> 1. Would KeyCloak be suitable for securing my REST API Whig is built using
> > C# (ASP.NET <http://asp.net/> Core Web API)? If so, can I get a brief
> explanation and steps that need to be taken to achieve this?

Please take a look at this:
https://andrewlock.net/an-introduction-to-openid-connect-in-asp-net-core/

> 2. Now I need my mobile app to consume the REST API secured by KeyCloak.
> For authenticating users (e.g., via login screen using username/password
> credentials), how would this be done? Which grant type and flow will be
> suitable? The Web application demos shows a redirect to the KeyCloak server
> for authentication and then back to the app. It seems this cannot be
> applied for mobile apps (correct me if am wrong), so what would be the best
> approach for a mobile application? I would think KeyCloak would provide a
> REST API for such cases but I can only find an Admin REST API for admin
> purposes only Any help regarding this would very much appreciated.

For mobile apps, there are basically two options.

That "REST API for authentication" you're talking about is called "direct grant" in Keycloak's terms:
https://www.keycloak.org/docs/latest/securing_apps/index.html#_resource_owner_password_credentials_flow

You can create your own GUI form to ask a user for credentials and then use direct grant to obtain a token. In this case, you will be generally limited to simple login/password authentication (no OTP, brokering etc.)

Or you can embed a web view, use Keycloak JavaScript adapter (link below) to handle interaction with Keycloak, and then retrieve tokens from it.
https://www.keycloak.org/docs/latest/securing_apps/index.html#_javascript_adapter

As always, both methods have their benefits and drawbacks.

Cheers,
Dmitry Telegin
CTO, Acutus s.r.o.
Keycloak Consulting and Training

Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
+42 (022) 888-30-71
E-mail: info at acutus.pro

> 
> Kind regards,
> 
> Joe Livu
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From dt at acutus.pro  Mon Nov 12 01:58:30 2018
From: dt at acutus.pro (Dmitry Telegin)
Date: Mon, 12 Nov 2018 09:58:30 +0300
Subject: [keycloak-user] Welcome Email after Verification Success
In-Reply-To: <a37b2c9ec0c6466f8da31509479ef2fd@bedag.ch>
References: <a37b2c9ec0c6466f8da31509479ef2fd@bedag.ch>
Message-ID: <1542005910.7421.11.camel@acutus.pro>

Hello Rajib,

The phrase in the doc "The Email Event Listener only supports the following events at the moment" and those 4 types boil down to the following 4 template files:

event-login_error.ftl
event-remove_totp.ftl
event-update_password.ftl
event-update_totp.ftl

They can be found under "html" and "text" subdirs under this subtree:
https://github.com/keycloak/keycloak/tree/master/themes/src/main/resources/theme/base/email

Other than that, there are no restrictions on email event types.?See this:
https://github.com/keycloak/keycloak/blob/master/services/src/main/java/org/keycloak/email/freemarker/FreeMarkerEmailTemplateProvider.java#L109

Basically, you need to define your own email theme and include event-verify_email.ftl in it.
See this on creating and deploying custom themes:
https://www.keycloak.org/docs/latest/server_development/index.html#_themes

Good luck,
Dmitry Telegin
CTO, Acutus s.r.o.
Keycloak Consulting and Training

Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
+42 (022) 888-30-71
E-mail: info at acutus.pro

On Tue, 2018-11-06 at 16:26 +0000, Mitra Rajib, Bedag wrote:
> Hi!
> 
> I use Keycloak for User-Registration and would like to send a realm-customized "Welcome"-Email after the user verified his email-account.
> 
> The doc at https://www.keycloak.org/docs/3.2/server_admin/topics/events/login.html mentions 4 different type of email events, but none of these events fit my use-case.
> Is there any other way I can (easily) implement such a functionality ?
> 
> Thanks,
> Rajib
> 
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From wilson.sharlet at gmail.com  Mon Nov 12 03:07:35 2018
From: wilson.sharlet at gmail.com (Sharlet Wilson)
Date: Mon, 12 Nov 2018 13:37:35 +0530
Subject: [keycloak-user] Regarding keycloak REST api
Message-ID: <CAGrLpw_jurupGLYOK5d3ykkBt6UOiTmhj0tOhZ2ZJF-BczrHRg@mail.gmail.com>

Hi,

I have a user's keycloak access token on my backend Node.js application.
Would like to know how I can use it to authorize a user to access my custom
REST apis. (I am using the
/auth/realms/<realm-name>/protocol/openid-connect/token
api to get the user's access token).

Regards,
Sharlet Hannah Wilson

From Gregor.Tudan at cofinpro.de  Mon Nov 12 03:12:04 2018
From: Gregor.Tudan at cofinpro.de (Gregor Tudan)
Date: Mon, 12 Nov 2018 08:12:04 +0000
Subject: [keycloak-user] Email-Event UPDATE-PASSWORD
In-Reply-To: <1879433522.649.1541703888436.JavaMail.zimbra@tech-advantage.com>
References: <B31D602E-3E32-491A-8AE3-5BA96362232A@cofinpro.de>
	<1879433522.649.1541703888436.JavaMail.zimbra@tech-advantage.com>
Message-ID: <A4824556-6C94-4E12-9603-8B959E0B3AF6@cofinpro.de>

Hey Ionel,

Could be - but it makes those email-events rather useless if you don?t do email-verification.
I?m going to file an issue for adding a note in the manual about the verification requirement - it?s a rather surprising constraint.
https://www.keycloak.org/docs/latest/server_admin/index.html#event-listener<https://www.keycloak.org/docs/3.2/server_admin/topics/events/login.html>

Still, it would be nice to know the reasons behind this design choice.

Gregor

Am 08.11.2018 um 20:04 schrieb GARDAIS Ionel <ionel.gardais at tech-advantage.com<mailto:ionel.gardais at tech-advantage.com>>:

Hi Gregor,

I had the same questioning about other email-events.
My guess is that not verified email could be wrong and than lead to keycloak spamming the world.
It would be useless implement and maintain bounce logic whereas there is a verification process available, and thus to use a verified email for this purpose.

One may ask : should verified-email be reconfirmed on a periodic schedule so abandoned addresses be unused ?

--
Ionel GARDAIS
Tech'Advantage CIO - IT Team manager

----- Mail original -----
De: "Gregor Tudan" <Gregor.Tudan at cofinpro.de<mailto:Gregor.Tudan at cofinpro.de>>
?: "keycloak-user" <keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>>
Envoy?: Jeudi 8 Novembre 2018 11:30:47
Objet: [FGTSPAM] [keycloak-user] Email-Event UPDATE-PASSWORD

Hi,

We?re trying to send an email to a user if his/her password was changed. The Email-Event UPDATE-PASSWORD looks exactly like what we want.

https://github.com/keycloak/keycloak/blob/master/services/src/main/java/org/keycloak/events/email/EmailEventListenerProvider.java <https://github.com/keycloak/keycloak/blob/master/services/src/main/java/org/keycloak/events/email/EmailEventListenerProvider.java>

There?s one catch: the email seems to only get sent if the user has a verified email address. Email-Verification is not activated on the realm.
Is there a reason why email-verification is required for those emails?

Thanks,
Gregor

_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user
--
232 avenue Napoleon BONAPARTE 92500 RUEIL MALMAISON
Capital EUR 219 300,00 - RCS Nanterre B 408 832 301 - TVA FR 09 408 832 301



From Rajib.Mitra at bedag.ch  Mon Nov 12 03:38:44 2018
From: Rajib.Mitra at bedag.ch (Mitra Rajib, Bedag)
Date: Mon, 12 Nov 2018 08:38:44 +0000
Subject: [keycloak-user] Welcome Email after Verification Success
In-Reply-To: <1542005910.7421.11.camel@acutus.pro>
References: <a37b2c9ec0c6466f8da31509479ef2fd@bedag.ch>
	<1542005910.7421.11.camel@acutus.pro>
Message-ID: <e9085b5b5cde43159f6ab8f21e95378f@bedag.ch>

Hi Dmitry,

Thanks for your reply! I ended up implementing my own EventListenerProvider / Theme-Extension, like you mentioned.

Unfortunately a few things with this solution are not ideal:

1) The EventListenerProviderFactory-Interface resides in a "private" module, assuming meaning the SPI could change at any time (see https://issues.jboss.org/browse/KEYCLOAK-6071).

2) The event-type that is sent in my case after a user verified his email is a CUSTOM_REQUIRED_ACTION (see http://lists.jboss.org/pipermail/keycloak-user/2018-May/013935.html), so I have to provide this .ftl accordingly. The event contains a detail so I can differentiate it from other custom required actions. But unfortunately since the template is shared between all the custom required actions, I can only have one email for all of events of the same type. Or I could introduce FreeMaker if-else-statements to differentiate what should be displayed according to the event-detail.

3) Since I use the sendEvent-Method, I can't introduce my own attributes for the email-template (e.g. realmName, Custom-Link, etc.).


2) and 3) could be mitigated by providing a new method in FreeMarkerEmailTemplateProvider that could be named for example sendWelcomeEmail, accepting additional attributes as a parameter for the email-template. 
Do you think this is worth contacting the dev-mailing list for? I would be happy to provide a PR for this change with the new EventListener, since I am sure this is a common requirement.


Best,
Rajib


-----Urspr?ngliche Nachricht-----
Von: Dmitry Telegin [mailto:dt at acutus.pro] 
Gesendet: Montag, 12. November 2018 07:59
An: Mitra Rajib, Bedag; keycloak-user at lists.jboss.org
Betreff: Re: [keycloak-user] Welcome Email after Verification Success

Hello Rajib,

The phrase in the doc "The Email Event Listener only supports the following events at the moment" and those 4 types boil down to the following 4 template files:

event-login_error.ftl
event-remove_totp.ftl
event-update_password.ftl
event-update_totp.ftl

They can be found under "html" and "text" subdirs under this subtree:
https://github.com/keycloak/keycloak/tree/master/themes/src/main/resources/theme/base/email

Other than that, there are no restrictions on email event types.?See this:
https://github.com/keycloak/keycloak/blob/master/services/src/main/java/org/keycloak/email/freemarker/FreeMarkerEmailTemplateProvider.java#L109

Basically, you need to define your own email theme and include event-verify_email.ftl in it.
See this on creating and deploying custom themes:
https://www.keycloak.org/docs/latest/server_development/index.html#_themes

Good luck,
Dmitry Telegin
CTO, Acutus s.r.o.
Keycloak Consulting and Training

Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
+42 (022) 888-30-71
E-mail: info at acutus.pro

On Tue, 2018-11-06 at 16:26 +0000, Mitra Rajib, Bedag wrote:
> Hi!
> 
> I use Keycloak for User-Registration and would like to send a realm-customized "Welcome"-Email after the user verified his email-account.
> 
> The doc at https://www.keycloak.org/docs/3.2/server_admin/topics/events/login.html mentions 4 different type of email events, but none of these events fit my use-case.
> Is there any other way I can (easily) implement such a functionality ?
> 
> Thanks,
> Rajib
> 
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user


From vramik at redhat.com  Mon Nov 12 03:46:28 2018
From: vramik at redhat.com (Vlasta Ramik)
Date: Mon, 12 Nov 2018 09:46:28 +0100
Subject: [keycloak-user] Running Keycloak examples
In-Reply-To: <1107344991.32206816.1541753576533.JavaMail.zimbra@redhat.com>
References: <257635183.32186267.1541746556969.JavaMail.zimbra@redhat.com>
	<0cb2a458-a741-8858-f339-9ddb3b75a442@redhat.com>
	<1107344991.32206816.1541753576533.JavaMail.zimbra@redhat.com>
Message-ID: <9a1bf974-82c9-4d0d-b7a1-70c439e43f64@redhat.com>

I've just checked it and it seems to work. There are my steps:

1. download wildfly-14.0.1.Final.zip as an application server and unpack

2. download keycloak-wildfly-adapter-dist-4.5.0.Final.zip unpack it to 
$WILDFLY_HOME

3. run $WILDFLY_HOME/bin/jboss-cli.sh 
--file=adapter-elytron-install-offline.cli

all passes.

4. download keycloak-4.5.0.Final.zip and 
keycloak-examples-4.5.0.Final.zip (which are deprecated) and unzip it

then I can start keycloak-4.5.0.Final (auth server) and 
wildfly-14.0.1.Final (app server) and then I can deploy examples to the 
app server.

V.

On 11/9/18 9:52 AM, Pritha Srivastava wrote:
> I still get the same error:
>
> ./bin/jboss-cli.sh --file=adapter-elytron-install-offline.cli
>
> {
>      "outcome" => "failed",
>      "failure-description" => "WFLYCTL0310: Extension module org.keycloak.keycloak-adapter-subsystem not found",
>      "rolled-back" => true
> }
>
>
> Thanks,
> Pritha
>
> ----- Original Message -----
>> From: "Vlasta Ramik" <vramik at redhat.com>
>> To: keycloak-user at lists.jboss.org
>> Sent: Friday, November 9, 2018 1:52:02 PM
>> Subject: Re: [keycloak-user] Running Keycloak examples
>>
>> Hello,
>>
>> inline
>>
>> On 11/9/18 7:55 AM, Pritha Srivastava wrote:
>>> Hi All,
>>>
>>> I am trying to setup a Keycloak server and run the examples, for which I
>>> did the following:
>>>
>>> 1. Downloaded 4.5.0.Final Standalone Server distribution, and started the
>>> server using ./standalone.sh, which worked fine.
>>> 2. Downlaoded keycloak-examples-4.5.0.Final, and for the
>>> preconfigured-demo, I did a mvn clean install and mvn wildfly:deploy and
>>> the second step gave me this error - UT010039: Unknown authentication
>>> mechanism KEYCLOAK
>>> 3. To solve the error in 2.0, I downloaded the wildfly adapter
>>> keycloak-wildfly-adapter-dist-4.5.0.Final.zip, and ran this command -
>>> ./bin/jboss-cli.sh --file=adapter-install.cli --connect
>>> --controller=127.0.0.1:9990 which gave the following response:
>> can you please try the following to install adapter?
>>
>> ./bin/jboss-cli.sh --file=adapter-elytron-install-offline.cli
>>
>>> {"outcome" => "success"}
>>> {
>>>       "outcome" => "success",
>>>       "response-headers" => {
>>>           "operation-requires-reload" => true,
>>>           "process-state" => "reload-required"
>>>       }
>>> }
>>> {
>>>       "outcome" => "failed",
>>>       "failure-description" => "WFLYCTL0310: Extension module
>>>       org.keycloak.keycloak-adapter-subsystem not found",
>>>       "rolled-back" => true,
>>>       "response-headers" => {"process-state" => "reload-required"}
>>> }
>>>
>>> I am not sure how to solve the above problem. Any help is greatly
>>> appreciated.
>>>
>>> P.S.: I am completely new to Jboss, Wildfly etc.
>>>
>>> Thanks,
>>> Pritha
>>>
>>> _______________________________________________
>>> keycloak-user mailing list
>>> keycloak-user at lists.jboss.org
>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>

From bruno at abstractj.org  Mon Nov 12 03:56:43 2018
From: bruno at abstractj.org (Bruno Oliveira)
Date: Mon, 12 Nov 2018 06:56:43 -0200
Subject: [keycloak-user] Regarding keycloak REST api
In-Reply-To: <CAGrLpw_jurupGLYOK5d3ykkBt6UOiTmhj0tOhZ2ZJF-BczrHRg@mail.gmail.com>
References: <CAGrLpw_jurupGLYOK5d3ykkBt6UOiTmhj0tOhZ2ZJF-BczrHRg@mail.gmail.com>
Message-ID: <CAM5SUC7J0XAKpCDuVUd=5gTY50EAA2Db9=1zf+6QDamDYVkFjQ@mail.gmail.com>

Hi Sharlet, there's a quickstart here
https://github.com/keycloak/keycloak-quickstarts/tree/latest/service-nodejs
which can help you.
On Mon, Nov 12, 2018 at 6:08 AM Sharlet Wilson <wilson.sharlet at gmail.com> wrote:
>
> Hi,
>
> I have a user's keycloak access token on my backend Node.js application.
> Would like to know how I can use it to authorize a user to access my custom
> REST apis. (I am using the
> /auth/realms/<realm-name>/protocol/openid-connect/token
> api to get the user's access token).
>
> Regards,
> Sharlet Hannah Wilson
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user



-- 
- abstractj

From bruno at abstractj.org  Mon Nov 12 04:00:38 2018
From: bruno at abstractj.org (Bruno Oliveira)
Date: Mon, 12 Nov 2018 07:00:38 -0200
Subject: [keycloak-user] There is already a httpSessionManager
In-Reply-To: <9700A518-4D16-4EEB-A7AC-18B650F0D2C2@gmail.com>
References: <9700A518-4D16-4EEB-A7AC-18B650F0D2C2@gmail.com>
Message-ID: <CAM5SUC6p1E3vVgGYcY5LY5K15n6CnROx7cigowr8_sHU9NH+hQ@mail.gmail.com>

Hi Calixto, I'd suggest to validate your setup just looking at the
quickstarts https://github.com/keycloak/keycloak-quickstarts
On Fri, Nov 9, 2018 at 6:53 PM Calixto Mele?n <cmelean at gmail.com> wrote:
>
> I?m doing a simple tutorial with SpringBoot 2.1.0 and KeyCloack 4.5.0. When I start the app, I am getting the following error:
>
> org.springframework.beans.factory.support.BeanDefinitionOverrideException: Invalid bean definition with name 'httpSessionManager' defined in class path resource [com/example/demo/configuration/SecurityConfig.class]: Cannot register bean definition [Root bean: class [null]; scope=; abstract=false; lazyInit=false; autowireMode=3; dependencyCheck=0; autowireCandidate=true; primary=false; factoryBeanName=securityConfig; factoryMethodName=httpSessionManager; initMethodName=null; destroyMethodName=(inferred); defined in class path resource [com/example/demo/configuration/SecurityConfig.class]] for bean 'httpSessionManager': There is already [Generic bean: class [org.keycloak.adapters.springsecurity.management.HttpSessionManager]; scope=singleton; abstract=false; lazyInit=false; autowireMode=0; dependencyCheck=0; autowireCandidate=true; primary=false; factoryBeanName=null; factoryMethodName=null; initMethodName=null; destroyMethodName=null; defined in URL [jar:file:/Users/bigcat/.m!
> 2/repository/org/keycloak/keycloak-spring-security-adapter/4.5.0.Final/keycloak-spring-security-adapter-4.5.0.Final.jar!/org/keycloak/adapters/springsecurity/management/HttpSessionManager.class]] bound.
>
> Relevant maven dependencies I have are:
>
> <dependency>
>   <groupId>org.keycloak</groupId>
>   <artifactId>keycloak-spring-boot-starter</artifactId>
>   <version>${keycloak.version}</version>
> </dependency>
>
> <dependency>
>   <groupId>org.springframework.boot</groupId>
>   <artifactId>spring-boot-starter-security</artifactId>
> </dependency>
>
> SecurityConfig.class is:
>
> @KeycloakConfiguration
> public class SecurityConfig extends KeycloakWebSecurityConfigurerAdapter {
>
>    @Bean
>    public KeycloakConfigResolver KeycloakConfigResolver() {
>        return new KeycloakSpringBootConfigResolver();
>    }
>
>    /**
>     * Registers the KeycloakAuthenticationProvider with the authentication manager.
>     */
>    @Autowired
>    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
>        auth.authenticationProvider(keycloakAuthenticationProvider());
>    }
>
>    /**
>     * Defines the session authentication strategy.
>     */
>    @Bean
>    @Override
>    protected SessionAuthenticationStrategy sessionAuthenticationStrategy() {
>        return new RegisterSessionAuthenticationStrategy(new SessionRegistryImpl());
>    }
>
>    @Override
>    protected void configure(HttpSecurity http) throws Exception
>    {
>        super.configure(http);
>        http
>                .authorizeRequests()
>                .antMatchers("/customers*").hasRole("pharmacist")
>                .anyRequest().permitAll();
>    }
> }
>
>
> Appreciate any help. Thanks
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user



-- 
- abstractj


From msakho at redhat.com  Mon Nov 12 04:24:51 2018
From: msakho at redhat.com (Meissa M'baye Sakho)
Date: Mon, 12 Nov 2018 10:24:51 +0100
Subject: [keycloak-user] setting up TLS(SSL) through the X509_CA_BUNDLE
	environment variable
In-Reply-To: <CAA9R9O4Hyurn-8BbWW=N34fwNWO0D9=4VUYvzVhobMqZn8XkXA@mail.gmail.com>
References: <CAF83W6LNmusLcefhf_RBLJ6t+dSixqNXY+twc0ZQLitqwA9JyA@mail.gmail.com>
	<CAF83W6JEWtjbPhAqBBuQdfs5M0Lb+UymvA+e-=-THjcuGO_7RQ@mail.gmail.com>
	<CAA9R9O4Hyurn-8BbWW=N34fwNWO0D9=4VUYvzVhobMqZn8XkXA@mail.gmail.com>
Message-ID: <CAF83W6+KGfg_1sE9znqBUmGsQ-7dfkRwkU2O8PhnJCzgEoAOng@mail.gmail.com>

Hi Sebastian,
That's correct. I can see that my the truststore is created correctly with
my CA certificates.
I need now to configure the OutGoing HTTPS Request Truststore [3] with the
created truststore and the password.
The problem is that I can't set the password. I've checked into the
x509-truststore.cli [1] and see that it's picked from the
$keycloak_tls_truststore_password variable.
and created from your x509.sh script [2]
I've tried to use the same syntax in my cli below but it fails because the
$keycloak_tls_truststore_password is not know from my cli.
So Sebastien, do you know how I can get the trsustore password?
Is it possible to set it as an environment variable to the docker image?


[1]=
https://raw.githubusercontent.com/jboss-dockerfiles/keycloak/master/server/tools/cli/x509-truststore.cli
[2]=
https://raw.githubusercontent.com/jboss-dockerfiles/keycloak/master/server/tools/x509.sh
[3]=
https://www.keycloak.org/docs/latest/server_installation/index.html#_truststore
Thanks,
Meissa


Le mer. 31 oct. 2018 ? 09:08, Sebastian Laskawiec <slaskawi at redhat.com> a
?crit :

> Hey Meissa,
>
> The warning you see does no harm. As you can see here [1], the message is
> being thrown without stopping the script.
>
> Pulling JDK CAs has been implemented somewhat ahead of time. I asked the
> Cloud Enablement (and also other Red Hat teams) to put Kubernetes and
> OpenShift CAs into JDK lib directory. This way Keycloak will trust the
> OpenShift cluster out of the box. The warning you see clearly indicates
> that this feature hasn't been implemented yet.
>
> So the bottom line - please ignore this error. I'm pretty sure it will
> disappear in the future (and if not, I'll just remove or disable this
> feature).
>
> Thanks,
> Sebastian
>
> [1]
> https://github.com/jboss-dockerfiles/keycloak/blob/master/server/tools/x509.sh#L88
>
> On Wed, Oct 31, 2018 at 8:59 AM Meissa M'baye Sakho <msakho at redhat.com>
> wrote:
>
>> Hi Sebastian,
>> Do you have any advice in this issue. It's related to the x509.sh script
>> and I would really apprecaite an input/help here.
>> Meissa
>> ---------- Forwarded message ---------
>> From: Meissa M'baye Sakho <msakho at redhat.com>
>> Date: mar. 30 oct. 2018 ? 17:12
>> Subject: setting up TLS(SSL) through the X509_CA_BUNDLE environment
>> variable
>> To: keycloak-user <keycloak-user at lists.jboss.org>
>>
>>
>> hello everyone,
>> I'm using the jboss/keycloak:4.5.0.Final docker image.
>> I'm trying to setup Mutual TLS by using the X509_CA_BUNDLE environment
>> variable as explained in the Jboss/keycloak docker image documentation.
>> I've mounted a volume to the image pointing to the cert file and defined
>> the env variable.
>> I'm running the image with the following command:
>>  *docker run -d --name opengie -e KEYCLOAK_USER=meissa -e
>> KEYCLOAK_PASSWORD=meissa \*
>> *  -e PROXY_ADDRESS_FORWARDING=true \*
>> *  -v /home/centos/docker-opengie/docker-image/staging:/var/run/secrets \*
>> *  -v
>> /home/centos/docker-opengie/docker-image/staging/jks:/etc/x509/https \*
>> *  -e JGROUPS_DISCOVERY_PROTOCOL=dns.DNS_PING \*
>> *  -e
>> JGROUPS_DISCOVERY_PROPERTIES=dns_query=bdf-opengie-test.paas.eclair.local \*
>> *  -e X509_CA_BUNDLE=/var/run/secrets/bdf-ca.crt \*
>> *  jboss/keycloak:4.5.0.Final*
>>
>>
>> When The container starts, I've checked that the cert has been corectly
>> mounted to the expected folder /var/run/secrets
>> But I see in the log that the certificat import fails (extract below):
>> *Creating HTTPS keystore via OpenShift's service serving x509 certificate
>> secrets..*
>> *HTTPS keystore successfully created at:
>> /opt/jboss/keycloak/standalone/configuration/keystores/https-keystore.jks*
>> *Creating Keycloak truststore..*
>> *Keycloak truststore successfully created at:
>> /opt/jboss/keycloak/standalone/configuration/keystores/truststore.jks*
>> *Importing certificates from system's Java CA certificate bundle into
>> Keycloak truststore..*
>> *Failed to import certificates from system's Java CA certificate bundle
>> into Keycloak truststore!*
>> *Setting JGroups discovery to dns.DNS_PING with properties
>> {dns_query=>bdf-opengie-test.paas.eclair.local}*
>>
>> I've checked in the script that handle the TLS import [1], but I'm not
>> able to guess why the import is failing.
>>
>> The following extract is a part of the scripts that is used by the image
>> to import the cert.
>> # Import existing system CA certificates into the newly generated
>> truststore
>> local SYSTEM_CACERTS=$(readlink -e $(dirname $(readlink -e $(which
>> keytool)))"/../lib/security/cacerts")
>> if keytool -v -list -keystore "${SYSTEM_CACERTS}" -storepass "changeit" >
>> /dev/null; then
>> echo "Importing certificates from system's Java CA certificate bundle
>> into Keycloak truststore.."
>> keytool -importkeystore -noprompt \
>> -srckeystore "${SYSTEM_CACERTS}" \
>> -destkeystore "${JKS_TRUSTSTORE_PATH}" \
>> -srcstoretype jks -deststoretype jks \
>> -storepass "${PASSWORD}" -srcstorepass "changeit" >& /dev/null
>> if [ "$?" -ne "0" ]; then
>> echo "Successfully imported certificates from system's Java CA
>> certificate bundle into Keycloak truststore at: ${JKS_TRUSTSTORE_PATH}"
>> else
>>   echo "Failed to import certificates from system's Java CA certificate
>> bundle into Keycloak truststore!"
>> fi
>>
>> Any advice?
>>
>> [1]=
>> https://github.com/jboss-dockerfiles/keycloak/blob/master/server/tools/x509.sh
>>
>> Meissa
>>
>

From msakho at redhat.com  Mon Nov 12 04:47:03 2018
From: msakho at redhat.com (Meissa M'baye Sakho)
Date: Mon, 12 Nov 2018 10:47:03 +0100
Subject: [keycloak-user] Add CA certificates for LDAPS ?
In-Reply-To: <CAF83W6J8v03WtJ49aBwDrAZDmn6HODDn3bVwG-n6ow15k5VDfw@mail.gmail.com>
References: <1662f626b66.d913c15131404.552465038631491981@mpouss.in>
	<9a8a4961-c5fb-87e9-661c-bfd87e10da09@redhat.com>
	<16633c8bd7b.1093feebf42029.2315606082414745027@mpouss.in>
	<CAF83W6KnqNr2fhtmcKHSQoJBx3saza0CGn75VG99nVeEGETPPA@mail.gmail.com>
	<1541018026.2120.1.camel@acutus.pro>
	<166e3975670.edec95a619314.6696607516355464263@mpouss.in>
	<CAF83W6+qmRGF0PyCr7NbOmEqBzS4emjMq0fGU1YNTC-yuKXH6Q@mail.gmail.com>
	<CAF83W6J8v03WtJ49aBwDrAZDmn6HODDn3bVwG-n6ow15k5VDfw@mail.gmail.com>
Message-ID: <CAF83W6K7rY_ei63osh=fKOQhXPx-Pt4sOBx=yMh+aPuSMVgSEA@mail.gmail.com>

Hi Mathieu, I finally managed to see the certificates in the jks store.
I need to defind the outgoing https request and the truststore password is
required.
Did you find a way to get the truststore password?
Meissa

Le ven. 9 nov. 2018 ? 10:18, Meissa M'baye Sakho <msakho at redhat.com> a
?crit :

> Hi Mathieu,
> Regarding your statement below:
> - *The X509_CA_BUNDLE env variable thing (It's running in a container), I
> can see the certificates in the JKS store *
> Could you please tell me how you managed to see the certificates in the
> JKS store?
> Regards,
> Meissa
>
> Le mar. 6 nov. 2018 ? 14:50, Meissa M'baye Sakho <msakho at redhat.com> a
> ?crit :
>
>> My LDAPS configuration did also work fine with keycloak 3.3.5 docker image
>> My question was related to the The X509_CA_BUNDLE env variable that
>> comes with the keycloak 4.4.x docker image.
>> I would like to use it and wanted to know if it work.
>> Do I understand that it's working fine for you Mathieu?
>> Meissa
>>
>> Le lun. 5 nov. 2018 ? 12:17, Mathieu Poussin <me at mpouss.in> a ?crit :
>>
>>> I confirm this fixed the issue :)
>>>
>>> So simple that I didn't think about it...
>>>
>>> Thank you
>>>
>>>  ---- On Wed, 31 Oct 2018 21:33:46 +0100 Dmitry Telegin <dt at acutus.pro>
>>> wrote ----
>>>  > Mathieu, Meissa,
>>>  >
>>>  > Starting from 4.5.0, the Keycloak Docker image uses standalone-ha.xml
>>> instead of standalone.xml by default. I guess this is why your truststore
>>> settings are being ignored.
>>>  >
>>>  > I've also tested Keycloak + LDAP + self-signed cert + truststore on a
>>> non-Docker deployment - it works pretty well, so definitely not a Keycloak
>>> bug per se.
>>>  >
>>>  > Good luck!
>>>  > Dmitry Telegin
>>>  > CTO, Acutus s.r.o.
>>>  > Keycloak Consulting and Training
>>>  >
>>>  > Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
>>>  > +42 (022) 888-30-71
>>>  > E-mail: info at acutus.pro
>>>  >
>>>  > On Wed, 2018-10-31 at 11:05 +0100, Meissa M'baye Sakho wrote:
>>>  > > Hello Mathieu,
>>>  > > did you manage to make it work?
>>>  > > If yes, could you tell me how?
>>>  > > Meissa
>>>  > >
>>>  > > > Le mar. 2 oct. 2018 ? 10:01, Mathieu Poussin <me at mpouss.in> a
>>> ?crit :
>>>  > >
>>>  > > > Hello Marek.
>>>  > > >
>>>  > > > I've done that already but looks like it is completely ignored.
>>>  > > > I have my custom truststore that have all my CA certificates (2),
>>> but I'm
>>>  > > > still seeing the same issue. (SPI is enabled on the LDAPS
>>> settings on the
>>>  > > > admin)
>>>  > > > Is there a way to make sure it has been loaded correctly? (I
>>> don't see any
>>>  > > > error when the application starts but it's not working as
>>> expected)
>>>  > > >
>>>  > > > Thanks.
>>>  > > > Mathieu
>>>  > > >
>>>  > > >
>>>  > > >  ---- On Mon, 01 Oct 2018 20:14:22 +0200 Marek Posolda <
>>>  > > > mposolda at redhat.com> wrote ----
>>>  > > >  > You can configure the Truststore SPI, which is mentioned in
>>> our docs
>>>  > > >  > here:
>>>  > > >  >
>>>  > > >
>>> https://www.keycloak.org/docs/latest/server_installation/index.html#_truststore
>>>  > > >  >
>>>  > > >  > Some additional notes around LDAP are here:
>>>  > > >  >
>>>  > > >
>>> https://www.keycloak.org/docs/latest/server_admin/index.html#connect-to-ldap-over-ssl
>>>  > > >  >
>>>  > > >  > Marek
>>>  > > >  >
>>>  > > >  >
>>>  > > >  > On 01/10/18 13:27, Mathieu Poussin wrote:
>>>  > > >  > > Hello.
>>>  > > >  > >
>>>  > > >  > > What would be the recommended way to add a custom CA
>>> certificates ?
>>>  > > > The documentation has a lot of different ways and so far none of
>>> them
>>>  > > > worked :
>>>  > > >  > >
>>>  > > >  > > - The X509_CA_BUNDLE env variable thing (It's running in a
>>>  > > > container), I can see the certificates in the JKS store  but
>>> looks like
>>>  > > > they are completely ignored by the app server.
>>>  > > >  > > - Added custom SPI to load a custom JKS store, same, no
>>> error at
>>>  > > > server start but they are completely ignored by the app server.
>>>  > > >  > >
>>>  > > >  > > This is the error I am getting :
>>>  > > >  > >
>>>  > > >  > > Caused by: sun.security.validator.ValidatorException: PKIX
>>> path
>>>  > > > building failed:
>>>  > > > sun.security.provider.certpath.SunCertPathBuilderException:
>>> unable to find
>>>  > > > valid certification path to requested target
>>>  > > >  > >          at
>>>  > > >
>>> sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:397)
>>>  > > >  > >          at
>>>  > > >
>>> sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:302)
>>>  > > >  > >          at
>>>  > > > sun.security.validator.Validator.validate(Validator.java:262)
>>>  > > >  > >          at
>>>  > > >
>>> sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:324)
>>>
>>>  > > >
>>>  > > >  > >          at
>>>  > > >
>>> sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:229)
>>>
>>>  > > >
>>>  > > >  > >          at
>>>  > > >
>>> sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:124)
>>>
>>>  > > >
>>>  > > >  > >          at
>>>  > > >
>>> sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1596)
>>>
>>>  > > >
>>>  > > >  > >          ... 99 more
>>>  > > >  > > Caused by:
>>>  > > > sun.security.provider.certpath.SunCertPathBuilderException:
>>> unable to find
>>>  > > > valid certification path to requested target
>>>  > > >  > >          at
>>>  > > >
>>> sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:141)
>>>
>>>  > > >
>>>  > > >  > >          at
>>>  > > >
>>> sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:126)
>>>
>>>  > > >
>>>  > > >  > >          at
>>>  > > >
>>> java.security.cert.CertPathBuilder.build(CertPathBuilder.java:280)
>>>  > > >  > >          at
>>>  > > >
>>> sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:392)
>>>  > > >  > >          ... 105 more
>>>  > > >  > >
>>>  > > >  > >
>>>  > > >  > > Another option would be to disable certificate verification
>>> on LDAPS
>>>  > > > as it's a trusted environment (last resort but well so far
>>> nothing else
>>>  > > > worked), would there be a way to do that?
>>>  > > >  > > Connecting over LDAP is not an option a this prevent some
>>> features to
>>>  > > > work like password reset.
>>>  > > >  > >
>>>  > > >  > > Thanks.
>>>  > > >  > >
>>>  > > >  > >
>>>  > > >  > > _______________________________________________
>>>  > > >  > > keycloak-user mailing list
>>>  > > >  > > keycloak-user at lists.jboss.org
>>>  > > >  > > https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>  > > >  >
>>>  > > >  >
>>>  > > >  >
>>>  > > >
>>>  > > >
>>>  > > > _______________________________________________
>>>  > > > keycloak-user mailing list
>>>  > > > keycloak-user at lists.jboss.org
>>>  > > > https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>  > > >
>>>  > >
>>>  > > _______________________________________________
>>>  > > keycloak-user mailing list
>>>  > > keycloak-user at lists.jboss.org
>>>  > > https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>  >
>>>
>>>
>>>

From ronald.demneri at amdtia.com  Mon Nov 12 04:59:13 2018
From: ronald.demneri at amdtia.com (Ronald Demneri)
Date: Mon, 12 Nov 2018 09:59:13 +0000
Subject: [keycloak-user] filter group claim in token per client
In-Reply-To: <1541806456.2031.5.camel@acutus.pro>
References: <VI1PR0402MB3696E4DCAFFE7EEEEB0EAF70E9CF0@VI1PR0402MB3696.eurprd04.prod.outlook.com>
	<1541397265.3650.7.camel@acutus.pro>
	<VI1PR0402MB369663EA52F0699AF650CE58E9CA0@VI1PR0402MB3696.eurprd04.prod.outlook.com>
	<VI1PR0402MB3696D1D1312CB4F7A65920FAE9CB0@VI1PR0402MB3696.eurprd04.prod.outlook.com>
	,
	<VI1PR0402MB36967CDFF7608457E6AB73BFE9CB0@VI1PR0402MB3696.eurprd04.prod.outlook.com>
	<VI1PR0402MB36962E1029F6BB26BC168EA4E9CB0@VI1PR0402MB3696.eurprd04.prod.outlook.com>
	<1541806456.2031.5.camel@acutus.pro>
Message-ID: <VI1PR0402MB3696D6DEFD08BCEF52742C14E9C10@VI1PR0402MB3696.eurprd04.prod.outlook.com>

Hello Dmitry,

After some trial and error, we were able to achieve having only pertinent groups in the token, although not as elegant as your script. So now we have it configured the way we want... approximately... Do you care to elaborate a little bit more on the possibilities to mitigate that security issue you mentioned in the email. The idea behind allowing a user to login if required group membership constraint is fulfilled, is quite important to us, which means that we need to find a different way from what we are doing right now. And of course, disabling SSO for all the clients is not a solution :)


Looking forward to hearing from you soon!

Thanks in advance,
Ronald

-----Original Message-----
From: Dmitry Telegin <dt at acutus.pro> 
Sent: 10.Nov.2018 12:34 AM
To: Ronald Demneri <ronald.demneri at amdtia.com>; keycloak-user at lists.jboss.org
Subject: Re: [keycloak-user] filter group claim in token per client

Ronald,

Here are some Pro Tips(tm) for you :)

- use keycloakSession.context.client.clientId to retrieve client ID (works for both tokens and userinfo);
- use Java.from() and Java.to() to convert objects and arrays from Java to JavaScript and vice versa;
- use more JavaScript-fu like map() and filter() to avoid looping over arrays;
- use RegExp for generic case-insensitive pattern matching.

With the above, your whole mapper could look as simple as this:

==========================================
/**
 * Available variables: 
 * user - the current user
 * realm - the current realm
 * token - the current token
 * userSession - the current userSession
 * keycloakSession - the current userSession  */

var client = keycloakSession.context.client.clientId;

var groups = Java.from(user.groups)
    .map(function(group) {
        return group.name;
    })
    .filter(function(name) {
        return RegExp("(\\w+)-" + client + "-(\\w+)", "i").test(name);
    })

token.setOtherClaims("fGroup", Java.to(groups, "java.lang.String[]")) ==========================================

Please also read my earlier reply about the potential security issue with the script authenticator and how to mitigate it.

In fact, this problem (restricting access to clients based on group membership) has surfaced here at least three times during last month, so I think I'd write an article with the solution walkthrough. Stay tuned and good luck :)

Dmitry Telegin
CTO, Acutus s.r.o.
Keycloak Consulting and Training

Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
+42 (022) 888-30-71
E-mail: info at acutus.pro

On Tue, 2018-11-06 at 20:51 +0000, Ronald Demneri wrote:
> I configured the client to not use the userinfo endpoint for the group mapping.? Instead I used the id token,? and everything looks good now (no errors in the log,? and the client gets the claim, and assigns permissions accordingly) . Anyhow,? the question remains,? is there a way to get the client id using the script mapper?
> 
> Thanks in advance,
> Ronald
> 
> Sent from my HTC
> 
> ----- Reply message -----
> > From: "Ronald Demneri" <ronald.demneri at amdtia.com>
> > > To: "Ronald Demneri" <ronald.demneri at amdtia.com>, "Dmitry Telegin" 
> > > <dt at acutus.pro>, "keycloak-user at lists.jboss.org" 
> > > <keycloak-user at lists.jboss.org>
> Subject: [keycloak-user] filter group claim in token per client
> Date: Tue, Nov 6, 2018 16:08
> 
> Hello again,
> 
> Upon testing login and experimenting where the claim should be inserted, I found out that the duplicate print() is a result of including the claim in both ID access tokens. The error comes as a result of including the claim in the userinfo token, and probably that is why the userinfo endpoint does not contain the claim when the client application requests it.
> 
> Any idea how to solve it?
> 
> 
> Thanks in advance,
> Ronald
> 
> -----Original Message-----
> From: Ronald Demneri
> Sent: 06.Nov.2018 12:01 PM
> > To: Ronald Demneri <ronald.demneri at amdtia.com>; Dmitry Telegin 
> > <dt at acutus.pro>; keycloak-user at lists.jboss.org
> Subject: RE: [keycloak-user] filter group claim in token per client
> 
> So, I am looking at the logs and receive the following when going to App1 > Client Scopes > Evaluate:
> 
> 2018-11-06 10:51:42,407 INFO? [stdout] (default task-1892) 
> ############################################ APP1
> 2018-11-06 10:51:42,407 INFO? [stdout] (default task-1892) 
> ############################################
> 2018-11-06 10:51:42,407 INFO? [stdout] (default task-1892)? We are here!!!
> 2018-11-06 10:51:42,408 INFO? [stdout] (default task-1892) 
> ############################################
> 
> But when trying to actually log in to the client, I receive the following:
> 
> 2018-11-06 10:52:20,465 INFO? [stdout] (default task-1891) 
> ############################################ APP1
> 2018-11-06 10:52:20,465 INFO? [stdout] (default task-1891) 
> ############################################
> 2018-11-06 10:52:20,465 INFO? [stdout] (default task-1891)? We are here!!!
> 2018-11-06 10:52:20,466 INFO? [stdout] (default task-1891) 
> ############################################
> 2018-11-06 10:52:20,474 INFO? [stdout] (default task-1891) 
> ############################################ APP1
> 2018-11-06 10:52:20,474 INFO? [stdout] (default task-1891) 
> ############################################
> 2018-11-06 10:52:20,474 INFO? [stdout] (default task-1891)? We are here!!!
> 2018-11-06 10:52:20,475 INFO? [stdout] (default task-1891) 
> ############################################
> 2018-11-06 10:52:20,691 ERROR 
> [org.keycloak.protocol.oidc.mappers.ScriptBasedOIDCProtocolMapper] 
> (default task-1891) Error during execution of ProtocolMapper script: 
> org.keycloak.scripting.ScriptExecutionException: Could not execute 
> script 'token-mapper-script_filteredGroupsMapper' problem was: 
> TypeError: null has no such function "toUpperCase" in <eval> at line 
> number 31
> 
> Line 31 is as follows:
> 
> 31:??? var client = token.getIssuedFor().toUpperCase();
> 32:??? print("############################################ " + 
> client);
> 
> So why does it display an error, when in fact it also displays the correct form of the clientId in upper case? And why is the log entry duplicated? ATM, I removed the client scope mapper and have recreated the script mapper only for this client.
> 
> 
> Regards,
> Ronald
> 
> 
> -----Original Message-----
> From: Ronald Demneri
> Sent: 06.Nov.2018 11:05 AM
> > > To: 'Ronald Demneri' <ronald.demneri at amdtia.com>; 'Dmitry Telegin' 
> > > <dt at acutus.pro>; 'keycloak-user at lists.jboss.org' 
> > > <keycloak-user at lists.jboss.org>
> Subject: RE: [keycloak-user] filter group claim in token per client
> 
> Hello Dmitry,
> 
> A colleague of mine helped solving the issue with the array, and I can see the filtered groups in the Access token. I also used token.getIssuedFor() to get the client name and make the evaluation of the filtered groups dynamic. The problem now is that this new claim is not present in the userinfo. This is the script that we came up with (configured both as client scopes (possibly define as a default client scope) as well as script mapper specific to this client for test purposes - claim names are different of course):
> 
> > [kcadmin at keycloak bin]$ ./kcadm.sh get client-scopes [ {
> ? "id" : "4ea94866-044e-4590-a2da-f25c980f08b4",
> ? "name" : "Filtered_Groups",
> ? "protocol" : "openid-connect",
> ? "attributes" : {
> ??? "display.on.consent.screen" : "true"
> ? },
> ? "protocolMappers" : [ {
> ??? "id" : "7d3c521a-b291-4f43-ad87-6891ed9584d3",
> ??? "name" : "Filtered Groups",
> ??? "protocol" : "openid-connect",
> ??? "protocolMapper" : "oidc-script-based-protocol-mapper",
> ??? "consentRequired" : false,
> ??? "config" : {
> ????? "multivalued" : "true",
> ????? "userinfo.token.claim" : "true",
> ????? "id.token.claim" : "true",
> ????? "access.token.claim" : "true",
> ????? "claim.name" : "fGroup",
> ????? "jsonType.label" : "String",
> ????? "script" : "/**
> ??????? * Available variables:
> ??????? * user - the current user
> ??????? * realm - the current realm
> ??????? * token - the current token
> ??????? * userSession - the current userSession
> ??????? * keycloakSession - the current userSession
> ??????? */
> ????????
> ??????? //insert your code here...
> 
> ??????? //So, first we need to know, how many names should be added to 
> the new claim,
> ??????? var username = user ? user.username : \"anonymous\";
> ??????? var groups = user.getGroups();
> ??????? var group_array = groups.toArray();
> ??????? //print(\"########################################## \" + 
> username);
> 
> ??????? var client = token.getIssuedFor();
> ??????? //print(\"############################################ \" + 
> client);
> 
> ??????? var clUp = client.toUpperCase();
> ??????? //print(clUp);
> 
> ??????? var group_APP = \"APP-\" + clUp + \"-USERS\";
> ??????? var group_ROL = \"ROL_SSO-\" + clUp + \"-ADMIN\";
> 
> ??????? var group_filtered = [];
> 
> ??????? for (var i in group_array) {
> ??????????????? var gn = group_array[i].getName();
> ??????????????? var gnUp = gn.toUpperCase();
> ??????????????? if (gnUp === group_APP || gnUp === group_ROL) {
> ??????????????????????? group_filtered.push(\"/\" + gn);
> ??????????????????????? }
> ??????????????? }
> ??????? //Then we declare the new array.
> ??????? var l = group_filtered.length;
> ??????? var group_token = 
> java.lang.reflect.Array.newInstance(java.lang.String.class, l);
> 
> ??????? for (var f in group_filtered) {
> ??????????????? group_token[f] = group_filtered[f];
> ??????????????? //print(group_token[f]);
> ??????? }
> 
> ??????? //And submit the array as token
> ??????? token.setOtherClaims(\"fGroup\", group_token);"
> ??? }
> ? } ]
> }
> 
> This is the userinfo data for my account:
> 
> {
> ? "sub": "bad7ff26-2a70-446f-a635-06fdbe1bec55",
> ? "Group": [
> ??? "/APP-App1-Users/TGR-Team-ABC",
> ??? "/APP-App1-Users/TGR-Team-DEF",
> ??? "/APP-App1-Users",
> ??? "/APP-MySmallApp-Users"
> ? ],
> ? "email_verified": false,
> ? "name": "Ronald Demneri",
> ? "preferred_username": "u151302",
> ? "given_name": "Ronald",
> ? "family_name": "Demneri"
> 
> 
> The group claim is inserted by the group mapper created for this client, and the idea is to remove it once the script mapper works as expected.
> What do you think is going on? Is this behavior normal?
> 
> Thanks in advance,
> Ronald
> 
> -----Original Message-----
> From: Ronald Demneri
> Sent: 05.Nov.2018 12:12 PM
> > To: 'Ronald Demneri' <ronald.demneri at amdtia.com>; Dmitry Telegin 
> > <dt at acutus.pro>; keycloak-user at lists.jboss.org
> Subject: RE: [keycloak-user] filter group claim in token per client
> 
> Hello,
> 
> In the script authenticator there was authenticationSession which I used to get the clientId. There is no such variable in the script mapper, and If I define such mapper in the client template, I suppose I'd need some mechanism to get the client name and then make the filtering of the groups that need to be inserted in the token. How do I do that? Is there any documentation available for this online?
> 
> 
> Thanks again for your support!
> Ronald
> 
> 
> -----Original Message-----
> > From: keycloak-user-bounces at lists.jboss.org 
> > <keycloak-user-bounces at lists.jboss.org> On Behalf Of Ronald Demneri
> Sent: 05.Nov.2018 11:00 AM
> > To: Dmitry Telegin <dt at acutus.pro>; keycloak-user at lists.jboss.org
> Subject: Re: [keycloak-user] filter group claim in token per client
> 
> Hello Dmitry,
> 
> Thanks for the response. In fact I tried that before posting here, created a custom script mapper for the client that I have configured. The problem is that the script will return a list of objects, not an array of strings, which is what I am expecting.
> 
> What do I need to pay extra attention in order to solve this?
> 
> 
> Thanks in advance and Regards,
> Ronald
> 
> -----Original Message-----
> > From: Dmitry Telegin <dt at acutus.pro>
> Sent: 05.Nov.2018 6:54 AM
> > To: Ronald Demneri <ronald.demneri at amdtia.com>; 
> > keycloak-user at lists.jboss.org
> Subject: Re: [keycloak-user] filter group claim in token per client
> 
> Hello Ronald,
> 
> As in the case with authentication, JavaScript is to the rescue again :) You can create a script mapper for groups that will do additional group filtering based on the client, and use it instead of the built-in one.
> 
> To avoid explicitly configuring it for each and every client, you can create a Client Scope (can be called "Client Template" depending on the KC version), define the mapper in the scope, and add it do default scopes.
> 
> Cheers,
> Dmitry Telegin
> CTO, Acutus s.r.o.
> Keycloak Consulting and Training
> 
> Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
> +42 (022) 888-30-71
> > E-mail: info at acutus.pro
> 
> On Fri, 2018-11-02 at 10:30 +0000, Ronald Demneri wrote:
> > Hello everyone,
> >?
> > Is there a way to filter the groups a user is a member of per client, based on clientId (which is part of the group name(s) in AD). Let's say that user Ronald is member of??group_client1, group_client2 and group_client3, so using a group mapper, the token will contain a claim like group:["group_client1", "group_client2", "group_client3"]. Upon logging in to client1 app, I want to customize the group claim so that it contains only the respective group_client1 value.
> >?
> > Thanks in advance,
> >?
> > Ronald
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
> 
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user


From wilson.sharlet at gmail.com  Mon Nov 12 05:48:27 2018
From: wilson.sharlet at gmail.com (Sharlet Wilson)
Date: Mon, 12 Nov 2018 16:18:27 +0530
Subject: [keycloak-user] Regarding keycloak REST api
In-Reply-To: <CAGrLpw_jurupGLYOK5d3ykkBt6UOiTmhj0tOhZ2ZJF-BczrHRg@mail.gmail.com>
References: <CAGrLpw_jurupGLYOK5d3ykkBt6UOiTmhj0tOhZ2ZJF-BczrHRg@mail.gmail.com>
Message-ID: <CAGrLpw-aZykBqoCwgjd-2D6kW+_t2jpde5rsB6baSzLp1-ojxA@mail.gmail.com>

Hi, I'm directly using the jboss/keycloak docker image to run Keycloak.

I created a 'quickstart' realm and a 'service-nodejs' client in the
Keycloak server. I get the access token by sending a POST request to
/auth/realms/<realm-name>/protocol/openid-connect/token API. (For this, I
had to set the Access Type of the client to 'confidential' on the Keycloak
server). Now I'm trying to access the protected route of the example
http://localhost:3000/service/secured by setting the Authorization header
to the access token I got above, but it still gives me 'Access denied'. Am
I doing anything wrong here?

Regards,
Sharlet Hannah Wilson


On Mon, Nov 12, 2018 at 1:37 PM Sharlet Wilson <wilson.sharlet at gmail.com>
wrote:

> Hi,
>
> I have a user's keycloak access token on my backend Node.js application.
> Would like to know how I can use it to authorize a user to access my custom
> REST apis. (I am using the /auth/realms/<realm-name>/protocol/openid-connect/token
> api to get the user's access token).
>
> Regards,
> Sharlet Hannah Wilson
>

From sthorger at redhat.com  Mon Nov 12 05:52:09 2018
From: sthorger at redhat.com (Stian Thorgersen)
Date: Mon, 12 Nov 2018 11:52:09 +0100
Subject: [keycloak-user] Latvian translation review
Message-ID: <CAJgngAf6nAAPZd=X93+AquO1A8OVCL0gWtte7pRvun80YJB62Q@mail.gmail.com>

Anyone from the community that can review Latvian translation PR [1]?

[1] https://github.com/keycloak/keycloak/pull/5676

From mad_style42 at hotmail.com  Mon Nov 12 06:34:01 2018
From: mad_style42 at hotmail.com (David F)
Date: Mon, 12 Nov 2018 11:34:01 +0000
Subject: [keycloak-user] How update the locale value in user profile with
	REST API ?
Message-ID: <HE1PR10MB18522D1CBA9768719A01EBF789C10@HE1PR10MB1852.EURPRD10.PROD.OUTLOOK.COM>

Hi,

I use the doc to update my profile with REST API


PUT /{realm}/users/{id}

but if I want to change the locale value ("en", "fr"...), it's impossible.

I have this response "Unrecognized field &quot;locale&quot; (class org.keycloak.representations.idm.UserRepresentation), not marked as ignorable" because in my body object I use "locale" key for "en" value for example.

I don't see in the doc how send my new locale value in my body object.

Thanks for your help ?

From bruno at abstractj.org  Mon Nov 12 07:02:25 2018
From: bruno at abstractj.org (Bruno Oliveira)
Date: Mon, 12 Nov 2018 10:02:25 -0200
Subject: [keycloak-user] Regarding keycloak REST api
In-Reply-To: <CAGrLpw-aZykBqoCwgjd-2D6kW+_t2jpde5rsB6baSzLp1-ojxA@mail.gmail.com>
References: <CAGrLpw_jurupGLYOK5d3ykkBt6UOiTmhj0tOhZ2ZJF-BczrHRg@mail.gmail.com>
	<CAGrLpw-aZykBqoCwgjd-2D6kW+_t2jpde5rsB6baSzLp1-ojxA@mail.gmail.com>
Message-ID: <CAM5SUC7Hf7AnPpf9QU_7YpUwr3_i3S2ydYMuo=tn487B-MDJVw@mail.gmail.com>

Try something like this:

#!/bin/bash

REALM="quickstart"
PORT="8180"

echo "Access"
TKN=$(curl -X POST
"http://172.18.0.2:$PORT/auth/realms/$REALM/protocol/openid-connect/token"
\
 -H "Content-Type: application/x-www-form-urlencoded" \
 -d "username=alice" \
 -d 'password=password' \
 -d 'grant_type=password' \
 -d 'client_id=admin-cli' | jq -r '.access_token')

curl -X GET 'http://localhost:3000/service/secured' -H "Accept:
application/json" -H "Authorization: Bearer $TKN"

On Mon, Nov 12, 2018 at 8:49 AM Sharlet Wilson <wilson.sharlet at gmail.com> wrote:
>
> Hi, I'm directly using the jboss/keycloak docker image to run Keycloak.
>
> I created a 'quickstart' realm and a 'service-nodejs' client in the
> Keycloak server. I get the access token by sending a POST request to
> /auth/realms/<realm-name>/protocol/openid-connect/token API. (For this, I
> had to set the Access Type of the client to 'confidential' on the Keycloak
> server). Now I'm trying to access the protected route of the example
> http://localhost:3000/service/secured by setting the Authorization header
> to the access token I got above, but it still gives me 'Access denied'. Am
> I doing anything wrong here?
>
> Regards,
> Sharlet Hannah Wilson
>
>
> On Mon, Nov 12, 2018 at 1:37 PM Sharlet Wilson <wilson.sharlet at gmail.com>
> wrote:
>
> > Hi,
> >
> > I have a user's keycloak access token on my backend Node.js application.
> > Would like to know how I can use it to authorize a user to access my custom
> > REST apis. (I am using the /auth/realms/<realm-name>/protocol/openid-connect/token
> > api to get the user's access token).
> >
> > Regards,
> > Sharlet Hannah Wilson
> >
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user



-- 
- abstractj

From geoff at opticks.io  Mon Nov 12 07:08:00 2018
From: geoff at opticks.io (Geoffrey Cleaves)
Date: Mon, 12 Nov 2018 13:08:00 +0100
Subject: [keycloak-user] End user sharing of his resource removes permission
	to his resource
Message-ID: <CAHzT=q8yaw7wPEzRh=FST4cmWEd0MWW3LFYv5Z_ESJXn7TaxCg@mail.gmail.com>

I'm experiencing unexpected results and believe there is a bug. I am losing
permissions to my resource after sharing my resource with another user.

Resource owner rs1 has read and edit rights to his resource1 through a JS
policy and permission which grants the resource owner the rights.

If rs1 uses the My resources screen to grant another user, rs2, the read
scope to resource1, rs1 looses the right to the read scope.

Please see JIRA https://issues.jboss.org/browse/KEYCLOAK-8794 and the
screen cast within the JIRA.

From Cedric.Roeck at senacor.com  Mon Nov 12 07:24:40 2018
From: Cedric.Roeck at senacor.com (=?utf-8?B?UsO2Y2ssIENlZHJpYw==?=)
Date: Mon, 12 Nov 2018 12:24:40 +0000
Subject: [keycloak-user] Persist Keycloak session cache into JDBC store,
 no data is written into table
Message-ID: <91A1C543-4CFF-4BC6-9A2F-904A2FCB9736@senacor.com>

Hi,

we are currently trying to persist the in-memory session cache of our Keycloak (9.5.0.Final) deployment into a persistent store, preferably JDBC based.

In order to achieve this, we already updated the configuration and ended up with this config for the Infinispan subsystem:

<subsystem xmlns="urn:jboss:domain:infinispan:6.0">
    <cache-container name="keycloak">
        <transport lock-timeout="60000"/>
        <local-cache name="realms">
            <object-memory size="10000"/>
        </local-cache>
        <local-cache name="users">
            <object-memory size="10000"/>
        </local-cache>
        <local-cache name="authorization">
            <object-memory size="10000"/>
        </local-cache>
        <local-cache name="keys">
            <object-memory size="1000"/>
            <expiration max-idle="3600000"/>
        </local-cache>
        <replicated-cache name="work"/>
        <distributed-cache name="sessions" statistics-enabled="true" owners="${env.CACHE_OWNERS:1}">
            <jdbc-store data-source="KeycloakDS" dialect="SQL_SERVER" fetch-state="true" passivation="false" preload="true" purge="false" shared="true" singleton="false">
                <property name="dropTableOnExit">
                    false
                </property>
                <property name="createTableOnStart">
                    true
                </property>
                <table/>
            </jdbc-store>
        </distributed-cache>
        <distributed-cache name="clientSessions" statistics-enabled="true" owners="${env.CACHE_OWNERS:1}"/>
        <distributed-cache name="authenticationSessions" statistics-enabled="true" owners="${env.CACHE_OWNERS:1}"/>
        [...]
    </cache-container>
    [...]
</subsystem>

Even though the table ?ispn_entry_sessions? gets created once Keycloak starts, no data is being persisted there. Not after 5min and also not once several hours passed. To exclude batch sizes and alike as error cause, our test creates 300 users and performs repeated logins for all of them, so there should also be enough load on the system.

Some more details:

  *   The statistics already show more than 600 cache-loader-misses for the jdbc store, but no successful load.
  *   Our deployment consists of three Keycloak instances running in Kubernetes pods / docker containers.
  *   Target JDBC Database is an Azure managed SQL DB / SQL Server
  *   We can?t see any errors in the logs and also the cache distribution appears to still work amongst all nodes in the cluster.


If you need more details, log excerpts, the full config, ?, just give me a ping.

What are we missing? Any help is very much appreciated.

Thanks and kind regards
Cedric

Cedric R?ck
______________________________
Senacor Technologies AG
?u?ere Cramer-Klett-Str. 21
90489 N?rnberg

M +49 (170) 2274 878

Cedric.Roeck at senacor.com
www.senacor.com


Senacor Technologies Aktiengesellschaft - Sitz: Eschborn - Amtsgericht Frankfurt am Main - Reg.-Nr.: HRB 110482
Vorstand: Matthias Tomann, Marcus Purzer - Aufsichtsratsvorsitzender: Daniel Gr?zinger

Diese E-Mail inklusive Anlagen enth?lt vertrauliche und/oder rechtlich gesch?tzte Informationen. Wenn Sie
nicht der richtige Adressat sind oder diese E-Mail irrt?mlich erhalten, informieren Sie bitte den  Absender
und vernichten Sie diese E-Mail. Das unerlaubte Kopieren sowie die unbefugte Weitergabe dieser  E-Mail ist
nicht gestattet.

This e-mail including any attachments may contain confidential and/or privileged information. If you are
not the intended recipient (or have received this e-mail in error) please notify the sender immediately and
destroy this e-mail. Any unauthorized copying, disclosure or distribution of the materials in this e-mail is
strictly forbidden.

From psilva at redhat.com  Mon Nov 12 07:34:01 2018
From: psilva at redhat.com (Pedro Igor Silva)
Date: Mon, 12 Nov 2018 10:34:01 -0200
Subject: [keycloak-user] End user sharing of his resource removes
 permission to his resource
In-Reply-To: <CAHzT=q8yaw7wPEzRh=FST4cmWEd0MWW3LFYv5Z_ESJXn7TaxCg@mail.gmail.com>
References: <CAHzT=q8yaw7wPEzRh=FST4cmWEd0MWW3LFYv5Z_ESJXn7TaxCg@mail.gmail.com>
Message-ID: <CAJrcDBcSzgvpScK_M7Ru0woQoAA9sfYWMv9Z7ZHw6ezb16v5SA@mail.gmail.com>

Hi,

It should be fixed by https://issues.jboss.org/browse/KEYCLOAK-8445. Fix
will be available in the next release.

Regards.
Pedro Igor

On Mon, Nov 12, 2018 at 10:23 AM Geoffrey Cleaves <geoff at opticks.io> wrote:

> I'm experiencing unexpected results and believe there is a bug. I am losing
> permissions to my resource after sharing my resource with another user.
>
> Resource owner rs1 has read and edit rights to his resource1 through a JS
> policy and permission which grants the resource owner the rights.
>
> If rs1 uses the My resources screen to grant another user, rs2, the read
> scope to resource1, rs1 looses the right to the read scope.
>
> Please see JIRA https://issues.jboss.org/browse/KEYCLOAK-8794 and the
> screen cast within the JIRA.
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

From geoff at opticks.io  Mon Nov 12 08:42:29 2018
From: geoff at opticks.io (Geoffrey Cleaves)
Date: Mon, 12 Nov 2018 14:42:29 +0100
Subject: [keycloak-user] How update the locale value in user profile
 with REST API ?
In-Reply-To: <HE1PR10MB18522D1CBA9768719A01EBF789C10@HE1PR10MB1852.EURPRD10.PROD.OUTLOOK.COM>
References: <HE1PR10MB18522D1CBA9768719A01EBF789C10@HE1PR10MB1852.EURPRD10.PROD.OUTLOOK.COM>
Message-ID: <CAHzT=q-vpk4=Kb2Y8k6jZ9j-YO54-UfuF8FeU_PELQf11WyzOA@mail.gmail.com>

Does this body work? Is locale an attribute?

{
"username": "username",
"enabled": true,
"emailVerified": true,
"email": "email",
"disableableCredentialTypes": ["password"],
"credentials": [{
"value": "pass123",
"type": "password"
}],
"attributes": {
"company": ["company"],
"locale": ["fr"]
}
}


Regards,
Geoffrey Cleaves







On Mon, 12 Nov 2018 at 12:37, David F <mad_style42 at hotmail.com> wrote:

> Hi,
>
> I use the doc to update my profile with REST API
>
>
> PUT /{realm}/users/{id}
>
> but if I want to change the locale value ("en", "fr"...), it's impossible.
>
> I have this response "Unrecognized field &quot;locale&quot; (class
> org.keycloak.representations.idm.UserRepresentation), not marked as
> ignorable" because in my body object I use "locale" key for "en" value for
> example.
>
> I don't see in the doc how send my new locale value in my body object.
>
> Thanks for your help ?
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From prsrivas at redhat.com  Mon Nov 12 10:00:17 2018
From: prsrivas at redhat.com (Pritha Srivastava)
Date: Mon, 12 Nov 2018 10:00:17 -0500 (EST)
Subject: [keycloak-user] Running Keycloak examples
In-Reply-To: <9a1bf974-82c9-4d0d-b7a1-70c439e43f64@redhat.com>
References: <257635183.32186267.1541746556969.JavaMail.zimbra@redhat.com>
	<0cb2a458-a741-8858-f339-9ddb3b75a442@redhat.com>
	<1107344991.32206816.1541753576533.JavaMail.zimbra@redhat.com>
	<9a1bf974-82c9-4d0d-b7a1-70c439e43f64@redhat.com>
Message-ID: <219649640.32930099.1542034817156.JavaMail.zimbra@redhat.com>

Thank you for your help.

It does work fine for me as well. I was not sure what is the correct location of $WILDFLY_HOME.

Thanks,
Pritha

----- Original Message -----
> From: "Vlasta Ramik" <vramik at redhat.com>
> To: "Pritha Srivastava" <prsrivas at redhat.com>
> Cc: keycloak-user at lists.jboss.org
> Sent: Monday, November 12, 2018 2:16:28 PM
> Subject: Re: [keycloak-user] Running Keycloak examples
> 
> I've just checked it and it seems to work. There are my steps:
> 
> 1. download wildfly-14.0.1.Final.zip as an application server and unpack
> 
> 2. download keycloak-wildfly-adapter-dist-4.5.0.Final.zip unpack it to
> $WILDFLY_HOME
> 
> 3. run $WILDFLY_HOME/bin/jboss-cli.sh
> --file=adapter-elytron-install-offline.cli
> 
> all passes.
> 
> 4. download keycloak-4.5.0.Final.zip and
> keycloak-examples-4.5.0.Final.zip (which are deprecated) and unzip it
> 
> then I can start keycloak-4.5.0.Final (auth server) and
> wildfly-14.0.1.Final (app server) and then I can deploy examples to the
> app server.
> 
> V.
> 
> On 11/9/18 9:52 AM, Pritha Srivastava wrote:
> > I still get the same error:
> >
> > ./bin/jboss-cli.sh --file=adapter-elytron-install-offline.cli
> >
> > {
> >      "outcome" => "failed",
> >      "failure-description" => "WFLYCTL0310: Extension module
> >      org.keycloak.keycloak-adapter-subsystem not found",
> >      "rolled-back" => true
> > }
> >
> >
> > Thanks,
> > Pritha
> >
> > ----- Original Message -----
> >> From: "Vlasta Ramik" <vramik at redhat.com>
> >> To: keycloak-user at lists.jboss.org
> >> Sent: Friday, November 9, 2018 1:52:02 PM
> >> Subject: Re: [keycloak-user] Running Keycloak examples
> >>
> >> Hello,
> >>
> >> inline
> >>
> >> On 11/9/18 7:55 AM, Pritha Srivastava wrote:
> >>> Hi All,
> >>>
> >>> I am trying to setup a Keycloak server and run the examples, for which I
> >>> did the following:
> >>>
> >>> 1. Downloaded 4.5.0.Final Standalone Server distribution, and started the
> >>> server using ./standalone.sh, which worked fine.
> >>> 2. Downlaoded keycloak-examples-4.5.0.Final, and for the
> >>> preconfigured-demo, I did a mvn clean install and mvn wildfly:deploy and
> >>> the second step gave me this error - UT010039: Unknown authentication
> >>> mechanism KEYCLOAK
> >>> 3. To solve the error in 2.0, I downloaded the wildfly adapter
> >>> keycloak-wildfly-adapter-dist-4.5.0.Final.zip, and ran this command -
> >>> ./bin/jboss-cli.sh --file=adapter-install.cli --connect
> >>> --controller=127.0.0.1:9990 which gave the following response:
> >> can you please try the following to install adapter?
> >>
> >> ./bin/jboss-cli.sh --file=adapter-elytron-install-offline.cli
> >>
> >>> {"outcome" => "success"}
> >>> {
> >>>       "outcome" => "success",
> >>>       "response-headers" => {
> >>>           "operation-requires-reload" => true,
> >>>           "process-state" => "reload-required"
> >>>       }
> >>> }
> >>> {
> >>>       "outcome" => "failed",
> >>>       "failure-description" => "WFLYCTL0310: Extension module
> >>>       org.keycloak.keycloak-adapter-subsystem not found",
> >>>       "rolled-back" => true,
> >>>       "response-headers" => {"process-state" => "reload-required"}
> >>> }
> >>>
> >>> I am not sure how to solve the above problem. Any help is greatly
> >>> appreciated.
> >>>
> >>> P.S.: I am completely new to Jboss, Wildfly etc.
> >>>
> >>> Thanks,
> >>> Pritha
> >>>
> >>> _______________________________________________
> >>> keycloak-user mailing list
> >>> keycloak-user at lists.jboss.org
> >>> https://lists.jboss.org/mailman/listinfo/keycloak-user
> >> _______________________________________________
> >> keycloak-user mailing list
> >> keycloak-user at lists.jboss.org
> >> https://lists.jboss.org/mailman/listinfo/keycloak-user
> >>
> 

From fabio.ebner at lumera.com.br  Mon Nov 12 15:56:59 2018
From: fabio.ebner at lumera.com.br (Fabio Ebner)
Date: Mon, 12 Nov 2018 18:56:59 -0200
Subject: [keycloak-user] Authorize Url
Message-ID: <CAFxMZbY+dC7QqD8Ytt7ueJM7Cv2yU6qBk9TTVXX3h=ZOGDezAw@mail.gmail.com>

I using SpringBoot 2.0.5 and keycloak 4.5.0.Final so it's possible to
secure an URL using:

@PreAuthorize("hasRole('USER')")

@GetMapping("/mensagem/enviada/t")


instead the

.antMatchers("/mensagem/enviada/**").hasRole("USER")

From david at smooth-systems.solutions  Mon Nov 12 16:55:46 2018
From: david at smooth-systems.solutions (David Monichi)
Date: Mon, 12 Nov 2018 22:55:46 +0100
Subject: [keycloak-user] Extend keycloak notifications
Message-ID: <5145cc17-a0aa-ca89-3a6f-41e4ad15599e@smooth-systems.solutions>

Hi,

I'm considering to create a new application and for sure I'll use 
keycloak as user backend. It's really cool stuff what you guys created.

I thought about various solutions for notifications of my application 
and was wondering if you guys already thought about to extend your 
e-mail notification to a more general and flexible system. So that not 
only keycloak e-mails will be sent over keycloak but also other 
applications e-mails and even more notifications can be send over 
keycloak (I'm thinking here of SMS, etc.). Therefore applications would 
need to upload any kind of templates to keycloak and somehow be able to 
manage them. There are 2 reasons for such a step. First of all keycloak 
already provides such basic functionality to sent notifications and so 
extending it could be done with lower overhead. Second, keycloak already 
owns the recipient data, if applications manage users over keycloak.

As additional feature of course a proper monitoring should be placed in 
such a feature, since notifications are really vital to modern applications.

We would be able to provide programming resources for such a feature but 
of course working together, specially for the design phase, with you guys.

The alternative would be to provide a different notification system and 
forward keycloak e-mails to that service (actually the event to sent a 
notification). Don't know if this actually is the way to go ...


My motivation for such a feature is, that a single application should be 
responsible for sending notifications of any kind and not be widespread 
over various applications.

Any ideas welcome ;) Eventually I overlooked something in my design ...


Thx in advance for all your thoughts & all the best

/david


From dt at acutus.pro  Mon Nov 12 18:20:27 2018
From: dt at acutus.pro (Dmitry Telegin)
Date: Tue, 13 Nov 2018 02:20:27 +0300
Subject: [keycloak-user] Extend keycloak notifications
In-Reply-To: <5145cc17-a0aa-ca89-3a6f-41e4ad15599e@smooth-systems.solutions>
References: <5145cc17-a0aa-ca89-3a6f-41e4ad15599e@smooth-systems.solutions>
Message-ID: <1542064827.2535.5.camel@acutus.pro>

Hello David,

Just FYI, you can reach Keycloak developers via keycloak-dev mailing list; this one is more like a community of independent Keycloak experts. Being a proud member thereof, I'll put in my two cents with great pleasure :) see answers inline.

TL;DR: the feature seems interesting, but I highly doubt it will be ever made a part of Keycloak. However, you can implement everything as a Keycloak extension (and that's what we love about Keycloak).

On Mon, 2018-11-12 at 22:55 +0100, David Monichi wrote:
> Hi,
> 
> I'm considering to create a new application and for sure I'll use?
> keycloak as user backend. It's really cool stuff what you guys created.
> 
> I thought about various solutions for notifications of my application?
> and was wondering if you guys already thought about to extend your?
> e-mail notification to a more general and flexible system. So that not?
> only keycloak e-mails will be sent over keycloak but also other?
> applications e-mails and even more notifications can be send over?
> keycloak (I'm thinking here of SMS, etc.). Therefore applications would?
> need to upload any kind of templates to keycloak and somehow be able to?
> manage them. There are 2 reasons for such a step. First of all keycloak?
> already provides such basic functionality to sent notifications and so?
> extending it could be done with lower overhead. Second, keycloak already?
> owns the recipient data, if applications manage users over keycloak.

I'd also add that Keycloak already integrates the Freemarker?template engine, which is used to generate emails (along with login forms and the account UI).

> As additional feature of course a proper monitoring should be placed in?
> such a feature, since notifications are really vital to modern applications.

Could you please elaborate what exactly you need to monitor?

> We would be able to provide programming resources for such a feature but?
> of course working together, specially for the design phase, with you guys.
> 
> The alternative would be to provide a different notification system and?
> forward keycloak e-mails to that service (actually the event to sent a?
> notification). Don't know if this actually is the way to go ...
> 
> 
> My motivation for such a feature is, that a single application should be?
> responsible for sending notifications of any kind and not be widespread?
> over various applications.
> 
> Any ideas welcome ;) Eventually I overlooked something in my design ...

My experience says that features like that rarely get incorporated into mainline Keycloak; the necessary (but not sufficient) condition is that you should be able to maintain this feature in the future.

However, you can use Keycloak extension points (called Providers [1] in Keycloak's terms) to implement what you want.

Here's my take on the outline of the solution:
- implement EntityProvider [2] (custom JPA entity + DB table) to store templates;
- implement RealmResourceProvider [3] (custom REST resource) for CRUD-style template management by the applications;
- implement another one to trigger notification (and potentially track its status);
- implement the actual notification code, i.e. retrieving the template, processing it with Freemarker and queueing it for delivery;
- most likely, you will need a persistent queue to store pending notifications. For that, you can employ Keycloak's built-in ActiveMQ Artemis message broker;
- optionally, integrate your system with Keycloak internal events, so that the latter could trigger your application-managed notifications.

For the reference, I'd recommend the official keycloak examples [4] and my own BeerCloak project [5].

Good luck, and feel free to ask any questions :)

Dmitry Telegin
CTO, Acutus s.r.o.
Keycloak Consulting and Training

Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
+42 (022) 888-30-71
E-mail: info at acutus.pro

[1] https://www.keycloak.org/docs/latest/server_development/index.html#_providers
[2] https://www.keycloak.org/docs/latest/server_development/index.html#_extensions_jpa
[3] https://www.keycloak.org/docs/latest/server_development/index.html#_extensions_rest
[4] https://github.com/keycloak/keycloak/tree/master/examples/providers
[5] https://github.com/dteleguin/beercloak

> 
> 
> Thx in advance for all your thoughts & all the best
> 
> /david
> 
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From tommaso.tamantini at staff.aruba.it  Tue Nov 13 02:01:38 2018
From: tommaso.tamantini at staff.aruba.it (Tommaso Tamantini)
Date: Tue, 13 Nov 2018 08:01:38 +0100
Subject: [keycloak-user] Keycloak + Custom AuthenticatorFactory + Spring 5
Message-ID: <000001d47b1e$b980ac40$2c8204c0$@staff.aruba.it>

Hi to all,

 

I'm trying to develope a custom AuthenticatorFactory with a custom
Authenticator.

 

I would like to inject my custom Authenticator  as Spring Bean into my
custom AuthenticatorFactory (because my authenticator should use an existing
spring library).

 

My authenticator is like:

 

@Component

public class MyAuthenticator extends AbstractUsernameFormAuthenticator
implements Authenticator {

[.]

 

To achieve it, I created an  ApplicationContextAware bean 

 

@Service

public class BeanUtil implements ApplicationContextAware {

 

     private static ApplicationContext applicationContext;

     

     public BeanUtil() {

     }

 

     @Override

     public void setApplicationContext(ApplicationContext
applicationContext) throws BeansException {

          this.applicationContext = applicationContext;

     }

 

     public static Authenticator getAuthenticatorBean() { 

          return applicationContext.getBean(MyAuthenticator.class);

     } 

 

}

 

My factory is:

 

public class MyAuthenticatorFactory implements AuthenticatorFactory,
ConfigurableAuthenticatorFactory {

 

     public static final String PROVIDER_ID = "aruba-alias-authenticator";

 

     public static final String G_RECAPTCHA_RESPONSE =
"g-recaptcha-response";

     public static final String RECAPTCHA_REFERENCE_CATEGORY = "recaptcha";

     public static final String SITE_KEY = "site.key";

     public static final String NUMBER_KEY = "number.key";

     public static final String SITE_SECRET = "secret";

 

     @Override

     public String getId() {

          return PROVIDER_ID;

     }

 

     @Override

     public MyAuthenticator create(KeycloakSession session) {

          return BeanUtil.AuthenticatorBean();

     }

 

[.]

 

Keycloak starts up correctly. 

 

When I try to use myAuthenticator, i get: 

 

 

16:46:48,484 INFO  [org.jboss.as] (Controller Boot Thread) WFLYSRV0060: Http
management interface listening on http://0.0.0.0:9990/management

sia-keycloak | 16:46:48,484 INFO  [org.jboss.as] (Controller Boot Thread)
WFLYSRV0051: Admin console listening on http://0.0.0.0:9990

sia-keycloak | 16:46:48,485 INFO  [org.jboss.as] (Controller Boot Thread)
WFLYSRV0025: Keycloak 4.5.0.Final (WildFly Core 5.0.0.Final) started in
23456ms - Started 943 of 1231 services (653 services are lazy, passive or
on-demand)

sia-keycloak | 16:47:12,357 WARN  [org.keycloak.services] (default task-3)
KC-SERVICES0013: Failed authentication: java.lang.NullPointerException

sia-keycloak |  at
...authenticator.alias.BeanUtil.getArubaAliasAuthenticatorBean(BeanUtil.java
:22)

sia-keycloak |  at
..authenticator.alias.AuthenticatorFactory.create(MyAuthenticatorFactory.jav
a:35)

sia-keycloak |  at
...authenticator.alias.AuthenticatorFactory.create(MyAuthenticatorFactory.ja
va:1)

 

 

The reason in that the Spring Context is null. 

 

Any idea about how to fix this issue?

 

 

Many thanks, 

Tom

 

 

 

 


From karsten.honsack at zurich.com  Tue Nov 13 02:11:03 2018
From: karsten.honsack at zurich.com (Karsten Honsack)
Date: Tue, 13 Nov 2018 07:11:03 +0000
Subject: [keycloak-user] Login via SAML RESPONSE from an IdP
In-Reply-To: <1541736836.15117.5.camel@acutus.pro>
References: <ce084148ab0043aab89c665f24f57744@CEEXC0523.ZURMWS.CSCMWS.COM>
	<1541736836.15117.5.camel@acutus.pro>
Message-ID: <f53beb21339a40579802edbc4ac0f5a4@CEEXC0523.ZURMWS.CSCMWS.COM>

Hi Dimitry,

thank you for the additional information!

I don't know the the exact technology. It is a german SSO provider for insurance sellers called "easy login" and I think their IdP is their own implementation as they also use some proprietary token formats for other scenarios.

Best regards

Karsten

-----Urspr?ngliche Nachricht-----
Von: Dmitry Telegin <dt at acutus.pro>
Gesendet: Freitag, 9. November 2018 05:14
An: Karsten Honsack <karsten.honsack at zurich.com>; keycloak-user at lists.jboss.org
Betreff: [EXTERNAL] Re: [keycloak-user] Login via SAML RESPONSE from an IdP

Hello Karsten,

Just to add to Luis's answer below. In SAML terms, this is called "Unsolicited SAML response", meaning that it hasn't been preceded by any AuthnRequest.

While configuring your partner webapp in the 3rd party IdP, make sure that your ACS URL is in the following form:
/auth/realms/{broker-realm}/broker/{idp-name}/endpoint/clients/{client-id}

where {client-id} is the value of the "IDP Initiated SSO URL Name" in the broker definition. It's a common mistake to use Keycloak SAML endpoint (/auth/realms/{realm}/protocol/saml/endpoint) as ACS for IdP-initiated SSO. This won't work as generic SAML endpoint doesn't accept unsolicited responses, only client-specific endpoints do.

By the way, what's that 3rd party IdP? Keycloak is known to work with Okta and PingFederate and theoretically should work with any SAML 2.0 compliant IdP.

Cheers,
Dmitry Telegin
CTO, Acutus s.r.o.
Keycloak Consulting and Training

Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
+42 (022) 888-30-71
E-mail: info at acutus.pro

On Thu, 2018-11-08 at 09:50 +0000, Karsten Honsack wrote:
> Hello everybody,
>
> I am trying to figure out if Keycloak is capable to fulfil the following requirement. I read through the documentation but was not able to figure it out.
>
> Scenario:
> A user is on a website where he has the possibility to jump to web applications of different partners via SSO. The website provider only supports IdP Initiated SSO and the button links provided are SAML Assertion Consumer URLs. The flow describes what should be happening for my understanding:
>
> Flow:
> 1. User login on website.
> 2. User clicks on button.
> 3. Website creates an encrypted SAML RESPONSE using its STS, redirects user to Keycloak's SAML Assertion Consumer URL and POSTs the SAML RESPONSE there.
> 4. Keycloak decrypts/validates SAML RESPONSE and authenticates the user.
> 5. Keycloak redirects user to the application.
> 6. User uses application.
>
> Is this possible? How has it to be configured? Do you need any more information to help me? Thank you in advance!
>
> Best regards
>
> Karsten Honsack
>
> **************************************
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://urldefense.proofpoint.com/v2/url?u=https-3A__lists.jboss.org_mailman_listinfo_keycloak-2Duser&d=DwICaQ&c=DgzfCyvE4m33Nb8jT6Zstq7mstX2IJrYfaJl8Ak-0_8&r=tEV5NbaAf1DsefwaP5VV_SYeWZQslIoxTN6j5CE93Hg&m=I3NNDtQVN-43hlzPT2rh2Hy2X1Aj7wsMVhzwxJ8T_KM&s=EJEl86Bzg8pClVwtool4TJhr8H_PmG54y8BoEGn43XI&e=

**************************************



From msakho at redhat.com  Tue Nov 13 03:14:03 2018
From: msakho at redhat.com (Meissa M'baye Sakho)
Date: Tue, 13 Nov 2018 09:14:03 +0100
Subject: [keycloak-user] setting up TLS(SSL) through the X509_CA_BUNDLE
	environment variable
In-Reply-To: <CAF83W6+KGfg_1sE9znqBUmGsQ-7dfkRwkU2O8PhnJCzgEoAOng@mail.gmail.com>
References: <CAF83W6LNmusLcefhf_RBLJ6t+dSixqNXY+twc0ZQLitqwA9JyA@mail.gmail.com>
	<CAF83W6JEWtjbPhAqBBuQdfs5M0Lb+UymvA+e-=-THjcuGO_7RQ@mail.gmail.com>
	<CAA9R9O4Hyurn-8BbWW=N34fwNWO0D9=4VUYvzVhobMqZn8XkXA@mail.gmail.com>
	<CAF83W6+KGfg_1sE9znqBUmGsQ-7dfkRwkU2O8PhnJCzgEoAOng@mail.gmail.com>
Message-ID: <CAF83W6KQ7nhfMKjMw8TsoS3SkTHBD_-cTZuJoWKW1pGU7UL5OQ@mail.gmail.com>

Hello Sebastien,
Any advice?
I really need to access trustore password initilized loccally from the
x509.sh script. (extrcat below)
local PASSWORD=$(openssl rand -base64 32 2>/dev/null)
local JKS_KEYSTORE_FILE="${KEYSTORE_TYPE}-keystore.jks

I'm stuck otherwise.
How can I get access to it?
Meissa

Le lun. 12 nov. 2018 ? 10:24, Meissa M'baye Sakho <msakho at redhat.com> a
?crit :

> Hi Sebastian,
> That's correct. I can see that my the truststore is created correctly with
> my CA certificates.
> I need now to configure the OutGoing HTTPS Request Truststore [3] with the
> created truststore and the password.
> The problem is that I can't set the password. I've checked into the
> x509-truststore.cli [1] and see that it's picked from the
> $keycloak_tls_truststore_password variable.
> and created from your x509.sh script [2]
> I've tried to use the same syntax in my cli below but it fails because the
> $keycloak_tls_truststore_password is not know from my cli.
> So Sebastien, do you know how I can get the trsustore password?
> Is it possible to set it as an environment variable to the docker image?
>
>
> [1]=
> https://raw.githubusercontent.com/jboss-dockerfiles/keycloak/master/server/tools/cli/x509-truststore.cli
> [2]=
> https://raw.githubusercontent.com/jboss-dockerfiles/keycloak/master/server/tools/x509.sh
> [3]=
> https://www.keycloak.org/docs/latest/server_installation/index.html#_truststore
> Thanks,
> Meissa
>
>
> Le mer. 31 oct. 2018 ? 09:08, Sebastian Laskawiec <slaskawi at redhat.com> a
> ?crit :
>
>> Hey Meissa,
>>
>> The warning you see does no harm. As you can see here [1], the message is
>> being thrown without stopping the script.
>>
>> Pulling JDK CAs has been implemented somewhat ahead of time. I asked the
>> Cloud Enablement (and also other Red Hat teams) to put Kubernetes and
>> OpenShift CAs into JDK lib directory. This way Keycloak will trust the
>> OpenShift cluster out of the box. The warning you see clearly indicates
>> that this feature hasn't been implemented yet.
>>
>> So the bottom line - please ignore this error. I'm pretty sure it will
>> disappear in the future (and if not, I'll just remove or disable this
>> feature).
>>
>> Thanks,
>> Sebastian
>>
>> [1]
>> https://github.com/jboss-dockerfiles/keycloak/blob/master/server/tools/x509.sh#L88
>>
>> On Wed, Oct 31, 2018 at 8:59 AM Meissa M'baye Sakho <msakho at redhat.com>
>> wrote:
>>
>>> Hi Sebastian,
>>> Do you have any advice in this issue. It's related to the x509.sh script
>>> and I would really apprecaite an input/help here.
>>> Meissa
>>> ---------- Forwarded message ---------
>>> From: Meissa M'baye Sakho <msakho at redhat.com>
>>> Date: mar. 30 oct. 2018 ? 17:12
>>> Subject: setting up TLS(SSL) through the X509_CA_BUNDLE environment
>>> variable
>>> To: keycloak-user <keycloak-user at lists.jboss.org>
>>>
>>>
>>> hello everyone,
>>> I'm using the jboss/keycloak:4.5.0.Final docker image.
>>> I'm trying to setup Mutual TLS by using the X509_CA_BUNDLE environment
>>> variable as explained in the Jboss/keycloak docker image documentation.
>>> I've mounted a volume to the image pointing to the cert file and defined
>>> the env variable.
>>> I'm running the image with the following command:
>>>  *docker run -d --name opengie -e KEYCLOAK_USER=meissa -e
>>> KEYCLOAK_PASSWORD=meissa \*
>>> *  -e PROXY_ADDRESS_FORWARDING=true \*
>>> *  -v /home/centos/docker-opengie/docker-image/staging:/var/run/secrets
>>> \*
>>> *  -v
>>> /home/centos/docker-opengie/docker-image/staging/jks:/etc/x509/https \*
>>> *  -e JGROUPS_DISCOVERY_PROTOCOL=dns.DNS_PING \*
>>> *  -e
>>> JGROUPS_DISCOVERY_PROPERTIES=dns_query=bdf-opengie-test.paas.eclair.local \*
>>> *  -e X509_CA_BUNDLE=/var/run/secrets/bdf-ca.crt \*
>>> *  jboss/keycloak:4.5.0.Final*
>>>
>>>
>>> When The container starts, I've checked that the cert has been corectly
>>> mounted to the expected folder /var/run/secrets
>>> But I see in the log that the certificat import fails (extract below):
>>> *Creating HTTPS keystore via OpenShift's service serving x509
>>> certificate secrets..*
>>> *HTTPS keystore successfully created at:
>>> /opt/jboss/keycloak/standalone/configuration/keystores/https-keystore.jks*
>>> *Creating Keycloak truststore..*
>>> *Keycloak truststore successfully created at:
>>> /opt/jboss/keycloak/standalone/configuration/keystores/truststore.jks*
>>> *Importing certificates from system's Java CA certificate bundle into
>>> Keycloak truststore..*
>>> *Failed to import certificates from system's Java CA certificate bundle
>>> into Keycloak truststore!*
>>> *Setting JGroups discovery to dns.DNS_PING with properties
>>> {dns_query=>bdf-opengie-test.paas.eclair.local}*
>>>
>>> I've checked in the script that handle the TLS import [1], but I'm not
>>> able to guess why the import is failing.
>>>
>>> The following extract is a part of the scripts that is used by the image
>>> to import the cert.
>>> # Import existing system CA certificates into the newly generated
>>> truststore
>>> local SYSTEM_CACERTS=$(readlink -e $(dirname $(readlink -e $(which
>>> keytool)))"/../lib/security/cacerts")
>>> if keytool -v -list -keystore "${SYSTEM_CACERTS}" -storepass "changeit"
>>> > /dev/null; then
>>> echo "Importing certificates from system's Java CA certificate bundle
>>> into Keycloak truststore.."
>>> keytool -importkeystore -noprompt \
>>> -srckeystore "${SYSTEM_CACERTS}" \
>>> -destkeystore "${JKS_TRUSTSTORE_PATH}" \
>>> -srcstoretype jks -deststoretype jks \
>>> -storepass "${PASSWORD}" -srcstorepass "changeit" >& /dev/null
>>> if [ "$?" -ne "0" ]; then
>>> echo "Successfully imported certificates from system's Java CA
>>> certificate bundle into Keycloak truststore at: ${JKS_TRUSTSTORE_PATH}"
>>> else
>>>   echo "Failed to import certificates from system's Java CA certificate
>>> bundle into Keycloak truststore!"
>>> fi
>>>
>>> Any advice?
>>>
>>> [1]=
>>> https://github.com/jboss-dockerfiles/keycloak/blob/master/server/tools/x509.sh
>>>
>>> Meissa
>>>
>>

From slaskawi at redhat.com  Tue Nov 13 03:37:41 2018
From: slaskawi at redhat.com (Sebastian Laskawiec)
Date: Tue, 13 Nov 2018 09:37:41 +0100
Subject: [keycloak-user] setting up TLS(SSL) through the X509_CA_BUNDLE
	environment variable
In-Reply-To: <CAF83W6KQ7nhfMKjMw8TsoS3SkTHBD_-cTZuJoWKW1pGU7UL5OQ@mail.gmail.com>
References: <CAF83W6LNmusLcefhf_RBLJ6t+dSixqNXY+twc0ZQLitqwA9JyA@mail.gmail.com>
	<CAF83W6JEWtjbPhAqBBuQdfs5M0Lb+UymvA+e-=-THjcuGO_7RQ@mail.gmail.com>
	<CAA9R9O4Hyurn-8BbWW=N34fwNWO0D9=4VUYvzVhobMqZn8XkXA@mail.gmail.com>
	<CAF83W6+KGfg_1sE9znqBUmGsQ-7dfkRwkU2O8PhnJCzgEoAOng@mail.gmail.com>
	<CAF83W6KQ7nhfMKjMw8TsoS3SkTHBD_-cTZuJoWKW1pGU7UL5OQ@mail.gmail.com>
Message-ID: <CAA9R9O6Me=Ez7EVRkibaYqKtm+ndfZ8+=JHzyrXs4x_O0V=Mdg@mail.gmail.com>

So the variable you're pointing out is local to the script. Having said
that, you have no access to it from the outside.

I think the proper solution would be to modify Keycloak codebase
(especially Keycloak subsystem) and integrate it with Elytron. Probably +Pedro
Igor Silva <psilva at redhat.com> would be the best person to ask about that.

As for the short-term solution, I guess introducing two optional
environmental variables for storing Keystore and Truststore passwords would
be enough. If those variables were empty, we would generate a new password.
If not, we'd use it for generating JKS files.

Unfortunately adding this feature is not currently on our priority list.
Therefore, I highly encourage you to contribute it. If you plan to do so,
please remember about creating a JIRA for it. I will be more than happy to
review the code once you have something ready.

Thanks,
Sebastian

On Tue, Nov 13, 2018 at 9:14 AM Meissa M'baye Sakho <msakho at redhat.com>
wrote:

> Hello Sebastien,
> Any advice?
> I really need to access trustore password initilized loccally from the
> x509.sh script. (extrcat below)
> local PASSWORD=$(openssl rand -base64 32 2>/dev/null)
> local JKS_KEYSTORE_FILE="${KEYSTORE_TYPE}-keystore.jks
>
> I'm stuck otherwise.
> How can I get access to it?
> Meissa
>
> Le lun. 12 nov. 2018 ? 10:24, Meissa M'baye Sakho <msakho at redhat.com> a
> ?crit :
>
>> Hi Sebastian,
>> That's correct. I can see that my the truststore is created correctly
>> with my CA certificates.
>> I need now to configure the OutGoing HTTPS Request Truststore [3] with
>> the created truststore and the password.
>> The problem is that I can't set the password. I've checked into the
>> x509-truststore.cli [1] and see that it's picked from the
>> $keycloak_tls_truststore_password variable.
>> and created from your x509.sh script [2]
>> I've tried to use the same syntax in my cli below but it fails because
>> the $keycloak_tls_truststore_password is not know from my cli.
>> So Sebastien, do you know how I can get the trsustore password?
>> Is it possible to set it as an environment variable to the docker image?
>>
>>
>> [1]=
>> https://raw.githubusercontent.com/jboss-dockerfiles/keycloak/master/server/tools/cli/x509-truststore.cli
>> [2]=
>> https://raw.githubusercontent.com/jboss-dockerfiles/keycloak/master/server/tools/x509.sh
>> [3]=
>> https://www.keycloak.org/docs/latest/server_installation/index.html#_truststore
>> Thanks,
>> Meissa
>>
>>
>> Le mer. 31 oct. 2018 ? 09:08, Sebastian Laskawiec <slaskawi at redhat.com>
>> a ?crit :
>>
>>> Hey Meissa,
>>>
>>> The warning you see does no harm. As you can see here [1], the message
>>> is being thrown without stopping the script.
>>>
>>> Pulling JDK CAs has been implemented somewhat ahead of time. I asked the
>>> Cloud Enablement (and also other Red Hat teams) to put Kubernetes and
>>> OpenShift CAs into JDK lib directory. This way Keycloak will trust the
>>> OpenShift cluster out of the box. The warning you see clearly indicates
>>> that this feature hasn't been implemented yet.
>>>
>>> So the bottom line - please ignore this error. I'm pretty sure it will
>>> disappear in the future (and if not, I'll just remove or disable this
>>> feature).
>>>
>>> Thanks,
>>> Sebastian
>>>
>>> [1]
>>> https://github.com/jboss-dockerfiles/keycloak/blob/master/server/tools/x509.sh#L88
>>>
>>> On Wed, Oct 31, 2018 at 8:59 AM Meissa M'baye Sakho <msakho at redhat.com>
>>> wrote:
>>>
>>>> Hi Sebastian,
>>>> Do you have any advice in this issue. It's related to the x509.sh
>>>> script and I would really apprecaite an input/help here.
>>>> Meissa
>>>> ---------- Forwarded message ---------
>>>> From: Meissa M'baye Sakho <msakho at redhat.com>
>>>> Date: mar. 30 oct. 2018 ? 17:12
>>>> Subject: setting up TLS(SSL) through the X509_CA_BUNDLE environment
>>>> variable
>>>> To: keycloak-user <keycloak-user at lists.jboss.org>
>>>>
>>>>
>>>> hello everyone,
>>>> I'm using the jboss/keycloak:4.5.0.Final docker image.
>>>> I'm trying to setup Mutual TLS by using the X509_CA_BUNDLE environment
>>>> variable as explained in the Jboss/keycloak docker image documentation.
>>>> I've mounted a volume to the image pointing to the cert file and
>>>> defined the env variable.
>>>> I'm running the image with the following command:
>>>>  *docker run -d --name opengie -e KEYCLOAK_USER=meissa -e
>>>> KEYCLOAK_PASSWORD=meissa \*
>>>> *  -e PROXY_ADDRESS_FORWARDING=true \*
>>>> *  -v /home/centos/docker-opengie/docker-image/staging:/var/run/secrets
>>>> \*
>>>> *  -v
>>>> /home/centos/docker-opengie/docker-image/staging/jks:/etc/x509/https \*
>>>> *  -e JGROUPS_DISCOVERY_PROTOCOL=dns.DNS_PING \*
>>>> *  -e
>>>> JGROUPS_DISCOVERY_PROPERTIES=dns_query=bdf-opengie-test.paas.eclair.local \*
>>>> *  -e X509_CA_BUNDLE=/var/run/secrets/bdf-ca.crt \*
>>>> *  jboss/keycloak:4.5.0.Final*
>>>>
>>>>
>>>> When The container starts, I've checked that the cert has been corectly
>>>> mounted to the expected folder /var/run/secrets
>>>> But I see in the log that the certificat import fails (extract below):
>>>> *Creating HTTPS keystore via OpenShift's service serving x509
>>>> certificate secrets..*
>>>> *HTTPS keystore successfully created at:
>>>> /opt/jboss/keycloak/standalone/configuration/keystores/https-keystore.jks*
>>>> *Creating Keycloak truststore..*
>>>> *Keycloak truststore successfully created at:
>>>> /opt/jboss/keycloak/standalone/configuration/keystores/truststore.jks*
>>>> *Importing certificates from system's Java CA certificate bundle into
>>>> Keycloak truststore..*
>>>> *Failed to import certificates from system's Java CA certificate bundle
>>>> into Keycloak truststore!*
>>>> *Setting JGroups discovery to dns.DNS_PING with properties
>>>> {dns_query=>bdf-opengie-test.paas.eclair.local}*
>>>>
>>>> I've checked in the script that handle the TLS import [1], but I'm not
>>>> able to guess why the import is failing.
>>>>
>>>> The following extract is a part of the scripts that is used by the
>>>> image to import the cert.
>>>> # Import existing system CA certificates into the newly generated
>>>> truststore
>>>> local SYSTEM_CACERTS=$(readlink -e $(dirname $(readlink -e $(which
>>>> keytool)))"/../lib/security/cacerts")
>>>> if keytool -v -list -keystore "${SYSTEM_CACERTS}" -storepass "changeit"
>>>> > /dev/null; then
>>>> echo "Importing certificates from system's Java CA certificate bundle
>>>> into Keycloak truststore.."
>>>> keytool -importkeystore -noprompt \
>>>> -srckeystore "${SYSTEM_CACERTS}" \
>>>> -destkeystore "${JKS_TRUSTSTORE_PATH}" \
>>>> -srcstoretype jks -deststoretype jks \
>>>> -storepass "${PASSWORD}" -srcstorepass "changeit" >& /dev/null
>>>> if [ "$?" -ne "0" ]; then
>>>> echo "Successfully imported certificates from system's Java CA
>>>> certificate bundle into Keycloak truststore at: ${JKS_TRUSTSTORE_PATH}"
>>>> else
>>>>   echo "Failed to import certificates from system's Java CA certificate
>>>> bundle into Keycloak truststore!"
>>>> fi
>>>>
>>>> Any advice?
>>>>
>>>> [1]=
>>>> https://github.com/jboss-dockerfiles/keycloak/blob/master/server/tools/x509.sh
>>>>
>>>> Meissa
>>>>
>>>

From thomas.darimont at googlemail.com  Tue Nov 13 03:42:36 2018
From: thomas.darimont at googlemail.com (Thomas Darimont)
Date: Tue, 13 Nov 2018 09:42:36 +0100
Subject: [keycloak-user] [keycloak-dev] There is already a
	httpSessionManager
In-Reply-To: <F3028D6F-754B-47BB-A90B-A757DF5B382A@gmail.com>
References: <9700A518-4D16-4EEB-A7AC-18B650F0D2C2@gmail.com>
	<F3028D6F-754B-47BB-A90B-A757DF5B382A@gmail.com>
Message-ID: <CAK-7U1hWx9=qKLxhvZRNa0qLbPOvQ-Y26HoFe3k-f0KdYh80wA@mail.gmail.com>

Hello Calixto,

this is more a question for keycloak-user instead of keycloak-dev.

There are some issues with Spring Security and the latest version of the
keycloak spring-boot / spring-security adapter 4.5.0.Final.
You can have a look at the following two examples for a working
configuration.

see:
https://github.com/thomasdarimont/wjax2018-spring-keycloak/tree/master/demos
- spring-boot-2-frontend
- spring-boot-2-backend

The examples are currently using
    <parent>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
        <version>2.0.6.RELEASE</version>
        <relativePath/> <!-- lookup parent from repository -->
    </parent>

but the configuration works as well with

    <parent>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
        <version>2.1.0.RELEASE</version>
        <relativePath/> <!-- lookup parent from repository -->
    </parent>

in combination with the following setting in application.yml /
application.properties:

spring:
  main:
    allow-bean-definition-overriding: true

which seems to be required since Spring Boot 2.1

Cheers,
Thomas

Am Di., 13. Nov. 2018 um 01:18 Uhr schrieb Calixto Mele?n <cmelean at gmail.com
>:

> I?m doing a simple tutorial with SpringBoot 2.1.0 and KeyCloack 4.5.0.
> When I start my app, I am getting the error below. It?s like the session
> manager bean is being registered more than once.
>
> org.springframework.beans.factory.support.BeanDefinitionOverrideException:
> Invalid bean definition with name 'httpSessionManager' defined in class
> path resource [com/example/demo/configuration/SecurityConfig.class]: Cannot
> register bean definition [Root bean: class [null]; scope=; abstract=false;
> lazyInit=false; autowireMode=3; dependencyCheck=0; autowireCandidate=true;
> primary=false; factoryBeanName=securityConfig;
> factoryMethodName=httpSessionManager; initMethodName=null;
> destroyMethodName=(inferred); defined in class path resource
> [com/example/demo/configuration/SecurityConfig.class]] for bean
> 'httpSessionManager': There is already [Generic bean: class
> [org.keycloak.adapters.springsecurity.management.HttpSessionManager];
> scope=singleton; abstract=false; lazyInit=false; autowireMode=0;
> dependencyCheck=0; autowireCandidate=true; primary=false;
> factoryBeanName=null; factoryMethodName=null; initMethodName=null;
> destroyMethodName=null; defined in URL [jar:file:/Users/bigcat/.m!
> 2/repository/org/keycloak/keycloak-spring-security-adapter/4.5.0.Final/keycloak-spring-security-adapter-4.5.0.Final.jar!/org/keycloak/adapters/springsecurity/management/HttpSessionManager.class]]
> bound.
>
> Relevant maven dependencies I have are:
>
> <dependency>
>  <groupId>org.keycloak</groupId>
>  <artifactId>keycloak-spring-boot-starter</artifactId>
>  <version>${keycloak.version}</version>
> </dependency>
>
> <dependency>
>  <groupId>org.springframework.boot</groupId>
>  <artifactId>spring-boot-starter-security</artifactId>
> </dependency>
>
> SecurityConfig.class is:
>
> @KeycloakConfiguration
> public class SecurityConfig extends KeycloakWebSecurityConfigurerAdapter {
>
>   @Bean
>   public KeycloakConfigResolver KeycloakConfigResolver() {
>       return new KeycloakSpringBootConfigResolver();
>   }
>
>   /**
>    * Registers the KeycloakAuthenticationProvider with the authentication
> manager.
>    */
>   @Autowired
>   public void configureGlobal(AuthenticationManagerBuilder auth) throws
> Exception {
>       auth.authenticationProvider(keycloakAuthenticationProvider());
>   }
>
>   /**
>    * Defines the session authentication strategy.
>    */
>   @Bean
>   @Override
>   protected SessionAuthenticationStrategy sessionAuthenticationStrategy() {
>       return new RegisterSessionAuthenticationStrategy(new
> SessionRegistryImpl());
>   }
>
>   @Override
>   protected void configure(HttpSecurity http) throws Exception
>   {
>       super.configure(http);
>       http
>               .authorizeRequests()
>               .antMatchers("/customers*").hasRole("pharmacist")
>               .anyRequest().permitAll();
>   }
> }
>
>
> Appreciate any help. Thanks
>
>
> _______________________________________________
> keycloak-dev mailing list
> keycloak-dev at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-dev

From msakho at redhat.com  Tue Nov 13 03:54:01 2018
From: msakho at redhat.com (Meissa M'baye Sakho)
Date: Tue, 13 Nov 2018 09:54:01 +0100
Subject: [keycloak-user] setting up TLS(SSL) through the X509_CA_BUNDLE
	environment variable
In-Reply-To: <CAA9R9O6Me=Ez7EVRkibaYqKtm+ndfZ8+=JHzyrXs4x_O0V=Mdg@mail.gmail.com>
References: <CAF83W6LNmusLcefhf_RBLJ6t+dSixqNXY+twc0ZQLitqwA9JyA@mail.gmail.com>
	<CAF83W6JEWtjbPhAqBBuQdfs5M0Lb+UymvA+e-=-THjcuGO_7RQ@mail.gmail.com>
	<CAA9R9O4Hyurn-8BbWW=N34fwNWO0D9=4VUYvzVhobMqZn8XkXA@mail.gmail.com>
	<CAF83W6+KGfg_1sE9znqBUmGsQ-7dfkRwkU2O8PhnJCzgEoAOng@mail.gmail.com>
	<CAF83W6KQ7nhfMKjMw8TsoS3SkTHBD_-cTZuJoWKW1pGU7UL5OQ@mail.gmail.com>
	<CAA9R9O6Me=Ez7EVRkibaYqKtm+ndfZ8+=JHzyrXs4x_O0V=Mdg@mail.gmail.com>
Message-ID: <CAF83W6LkCobq_B+0LWACtcZxw+Rq1zfZ9rJqU3PKYvae5zu8qA@mail.gmail.com>

Sebastian,
I'm already working for the short term solution.
 I will create a JIRA and let you know when everything is ok.
@Pedro Igor Silva <psilva at redhat.com>  for the wildfly solution, I've
opened a thread in the wildfly forum [0]. No one answered ATM.
I think that it's a feature between wildfly and keycloak. We should be able
to reference a truststore while defining a keycloak SPI [1] with keycloak
4.5 that rely on wildfly 13.
This feature is missing.
 [0] =https://developer.jboss.org/message/986328#986328
 [1]=
https://www.keycloak.org/docs/latest/server_installation/index.html#_truststore
What do you think about that?

thanks,
Meissa


Le mar. 13 nov. 2018 ? 09:37, Sebastian Laskawiec <slaskawi at redhat.com> a
?crit :

> So the variable you're pointing out is local to the script. Having said
> that, you have no access to it from the outside.
>
> I think the proper solution would be to modify Keycloak codebase
> (especially Keycloak subsystem) and integrate it with Elytron. Probably +Pedro
> Igor Silva <psilva at redhat.com> would be the best person to ask about that.
>
> As for the short-term solution, I guess introducing two optional
> environmental variables for storing Keystore and Truststore passwords would
> be enough. If those variables were empty, we would generate a new password.
> If not, we'd use it for generating JKS files.
>
> Unfortunately adding this feature is not currently on our priority list.
> Therefore, I highly encourage you to contribute it. If you plan to do so,
> please remember about creating a JIRA for it. I will be more than happy to
> review the code once you have something ready.
>
> Thanks,
> Sebastian
>
> On Tue, Nov 13, 2018 at 9:14 AM Meissa M'baye Sakho <msakho at redhat.com>
> wrote:
>
>> Hello Sebastien,
>> Any advice?
>> I really need to access trustore password initilized loccally from the
>> x509.sh script. (extrcat below)
>> local PASSWORD=$(openssl rand -base64 32 2>/dev/null)
>> local JKS_KEYSTORE_FILE="${KEYSTORE_TYPE}-keystore.jks
>>
>> I'm stuck otherwise.
>> How can I get access to it?
>> Meissa
>>
>> Le lun. 12 nov. 2018 ? 10:24, Meissa M'baye Sakho <msakho at redhat.com> a
>> ?crit :
>>
>>> Hi Sebastian,
>>> That's correct. I can see that my the truststore is created correctly
>>> with my CA certificates.
>>> I need now to configure the OutGoing HTTPS Request Truststore [3] with
>>> the created truststore and the password.
>>> The problem is that I can't set the password. I've checked into the
>>> x509-truststore.cli [1] and see that it's picked from the
>>> $keycloak_tls_truststore_password variable.
>>> and created from your x509.sh script [2]
>>> I've tried to use the same syntax in my cli below but it fails because
>>> the $keycloak_tls_truststore_password is not know from my cli.
>>> So Sebastien, do you know how I can get the trsustore password?
>>> Is it possible to set it as an environment variable to the docker image?
>>>
>>>
>>> [1]=
>>> https://raw.githubusercontent.com/jboss-dockerfiles/keycloak/master/server/tools/cli/x509-truststore.cli
>>> [2]=
>>> https://raw.githubusercontent.com/jboss-dockerfiles/keycloak/master/server/tools/x509.sh
>>> [3]=
>>> https://www.keycloak.org/docs/latest/server_installation/index.html#_truststore
>>> Thanks,
>>> Meissa
>>>
>>>
>>> Le mer. 31 oct. 2018 ? 09:08, Sebastian Laskawiec <slaskawi at redhat.com>
>>> a ?crit :
>>>
>>>> Hey Meissa,
>>>>
>>>> The warning you see does no harm. As you can see here [1], the message
>>>> is being thrown without stopping the script.
>>>>
>>>> Pulling JDK CAs has been implemented somewhat ahead of time. I asked
>>>> the Cloud Enablement (and also other Red Hat teams) to put Kubernetes and
>>>> OpenShift CAs into JDK lib directory. This way Keycloak will trust the
>>>> OpenShift cluster out of the box. The warning you see clearly indicates
>>>> that this feature hasn't been implemented yet.
>>>>
>>>> So the bottom line - please ignore this error. I'm pretty sure it will
>>>> disappear in the future (and if not, I'll just remove or disable this
>>>> feature).
>>>>
>>>> Thanks,
>>>> Sebastian
>>>>
>>>> [1]
>>>> https://github.com/jboss-dockerfiles/keycloak/blob/master/server/tools/x509.sh#L88
>>>>
>>>> On Wed, Oct 31, 2018 at 8:59 AM Meissa M'baye Sakho <msakho at redhat.com>
>>>> wrote:
>>>>
>>>>> Hi Sebastian,
>>>>> Do you have any advice in this issue. It's related to the x509.sh
>>>>> script and I would really apprecaite an input/help here.
>>>>> Meissa
>>>>> ---------- Forwarded message ---------
>>>>> From: Meissa M'baye Sakho <msakho at redhat.com>
>>>>> Date: mar. 30 oct. 2018 ? 17:12
>>>>> Subject: setting up TLS(SSL) through the X509_CA_BUNDLE environment
>>>>> variable
>>>>> To: keycloak-user <keycloak-user at lists.jboss.org>
>>>>>
>>>>>
>>>>> hello everyone,
>>>>> I'm using the jboss/keycloak:4.5.0.Final docker image.
>>>>> I'm trying to setup Mutual TLS by using the X509_CA_BUNDLE environment
>>>>> variable as explained in the Jboss/keycloak docker image documentation.
>>>>> I've mounted a volume to the image pointing to the cert file and
>>>>> defined the env variable.
>>>>> I'm running the image with the following command:
>>>>>  *docker run -d --name opengie -e KEYCLOAK_USER=meissa -e
>>>>> KEYCLOAK_PASSWORD=meissa \*
>>>>> *  -e PROXY_ADDRESS_FORWARDING=true \*
>>>>> *  -v
>>>>> /home/centos/docker-opengie/docker-image/staging:/var/run/secrets \*
>>>>> *  -v
>>>>> /home/centos/docker-opengie/docker-image/staging/jks:/etc/x509/https \*
>>>>> *  -e JGROUPS_DISCOVERY_PROTOCOL=dns.DNS_PING \*
>>>>> *  -e
>>>>> JGROUPS_DISCOVERY_PROPERTIES=dns_query=bdf-opengie-test.paas.eclair.local \*
>>>>> *  -e X509_CA_BUNDLE=/var/run/secrets/bdf-ca.crt \*
>>>>> *  jboss/keycloak:4.5.0.Final*
>>>>>
>>>>>
>>>>> When The container starts, I've checked that the cert has been
>>>>> corectly mounted to the expected folder /var/run/secrets
>>>>> But I see in the log that the certificat import fails (extract below):
>>>>> *Creating HTTPS keystore via OpenShift's service serving x509
>>>>> certificate secrets..*
>>>>> *HTTPS keystore successfully created at:
>>>>> /opt/jboss/keycloak/standalone/configuration/keystores/https-keystore.jks*
>>>>> *Creating Keycloak truststore..*
>>>>> *Keycloak truststore successfully created at:
>>>>> /opt/jboss/keycloak/standalone/configuration/keystores/truststore.jks*
>>>>> *Importing certificates from system's Java CA certificate bundle into
>>>>> Keycloak truststore..*
>>>>> *Failed to import certificates from system's Java CA certificate
>>>>> bundle into Keycloak truststore!*
>>>>> *Setting JGroups discovery to dns.DNS_PING with properties
>>>>> {dns_query=>bdf-opengie-test.paas.eclair.local}*
>>>>>
>>>>> I've checked in the script that handle the TLS import [1], but I'm not
>>>>> able to guess why the import is failing.
>>>>>
>>>>> The following extract is a part of the scripts that is used by the
>>>>> image to import the cert.
>>>>> # Import existing system CA certificates into the newly generated
>>>>> truststore
>>>>> local SYSTEM_CACERTS=$(readlink -e $(dirname $(readlink -e $(which
>>>>> keytool)))"/../lib/security/cacerts")
>>>>> if keytool -v -list -keystore "${SYSTEM_CACERTS}" -storepass
>>>>> "changeit" > /dev/null; then
>>>>> echo "Importing certificates from system's Java CA certificate bundle
>>>>> into Keycloak truststore.."
>>>>> keytool -importkeystore -noprompt \
>>>>> -srckeystore "${SYSTEM_CACERTS}" \
>>>>> -destkeystore "${JKS_TRUSTSTORE_PATH}" \
>>>>> -srcstoretype jks -deststoretype jks \
>>>>> -storepass "${PASSWORD}" -srcstorepass "changeit" >& /dev/null
>>>>> if [ "$?" -ne "0" ]; then
>>>>> echo "Successfully imported certificates from system's Java CA
>>>>> certificate bundle into Keycloak truststore at: ${JKS_TRUSTSTORE_PATH}"
>>>>> else
>>>>>   echo "Failed to import certificates from system's Java CA
>>>>> certificate bundle into Keycloak truststore!"
>>>>> fi
>>>>>
>>>>> Any advice?
>>>>>
>>>>> [1]=
>>>>> https://github.com/jboss-dockerfiles/keycloak/blob/master/server/tools/x509.sh
>>>>>
>>>>> Meissa
>>>>>
>>>>

From lists at merit.unu.edu  Tue Nov 13 04:23:59 2018
From: lists at merit.unu.edu (mj)
Date: Tue, 13 Nov 2018 10:23:59 +0100
Subject: [keycloak-user] SaaS idp brokering
Message-ID: <b41e8da8-5a8e-99da-05ad-76959b65fa07@merit.unu.edu>

Hi,

This question is slightly off-topic, I hope it's allowed to ask here.

We are using keycloak as an IdP, loving it. One of our sister institutes 
is using another (openid connect / saml2 compatible) IdP.

Now a new project: Trying to achieve web SSO across both institutes, for 
several web applications, mostly supporting only one single IdP.

We have made a PoC using keycloak's brokering function, and it worked 
nicely. However, our sister institute prefers a SaaS solution.

I've done my googling, but terminology is confusingly different:
- onelogin  ("trusted IdP")
- okta ("inbound federation")
- gluu ("inbound identity")
and obviously
- keycloak ("IdP brokering") (but not saas)

and I am not even sure that the above solution are really the same as 
keycloak's IdP brokering, and that they would solve our SSO requirement. 
(doing a PoC would be the next step)

So I am asking for recommendations from the guru's here. What are the 
do's and don't for something like this? Perhaps suggestions what to look 
for, what to avoid, what other products to take a look at, etc, etc.

Insights?

Thanks very much in advance, and again: apologies for being a bit 
off-topic, hope not to offend anyone.

MJ

From geoff at opticks.io  Tue Nov 13 08:10:06 2018
From: geoff at opticks.io (Geoffrey Cleaves)
Date: Tue, 13 Nov 2018 14:10:06 +0100
Subject: [keycloak-user] 4.6.0 Final
Message-ID: <CAHzT=q9n54vJAaTj3xv=OeZxgpxycT+OSBB15tredDYUAUDvxg@mail.gmail.com>

Anybody know when 4.6.0 is expected to roll out? I'm waiting for some nice
bug fixes...

From wburns at redhat.com  Tue Nov 13 09:09:28 2018
From: wburns at redhat.com (William Burns)
Date: Tue, 13 Nov 2018 09:09:28 -0500 (EST)
Subject: [keycloak-user] Persist Keycloak session cache into JDBC store,
 no data is written into table
In-Reply-To: <91A1C543-4CFF-4BC6-9A2F-904A2FCB9736@senacor.com>
References: <91A1C543-4CFF-4BC6-9A2F-904A2FCB9736@senacor.com>
Message-ID: <1294229187.68193521.1542118168285.JavaMail.zimbra@redhat.com>

This looks like the same issue I mentioned at [1]. It seems that keycloak is writing to the underlying Infinispan Cache using SKIP_CACHE_STORE flag which is preventing it from writing the entry to any configured store when passivation is configured as false. It seems that Keycloak currently only supports persistence when passivation is true. Unfortunately, a shared store and passivation can have consistency guarantees and as such is no longer a valid configuration with Infinispan 9.4 [2].

[1] http://lists.jboss.org/pipermail/keycloak-user/2018-November/016214.html
[2] https://issues.jboss.org/browse/ISPN-7168

----- Original Message -----
> From: "Cedric R?ck" <Cedric.Roeck at senacor.com>
> To: keycloak-user at lists.jboss.org
> Sent: Monday, November 12, 2018 7:24:40 AM
> Subject: [keycloak-user] Persist Keycloak session cache into JDBC store, no data is written into table
> 
> Hi,
> 
> we are currently trying to persist the in-memory session cache of our
> Keycloak (9.5.0.Final) deployment into a persistent store, preferably JDBC
> based.
> 
> In order to achieve this, we already updated the configuration and ended up
> with this config for the Infinispan subsystem:
> 
> <subsystem xmlns="urn:jboss:domain:infinispan:6.0">
>     <cache-container name="keycloak">
>         <transport lock-timeout="60000"/>
>         <local-cache name="realms">
>             <object-memory size="10000"/>
>         </local-cache>
>         <local-cache name="users">
>             <object-memory size="10000"/>
>         </local-cache>
>         <local-cache name="authorization">
>             <object-memory size="10000"/>
>         </local-cache>
>         <local-cache name="keys">
>             <object-memory size="1000"/>
>             <expiration max-idle="3600000"/>
>         </local-cache>
>         <replicated-cache name="work"/>
>         <distributed-cache name="sessions" statistics-enabled="true"
>         owners="${env.CACHE_OWNERS:1}">
>             <jdbc-store data-source="KeycloakDS" dialect="SQL_SERVER"
>             fetch-state="true" passivation="false" preload="true"
>             purge="false" shared="true" singleton="false">
>                 <property name="dropTableOnExit">
>                     false
>                 </property>
>                 <property name="createTableOnStart">
>                     true
>                 </property>
>                 <table/>
>             </jdbc-store>
>         </distributed-cache>
>         <distributed-cache name="clientSessions" statistics-enabled="true"
>         owners="${env.CACHE_OWNERS:1}"/>
>         <distributed-cache name="authenticationSessions"
>         statistics-enabled="true" owners="${env.CACHE_OWNERS:1}"/>
>         [...]
>     </cache-container>
>     [...]
> </subsystem>
> 
> Even though the table ?ispn_entry_sessions? gets created once Keycloak
> starts, no data is being persisted there. Not after 5min and also not once
> several hours passed. To exclude batch sizes and alike as error cause, our
> test creates 300 users and performs repeated logins for all of them, so
> there should also be enough load on the system.
> 
> Some more details:
> 
>   *   The statistics already show more than 600 cache-loader-misses for the
>   jdbc store, but no successful load.
>   *   Our deployment consists of three Keycloak instances running in
>   Kubernetes pods / docker containers.
>   *   Target JDBC Database is an Azure managed SQL DB / SQL Server
>   *   We can?t see any errors in the logs and also the cache distribution
>   appears to still work amongst all nodes in the cluster.
> 
> 
> If you need more details, log excerpts, the full config, ?, just give me a
> ping.
> 
> What are we missing? Any help is very much appreciated.
> 
> Thanks and kind regards
> Cedric
> 
> Cedric R?ck
> ______________________________
> Senacor Technologies AG
> ?u?ere Cramer-Klett-Str. 21
> 90489 N?rnberg
> 
> M +49 (170) 2274 878
> 
> Cedric.Roeck at senacor.com
> www.senacor.com
> 
> 
> Senacor Technologies Aktiengesellschaft - Sitz: Eschborn - Amtsgericht
> Frankfurt am Main - Reg.-Nr.: HRB 110482
> Vorstand: Matthias Tomann, Marcus Purzer - Aufsichtsratsvorsitzender: Daniel
> Gr?zinger
> 
> Diese E-Mail inklusive Anlagen enth?lt vertrauliche und/oder rechtlich
> gesch?tzte Informationen. Wenn Sie
> nicht der richtige Adressat sind oder diese E-Mail irrt?mlich erhalten,
> informieren Sie bitte den  Absender
> und vernichten Sie diese E-Mail. Das unerlaubte Kopieren sowie die unbefugte
> Weitergabe dieser  E-Mail ist
> nicht gestattet.
> 
> This e-mail including any attachments may contain confidential and/or
> privileged information. If you are
> not the intended recipient (or have received this e-mail in error) please
> notify the sender immediately and
> destroy this e-mail. Any unauthorized copying, disclosure or distribution of
> the materials in this e-mail is
> strictly forbidden.
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user


From nocquidant at gmail.com  Tue Nov 13 10:34:16 2018
From: nocquidant at gmail.com (Nicolas Ocquidant)
Date: Tue, 13 Nov 2018 16:34:16 +0100
Subject: [keycloak-user] Persist Keycloak session cache into JDBC store,
 no data is written into table
In-Reply-To: <91A1C543-4CFF-4BC6-9A2F-904A2FCB9736@senacor.com>
References: <91A1C543-4CFF-4BC6-9A2F-904A2FCB9736@senacor.com>
Message-ID: <CABS93FQKatjPomyjfgLCNRKVTf=34-HZmzoH_aJQhngGNHxCRQ@mail.gmail.com>

Hi Cedric

I experimented the same... For me, the only way to get data in the jdbc
store is to enable passivation in Keycloak.
But then, set shared=false as passivation doesn't play well with shared
stores in Infinispan.

See http://lists.jboss.org/pipermail/keycloak-user/2018-November/016214.html

--nick

Le lun. 12 nov. 2018 ? 13:30, R?ck, Cedric <Cedric.Roeck at senacor.com> a
?crit :

> Hi,
>
> we are currently trying to persist the in-memory session cache of our
> Keycloak (9.5.0.Final) deployment into a persistent store, preferably JDBC
> based.
>
> In order to achieve this, we already updated the configuration and ended
> up with this config for the Infinispan subsystem:
>
> <subsystem xmlns="urn:jboss:domain:infinispan:6.0">
>     <cache-container name="keycloak">
>         <transport lock-timeout="60000"/>
>         <local-cache name="realms">
>             <object-memory size="10000"/>
>         </local-cache>
>         <local-cache name="users">
>             <object-memory size="10000"/>
>         </local-cache>
>         <local-cache name="authorization">
>             <object-memory size="10000"/>
>         </local-cache>
>         <local-cache name="keys">
>             <object-memory size="1000"/>
>             <expiration max-idle="3600000"/>
>         </local-cache>
>         <replicated-cache name="work"/>
>         <distributed-cache name="sessions" statistics-enabled="true"
> owners="${env.CACHE_OWNERS:1}">
>             <jdbc-store data-source="KeycloakDS" dialect="SQL_SERVER"
> fetch-state="true" passivation="false" preload="true" purge="false"
> shared="true" singleton="false">
>                 <property name="dropTableOnExit">
>                     false
>                 </property>
>                 <property name="createTableOnStart">
>                     true
>                 </property>
>                 <table/>
>             </jdbc-store>
>         </distributed-cache>
>         <distributed-cache name="clientSessions" statistics-enabled="true"
> owners="${env.CACHE_OWNERS:1}"/>
>         <distributed-cache name="authenticationSessions"
> statistics-enabled="true" owners="${env.CACHE_OWNERS:1}"/>
>         [...]
>     </cache-container>
>     [...]
> </subsystem>
>
> Even though the table ?ispn_entry_sessions? gets created once Keycloak
> starts, no data is being persisted there. Not after 5min and also not once
> several hours passed. To exclude batch sizes and alike as error cause, our
> test creates 300 users and performs repeated logins for all of them, so
> there should also be enough load on the system.
>
> Some more details:
>
>   *   The statistics already show more than 600 cache-loader-misses for
> the jdbc store, but no successful load.
>   *   Our deployment consists of three Keycloak instances running in
> Kubernetes pods / docker containers.
>   *   Target JDBC Database is an Azure managed SQL DB / SQL Server
>   *   We can?t see any errors in the logs and also the cache distribution
> appears to still work amongst all nodes in the cluster.
>
>
> If you need more details, log excerpts, the full config, ?, just give me a
> ping.
>
> What are we missing? Any help is very much appreciated.
>
> Thanks and kind regards
> Cedric
>
> Cedric R?ck
> ______________________________
> Senacor Technologies AG
> ?u?ere Cramer-Klett-Str. 21
> 90489 N?rnberg
>
> M +49 (170) 2274 878
>
> Cedric.Roeck at senacor.com
> www.senacor.com
>
>
> Senacor Technologies Aktiengesellschaft - Sitz: Eschborn - Amtsgericht
> Frankfurt am Main - Reg.-Nr.: HRB 110482
> Vorstand: Matthias Tomann, Marcus Purzer - Aufsichtsratsvorsitzender:
> Daniel Gr?zinger
>
> Diese E-Mail inklusive Anlagen enth?lt vertrauliche und/oder rechtlich
> gesch?tzte Informationen. Wenn Sie
> nicht der richtige Adressat sind oder diese E-Mail irrt?mlich erhalten,
> informieren Sie bitte den  Absender
> und vernichten Sie diese E-Mail. Das unerlaubte Kopieren sowie die
> unbefugte Weitergabe dieser  E-Mail ist
> nicht gestattet.
>
> This e-mail including any attachments may contain confidential and/or
> privileged information. If you are
> not the intended recipient (or have received this e-mail in error) please
> notify the sender immediately and
> destroy this e-mail. Any unauthorized copying, disclosure or distribution
> of the materials in this e-mail is
> strictly forbidden.
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From vagelis.savvas at gmail.com  Tue Nov 13 12:07:09 2018
From: vagelis.savvas at gmail.com (Vagelis Savvas)
Date: Tue, 13 Nov 2018 19:07:09 +0200
Subject: [keycloak-user] Custom authentication
Message-ID: <92f9ed9f-1adf-4da1-4b5a-4ede725d8c42@gmail.com>

Hello,
I'd like some advice on how to go about implementing the following 
custom authentication scenario:
 ?- A user besides the standard username and password optionally 
provides one more secret in the login screen.
 ?- The secret is associated with a realm role (one to one) by the realm 
admin, and if matched the user is dynamically added to the corresponding 
role.
 ?- If the secret isn't provided the user is normally authenticated and 
gets whatever roles he is assigned, like the default behavior

Of course I would like to avoid implementing an SPI for that :-) but if 
it is not possible to avoid it I'd appreciate any insights and advice.
I admit I haven't carefully read the relevant SPI extension docs yet, 
hoping that there is some way of doing it without an SPI extension.

Cheers,

Vagelis

From zitrone at gmx-topmail.de  Tue Nov 13 14:11:10 2018
From: zitrone at gmx-topmail.de (zitrone at gmx-topmail.de)
Date: Tue, 13 Nov 2018 20:11:10 +0100
Subject: [keycloak-user] Adding attributes during login
In-Reply-To: <1541914268.3830.1.camel@acutus.pro>
References: <1541914268.3830.1.camel@acutus.pro>
Message-ID: <7d9b9737-12f5-a48a-7ead-3355f55c257b@gmx-topmail.de>

Hi,

i'm working on a similar problem. I managed to set up a script 
authenticator and a User Session Note Mapper. Works fine on first 
request (like, on the first try. Thanks for the code!). I send the query 
parameter to the auth endpoint, enter the credentials and get a code. 
The token i get for the code contains the query parameter as a field.

But when i query the auth endpoint a second time, it authenticates via 
cookie. Then it starts the script and the script throws a null pointer 
exception. The problen is, that the "Referer" header is null.

The idea behind the second call is to "update" the session note. Any 
ideas how to get the query parameter in this case? Or why it vanishes in 
the first place?


Regards


From pnowak.pierre at gmail.com  Tue Nov 13 15:41:35 2018
From: pnowak.pierre at gmail.com (Pierre Nowak)
Date: Tue, 13 Nov 2018 21:41:35 +0100
Subject: [keycloak-user] UMA fine grained management in the client itself
Message-ID: <CAHgxc_z5gxX8HBvD=3JUPx2VggeWG20zDe-9OWYgxe-5sUySPA@mail.gmail.com>

Hello,

I have difficulties finding the best way of protecting resources using
Authorization Services or UMA.

Here is the following problem:

user1 creates resource/item/id1
user2 creates resource/item/id2

I want to be able in my nodejs confidential client to:

   1. list users that have access to a specific item  (eg: item/id1)
   2. list all resources a user has access to (not only the ones he has,
   but also the ones other users shared with him)
   3. permit a user to access a resource
   4. remove the access of a user to a resource

I saw in photoz UMA example a nice UI directly in keycloak. I would like to
reproduce this tab directly in my client calling APIs to Keycloak. The
reason is the tab in the account page doesnt give enough functionality for
example if I want to join some detail about the resources that would only
be available in my resource server.

I saw the resource set api and a node package (
https://github.com/proficonf/keycloak-authz) that tries to manage the
resources only
but I can't find APIs that directly handle the 4 steps I just mentioned.

Thanks

From nocquidant at gmail.com  Tue Nov 13 16:02:11 2018
From: nocquidant at gmail.com (Nicolas Ocquidant)
Date: Tue, 13 Nov 2018 22:02:11 +0100
Subject: [keycloak-user] File based cache store migration
Message-ID: <CABS93FQzR=9BMu2ZQB4q1hBy4TH329k9x3X5i8w20UoRyYNdAg@mail.gmail.com>

Hi

When using a file based cache store for sessions, and assuming that I have
millions of sessions in the file I don't want to loose, could Keycloak
helps me migrate this file when upgrading for a new version of Keycloak?

It is serialized data inside, so migration may be difficult that's why I am
asking.

Thanks
--nick

From dt at acutus.pro  Tue Nov 13 17:40:37 2018
From: dt at acutus.pro (Dmitry Telegin)
Date: Wed, 14 Nov 2018 01:40:37 +0300
Subject: [keycloak-user] Adding attributes during login
In-Reply-To: <7d9b9737-12f5-a48a-7ead-3355f55c257b@gmx-topmail.de>
References: <1541914268.3830.1.camel@acutus.pro>
	<7d9b9737-12f5-a48a-7ead-3355f55c257b@gmx-topmail.de>
Message-ID: <1542148837.10365.2.camel@acutus.pro>

Hi, you're welcome,

In the second scenario (cookie-based auth), there is no HTTP redirect, hence your query params are in the actual URL, not in the referer header. You can extract them as follows:

var _foo = httpRequest.uri.queryParameters['foo']);
if (_foo !== null)
  var foo = _foo[0];

Good luck!
Dmitry

On Tue, 2018-11-13 at 20:11 +0100, zitrone at gmx-topmail.de wrote:
> Hi,
> 
> i'm working on a similar problem. I managed to set up a script?
> authenticator and a User Session Note Mapper. Works fine on first?
> request (like, on the first try. Thanks for the code!). I send the query?
> parameter to the auth endpoint, enter the credentials and get a code.?
> The token i get for the code contains the query parameter as a field.
> 
> But when i query the auth endpoint a second time, it authenticates via?
> cookie. Then it starts the script and the script throws a null pointer?
> exception. The problen is, that the "Referer" header is null.
> 
> The idea behind the second call is to "update" the session note. Any?
> ideas how to get the query parameter in this case? Or why it vanishes in?
> the first place?
> 
> 
> Regards
> 
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From dt at acutus.pro  Tue Nov 13 17:54:51 2018
From: dt at acutus.pro (Dmitry Telegin)
Date: Wed, 14 Nov 2018 01:54:51 +0300
Subject: [keycloak-user] Adding attributes during login
In-Reply-To: <CAPVdwjrMsAZ1q25ueyT7odjGQ8N12phFTCVhxQwRKO9bncBONw@mail.gmail.com>
References: <CAPVdwjoF3W8C8xmJmapCNErL-Ey8b+bt4p-g-fe4WhFEeSKhDw@mail.gmail.com>
	<1541879356.3515.1.camel@acutus.pro>
	<CAPVdwjqYaxLiK4MTdupBgtw1W3+AFVWOnwCKRgk5_RHLjiyKhA@mail.gmail.com>
	<1541914268.3830.1.camel@acutus.pro>
	<CAPVdwjp-ajdwm0Ey4M0W-tuDZMMTp91a=jxF8aRc6WP0C2tKxQ@mail.gmail.com>
	<1541980028.2048.1.camel@acutus.pro>
	<CAPVdwjrMsAZ1q25ueyT7odjGQ8N12phFTCVhxQwRKO9bncBONw@mail.gmail.com>
Message-ID: <1542149691.10365.4.camel@acutus.pro>

Hello Craig,

Unfortunately I didn't have time for a full PoC, but here are some ideas that might be helpful.

On Sun, 2018-11-11 at 19:12 -0600, Craig Setera wrote:
> We want to "brand" (color and logo) the user-facing parts of the application based on the partner code.? I think that means:
> 
> - Login theme

I think we have covered this in the previous thread (dynamically branded login). In case your auth flow contains additional steps like optional OTP, and you want to brand them too, you can reuse already populated user session notes.

Use the same technique (extend FreeMarkerLoginFormsProvider and override createCommonAttributes) to obtain partner code from the user session (via authenticationSession field) and push it to Freemarker context via template attributes.

> - Email theme

Similarly, extend FreeMarkerEmailTemplateProvider and override processTemplate() to pass your partner code from authenticationSession to the template attributes.

> - Account theme

This one will be a bit more complex, since FreeMarkerAccountProvider doesn't have authenticationSession field. However, you can use org.keycloak.services.managers.AuthenticationSessionManager to obtain current user session. As the final step, again override processTemplate().

Good luck,
Dmitry

> 
> Craig
> 
> =================================
> Craig Setera
> Chief Technology Officer
> 
> 
> 
> 
> > On Sun, Nov 11, 2018 at 5:47 PM Dmitry Telegin <dt at acutus.pro> wrote:
> > Hi Craig, you're welcome :)
> > 
> > As for "theme engine", in fact there are five types thereof in Keycloak:
> > - Welcome theme
> > - Login theme
> > - Admin console theme
> > - Email theme
> > - Account theme
> > 
> > Which one is most relevant to your problem? And, more generally, what are you trying to achieve?
> > 
> > Cheers,
> > Dmitry
> > 
> > On Sun, 2018-11-11 at 06:56 -0600, Craig Setera wrote:
> > > Wow!? This is great.? Thanks so much.? I will have to give this a try this week and see if I can make it work.? You are correct that this is also the code that we want to use to drive our branding.? Are the session notes or token claims available to the theme engine???
> > >?
> > > =================================
> > > Craig Setera
> > > Chief Technology Officer
> > > 415-324-5861
> > > craig at baseventure.com
> > >?
> > >?
> > >?
> > >?
> > > > > > On Sat, Nov 10, 2018 at 11:31 PM Dmitry Telegin <dt at acutus.pro> wrote:
> > > > Hello Craig,
> > > >?
> > > > Thanks for the explanation, it's pretty clear now. I guess that "partner code" is the same parameter you use to dynamically brand your login themes, right?
> > > >?
> > > > First, you need to extract it from your request parameters. In Keycloak, you can do this with a script authenticator. Things are a bit complicated by the fact that the initial incoming link (protocol/openid-connect/auth) does a POST to another endpoint (login-actions/authenticate), and the script authenticator is able introspect only the second request. Query parameters do not survive POST, but still can be found in the Referer header; therefore, you need to fish them out of there. (NB this will only work unless sending this header is disabled in the browser by a paranoid user :)
> > > >?
> > > > Create it as the last authenticator in the flow and make it "required". It's up to you how to handle the case where there is no "foo" parameter in the initial link.
> > > >?
> > > > ===================================================
> > > > function authenticate(context) {
> > > >?
> > > > ? ? var username = user ? user.username : "anonymous";
> > > >?
> > > > ? ? var uri = new java.net.URI(httpRequest.httpHeaders.getHeaderString("Referer"));
> > > > ? ? LOG.info(uri);
> > > > ? ? var uriInfo = new org.jboss.resteasy.spi.ResteasyUriInfo(uri);
> > > > ? ? var _foo = uriInfo.queryParameters['foo'];
> > > > ? ? if (_foo !== null ){
> > > > ? ? ? ? var foo = _foo[0]; // uriInfo.queryParameters is a multivalued map
> > > > ? ? ? ? LOG.info(script.name + ": " + username + " foo=" + foo);
> > > > ? ? ? ? authenticationSession.setUserSessionNote("foo", foo);
> > > > ? ? }
> > > >?
> > > > ? ? context.success();
> > > >?
> > > > }
> > > > ===================================================
> > > >?
> > > > (Quick remark on terminology: in Keycloak's terms, "attributes" are persistent pieces of data attached to a user, group or realm; you can find them in the corresponding GUI tabs. Transient data is called "[session] notes".)
> > > >?
> > > > Next, you will need to propagate it to the tokens. Again, JavaScript to the rescue, this time in the form of script mapper (client -> Mappers):
> > > >?
> > > > ===================================================
> > > > var foo = userSession.notes["foo"];
> > > >?
> > > > if (foo !== null) {
> > > > ? token.setOtherClaims("foo", foo);? ??
> > > > }
> > > > ===================================================
> > > >?
> > > > And voil?, your query parameter is now in the tokens :)
> > > >?
> > > > Good luck!
> > > > Dmitry Telegin
> > > > CTO, Acutus s.r.o.
> > > > Keycloak Consulting and Training
> > > >?
> > > > Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
> > > > +42 (022) 888-30-71
> > > > E-mail: info at acutus.pro
> > > >?
> > > > On Sat, 2018-11-10 at 14:01 -0600, Craig Setera wrote:
> > > > > Dmitry,
> > > > >?
> > > > > Thanks for responding and sorry for not being more clear.??
> > > > >?
> > > > > The circumstance is that a username may be associated with multiple different companies in our system.? However, if the user is logging in from a link that originated from company X, we want to limit what they are authorized to view based on the incoming link to preserve the view of separate tenancy.? So, the partner code is provided (hidden) for each login.? The hope would be that it would be part of the initial login URL as a query parameter, be captured in Keycloak and then made available throughout the "session" associated with the access/refresh tokens.
> > > > >?
> > > > > Thanks!
> > > > > Craig
> > > > >?
> > > > >?
> > > > > =================================
> > > > > Craig Setera
> > > > > Chief Technology Officer
> > > > > 415-324-5861
> > > > > craig at baseventure.com
> > > > >?
> > > > >?
> > > > >?
> > > > >?
> > > > > > > > On Sat, Nov 10, 2018 at 1:49 PM Dmitry Telegin <dt at acutus.pro> wrote:
> > > > > > Hell Craig,
> > > > > >?
> > > > > > Do you mean the user should enter a "partner code" along with login+password? (either as a 3rd field or in a separate screen)
> > > > > > Or only once during registration / upon the first login?
> > > > > >?
> > > > > > Cheers,
> > > > > > Dmitry Telegin
> > > > > > CTO, Acutus s.r.o.
> > > > > > Keycloak Consulting and Training
> > > > > >?
> > > > > > Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
> > > > > > +42 (022) 888-30-71
> > > > > > > > > > > > E-mail: info at acutus.pro?
> > > > > >?
> > > > > > On Sat, 2018-11-10 at 09:00 -0600, Craig Setera wrote:
> > > > > > > We have an attribute we use to allow customers to to "scope" or "namespace"
> > > > > > > a users interaction with our system (a "partner code" that is known to our
> > > > > > > system).??In our previous proprietary Java session-based security system,
> > > > > > > this value was stored in the Java session at the time of login and used by
> > > > > > > the authorization engine to further restrict what the user was allowed to
> > > > > > > see.
> > > > > > >?
> > > > > > > As we transition to using Keycloak for authentication, I'm wondering if
> > > > > > > there is a way to use Keycloak to manage this partner code during a login
> > > > > > > session???Some way to send the value during the Keycloak login sequence and
> > > > > > > then later retrieve it based on the access token?
> > > > > > >?
> > > > > > > Thanks for any insights.
> > > > > > > Craig
> > > > > > >?
> > > > > > > =================================
> > > > > > > *Craig Setera*
> > > > > > >?
> > > > > > > *Chief Technology Officer*
> > > > > > > _______________________________________________
> > > > > > > keycloak-user mailing list
> > > > > > > keycloak-user at lists.jboss.org
> > > > > > > https://lists.jboss.org/mailman/listinfo/keycloak-user
> > > > > >?
> > > >?
> > 

From craig at baseventure.com  Tue Nov 13 18:07:25 2018
From: craig at baseventure.com (Craig Setera)
Date: Tue, 13 Nov 2018 17:07:25 -0600
Subject: [keycloak-user] Adding attributes during login
In-Reply-To: <1542149691.10365.4.camel@acutus.pro>
References: <CAPVdwjoF3W8C8xmJmapCNErL-Ey8b+bt4p-g-fe4WhFEeSKhDw@mail.gmail.com>
	<1541879356.3515.1.camel@acutus.pro>
	<CAPVdwjqYaxLiK4MTdupBgtw1W3+AFVWOnwCKRgk5_RHLjiyKhA@mail.gmail.com>
	<1541914268.3830.1.camel@acutus.pro>
	<CAPVdwjp-ajdwm0Ey4M0W-tuDZMMTp91a=jxF8aRc6WP0C2tKxQ@mail.gmail.com>
	<1541980028.2048.1.camel@acutus.pro>
	<CAPVdwjrMsAZ1q25ueyT7odjGQ8N12phFTCVhxQwRKO9bncBONw@mail.gmail.com>
	<1542149691.10365.4.camel@acutus.pro>
Message-ID: <CAPVdwjpwZRcTVOe5dHRS-z=M=mPib4o-giOQD_82RJm40x9O1w@mail.gmail.com>

Dmitry,

Thanks again for the various pointers.  I'd like to believe that you've
given me more than enough threads to pull on.    Much appreciated!

Craig

=================================
*Craig Setera*

*Chief Technology Officer*




On Tue, Nov 13, 2018 at 4:55 PM Dmitry Telegin <dt at acutus.pro> wrote:

> Hello Craig,
>
> Unfortunately I didn't have time for a full PoC, but here are some ideas
> that might be helpful.
>
> On Sun, 2018-11-11 at 19:12 -0600, Craig Setera wrote:
> > We want to "brand" (color and logo) the user-facing parts of the
> application based on the partner code.  I think that means:
> >
> > - Login theme
>
> I think we have covered this in the previous thread (dynamically branded
> login). In case your auth flow contains additional steps like optional OTP,
> and you want to brand them too, you can reuse already populated user
> session notes.
>
> Use the same technique (extend FreeMarkerLoginFormsProvider and override
> createCommonAttributes) to obtain partner code from the user session (via
> authenticationSession field) and push it to Freemarker context via template
> attributes.
>
> > - Email theme
>
> Similarly, extend FreeMarkerEmailTemplateProvider and override
> processTemplate() to pass your partner code from authenticationSession to
> the template attributes.
>
> > - Account theme
>
> This one will be a bit more complex, since FreeMarkerAccountProvider
> doesn't have authenticationSession field. However, you can use
> org.keycloak.services.managers.AuthenticationSessionManager to obtain
> current user session. As the final step, again override processTemplate().
>
> Good luck,
> Dmitry
>
> >
> > Craig
> >
> > =================================
> > Craig Setera
> > Chief Technology Officer
> >
> >
> >
> >
> > > On Sun, Nov 11, 2018 at 5:47 PM Dmitry Telegin <dt at acutus.pro> wrote:
> > > Hi Craig, you're welcome :)
> > >
> > > As for "theme engine", in fact there are five types thereof in
> Keycloak:
> > > - Welcome theme
> > > - Login theme
> > > - Admin console theme
> > > - Email theme
> > > - Account theme
> > >
> > > Which one is most relevant to your problem? And, more generally, what
> are you trying to achieve?
> > >
> > > Cheers,
> > > Dmitry
> > >
> > > On Sun, 2018-11-11 at 06:56 -0600, Craig Setera wrote:
> > > > Wow!  This is great.  Thanks so much.  I will have to give this a
> try this week and see if I can make it work.  You are correct that this is
> also the code that we want to use to drive our branding.  Are the session
> notes or token claims available to the theme engine?
> > > >
> > > > =================================
> > > > Craig Setera
> > > > Chief Technology Officer
> > > > 415-324-5861
> > > > craig at baseventure.com
> > > >
> > > >
> > > >
> > > >
> > > > > > > On Sat, Nov 10, 2018 at 11:31 PM Dmitry Telegin <dt at acutus.pro>
> wrote:
> > > > > Hello Craig,
> > > > >
> > > > > Thanks for the explanation, it's pretty clear now. I guess that
> "partner code" is the same parameter you use to dynamically brand your
> login themes, right?
> > > > >
> > > > > First, you need to extract it from your request parameters. In
> Keycloak, you can do this with a script authenticator. Things are a bit
> complicated by the fact that the initial incoming link
> (protocol/openid-connect/auth) does a POST to another endpoint
> (login-actions/authenticate), and the script authenticator is able
> introspect only the second request. Query parameters do not survive POST,
> but still can be found in the Referer header; therefore, you need to fish
> them out of there. (NB this will only work unless sending this header is
> disabled in the browser by a paranoid user :)
> > > > >
> > > > > Create it as the last authenticator in the flow and make it
> "required". It's up to you how to handle the case where there is no "foo"
> parameter in the initial link.
> > > > >
> > > > > ===================================================
> > > > > function authenticate(context) {
> > > > >
> > > > >     var username = user ? user.username : "anonymous";
> > > > >
> > > > >     var uri = new
> java.net.URI(httpRequest.httpHeaders.getHeaderString("Referer"));
> > > > >     LOG.info(uri);
> > > > >     var uriInfo = new org.jboss.resteasy.spi.ResteasyUriInfo(uri);
> > > > >     var _foo = uriInfo.queryParameters['foo'];
> > > > >     if (_foo !== null ){
> > > > >         var foo = _foo[0]; // uriInfo.queryParameters is a
> multivalued map
> > > > >         LOG.info(script.name + ": " + username + " foo=" + foo);
> > > > >         authenticationSession.setUserSessionNote("foo", foo);
> > > > >     }
> > > > >
> > > > >     context.success();
> > > > >
> > > > > }
> > > > > ===================================================
> > > > >
> > > > > (Quick remark on terminology: in Keycloak's terms, "attributes"
> are persistent pieces of data attached to a user, group or realm; you can
> find them in the corresponding GUI tabs. Transient data is called
> "[session] notes".)
> > > > >
> > > > > Next, you will need to propagate it to the tokens. Again,
> JavaScript to the rescue, this time in the form of script mapper (client ->
> Mappers):
> > > > >
> > > > > ===================================================
> > > > > var foo = userSession.notes["foo"];
> > > > >
> > > > > if (foo !== null) {
> > > > >   token.setOtherClaims("foo", foo);
> > > > > }
> > > > > ===================================================
> > > > >
> > > > > And voil?, your query parameter is now in the tokens :)
> > > > >
> > > > > Good luck!
> > > > > Dmitry Telegin
> > > > > CTO, Acutus s.r.o.
> > > > > Keycloak Consulting and Training
> > > > >
> > > > > Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
> > > > > +42 (022) 888-30-71
> > > > > E-mail: info at acutus.pro
> > > > >
> > > > > On Sat, 2018-11-10 at 14:01 -0600, Craig Setera wrote:
> > > > > > Dmitry,
> > > > > >
> > > > > > Thanks for responding and sorry for not being more clear.
> > > > > >
> > > > > > The circumstance is that a username may be associated with
> multiple different companies in our system.  However, if the user is
> logging in from a link that originated from company X, we want to limit
> what they are authorized to view based on the incoming link to preserve the
> view of separate tenancy.  So, the partner code is provided (hidden) for
> each login.  The hope would be that it would be part of the initial login
> URL as a query parameter, be captured in Keycloak and then made available
> throughout the "session" associated with the access/refresh tokens.
> > > > > >
> > > > > > Thanks!
> > > > > > Craig
> > > > > >
> > > > > >
> > > > > > =================================
> > > > > > Craig Setera
> > > > > > Chief Technology Officer
> > > > > > 415-324-5861
> > > > > > craig at baseventure.com
> > > > > >
> > > > > >
> > > > > >
> > > > > >
> > > > > > > > > On Sat, Nov 10, 2018 at 1:49 PM Dmitry Telegin <
> dt at acutus.pro> wrote:
> > > > > > > Hell Craig,
> > > > > > >
> > > > > > > Do you mean the user should enter a "partner code" along with
> login+password? (either as a 3rd field or in a separate screen)
> > > > > > > Or only once during registration / upon the first login?
> > > > > > >
> > > > > > > Cheers,
> > > > > > > Dmitry Telegin
> > > > > > > CTO, Acutus s.r.o.
> > > > > > > Keycloak Consulting and Training
> > > > > > >
> > > > > > > Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
> > > > > > > +42 (022) 888-30-71
> > > > > > > > > > > > > E-mail: info at acutus.pro
> > > > > > >
> > > > > > > On Sat, 2018-11-10 at 09:00 -0600, Craig Setera wrote:
> > > > > > > > We have an attribute we use to allow customers to to "scope"
> or "namespace"
> > > > > > > > a users interaction with our system (a "partner code" that
> is known to our
> > > > > > > > system).  In our previous proprietary Java session-based
> security system,
> > > > > > > > this value was stored in the Java session at the time of
> login and used by
> > > > > > > > the authorization engine to further restrict what the user
> was allowed to
> > > > > > > > see.
> > > > > > > >
> > > > > > > > As we transition to using Keycloak for authentication, I'm
> wondering if
> > > > > > > > there is a way to use Keycloak to manage this partner code
> during a login
> > > > > > > > session?  Some way to send the value during the Keycloak
> login sequence and
> > > > > > > > then later retrieve it based on the access token?
> > > > > > > >
> > > > > > > > Thanks for any insights.
> > > > > > > > Craig
> > > > > > > >
> > > > > > > > =================================
> > > > > > > > *Craig Setera*
> > > > > > > >
> > > > > > > > *Chief Technology Officer*
> > > > > > > > _______________________________________________
> > > > > > > > keycloak-user mailing list
> > > > > > > > keycloak-user at lists.jboss.org
> > > > > > > > https://lists.jboss.org/mailman/listinfo/keycloak-user
> > > > > > >
> > > > >
> > >
>

From marco.lamina at sap.com  Tue Nov 13 18:44:20 2018
From: marco.lamina at sap.com (Lamina, Marco)
Date: Tue, 13 Nov 2018 23:44:20 +0000
Subject: [keycloak-user] Unspecified behavior of token endpoint when
	obtaining permissions
Message-ID: <93622CAC-1CFE-48C6-9CC3-D2AD9047CF1A@sap.com>

Hi,
I am trying to use Keycloak?s token endpoint to obtain a list of all resources and the respective scopes that a user has permission to access. However, the behavior I am observing does not match what is described in the documentation (Link [1]). I am using the token endpoint as shown in Link [2].

Expected behavior:
Token endpoint returns a list of all resources and scopes that the token?s user has permission to access.

Observed behavior:
Token endpoint only returns resources that are owned by either the token?s user or the resource server itself. Resources owned by other users are not listed, even though the token?s user has permission to access them.

Is that a bug or expected behavior?

Links:

[1] https://www.keycloak.org/docs/latest/authorization_services/index.html#_service_obtaining_permissions
[2] https://issues.jboss.org/browse/KEYCLOAK-8768?focusedCommentId=13658545&page=com.atlassian.jira.plugin.system.issuetabpanels%3Acomment-tabpanel#comment-13658545

Thanks,
Marco


From dt at acutus.pro  Tue Nov 13 22:02:21 2018
From: dt at acutus.pro (Dmitry Telegin)
Date: Wed, 14 Nov 2018 06:02:21 +0300
Subject: [keycloak-user] Custom authentication
In-Reply-To: <92f9ed9f-1adf-4da1-4b5a-4ede725d8c42@gmail.com>
References: <92f9ed9f-1adf-4da1-4b5a-4ede725d8c42@gmail.com>
Message-ID: <1542164541.10365.6.camel@acutus.pro>

Hello Vagelis,

Here's the outline of the solution as I see it:
- you'll need a custom authenticator, this could be either Script authenticator or Java-based one (Authentication SPI [1]);
- you'll need to modify or supply your own login page. The easiest way is to use Theme Resource JAR [2];
- next, you need to decide how would you store role secrets. I'd recommend to use the same mechanism Keycloak uses to store passwords and private keys, namely Credentials (see org.keycloak.credential.*);
- then, you should establish 1-to-1 association between roles and secrets. You can use CredentialAttributeEntity (CREDENTIAL_ATTRIBUTE table) for that;
- or maybe better introduce your own entity [3] for that association, because CREDENTIAL_ATTRIBUTE.VALUE doesn't have index, therefore queries will be slow;
- finally, you need a mechanism to manage your role secrets. If you want to use Admin console GUI for that, you'll need to implement a REST endpoint [3] and your custom GUI theme [4]. 

So probably you'll end up with 2-3 providers and a theme, packaged in a single JAR. As always, I'd recommend my BeerCloak project [6] as a reference, since it contains many of the above.

Feel free to ask questions, and good luck!
Dmitry Telegin
CTO, Acutus s.r.o.
Keycloak Consulting and Training

Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
+42 (022) 888-30-71
E-mail: info at acutus.pro

[1] https://www.keycloak.org/docs/latest/server_development/index.html#_auth_spi
[2] https://www.keycloak.org/docs/latest/server_development/index.html#_theme_resource
[3] https://www.keycloak.org/docs/latest/server_development/index.html#_extensions_jpa
[4] https://www.keycloak.org/docs/latest/server_development/index.html#_extensions_rest
[5] https://www.keycloak.org/docs/latest/server_development/index.html#_themes
[6] https://github.com/dteleguin/beercloak

On Tue, 2018-11-13 at 19:07 +0200, Vagelis Savvas wrote:
> Hello,
> I'd like some advice on how to go about implementing the following?
> custom authentication scenario:
> ??- A user besides the standard username and password optionally?
> provides one more secret in the login screen.
> ??- The secret is associated with a realm role (one to one) by the realm?
> admin, and if matched the user is dynamically added to the corresponding?
> role.
> ??- If the secret isn't provided the user is normally authenticated and?
> gets whatever roles he is assigned, like the default behavior
> 
> Of course I would like to avoid implementing an SPI for that :-) but if?
> it is not possible to avoid it I'd appreciate any insights and advice.
> I admit I haven't carefully read the relevant SPI extension docs yet,?
> hoping that there is some way of doing it without an SPI extension.
> 
> Cheers,
> 
> Vagelis
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From dt at acutus.pro  Tue Nov 13 22:15:06 2018
From: dt at acutus.pro (Dmitry Telegin)
Date: Wed, 14 Nov 2018 06:15:06 +0300
Subject: [keycloak-user] SaaS idp brokering
In-Reply-To: <b41e8da8-5a8e-99da-05ad-76959b65fa07@merit.unu.edu>
References: <b41e8da8-5a8e-99da-05ad-76959b65fa07@merit.unu.edu>
Message-ID: <1542165306.10365.8.camel@acutus.pro>

Hello MJ,

Quick question: do you plan to decommission both your Keycloak and sister institute's IdP, and migrate everything to a SaaS IdP? Or you want both your IdPs broker to SaaS? Or is your sister institute going to migrate to SaaS IdP, and you have to broker to it from your Keycloak?

All the options are viable and will do the job. As always, each has benefits and drawbacks.

Cheers,
Dmitry Telegin
CTO, Acutus s.r.o.
Keycloak Consulting and Training

Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
+42 (022) 888-30-71
E-mail: info at acutus.pro

On Tue, 2018-11-13 at 10:23 +0100, mj wrote:
> Hi,
> 
> This question is slightly off-topic, I hope it's allowed to ask here.
> 
> We are using keycloak as an IdP, loving it. One of our sister institutes?
> is using another (openid connect / saml2 compatible) IdP.
> 
> Now a new project: Trying to achieve web SSO across both institutes, for?
> several web applications, mostly supporting only one single IdP.
> 
> We have made a PoC using keycloak's brokering function, and it worked?
> nicely. However, our sister institute prefers a SaaS solution.
> 
> I've done my googling, but terminology is confusingly different:
> - onelogin??("trusted IdP")
> - okta ("inbound federation")
> - gluu ("inbound identity")
> and obviously
> - keycloak ("IdP brokering") (but not saas)
> 
> and I am not even sure that the above solution are really the same as?
> keycloak's IdP brokering, and that they would solve our SSO requirement.?
> (doing a PoC would be the next step)
> 
> So I am asking for recommendations from the guru's here. What are the?
> do's and don't for something like this? Perhaps suggestions what to look?
> for, what to avoid, what other products to take a look at, etc, etc.
> 
> Insights?
> 
> Thanks very much in advance, and again: apologies for being a bit?
> off-topic, hope not to offend anyone.
> 
> MJ
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From dt at acutus.pro  Tue Nov 13 22:31:13 2018
From: dt at acutus.pro (Dmitry Telegin)
Date: Wed, 14 Nov 2018 06:31:13 +0300
Subject: [keycloak-user] Keycloak + Custom AuthenticatorFactory + Spring
 5
In-Reply-To: <000001d47b1e$b980ac40$2c8204c0$@staff.aruba.it>
References: <000001d47b1e$b980ac40$2c8204c0$@staff.aruba.it>
Message-ID: <1542166273.10365.10.camel@acutus.pro>

Hello Tommaso,

Spring framework needs to be initialized before you can use it, including booting IoC container etc. Keycloak itself is a pure Java EE web application; I'm not sure this is possible in principle, let alone it would likely require source code modification.

If you absolutely need to use Spring-based components, I'd recommend to deploy them as a separate WAR/EAR with Spring inside, microservice style, and use some kind of IPC/RPC to call them from your Keycloak providers.

Cheers,
Dmitry Telegin
CTO, Acutus s.r.o.
Keycloak Consulting and Training

Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
+42 (022) 888-30-71
E-mail: info at acutus.pro

On Tue, 2018-11-13 at 08:01 +0100, Tommaso Tamantini wrote:
> Hi to all,
> 
> ?
> 
> I'm trying to develope a custom AuthenticatorFactory with a custom
> Authenticator.
> 
> ?
> 
> I would like to inject my custom Authenticator??as Spring Bean into my
> custom AuthenticatorFactory (because my authenticator should use an existing
> spring library).
> 
> ?
> 
> My authenticator is like:
> 
> ?
> 
> @Component
> 
> public class MyAuthenticator extends AbstractUsernameFormAuthenticator
> implements Authenticator {
> 
> [.]
> 
> ?
> 
> To achieve it, I created an??ApplicationContextAware bean?
> 
> ?
> 
> @Service
> 
> public class BeanUtil implements ApplicationContextAware {
> 
> ?
> 
> ?????private static ApplicationContext applicationContext;
> 
> ?????
> 
> ?????public BeanUtil() {
> 
> ?????}
> 
> ?
> 
> ?????@Override
> 
> ?????public void setApplicationContext(ApplicationContext
> applicationContext) throws BeansException {
> 
> ??????????this.applicationContext = applicationContext;
> 
> ?????}
> 
> ?
> 
> ?????public static Authenticator getAuthenticatorBean() {?
> 
> ??????????return applicationContext.getBean(MyAuthenticator.class);
> 
> ?????}?
> 
> ?
> 
> }
> 
> ?
> 
> My factory is:
> 
> ?
> 
> public class MyAuthenticatorFactory implements AuthenticatorFactory,
> ConfigurableAuthenticatorFactory {
> 
> ?
> 
> ?????public static final String PROVIDER_ID = "aruba-alias-authenticator";
> 
> ?
> 
> ?????public static final String G_RECAPTCHA_RESPONSE =
> "g-recaptcha-response";
> 
> ?????public static final String RECAPTCHA_REFERENCE_CATEGORY = "recaptcha";
> 
> ?????public static final String SITE_KEY = "site.key";
> 
> ?????public static final String NUMBER_KEY = "number.key";
> 
> ?????public static final String SITE_SECRET = "secret";
> 
> ?
> 
> ?????@Override
> 
> ?????public String getId() {
> 
> ??????????return PROVIDER_ID;
> 
> ?????}
> 
> ?
> 
> ?????@Override
> 
> ?????public MyAuthenticator create(KeycloakSession session) {
> 
> ??????????return BeanUtil.AuthenticatorBean();
> 
> ?????}
> 
> ?
> 
> [.]
> 
> ?
> 
> Keycloak starts up correctly.?
> 
> ?
> 
> When I try to use myAuthenticator, i get:?
> 
> ?
> 
> ?
> 
> 16:46:48,484 INFO??[org.jboss.as] (Controller Boot Thread) WFLYSRV0060: Http
> management interface listening on http://0.0.0.0:9990/management
> 
> sia-keycloak | 16:46:48,484 INFO??[org.jboss.as] (Controller Boot Thread)
> WFLYSRV0051: Admin console listening on http://0.0.0.0:9990
> 
> sia-keycloak | 16:46:48,485 INFO??[org.jboss.as] (Controller Boot Thread)
> WFLYSRV0025: Keycloak 4.5.0.Final (WildFly Core 5.0.0.Final) started in
> 23456ms - Started 943 of 1231 services (653 services are lazy, passive or
> on-demand)
> 
> sia-keycloak | 16:47:12,357 WARN??[org.keycloak.services] (default task-3)
> KC-SERVICES0013: Failed authentication: java.lang.NullPointerException
> 
> sia-keycloak |??at
> ...authenticator.alias.BeanUtil.getArubaAliasAuthenticatorBean(BeanUtil.java
> :22)
> 
> sia-keycloak |??at
> ..authenticator.alias.AuthenticatorFactory.create(MyAuthenticatorFactory.jav
> a:35)
> 
> sia-keycloak |??at
> ...authenticator.alias.AuthenticatorFactory.create(MyAuthenticatorFactory.ja
> va:1)
> 
> ?
> 
> ?
> 
> The reason in that the Spring Context is null.?
> 
> ?
> 
> Any idea about how to fix this issue?
> 
> ?
> 
> ?
> 
> Many thanks,?
> 
> Tom
> 
> ?
> 
> ?
> 
> ?
> 
> ?
> 
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From dt at acutus.pro  Tue Nov 13 23:04:49 2018
From: dt at acutus.pro (Dmitry Telegin)
Date: Wed, 14 Nov 2018 07:04:49 +0300
Subject: [keycloak-user] EVENTTYPE for a temporarily disabled user
In-Reply-To: <4dc8e3ce-50da-497a-6db0-c4142beeb756@breust.de>
References: <4dc8e3ce-50da-497a-6db0-c4142beeb756@breust.de>
Message-ID: <1542168289.10365.12.camel@acutus.pro>

Hello Anneke,

I've encountered exactly the same problem about a year ago, also trying to collect custom metrics from Keycloak.

Matter is, all the data layer in Keycloak is accessed through the Infinispan facade. The idea is, if there is no built-in event type in Keycloak, you can still hook directly into the corresponding Infinispan cache and listen for its events. (Thanks Marek Posolda for pointing this out.)

The workflow is roughly the following:
- write a dummy provider (+factory);
- upon startup, use KeycloakSession::getProvider(InfinispanConnectionProvider.class) to retrieve default Infinispan connection;
- get users cache;
- get cache manager;
- call addListener to register your event handler.

Good luck,
Dmitry Telegin
CTO, Acutus s.r.o.
Keycloak Consulting and Training

Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
+42 (022) 888-30-71
E-mail: info at acutus.pro

On Tue, 2018-11-06 at 14:31 +0100, Anneke Breust wrote:
> Hi,
> 
> in context with customized Prometheus metrics I am looking for an Event,?
> which is emitted whenever a user is temporarily disabled (and a?
> counterpart, which is emitted when the disabled user is enabled again).?
> The goal is to be able to monitor the number of currently disabled users?
> as well as how many times in a specific time span a user has been?
> disabled. I looked through the EventTypes here?
> https://www.keycloak.org/docs-api/3.2/javadocs/org/keycloak/events/EventType.html?
> but I didn't find anything useful- did I overlook something?
> 
> 
> Thanks in advance,
> 
> Anneke
> 
> 
> 
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From dt at acutus.pro  Tue Nov 13 23:20:55 2018
From: dt at acutus.pro (Dmitry Telegin)
Date: Wed, 14 Nov 2018 07:20:55 +0300
Subject: [keycloak-user] Notify Keycloak Bearer Clients on Admin Actions
In-Reply-To: <CAOg2aVA8nR3V7cEyMtRDvFPXfsBv4z6AxwmEVq+aSTZREjZHtA@mail.gmail.com>
References: <CAOg2aVA8nR3V7cEyMtRDvFPXfsBv4z6AxwmEVq+aSTZREjZHtA@mail.gmail.com>
Message-ID: <1542169255.10365.14.camel@acutus.pro>

Hello Miguel,

There is no default mechanism to notify clients, so you'll have to implement it yourself.

That shouldn't be that hard, especially given that it's a perfect case for a message-driven solution. I'd suggest that you use Keycloak's builtin ActiveMQ Artemis message broker [1], which supports persistence and message redelivery.

Write your EventListenerProvider, listen for AdminEvents, publish them to MQ and subscribe your clients to it. If your clients are also Java-based, JMS should be your choice. Otherwise, you should be using AMQP directly.

Good luck,
Dmitry Telegin
CTO, Acutus s.r.o.
Keycloak Consulting and Training

Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
+42 (022) 888-30-71
E-mail: info at acutus.pro

[1] http://activemq.apache.org/artemis/

On Tue, 2018-11-06 at 15:27 +0200, Miguel Haber wrote:
> Hi,
> 
> I'm just wondering about one scenario where I'm running:
> 
> - Keycloak server (using it as a user base, and for
> authentication/authorization)
> - 3 resource servers connected to the Keycloak as bearer-only clients
> 
> These resource servers store separate information about users.
> 
> One use case I need to investigate:
> 
> - Keycloak admin logs in, deletes one user that has data in all 3 resource
> servers
> 
> Questions:
> 
> 1) Do the 3 resource servers get notified at the moment in order to purge
> the user data from their DBs?
> 2) What if 1 resource server is offline, does it get notified as soon as it
> goes back online?
> 
> Thanks
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From geoff at opticks.io  Wed Nov 14 02:26:42 2018
From: geoff at opticks.io (Geoffrey Cleaves)
Date: Wed, 14 Nov 2018 08:26:42 +0100
Subject: [keycloak-user] Unspecified behavior of token endpoint when
 obtaining permissions
In-Reply-To: <93622CAC-1CFE-48C6-9CC3-D2AD9047CF1A@sap.com>
References: <93622CAC-1CFE-48C6-9CC3-D2AD9047CF1A@sap.com>
Message-ID: <CAHzT=q8j_NPFHip9yzkHF25HGRQ1hqqDBgtvc_9xsqyzy1JV0w@mail.gmail.com>

Sounds like a bug. I know there is a bug in the policy evaluation code that
can result in some permissions being missed and I understand that it will
be fixed in 4.6.

That being said, when I request all the permissions for the token's owner,
I do get the expected result except for some missing scopes due to said
bug. Are you sure your policies are built correctly? Did you build a policy
granting permissions to resource owners?

On Wed, Nov 14, 2018, 00:52 Lamina, Marco <marco.lamina at sap.com wrote:

> Hi,
> I am trying to use Keycloak?s token endpoint to obtain a list of all
> resources and the respective scopes that a user has permission to access.
> However, the behavior I am observing does not match what is described in
> the documentation (Link [1]). I am using the token endpoint as shown in
> Link [2].
>
> Expected behavior:
> Token endpoint returns a list of all resources and scopes that the token?s
> user has permission to access.
>
> Observed behavior:
> Token endpoint only returns resources that are owned by either the token?s
> user or the resource server itself. Resources owned by other users are not
> listed, even though the token?s user has permission to access them.
>
> Is that a bug or expected behavior?
>
> Links:
>
> [1]
> https://www.keycloak.org/docs/latest/authorization_services/index.html#_service_obtaining_permissions
> [2]
> https://issues.jboss.org/browse/KEYCLOAK-8768?focusedCommentId=13658545&page=com.atlassian.jira.plugin.system.issuetabpanels%3Acomment-tabpanel#comment-13658545
>
> Thanks,
> Marco
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From vagelis.savvas at gmail.com  Wed Nov 14 02:50:41 2018
From: vagelis.savvas at gmail.com (Vagelis Savvas)
Date: Wed, 14 Nov 2018 09:50:41 +0200
Subject: [keycloak-user] Custom authentication
In-Reply-To: <1542164541.10365.6.camel@acutus.pro>
References: <92f9ed9f-1adf-4da1-4b5a-4ede725d8c42@gmail.com>
	<1542164541.10365.6.camel@acutus.pro>
Message-ID: <a675e9c3-1f91-05b6-ba5f-37065c78b9c3@gmail.com>

Thanx alot Dmitry!
Your explanation sounds pretty straightforward , I'll go about 
implementing it soon and keep you up to date with feedback.
Cheers,
Vagelis

On 14/11/2018 05:02, Dmitry Telegin wrote:
> Hello Vagelis,
>
> Here's the outline of the solution as I see it:
> - you'll need a custom authenticator, this could be either Script authenticator or Java-based one (Authentication SPI [1]);
> - you'll need to modify or supply your own login page. The easiest way is to use Theme Resource JAR [2];
> - next, you need to decide how would you store role secrets. I'd recommend to use the same mechanism Keycloak uses to store passwords and private keys, namely Credentials (see org.keycloak.credential.*);
> - then, you should establish 1-to-1 association between roles and secrets. You can use CredentialAttributeEntity (CREDENTIAL_ATTRIBUTE table) for that;
> - or maybe better introduce your own entity [3] for that association, because CREDENTIAL_ATTRIBUTE.VALUE doesn't have index, therefore queries will be slow;
> - finally, you need a mechanism to manage your role secrets. If you want to use Admin console GUI for that, you'll need to implement a REST endpoint [3] and your custom GUI theme [4].
>
> So probably you'll end up with 2-3 providers and a theme, packaged in a single JAR. As always, I'd recommend my BeerCloak project [6] as a reference, since it contains many of the above.
>
> Feel free to ask questions, and good luck!
> Dmitry Telegin
> CTO, Acutus s.r.o.
> Keycloak Consulting and Training
>
> Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
> +42 (022) 888-30-71
> E-mail: info at acutus.pro
>
> [1] https://www.keycloak.org/docs/latest/server_development/index.html#_auth_spi
> [2] https://www.keycloak.org/docs/latest/server_development/index.html#_theme_resource
> [3] https://www.keycloak.org/docs/latest/server_development/index.html#_extensions_jpa
> [4] https://www.keycloak.org/docs/latest/server_development/index.html#_extensions_rest
> [5] https://www.keycloak.org/docs/latest/server_development/index.html#_themes
> [6] https://github.com/dteleguin/beercloak
>
> On Tue, 2018-11-13 at 19:07 +0200, Vagelis Savvas wrote:
>> Hello,
>> I'd like some advice on how to go about implementing the following
>> custom authentication scenario:
>>  ??- A user besides the standard username and password optionally
>> provides one more secret in the login screen.
>>  ??- The secret is associated with a realm role (one to one) by the realm
>> admin, and if matched the user is dynamically added to the corresponding
>> role.
>>  ??- If the secret isn't provided the user is normally authenticated and
>> gets whatever roles he is assigned, like the default behavior
>>
>> Of course I would like to avoid implementing an SPI for that :-) but if
>> it is not possible to avoid it I'd appreciate any insights and advice.
>> I admit I haven't carefully read the relevant SPI extension docs yet,
>> hoping that there is some way of doing it without an SPI extension.
>>
>> Cheers,
>>
>> Vagelis
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user


From Ori.Doolman at amdocs.com  Wed Nov 14 05:36:14 2018
From: Ori.Doolman at amdocs.com (Ori Doolman)
Date: Wed, 14 Nov 2018 10:36:14 +0000
Subject: [keycloak-user] SSO experience
Message-ID: <AM0PR06MB55401025C96174BB7FE8465F92C30@AM0PR06MB5540.eurprd06.prod.outlook.com>

Hi,
I have 2 applications: one is desktop (Windows) and the other one is a web application.
My desktop application performs authentication and login using Keycloak, and getting a JWT Access Token.
My web application is using the Keycloak JS adapter to perform the same.

After I login to my desktop application, is there a way to pass the generated access token to the web application and continue the same session? Or at least have an SSO experience and get another token for the user without the user entering the credentials again?



Maybe I can pass the token and refresh token from desktop application as init parameters to the Keycloak-JS ?
I see the following code is checking if initOptions contains the token:


            function processInit() {
                var callback = parseCallback(window.location.href);

                if (callback) {
                    window.history.replaceState({}, null, callback.newUrl);
                }

                if (callback && callback.valid) {
                    return setupCheckLoginIframe().success(function() {
                        processCallback(callback, initPromise);
                    }).error(function (e) {
                        initPromise.setError();
                    });
                } else if (initOptions) {
                    if (initOptions.token && initOptions.refreshToken) {
                        setToken(initOptions.token, initOptions.refreshToken, initOptions.idToken);






Thanks,

Ori Doolman
Lead Software Architect
Amdocs Optima


[cid:image001.png at 01D2C8DE.BFF33E10]

?Amdocs? email platform is based on a third-party, worldwide, cloud-based system. Any emails sent to Amdocs will be processed and stored using such system and are accessible by third party providers of such system on a limited basis. Your sending of emails to Amdocs evidences your consent to the use of such system and such processing, storing and access?.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.png
Type: image/png
Size: 3506 bytes
Desc: image001.png
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20181114/9f5d0de9/attachment.png 

From hannah.short at cern.ch  Wed Nov 14 06:24:50 2018
From: hannah.short at cern.ch (Hannah Short)
Date: Wed, 14 Nov 2018 11:24:50 +0000
Subject: [keycloak-user] Authenticated Protocol Mapper?
Message-ID: <B838B9AA-27B8-4518-996E-9B006102D083@cern.ch>

Hi, 

I?d like to deploy a custom OIDC Protocol Mapper that is itself a client of Keycloak. Is this possible? 

The objective is for the mapper to be able to call an API that is protected also by Keycloak.

The current approach was for the mapper to use the Client Credentials flow to authenticate, exchange the access token for one for the API client, and use it to call the API. This works OK until I deploy the mapper to Keycloak, where it throws various exceptions and does not seem to attempt the Client Credentials flow.

Any guidance, including alternative approaches, would be appreciated!

Cheers,
Hannah


From psilva at redhat.com  Wed Nov 14 07:03:52 2018
From: psilva at redhat.com (Pedro Igor Silva)
Date: Wed, 14 Nov 2018 10:03:52 -0200
Subject: [keycloak-user] Unspecified behavior of token endpoint when
 obtaining permissions
In-Reply-To: <93622CAC-1CFE-48C6-9CC3-D2AD9047CF1A@sap.com>
References: <93622CAC-1CFE-48C6-9CC3-D2AD9047CF1A@sap.com>
Message-ID: <CAJrcDBdEJAUZexSfSkE+BvZ72Zm5mgsEMkpzHoBkZUbJGDrZ0A@mail.gmail.com>

When asking for *all* permissions a user has, the policy evaluation engine
resolves the resources as follows:

1) Get all resources owned by the user
2) Get all resources owned by the resource server
3) Get all resources granted by another user to the user based on UMA and
permission tickets.

NOTE: when doing an "all" request we don't fetch all resources managed by
the server.

If you are not getting the resources owned by other users is probably
because they were not granted based on permission tickets (UMA flow). I
would suggest you to get the id for one of these resources and send an
authorization request using the resource id to see what you get.

Regards.
Pedro Igor

On Tue, Nov 13, 2018 at 9:50 PM Lamina, Marco <marco.lamina at sap.com> wrote:

> Hi,
> I am trying to use Keycloak?s token endpoint to obtain a list of all
> resources and the respective scopes that a user has permission to access.
> However, the behavior I am observing does not match what is described in
> the documentation (Link [1]). I am using the token endpoint as shown in
> Link [2].
>
> Expected behavior:
> Token endpoint returns a list of all resources and scopes that the token?s
> user has permission to access.
>
> Observed behavior:
> Token endpoint only returns resources that are owned by either the token?s
> user or the resource server itself. Resources owned by other users are not
> listed, even though the token?s user has permission to access them.
>
> Is that a bug or expected behavior?
>
> Links:
>
> [1]
> https://www.keycloak.org/docs/latest/authorization_services/index.html#_service_obtaining_permissions
> [2]
> https://issues.jboss.org/browse/KEYCLOAK-8768?focusedCommentId=13658545&page=com.atlassian.jira.plugin.system.issuetabpanels%3Acomment-tabpanel#comment-13658545
>
> Thanks,
> Marco
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From psilva at redhat.com  Wed Nov 14 07:05:12 2018
From: psilva at redhat.com (Pedro Igor Silva)
Date: Wed, 14 Nov 2018 10:05:12 -0200
Subject: [keycloak-user] Unspecified behavior of token endpoint when
 obtaining permissions
In-Reply-To: <CAHzT=q8j_NPFHip9yzkHF25HGRQ1hqqDBgtvc_9xsqyzy1JV0w@mail.gmail.com>
References: <93622CAC-1CFE-48C6-9CC3-D2AD9047CF1A@sap.com>
	<CAHzT=q8j_NPFHip9yzkHF25HGRQ1hqqDBgtvc_9xsqyzy1JV0w@mail.gmail.com>
Message-ID: <CAJrcDBe1Vr6hisH_88zT0YgMPzKXE7Mb9NKyuAGvDDABqKjE8Q@mail.gmail.com>

+1. However, that issue that was fixed only impact scope-based permissions.

On Wed, Nov 14, 2018 at 5:34 AM Geoffrey Cleaves <geoff at opticks.io> wrote:

> Sounds like a bug. I know there is a bug in the policy evaluation code that
> can result in some permissions being missed and I understand that it will
> be fixed in 4.6.
>
> That being said, when I request all the permissions for the token's owner,
> I do get the expected result except for some missing scopes due to said
> bug. Are you sure your policies are built correctly? Did you build a policy
> granting permissions to resource owners?
>
> On Wed, Nov 14, 2018, 00:52 Lamina, Marco <marco.lamina at sap.com wrote:
>
> > Hi,
> > I am trying to use Keycloak?s token endpoint to obtain a list of all
> > resources and the respective scopes that a user has permission to access.
> > However, the behavior I am observing does not match what is described in
> > the documentation (Link [1]). I am using the token endpoint as shown in
> > Link [2].
> >
> > Expected behavior:
> > Token endpoint returns a list of all resources and scopes that the
> token?s
> > user has permission to access.
> >
> > Observed behavior:
> > Token endpoint only returns resources that are owned by either the
> token?s
> > user or the resource server itself. Resources owned by other users are
> not
> > listed, even though the token?s user has permission to access them.
> >
> > Is that a bug or expected behavior?
> >
> > Links:
> >
> > [1]
> >
> https://www.keycloak.org/docs/latest/authorization_services/index.html#_service_obtaining_permissions
> > [2]
> >
> https://issues.jboss.org/browse/KEYCLOAK-8768?focusedCommentId=13658545&page=com.atlassian.jira.plugin.system.issuetabpanels%3Acomment-tabpanel#comment-13658545
> >
> > Thanks,
> > Marco
> >
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From orwittatibm at gmail.com  Wed Nov 14 07:49:20 2018
From: orwittatibm at gmail.com (Oliver-Rainer Wittmann)
Date: Wed, 14 Nov 2018 13:49:20 +0100
Subject: [keycloak-user] Update user attributes on login
Message-ID: <2C8A4D72-F9FD-4A8D-9F60-1985BA800798@gmail.com>

Hi,

I have a running keycloak with a custom identity provider - corresponding implementation of AbstractOAuth2IdentityProvider

On registration of a user certain user attributes are stored and mapped into the token.
Now, I want to update these user attributes on following logins.

How to do this?
Unfortunately, I did not find a corresponding hint in the documentation.

Thx in advance for your support.

Best regards, Oliver

From SvenErik.Jeroschewski at bosch-si.com  Wed Nov 14 08:51:02 2018
From: SvenErik.Jeroschewski at bosch-si.com (Jeroschewski Sven Erik (INST-CSS/BSV-OS))
Date: Wed, 14 Nov 2018 13:51:02 +0000
Subject: [keycloak-user] UMA 2.0 manage shared access with Rest-API
Message-ID: <6c720e7cbfb94933b5d6a40a618a6635@bosch-si.com>

Hello everyone,

is there an example project or tutorial with UMA 2.0 where the user can give his consent regarding shared access using the Rest-API of Keycloak?

We already had a look at the "app-authz-uma-photoz" project from the "keycloak-quickstarts" repository. However, the example integrates a Keycloak website where the user can manage the requests for her/his resources.  In our application we would like to have a custom service through which the user can manage his/her resources, can get notifications for new requests, and can define rules for permissions that are set automatically when a new resource is created or a new request is coming in.

For example, we have a use case in which an application creates new resources where the user is the resource owner. This resource should be accessible by another user by default or the uploading application should be able to grant access in the name of the resource owner.

We would be glad for any comments and recommendations on our approach.

Mit freundlichen Gr??en / Best regards

Sven Erik Jeroschewski

Open Source Services - Product Group Customer Success Services (INST-CSS/BSV-OS)
Bosch Software Innovations GmbH | Ullsteinstr. 128 | 12109 Berlin | GERMANY | www.bosch-si.com<http://www.bosch-si.com>
Tel. +49 30 726112-416 | Mobil +49 152 24308225 | SvenErik.Jeroschewski at bosch-si.com<mailto:SvenErik.Jeroschewski at bosch-si.com>

Sitz: Berlin, Registergericht: Amtsgericht Charlottenburg; HRB 148411 B
Aufsichtsratsvorsitzender: Dr.-Ing. Thorsten L?cke; Gesch?ftsf?hrung: Dr. Stefan Ferber, Michael Hahn, Dr. Aleksandar Mitrovic




From thesofiane at gmail.com  Wed Nov 14 09:17:50 2018
From: thesofiane at gmail.com (So Be)
Date: Wed, 14 Nov 2018 15:17:50 +0100
Subject: [keycloak-user] Upgrade Keycloak running in Docker
Message-ID: <CACz=5kmWtvfmQ3-QOSdnjA=DUpuPh_d6X6yqUFsf+6VYySaSgg@mail.gmail.com>

Hi,
 I am running keycloak 3 in a docker container. Is it possible to upgrade
to v4 or the to the latest version without pulling new image?
The reason of my question is that I don't want to configure the realms,
clients, etc from scratch.

Do you have an advice for this?
Thank you.

Sofiane.

From thesofiane at gmail.com  Wed Nov 14 09:22:01 2018
From: thesofiane at gmail.com (So Be)
Date: Wed, 14 Nov 2018 15:22:01 +0100
Subject: [keycloak-user] User registration
Message-ID: <CACz=5k=vQJ+b7Vcxi3aFNHXib9iqypNJb1uWHtYxHF81sfOFrw@mail.gmail.com>

I want to enable user registration, it works fine, but after successful
registration (email confirmation, etc), the new user is first redirected to
"account management" and not directly to the client (in my case
JupyterHub).

Is there a solution to avoid users to get the account management page?

Best,

Sofiane.

From stuarta at squashedfrog.net  Wed Nov 14 09:56:55 2018
From: stuarta at squashedfrog.net (Stuart Auchterlonie)
Date: Wed, 14 Nov 2018 14:56:55 +0000
Subject: [keycloak-user] Upgrade Keycloak running in Docker
In-Reply-To: <CACz=5kmWtvfmQ3-QOSdnjA=DUpuPh_d6X6yqUFsf+6VYySaSgg@mail.gmail.com>
References: <CACz=5kmWtvfmQ3-QOSdnjA=DUpuPh_d6X6yqUFsf+6VYySaSgg@mail.gmail.com>
Message-ID: <107c07df-8ee2-5913-d889-0f0a9b2a9db0@squashedfrog.net>

On 14/11/2018 14:17, So Be wrote:
> Hi,
>  I am running keycloak 3 in a docker container. Is it possible to upgrade
> to v4 or the to the latest version without pulling new image?
> The reason of my question is that I don't want to configure the realms,
> clients, etc from scratch.
> 
> Do you have an advice for this?
> Thank you.
> 

I believe you are missing the point. You can't actually upgrade without
pulling the new container.

I'm hoping you are using an external database, and not the default in
built database?

Upgrade procedure should be

- Shutdown currently running container
- Ensure you have a docker tag (other than latest) against the container
you are currently using.
- Backup database
- Pull new image
- Start new image, and it should automatically upgrade the DB to new
version.

For rollback, you can restore the DB, and start the container from
the earlier version tag.


Regards
Stuart


From psilva at redhat.com  Wed Nov 14 10:12:36 2018
From: psilva at redhat.com (Pedro Igor Silva)
Date: Wed, 14 Nov 2018 13:12:36 -0200
Subject: [keycloak-user] UMA 2.0 manage shared access with Rest-API
In-Reply-To: <6c720e7cbfb94933b5d6a40a618a6635@bosch-si.com>
References: <6c720e7cbfb94933b5d6a40a618a6635@bosch-si.com>
Message-ID: <CAJrcDBcpTnW=Pem9bAGZRukCZNx0DiaSDCK+PMA6oWJQicBhUQ@mail.gmail.com>

Hi, building your own service should be fine if you use parts of the API
that we provide.

1) User can manage his/her resources
    Take a look at the Protection API, the Resource Management Endpoint in
particular [1].
2) Notifications and management of authorization requests
    We have an undocumented endpoint that exposes the permission tickets,
which represent authorization requests pending for approval or already
approved by the resource owner. For now, you could take a look at the
app-auths-uma-photoz to check there how we are using this endpoint to fetch
"shared resources" [2].
3) Define rules for permissions that are set automatically when a new
resource is created
    You have some options here. If you have typed resource (owned by the
resource server itself) and a set of permissions associated with this
resource when you create a new user resource (user is the owner, thus it is
considered a resource instance) any permission defined for the typed
resource will be applied to the user resource.
    You can also manage permissions/policies through the Admin REST API,
just like we do in Keycloak admin console.
    For User-Managed resources, you can also use the User-Managed Policy
API [3].

[1]
https://www.keycloak.org/docs/latest/authorization_services/index.html#_service_protection_resources_api
[2]
https://github.com/keycloak/keycloak-quickstarts/blob/latest/app-authz-uma-photoz/photoz-restful-api/src/main/java/org/keycloak/example/photoz/album/AlbumService.java#L101
[3]
https://www.keycloak.org/docs/latest/authorization_services/index.html#_service_authorization_uma_policy_api

Regards.
Pedro Igor

On Wed, Nov 14, 2018 at 12:00 PM Jeroschewski Sven Erik (INST-CSS/BSV-OS) <
SvenErik.Jeroschewski at bosch-si.com> wrote:

> Hello everyone,
>
> is there an example project or tutorial with UMA 2.0 where the user can
> give his consent regarding shared access using the Rest-API of Keycloak?
>
> We already had a look at the "app-authz-uma-photoz" project from the
> "keycloak-quickstarts" repository. However, the example integrates a
> Keycloak website where the user can manage the requests for her/his
> resources.  In our application we would like to have a custom service
> through which the user can manage his/her resources, can get notifications
> for new requests, and can define rules for permissions that are set
> automatically when a new resource is created or a new request is coming in.
>
> For example, we have a use case in which an application creates new
> resources where the user is the resource owner. This resource should be
> accessible by another user by default or the uploading application should
> be able to grant access in the name of the resource owner.
>
> We would be glad for any comments and recommendations on our approach.
>
> Mit freundlichen Gr??en / Best regards
>
> Sven Erik Jeroschewski
>
> Open Source Services - Product Group Customer Success Services
> (INST-CSS/BSV-OS)
> Bosch Software Innovations GmbH | Ullsteinstr. 128 | 12109 Berlin |
> GERMANY | www.bosch-si.com<http://www.bosch-si.com>
> Tel. +49 30 726112-416 | Mobil +49 152 24308225 |
> SvenErik.Jeroschewski at bosch-si.com<mailto:
> SvenErik.Jeroschewski at bosch-si.com>
>
> Sitz: Berlin, Registergericht: Amtsgericht Charlottenburg; HRB 148411 B
> Aufsichtsratsvorsitzender: Dr.-Ing. Thorsten L?cke; Gesch?ftsf?hrung: Dr.
> Stefan Ferber, Michael Hahn, Dr. Aleksandar Mitrovic
>
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

From psilva at redhat.com  Wed Nov 14 10:21:12 2018
From: psilva at redhat.com (Pedro Igor Silva)
Date: Wed, 14 Nov 2018 13:21:12 -0200
Subject: [keycloak-user] UMA fine grained management in the client itself
In-Reply-To: <CAHgxc_z5gxX8HBvD=3JUPx2VggeWG20zDe-9OWYgxe-5sUySPA@mail.gmail.com>
References: <CAHgxc_z5gxX8HBvD=3JUPx2VggeWG20zDe-9OWYgxe-5sUySPA@mail.gmail.com>
Message-ID: <CAJrcDBfytm4V-ntejX=w1ems7ihn+9wsJoUrGgCK5bfbOPHk5Q@mail.gmail.com>

Hi, answers inline. In general, I need to document this endpoint
https://github.com/keycloak/keycloak/blob/5a9bfea419f37267afb656ea4bfce1ff1489384f/services/src/main/java/org/keycloak/authorization/protection/permission/PermissionTicketService.java#L57
.

On Tue, Nov 13, 2018 at 6:56 PM Pierre Nowak <pnowak.pierre at gmail.com>
wrote:

> Hello,
>
> I have difficulties finding the best way of protecting resources using
> Authorization Services or UMA.
>
> Here is the following problem:
>
> user1 creates resource/item/id1
> user2 creates resource/item/id2
>
> I want to be able in my nodejs confidential client to:
>
>    1. list users that have access to a specific item  (eg: item/id1)
>

Being the resource owner, user1 will always have access to item/id1, I
guess. To fetch other users with access to this resource after resource
owner's approval, you can use this example [1].

[1]
https://github.com/keycloak/keycloak-quickstarts/blob/latest/app-authz-uma-photoz/photoz-restful-api/src/main/java/org/keycloak/example/photoz/album/AlbumService.java#L101


>    2. list all resources a user has access to (not only the ones he has,
>    but also the ones other users shared with him)
>

The same as above.


>    3. permit a user to access a resource
>

The same endpoint also allows you to create permission tickets and grant
access to the resource. Best is follow UMA flow though, for privacy reasons.


>    4. remove the access of a user to a resource
>

Same endpoint as above.


>
> I saw in photoz UMA example a nice UI directly in keycloak. I would like to
> reproduce this tab directly in my client calling APIs to Keycloak. The
> reason is the tab in the account page doesnt give enough functionality for
> example if I want to join some detail about the resources that would only
> be available in my resource server.
>
> I saw the resource set api and a node package (
> https://github.com/proficonf/keycloak-authz) that tries to manage the
> resources only
> but I can't find APIs that directly handle the 4 steps I just mentioned.
>
> Thanks
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

From lists at merit.unu.edu  Wed Nov 14 12:37:21 2018
From: lists at merit.unu.edu (lists)
Date: Wed, 14 Nov 2018 18:37:21 +0100
Subject: [keycloak-user] SaaS idp brokering
In-Reply-To: <1542165306.10365.8.camel@acutus.pro>
References: <b41e8da8-5a8e-99da-05ad-76959b65fa07@merit.unu.edu>
	<1542165306.10365.8.camel@acutus.pro>
Message-ID: <7e9acb90-50cb-262d-73c3-421214dc88ac@merit.unu.edu>

Hi Dmitri,

Thanks for your follow-up.

The idea is to both keep our current IdP's, and use an 'umbrella' 
brokering IdP for the applications that need to be shared between the 
two institutes.

It's just the brokering IdP that has to be SaaS.

We also just discovered Ping Identity, making our shortlist:

- PingIdentity
- OneLogin
- okta
- gluu

Anyone here with arguments against / in favour of / experience with one 
of these options?

MJ

On 14-11-2018 4:15, Dmitry Telegin wrote:
> Quick question: do you plan to decommission both your Keycloak and
> sister institute's IdP, and migrate everything to a SaaS IdP? Or you
> want both your IdPs broker to SaaS? Or is your sister institute going
> to migrate to SaaS IdP, and you have to broker to it from your
> Keycloak?

From dt at acutus.pro  Wed Nov 14 12:37:46 2018
From: dt at acutus.pro (Dmitry Telegin)
Date: Wed, 14 Nov 2018 20:37:46 +0300
Subject: [keycloak-user] User registration
In-Reply-To: <CACz=5k=vQJ+b7Vcxi3aFNHXib9iqypNJb1uWHtYxHF81sfOFrw@mail.gmail.com>
References: <CACz=5k=vQJ+b7Vcxi3aFNHXib9iqypNJb1uWHtYxHF81sfOFrw@mail.gmail.com>
Message-ID: <1542217066.2133.1.camel@acutus.pro>

Hello Sofiane,

I've just tested this workflow with Keylcoak 4.5.0:
- try to access a test application secured by Keycloak;
- login screen is shown;
- click Register, complete the process;
- you will be logged in and redirected to the test application.

How exactly do your clients register themselves? If they to go to JupyterHub first, like in the workflow above, at the end they will land right there.

Cheers,
Dmitry Telegin
CTO, Acutus s.r.o.
Keycloak Consulting and Training

Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
+42 (022) 888-30-71
E-mail: info at acutus.pro

On Wed, 2018-11-14 at 15:22 +0100, So Be wrote:
> I want to enable user registration, it works fine, but after successful
> registration (email confirmation, etc), the new user is first redirected to
> "account management" and not directly to the client (in my case
> JupyterHub).
> 
> Is there a solution to avoid users to get the account management page?
> 
> Best,
> 
> Sofiane.
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From dt at acutus.pro  Wed Nov 14 13:02:34 2018
From: dt at acutus.pro (Dmitry Telegin)
Date: Wed, 14 Nov 2018 21:02:34 +0300
Subject: [keycloak-user] Update user attributes on login
In-Reply-To: <2C8A4D72-F9FD-4A8D-9F60-1985BA800798@gmail.com>
References: <2C8A4D72-F9FD-4A8D-9F60-1985BA800798@gmail.com>
Message-ID: <1542218554.2133.3.camel@acutus.pro>

Hello Oliver,

If you mean that very attributes that you can see under user's "Attributes" tab in Admin console, you can use script authenticator to do that:

function authenticate(context) {

    var username = user ? user.username : "anonymous";
    LOG.info(script.name + " trace auth for: " + username);

    if (user) {
      LOG.info(user.attributes.foo); // multivalued map
      // replace existing value
      user.attributes.foo[0] = "bar";
      // or create new attribute
      user.attributes.bar = java.util.ArrayList(['foo', 'bar', 'baz']);
    }

    context.success();

}

Add this as the last step in your flow and make it required. Please note that the attributes are always multivalued in the model. This is not yet implemented in the GUI, but you can use ## to separate multiple values. That said, the value of the "bar" attribute will be seen as "foo##bar##baz" under the Attributes tab.

Good luck,
Dmitry Telegin
CTO, Acutus s.r.o.
Keycloak Consulting and Training

Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
+42 (022) 888-30-71
E-mail: info at acutus.pro

On Wed, 2018-11-14 at 13:49 +0100, Oliver-Rainer Wittmann wrote:
> Hi,
> 
> I have a running keycloak with a custom identity provider - corresponding implementation of AbstractOAuth2IdentityProvider
> 
> On registration of a user certain user attributes are stored and mapped into the token.
> Now, I want to update these user attributes on following logins.
> 
> How to do this?
> Unfortunately, I did not find a corresponding hint in the documentation.
> 
> Thx in advance for your support.
> 
> Best regards, Oliver
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From dt at acutus.pro  Wed Nov 14 13:15:15 2018
From: dt at acutus.pro (Dmitry Telegin)
Date: Wed, 14 Nov 2018 21:15:15 +0300
Subject: [keycloak-user] SaaS idp brokering
In-Reply-To: <7e9acb90-50cb-262d-73c3-421214dc88ac@merit.unu.edu>
References: <b41e8da8-5a8e-99da-05ad-76959b65fa07@merit.unu.edu>
	<1542165306.10365.8.camel@acutus.pro>
	<7e9acb90-50cb-262d-73c3-421214dc88ac@merit.unu.edu>
Message-ID: <1542219315.2133.5.camel@acutus.pro>

Hi, you're welcome,

On Wed, 2018-11-14 at 18:37 +0100, lists wrote:
> Hi Dmitri,
> 
> Thanks for your follow-up.
> 
> The idea is to both keep our current IdP's, and use an 'umbrella'?
> brokering IdP for the applications that need to be shared between the?
> two institutes.
> 
> It's just the brokering IdP that has to be SaaS.

Thanks for the info, it's clear now.

> We also just discovered Ping Identity, making our shortlist:
> 
> - PingIdentity
> - OneLogin
> - okta
> - gluu
> 
> Anyone here with arguments against / in favour of / experience with one?
> of these options?

I used to work with PingIdentity (or rather on-premise PingFederate) and?Okta, using SAML in both cases, and the results were perfect. For Okta, I'd recommend an excellent article by Michael Furman [1]. Michael uses SAML too; don't know if you're going to use SAML or OpenID Connect, but in the latter case the process should be similar. Please read this [2] on the protocol choice.

NB you can use whatever combination of protocols you like (OIDC at Keycloak + SAML at Saas IdP or vice versa), but probably unless you're seriously considering IdP-initiated login. In that case, things work more smoothly with pure SAML.

Cheers,
Dmitry Telegin
CTO, Acutus s.r.o.
Keycloak Consulting and Training

Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
+42 (022) 888-30-71
E-mail: info at acutus.pro

[1] https://ultimatesecurity.pro/post/okta-saml/
[2] https://www.keycloak.org/docs/latest/securing_apps/index.html#openid-connect-vs-saml

> 
> MJ
> 
> On 14-11-2018 4:15, Dmitry Telegin wrote:
> > Quick question: do you plan to decommission both your Keycloak and
> > sister institute's IdP, and migrate everything to a SaaS IdP? Or you
> > want both your IdPs broker to SaaS? Or is your sister institute going
> > to migrate to SaaS IdP, and you have to broker to it from your
> > Keycloak?

From dt at acutus.pro  Wed Nov 14 13:27:41 2018
From: dt at acutus.pro (Dmitry Telegin)
Date: Wed, 14 Nov 2018 21:27:41 +0300
Subject: [keycloak-user] Authenticated Protocol Mapper?
In-Reply-To: <B838B9AA-27B8-4518-996E-9B006102D083@cern.ch>
References: <B838B9AA-27B8-4518-996E-9B006102D083@cern.ch>
Message-ID: <1542220061.2133.7.camel@acutus.pro>

Hello Hannah,

Just to make it clear: is your API secured by the same Keycloak instance? does it belong to the same realm?

If so, this is probably a use case for offline tokens and/or impersonation. The idea is, the mapper is executed with Keycloak's privileges, hence no need to perform "honest" authentication; you can in fact produce any token you need to act on behalf of another identity.

However, I'd also suggest that you try to "short-circuit" the whole operation, maybe with the help of RMI/RPC. Is that possible? REST has more overhead, which can come to the fore under high load.

Cheers,
Dmitry Telegin
CTO, Acutus s.r.o.
Keycloak Consulting and Training

Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
+42 (022) 888-30-71
E-mail: info at acutus.pro

On Wed, 2018-11-14 at 11:24 +0000, Hannah Short wrote:
> Hi,?
> 
> I?d like to deploy a custom OIDC Protocol Mapper that is itself a client of Keycloak. Is this possible??
> 
> The objective is for the mapper to be able to call an API that is protected also by Keycloak.
> 
> The current approach was for the mapper to use the Client Credentials flow to authenticate, exchange the access token for one for the API client, and use it to call the API. This works OK until I deploy the mapper to Keycloak, where it throws various exceptions and does not seem to attempt the Client Credentials flow.
> 
> Any guidance, including alternative approaches, would be appreciated!
> 
> Cheers,
> Hannah
> 
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From dt at acutus.pro  Wed Nov 14 13:34:23 2018
From: dt at acutus.pro (Dmitry Telegin)
Date: Wed, 14 Nov 2018 21:34:23 +0300
Subject: [keycloak-user] SSO experience
In-Reply-To: <AM0PR06MB55401025C96174BB7FE8465F92C30@AM0PR06MB5540.eurprd06.prod.outlook.com>
References: <AM0PR06MB55401025C96174BB7FE8465F92C30@AM0PR06MB5540.eurprd06.prod.outlook.com>
Message-ID: <1542220463.2133.9.camel@acutus.pro>

Hello Ori,

How do you implement SSO for your desktop application? Are you using kcinit [1] or KeycloakInstalled [2]?

Both will do interactive login via the system browser, that means, SSO cookies should be shared with whatever web application that is run therein.

Cheers,
Dmitry Telegin
CTO, Acutus s.r.o.
Keycloak Consulting and Training

Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
+42 (022) 888-30-71
E-mail: info at acutus.pro

[1] https://github.com/keycloak/kcinit
[2] https://www.keycloak.org/docs/latest/securing_apps/index.html#_installed_adapter

On Wed, 2018-11-14 at 10:36 +0000, Ori Doolman wrote:
> Hi,
> I have 2 applications: one is desktop (Windows) and the other one is a web application.
> My desktop application performs authentication and login using Keycloak, and getting a JWT Access Token.
> My web application is using the Keycloak JS adapter to perform the same.
> 
> After I login to my desktop application, is there a way to pass the generated access token to the web application and continue the same session? Or at least have an SSO experience and get another token for the user without the user entering the credentials again?
> 
> 
> 
> Maybe I can pass the token and refresh token from desktop application as init parameters to the Keycloak-JS ?
> I see the following code is checking if initOptions contains the token:
> 
> 
> ????????????function processInit() {
> ????????????????var callback = parseCallback(window.location.href);
> 
> ????????????????if (callback) {
> ????????????????????window.history.replaceState({}, null, callback.newUrl);
> ????????????????}
> 
> ????????????????if (callback && callback.valid) {
> ????????????????????return setupCheckLoginIframe().success(function() {
> ????????????????????????processCallback(callback, initPromise);
> ????????????????????}).error(function (e) {
> ????????????????????????initPromise.setError();
> ????????????????????});
> ????????????????} else if (initOptions) {
> ????????????????????if (initOptions.token && initOptions.refreshToken) {
> ????????????????????????setToken(initOptions.token, initOptions.refreshToken, initOptions.idToken);
> 
> 
> 
> 
> 
> 
> Thanks,
> 
> Ori Doolman
> Lead Software Architect
> Amdocs Optima
> 
> 
> > [cid:image001.png at 01D2C8DE.BFF33E10]
> 
> ?Amdocs? email platform is based on a third-party, worldwide, cloud-based system. Any emails sent to Amdocs will be processed and stored using such system and are accessible by third party providers of such system on a limited basis. Your sending of emails to Amdocs evidences your consent to the use of such system and such processing, storing and access?.
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From marco.lamina at sap.com  Wed Nov 14 13:44:03 2018
From: marco.lamina at sap.com (Lamina, Marco)
Date: Wed, 14 Nov 2018 18:44:03 +0000
Subject: [keycloak-user] Unspecified behavior of token endpoint when
 obtaining permissions
In-Reply-To: <CAJrcDBdEJAUZexSfSkE+BvZ72Zm5mgsEMkpzHoBkZUbJGDrZ0A@mail.gmail.com>
References: <93622CAC-1CFE-48C6-9CC3-D2AD9047CF1A@sap.com>
	<CAJrcDBdEJAUZexSfSkE+BvZ72Zm5mgsEMkpzHoBkZUbJGDrZ0A@mail.gmail.com>
Message-ID: <A0524313-BB35-4EFE-827A-2B3306D8B437@sap.com>

The permission to my resources is not given using the UMA flow, but by policies and permissions that I defined manually.
For example, I have a resource-type-based permission that combines two policies with the ?affirmative? strategy:

  1.  ?User is resource owner? ? JS-based policy
  2.  ?User is admin? ? role-based policy

My assumption was that this will grant full access to any resources of that type if a user is either its owner or is assigned the ?admin? role. Using the evaluation tool, I can verify that admins have permission to access any resource of that type with any scope. But still, these resources do not show up in the permissions list I receive from the token endpoint.

For context: I need this type of request to query my database for all objects that a given token has access to. Maybe I?m going about this the wrong way? Would love to hear your suggestions!


From: Pedro Igor Silva <psilva at redhat.com>
Date: Wednesday, November 14, 2018 at 4:04 AM
To: "Lamina, Marco" <marco.lamina at sap.com>
Cc: keycloak-user <keycloak-user at lists.jboss.org>
Subject: Re: [keycloak-user] Unspecified behavior of token endpoint when obtaining permissions

When asking for *all* permissions a user has, the policy evaluation engine resolves the resources as follows:

1) Get all resources owned by the user
2) Get all resources owned by the resource server
3) Get all resources granted by another user to the user based on UMA and permission tickets.

NOTE: when doing an "all" request we don't fetch all resources managed by the server.

If you are not getting the resources owned by other users is probably because they were not granted based on permission tickets (UMA flow). I would suggest you to get the id for one of these resources and send an authorization request using the resource id to see what you get.

Regards.
Pedro Igor

On Tue, Nov 13, 2018 at 9:50 PM Lamina, Marco <marco.lamina at sap.com<mailto:marco.lamina at sap.com>> wrote:
Hi,
I am trying to use Keycloak?s token endpoint to obtain a list of all resources and the respective scopes that a user has permission to access. However, the behavior I am observing does not match what is described in the documentation (Link [1]). I am using the token endpoint as shown in Link [2].

Expected behavior:
Token endpoint returns a list of all resources and scopes that the token?s user has permission to access.

Observed behavior:
Token endpoint only returns resources that are owned by either the token?s user or the resource server itself. Resources owned by other users are not listed, even though the token?s user has permission to access them.

Is that a bug or expected behavior?

Links:

[1] https://www.keycloak.org/docs/latest/authorization_services/index.html#_service_obtaining_permissions
[2] https://issues.jboss.org/browse/KEYCLOAK-8768?focusedCommentId=13658545&page=com.atlassian.jira.plugin.system.issuetabpanels%3Acomment-tabpanel#comment-13658545

Thanks,
Marco

_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user

From psilva at redhat.com  Wed Nov 14 15:34:47 2018
From: psilva at redhat.com (Pedro Igor Silva)
Date: Wed, 14 Nov 2018 18:34:47 -0200
Subject: [keycloak-user] Unspecified behavior of token endpoint when
 obtaining permissions
In-Reply-To: <A0524313-BB35-4EFE-827A-2B3306D8B437@sap.com>
References: <93622CAC-1CFE-48C6-9CC3-D2AD9047CF1A@sap.com>
	<CAJrcDBdEJAUZexSfSkE+BvZ72Zm5mgsEMkpzHoBkZUbJGDrZ0A@mail.gmail.com>
	<A0524313-BB35-4EFE-827A-2B3306D8B437@sap.com>
Message-ID: <CAJrcDBdUSwpGMYi9J0pOeJmuLgEbHDRUbMjO0diK_+XmAOc3PA@mail.gmail.com>

I see. As I mentioned before, the specific resource (owned by a different
user) is not processed by the policy evaluation engine.

For this particular case, if the user is granted with the typed resource
you could just assume that she/he can fetch any resource from the database
with the same logical type, right ?

On Wed, Nov 14, 2018 at 4:44 PM Lamina, Marco <marco.lamina at sap.com> wrote:

> The permission to my resources is not given using the UMA flow, but by
> policies and permissions that I defined manually.
>
> For example, I have a resource-type-based permission that combines two
> policies with the ?affirmative? strategy:
>
>    1. ?User is resource owner? ? JS-based policy
>    2. ?User is admin? ? role-based policy
>
>
>
> My assumption was that this will grant full access to any resources of
> that type if a user is either its owner or is assigned the ?admin? role.
> Using the evaluation tool, I can verify that admins have permission to
> access any resource of that type with any scope. But still, these resources
> do not show up in the permissions list I receive from the token endpoint.
>
>
>
> For context: I need this type of request to query my database for all
> objects that a given token has access to. Maybe I?m going about this the
> wrong way? Would love to hear your suggestions!
>
>
>
>
>
> *From: *Pedro Igor Silva <psilva at redhat.com>
> *Date: *Wednesday, November 14, 2018 at 4:04 AM
> *To: *"Lamina, Marco" <marco.lamina at sap.com>
> *Cc: *keycloak-user <keycloak-user at lists.jboss.org>
> *Subject: *Re: [keycloak-user] Unspecified behavior of token endpoint
> when obtaining permissions
>
>
>
> When asking for *all* permissions a user has, the policy evaluation engine
> resolves the resources as follows:
>
>
>
> 1) Get all resources owned by the user
>
> 2) Get all resources owned by the resource server
>
> 3) Get all resources granted by another user to the user based on UMA and
> permission tickets.
>
>
>
> NOTE: when doing an "all" request we don't fetch all resources managed by
> the server.
>
>
>
> If you are not getting the resources owned by other users is probably
> because they were not granted based on permission tickets (UMA flow). I
> would suggest you to get the id for one of these resources and send an
> authorization request using the resource id to see what you get.
>
>
>
> Regards.
>
> Pedro Igor
>
>
>
> On Tue, Nov 13, 2018 at 9:50 PM Lamina, Marco <marco.lamina at sap.com>
> wrote:
>
> Hi,
> I am trying to use Keycloak?s token endpoint to obtain a list of all
> resources and the respective scopes that a user has permission to access.
> However, the behavior I am observing does not match what is described in
> the documentation (Link [1]). I am using the token endpoint as shown in
> Link [2].
>
> Expected behavior:
> Token endpoint returns a list of all resources and scopes that the token?s
> user has permission to access.
>
> Observed behavior:
> Token endpoint only returns resources that are owned by either the token?s
> user or the resource server itself. Resources owned by other users are not
> listed, even though the token?s user has permission to access them.
>
> Is that a bug or expected behavior?
>
> Links:
>
> [1]
> https://www.keycloak.org/docs/latest/authorization_services/index.html#_service_obtaining_permissions
> [2]
> https://issues.jboss.org/browse/KEYCLOAK-8768?focusedCommentId=13658545&page=com.atlassian.jira.plugin.system.issuetabpanels%3Acomment-tabpanel#comment-13658545
>
> Thanks,
> Marco
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
>

From marco.lamina at sap.com  Wed Nov 14 15:55:48 2018
From: marco.lamina at sap.com (Lamina, Marco)
Date: Wed, 14 Nov 2018 20:55:48 +0000
Subject: [keycloak-user] Unspecified behavior of token endpoint when
 obtaining permissions
In-Reply-To: <CAJrcDBdUSwpGMYi9J0pOeJmuLgEbHDRUbMjO0diK_+XmAOc3PA@mail.gmail.com>
References: <93622CAC-1CFE-48C6-9CC3-D2AD9047CF1A@sap.com>
	<CAJrcDBdEJAUZexSfSkE+BvZ72Zm5mgsEMkpzHoBkZUbJGDrZ0A@mail.gmail.com>
	<A0524313-BB35-4EFE-827A-2B3306D8B437@sap.com>
	<CAJrcDBdUSwpGMYi9J0pOeJmuLgEbHDRUbMjO0diK_+XmAOc3PA@mail.gmail.com>
Message-ID: <50CD5317-9273-4407-8469-87D5B24B3F62@sap.com>

Correct, in this particular case that might be true. However, in the future there will be a more complex scenario with different types of permissions and users involved. For now I am using the following workaround to implement my use case on the resource server:

  1.  Request a PAT token from Keycloak
  2.  List all resources of a certain type via {keycloak}/auth/realms/${realm_name}/authz/protection/resource_set?type={type}
  3.  Send a permissions request to the token endpoint with a permission={resource_id}#{my_scope} item for every resource ID from 2), using the user?s access token in the header
  4.  The resulting list contains all resources a user can access with a given scope

This gives me the correct result, but doesn?t scale well if I end up having a lot of resources.


From: Pedro Igor Silva <psilva at redhat.com>
Date: Wednesday, November 14, 2018 at 12:35 PM
To: "Lamina, Marco" <marco.lamina at sap.com>
Cc: keycloak-user <keycloak-user at lists.jboss.org>
Subject: Re: [keycloak-user] Unspecified behavior of token endpoint when obtaining permissions

I see. As I mentioned before, the specific resource (owned by a different user) is not processed by the policy evaluation engine.

For this particular case, if the user is granted with the typed resource you could just assume that she/he can fetch any resource from the database with the same logical type, right ?
On Wed, Nov 14, 2018 at 4:44 PM Lamina, Marco <marco.lamina at sap.com<mailto:marco.lamina at sap.com>> wrote:
The permission to my resources is not given using the UMA flow, but by policies and permissions that I defined manually.
For example, I have a resource-type-based permission that combines two policies with the ?affirmative? strategy:

  1.  ?User is resource owner? ? JS-based policy
  2.  ?User is admin? ? role-based policy

My assumption was that this will grant full access to any resources of that type if a user is either its owner or is assigned the ?admin? role. Using the evaluation tool, I can verify that admins have permission to access any resource of that type with any scope. But still, these resources do not show up in the permissions list I receive from the token endpoint.

For context: I need this type of request to query my database for all objects that a given token has access to. Maybe I?m going about this the wrong way? Would love to hear your suggestions!


From: Pedro Igor Silva <psilva at redhat.com<mailto:psilva at redhat.com>>
Date: Wednesday, November 14, 2018 at 4:04 AM
To: "Lamina, Marco" <marco.lamina at sap.com<mailto:marco.lamina at sap.com>>
Cc: keycloak-user <keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>>
Subject: Re: [keycloak-user] Unspecified behavior of token endpoint when obtaining permissions

When asking for *all* permissions a user has, the policy evaluation engine resolves the resources as follows:

1) Get all resources owned by the user
2) Get all resources owned by the resource server
3) Get all resources granted by another user to the user based on UMA and permission tickets.

NOTE: when doing an "all" request we don't fetch all resources managed by the server.

If you are not getting the resources owned by other users is probably because they were not granted based on permission tickets (UMA flow). I would suggest you to get the id for one of these resources and send an authorization request using the resource id to see what you get.

Regards.
Pedro Igor

On Tue, Nov 13, 2018 at 9:50 PM Lamina, Marco <marco.lamina at sap.com<mailto:marco.lamina at sap.com>> wrote:
Hi,
I am trying to use Keycloak?s token endpoint to obtain a list of all resources and the respective scopes that a user has permission to access. However, the behavior I am observing does not match what is described in the documentation (Link [1]). I am using the token endpoint as shown in Link [2].

Expected behavior:
Token endpoint returns a list of all resources and scopes that the token?s user has permission to access.

Observed behavior:
Token endpoint only returns resources that are owned by either the token?s user or the resource server itself. Resources owned by other users are not listed, even though the token?s user has permission to access them.

Is that a bug or expected behavior?

Links:

[1] https://www.keycloak.org/docs/latest/authorization_services/index.html#_service_obtaining_permissions
[2] https://issues.jboss.org/browse/KEYCLOAK-8768?focusedCommentId=13658545&page=com.atlassian.jira.plugin.system.issuetabpanels%3Acomment-tabpanel#comment-13658545

Thanks,
Marco

_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user

From psilva at redhat.com  Wed Nov 14 16:40:23 2018
From: psilva at redhat.com (Pedro Igor Silva)
Date: Wed, 14 Nov 2018 19:40:23 -0200
Subject: [keycloak-user] Unspecified behavior of token endpoint when
 obtaining permissions
In-Reply-To: <50CD5317-9273-4407-8469-87D5B24B3F62@sap.com>
References: <93622CAC-1CFE-48C6-9CC3-D2AD9047CF1A@sap.com>
	<CAJrcDBdEJAUZexSfSkE+BvZ72Zm5mgsEMkpzHoBkZUbJGDrZ0A@mail.gmail.com>
	<A0524313-BB35-4EFE-827A-2B3306D8B437@sap.com>
	<CAJrcDBdUSwpGMYi9J0pOeJmuLgEbHDRUbMjO0diK_+XmAOc3PA@mail.gmail.com>
	<50CD5317-9273-4407-8469-87D5B24B3F62@sap.com>
Message-ID: <CAJrcDBeqdRdAm3jL09451Syk9k7cY4-b6FjUHWWtSbHNfY6v0g@mail.gmail.com>

I mentioned a possible solution in another thread which was about data
filtering. What if you push back claims from your policies where these
claims represent conditions that should be added to your query. See
http://lists.jboss.org/pipermail/keycloak-user/2018-November/016213.html.

Regards.
Pedro Igor

On Wed, Nov 14, 2018 at 6:56 PM Lamina, Marco <marco.lamina at sap.com> wrote:

> Correct, in this particular case that might be true. However, in the
> future there will be a more complex scenario with different types of
> permissions and users involved. For now I am using the following workaround
> to implement my use case on the resource server:
>
>    1. Request a PAT token from Keycloak
>    2. List all resources of a certain type via
>    {keycloak}/auth/realms/${realm_name}/authz/protection/resource_set?type={type}
>    3. Send a permissions request to the token endpoint with a
>    permission={resource_id}#{my_scope} item for every resource ID from 2),
>    using the user?s access token in the header
>    4. The resulting list contains all resources a user can access with a
>    given scope
>
>
>
> This gives me the correct result, but doesn?t scale well if I end up
> having a lot of resources.
>
>
>
>
>
> *From: *Pedro Igor Silva <psilva at redhat.com>
> *Date: *Wednesday, November 14, 2018 at 12:35 PM
> *To: *"Lamina, Marco" <marco.lamina at sap.com>
> *Cc: *keycloak-user <keycloak-user at lists.jboss.org>
> *Subject: *Re: [keycloak-user] Unspecified behavior of token endpoint
> when obtaining permissions
>
>
>
> I see. As I mentioned before, the specific resource (owned by a different
> user) is not processed by the policy evaluation engine.
>
>
>
> For this particular case, if the user is granted with the typed resource
> you could just assume that she/he can fetch any resource from the database
> with the same logical type, right ?
>
> On Wed, Nov 14, 2018 at 4:44 PM Lamina, Marco <marco.lamina at sap.com>
> wrote:
>
> The permission to my resources is not given using the UMA flow, but by
> policies and permissions that I defined manually.
>
> For example, I have a resource-type-based permission that combines two
> policies with the ?affirmative? strategy:
>
>    1. ?User is resource owner? ? JS-based policy
>    2. ?User is admin? ? role-based policy
>
>
>
> My assumption was that this will grant full access to any resources of
> that type if a user is either its owner or is assigned the ?admin? role.
> Using the evaluation tool, I can verify that admins have permission to
> access any resource of that type with any scope. But still, these resources
> do not show up in the permissions list I receive from the token endpoint.
>
>
>
> For context: I need this type of request to query my database for all
> objects that a given token has access to. Maybe I?m going about this the
> wrong way? Would love to hear your suggestions!
>
>
>
>
>
> *From: *Pedro Igor Silva <psilva at redhat.com>
> *Date: *Wednesday, November 14, 2018 at 4:04 AM
> *To: *"Lamina, Marco" <marco.lamina at sap.com>
> *Cc: *keycloak-user <keycloak-user at lists.jboss.org>
> *Subject: *Re: [keycloak-user] Unspecified behavior of token endpoint
> when obtaining permissions
>
>
>
> When asking for *all* permissions a user has, the policy evaluation engine
> resolves the resources as follows:
>
>
>
> 1) Get all resources owned by the user
>
> 2) Get all resources owned by the resource server
>
> 3) Get all resources granted by another user to the user based on UMA and
> permission tickets.
>
>
>
> NOTE: when doing an "all" request we don't fetch all resources managed by
> the server.
>
>
>
> If you are not getting the resources owned by other users is probably
> because they were not granted based on permission tickets (UMA flow). I
> would suggest you to get the id for one of these resources and send an
> authorization request using the resource id to see what you get.
>
>
>
> Regards.
>
> Pedro Igor
>
>
>
> On Tue, Nov 13, 2018 at 9:50 PM Lamina, Marco <marco.lamina at sap.com>
> wrote:
>
> Hi,
> I am trying to use Keycloak?s token endpoint to obtain a list of all
> resources and the respective scopes that a user has permission to access.
> However, the behavior I am observing does not match what is described in
> the documentation (Link [1]). I am using the token endpoint as shown in
> Link [2].
>
> Expected behavior:
> Token endpoint returns a list of all resources and scopes that the token?s
> user has permission to access.
>
> Observed behavior:
> Token endpoint only returns resources that are owned by either the token?s
> user or the resource server itself. Resources owned by other users are not
> listed, even though the token?s user has permission to access them.
>
> Is that a bug or expected behavior?
>
> Links:
>
> [1]
> https://www.keycloak.org/docs/latest/authorization_services/index.html#_service_obtaining_permissions
> [2]
> https://issues.jboss.org/browse/KEYCLOAK-8768?focusedCommentId=13658545&page=com.atlassian.jira.plugin.system.issuetabpanels%3Acomment-tabpanel#comment-13658545
>
> Thanks,
> Marco
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
>

From marco.lamina at sap.com  Wed Nov 14 18:37:42 2018
From: marco.lamina at sap.com (Lamina, Marco)
Date: Wed, 14 Nov 2018 23:37:42 +0000
Subject: [keycloak-user] Unspecified behavior of token endpoint when
 obtaining permissions
In-Reply-To: <CAJrcDBeqdRdAm3jL09451Syk9k7cY4-b6FjUHWWtSbHNfY6v0g@mail.gmail.com>
References: <93622CAC-1CFE-48C6-9CC3-D2AD9047CF1A@sap.com>
	<CAJrcDBdEJAUZexSfSkE+BvZ72Zm5mgsEMkpzHoBkZUbJGDrZ0A@mail.gmail.com>
	<A0524313-BB35-4EFE-827A-2B3306D8B437@sap.com>
	<CAJrcDBdUSwpGMYi9J0pOeJmuLgEbHDRUbMjO0diK_+XmAOc3PA@mail.gmail.com>
	<50CD5317-9273-4407-8469-87D5B24B3F62@sap.com>
	<CAJrcDBeqdRdAm3jL09451Syk9k7cY4-b6FjUHWWtSbHNfY6v0g@mail.gmail.com>
Message-ID: <E68A1C34-25B8-4998-B6A5-7C47B7A4DE8F@sap.com>

I looked at push claims and I like the idea, but I wasn?t able to come up with a scenario that would support my use case.


From: Pedro Igor Silva <psilva at redhat.com>
Date: Wednesday, November 14, 2018 at 1:41 PM
To: "Lamina, Marco" <marco.lamina at sap.com>
Cc: keycloak-user <keycloak-user at lists.jboss.org>
Subject: Re: [keycloak-user] Unspecified behavior of token endpoint when obtaining permissions

I mentioned a possible solution in another thread which was about data filtering. What if you push back claims from your policies where these claims represent conditions that should be added to your query. See http://lists.jboss.org/pipermail/keycloak-user/2018-November/016213.html.

Regards.
Pedro Igor

On Wed, Nov 14, 2018 at 6:56 PM Lamina, Marco <marco.lamina at sap.com<mailto:marco.lamina at sap.com>> wrote:
Correct, in this particular case that might be true. However, in the future there will be a more complex scenario with different types of permissions and users involved. For now I am using the following workaround to implement my use case on the resource server:

  1.  Request a PAT token from Keycloak
  2.  List all resources of a certain type via {keycloak}/auth/realms/${realm_name}/authz/protection/resource_set?type={type}
  3.  Send a permissions request to the token endpoint with a permission={resource_id}#{my_scope} item for every resource ID from 2), using the user?s access token in the header
  4.  The resulting list contains all resources a user can access with a given scope

This gives me the correct result, but doesn?t scale well if I end up having a lot of resources.


From: Pedro Igor Silva <psilva at redhat.com<mailto:psilva at redhat.com>>
Date: Wednesday, November 14, 2018 at 12:35 PM
To: "Lamina, Marco" <marco.lamina at sap.com<mailto:marco.lamina at sap.com>>
Cc: keycloak-user <keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>>
Subject: Re: [keycloak-user] Unspecified behavior of token endpoint when obtaining permissions

I see. As I mentioned before, the specific resource (owned by a different user) is not processed by the policy evaluation engine.

For this particular case, if the user is granted with the typed resource you could just assume that she/he can fetch any resource from the database with the same logical type, right ?
On Wed, Nov 14, 2018 at 4:44 PM Lamina, Marco <marco.lamina at sap.com<mailto:marco.lamina at sap.com>> wrote:
The permission to my resources is not given using the UMA flow, but by policies and permissions that I defined manually.
For example, I have a resource-type-based permission that combines two policies with the ?affirmative? strategy:

  1.  ?User is resource owner? ? JS-based policy
  2.  ?User is admin? ? role-based policy

My assumption was that this will grant full access to any resources of that type if a user is either its owner or is assigned the ?admin? role. Using the evaluation tool, I can verify that admins have permission to access any resource of that type with any scope. But still, these resources do not show up in the permissions list I receive from the token endpoint.

For context: I need this type of request to query my database for all objects that a given token has access to. Maybe I?m going about this the wrong way? Would love to hear your suggestions!


From: Pedro Igor Silva <psilva at redhat.com<mailto:psilva at redhat.com>>
Date: Wednesday, November 14, 2018 at 4:04 AM
To: "Lamina, Marco" <marco.lamina at sap.com<mailto:marco.lamina at sap.com>>
Cc: keycloak-user <keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>>
Subject: Re: [keycloak-user] Unspecified behavior of token endpoint when obtaining permissions

When asking for *all* permissions a user has, the policy evaluation engine resolves the resources as follows:

1) Get all resources owned by the user
2) Get all resources owned by the resource server
3) Get all resources granted by another user to the user based on UMA and permission tickets.

NOTE: when doing an "all" request we don't fetch all resources managed by the server.

If you are not getting the resources owned by other users is probably because they were not granted based on permission tickets (UMA flow). I would suggest you to get the id for one of these resources and send an authorization request using the resource id to see what you get.

Regards.
Pedro Igor

On Tue, Nov 13, 2018 at 9:50 PM Lamina, Marco <marco.lamina at sap.com<mailto:marco.lamina at sap.com>> wrote:
Hi,
I am trying to use Keycloak?s token endpoint to obtain a list of all resources and the respective scopes that a user has permission to access. However, the behavior I am observing does not match what is described in the documentation (Link [1]). I am using the token endpoint as shown in Link [2].

Expected behavior:
Token endpoint returns a list of all resources and scopes that the token?s user has permission to access.

Observed behavior:
Token endpoint only returns resources that are owned by either the token?s user or the resource server itself. Resources owned by other users are not listed, even though the token?s user has permission to access them.

Is that a bug or expected behavior?

Links:

[1] https://www.keycloak.org/docs/latest/authorization_services/index.html#_service_obtaining_permissions
[2] https://issues.jboss.org/browse/KEYCLOAK-8768?focusedCommentId=13658545&page=com.atlassian.jira.plugin.system.issuetabpanels%3Acomment-tabpanel#comment-13658545

Thanks,
Marco

_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user

From sthorger at redhat.com  Thu Nov 15 02:55:32 2018
From: sthorger at redhat.com (Stian Thorgersen)
Date: Thu, 15 Nov 2018 08:55:32 +0100
Subject: [keycloak-user] Keycloak 4.6.0.Final released
Message-ID: <CAJgngAc2vsKfyM7s9MEhrbNBvmBgRpdYyUY29Js6Cw5gS62+Rg@mail.gmail.com>

http://blog.keycloak.org/2018/11/keycloak-460final-released.html

From cedric at couralet.eu  Thu Nov 15 03:23:51 2018
From: cedric at couralet.eu (=?UTF-8?Q?C=C3=A9dric_Couralet?=)
Date: Thu, 15 Nov 2018 09:23:51 +0100
Subject: [keycloak-user] Keycloak 4.6.0.Final released
In-Reply-To: <CAJgngAc2vsKfyM7s9MEhrbNBvmBgRpdYyUY29Js6Cw5gS62+Rg@mail.gmail.com>
References: <CAJgngAc2vsKfyM7s9MEhrbNBvmBgRpdYyUY29Js6Cw5gS62+Rg@mail.gmail.com>
Message-ID: <9721fa600ae28dd56d6eecabe76ec884@couralet.eu>

Le 2018-11-15 08:55, Stian Thorgersen a ?crit?:
> http://blog.keycloak.org/2018/11/keycloak-460final-released.html
> _______________________________________________

Hi all,

When updating the docker image, I had a lot of warning in log (stack 
trace in bottom). This is related to infinispan apparently. Everything 
seems to work fine, but should I be worried?



08:11:49,642 WARN  [org.infinispan.statetransfer.StateConsumerImpl] 
(transport-thread--p19-t3) ISPN000209: Failed to retrieve transactions 
of cache client-mappings from node cba19ca69fd1, segments {0-255}: 
org.infinispan.remoting.RemoteException: ISPN000217: Received exception 
from cba19ca69fd1, see cause for remote stack trace
	at 
org.infinispan.remoting.transport.ResponseCollectors.wrapRemoteException(ResponseCollectors.java:27)
	at 
org.infinispan.remoting.transport.ValidSingleResponseCollector.withException(ValidSingleResponseCollector.java:37)
	at 
org.infinispan.remoting.transport.ValidSingleResponseCollector.addResponse(ValidSingleResponseCollector.java:21)
	at 
org.infinispan.remoting.transport.impl.SingleTargetRequest.receiveResponse(SingleTargetRequest.java:52)
	at 
org.infinispan.remoting.transport.impl.SingleTargetRequest.onResponse(SingleTargetRequest.java:35)
	at 
org.infinispan.remoting.transport.impl.RequestRepository.addResponse(RequestRepository.java:52)
	at 
org.infinispan.remoting.transport.jgroups.JGroupsTransport.processResponse(JGroupsTransport.java:1370)
	at 
org.infinispan.remoting.transport.jgroups.JGroupsTransport.processMessage(JGroupsTransport.java:1273)
	at 
org.infinispan.remoting.transport.jgroups.JGroupsTransport.access$300(JGroupsTransport.java:125)
	at 
org.infinispan.remoting.transport.jgroups.JGroupsTransport$ChannelCallbacks.up(JGroupsTransport.java:1418)
	at org.jgroups.JChannel.up(JChannel.java:816)
	at org.jgroups.fork.ForkProtocolStack.up(ForkProtocolStack.java:134)
	at org.jgroups.stack.Protocol.up(Protocol.java:340)
	at org.jgroups.protocols.FORK.up(FORK.java:134)
	at org.jgroups.protocols.FRAG2.up(FRAG2.java:177)
	at org.jgroups.protocols.FlowControl.up(FlowControl.java:343)
	at org.jgroups.protocols.pbcast.GMS.up(GMS.java:873)
	at org.jgroups.protocols.pbcast.STABLE.up(STABLE.java:240)
	at org.jgroups.protocols.UNICAST3.deliverMessage(UNICAST3.java:1003)
	at org.jgroups.protocols.UNICAST3.handleDataReceived(UNICAST3.java:729)
	at org.jgroups.protocols.UNICAST3.up(UNICAST3.java:384)
	at org.jgroups.protocols.pbcast.NAKACK2.up(NAKACK2.java:600)
	at org.jgroups.protocols.VERIFY_SUSPECT.up(VERIFY_SUSPECT.java:130)
	at org.jgroups.protocols.FD.up(FD.java:212)
	at org.jgroups.protocols.FD_SOCK.up(FD_SOCK.java:253)
	at org.jgroups.protocols.MERGE3.up(MERGE3.java:280)
	at org.jgroups.protocols.Discovery.up(Discovery.java:269)
	at org.jgroups.protocols.TP.passMessageUp(TP.java:1248)
	at 
org.jgroups.util.SubmitToThreadPool$SingleMessageHandler.run(SubmitToThreadPool.java:87)
	at 
java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
	at 
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
	at 
org.jboss.as.clustering.jgroups.ClassLoaderThreadFactory.lambda$newThread$0(ClassLoaderThreadFactory.java:52)
	at java.lang.Thread.run(Thread.java:748)
	Suppressed: org.infinispan.util.logging.TraceException
		at 
org.infinispan.remoting.rpc.RpcManagerImpl.blocking(RpcManagerImpl.java:268)
		at 
org.infinispan.statetransfer.StateConsumerImpl.getTransactions(StateConsumerImpl.java:916)
		at 
org.infinispan.statetransfer.StateConsumerImpl.requestTransactions(StateConsumerImpl.java:829)
		at 
org.infinispan.statetransfer.StateConsumerImpl.addTransfers(StateConsumerImpl.java:767)
		at 
org.infinispan.statetransfer.StateConsumerImpl.handleSegments(StateConsumerImpl.java:470)
		at 
org.infinispan.statetransfer.StateConsumerImpl.onTopologyUpdate(StateConsumerImpl.java:362)
		at 
org.infinispan.statetransfer.StateTransferManagerImpl.doTopologyUpdate(StateTransferManagerImpl.java:197)
		at 
org.infinispan.statetransfer.StateTransferManagerImpl.access$000(StateTransferManagerImpl.java:54)
		at 
org.infinispan.statetransfer.StateTransferManagerImpl$1.rebalance(StateTransferManagerImpl.java:117)
		at 
org.infinispan.topology.LocalTopologyManagerImpl.doHandleRebalance(LocalTopologyManagerImpl.java:517)
		at 
org.infinispan.topology.LocalTopologyManagerImpl.lambda$handleRebalance$3(LocalTopologyManagerImpl.java:475)
		at 
org.infinispan.executors.LimitedExecutor.runTasks(LimitedExecutor.java:175)
		at 
org.infinispan.executors.LimitedExecutor.access$100(LimitedExecutor.java:37)
		at 
org.infinispan.executors.LimitedExecutor$Runner.run(LimitedExecutor.java:227)
		at 
java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
		at 
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
		at 
org.wildfly.clustering.service.concurrent.ClassLoaderThreadFactory.lambda$newThread$0(ClassLoaderThreadFactory.java:47)
		... 1 more
Caused by: java.io.IOException: Unknown type: 132
	at 
org.infinispan.marshall.core.GlobalMarshaller.readNonNullableObject(GlobalMarshaller.java:681)
	at 
org.infinispan.marshall.core.GlobalMarshaller.readNullableObject(GlobalMarshaller.java:355)
	at 
org.infinispan.marshall.core.BytesObjectInput.readObject(BytesObjectInput.java:40)
	at 
org.infinispan.commons.marshall.MarshallUtil.unmarshallCollectionUnbounded(MarshallUtil.java:302)
	at 
org.infinispan.statetransfer.StateRequestCommand.readFrom(StateRequestCommand.java:197)
	at 
org.infinispan.marshall.exts.ReplicableCommandExternalizer.readCommandParameters(ReplicableCommandExternalizer.java:104)
	at 
org.infinispan.marshall.exts.CacheRpcCommandExternalizer.readObject(CacheRpcCommandExternalizer.java:130)
	at 
org.infinispan.marshall.exts.CacheRpcCommandExternalizer.readObject(CacheRpcCommandExternalizer.java:65)
	at 
org.infinispan.marshall.core.GlobalMarshaller.readWithExternalizer(GlobalMarshaller.java:688)
	at 
org.infinispan.marshall.core.GlobalMarshaller.readNonNullableObject(GlobalMarshaller.java:671)
	at 
org.infinispan.marshall.core.GlobalMarshaller.readNullableObject(GlobalMarshaller.java:355)
	at 
org.infinispan.marshall.core.GlobalMarshaller.objectFromObjectInput(GlobalMarshaller.java:193)
	at 
org.infinispan.marshall.core.GlobalMarshaller.objectFromByteBuffer(GlobalMarshaller.java:222)
	at 
org.infinispan.remoting.transport.jgroups.JGroupsTransport.processRequest(JGroupsTransport.java:1278)
	at 
org.infinispan.remoting.transport.jgroups.JGroupsTransport.processMessage(JGroupsTransport.java:1218)
	at 
org.infinispan.remoting.transport.jgroups.JGroupsTransport.access$200(JGroupsTransport.java:123)
	at 
org.infinispan.remoting.transport.jgroups.JGroupsTransport$ChannelCallbacks.receive(JGroupsTransport.java:1356)
	at org.jgroups.JChannel.up(JChannel.java:819)
	at org.jgroups.fork.ForkProtocolStack.up(ForkProtocolStack.java:134)
	at org.jgroups.stack.Protocol.up(Protocol.java:340)
	at org.jgroups.protocols.FORK.up(FORK.java:134)
	at org.jgroups.protocols.FRAG2.up(FRAG2.java:177)
	at org.jgroups.protocols.FlowControl.up(FlowControl.java:351)
	at org.jgroups.protocols.pbcast.GMS.up(GMS.java:864)
	at org.jgroups.protocols.pbcast.STABLE.up(STABLE.java:240)
	at org.jgroups.protocols.UNICAST3.deliverMessage(UNICAST3.java:1002)
	at org.jgroups.protocols.UNICAST3.handleDataReceived(UNICAST3.java:728)
	at org.jgroups.protocols.UNICAST3.up(UNICAST3.java:383)
	at org.jgroups.protocols.pbcast.NAKACK2.up(NAKACK2.java:600)
	at org.jgroups.protocols.VERIFY_SUSPECT.up(VERIFY_SUSPECT.java:119)
	at org.jgroups.protocols.FD.up(FD.java:212)
	at org.jgroups.protocols.FD_SOCK.up(FD_SOCK.java:252)
	at org.jgroups.protocols.MERGE3.up(MERGE3.java:276)
	at org.jgroups.protocols.Discovery.up(Discovery.java:267)
	... 6 more


C?dric

From orwittatibm at gmail.com  Thu Nov 15 03:35:03 2018
From: orwittatibm at gmail.com (Oliver-Rainer Wittmann)
Date: Thu, 15 Nov 2018 09:35:03 +0100
Subject: [keycloak-user] Update user attributes on login
In-Reply-To: <1542218554.2133.3.camel@acutus.pro>
References: <2C8A4D72-F9FD-4A8D-9F60-1985BA800798@gmail.com>
	<1542218554.2133.3.camel@acutus.pro>
Message-ID: <A75A8B08-7EA2-48A0-AF6F-CB246F71A86D@gmail.com>

Hi Dmitry,

Thanks for your suggestion.

In the meanwhile I got the hint to implement AbstractIdentityProvider.updateBrokeredUser(..) to update the user?s attributes.
The method got called on following logins.

Best regards, Oliver.


> On 14. Nov 2018, at 19:02, Dmitry Telegin <dt at acutus.pro> wrote:
> 
> Hello Oliver,
> 
> If you mean that very attributes that you can see under user's "Attributes" tab in Admin console, you can use script authenticator to do that:
> 
> function authenticate(context) {
> 
>    var username = user ? user.username : "anonymous";
>    LOG.info(script.name + " trace auth for: " + username);
> 
>    if (user) {
>      LOG.info(user.attributes.foo); // multivalued map
>      // replace existing value
>      user.attributes.foo[0] = "bar";
>      // or create new attribute
>      user.attributes.bar = java.util.ArrayList(['foo', 'bar', 'baz']);
>    }
> 
>    context.success();
> 
> }
> 
> Add this as the last step in your flow and make it required. Please note that the attributes are always multivalued in the model. This is not yet implemented in the GUI, but you can use ## to separate multiple values. That said, the value of the "bar" attribute will be seen as "foo##bar##baz" under the Attributes tab.
> 
> Good luck,
> Dmitry Telegin
> CTO, Acutus s.r.o.
> Keycloak Consulting and Training
> 
> Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
> +42 (022) 888-30-71
> E-mail: info at acutus.pro
> 
> On Wed, 2018-11-14 at 13:49 +0100, Oliver-Rainer Wittmann wrote:
>> Hi,
>> 
>> I have a running keycloak with a custom identity provider - corresponding implementation of AbstractOAuth2IdentityProvider
>> 
>> On registration of a user certain user attributes are stored and mapped into the token.
>> Now, I want to update these user attributes on following logins.
>> 
>> How to do this?
>> Unfortunately, I did not find a corresponding hint in the documentation.
>> 
>> Thx in advance for your support.
>> 
>> Best regards, Oliver
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user



From ronald.demneri at amdtia.com  Thu Nov 15 03:44:21 2018
From: ronald.demneri at amdtia.com (Ronald Demneri)
Date: Thu, 15 Nov 2018 08:44:21 +0000
Subject: [keycloak-user] filter group claim in token per client
References: <VI1PR0402MB3696E4DCAFFE7EEEEB0EAF70E9CF0@VI1PR0402MB3696.eurprd04.prod.outlook.com>
	<1541397265.3650.7.camel@acutus.pro>
	<VI1PR0402MB369663EA52F0699AF650CE58E9CA0@VI1PR0402MB3696.eurprd04.prod.outlook.com>
	<VI1PR0402MB3696D1D1312CB4F7A65920FAE9CB0@VI1PR0402MB3696.eurprd04.prod.outlook.com>
	,
	<VI1PR0402MB36967CDFF7608457E6AB73BFE9CB0@VI1PR0402MB3696.eurprd04.prod.outlook.com>
	<VI1PR0402MB36962E1029F6BB26BC168EA4E9CB0@VI1PR0402MB3696.eurprd04.prod.outlook.com>
	<1541806456.2031.5.camel@acutus.pro> 
Message-ID: <VI1PR0402MB3696EFF27270870BFAFB66D2E9DC0@VI1PR0402MB3696.eurprd04.prod.outlook.com>

Hello Dmitry,

When you have some time, can you please explain a little bit more about the more complex methods to mitigate the potential security issue that arises from our current configuration (Keycloak to allow/deny login based on group membership of user).

Thanks in advance,
Ronald

-----Original Message-----
From: Ronald Demneri 
Sent: 12.Nov.2018 10:59 AM
To: 'Dmitry Telegin' <dt at acutus.pro>; keycloak-user at lists.jboss.org
Subject: RE: [keycloak-user] filter group claim in token per client

Hello Dmitry,

After some trial and error, we were able to achieve having only pertinent groups in the token, although not as elegant as your script. So now we have it configured the way we want... approximately... Do you care to elaborate a little bit more on the possibilities to mitigate that security issue you mentioned in the email. The idea behind allowing a user to login if required group membership constraint is fulfilled, is quite important to us, which means that we need to find a different way from what we are doing right now. And of course, disabling SSO for all the clients is not a solution :)


Looking forward to hearing from you soon!

Thanks in advance,
Ronald

-----Original Message-----
From: Dmitry Telegin <dt at acutus.pro>
Sent: 10.Nov.2018 12:34 AM
To: Ronald Demneri <ronald.demneri at amdtia.com>; keycloak-user at lists.jboss.org
Subject: Re: [keycloak-user] filter group claim in token per client

Ronald,

Here are some Pro Tips(tm) for you :)

- use keycloakSession.context.client.clientId to retrieve client ID (works for both tokens and userinfo);
- use Java.from() and Java.to() to convert objects and arrays from Java to JavaScript and vice versa;
- use more JavaScript-fu like map() and filter() to avoid looping over arrays;
- use RegExp for generic case-insensitive pattern matching.

With the above, your whole mapper could look as simple as this:

==========================================
/**
 * Available variables: 
 * user - the current user
 * realm - the current realm
 * token - the current token
 * userSession - the current userSession
 * keycloakSession - the current userSession  */

var client = keycloakSession.context.client.clientId;

var groups = Java.from(user.groups)
    .map(function(group) {
        return group.name;
    })
    .filter(function(name) {
        return RegExp("(\\w+)-" + client + "-(\\w+)", "i").test(name);
    })

token.setOtherClaims("fGroup", Java.to(groups, "java.lang.String[]")) ==========================================

Please also read my earlier reply about the potential security issue with the script authenticator and how to mitigate it.

In fact, this problem (restricting access to clients based on group membership) has surfaced here at least three times during last month, so I think I'd write an article with the solution walkthrough. Stay tuned and good luck :)

Dmitry Telegin
CTO, Acutus s.r.o.
Keycloak Consulting and Training

Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
+42 (022) 888-30-71
E-mail: info at acutus.pro

On Tue, 2018-11-06 at 20:51 +0000, Ronald Demneri wrote:
> I configured the client to not use the userinfo endpoint for the group mapping.? Instead I used the id token,? and everything looks good now (no errors in the log,? and the client gets the claim, and assigns permissions accordingly) . Anyhow,? the question remains,? is there a way to get the client id using the script mapper?
> 
> Thanks in advance,
> Ronald
> 
> Sent from my HTC
> 
> ----- Reply message -----
> > From: "Ronald Demneri" <ronald.demneri at amdtia.com>
> > > To: "Ronald Demneri" <ronald.demneri at amdtia.com>, "Dmitry Telegin" 
> > > <dt at acutus.pro>, "keycloak-user at lists.jboss.org" 
> > > <keycloak-user at lists.jboss.org>
> Subject: [keycloak-user] filter group claim in token per client
> Date: Tue, Nov 6, 2018 16:08
> 
> Hello again,
> 
> Upon testing login and experimenting where the claim should be inserted, I found out that the duplicate print() is a result of including the claim in both ID access tokens. The error comes as a result of including the claim in the userinfo token, and probably that is why the userinfo endpoint does not contain the claim when the client application requests it.
> 
> Any idea how to solve it?
> 
> 
> Thanks in advance,
> Ronald
> 
> -----Original Message-----
> From: Ronald Demneri
> Sent: 06.Nov.2018 12:01 PM
> > To: Ronald Demneri <ronald.demneri at amdtia.com>; Dmitry Telegin 
> > <dt at acutus.pro>; keycloak-user at lists.jboss.org
> Subject: RE: [keycloak-user] filter group claim in token per client
> 
> So, I am looking at the logs and receive the following when going to App1 > Client Scopes > Evaluate:
> 
> 2018-11-06 10:51:42,407 INFO? [stdout] (default task-1892) 
> ############################################ APP1
> 2018-11-06 10:51:42,407 INFO? [stdout] (default task-1892) 
> ############################################
> 2018-11-06 10:51:42,407 INFO? [stdout] (default task-1892)? We are here!!!
> 2018-11-06 10:51:42,408 INFO? [stdout] (default task-1892) 
> ############################################
> 
> But when trying to actually log in to the client, I receive the following:
> 
> 2018-11-06 10:52:20,465 INFO? [stdout] (default task-1891) 
> ############################################ APP1
> 2018-11-06 10:52:20,465 INFO? [stdout] (default task-1891) 
> ############################################
> 2018-11-06 10:52:20,465 INFO? [stdout] (default task-1891)? We are here!!!
> 2018-11-06 10:52:20,466 INFO? [stdout] (default task-1891) 
> ############################################
> 2018-11-06 10:52:20,474 INFO? [stdout] (default task-1891) 
> ############################################ APP1
> 2018-11-06 10:52:20,474 INFO? [stdout] (default task-1891) 
> ############################################
> 2018-11-06 10:52:20,474 INFO? [stdout] (default task-1891)? We are here!!!
> 2018-11-06 10:52:20,475 INFO? [stdout] (default task-1891) 
> ############################################
> 2018-11-06 10:52:20,691 ERROR
> [org.keycloak.protocol.oidc.mappers.ScriptBasedOIDCProtocolMapper]
> (default task-1891) Error during execution of ProtocolMapper script: 
> org.keycloak.scripting.ScriptExecutionException: Could not execute 
> script 'token-mapper-script_filteredGroupsMapper' problem was:
> TypeError: null has no such function "toUpperCase" in <eval> at line 
> number 31
> 
> Line 31 is as follows:
> 
> 31:??? var client = token.getIssuedFor().toUpperCase();
> 32:??? print("############################################ " + 
> client);
> 
> So why does it display an error, when in fact it also displays the correct form of the clientId in upper case? And why is the log entry duplicated? ATM, I removed the client scope mapper and have recreated the script mapper only for this client.
> 
> 
> Regards,
> Ronald
> 
> 
> -----Original Message-----
> From: Ronald Demneri
> Sent: 06.Nov.2018 11:05 AM
> > > To: 'Ronald Demneri' <ronald.demneri at amdtia.com>; 'Dmitry Telegin' 
> > > <dt at acutus.pro>; 'keycloak-user at lists.jboss.org' 
> > > <keycloak-user at lists.jboss.org>
> Subject: RE: [keycloak-user] filter group claim in token per client
> 
> Hello Dmitry,
> 
> A colleague of mine helped solving the issue with the array, and I can see the filtered groups in the Access token. I also used token.getIssuedFor() to get the client name and make the evaluation of the filtered groups dynamic. The problem now is that this new claim is not present in the userinfo. This is the script that we came up with (configured both as client scopes (possibly define as a default client scope) as well as script mapper specific to this client for test purposes - claim names are different of course):
> 
> > [kcadmin at keycloak bin]$ ./kcadm.sh get client-scopes [ {
> ? "id" : "4ea94866-044e-4590-a2da-f25c980f08b4",
> ? "name" : "Filtered_Groups",
> ? "protocol" : "openid-connect",
> ? "attributes" : {
> ??? "display.on.consent.screen" : "true"
> ? },
> ? "protocolMappers" : [ {
> ??? "id" : "7d3c521a-b291-4f43-ad87-6891ed9584d3",
> ??? "name" : "Filtered Groups",
> ??? "protocol" : "openid-connect",
> ??? "protocolMapper" : "oidc-script-based-protocol-mapper",
> ??? "consentRequired" : false,
> ??? "config" : {
> ????? "multivalued" : "true",
> ????? "userinfo.token.claim" : "true",
> ????? "id.token.claim" : "true",
> ????? "access.token.claim" : "true",
> ????? "claim.name" : "fGroup",
> ????? "jsonType.label" : "String",
> ????? "script" : "/**
> ??????? * Available variables:
> ??????? * user - the current user
> ??????? * realm - the current realm
> ??????? * token - the current token
> ??????? * userSession - the current userSession
> ??????? * keycloakSession - the current userSession
> ??????? */
> ????????
> ??????? //insert your code here...
> 
> ??????? //So, first we need to know, how many names should be added to 
> the new claim,
> ??????? var username = user ? user.username : \"anonymous\";
> ??????? var groups = user.getGroups();
> ??????? var group_array = groups.toArray();
> ??????? //print(\"########################################## \" + 
> username);
> 
> ??????? var client = token.getIssuedFor();
> ??????? //print(\"############################################ \" + 
> client);
> 
> ??????? var clUp = client.toUpperCase();
> ??????? //print(clUp);
> 
> ??????? var group_APP = \"APP-\" + clUp + \"-USERS\";
> ??????? var group_ROL = \"ROL_SSO-\" + clUp + \"-ADMIN\";
> 
> ??????? var group_filtered = [];
> 
> ??????? for (var i in group_array) {
> ??????????????? var gn = group_array[i].getName();
> ??????????????? var gnUp = gn.toUpperCase();
> ??????????????? if (gnUp === group_APP || gnUp === group_ROL) {
> ??????????????????????? group_filtered.push(\"/\" + gn);
> ??????????????????????? }
> ??????????????? }
> ??????? //Then we declare the new array.
> ??????? var l = group_filtered.length;
> ??????? var group_token =
> java.lang.reflect.Array.newInstance(java.lang.String.class, l);
> 
> ??????? for (var f in group_filtered) {
> ??????????????? group_token[f] = group_filtered[f];
> ??????????????? //print(group_token[f]);
> ??????? }
> 
> ??????? //And submit the array as token
> ??????? token.setOtherClaims(\"fGroup\", group_token);"
> ??? }
> ? } ]
> }
> 
> This is the userinfo data for my account:
> 
> {
> ? "sub": "bad7ff26-2a70-446f-a635-06fdbe1bec55",
> ? "Group": [
> ??? "/APP-App1-Users/TGR-Team-ABC",
> ??? "/APP-App1-Users/TGR-Team-DEF",
> ??? "/APP-App1-Users",
> ??? "/APP-MySmallApp-Users"
> ? ],
> ? "email_verified": false,
> ? "name": "Ronald Demneri",
> ? "preferred_username": "u151302",
> ? "given_name": "Ronald",
> ? "family_name": "Demneri"
> 
> 
> The group claim is inserted by the group mapper created for this client, and the idea is to remove it once the script mapper works as expected.
> What do you think is going on? Is this behavior normal?
> 
> Thanks in advance,
> Ronald
> 
> -----Original Message-----
> From: Ronald Demneri
> Sent: 05.Nov.2018 12:12 PM
> > To: 'Ronald Demneri' <ronald.demneri at amdtia.com>; Dmitry Telegin 
> > <dt at acutus.pro>; keycloak-user at lists.jboss.org
> Subject: RE: [keycloak-user] filter group claim in token per client
> 
> Hello,
> 
> In the script authenticator there was authenticationSession which I used to get the clientId. There is no such variable in the script mapper, and If I define such mapper in the client template, I suppose I'd need some mechanism to get the client name and then make the filtering of the groups that need to be inserted in the token. How do I do that? Is there any documentation available for this online?
> 
> 
> Thanks again for your support!
> Ronald
> 
> 
> -----Original Message-----
> > From: keycloak-user-bounces at lists.jboss.org
> > <keycloak-user-bounces at lists.jboss.org> On Behalf Of Ronald Demneri
> Sent: 05.Nov.2018 11:00 AM
> > To: Dmitry Telegin <dt at acutus.pro>; keycloak-user at lists.jboss.org
> Subject: Re: [keycloak-user] filter group claim in token per client
> 
> Hello Dmitry,
> 
> Thanks for the response. In fact I tried that before posting here, created a custom script mapper for the client that I have configured. The problem is that the script will return a list of objects, not an array of strings, which is what I am expecting.
> 
> What do I need to pay extra attention in order to solve this?
> 
> 
> Thanks in advance and Regards,
> Ronald
> 
> -----Original Message-----
> > From: Dmitry Telegin <dt at acutus.pro>
> Sent: 05.Nov.2018 6:54 AM
> > To: Ronald Demneri <ronald.demneri at amdtia.com>; 
> > keycloak-user at lists.jboss.org
> Subject: Re: [keycloak-user] filter group claim in token per client
> 
> Hello Ronald,
> 
> As in the case with authentication, JavaScript is to the rescue again :) You can create a script mapper for groups that will do additional group filtering based on the client, and use it instead of the built-in one.
> 
> To avoid explicitly configuring it for each and every client, you can create a Client Scope (can be called "Client Template" depending on the KC version), define the mapper in the scope, and add it do default scopes.
> 
> Cheers,
> Dmitry Telegin
> CTO, Acutus s.r.o.
> Keycloak Consulting and Training
> 
> Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
> +42 (022) 888-30-71
> > E-mail: info at acutus.pro
> 
> On Fri, 2018-11-02 at 10:30 +0000, Ronald Demneri wrote:
> > Hello everyone,
> >?
> > Is there a way to filter the groups a user is a member of per client, based on clientId (which is part of the group name(s) in AD). Let's say that user Ronald is member of??group_client1, group_client2 and group_client3, so using a group mapper, the token will contain a claim like group:["group_client1", "group_client2", "group_client3"]. Upon logging in to client1 app, I want to customize the group claim so that it contains only the respective group_client1 value.
> >?
> > Thanks in advance,
> >?
> > Ronald
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
> 
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user


From marian.petrik at esgroup.ch  Thu Nov 15 04:06:54 2018
From: marian.petrik at esgroup.ch (Marian Petrik)
Date: Thu, 15 Nov 2018 09:06:54 +0000
Subject: [keycloak-user] multitenant login with Keyclaok OpenID connect
	providers
Message-ID: <VI1PR0502MB39972F97ECDB8DCFDEEAFB4B91DC0@VI1PR0502MB3997.eurprd05.prod.outlook.com>

Dear Keycloak team,


I have a multitenant keycloak setup with dedicated tenant realms. The goal is to have a single login page and pick the target realm automatically based on the domain in the user email. Can this be achieved in keycloak?


My idea is to create an extra LOGIN realm with keycloak OIDC provider for each tenant realm. Client would only use this single LOGIN realm. The issue is how to get rid of the realm selection and implement custom authentication flow. Is this the right way to do this?


Kind regards,

Maran Petrik


From msakho at redhat.com  Thu Nov 15 04:12:16 2018
From: msakho at redhat.com (Meissa M'baye Sakho)
Date: Thu, 15 Nov 2018 10:12:16 +0100
Subject: [keycloak-user] ldaps configuration --> Bug or regression with ldap
	connection ulr
Message-ID: <CAF83W6L7Tz2w-1cOwUubk5bY16G3z_N8rn27PMmp9g-bZZyK2g@mail.gmail.com>

Hello everyone,
I'm facing a very strange behaviour using keycloak 4.5 Final while
configuring my realm user federation with ldaps.
When I set the ldap connection URL to ldaps://myldaphost. It works fine.
When I change it to LDAPS://myldaphost, the test connexion fails with the
exception below (extract):

*KC-SERVICES0055: Error when connecting to LDAP:
intra-dev01.bdf-dev01.local:636: javax.naming.CommunicationException:
intra-dev01.bdf-dev01.local:636 [Root exception is
javax.net.ssl.SSLHandshakeException:
sun.security.validator.ValidatorException: PKIX path building failed:
sun.security.provider.certpath.SunCertPathBuilderException: unable to find
valid certification path to requested target]*
*        at com.sun.jndi.ldap.Connection.<init>(Connection.java:238)*
*        at com.sun.jndi.ldap.LdapClient.<init>(LdapClient.java:137)*
*        at com.sun.jndi.ldap.LdapClient.getInstance(LdapClient.java:1615)*
*        at com.sun.jndi.ldap.LdapCtx.connect(LdapCtx.java:2749)*
*        at com.sun.jndi.ldap.LdapCtx.<init>(LdapCtx.java:319)*
*        at
com.sun.jndi.ldap.LdapCtxFactory.getUsingURL(LdapCtxFactory.java:192)*
*        at
com.sun.jndi.ldap.LdapCtxFactory.getUsingURLs(LdapCtxFactory.java:210)*

* Caused by: javax.net.ssl.SSLHandshakeException:
sun.security.validator.ValidatorException: PKIX path building failed:
sun.security.provider.certpath.SunCertPathBuilderException: unable to find
valid certification path to requested target*
*        at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)*
*        at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1964)*

With Keycloak 3.4.3Final, I used LDAPS without any problem.
Any advice?
Meissa

From Ori.Doolman at amdocs.com  Thu Nov 15 04:15:07 2018
From: Ori.Doolman at amdocs.com (Ori Doolman)
Date: Thu, 15 Nov 2018 09:15:07 +0000
Subject: [keycloak-user] SSO experience
In-Reply-To: <1542220463.2133.9.camel@acutus.pro>
References: <AM0PR06MB55401025C96174BB7FE8465F92C30@AM0PR06MB5540.eurprd06.prod.outlook.com>
	<1542220463.2133.9.camel@acutus.pro>
Message-ID: <AM0PR06MB554092D546413DC77E09919492DC0@AM0PR06MB5540.eurprd06.prod.outlook.com>

Hi Dmitry,
Thank you for answering.
In fact, the desktop app is not yet integrated to Keycloak and it is work to be done. 
I'm not familiar with the desktop app since it is a 3rd party app not written by us. If Java based, I thought of using one of the Keycloak Java adapters. If not, just get the token with an HTTP[S] call (which seems that this is also what kcinit and KeycloakInstalled are doing as well).
I was not familiar with kcinit or KeycloakInstalled before. 
KeycloakInstalled might be a solution, but with limitations:
1) The desktop app must be written in Java.
2) It must be acceptable by the app designers to launch a browser for login. 
3) If I understand correctly, it only performs a client level authentication, not supporting username/password credentials authentication.

That leads me to the original question - can I have SSO without using cookies, and by simply send the token to my web app as part of the starting URL (the desktop app will launch the web app in a browser)?


Thanks,

Ori Doolman
Lead Software Architect
Amdocs Optima

+972 9 778 6914 (office)
+972 50 9111442 (mobile)



-----Original Message-----
From: Dmitry Telegin <dt at acutus.pro> 
Sent: Wednesday, November 14, 2018 20:34
To: Ori Doolman <Ori.Doolman at Amdocs.com>; keycloak-user at lists.jboss.org
Subject: Re: [keycloak-user] SSO experience

Hello Ori,

How do you implement SSO for your desktop application? Are you using kcinit [1] or KeycloakInstalled [2]?

Both will do interactive login via the system browser, that means, SSO cookies should be shared with whatever web application that is run therein.

Cheers,
Dmitry Telegin
CTO, Acutus s.r.o.
Keycloak Consulting and Training

Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
+42 (022) 888-30-71
E-mail: info at acutus.pro

[1] https://github.com/keycloak/kcinit
[2] https://www.keycloak.org/docs/latest/securing_apps/index.html#_installed_adapter

On Wed, 2018-11-14 at 10:36 +0000, Ori Doolman wrote:
> Hi,
> I have 2 applications: one is desktop (Windows) and the other one is a web application.
> My desktop application performs authentication and login using Keycloak, and getting a JWT Access Token.
> My web application is using the Keycloak JS adapter to perform the same.
> 
> After I login to my desktop application, is there a way to pass the generated access token to the web application and continue the same session? Or at least have an SSO experience and get another token for the user without the user entering the credentials again?
> 
> 
> 
> Maybe I can pass the token and refresh token from desktop application as init parameters to the Keycloak-JS ?
> I see the following code is checking if initOptions contains the token:
> 
> 
> ????????????function processInit() {
> ????????????????var callback = parseCallback(window.location.href);
> 
> ????????????????if (callback) {
> ????????????????????window.history.replaceState({}, null, callback.newUrl);
> ????????????????}
> 
> ????????????????if (callback && callback.valid) {
> ????????????????????return setupCheckLoginIframe().success(function() {
> ????????????????????????processCallback(callback, initPromise);
> ????????????????????}).error(function (e) {
> ????????????????????????initPromise.setError();
> ????????????????????});
> ????????????????} else if (initOptions) {
> ????????????????????if (initOptions.token && initOptions.refreshToken) {
> ????????????????????????setToken(initOptions.token, initOptions.refreshToken, initOptions.idToken);
> 
> 
> 
> 
> 
> 
> Thanks,
> 
> Ori Doolman
> Lead Software Architect
> Amdocs Optima
> 
> 
> > [cid:image001.png at 01D2C8DE.BFF33E10]
> 
> ?Amdocs? email platform is based on a third-party, worldwide, cloud-based system. Any emails sent to Amdocs will be processed and stored using such system and are accessible by third party providers of such system on a limited basis. Your sending of emails to Amdocs evidences your consent to the use of such system and such processing, storing and access?.
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
?Amdocs? email platform is based on a third-party, worldwide, cloud-based system. Any emails sent to Amdocs will be processed and stored using such system and are accessible by third party providers of such system on a limited basis. Your sending of emails to Amdocs evidences your consent to the use of such system and such processing, storing and access?.


From slaskawi at redhat.com  Thu Nov 15 04:37:02 2018
From: slaskawi at redhat.com (Sebastian Laskawiec)
Date: Thu, 15 Nov 2018 10:37:02 +0100
Subject: [keycloak-user] Keycloak 4.6.0.Final released
In-Reply-To: <9721fa600ae28dd56d6eecabe76ec884@couralet.eu>
References: <CAJgngAc2vsKfyM7s9MEhrbNBvmBgRpdYyUY29Js6Cw5gS62+Rg@mail.gmail.com>
	<9721fa600ae28dd56d6eecabe76ec884@couralet.eu>
Message-ID: <CAA9R9O6ZSj3Yrn30Wk6YwP+cA+EH3q-VdgATM8tSPKY_3KLnjg@mail.gmail.com>

Adding +Pedro Ruivo <pruivo at redhat.com>.

It seems you lost some of the transactions. This those are volatile data,
you should be fine. The only thing you might do (if it's not too late) is
to flush the caches from Keycloak admin panel... just in case...

On Thu, Nov 15, 2018 at 9:30 AM C?dric Couralet <cedric at couralet.eu> wrote:

> Le 2018-11-15 08:55, Stian Thorgersen a ?crit :
> > http://blog.keycloak.org/2018/11/keycloak-460final-released.html
> > _______________________________________________
>
> Hi all,
>
> When updating the docker image, I had a lot of warning in log (stack
> trace in bottom). This is related to infinispan apparently. Everything
> seems to work fine, but should I be worried?
>
>
>
> 08:11:49,642 WARN  [org.infinispan.statetransfer.StateConsumerImpl]
> (transport-thread--p19-t3) ISPN000209: Failed to retrieve transactions
> of cache client-mappings from node cba19ca69fd1, segments {0-255}:
> org.infinispan.remoting.RemoteException: ISPN000217: Received exception
> from cba19ca69fd1, see cause for remote stack trace
>         at
>
> org.infinispan.remoting.transport.ResponseCollectors.wrapRemoteException(ResponseCollectors.java:27)
>         at
>
> org.infinispan.remoting.transport.ValidSingleResponseCollector.withException(ValidSingleResponseCollector.java:37)
>         at
>
> org.infinispan.remoting.transport.ValidSingleResponseCollector.addResponse(ValidSingleResponseCollector.java:21)
>         at
>
> org.infinispan.remoting.transport.impl.SingleTargetRequest.receiveResponse(SingleTargetRequest.java:52)
>         at
>
> org.infinispan.remoting.transport.impl.SingleTargetRequest.onResponse(SingleTargetRequest.java:35)
>         at
>
> org.infinispan.remoting.transport.impl.RequestRepository.addResponse(RequestRepository.java:52)
>         at
>
> org.infinispan.remoting.transport.jgroups.JGroupsTransport.processResponse(JGroupsTransport.java:1370)
>         at
>
> org.infinispan.remoting.transport.jgroups.JGroupsTransport.processMessage(JGroupsTransport.java:1273)
>         at
>
> org.infinispan.remoting.transport.jgroups.JGroupsTransport.access$300(JGroupsTransport.java:125)
>         at
>
> org.infinispan.remoting.transport.jgroups.JGroupsTransport$ChannelCallbacks.up(JGroupsTransport.java:1418)
>         at org.jgroups.JChannel.up(JChannel.java:816)
>         at
> org.jgroups.fork.ForkProtocolStack.up(ForkProtocolStack.java:134)
>         at org.jgroups.stack.Protocol.up(Protocol.java:340)
>         at org.jgroups.protocols.FORK.up(FORK.java:134)
>         at org.jgroups.protocols.FRAG2.up(FRAG2.java:177)
>         at org.jgroups.protocols.FlowControl.up(FlowControl.java:343)
>         at org.jgroups.protocols.pbcast.GMS.up(GMS.java:873)
>         at org.jgroups.protocols.pbcast.STABLE.up(STABLE.java:240)
>         at
> org.jgroups.protocols.UNICAST3.deliverMessage(UNICAST3.java:1003)
>         at
> org.jgroups.protocols.UNICAST3.handleDataReceived(UNICAST3.java:729)
>         at org.jgroups.protocols.UNICAST3.up(UNICAST3.java:384)
>         at org.jgroups.protocols.pbcast.NAKACK2.up(NAKACK2.java:600)
>         at org.jgroups.protocols.VERIFY_SUSPECT.up(VERIFY_SUSPECT.java:130)
>         at org.jgroups.protocols.FD.up(FD.java:212)
>         at org.jgroups.protocols.FD_SOCK.up(FD_SOCK.java:253)
>         at org.jgroups.protocols.MERGE3.up(MERGE3.java:280)
>         at org.jgroups.protocols.Discovery.up(Discovery.java:269)
>         at org.jgroups.protocols.TP.passMessageUp(TP.java:1248)
>         at
>
> org.jgroups.util.SubmitToThreadPool$SingleMessageHandler.run(SubmitToThreadPool.java:87)
>         at
>
> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
>         at
>
> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
>         at
>
> org.jboss.as.clustering.jgroups.ClassLoaderThreadFactory.lambda$newThread$0(ClassLoaderThreadFactory.java:52)
>         at java.lang.Thread.run(Thread.java:748)
>         Suppressed: org.infinispan.util.logging.TraceException
>                 at
>
> org.infinispan.remoting.rpc.RpcManagerImpl.blocking(RpcManagerImpl.java:268)
>                 at
>
> org.infinispan.statetransfer.StateConsumerImpl.getTransactions(StateConsumerImpl.java:916)
>                 at
>
> org.infinispan.statetransfer.StateConsumerImpl.requestTransactions(StateConsumerImpl.java:829)
>                 at
>
> org.infinispan.statetransfer.StateConsumerImpl.addTransfers(StateConsumerImpl.java:767)
>                 at
>
> org.infinispan.statetransfer.StateConsumerImpl.handleSegments(StateConsumerImpl.java:470)
>                 at
>
> org.infinispan.statetransfer.StateConsumerImpl.onTopologyUpdate(StateConsumerImpl.java:362)
>                 at
>
> org.infinispan.statetransfer.StateTransferManagerImpl.doTopologyUpdate(StateTransferManagerImpl.java:197)
>                 at
>
> org.infinispan.statetransfer.StateTransferManagerImpl.access$000(StateTransferManagerImpl.java:54)
>                 at
>
> org.infinispan.statetransfer.StateTransferManagerImpl$1.rebalance(StateTransferManagerImpl.java:117)
>                 at
>
> org.infinispan.topology.LocalTopologyManagerImpl.doHandleRebalance(LocalTopologyManagerImpl.java:517)
>                 at
>
> org.infinispan.topology.LocalTopologyManagerImpl.lambda$handleRebalance$3(LocalTopologyManagerImpl.java:475)
>                 at
> org.infinispan.executors.LimitedExecutor.runTasks(LimitedExecutor.java:175)
>                 at
>
> org.infinispan.executors.LimitedExecutor.access$100(LimitedExecutor.java:37)
>                 at
>
> org.infinispan.executors.LimitedExecutor$Runner.run(LimitedExecutor.java:227)
>                 at
>
> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
>                 at
>
> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
>                 at
>
> org.wildfly.clustering.service.concurrent.ClassLoaderThreadFactory.lambda$newThread$0(ClassLoaderThreadFactory.java:47)
>                 ... 1 more
> Caused by: java.io.IOException: Unknown type: 132
>         at
>
> org.infinispan.marshall.core.GlobalMarshaller.readNonNullableObject(GlobalMarshaller.java:681)
>         at
>
> org.infinispan.marshall.core.GlobalMarshaller.readNullableObject(GlobalMarshaller.java:355)
>         at
>
> org.infinispan.marshall.core.BytesObjectInput.readObject(BytesObjectInput.java:40)
>         at
>
> org.infinispan.commons.marshall.MarshallUtil.unmarshallCollectionUnbounded(MarshallUtil.java:302)
>         at
>
> org.infinispan.statetransfer.StateRequestCommand.readFrom(StateRequestCommand.java:197)
>         at
>
> org.infinispan.marshall.exts.ReplicableCommandExternalizer.readCommandParameters(ReplicableCommandExternalizer.java:104)
>         at
>
> org.infinispan.marshall.exts.CacheRpcCommandExternalizer.readObject(CacheRpcCommandExternalizer.java:130)
>         at
>
> org.infinispan.marshall.exts.CacheRpcCommandExternalizer.readObject(CacheRpcCommandExternalizer.java:65)
>         at
>
> org.infinispan.marshall.core.GlobalMarshaller.readWithExternalizer(GlobalMarshaller.java:688)
>         at
>
> org.infinispan.marshall.core.GlobalMarshaller.readNonNullableObject(GlobalMarshaller.java:671)
>         at
>
> org.infinispan.marshall.core.GlobalMarshaller.readNullableObject(GlobalMarshaller.java:355)
>         at
>
> org.infinispan.marshall.core.GlobalMarshaller.objectFromObjectInput(GlobalMarshaller.java:193)
>         at
>
> org.infinispan.marshall.core.GlobalMarshaller.objectFromByteBuffer(GlobalMarshaller.java:222)
>         at
>
> org.infinispan.remoting.transport.jgroups.JGroupsTransport.processRequest(JGroupsTransport.java:1278)
>         at
>
> org.infinispan.remoting.transport.jgroups.JGroupsTransport.processMessage(JGroupsTransport.java:1218)
>         at
>
> org.infinispan.remoting.transport.jgroups.JGroupsTransport.access$200(JGroupsTransport.java:123)
>         at
>
> org.infinispan.remoting.transport.jgroups.JGroupsTransport$ChannelCallbacks.receive(JGroupsTransport.java:1356)
>         at org.jgroups.JChannel.up(JChannel.java:819)
>         at
> org.jgroups.fork.ForkProtocolStack.up(ForkProtocolStack.java:134)
>         at org.jgroups.stack.Protocol.up(Protocol.java:340)
>         at org.jgroups.protocols.FORK.up(FORK.java:134)
>         at org.jgroups.protocols.FRAG2.up(FRAG2.java:177)
>         at org.jgroups.protocols.FlowControl.up(FlowControl.java:351)
>         at org.jgroups.protocols.pbcast.GMS.up(GMS.java:864)
>         at org.jgroups.protocols.pbcast.STABLE.up(STABLE.java:240)
>         at
> org.jgroups.protocols.UNICAST3.deliverMessage(UNICAST3.java:1002)
>         at
> org.jgroups.protocols.UNICAST3.handleDataReceived(UNICAST3.java:728)
>         at org.jgroups.protocols.UNICAST3.up(UNICAST3.java:383)
>         at org.jgroups.protocols.pbcast.NAKACK2.up(NAKACK2.java:600)
>         at org.jgroups.protocols.VERIFY_SUSPECT.up(VERIFY_SUSPECT.java:119)
>         at org.jgroups.protocols.FD.up(FD.java:212)
>         at org.jgroups.protocols.FD_SOCK.up(FD_SOCK.java:252)
>         at org.jgroups.protocols.MERGE3.up(MERGE3.java:276)
>         at org.jgroups.protocols.Discovery.up(Discovery.java:267)
>         ... 6 more
>
>
> C?dric
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From mposolda at redhat.com  Thu Nov 15 05:05:29 2018
From: mposolda at redhat.com (Marek Posolda)
Date: Thu, 15 Nov 2018 11:05:29 +0100
Subject: [keycloak-user] ldaps configuration --> Bug or regression with
 ldap connection ulr
In-Reply-To: <CAF83W6L7Tz2w-1cOwUubk5bY16G3z_N8rn27PMmp9g-bZZyK2g@mail.gmail.com>
References: <CAF83W6L7Tz2w-1cOwUubk5bY16G3z_N8rn27PMmp9g-bZZyK2g@mail.gmail.com>
Message-ID: <a6eca599-5903-06f8-b28e-2e67f11d503a@redhat.com>

Hi Meissa,

I don't think that we changed anything in this part related to ldaps, 
truststore SPI etc, but I could be wrong. We upgraded Wildfly, but this 
doesn't look that it is related to Wildfly upgrade (although again not 
100% sure TBH).

Also this could be a bug in Java. Are you using same Java version you 
used with Keycloak 3.4.3.Final?

Another question is, how problematic it is to change "LDAPS://" to 
"ldap://" in the configuration? Any issues with changing that in your 
environment?

Marek

On 15/11/18 10:12, Meissa M'baye Sakho wrote:
> Hello everyone,
> I'm facing a very strange behaviour using keycloak 4.5 Final while
> configuring my realm user federation with ldaps.
> When I set the ldap connection URL to ldaps://myldaphost. It works fine.
> When I change it to LDAPS://myldaphost, the test connexion fails with the
> exception below (extract):
>
> *KC-SERVICES0055: Error when connecting to LDAP:
> intra-dev01.bdf-dev01.local:636: javax.naming.CommunicationException:
> intra-dev01.bdf-dev01.local:636 [Root exception is
> javax.net.ssl.SSLHandshakeException:
> sun.security.validator.ValidatorException: PKIX path building failed:
> sun.security.provider.certpath.SunCertPathBuilderException: unable to find
> valid certification path to requested target]*
> *        at com.sun.jndi.ldap.Connection.<init>(Connection.java:238)*
> *        at com.sun.jndi.ldap.LdapClient.<init>(LdapClient.java:137)*
> *        at com.sun.jndi.ldap.LdapClient.getInstance(LdapClient.java:1615)*
> *        at com.sun.jndi.ldap.LdapCtx.connect(LdapCtx.java:2749)*
> *        at com.sun.jndi.ldap.LdapCtx.<init>(LdapCtx.java:319)*
> *        at
> com.sun.jndi.ldap.LdapCtxFactory.getUsingURL(LdapCtxFactory.java:192)*
> *        at
> com.sun.jndi.ldap.LdapCtxFactory.getUsingURLs(LdapCtxFactory.java:210)*
>
> * Caused by: javax.net.ssl.SSLHandshakeException:
> sun.security.validator.ValidatorException: PKIX path building failed:
> sun.security.provider.certpath.SunCertPathBuilderException: unable to find
> valid certification path to requested target*
> *        at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)*
> *        at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1964)*
>
> With Keycloak 3.4.3Final, I used LDAPS without any problem.
> Any advice?
> Meissa
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user



From hannah.short at cern.ch  Thu Nov 15 05:13:47 2018
From: hannah.short at cern.ch (Hannah Short)
Date: Thu, 15 Nov 2018 10:13:47 +0000
Subject: [keycloak-user] Authenticated Protocol Mapper?
In-Reply-To: <1542220061.2133.7.camel@acutus.pro>
References: <B838B9AA-27B8-4518-996E-9B006102D083@cern.ch>
	<1542220061.2133.7.camel@acutus.pro>
Message-ID: <E04CDA9B-0911-4881-B00D-87B51DD97BF8@cern.ch>

Hi Dmitry, 

Thanks for your help!

> Just to make it clear: is your API secured by the same Keycloak instance? does it belong to the same realm?
Yes, both the same Keycloak instance and realm.

For the offline tokens approach, I?ve understood that they can only be generated programatically, and for a user. In our case this would be an offline token for the API (we could create a user to ?own" this token) - is there a way to generate tokens through the Keycloak UI? 

Cheers,
Hannah

> On 14 Nov 2018, at 19:27, Dmitry Telegin <dt at acutus.pro> wrote:
> 
> Hello Hannah,
> 
> Just to make it clear: is your API secured by the same Keycloak instance? does it belong to the same realm?
> 
> If so, this is probably a use case for offline tokens and/or impersonation. The idea is, the mapper is executed with Keycloak's privileges, hence no need to perform "honest" authentication; you can in fact produce any token you need to act on behalf of another identity.
> 
> However, I'd also suggest that you try to "short-circuit" the whole operation, maybe with the help of RMI/RPC. Is that possible? REST has more overhead, which can come to the fore under high load.
> 
> Cheers,
> Dmitry Telegin
> CTO, Acutus s.r.o.
> Keycloak Consulting and Training
> 
> Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
> +42 (022) 888-30-71
> E-mail: info at acutus.pro
> 
> On Wed, 2018-11-14 at 11:24 +0000, Hannah Short wrote:
>> Hi, 
>> 
>> I?d like to deploy a custom OIDC Protocol Mapper that is itself a client of Keycloak. Is this possible? 
>> 
>> The objective is for the mapper to be able to call an API that is protected also by Keycloak.
>> 
>> The current approach was for the mapper to use the Client Credentials flow to authenticate, exchange the access token for one for the API client, and use it to call the API. This works OK until I deploy the mapper to Keycloak, where it throws various exceptions and does not seem to attempt the Client Credentials flow.
>> 
>> Any guidance, including alternative approaches, would be appreciated!
>> 
>> Cheers,
>> Hannah
>> 
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user



From msakho at redhat.com  Thu Nov 15 05:16:00 2018
From: msakho at redhat.com (Meissa M'baye Sakho)
Date: Thu, 15 Nov 2018 11:16:00 +0100
Subject: [keycloak-user] ldaps configuration --> Bug or regression with
 ldap connection ulr
In-Reply-To: <a6eca599-5903-06f8-b28e-2e67f11d503a@redhat.com>
References: <CAF83W6L7Tz2w-1cOwUubk5bY16G3z_N8rn27PMmp9g-bZZyK2g@mail.gmail.com>
	<a6eca599-5903-06f8-b28e-2e67f11d503a@redhat.com>
Message-ID: <CAF83W6KkzXZyLN4YZLRcA9vr8roqaBaKMh_M_SYrQ7iM_TgUGw@mail.gmail.com>

Marek,
I'm using the same JRE.
It's not problematic at all using ldaps instead of LDAPS.
I've also been told (somewhere else) that protocols should be "lowercased".
So I will stick to ldaps.
Meissa


Le jeu. 15 nov. 2018 ? 11:05, Marek Posolda <mposolda at redhat.com> a ?crit :

> Hi Meissa,
>
> I don't think that we changed anything in this part related to ldaps,
> truststore SPI etc, but I could be wrong. We upgraded Wildfly, but this
> doesn't look that it is related to Wildfly upgrade (although again not
> 100% sure TBH).
>
> Also this could be a bug in Java. Are you using same Java version you
> used with Keycloak 3.4.3.Final?
>
> Another question is, how problematic it is to change "LDAPS://" to
> "ldap://" in the configuration? Any issues with changing that in your
> environment?
>
> Marek
>
> On 15/11/18 10:12, Meissa M'baye Sakho wrote:
> > Hello everyone,
> > I'm facing a very strange behaviour using keycloak 4.5 Final while
> > configuring my realm user federation with ldaps.
> > When I set the ldap connection URL to ldaps://myldaphost. It works fine.
> > When I change it to LDAPS://myldaphost, the test connexion fails with the
> > exception below (extract):
> >
> > *KC-SERVICES0055: Error when connecting to LDAP:
> > intra-dev01.bdf-dev01.local:636: javax.naming.CommunicationException:
> > intra-dev01.bdf-dev01.local:636 [Root exception is
> > javax.net.ssl.SSLHandshakeException:
> > sun.security.validator.ValidatorException: PKIX path building failed:
> > sun.security.provider.certpath.SunCertPathBuilderException: unable to
> find
> > valid certification path to requested target]*
> > *        at com.sun.jndi.ldap.Connection.<init>(Connection.java:238)*
> > *        at com.sun.jndi.ldap.LdapClient.<init>(LdapClient.java:137)*
> > *        at
> com.sun.jndi.ldap.LdapClient.getInstance(LdapClient.java:1615)*
> > *        at com.sun.jndi.ldap.LdapCtx.connect(LdapCtx.java:2749)*
> > *        at com.sun.jndi.ldap.LdapCtx.<init>(LdapCtx.java:319)*
> > *        at
> > com.sun.jndi.ldap.LdapCtxFactory.getUsingURL(LdapCtxFactory.java:192)*
> > *        at
> > com.sun.jndi.ldap.LdapCtxFactory.getUsingURLs(LdapCtxFactory.java:210)*
> >
> > * Caused by: javax.net.ssl.SSLHandshakeException:
> > sun.security.validator.ValidatorException: PKIX path building failed:
> > sun.security.provider.certpath.SunCertPathBuilderException: unable to
> find
> > valid certification path to requested target*
> > *        at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)*
> > *        at
> sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1964)*
> >
> > With Keycloak 3.4.3Final, I used LDAPS without any problem.
> > Any advice?
> > Meissa
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
>
>
>

From marian.petrik at esgroup.ch  Thu Nov 15 05:23:30 2018
From: marian.petrik at esgroup.ch (Marian Petrik)
Date: Thu, 15 Nov 2018 10:23:30 +0000
Subject: [keycloak-user] Realm resolution based on username (email
 address)
In-Reply-To: <2053198511.654526.1526402760358.JavaMail.apache@nm83.abv.bg>
References: <2053198511.654526.1526402760358.JavaMail.apache@nm83.abv.bg>
Message-ID: <8837df2d-e121-7525-dd9a-127b4676f11a@esgroup.ch>

Hi Pedro,

We face now similar problem, have you found a solution to this?

Best regards,

Marian



From mposolda at redhat.com  Thu Nov 15 05:43:59 2018
From: mposolda at redhat.com (Marek Posolda)
Date: Thu, 15 Nov 2018 11:43:59 +0100
Subject: [keycloak-user] Shared datastore?
In-Reply-To: <CABS93FTjHkHaZRFWKuXsFoQ50u4fAN1EFyXoTsyJRtXf4HmS3w@mail.gmail.com>
References: <CABS93FQoYAW5trxmEww9j8RsyCSmiNAxxopnvj6iHvDNM4qtjg@mail.gmail.com>
	<CABS93FTjHkHaZRFWKuXsFoQ50u4fAN1EFyXoTsyJRtXf4HmS3w@mail.gmail.com>
Message-ID: <c287e24a-5921-f96d-b6d2-9f69e681567a@redhat.com>

On 08/11/18 17:35, Nicolas Ocquidant wrote:
> My requirements are the following: store tokens emitted by KC during one
> year.
>
> I don't know how many users there are, but here are the number I get:
>    * the number of connections a week is about 700k.
>    * the number of session refresh a week is about 200k.
>
> I approximated around 1M of sessions a week, thus 52M a year.
> In memory, a user session has been estimated around 4KB (about 1KB in
> file/DB).
>
> But I guess a refresh does not create another session isn't it? And maybe
> it's possible to ask KC to delete previous emitted tokens when a new one is
> created for a same user?
No, it doesn't. It just updates lastSessionRefresh field on userSession 
and possibly timestamp on clientSession.
>
> If yes, my estimation is probably a little bit too high here, but I
> certainly have several millions of tokens to keep (and maybe dozens of
> millions).
>
> Thanks
> --nick
>
> Le mer. 7 nov. 2018 ? 18:17, Nicolas Ocquidant <nocquidant at gmail.com> a
> ?crit :
>
>> Hi,
>>
>> According to Infinispan, when passivation is disabled, every update to the
>> cache should always write to the store.
>>
>> But I can't manage to get it work with Keycloak. If I disable passivation,
>> my SQL store (Postgres) stays empty, even if the cache is full.
>>
>> So, if passivation is needed for Keycloak to write to the DB, it means
>> that the use of a shared DB is not possible...
>>
>> But this leads to another issue for me. Enable passivation without a
>> shared DB seems to imply that either 'fetch-state' or 'purge' should be
>> enabled on startup, in order for the cache to not contain stale entries.
>>
>> 15:27:44,626 WARN
>> [org.infinispan.configuration.cache.AbstractStoreConfigurationBuilder] (MSC
>> service thread 1-6) ISPN000149: Fetch persistent state and purge on startup
>> are both disabled, cache may contain stale entries on startup
>>
>> As I need to keep millions of sessions, this will considerably slow down
>> the startup of my node (when started again after a crash for instance).
>>
>> So, is shared datastore allowed in Keycloak? If yes, how to enable it?
>> Otherwise what other options do I have to improve my startup time, if
>> millions of sessions are in the store?
>>
>> Thanks
>> --nick
>>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user



From geoff at opticks.io  Thu Nov 15 05:55:20 2018
From: geoff at opticks.io (Geoffrey Cleaves)
Date: Thu, 15 Nov 2018 11:55:20 +0100
Subject: [keycloak-user] Keycloak 4.6.0.Final released
In-Reply-To: <CAA9R9O6ZSj3Yrn30Wk6YwP+cA+EH3q-VdgATM8tSPKY_3KLnjg@mail.gmail.com>
References: <CAJgngAc2vsKfyM7s9MEhrbNBvmBgRpdYyUY29Js6Cw5gS62+Rg@mail.gmail.com>
	<9721fa600ae28dd56d6eecabe76ec884@couralet.eu>
	<CAA9R9O6ZSj3Yrn30Wk6YwP+cA+EH3q-VdgATM8tSPKY_3KLnjg@mail.gmail.com>
Message-ID: <CAHzT=q8JZAOVxf3wWP2KXvxt0cX4RVG5cuYVjJ5Yek2uimLH+Q@mail.gmail.com>

I am unable to make absolutely any changes in the Admin Console since
upgrading to 4.6. Every time I click the Save button, I get "An unexpected
error occurred" message and the following log output:

10:52:20,574 DEBUG [io.undertow.request] (default I/O-16) Matched prefix
path /auth for path /auth/admin/realms/master
10:52:20,575 DEBUG [io.undertow.request.security] (default task-1)
Attempting to authenticate /auth/admin/realms/master, authentication
required: false
10:52:20,575 DEBUG [io.undertow.request.security] (default task-1)
Authentication outcome was NOT_ATTEMPTED with method
io.undertow.security.impl.CachedAuthenticatedSessionMechanism at 43579ab2 for
/auth/admin/realms/master
10:52:20,575 DEBUG [io.undertow.request.security] (default task-1)
Authentication result was ATTEMPTED for /auth/admin/realms/master
10:52:20,575 DEBUG [org.keycloak.transaction.JtaTransactionWrapper]
(default task-1) new JtaTransactionWrapper
10:52:20,575 DEBUG [org.keycloak.transaction.JtaTransactionWrapper]
(default task-1) was existing? false
10:52:20,576 DEBUG [org.jboss.resteasy.resteasy_jaxrs.i18n] (default
task-1) RESTEASY002315: PathInfo: /admin/realms/master
10:52:20,577 DEBUG [org.keycloak.services.resources.admin.AdminRoot]
(default task-1) authenticated admin access for: admin
10:52:20,578 ERROR [org.keycloak.services.error.KeycloakErrorHandler]
(default task-1) Uncaught server error: java.lang.NullPointerException
at org.keycloak.services.resources.Cors.build(Cors.java:193)
at
org.keycloak.services.resources.admin.AdminRoot.getRealmsAdmin(AdminRoot.java:211)
at sun.reflect.GeneratedMethodAccessor576.invoke(Unknown Source)
at
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)
at
org.jboss.resteasy.core.ResourceLocatorInvoker.createResource(ResourceLocatorInvoker.java:69)
at
org.jboss.resteasy.core.ResourceLocatorInvoker.createResource(ResourceLocatorInvoker.java:48)
at
org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:99)
at
org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:443)
at
org.jboss.resteasy.core.SynchronousDispatcher.lambda$invoke$4(SynchronousDispatcher.java:233)
at
org.jboss.resteasy.core.SynchronousDispatcher.lambda$preprocess$0(SynchronousDispatcher.java:139)
at
org.jboss.resteasy.core.interception.PreMatchContainerRequestContext.filter(PreMatchContainerRequestContext.java:358)
at
org.jboss.resteasy.core.SynchronousDispatcher.preprocess(SynchronousDispatcher.java:142)
at
org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:219)
at
org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:227)
at
org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56)
at
org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:791)
at
io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:74)
at
io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129)
at
org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:90)
at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61)
at
io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
at
io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84)
at
io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62)
at
io.undertow.servlet.handlers.ServletChain$1.handleRequest(ServletChain.java:68)
at
io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
at
org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78)
at
io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
at
io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:132)
at
io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57)
at
io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
at
io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)
at
io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)
at
io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)
at
io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77)
at
io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50)
at
io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)
at
io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
at
org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)
at
io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
at
org.wildfly.extension.undertow.deployment.GlobalRequestControllerHandler.handleRequest(GlobalRequestControllerHandler.java:68)
at
io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
at
io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:292)
at
io.undertow.servlet.handlers.ServletInitialHandler.access$100(ServletInitialHandler.java:81)
at
io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:138)
at
io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:135)
at
io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:48)
at
io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43)
at
org.wildfly.extension.undertow.security.SecurityContextThreadSetupAction.lambda$create$0(SecurityContextThreadSetupAction.java:105)
at
org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)
at
org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)
at
org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)
at
org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)
at
io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:272)
at
io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81)
at
io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:104)
at io.undertow.server.Connectors.executeRootHandler(Connectors.java:360)
at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:830)
at
org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35)
at
org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1985)
at
org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1487)
at
org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1378)
at java.lang.Thread.run(Thread.java:748)

10:52:20,578 DEBUG [org.keycloak.transaction.JtaTransactionWrapper]
(default task-1) JtaTransactionWrapper rollback
10:52:20,578 DEBUG [org.keycloak.transaction.JtaTransactionWrapper]
(default task-1) JtaTransactionWrapper end
10:52:20,578 DEBUG [io.undertow.request.error-response] (default task-1)
Setting error code 500 for exchange HttpServerExchange{ PUT
/auth/admin/realms/master request {X-Real-IP=[90.74.16.36],
Accept=[application/json, text/plain, */*],
Accept-Language=[en-US,en;q=0.9,es;q=0.8,ca;q=0.7,it;q=0.6],
Accept-Encoding=[gzip, deflate, br], Origin=[https://files.opticks.io],
User-Agent=[Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36],
Connection=[close], Authorization=[Bearer
eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJTdHN1M1JzUjNKWVBzWklzS2huZnlqSVZDdS1XY1JWNVRESXBtUzJQbWJjIn0.eyJqdGkiOiJkNDhiMmVkMC04NTdmLTQ5NDMtYmNiNS1mODQwMTM2MzdjNTIiLCJleHAiOjE1NDIyNzkxNzIsIm5iZiI6MCwiaWF0IjoxNTQyMjc5MTEyLCJpc3MiOiJodHRwczovL2ZpbGVzLm9wdGlja3MuaW8vYXV0aC9yZWFsbXMvbWFzdGVyIiwic3ViIjoiMGNiNmY2MGQtZjY2ZS00ZDc3LTlhN2YtYWNhOWY5NzMzOGU1IiwidHlwIjoiQmVhcmVyIiwiYXpwIjoic2VjdXJpdHktYWRtaW4tY29uc29sZSIsIm5vbmNlIjoiZDdiYzMyM2EtYzlkYS00ZjY1LTg4OGMtNTY0NjU2ZmQxNjAzIiwiYXV0aF90aW1lIjoxNTQyMjc2MjA1LCJzZXNzaW9uX3N0YXRlIjoiNDQ3OTZhNDgtN2U0Ny00NjkwLTlhYTMtNDNlNjZjNzlhZGQ1IiwiYWNyIjoiMSIsInNjb3BlIjoib3BlbmlkIHByb2ZpbGUgZW1haWwiLCJlbWFpbF92ZXJpZmllZCI6ZmFsc2UsIm5hbWUiOiJHZW9mZnJleSBDbGVhdmVzIiwicHJlZmVycmVkX3VzZXJuYW1lIjoiYWRtaW4iLCJnaXZlbl9uYW1lIjoiR2VvZmZyZXkiLCJmYW1pbHlfbmFtZSI6IkNsZWF2ZXMiLCJlbWFpbCI6Imdlb2ZmQG9wdGlja3MuaW8ifQ.F8DBdQAzGfoer1G13lH0mTrVrsLhumL2imgTPS9KdkB8oFhsHz2Jlj98DOUxUQ2Uk5vJXTVljkDdmZnLyChotqYahp-N_sj7yL5HvVLk1Hgrc4oJL7enEcmdz2Sdso4o60Skr-nB5wGeFnKj_hxA3H_2y_p7yKjGWG3B6P912l-Vq3qbAm6-6TSsbewOwv9W1GQthJpILNFBtSWdITqrDfFhIvd741t5qQnu5USQemWGryh4Wzx_yW9ySP6wIAw6iIfI8KOF5OgDoysg7QclLqFmCHR_3goBE-VczUR4MulJt7O_ITdEqSW3cO4T7i0i_odDI9wd3A6Lg6hzXpfRMg],
X-Forwarded-Proto=[https], X-Forwarded-For=[90.74.16.36],
Content-Length=[2950], Content-Type=[application/json;charset=UTF-8],
Cookie=[oc_sessionPassphrase=KktyoSFGbzCOvyEZDn1Uz%2FbfLthgd%2BdkuDuNiWXwBdoANODy1%2Ft0yjlnaAE6nYy8A9gUoERC3xDuonMLSHozCkePQ6LzeEFj9zL48Tg20Om5LHyGkHEZkQx5P33ApnjH;
nc_sameSiteCookielax=true; nc_sameSiteCookiestrict=true;
ocqxkekcn7nx=d80bbb02ce49e4ac9a1da9da665e1463; nc_username=admin;
nc_token=c7u41tnkmcY8Ph6cjOrKJqlqnOPOIvYw;
nc_session_id=d80bbb02ce49e4ac9a1da9da665e1463;
_ga=GA1.2.356341845.1542269557; _gid=GA1.2.952747941.1542269557;
intercom-session-gp3sy9ng=RjB6ZW5pMVc2RWYwRjdDeG44N1QxL0RmeU9lOHF6VFdFUS8xSGNoY29SMDIvSUxaRnNMd0xnNjFlMzZyVG9JRy0tNWZBclhadjZuRWJnc2ZhdkdZZ3J5Zz09--3c508aa794080345f94f1ac391e38eaf3ce08e86],
Referer=[https://files.opticks.io/auth/admin/master/console/], Host=[
files.opticks.io]} response {}}: java.lang.RuntimeException
at
io.undertow.server.HttpServerExchange.setStatusCode(HttpServerExchange.java:1410)
at
io.undertow.servlet.spec.HttpServletResponseImpl.setStatus(HttpServletResponseImpl.java:286)
at
org.jboss.resteasy.plugins.server.servlet.HttpServletResponseWrapper.setStatus(HttpServletResponseWrapper.java:76)
at
org.jboss.resteasy.core.ServerResponseWriter.lambda$writeNomapResponse$2(ServerResponseWriter.java:89)
at
org.jboss.resteasy.core.interception.ContainerResponseContextImpl.filter(ContainerResponseContextImpl.java:398)
at
org.jboss.resteasy.core.ServerResponseWriter.executeFilters(ServerResponseWriter.java:208)
at
org.jboss.resteasy.core.ServerResponseWriter.writeNomapResponse(ServerResponseWriter.java:85)
at
org.jboss.resteasy.core.ServerResponseWriter.writeNomapResponse(ServerResponseWriter.java:59)
at
org.jboss.resteasy.core.SynchronousDispatcher.writeException(SynchronousDispatcher.java:205)
at
org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:459)
at
org.jboss.resteasy.core.SynchronousDispatcher.lambda$invoke$4(SynchronousDispatcher.java:233)
at
org.jboss.resteasy.core.SynchronousDispatcher.lambda$preprocess$0(SynchronousDispatcher.java:139)
at
org.jboss.resteasy.core.interception.PreMatchContainerRequestContext.filter(PreMatchContainerRequestContext.java:358)
at
org.jboss.resteasy.core.SynchronousDispatcher.preprocess(SynchronousDispatcher.java:142)
at
org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:219)
at
org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:227)
at
org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56)
at
org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:791)
at
io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:74)
at
io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129)
at
org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:90)
at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61)
at
io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
at
io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84)
at
io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62)
at
io.undertow.servlet.handlers.ServletChain$1.handleRequest(ServletChain.java:68)
at
io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
at
org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78)
at
io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
at
io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:132)
at
io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57)
at
io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
at
io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)
at
io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)
at
io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)
at
io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77)
at
io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50)
at
io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)
at
io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
at
org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)
at
io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
at
org.wildfly.extension.undertow.deployment.GlobalRequestControllerHandler.handleRequest(GlobalRequestControllerHandler.java:68)
at
io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
at
io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:292)
at
io.undertow.servlet.handlers.ServletInitialHandler.access$100(ServletInitialHandler.java:81)
at
io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:138)
at
io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:135)
at
io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:48)
at
io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43)
at
org.wildfly.extension.undertow.security.SecurityContextThreadSetupAction.lambda$create$0(SecurityContextThreadSetupAction.java:105)
at
org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)
at
org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)
at
org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)
at
org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)
at
io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:272)
at
io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81)
at
io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:104)
at io.undertow.server.Connectors.executeRootHandler(Connectors.java:360)
at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:830)
at
org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35)
at
org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1985)
at
org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1487)
at
org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1378)
at java.lang.Thread.run(Thread.java:748)

10:52:26,483 DEBUG
[org.jboss.jca.core.connectionmanager.pool.validator.ConnectionValidator]
(ConnectionValidator) Notifying pools, interval: 30000
10:52:26,483 DEBUG
[org.jboss.jca.core.connectionmanager.pool.strategy.OnePool]
(ConnectionValidator) Checking for connection within frequency


I am using Docker and used the following process to upgrade:


docker pull jboss/keycloak
docker tag jboss/keycloak:latest jboss/keycloak:${LATEST_KC}
docker stop keycloak
docker rename keycloak keycloak_${OLD_KC}
docker stop postgres
docker run -it --rm -v postgres-data:/volume -v /root/backup/:/backup
alpine tar -cjf /backup/keycloak_postgres.tar.bz2 -C /volume ./
docker start postgres
docker run -d -p ${KC_IP}:8080:8080 -e DB_VENDOR=postgres -e
DB_ADDR=${PG_IP} -e DB_PORT=5432 -e DB_DATABASE=keycloak -e
DB_USER=${DB_KC_USER} -e DB_PASSWORD=${DB_KC_PASS} -e
KEYCLOAK_LOGLEVEL=DEBUG -e ROOT_LOGLEVEL=DEBUG -e
PROXY_ADDRESS_FORWARDING=true jboss/keycloak:${LATEST_KC}

Regards,
Geoffrey Cleaves







On Thu, 15 Nov 2018 at 10:40, Sebastian Laskawiec <slaskawi at redhat.com>
wrote:

> Adding +Pedro Ruivo <pruivo at redhat.com>.
>
> It seems you lost some of the transactions. This those are volatile data,
> you should be fine. The only thing you might do (if it's not too late) is
> to flush the caches from Keycloak admin panel... just in case...
>
> On Thu, Nov 15, 2018 at 9:30 AM C?dric Couralet <cedric at couralet.eu>
> wrote:
>
> > Le 2018-11-15 08:55, Stian Thorgersen a ?crit :
> > > http://blog.keycloak.org/2018/11/keycloak-460final-released.html
> > > _______________________________________________
> >
> > Hi all,
> >
> > When updating the docker image, I had a lot of warning in log (stack
> > trace in bottom). This is related to infinispan apparently. Everything
> > seems to work fine, but should I be worried?
> >
> >
> >
> > 08:11:49,642 WARN  [org.infinispan.statetransfer.StateConsumerImpl]
> > (transport-thread--p19-t3) ISPN000209: Failed to retrieve transactions
> > of cache client-mappings from node cba19ca69fd1, segments {0-255}:
> > org.infinispan.remoting.RemoteException: ISPN000217: Received exception
> > from cba19ca69fd1, see cause for remote stack trace
> >         at
> >
> >
> org.infinispan.remoting.transport.ResponseCollectors.wrapRemoteException(ResponseCollectors.java:27)
> >         at
> >
> >
> org.infinispan.remoting.transport.ValidSingleResponseCollector.withException(ValidSingleResponseCollector.java:37)
> >         at
> >
> >
> org.infinispan.remoting.transport.ValidSingleResponseCollector.addResponse(ValidSingleResponseCollector.java:21)
> >         at
> >
> >
> org.infinispan.remoting.transport.impl.SingleTargetRequest.receiveResponse(SingleTargetRequest.java:52)
> >         at
> >
> >
> org.infinispan.remoting.transport.impl.SingleTargetRequest.onResponse(SingleTargetRequest.java:35)
> >         at
> >
> >
> org.infinispan.remoting.transport.impl.RequestRepository.addResponse(RequestRepository.java:52)
> >         at
> >
> >
> org.infinispan.remoting.transport.jgroups.JGroupsTransport.processResponse(JGroupsTransport.java:1370)
> >         at
> >
> >
> org.infinispan.remoting.transport.jgroups.JGroupsTransport.processMessage(JGroupsTransport.java:1273)
> >         at
> >
> >
> org.infinispan.remoting.transport.jgroups.JGroupsTransport.access$300(JGroupsTransport.java:125)
> >         at
> >
> >
> org.infinispan.remoting.transport.jgroups.JGroupsTransport$ChannelCallbacks.up(JGroupsTransport.java:1418)
> >         at org.jgroups.JChannel.up(JChannel.java:816)
> >         at
> > org.jgroups.fork.ForkProtocolStack.up(ForkProtocolStack.java:134)
> >         at org.jgroups.stack.Protocol.up(Protocol.java:340)
> >         at org.jgroups.protocols.FORK.up(FORK.java:134)
> >         at org.jgroups.protocols.FRAG2.up(FRAG2.java:177)
> >         at org.jgroups.protocols.FlowControl.up(FlowControl.java:343)
> >         at org.jgroups.protocols.pbcast.GMS.up(GMS.java:873)
> >         at org.jgroups.protocols.pbcast.STABLE.up(STABLE.java:240)
> >         at
> > org.jgroups.protocols.UNICAST3.deliverMessage(UNICAST3.java:1003)
> >         at
> > org.jgroups.protocols.UNICAST3.handleDataReceived(UNICAST3.java:729)
> >         at org.jgroups.protocols.UNICAST3.up(UNICAST3.java:384)
> >         at org.jgroups.protocols.pbcast.NAKACK2.up(NAKACK2.java:600)
> >         at
> org.jgroups.protocols.VERIFY_SUSPECT.up(VERIFY_SUSPECT.java:130)
> >         at org.jgroups.protocols.FD.up(FD.java:212)
> >         at org.jgroups.protocols.FD_SOCK.up(FD_SOCK.java:253)
> >         at org.jgroups.protocols.MERGE3.up(MERGE3.java:280)
> >         at org.jgroups.protocols.Discovery.up(Discovery.java:269)
> >         at org.jgroups.protocols.TP.passMessageUp(TP.java:1248)
> >         at
> >
> >
> org.jgroups.util.SubmitToThreadPool$SingleMessageHandler.run(SubmitToThreadPool.java:87)
> >         at
> >
> >
> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
> >         at
> >
> >
> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
> >         at
> >
> >
> org.jboss.as.clustering.jgroups.ClassLoaderThreadFactory.lambda$newThread$0(ClassLoaderThreadFactory.java:52)
> >         at java.lang.Thread.run(Thread.java:748)
> >         Suppressed: org.infinispan.util.logging.TraceException
> >                 at
> >
> >
> org.infinispan.remoting.rpc.RpcManagerImpl.blocking(RpcManagerImpl.java:268)
> >                 at
> >
> >
> org.infinispan.statetransfer.StateConsumerImpl.getTransactions(StateConsumerImpl.java:916)
> >                 at
> >
> >
> org.infinispan.statetransfer.StateConsumerImpl.requestTransactions(StateConsumerImpl.java:829)
> >                 at
> >
> >
> org.infinispan.statetransfer.StateConsumerImpl.addTransfers(StateConsumerImpl.java:767)
> >                 at
> >
> >
> org.infinispan.statetransfer.StateConsumerImpl.handleSegments(StateConsumerImpl.java:470)
> >                 at
> >
> >
> org.infinispan.statetransfer.StateConsumerImpl.onTopologyUpdate(StateConsumerImpl.java:362)
> >                 at
> >
> >
> org.infinispan.statetransfer.StateTransferManagerImpl.doTopologyUpdate(StateTransferManagerImpl.java:197)
> >                 at
> >
> >
> org.infinispan.statetransfer.StateTransferManagerImpl.access$000(StateTransferManagerImpl.java:54)
> >                 at
> >
> >
> org.infinispan.statetransfer.StateTransferManagerImpl$1.rebalance(StateTransferManagerImpl.java:117)
> >                 at
> >
> >
> org.infinispan.topology.LocalTopologyManagerImpl.doHandleRebalance(LocalTopologyManagerImpl.java:517)
> >                 at
> >
> >
> org.infinispan.topology.LocalTopologyManagerImpl.lambda$handleRebalance$3(LocalTopologyManagerImpl.java:475)
> >                 at
> >
> org.infinispan.executors.LimitedExecutor.runTasks(LimitedExecutor.java:175)
> >                 at
> >
> >
> org.infinispan.executors.LimitedExecutor.access$100(LimitedExecutor.java:37)
> >                 at
> >
> >
> org.infinispan.executors.LimitedExecutor$Runner.run(LimitedExecutor.java:227)
> >                 at
> >
> >
> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
> >                 at
> >
> >
> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
> >                 at
> >
> >
> org.wildfly.clustering.service.concurrent.ClassLoaderThreadFactory.lambda$newThread$0(ClassLoaderThreadFactory.java:47)
> >                 ... 1 more
> > Caused by: java.io.IOException: Unknown type: 132
> >         at
> >
> >
> org.infinispan.marshall.core.GlobalMarshaller.readNonNullableObject(GlobalMarshaller.java:681)
> >         at
> >
> >
> org.infinispan.marshall.core.GlobalMarshaller.readNullableObject(GlobalMarshaller.java:355)
> >         at
> >
> >
> org.infinispan.marshall.core.BytesObjectInput.readObject(BytesObjectInput.java:40)
> >         at
> >
> >
> org.infinispan.commons.marshall.MarshallUtil.unmarshallCollectionUnbounded(MarshallUtil.java:302)
> >         at
> >
> >
> org.infinispan.statetransfer.StateRequestCommand.readFrom(StateRequestCommand.java:197)
> >         at
> >
> >
> org.infinispan.marshall.exts.ReplicableCommandExternalizer.readCommandParameters(ReplicableCommandExternalizer.java:104)
> >         at
> >
> >
> org.infinispan.marshall.exts.CacheRpcCommandExternalizer.readObject(CacheRpcCommandExternalizer.java:130)
> >         at
> >
> >
> org.infinispan.marshall.exts.CacheRpcCommandExternalizer.readObject(CacheRpcCommandExternalizer.java:65)
> >         at
> >
> >
> org.infinispan.marshall.core.GlobalMarshaller.readWithExternalizer(GlobalMarshaller.java:688)
> >         at
> >
> >
> org.infinispan.marshall.core.GlobalMarshaller.readNonNullableObject(GlobalMarshaller.java:671)
> >         at
> >
> >
> org.infinispan.marshall.core.GlobalMarshaller.readNullableObject(GlobalMarshaller.java:355)
> >         at
> >
> >
> org.infinispan.marshall.core.GlobalMarshaller.objectFromObjectInput(GlobalMarshaller.java:193)
> >         at
> >
> >
> org.infinispan.marshall.core.GlobalMarshaller.objectFromByteBuffer(GlobalMarshaller.java:222)
> >         at
> >
> >
> org.infinispan.remoting.transport.jgroups.JGroupsTransport.processRequest(JGroupsTransport.java:1278)
> >         at
> >
> >
> org.infinispan.remoting.transport.jgroups.JGroupsTransport.processMessage(JGroupsTransport.java:1218)
> >         at
> >
> >
> org.infinispan.remoting.transport.jgroups.JGroupsTransport.access$200(JGroupsTransport.java:123)
> >         at
> >
> >
> org.infinispan.remoting.transport.jgroups.JGroupsTransport$ChannelCallbacks.receive(JGroupsTransport.java:1356)
> >         at org.jgroups.JChannel.up(JChannel.java:819)
> >         at
> > org.jgroups.fork.ForkProtocolStack.up(ForkProtocolStack.java:134)
> >         at org.jgroups.stack.Protocol.up(Protocol.java:340)
> >         at org.jgroups.protocols.FORK.up(FORK.java:134)
> >         at org.jgroups.protocols.FRAG2.up(FRAG2.java:177)
> >         at org.jgroups.protocols.FlowControl.up(FlowControl.java:351)
> >         at org.jgroups.protocols.pbcast.GMS.up(GMS.java:864)
> >         at org.jgroups.protocols.pbcast.STABLE.up(STABLE.java:240)
> >         at
> > org.jgroups.protocols.UNICAST3.deliverMessage(UNICAST3.java:1002)
> >         at
> > org.jgroups.protocols.UNICAST3.handleDataReceived(UNICAST3.java:728)
> >         at org.jgroups.protocols.UNICAST3.up(UNICAST3.java:383)
> >         at org.jgroups.protocols.pbcast.NAKACK2.up(NAKACK2.java:600)
> >         at
> org.jgroups.protocols.VERIFY_SUSPECT.up(VERIFY_SUSPECT.java:119)
> >         at org.jgroups.protocols.FD.up(FD.java:212)
> >         at org.jgroups.protocols.FD_SOCK.up(FD_SOCK.java:252)
> >         at org.jgroups.protocols.MERGE3.up(MERGE3.java:276)
> >         at org.jgroups.protocols.Discovery.up(Discovery.java:267)
> >         ... 6 more
> >
> >
> > C?dric
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From mposolda at redhat.com  Thu Nov 15 05:55:38 2018
From: mposolda at redhat.com (Marek Posolda)
Date: Thu, 15 Nov 2018 11:55:38 +0100
Subject: [keycloak-user] Shared datastore?
In-Reply-To: <CAA9R9O4GmBwUrbOGDmWRyUUaduFOc0t0fDKN1qb_ZTJiysRMtg@mail.gmail.com>
References: <CABS93FQoYAW5trxmEww9j8RsyCSmiNAxxopnvj6iHvDNM4qtjg@mail.gmail.com>
	<CABS93FTjHkHaZRFWKuXsFoQ50u4fAN1EFyXoTsyJRtXf4HmS3w@mail.gmail.com>
	<CAA9R9O5OKgZqrkCXbifNoHEYOfKKV52ujycoHMOMBvq7jzNFLQ@mail.gmail.com>
	<1408145257.66131813.1541706517375.JavaMail.zimbra@redhat.com>
	<CAA9R9O4GmBwUrbOGDmWRyUUaduFOc0t0fDKN1qb_ZTJiysRMtg@mail.gmail.com>
Message-ID: <6c684abf-809f-1a16-453b-5f99dbbe6a14@redhat.com>

Yes, true. We're using SKIP_CACHE_STORE when writing to sessions. We 
never tested with CacheStores enabled.

The only store, which we're tested with, is the "remote-store" which 
we're using for the cross-datacenter setup. We have lots of places when 
we're not just writing data to the "cache" directly and let the 
"remote-store" to propagate it, but instead we obtain "remoteCache" 
instance from the underlying remote-store and CRUD data directly to 
remoteCache to have some optimizations and guaranteed consistency and 
atomicity for remoteCache operations (EG. putIfAbsent, replace etc). 
That's also the reason why we're using SKIP_CACHE_STORE flag.

Feel free to create JIRA for better support of other CacheStores.

The other possibility to workaround this (besides what Sebastian already 
mentioned) is to have JDG server and configure your cache with the 
remote-store as described in our "Cross-Datacenter setup" documentation. 
On JDG side, you can configure the JDBC store to your cache. In other 
words, the session will be always written to JDG and JDG will write it 
to the undrlying JDBC. I know this option is far from ideal (you need to 
add JDG server just to workaround things), just mentioning it for 
completeness.

Marek


On 09/11/18 14:29, Sebastian Laskawiec wrote:
> Yes, I think that could be case, I see a plenty of places where we 
> use?SKIP_CACHE_STORE.
>
> Let me ask Marek for help here since it has been implemented long 
> before I joined the team and I don't know the history behind it...
>
> On Thu, Nov 8, 2018 at 8:48 PM William Burns <wburns at redhat.com 
> <mailto:wburns at redhat.com>> wrote:
>
>
>
>     ----- Original Message -----
>     > From: "Sebastian Laskawiec" <slaskawi at redhat.com
>     <mailto:slaskawi at redhat.com>>
>     > To: "Nicolas Ocquidant" <nocquidant at gmail.com
>     <mailto:nocquidant at gmail.com>>
>     > Cc: keycloak-user at lists.jboss.org
>     <mailto:keycloak-user at lists.jboss.org>, "Will Burns Rosenquist
>     Burns" <wburns at redhat.com <mailto:wburns at redhat.com>>
>     > Sent: Thursday, November 8, 2018 12:33:47 PM
>     > Subject: Re: [keycloak-user] Shared datastore?
>     >
>     > So I think there are at least two ways to address this problem.
>     This first
>     > one is to use Offline Tokens [1]. I'm not sure if that fits into
>     your
>     > application since it requires your client applications to store
>     the token.
>     > In other words you can simply delegate this problem one layer
>     below in your
>     > system.
>     >
>     > If that doesn't work for you, yes passivation is a way to go.
>     Frankly, I
>     > haven't used passivation but from the manual I see it works hand
>     in hand
>     > with eviction [2][3]. Will (on CC) can probably correct me here,
>     but my
>     > understanding is that whenever an entry gets evicted, the
>     passivation
>     > mechanism picks it up and stores somewhere.
>
>     It does and it works, the problem is that passivation doesn't play
>     well with shared stores in Infinispan. We prevent this
>     configuration in 9.4 or newer even.
>
>     I recommended that Nicolas just use eviction and a shared store
>     without passivation. However it seems that entries are not written
>     to the store in this configuration. My guess is that KeyCloak
>     performs write operations with the SKIP_CACHE_STORE flag and
>     assumes entries will only be written to the store due to
>     passivation. Is there a reason for that?
>
>     >
>     > [1] http://blog.keycloak.org/2015/12/offline-tokens-in-keycloak.html
>     > [2]
>     >
>     http://infinispan.org/docs/stable/user_guide/user_guide.html#cache_passivation
>     > [3]
>     >
>     https://github.com/infinispan/infinispan/blob/master/core/src/test/java/org/infinispan/eviction/impl/EvictionWithPassivationTest.java#L61-L69
>     >
>     > On Thu, Nov 8, 2018 at 5:40 PM Nicolas Ocquidant
>     <nocquidant at gmail.com <mailto:nocquidant at gmail.com>>
>     > wrote:
>     >
>     > > My requirements are the following: store tokens emitted by KC
>     during one
>     > > year.
>     > >
>     > > I don't know how many users there are, but here are the number
>     I get:
>     > >? ?* the number of connections a week is about 700k.
>     > >? ?* the number of session refresh a week is about 200k.
>     > >
>     > > I approximated around 1M of sessions a week, thus 52M a year.
>     > > In memory, a user session has been estimated around 4KB (about
>     1KB in
>     > > file/DB).
>     > >
>     > > But I guess a refresh does not create another session isn't
>     it? And maybe
>     > > it's possible to ask KC to delete previous emitted tokens when
>     a new one is
>     > > created for a same user?
>     > >
>     > > If yes, my estimation is probably a little bit too high here,
>     but I
>     > > certainly have several millions of tokens to keep (and maybe
>     dozens of
>     > > millions).
>     > >
>     > > Thanks
>     > > --nick
>     > >
>     > > Le mer. 7 nov. 2018 ? 18:17, Nicolas Ocquidant
>     <nocquidant at gmail.com <mailto:nocquidant at gmail.com>> a
>     > > ?crit :
>     > >
>     > > > Hi,
>     > > >
>     > > > According to Infinispan, when passivation is disabled, every
>     update to
>     > > the
>     > > > cache should always write to the store.
>     > > >
>     > > > But I can't manage to get it work with Keycloak. If I disable
>     > > passivation,
>     > > > my SQL store (Postgres) stays empty, even if the cache is full.
>     > > >
>     > > > So, if passivation is needed for Keycloak to write to the
>     DB, it means
>     > > > that the use of a shared DB is not possible...
>     > > >
>     > > > But this leads to another issue for me. Enable passivation
>     without a
>     > > > shared DB seems to imply that either 'fetch-state' or
>     'purge' should be
>     > > > enabled on startup, in order for the cache to not contain
>     stale entries.
>     > > >
>     > > > 15:27:44,626 WARN
>     > > >
>     [org.infinispan.configuration.cache.AbstractStoreConfigurationBuilder]
>     > > (MSC
>     > > > service thread 1-6) ISPN000149: Fetch persistent state and
>     purge on
>     > > startup
>     > > > are both disabled, cache may contain stale entries on startup
>     > > >
>     > > > As I need to keep millions of sessions, this will
>     considerably slow down
>     > > > the startup of my node (when started again after a crash for
>     instance).
>     > > >
>     > > > So, is shared datastore allowed in Keycloak? If yes, how to
>     enable it?
>     > > > Otherwise what other options do I have to improve my startup
>     time, if
>     > > > millions of sessions are in the store?
>     > > >
>     > > > Thanks
>     > > > --nick
>     > > >
>     > > _______________________________________________
>     > > keycloak-user mailing list
>     > > keycloak-user at lists.jboss.org
>     <mailto:keycloak-user at lists.jboss.org>
>     > > https://lists.jboss.org/mailman/listinfo/keycloak-user
>     >
>


From geoff at opticks.io  Thu Nov 15 06:44:49 2018
From: geoff at opticks.io (Geoffrey Cleaves)
Date: Thu, 15 Nov 2018 12:44:49 +0100
Subject: [keycloak-user] Keycloak 4.6.0.Final released
In-Reply-To: <CAHzT=q8JZAOVxf3wWP2KXvxt0cX4RVG5cuYVjJ5Yek2uimLH+Q@mail.gmail.com>
References: <CAJgngAc2vsKfyM7s9MEhrbNBvmBgRpdYyUY29Js6Cw5gS62+Rg@mail.gmail.com>
	<9721fa600ae28dd56d6eecabe76ec884@couralet.eu>
	<CAA9R9O6ZSj3Yrn30Wk6YwP+cA+EH3q-VdgATM8tSPKY_3KLnjg@mail.gmail.com>
	<CAHzT=q8JZAOVxf3wWP2KXvxt0cX4RVG5cuYVjJ5Yek2uimLH+Q@mail.gmail.com>
Message-ID: <CAHzT=q-Sf0GsTgYzPuiC9XXTEZWo+NzLQ3qx4Y8tfopNUCVMeg@mail.gmail.com>

I've created this ticket: https://issues.jboss.org/browse/KEYCLOAK-8832 .
(I wish I had been more careful before pasting the log dump in the previous
email.)

On Thu, 15 Nov 2018 at 11:55, Geoffrey Cleaves <geoff at opticks.io> wrote:

> I am unable to make absolutely any changes in the Admin Console since
> upgrading to 4.6. Every time I click the Save button, I get "An unexpected
> error occurred" message and the following log output:
>
> 10:52:20,574 DEBUG [io.undertow.request] (default I/O-16) Matched prefix
> path /auth for path /auth/admin/realms/master
> 10:52:20,575 DEBUG [io.undertow.request.security] (default task-1)
> Attempting to authenticate /auth/admin/realms/master, authentication
> required: false
> 10:52:20,575 DEBUG [io.undertow.request.security] (default task-1)
> Authentication outcome was NOT_ATTEMPTED with method
> io.undertow.security.impl.CachedAuthenticatedSessionMechanism at 43579ab2
> for /auth/admin/realms/master
> 10:52:20,575 DEBUG [io.undertow.request.security] (default task-1)
> Authentication result was ATTEMPTED for /auth/admin/realms/master
> 10:52:20,575 DEBUG [org.keycloak.transaction.JtaTransactionWrapper]
> (default task-1) new JtaTransactionWrapper
> 10:52:20,575 DEBUG [org.keycloak.transaction.JtaTransactionWrapper]
> (default task-1) was existing? false
> 10:52:20,576 DEBUG [org.jboss.resteasy.resteasy_jaxrs.i18n] (default
> task-1) RESTEASY002315: PathInfo: /admin/realms/master
> 10:52:20,577 DEBUG [org.keycloak.services.resources.admin.AdminRoot]
> (default task-1) authenticated admin access for: admin
> 10:52:20,578 ERROR [org.keycloak.services.error.KeycloakErrorHandler]
> (default task-1) Uncaught server error: java.lang.NullPointerException
> at org.keycloak.services.resources.Cors.build(Cors.java:193)
> at
> org.keycloak.services.resources.admin.AdminRoot.getRealmsAdmin(AdminRoot.java:211)
> at sun.reflect.GeneratedMethodAccessor576.invoke(Unknown Source)
> at
> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
> at java.lang.reflect.Method.invoke(Method.java:498)
> at
> org.jboss.resteasy.core.ResourceLocatorInvoker.createResource(ResourceLocatorInvoker.java:69)
> at
> org.jboss.resteasy.core.ResourceLocatorInvoker.createResource(ResourceLocatorInvoker.java:48)
> at
> org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:99)
> at
> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:443)
> at
> org.jboss.resteasy.core.SynchronousDispatcher.lambda$invoke$4(SynchronousDispatcher.java:233)
> at
> org.jboss.resteasy.core.SynchronousDispatcher.lambda$preprocess$0(SynchronousDispatcher.java:139)
> at
> org.jboss.resteasy.core.interception.PreMatchContainerRequestContext.filter(PreMatchContainerRequestContext.java:358)
> at
> org.jboss.resteasy.core.SynchronousDispatcher.preprocess(SynchronousDispatcher.java:142)
> at
> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:219)
> at
> org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:227)
> at
> org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56)
> at
> org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51)
> at javax.servlet.http.HttpServlet.service(HttpServlet.java:791)
> at
> io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:74)
> at
> io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129)
> at
> org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:90)
> at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61)
> at
> io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
> at
> io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84)
> at
> io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62)
> at
> io.undertow.servlet.handlers.ServletChain$1.handleRequest(ServletChain.java:68)
> at
> io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
> at
> org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78)
> at
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
> at
> io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:132)
> at
> io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57)
> at
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
> at
> io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)
> at
> io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)
> at
> io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)
> at
> io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77)
> at
> io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50)
> at
> io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)
> at
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
> at
> org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)
> at
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
> at
> org.wildfly.extension.undertow.deployment.GlobalRequestControllerHandler.handleRequest(GlobalRequestControllerHandler.java:68)
> at
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
> at
> io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:292)
> at
> io.undertow.servlet.handlers.ServletInitialHandler.access$100(ServletInitialHandler.java:81)
> at
> io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:138)
> at
> io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:135)
> at
> io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:48)
> at
> io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43)
> at
> org.wildfly.extension.undertow.security.SecurityContextThreadSetupAction.lambda$create$0(SecurityContextThreadSetupAction.java:105)
> at
> org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)
> at
> org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)
> at
> org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)
> at
> org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)
> at
> io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:272)
> at
> io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81)
> at
> io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:104)
> at io.undertow.server.Connectors.executeRootHandler(Connectors.java:360)
> at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:830)
> at
> org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35)
> at
> org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1985)
> at
> org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1487)
> at
> org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1378)
> at java.lang.Thread.run(Thread.java:748)
>
> 10:52:20,578 DEBUG [org.keycloak.transaction.JtaTransactionWrapper]
> (default task-1) JtaTransactionWrapper rollback
> 10:52:20,578 DEBUG [org.keycloak.transaction.JtaTransactionWrapper]
> (default task-1) JtaTransactionWrapper end
> 10:52:20,578 DEBUG [io.undertow.request.error-response] (default task-1)
> Setting error code 500 for exchange HttpServerExchange{ PUT
> /auth/admin/realms/master request {X-Real-IP=[90.74.16.36],
> Accept=[application/json, text/plain, */*],
> Accept-Language=[en-US,en;q=0.9,es;q=0.8,ca;q=0.7,it;q=0.6],
> Accept-Encoding=[gzip, deflate, br], Origin=[https://files.opticks.io],
> User-Agent=[Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6)
> AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36],
> Connection=[close], Authorization=[Bearer
> eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJTdHN1M1JzUjNKWVBzWklzS2huZnlqSVZDdS1XY1JWNVRESXBtUzJQbWJjIn0.eyJqdGkiOiJkNDhiMmVkMC04NTdmLTQ5NDMtYmNiNS1mODQwMTM2MzdjNTIiLCJleHAiOjE1NDIyNzkxNzIsIm5iZiI6MCwiaWF0IjoxNTQyMjc5MTEyLCJpc3MiOiJodHRwczovL2ZpbGVzLm9wdGlja3MuaW8vYXV0aC9yZWFsbXMvbWFzdGVyIiwic3ViIjoiMGNiNmY2MGQtZjY2ZS00ZDc3LTlhN2YtYWNhOWY5NzMzOGU1IiwidHlwIjoiQmVhcmVyIiwiYXpwIjoic2VjdXJpdHktYWRtaW4tY29uc29sZSIsIm5vbmNlIjoiZDdiYzMyM2EtYzlkYS00ZjY1LTg4OGMtNTY0NjU2ZmQxNjAzIiwiYXV0aF90aW1lIjoxNTQyMjc2MjA1LCJzZXNzaW9uX3N0YXRlIjoiNDQ3OTZhNDgtN2U0Ny00NjkwLTlhYTMtNDNlNjZjNzlhZGQ1IiwiYWNyIjoiMSIsInNjb3BlIjoib3BlbmlkIHByb2ZpbGUgZW1haWwiLCJlbWFpbF92ZXJpZmllZCI6ZmFsc2UsIm5hbWUiOiJHZW9mZnJleSBDbGVhdmVzIiwicHJlZmVycmVkX3VzZXJuYW1lIjoiYWRtaW4iLCJnaXZlbl9uYW1lIjoiR2VvZmZyZXkiLCJmYW1pbHlfbmFtZSI6IkNsZWF2ZXMiLCJlbWFpbCI6Imdlb2ZmQG9wdGlja3MuaW8ifQ.F8DBdQAzGfoer1G13lH0mTrVrsLhumL2imgTPS9KdkB8oFhsHz2Jlj98DOUxUQ2Uk5vJXTVljkDdmZnLyChotqYahp-N_sj7yL5HvVLk1Hgrc4oJL7enEcmdz2Sdso4o60Skr-nB5wGeFnKj_hxA3H_2y_p7yKjGWG3B6P912l-Vq3qbAm6-6TSsbewOwv9W1GQthJpILNFBtSWdITqrDfFhIvd741t5qQnu5USQemWGryh4Wzx_yW9ySP6wIAw6iIfI8KOF5OgDoysg7QclLqFmCHR_3goBE-VczUR4MulJt7O_ITdEqSW3cO4T7i0i_odDI9wd3A6Lg6hzXpfRMg],
> X-Forwarded-Proto=[https], X-Forwarded-For=[90.74.16.36],
> Content-Length=[2950], Content-Type=[application/json;charset=UTF-8],
> Cookie=[oc_sessionPassphrase=KktyoSFGbzCOvyEZDn1Uz%2FbfLthgd%2BdkuDuNiWXwBdoANODy1%2Ft0yjlnaAE6nYy8A9gUoERC3xDuonMLSHozCkePQ6LzeEFj9zL48Tg20Om5LHyGkHEZkQx5P33ApnjH;
> nc_sameSiteCookielax=true; nc_sameSiteCookiestrict=true;
> ocqxkekcn7nx=d80bbb02ce49e4ac9a1da9da665e1463; nc_username=admin;
> nc_token=c7u41tnkmcY8Ph6cjOrKJqlqnOPOIvYw;
> nc_session_id=d80bbb02ce49e4ac9a1da9da665e1463;
> _ga=GA1.2.356341845.1542269557; _gid=GA1.2.952747941.1542269557;
> intercom-session-gp3sy9ng=RjB6ZW5pMVc2RWYwRjdDeG44N1QxL0RmeU9lOHF6VFdFUS8xSGNoY29SMDIvSUxaRnNMd0xnNjFlMzZyVG9JRy0tNWZBclhadjZuRWJnc2ZhdkdZZ3J5Zz09--3c508aa794080345f94f1ac391e38eaf3ce08e86],
> Referer=[https://files.opticks.io/auth/admin/master/console/], Host=[
> files.opticks.io]} response {}}: java.lang.RuntimeException
> at
> io.undertow.server.HttpServerExchange.setStatusCode(HttpServerExchange.java:1410)
> at
> io.undertow.servlet.spec.HttpServletResponseImpl.setStatus(HttpServletResponseImpl.java:286)
> at
> org.jboss.resteasy.plugins.server.servlet.HttpServletResponseWrapper.setStatus(HttpServletResponseWrapper.java:76)
> at
> org.jboss.resteasy.core.ServerResponseWriter.lambda$writeNomapResponse$2(ServerResponseWriter.java:89)
> at
> org.jboss.resteasy.core.interception.ContainerResponseContextImpl.filter(ContainerResponseContextImpl.java:398)
> at
> org.jboss.resteasy.core.ServerResponseWriter.executeFilters(ServerResponseWriter.java:208)
> at
> org.jboss.resteasy.core.ServerResponseWriter.writeNomapResponse(ServerResponseWriter.java:85)
> at
> org.jboss.resteasy.core.ServerResponseWriter.writeNomapResponse(ServerResponseWriter.java:59)
> at
> org.jboss.resteasy.core.SynchronousDispatcher.writeException(SynchronousDispatcher.java:205)
> at
> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:459)
> at
> org.jboss.resteasy.core.SynchronousDispatcher.lambda$invoke$4(SynchronousDispatcher.java:233)
> at
> org.jboss.resteasy.core.SynchronousDispatcher.lambda$preprocess$0(SynchronousDispatcher.java:139)
> at
> org.jboss.resteasy.core.interception.PreMatchContainerRequestContext.filter(PreMatchContainerRequestContext.java:358)
> at
> org.jboss.resteasy.core.SynchronousDispatcher.preprocess(SynchronousDispatcher.java:142)
> at
> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:219)
> at
> org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:227)
> at
> org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56)
> at
> org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51)
> at javax.servlet.http.HttpServlet.service(HttpServlet.java:791)
> at
> io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:74)
> at
> io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129)
> at
> org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:90)
> at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61)
> at
> io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
> at
> io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84)
> at
> io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62)
> at
> io.undertow.servlet.handlers.ServletChain$1.handleRequest(ServletChain.java:68)
> at
> io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
> at
> org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78)
> at
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
> at
> io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:132)
> at
> io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57)
> at
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
> at
> io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)
> at
> io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)
> at
> io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)
> at
> io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77)
> at
> io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50)
> at
> io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)
> at
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
> at
> org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)
> at
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
> at
> org.wildfly.extension.undertow.deployment.GlobalRequestControllerHandler.handleRequest(GlobalRequestControllerHandler.java:68)
> at
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
> at
> io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:292)
> at
> io.undertow.servlet.handlers.ServletInitialHandler.access$100(ServletInitialHandler.java:81)
> at
> io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:138)
> at
> io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:135)
> at
> io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:48)
> at
> io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43)
> at
> org.wildfly.extension.undertow.security.SecurityContextThreadSetupAction.lambda$create$0(SecurityContextThreadSetupAction.java:105)
> at
> org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)
> at
> org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)
> at
> org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)
> at
> org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)
> at
> io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:272)
> at
> io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81)
> at
> io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:104)
> at io.undertow.server.Connectors.executeRootHandler(Connectors.java:360)
> at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:830)
> at
> org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35)
> at
> org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1985)
> at
> org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1487)
> at
> org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1378)
> at java.lang.Thread.run(Thread.java:748)
>
> 10:52:26,483 DEBUG
> [org.jboss.jca.core.connectionmanager.pool.validator.ConnectionValidator]
> (ConnectionValidator) Notifying pools, interval: 30000
> 10:52:26,483 DEBUG
> [org.jboss.jca.core.connectionmanager.pool.strategy.OnePool]
> (ConnectionValidator) Checking for connection within frequency
>
>
> I am using Docker and used the following process to upgrade:
>
>
> docker pull jboss/keycloak
> docker tag jboss/keycloak:latest jboss/keycloak:${LATEST_KC}
> docker stop keycloak
> docker rename keycloak keycloak_${OLD_KC}
> docker stop postgres
> docker run -it --rm -v postgres-data:/volume -v /root/backup/:/backup
> alpine tar -cjf /backup/keycloak_postgres.tar.bz2 -C /volume ./
> docker start postgres
> docker run -d -p ${KC_IP}:8080:8080 -e DB_VENDOR=postgres -e
> DB_ADDR=${PG_IP} -e DB_PORT=5432 -e DB_DATABASE=keycloak -e
> DB_USER=${DB_KC_USER} -e DB_PASSWORD=${DB_KC_PASS} -e
> KEYCLOAK_LOGLEVEL=DEBUG -e ROOT_LOGLEVEL=DEBUG -e
> PROXY_ADDRESS_FORWARDING=true jboss/keycloak:${LATEST_KC}
>
> Regards,
> Geoffrey Cleaves
>
>
>
>
>
>
>
> On Thu, 15 Nov 2018 at 10:40, Sebastian Laskawiec <slaskawi at redhat.com>
> wrote:
>
>> Adding +Pedro Ruivo <pruivo at redhat.com>.
>>
>> It seems you lost some of the transactions. This those are volatile data,
>> you should be fine. The only thing you might do (if it's not too late) is
>> to flush the caches from Keycloak admin panel... just in case...
>>
>> On Thu, Nov 15, 2018 at 9:30 AM C?dric Couralet <cedric at couralet.eu>
>> wrote:
>>
>> > Le 2018-11-15 08:55, Stian Thorgersen a ?crit :
>> > > http://blog.keycloak.org/2018/11/keycloak-460final-released.html
>> > > _______________________________________________
>> >
>> > Hi all,
>> >
>> > When updating the docker image, I had a lot of warning in log (stack
>> > trace in bottom). This is related to infinispan apparently. Everything
>> > seems to work fine, but should I be worried?
>> >
>> >
>> >
>> > 08:11:49,642 WARN  [org.infinispan.statetransfer.StateConsumerImpl]
>> > (transport-thread--p19-t3) ISPN000209: Failed to retrieve transactions
>> > of cache client-mappings from node cba19ca69fd1, segments {0-255}:
>> > org.infinispan.remoting.RemoteException: ISPN000217: Received exception
>> > from cba19ca69fd1, see cause for remote stack trace
>> >         at
>> >
>> >
>> org.infinispan.remoting.transport.ResponseCollectors.wrapRemoteException(ResponseCollectors.java:27)
>> >         at
>> >
>> >
>> org.infinispan.remoting.transport.ValidSingleResponseCollector.withException(ValidSingleResponseCollector.java:37)
>> >         at
>> >
>> >
>> org.infinispan.remoting.transport.ValidSingleResponseCollector.addResponse(ValidSingleResponseCollector.java:21)
>> >         at
>> >
>> >
>> org.infinispan.remoting.transport.impl.SingleTargetRequest.receiveResponse(SingleTargetRequest.java:52)
>> >         at
>> >
>> >
>> org.infinispan.remoting.transport.impl.SingleTargetRequest.onResponse(SingleTargetRequest.java:35)
>> >         at
>> >
>> >
>> org.infinispan.remoting.transport.impl.RequestRepository.addResponse(RequestRepository.java:52)
>> >         at
>> >
>> >
>> org.infinispan.remoting.transport.jgroups.JGroupsTransport.processResponse(JGroupsTransport.java:1370)
>> >         at
>> >
>> >
>> org.infinispan.remoting.transport.jgroups.JGroupsTransport.processMessage(JGroupsTransport.java:1273)
>> >         at
>> >
>> >
>> org.infinispan.remoting.transport.jgroups.JGroupsTransport.access$300(JGroupsTransport.java:125)
>> >         at
>> >
>> >
>> org.infinispan.remoting.transport.jgroups.JGroupsTransport$ChannelCallbacks.up(JGroupsTransport.java:1418)
>> >         at org.jgroups.JChannel.up(JChannel.java:816)
>> >         at
>> > org.jgroups.fork.ForkProtocolStack.up(ForkProtocolStack.java:134)
>> >         at org.jgroups.stack.Protocol.up(Protocol.java:340)
>> >         at org.jgroups.protocols.FORK.up(FORK.java:134)
>> >         at org.jgroups.protocols.FRAG2.up(FRAG2.java:177)
>> >         at org.jgroups.protocols.FlowControl.up(FlowControl.java:343)
>> >         at org.jgroups.protocols.pbcast.GMS.up(GMS.java:873)
>> >         at org.jgroups.protocols.pbcast.STABLE.up(STABLE.java:240)
>> >         at
>> > org.jgroups.protocols.UNICAST3.deliverMessage(UNICAST3.java:1003)
>> >         at
>> > org.jgroups.protocols.UNICAST3.handleDataReceived(UNICAST3.java:729)
>> >         at org.jgroups.protocols.UNICAST3.up(UNICAST3.java:384)
>> >         at org.jgroups.protocols.pbcast.NAKACK2.up(NAKACK2.java:600)
>> >         at
>> org.jgroups.protocols.VERIFY_SUSPECT.up(VERIFY_SUSPECT.java:130)
>> >         at org.jgroups.protocols.FD.up(FD.java:212)
>> >         at org.jgroups.protocols.FD_SOCK.up(FD_SOCK.java:253)
>> >         at org.jgroups.protocols.MERGE3.up(MERGE3.java:280)
>> >         at org.jgroups.protocols.Discovery.up(Discovery.java:269)
>> >         at org.jgroups.protocols.TP.passMessageUp(TP.java:1248)
>> >         at
>> >
>> >
>> org.jgroups.util.SubmitToThreadPool$SingleMessageHandler.run(SubmitToThreadPool.java:87)
>> >         at
>> >
>> >
>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
>> >         at
>> >
>> >
>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
>> >         at
>> >
>> >
>> org.jboss.as.clustering.jgroups.ClassLoaderThreadFactory.lambda$newThread$0(ClassLoaderThreadFactory.java:52)
>> >         at java.lang.Thread.run(Thread.java:748)
>> >         Suppressed: org.infinispan.util.logging.TraceException
>> >                 at
>> >
>> >
>> org.infinispan.remoting.rpc.RpcManagerImpl.blocking(RpcManagerImpl.java:268)
>> >                 at
>> >
>> >
>> org.infinispan.statetransfer.StateConsumerImpl.getTransactions(StateConsumerImpl.java:916)
>> >                 at
>> >
>> >
>> org.infinispan.statetransfer.StateConsumerImpl.requestTransactions(StateConsumerImpl.java:829)
>> >                 at
>> >
>> >
>> org.infinispan.statetransfer.StateConsumerImpl.addTransfers(StateConsumerImpl.java:767)
>> >                 at
>> >
>> >
>> org.infinispan.statetransfer.StateConsumerImpl.handleSegments(StateConsumerImpl.java:470)
>> >                 at
>> >
>> >
>> org.infinispan.statetransfer.StateConsumerImpl.onTopologyUpdate(StateConsumerImpl.java:362)
>> >                 at
>> >
>> >
>> org.infinispan.statetransfer.StateTransferManagerImpl.doTopologyUpdate(StateTransferManagerImpl.java:197)
>> >                 at
>> >
>> >
>> org.infinispan.statetransfer.StateTransferManagerImpl.access$000(StateTransferManagerImpl.java:54)
>> >                 at
>> >
>> >
>> org.infinispan.statetransfer.StateTransferManagerImpl$1.rebalance(StateTransferManagerImpl.java:117)
>> >                 at
>> >
>> >
>> org.infinispan.topology.LocalTopologyManagerImpl.doHandleRebalance(LocalTopologyManagerImpl.java:517)
>> >                 at
>> >
>> >
>> org.infinispan.topology.LocalTopologyManagerImpl.lambda$handleRebalance$3(LocalTopologyManagerImpl.java:475)
>> >                 at
>> >
>> org.infinispan.executors.LimitedExecutor.runTasks(LimitedExecutor.java:175)
>> >                 at
>> >
>> >
>> org.infinispan.executors.LimitedExecutor.access$100(LimitedExecutor.java:37)
>> >                 at
>> >
>> >
>> org.infinispan.executors.LimitedExecutor$Runner.run(LimitedExecutor.java:227)
>> >                 at
>> >
>> >
>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
>> >                 at
>> >
>> >
>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
>> >                 at
>> >
>> >
>> org.wildfly.clustering.service.concurrent.ClassLoaderThreadFactory.lambda$newThread$0(ClassLoaderThreadFactory.java:47)
>> >                 ... 1 more
>> > Caused by: java.io.IOException: Unknown type: 132
>> >         at
>> >
>> >
>> org.infinispan.marshall.core.GlobalMarshaller.readNonNullableObject(GlobalMarshaller.java:681)
>> >         at
>> >
>> >
>> org.infinispan.marshall.core.GlobalMarshaller.readNullableObject(GlobalMarshaller.java:355)
>> >         at
>> >
>> >
>> org.infinispan.marshall.core.BytesObjectInput.readObject(BytesObjectInput.java:40)
>> >         at
>> >
>> >
>> org.infinispan.commons.marshall.MarshallUtil.unmarshallCollectionUnbounded(MarshallUtil.java:302)
>> >         at
>> >
>> >
>> org.infinispan.statetransfer.StateRequestCommand.readFrom(StateRequestCommand.java:197)
>> >         at
>> >
>> >
>> org.infinispan.marshall.exts.ReplicableCommandExternalizer.readCommandParameters(ReplicableCommandExternalizer.java:104)
>> >         at
>> >
>> >
>> org.infinispan.marshall.exts.CacheRpcCommandExternalizer.readObject(CacheRpcCommandExternalizer.java:130)
>> >         at
>> >
>> >
>> org.infinispan.marshall.exts.CacheRpcCommandExternalizer.readObject(CacheRpcCommandExternalizer.java:65)
>> >         at
>> >
>> >
>> org.infinispan.marshall.core.GlobalMarshaller.readWithExternalizer(GlobalMarshaller.java:688)
>> >         at
>> >
>> >
>> org.infinispan.marshall.core.GlobalMarshaller.readNonNullableObject(GlobalMarshaller.java:671)
>> >         at
>> >
>> >
>> org.infinispan.marshall.core.GlobalMarshaller.readNullableObject(GlobalMarshaller.java:355)
>> >         at
>> >
>> >
>> org.infinispan.marshall.core.GlobalMarshaller.objectFromObjectInput(GlobalMarshaller.java:193)
>> >         at
>> >
>> >
>> org.infinispan.marshall.core.GlobalMarshaller.objectFromByteBuffer(GlobalMarshaller.java:222)
>> >         at
>> >
>> >
>> org.infinispan.remoting.transport.jgroups.JGroupsTransport.processRequest(JGroupsTransport.java:1278)
>> >         at
>> >
>> >
>> org.infinispan.remoting.transport.jgroups.JGroupsTransport.processMessage(JGroupsTransport.java:1218)
>> >         at
>> >
>> >
>> org.infinispan.remoting.transport.jgroups.JGroupsTransport.access$200(JGroupsTransport.java:123)
>> >         at
>> >
>> >
>> org.infinispan.remoting.transport.jgroups.JGroupsTransport$ChannelCallbacks.receive(JGroupsTransport.java:1356)
>> >         at org.jgroups.JChannel.up(JChannel.java:819)
>> >         at
>> > org.jgroups.fork.ForkProtocolStack.up(ForkProtocolStack.java:134)
>> >         at org.jgroups.stack.Protocol.up(Protocol.java:340)
>> >         at org.jgroups.protocols.FORK.up(FORK.java:134)
>> >         at org.jgroups.protocols.FRAG2.up(FRAG2.java:177)
>> >         at org.jgroups.protocols.FlowControl.up(FlowControl.java:351)
>> >         at org.jgroups.protocols.pbcast.GMS.up(GMS.java:864)
>> >         at org.jgroups.protocols.pbcast.STABLE.up(STABLE.java:240)
>> >         at
>> > org.jgroups.protocols.UNICAST3.deliverMessage(UNICAST3.java:1002)
>> >         at
>> > org.jgroups.protocols.UNICAST3.handleDataReceived(UNICAST3.java:728)
>> >         at org.jgroups.protocols.UNICAST3.up(UNICAST3.java:383)
>> >         at org.jgroups.protocols.pbcast.NAKACK2.up(NAKACK2.java:600)
>> >         at
>> org.jgroups.protocols.VERIFY_SUSPECT.up(VERIFY_SUSPECT.java:119)
>> >         at org.jgroups.protocols.FD.up(FD.java:212)
>> >         at org.jgroups.protocols.FD_SOCK.up(FD_SOCK.java:252)
>> >         at org.jgroups.protocols.MERGE3.up(MERGE3.java:276)
>> >         at org.jgroups.protocols.Discovery.up(Discovery.java:267)
>> >         ... 6 more
>> >
>> >
>> > C?dric
>> > _______________________________________________
>> > keycloak-user mailing list
>> > keycloak-user at lists.jboss.org
>> > https://lists.jboss.org/mailman/listinfo/keycloak-user
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
>

From Ondrej.Scerba at zoomint.com  Thu Nov 15 07:00:50 2018
From: Ondrej.Scerba at zoomint.com (Ondrej Scerba)
Date: Thu, 15 Nov 2018 12:00:50 +0000
Subject: [keycloak-user] Spring Boot Multitenancy
Message-ID: <4c2b88d59d5f4c27966ee669a798fe1b@zoomint.com>

Hi,

I'm trying to implement multitenant Spring Boot application using Spring Security Adapter.

I'm able to authenticate based on path to correct realm. Now I want to protect endpoints based on realm.

How can I achieve it? E.g. endpoint /realm/Customer1/users will be accessible only for authenticated user which belongs to realm Customer1 and endpoint /realm/Customer2/users will be accessible only for authenticated user which belongs to realm Customer2?

Thanks,
Ondrej



From Ondrej.Scerba at zoomint.com  Thu Nov 15 07:02:36 2018
From: Ondrej.Scerba at zoomint.com (Ondrej Scerba)
Date: Thu, 15 Nov 2018 12:02:36 +0000
Subject: [keycloak-user] Spring Boot Multitenancy
Message-ID: <584e3f933ef842ed896e39c59d5a1906@zoomint.com>

Hi,

I'm trying to implement multitenant Spring Boot application using Spring Security Adapter.

I'm able to authenticate based on path to correct realm. Now I want to protect endpoints based on realm.

How can I achieve it? E.g. endpoint /realm/Customer1/users will be accessible only for authenticated user which belongs to realm Customer1 and endpoint /realm/Customer2/users will be accessible only for authenticated user which belongs to realm Customer2?

Thanks,
Ondrej



From geoff at opticks.io  Thu Nov 15 09:46:39 2018
From: geoff at opticks.io (Geoffrey Cleaves)
Date: Thu, 15 Nov 2018 15:46:39 +0100
Subject: [keycloak-user] End user sharing of his resource removes
 permission to his resource
In-Reply-To: <CAJrcDBcSzgvpScK_M7Ru0woQoAA9sfYWMv9Z7ZHw6ezb16v5SA@mail.gmail.com>
References: <CAHzT=q8yaw7wPEzRh=FST4cmWEd0MWW3LFYv5Z_ESJXn7TaxCg@mail.gmail.com>
	<CAJrcDBcSzgvpScK_M7Ru0woQoAA9sfYWMv9Z7ZHw6ezb16v5SA@mail.gmail.com>
Message-ID: <CAHzT=q_Tp1CnpaK7akg+DR2ddrppZdxZjrwWX4_gxgKMpdZNBg@mail.gmail.com>

I still have this issue in 4.6.0.Final

Regards,
Geoffrey Cleaves







On Mon, 12 Nov 2018 at 13:34, Pedro Igor Silva <psilva at redhat.com> wrote:

> Hi,
>
> It should be fixed by https://issues.jboss.org/browse/KEYCLOAK-8445. Fix
> will be available in the next release.
>
> Regards.
> Pedro Igor
>
> On Mon, Nov 12, 2018 at 10:23 AM Geoffrey Cleaves <geoff at opticks.io>
> wrote:
>
>> I'm experiencing unexpected results and believe there is a bug. I am
>> losing
>> permissions to my resource after sharing my resource with another user.
>>
>> Resource owner rs1 has read and edit rights to his resource1 through a JS
>> policy and permission which grants the resource owner the rights.
>>
>> If rs1 uses the My resources screen to grant another user, rs2, the read
>> scope to resource1, rs1 looses the right to the read scope.
>>
>> Please see JIRA https://issues.jboss.org/browse/KEYCLOAK-8794 and the
>> screen cast within the JIRA.
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>

From nocquidant at gmail.com  Thu Nov 15 13:38:59 2018
From: nocquidant at gmail.com (Nicolas Ocquidant)
Date: Thu, 15 Nov 2018 19:38:59 +0100
Subject: [keycloak-user] Shared datastore?
In-Reply-To: <6c684abf-809f-1a16-453b-5f99dbbe6a14@redhat.com>
References: <CABS93FQoYAW5trxmEww9j8RsyCSmiNAxxopnvj6iHvDNM4qtjg@mail.gmail.com>
	<CABS93FTjHkHaZRFWKuXsFoQ50u4fAN1EFyXoTsyJRtXf4HmS3w@mail.gmail.com>
	<CAA9R9O5OKgZqrkCXbifNoHEYOfKKV52ujycoHMOMBvq7jzNFLQ@mail.gmail.com>
	<1408145257.66131813.1541706517375.JavaMail.zimbra@redhat.com>
	<CAA9R9O4GmBwUrbOGDmWRyUUaduFOc0t0fDKN1qb_ZTJiysRMtg@mail.gmail.com>
	<6c684abf-809f-1a16-453b-5f99dbbe6a14@redhat.com>
Message-ID: <CABS93FRCTK-6apPK1Yxp=-5WdZdUwEuqCAhhJMh27fAH-xpZwg@mail.gmail.com>

OK, so I setup one KC node with a remote store, and one JDG (ISPN) server
with a shared JDBC store and it seems to work fine. Thanks!
I would have preferred not to add a JDG server but at least I have a
solution.

But a few things remain unclear:
  - each time I update/insert/delete a session entity from KC, the JDG
server will always be updated, right?
  - what about read operations? Does it mean there are 2 independent
caches, one in KC and one in ISPN (JMX shows same numEntriesInMemory for
both)?

So let's say I am not interested in Cross DC yet, but i want to set up a
cluster of 3 VMs (with HAProxy in front of them), each VM holding one KC
process + one ISPN process:

* VM#1 : kc_node11 && ispn_node11 (kc_node11 uses ispn_node11 as remote
cache)
* VM#2 : kc_node21 && ispn_node21 (kc_node21 uses ispn_node21 as remote
cache)
* VM#3 : kc_node31 && ispn_node31 (kc_node31 uses ispn_node31 as remote
cache)

Which cache mode
<http://infinispan.org/docs/stable/user_guide/user_guide.html#which_cache_mode_should_i_use>
should I use then and how many owners, for both KC and ISPN?  Invalidation
mode and numOfOwner=2 for KC, and distributed mode and numOfOwner=2 for
ISPN? Would that work?

Thanks again
--nick


Le jeu. 15 nov. 2018 ? 11:55, Marek Posolda <mposolda at redhat.com> a ?crit :

> Yes, true. We're using SKIP_CACHE_STORE when writing to sessions. We never
> tested with CacheStores enabled.
>
> The only store, which we're tested with, is the "remote-store" which we're
> using for the cross-datacenter setup. We have lots of places when we're not
> just writing data to the "cache" directly and let the "remote-store" to
> propagate it, but instead we obtain "remoteCache" instance from the
> underlying remote-store and CRUD data directly to remoteCache to have some
> optimizations and guaranteed consistency and atomicity for remoteCache
> operations (EG. putIfAbsent, replace etc). That's also the reason why we're
> using SKIP_CACHE_STORE flag.
>
> Feel free to create JIRA for better support of other CacheStores.
>
> The other possibility to workaround this (besides what Sebastian already
> mentioned) is to have JDG server and configure your cache with the
> remote-store as described in our "Cross-Datacenter setup" documentation. On
> JDG side, you can configure the JDBC store to your cache. In other words,
> the session will be always written to JDG and JDG will write it to the
> undrlying JDBC. I know this option is far from ideal (you need to add JDG
> server just to workaround things), just mentioning it for completeness.
>
> Marek
>
>
> On 09/11/18 14:29, Sebastian Laskawiec wrote:
>
> Yes, I think that could be case, I see a plenty of places where we
> use SKIP_CACHE_STORE.
>
> Let me ask Marek for help here since it has been implemented long before I
> joined the team and I don't know the history behind it...
>
> On Thu, Nov 8, 2018 at 8:48 PM William Burns <wburns at redhat.com> wrote:
>
>>
>>
>> ----- Original Message -----
>> > From: "Sebastian Laskawiec" <slaskawi at redhat.com>
>> > To: "Nicolas Ocquidant" <nocquidant at gmail.com>
>> > Cc: keycloak-user at lists.jboss.org, "Will Burns Rosenquist Burns" <
>> wburns at redhat.com>
>> > Sent: Thursday, November 8, 2018 12:33:47 PM
>> > Subject: Re: [keycloak-user] Shared datastore?
>> >
>> > So I think there are at least two ways to address this problem. This
>> first
>> > one is to use Offline Tokens [1]. I'm not sure if that fits into your
>> > application since it requires your client applications to store the
>> token.
>> > In other words you can simply delegate this problem one layer below in
>> your
>> > system.
>> >
>> > If that doesn't work for you, yes passivation is a way to go. Frankly, I
>> > haven't used passivation but from the manual I see it works hand in hand
>> > with eviction [2][3]. Will (on CC) can probably correct me here, but my
>> > understanding is that whenever an entry gets evicted, the passivation
>> > mechanism picks it up and stores somewhere.
>>
>> It does and it works, the problem is that passivation doesn't play well
>> with shared stores in Infinispan. We prevent this configuration in 9.4 or
>> newer even.
>>
>> I recommended that Nicolas just use eviction and a shared store without
>> passivation. However it seems that entries are not written to the store in
>> this configuration. My guess is that KeyCloak performs write operations
>> with the SKIP_CACHE_STORE flag and assumes entries will only be written to
>> the store due to passivation. Is there a reason for that?
>>
>> >
>> > [1] http://blog.keycloak.org/2015/12/offline-tokens-in-keycloak.html
>> > [2]
>> >
>> http://infinispan.org/docs/stable/user_guide/user_guide.html#cache_passivation
>> > [3]
>> >
>> https://github.com/infinispan/infinispan/blob/master/core/src/test/java/org/infinispan/eviction/impl/EvictionWithPassivationTest.java#L61-L69
>> >
>> > On Thu, Nov 8, 2018 at 5:40 PM Nicolas Ocquidant <nocquidant at gmail.com>
>> > wrote:
>> >
>> > > My requirements are the following: store tokens emitted by KC during
>> one
>> > > year.
>> > >
>> > > I don't know how many users there are, but here are the number I get:
>> > >   * the number of connections a week is about 700k.
>> > >   * the number of session refresh a week is about 200k.
>> > >
>> > > I approximated around 1M of sessions a week, thus 52M a year.
>> > > In memory, a user session has been estimated around 4KB (about 1KB in
>> > > file/DB).
>> > >
>> > > But I guess a refresh does not create another session isn't it? And
>> maybe
>> > > it's possible to ask KC to delete previous emitted tokens when a new
>> one is
>> > > created for a same user?
>> > >
>> > > If yes, my estimation is probably a little bit too high here, but I
>> > > certainly have several millions of tokens to keep (and maybe dozens of
>> > > millions).
>> > >
>> > > Thanks
>> > > --nick
>> > >
>> > > Le mer. 7 nov. 2018 ? 18:17, Nicolas Ocquidant <nocquidant at gmail.com>
>> a
>> > > ?crit :
>> > >
>> > > > Hi,
>> > > >
>> > > > According to Infinispan, when passivation is disabled, every update
>> to
>> > > the
>> > > > cache should always write to the store.
>> > > >
>> > > > But I can't manage to get it work with Keycloak. If I disable
>> > > passivation,
>> > > > my SQL store (Postgres) stays empty, even if the cache is full.
>> > > >
>> > > > So, if passivation is needed for Keycloak to write to the DB, it
>> means
>> > > > that the use of a shared DB is not possible...
>> > > >
>> > > > But this leads to another issue for me. Enable passivation without a
>> > > > shared DB seems to imply that either 'fetch-state' or 'purge'
>> should be
>> > > > enabled on startup, in order for the cache to not contain stale
>> entries.
>> > > >
>> > > > 15:27:44,626 WARN
>> > > >
>> [org.infinispan.configuration.cache.AbstractStoreConfigurationBuilder]
>> > > (MSC
>> > > > service thread 1-6) ISPN000149: Fetch persistent state and purge on
>> > > startup
>> > > > are both disabled, cache may contain stale entries on startup
>> > > >
>> > > > As I need to keep millions of sessions, this will considerably slow
>> down
>> > > > the startup of my node (when started again after a crash for
>> instance).
>> > > >
>> > > > So, is shared datastore allowed in Keycloak? If yes, how to enable
>> it?
>> > > > Otherwise what other options do I have to improve my startup time,
>> if
>> > > > millions of sessions are in the store?
>> > > >
>> > > > Thanks
>> > > > --nick
>> > > >
>> > > _______________________________________________
>> > > keycloak-user mailing list
>> > > keycloak-user at lists.jboss.org
>> > > https://lists.jboss.org/mailman/listinfo/keycloak-user
>> >
>>
>
>

From psilva at redhat.com  Thu Nov 15 16:38:31 2018
From: psilva at redhat.com (Pedro Igor Silva)
Date: Thu, 15 Nov 2018 19:38:31 -0200
Subject: [keycloak-user] End user sharing of his resource removes
 permission to his resource
In-Reply-To: <CAHzT=q_Tp1CnpaK7akg+DR2ddrppZdxZjrwWX4_gxgKMpdZNBg@mail.gmail.com>
References: <CAHzT=q8yaw7wPEzRh=FST4cmWEd0MWW3LFYv5Z_ESJXn7TaxCg@mail.gmail.com>
	<CAJrcDBcSzgvpScK_M7Ru0woQoAA9sfYWMv9Z7ZHw6ezb16v5SA@mail.gmail.com>
	<CAHzT=q_Tp1CnpaK7akg+DR2ddrppZdxZjrwWX4_gxgKMpdZNBg@mail.gmail.com>
Message-ID: <CAJrcDBek1sMaE6mQ3OSOwN_+hcFJBRA7pRWB9YqjfMz+6WRYUw@mail.gmail.com>

Hi Geoffrey,

I could not reproduce this in 4.6.0.Final. If that video is still valid,
the report from the evaluation tool should not show the
"user-managed-permission" if you are running using the resource owner. That
is weird.

In any case, I've attached to that JIRA the settings I used(and similar to
what we have in tests) to try to reproduce the issue.

Regards.
Pedro Igor

On Thu, Nov 15, 2018 at 12:46 PM Geoffrey Cleaves <geoff at opticks.io> wrote:

> I still have this issue in 4.6.0.Final
>
> Regards,
> Geoffrey Cleaves
>
>
>
>
>
>
>
> On Mon, 12 Nov 2018 at 13:34, Pedro Igor Silva <psilva at redhat.com> wrote:
>
>> Hi,
>>
>> It should be fixed by https://issues.jboss.org/browse/KEYCLOAK-8445. Fix
>> will be available in the next release.
>>
>> Regards.
>> Pedro Igor
>>
>> On Mon, Nov 12, 2018 at 10:23 AM Geoffrey Cleaves <geoff at opticks.io>
>> wrote:
>>
>>> I'm experiencing unexpected results and believe there is a bug. I am
>>> losing
>>> permissions to my resource after sharing my resource with another user.
>>>
>>> Resource owner rs1 has read and edit rights to his resource1 through a JS
>>> policy and permission which grants the resource owner the rights.
>>>
>>> If rs1 uses the My resources screen to grant another user, rs2, the read
>>> scope to resource1, rs1 looses the right to the read scope.
>>>
>>> Please see JIRA https://issues.jboss.org/browse/KEYCLOAK-8794 and the
>>> screen cast within the JIRA.
>>> _______________________________________________
>>> keycloak-user mailing list
>>> keycloak-user at lists.jboss.org
>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>
>>

From cedric at couralet.eu  Fri Nov 16 02:21:46 2018
From: cedric at couralet.eu (=?UTF-8?Q?C=C3=A9dric_Couralet?=)
Date: Fri, 16 Nov 2018 08:21:46 +0100
Subject: [keycloak-user] Keycloak 4.6.0.Final released
In-Reply-To: <cd4e7c1c-b50b-6707-eb4c-1bb70489682a@redhat.com>
References: <CAJgngAc2vsKfyM7s9MEhrbNBvmBgRpdYyUY29Js6Cw5gS62+Rg@mail.gmail.com>
	<9721fa600ae28dd56d6eecabe76ec884@couralet.eu>
	<CAA9R9O6ZSj3Yrn30Wk6YwP+cA+EH3q-VdgATM8tSPKY_3KLnjg@mail.gmail.com>
	<cd4e7c1c-b50b-6707-eb4c-1bb70489682a@redhat.com>
Message-ID: <6a959a9d128ff9715a66e3b26d993740@couralet.eu>

Le 2018-11-15 16:53, Pedro Ruivo a ?crit?:
> Hi Sebastian,
> 
> Which ISPN version is shipped with 4.6.0?
> 
> The StateRequestCommand changed its wire format in 9.3.1/9.4.0.
> 
> From the exception, it looks like some nodes are using an older
> version and the "new" nodes can't deserialize it.
> 

Thanks for the answers, I realize now that I the old version was not 
entirely stopped before the new instance started. I'm guessing the 
change in format caused those exceptions. I'll change my procedures for 
future versions.
Sorry for the noise.

C?dric

From marco.scheuermann at daimler.com  Fri Nov 16 03:12:34 2018
From: marco.scheuermann at daimler.com (marco.scheuermann at daimler.com)
Date: Fri, 16 Nov 2018 08:12:34 +0000
Subject: [keycloak-user] How to package a provider as EAR
In-Reply-To: <1C82FBF5-3E14-4E86-B0F1-5D6FECB2229C@daimler.com>
References: <1C82FBF5-3E14-4E86-B0F1-5D6FECB2229C@daimler.com>
Message-ID: <8C6AB5C1-40DA-4AC2-8A9C-A25337D9709B@daimler.com>

Hi together,

do you have any example how to package a provider implementation as an EAR file?
I packaged it as JAR and it works but then I added some external libs (JARS) so I have the requirement to
package it as an EAR.

Thank you,
Marco


Marco Scheuermann

Dipl.-Informatiker

 [id:image001.png at 01D3CB2E.313F1BF0]

Software Engineer
RD/UIA ? Team Rising Stars
Tel.:       +49 151 5860 5255
E-Mail:  marco.scheuermann at daimler.com

Daimler AG
Sitz und Registergericht/Domicile and Court of Registry: Stuttgart
HRB-Nr./Commercial Register No. 19360
Vorsitzender des Aufsichtsrats/Chairman of the Supervisory Board: Manfred Bischoff
Vorstand/Board of Management: Dieter Zetsche (Vorsitzender/Chairman), Wolfgang Bernhard, Renata Jungo Br?ngger, Ola K?llenius, Wilfried Porth, Hubertus Troska, Bodo Uebber, Thomas Weber


If you are not the addressee, please inform us immediately that you have received this e-mail by mistake, and delete it. We thank you for your support.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.png
Type: image/png
Size: 6523 bytes
Desc: image001.png
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20181116/a58c3655/attachment-0001.png 

From callum at well.ox.ac.uk  Fri Nov 16 04:16:39 2018
From: callum at well.ox.ac.uk (Callum Smith)
Date: Fri, 16 Nov 2018 09:16:39 +0000
Subject: [keycloak-user] krbLastPwdChange - can we use this attribute
Message-ID: <76219A0B-5737-47FC-9B90-8D805B4BA0F8@well.ox.ac.uk>

Dear Keycloakers,

I was wondering, if Keycloak can accept the pwdLastSet from MSAD, why can it not use krbLastPwdChange from FreeIPA to allow for better integration of password resets? Surely this is possible and potentially even trivial to implement?

Regards,
Callum

--

Callum Smith
Research Computing Core
Wellcome Trust Centre for Human Genetics
University of Oxford
e. callum at well.ox.ac.uk<mailto:callum at well.ox.ac.uk>


From iammikesemail at gmail.com  Fri Nov 16 09:11:57 2018
From: iammikesemail at gmail.com (Mike Keith)
Date: Fri, 16 Nov 2018 09:11:57 -0500
Subject: [keycloak-user]  How to package a provider as EAR
Message-ID: <CAEjvsOTjA3pfm82bojnV54q_E1p7GnrN0j-J1scYhtSOGJnLNQ@mail.gmail.com>

Hi Marco,

I'm currently exploring this exact thing, and so far haven't gotten it
right just yet.  Today I plan to figure more about about the maven ear
plugin:

https://maven.apache.org/plugins/maven-ear-plugin/

I'll reply back if I find anything, and definitely would be interested in
your own progress as well if you find anything useful or make progress as
well.

-Mike

-- 
----

> Hi together,
> do you have any example how to package a provider implementation as an EAR
> file?
> I packaged it as JAR and it works but then I added some external libs
> (JARS) so I have the requirement to
> package it as an EAR.
> Thank you,
> Marco
> Marco Scheuermann

From geoff at opticks.io  Fri Nov 16 09:14:01 2018
From: geoff at opticks.io (Geoffrey Cleaves)
Date: Fri, 16 Nov 2018 15:14:01 +0100
Subject: [keycloak-user] End user sharing of his resource removes
 permission to his resource
In-Reply-To: <CAJrcDBek1sMaE6mQ3OSOwN_+hcFJBRA7pRWB9YqjfMz+6WRYUw@mail.gmail.com>
References: <CAHzT=q8yaw7wPEzRh=FST4cmWEd0MWW3LFYv5Z_ESJXn7TaxCg@mail.gmail.com>
	<CAJrcDBcSzgvpScK_M7Ru0woQoAA9sfYWMv9Z7ZHw6ezb16v5SA@mail.gmail.com>
	<CAHzT=q_Tp1CnpaK7akg+DR2ddrppZdxZjrwWX4_gxgKMpdZNBg@mail.gmail.com>
	<CAJrcDBek1sMaE6mQ3OSOwN_+hcFJBRA7pRWB9YqjfMz+6WRYUw@mail.gmail.com>
Message-ID: <CAHzT=q_6ocrd1w0KgD2ks4dqp0fAtvEV74rpTTwHvP2z3VQ39g@mail.gmail.com>

Hi Pedro,

I appreciate your efforts on this. I imported your JSON config into a new
client and have the same exact problem. I've updated the ticket with a
screen shot. By default, Alice has album:view and album:edit rights to her
Book. But once she give my user the album:view right, she looses that right.

Regards,
Geoffrey Cleaves







On Thu, 15 Nov 2018 at 22:38, Pedro Igor Silva <psilva at redhat.com> wrote:

> Hi Geoffrey,
>
> I could not reproduce this in 4.6.0.Final. If that video is still valid,
> the report from the evaluation tool should not show the
> "user-managed-permission" if you are running using the resource owner. That
> is weird.
>
> In any case, I've attached to that JIRA the settings I used(and similar to
> what we have in tests) to try to reproduce the issue.
>
> Regards.
> Pedro Igor
>
> On Thu, Nov 15, 2018 at 12:46 PM Geoffrey Cleaves <geoff at opticks.io>
> wrote:
>
>> I still have this issue in 4.6.0.Final
>>
>> Regards,
>> Geoffrey Cleaves
>>
>>
>>
>>
>>
>>
>>
>> On Mon, 12 Nov 2018 at 13:34, Pedro Igor Silva <psilva at redhat.com> wrote:
>>
>>> Hi,
>>>
>>> It should be fixed by https://issues.jboss.org/browse/KEYCLOAK-8445.
>>> Fix will be available in the next release.
>>>
>>> Regards.
>>> Pedro Igor
>>>
>>> On Mon, Nov 12, 2018 at 10:23 AM Geoffrey Cleaves <geoff at opticks.io>
>>> wrote:
>>>
>>>> I'm experiencing unexpected results and believe there is a bug. I am
>>>> losing
>>>> permissions to my resource after sharing my resource with another user.
>>>>
>>>> Resource owner rs1 has read and edit rights to his resource1 through a
>>>> JS
>>>> policy and permission which grants the resource owner the rights.
>>>>
>>>> If rs1 uses the My resources screen to grant another user, rs2, the read
>>>> scope to resource1, rs1 looses the right to the read scope.
>>>>
>>>> Please see JIRA https://issues.jboss.org/browse/KEYCLOAK-8794 and the
>>>> screen cast within the JIRA.
>>>> _______________________________________________
>>>> keycloak-user mailing list
>>>> keycloak-user at lists.jboss.org
>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>
>>>

From to_sud at yahoo.com  Fri Nov 16 09:47:53 2018
From: to_sud at yahoo.com (Sud Ramasamy)
Date: Fri, 16 Nov 2018 09:47:53 -0500
Subject: [keycloak-user] Keycloak SAML IdP and URL parameter
Message-ID: <etPan.5beed899.50b9905b.11539@yahoo.com>

Hi,

We are using Keycloak as a SAML IdP and have plugged in a custom authenticator to handle the browser flow. The authenticator relies on a custom URL parameter that is present in the initial SAML Authn request to Keycloak.?

We found that when the Keycloak SAML IdP receives a SAML Authn request (which also contains our custom URL parameter) it exchanges that request with a code and redirects the browser to itself at which point the control reaches our custom authenticator. This redirect causes our custom URL parameter from the initial request to not be available to our custom authenticator. Is there anyway to propagate our custom URL parameter to this second request and thereby have it available to our custom authenticator.

Thanks in advance for your help.

Regards
-sud?

From callum at well.ox.ac.uk  Fri Nov 16 11:27:35 2018
From: callum at well.ox.ac.uk (Callum Smith)
Date: Fri, 16 Nov 2018 16:27:35 +0000
Subject: [keycloak-user] krbLastPwdChange - can we use this attribute
In-Reply-To: <76219A0B-5737-47FC-9B90-8D805B4BA0F8@well.ox.ac.uk>
References: <76219A0B-5737-47FC-9B90-8D805B4BA0F8@well.ox.ac.uk>
Message-ID: <21B3C608-679D-4F3F-8587-769C3BFDC4B2@well.ox.ac.uk>

Dear All,

I've implemented this as a python script for now, hopefully this is useful to some, and hopefully something similar could be implemented for LDAP (although I imagine politically since SSSD cannot provide this data, and that's the preferred connection route for FreeIPA, it's not going to happen soon).

requirements: ldap3, python-keycloak


import python_freeipa
import json
import ldap3
from keycloak import KeycloakAdmin
from datetime import datetime

options['ipa_host']              = ''
options['ipa_admin_user']        = ''
options['ipa_base_dn']           = ''
options['ipa_admin_dn']          = ','+options['ipa_base_dn']
options['keycloak_host']         = ''
options['keycloak_admin_user']   = ''
options['keycloak_storage_id']   = ''

# Begin Keycloak Clietn
keycloakClient = KeycloakAdmin(server_url='https://'+options['keycloak_host']+'/auth/', username=options['keycloak_admin_user'], password=keycloakAdminPassword, realm_name='master<https://'+options['keycloak_host']+'/auth/',%20username=options['keycloak_admin_user'],%20password=keycloakAdminPassword,%20realm_name='master>', verify=False)

# Begin LDAP client
ldapServer = ldap3.Server(options['ipa_host'])
ldapClient = ldap3.Connection(ldapServer, user=options['ipa_admin_dn'], password=ipaAdminPassword, auto_bind=True)

# Generate datestamp
date = datetime.utcnow().strftime('%Y%m%d%H%M%S')+'Z'

# Perform an LDAP sync for Keycloak
keycloakClient.sync_users(storage_id=options['keycloak_storage_id'], action="triggerFullSync")

# Search LDAP for expired passwords
ldapClient.search('cn=users,cn=accounts,'+options['ipa_base_dn'], '(|(krbPasswordExpiration<='+date+')(!(krbPasswordExpiration=*)))', attributes=['uid','cn','krbLastPwdChange','krbPasswordExpiration','dn'])
resetPasswordUsers = ldapClient.entries

for user in resetPasswordUsers:
  user_id = keycloakClient.get_user_id(user.uid)
  keycloakClient.update_user(user_id=user_id, payload={"requiredActions":['UPDATE_PASSWORD']})


# Search LDAP for valid passwords
ldapClient.search('cn=users,cn=accounts,'+options['ipa_base_dn'], '(krbPasswordExpiration>='+date+')', attributes=['uid','cn','krbLastPwdChange','krbPasswordExpiration','dn'])
validPasswordUsers = ldapClient.entries

for user in validPasswordUsers:
  user_id = keycloakClient.get_user_id(user.uid)
  keycloakClient.update_user(user_id=user_id, payload={"requiredActions":[]})




I've chopped some domain specific stuff from this so it might not be flawless, but hopefully a start for someone. Also no error checking involved here.

Regards,
Callum

--

Callum Smith
Research Computing Core
Wellcome Trust Centre for Human Genetics
University of Oxford
e. callum at well.ox.ac.uk<mailto:callum at well.ox.ac.uk>

On 16 Nov 2018, at 09:16, Callum Smith <callum at well.ox.ac.uk<mailto:callum at well.ox.ac.uk>> wrote:

Dear Keycloakers,

I was wondering, if Keycloak can accept the pwdLastSet from MSAD, why can it not use krbLastPwdChange from FreeIPA to allow for better integration of password resets? Surely this is possible and potentially even trivial to implement?

Regards,
Callum

--

Callum Smith
Research Computing Core
Wellcome Trust Centre for Human Genetics
University of Oxford
e. callum at well.ox.ac.uk<mailto:callum at well.ox.ac.uk><mailto:callum at well.ox.ac.uk>

_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user


From henning.waack at codecentric.de  Fri Nov 16 11:29:15 2018
From: henning.waack at codecentric.de (Henning Waack)
Date: Fri, 16 Nov 2018 17:29:15 +0100
Subject: [keycloak-user] NullpointerException in AuthenticationManager
Message-ID: <CAGqTYaxvqC9_rarPZQKNbikVZrRqzSJTKeZdzZr=Wmw=vqjSOw@mail.gmail.com>

 Dear all.


Using KC 4.5.0, I get the following exception in my Custom SPI:


2018-11-16 17:05:23,407 ERROR
[org.keycloak.services.error.KeycloakErrorHandler] (default task-3)
Uncaught server error: java.lang.NullPointerException

at
org.keycloak.keys.DefaultKeyManager.getProviders(DefaultKeyManager.java:249)

at org.keycloak.keys.DefaultKeyManager.getKey(DefaultKeyManager.java:104)

at
org.keycloak.crypto.ServerAsymmetricSignatureVerifierContext.getKey(ServerAsymmetricSignatureVerifierContext.java:29)

at
org.keycloak.crypto.ServerAsymmetricSignatureVerifierContext.<init>(ServerAsymmetricSignatureVerifierContext.java:25)

at
org.keycloak.crypto.AsymmetricSignatureProvider.verifier(AsymmetricSignatureProvider.java:39)

at
org.keycloak.services.managers.AuthenticationManager.verifyIdentityToken(AuthenticationManager.java:1138)

at
org.keycloak.services.managers.AppAuthManager.authenticateBearerToken(AppAuthManager.java:71)

at
org.keycloak.services.managers.AppAuthManager.authenticateBearerToken(AppAuthManager.java:66)

at
org.keycloak.services.managers.AppAuthManager.authenticateBearerToken(AppAuthManager.java:58)

at
de.sys.keycloak.spi.UserSearchResourceProvider.<init>(UserSearchResourceProvider.java:46)

The method invoking it is as follows:

*        RealmManager realmManager = new RealmManager(session);*
*        RealmModel realm = realmManager.getRealmByName(realmName);*
*        this.auth = new AppAuthManager().authenticateBearerToken(session,
realm);*

Any pointer at what is happening here? Server did function before quite
nicely, don't know what could lead to this situation.

Thanks & greetings

Henning

-- 

Henning Waack | IT Consultant


codecentric AG | Hochstra?e 11
<https://maps.google.com/?q=Hochstra%C3%9Fe+11%C2%A0+%7C+%C2%A0+42697+Solingen+%C2%A0%7CDeutschland&entry=gmail&source=g>
|
<https://maps.google.com/?q=Hochstra%C3%9Fe+11%C2%A0+%7C+%C2%A0+42697+Solingen+%C2%A0%7CDeutschland&entry=gmail&source=g>

<https://maps.google.com/?q=Hochstra%C3%9Fe+11%C2%A0+%7C+%C2%A0+42697+Solingen+%C2%A0%7CDeutschland&entry=gmail&source=g>42697
Solingen
<https://maps.google.com/?q=Hochstra%C3%9Fe+11%C2%A0+%7C+%C2%A0+42697+Solingen+%C2%A0%7CDeutschland&entry=gmail&source=g>
 |Deutschland
<https://maps.google.com/?q=Hochstra%C3%9Fe+11%C2%A0+%7C+%C2%A0+42697+Solingen+%C2%A0%7CDeutschland&entry=gmail&source=g>


tel: +49 (0)151 108 515 29

www.codecentric.de | blog.codecentric.de | www.meettheexperts.de

Sitz der Gesellschaft: Solingen | HRB 25917 | Amtsgericht Wuppertal

Vorstand: Michael Hochg?rtel . Ulrich K?hn . Rainer Vehns
Aufsichtsrat: Patric Fedlmeier (Vorsitzender) . Klaus J?ger . J?rgen Sch?tz

Diese E-Mail einschlie?lich evtl. beigef?gter Dateien enth?lt vertrauliche
und/oder rechtlich gesch?tzte Informationen. Wenn Sie nicht der richtige
Adressat sind oder diese E-Mail irrt?mlich erhalten haben, informieren Sie
bitte sofort den Absender und l?schen Sie diese E-Mail und evtl.
beigef?gter Dateien umgehend. Das unerlaubte Kopieren, Nutzen oder ?ffnen
evtl. beigef?gter Dateien sowie die unbefugte Weitergabe dieser E-Mail ist
nicht gestattet.

From henning.waack at codecentric.de  Fri Nov 16 12:15:13 2018
From: henning.waack at codecentric.de (Henning Waack)
Date: Fri, 16 Nov 2018 18:15:13 +0100
Subject: [keycloak-user] NullpointerException in AuthenticationManager
In-Reply-To: <CAGqTYaxvqC9_rarPZQKNbikVZrRqzSJTKeZdzZr=Wmw=vqjSOw@mail.gmail.com>
References: <CAGqTYaxvqC9_rarPZQKNbikVZrRqzSJTKeZdzZr=Wmw=vqjSOw@mail.gmail.com>
Message-ID: <CAGqTYazBVYnHCK=01_fsRv8F__NyOghm1GQYRcmmj0bJKUBAbw@mail.gmail.com>

Ok, found something very weird!

So I changed the code as follows:

*     RealmManager realmManager = new RealmManager(session);*
*     RealmModel realm = realmManager.getRealmByName(realmName);*
*        session.getContext().setRealm(**realm);*
*     this.auth = new AppAuthManager().authenticateBearerToken(session,
realm);*

I.e. I manually added the RealmModel to the session context. Now it works
again. This was working perfectly before, so why could this change?

Thanks & greetings

Henning

Am Fr., 16. Nov. 2018 um 17:29 Uhr schrieb Henning Waack <
henning.waack at codecentric.de>:

> Dear all.
>
>
> Using KC 4.5.0, I get the following exception in my Custom SPI:
>
>
> 2018-11-16 17:05:23,407 ERROR
> [org.keycloak.services.error.KeycloakErrorHandler] (default task-3)
> Uncaught server error: java.lang.NullPointerException
>
> at
> org.keycloak.keys.DefaultKeyManager.getProviders(DefaultKeyManager.java:249)
>
> at org.keycloak.keys.DefaultKeyManager.getKey(DefaultKeyManager.java:104)
>
> at
> org.keycloak.crypto.ServerAsymmetricSignatureVerifierContext.getKey(ServerAsymmetricSignatureVerifierContext.java:29)
>
> at
> org.keycloak.crypto.ServerAsymmetricSignatureVerifierContext.<init>(ServerAsymmetricSignatureVerifierContext.java:25)
>
> at
> org.keycloak.crypto.AsymmetricSignatureProvider.verifier(AsymmetricSignatureProvider.java:39)
>
> at
> org.keycloak.services.managers.AuthenticationManager.verifyIdentityToken(AuthenticationManager.java:1138)
>
> at
> org.keycloak.services.managers.AppAuthManager.authenticateBearerToken(AppAuthManager.java:71)
>
> at
> org.keycloak.services.managers.AppAuthManager.authenticateBearerToken(AppAuthManager.java:66)
>
> at
> org.keycloak.services.managers.AppAuthManager.authenticateBearerToken(AppAuthManager.java:58)
>
> at
> de.sys.keycloak.spi.UserSearchResourceProvider.<init>(UserSearchResourceProvider.java:46)
>
> The method invoking it is as follows:
>
> *        RealmManager realmManager = new RealmManager(session);*
> *        RealmModel realm = realmManager.getRealmByName(realmName);*
> *        this.auth = new AppAuthManager().authenticateBearerToken(session,
> realm);*
>
> Any pointer at what is happening here? Server did function before quite
> nicely, don't know what could lead to this situation.
>
> Thanks & greetings
>
> Henning
>
> --
>
> Henning Waack | IT Consultant
>
>
> codecentric AG | Hochstra?e 11
> <https://maps.google.com/?q=Hochstra%C3%9Fe+11%C2%A0+%7C+%C2%A0+42697+Solingen+%C2%A0%7CDeutschland&entry=gmail&source=g>
> |
> <https://maps.google.com/?q=Hochstra%C3%9Fe+11%C2%A0+%7C+%C2%A0+42697+Solingen+%C2%A0%7CDeutschland&entry=gmail&source=g>
>
> <https://maps.google.com/?q=Hochstra%C3%9Fe+11%C2%A0+%7C+%C2%A0+42697+Solingen+%C2%A0%7CDeutschland&entry=gmail&source=g>42697
> Solingen
> <https://maps.google.com/?q=Hochstra%C3%9Fe+11%C2%A0+%7C+%C2%A0+42697+Solingen+%C2%A0%7CDeutschland&entry=gmail&source=g>
>  |Deutschland
> <https://maps.google.com/?q=Hochstra%C3%9Fe+11%C2%A0+%7C+%C2%A0+42697+Solingen+%C2%A0%7CDeutschland&entry=gmail&source=g>
>
>
> tel: +49 (0)151 108 515 29
>
> www.codecentric.de | blog.codecentric.de | www.meettheexperts.de
>
> Sitz der Gesellschaft: Solingen | HRB 25917 | Amtsgericht Wuppertal
>
> Vorstand: Michael Hochg?rtel . Ulrich K?hn . Rainer Vehns
> Aufsichtsrat: Patric Fedlmeier (Vorsitzender) . Klaus J?ger . J?rgen Sch?tz
>
> Diese E-Mail einschlie?lich evtl. beigef?gter Dateien enth?lt vertrauliche
> und/oder rechtlich gesch?tzte Informationen. Wenn Sie nicht der richtige
> Adressat sind oder diese E-Mail irrt?mlich erhalten haben, informieren Sie
> bitte sofort den Absender und l?schen Sie diese E-Mail und evtl.
> beigef?gter Dateien umgehend. Das unerlaubte Kopieren, Nutzen oder ?ffnen
> evtl. beigef?gter Dateien sowie die unbefugte Weitergabe dieser E-Mail ist
> nicht gestattet.
>


-- 

Henning Waack | IT Consultant


codecentric AG | Hochstra?e 11
<https://maps.google.com/?q=Hochstra%C3%9Fe+11%C2%A0+%7C+%C2%A0+42697+Solingen+%C2%A0%7CDeutschland&entry=gmail&source=g>
|
<https://maps.google.com/?q=Hochstra%C3%9Fe+11%C2%A0+%7C+%C2%A0+42697+Solingen+%C2%A0%7CDeutschland&entry=gmail&source=g>

<https://maps.google.com/?q=Hochstra%C3%9Fe+11%C2%A0+%7C+%C2%A0+42697+Solingen+%C2%A0%7CDeutschland&entry=gmail&source=g>42697
Solingen
<https://maps.google.com/?q=Hochstra%C3%9Fe+11%C2%A0+%7C+%C2%A0+42697+Solingen+%C2%A0%7CDeutschland&entry=gmail&source=g>
 |Deutschland
<https://maps.google.com/?q=Hochstra%C3%9Fe+11%C2%A0+%7C+%C2%A0+42697+Solingen+%C2%A0%7CDeutschland&entry=gmail&source=g>


tel: +49 (0)151 108 515 29

www.codecentric.de | blog.codecentric.de | www.meettheexperts.de

Sitz der Gesellschaft: Solingen | HRB 25917 | Amtsgericht Wuppertal

Vorstand: Michael Hochg?rtel . Ulrich K?hn . Rainer Vehns
Aufsichtsrat: Patric Fedlmeier (Vorsitzender) . Klaus J?ger . J?rgen Sch?tz

Diese E-Mail einschlie?lich evtl. beigef?gter Dateien enth?lt vertrauliche
und/oder rechtlich gesch?tzte Informationen. Wenn Sie nicht der richtige
Adressat sind oder diese E-Mail irrt?mlich erhalten haben, informieren Sie
bitte sofort den Absender und l?schen Sie diese E-Mail und evtl.
beigef?gter Dateien umgehend. Das unerlaubte Kopieren, Nutzen oder ?ffnen
evtl. beigef?gter Dateien sowie die unbefugte Weitergabe dieser E-Mail ist
nicht gestattet.

From geoff at opticks.io  Fri Nov 16 12:49:00 2018
From: geoff at opticks.io (Geoffrey Cleaves)
Date: Fri, 16 Nov 2018 18:49:00 +0100
Subject: [keycloak-user] Keycloak 4.6.0.Final released
In-Reply-To: <6a959a9d128ff9715a66e3b26d993740@couralet.eu>
References: <CAJgngAc2vsKfyM7s9MEhrbNBvmBgRpdYyUY29Js6Cw5gS62+Rg@mail.gmail.com>
	<9721fa600ae28dd56d6eecabe76ec884@couralet.eu>
	<CAA9R9O6ZSj3Yrn30Wk6YwP+cA+EH3q-VdgATM8tSPKY_3KLnjg@mail.gmail.com>
	<cd4e7c1c-b50b-6707-eb4c-1bb70489682a@redhat.com>
	<6a959a9d128ff9715a66e3b26d993740@couralet.eu>
Message-ID: <CAHzT=q_6-4ugB4ue7t+bcOwdu8jQKL4+K-hL8_rcjRGV9-5DfA@mail.gmail.com>

I'm unable to get 4.6.0.Final or 4.7.0.Snapshot Docker images to work
properly.  The Admin Console throws an error with every action. I've added
new info to this ticket https://issues.jboss.org/browse/KEYCLOAK-8832
including this screen cast to prove I'm not loco:
https://www.youtube.com/watch?v=prEO19-UQsk

Geoff

On Fri, 16 Nov 2018 at 08:26, C?dric Couralet <cedric at couralet.eu> wrote:

> Le 2018-11-15 16:53, Pedro Ruivo a ?crit :
> > Hi Sebastian,
> >
> > Which ISPN version is shipped with 4.6.0?
> >
> > The StateRequestCommand changed its wire format in 9.3.1/9.4.0.
> >
> > From the exception, it looks like some nodes are using an older
> > version and the "new" nodes can't deserialize it.
> >
>
> Thanks for the answers, I realize now that I the old version was not
> entirely stopped before the new instance started. I'm guessing the
> change in format caused those exceptions. I'll change my procedures for
> future versions.
> Sorry for the noise.
>
> C?dric
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From cedric at couralet.eu  Fri Nov 16 13:19:15 2018
From: cedric at couralet.eu (=?UTF-8?Q?C=C3=A9dric_Couralet?=)
Date: Fri, 16 Nov 2018 19:19:15 +0100
Subject: [keycloak-user] Keycloak 4.6.0.Final released
In-Reply-To: <CAHzT=q_6-4ugB4ue7t+bcOwdu8jQKL4+K-hL8_rcjRGV9-5DfA@mail.gmail.com>
References: <CAJgngAc2vsKfyM7s9MEhrbNBvmBgRpdYyUY29Js6Cw5gS62+Rg@mail.gmail.com>
	<9721fa600ae28dd56d6eecabe76ec884@couralet.eu>
	<CAA9R9O6ZSj3Yrn30Wk6YwP+cA+EH3q-VdgATM8tSPKY_3KLnjg@mail.gmail.com>
	<cd4e7c1c-b50b-6707-eb4c-1bb70489682a@redhat.com>
	<6a959a9d128ff9715a66e3b26d993740@couralet.eu>
	<CAHzT=q_6-4ugB4ue7t+bcOwdu8jQKL4+K-hL8_rcjRGV9-5DfA@mail.gmail.com>
Message-ID: <9eb67585f0b666a05c8d0aeb564adfe6@couralet.eu>

Le 2018-11-16 18:49, Geoffrey Cleaves a ?crit?:
> I'm unable to get 4.6.0.Final or 4.7.0.Snapshot Docker images to work
> properly.  The Admin Console throws an error with every action. I've
> added new info to this ticket
> https://issues.jboss.org/browse/KEYCLOAK-8832 [3] including this
> screen cast to prove I'm not loco:
> https://www.youtube.com/watch?v=prEO19-UQsk [4]
> 
> Geoff
> 

Hello,

I manage to get those error by using DEBUG Log level and using chrome to 
access admin console.

I think the problem is here :
https://github.com/keycloak/keycloak/blob/e5bb25dd2f8460bfa818a1cbed0b26c3e88d69db/services/src/main/java/org/keycloak/services/resources/Cors.java#L193

in the debug message allowedOrigins..toArray() is called even when null.
But I don't understand the difference between Firefox and Chrome on 
this.

I think a simple fix is to configure the log level as INFO.

C?dric Couralet


From cedric at couralet.eu  Fri Nov 16 13:21:26 2018
From: cedric at couralet.eu (=?UTF-8?Q?C=C3=A9dric_Couralet?=)
Date: Fri, 16 Nov 2018 19:21:26 +0100
Subject: [keycloak-user] Keycloak 4.6.0.Final released
In-Reply-To: <9eb67585f0b666a05c8d0aeb564adfe6@couralet.eu>
References: <CAJgngAc2vsKfyM7s9MEhrbNBvmBgRpdYyUY29Js6Cw5gS62+Rg@mail.gmail.com>
	<9721fa600ae28dd56d6eecabe76ec884@couralet.eu>
	<CAA9R9O6ZSj3Yrn30Wk6YwP+cA+EH3q-VdgATM8tSPKY_3KLnjg@mail.gmail.com>
	<cd4e7c1c-b50b-6707-eb4c-1bb70489682a@redhat.com>
	<6a959a9d128ff9715a66e3b26d993740@couralet.eu>
	<CAHzT=q_6-4ugB4ue7t+bcOwdu8jQKL4+K-hL8_rcjRGV9-5DfA@mail.gmail.com>
	<9eb67585f0b666a05c8d0aeb564adfe6@couralet.eu>
Message-ID: <2ef4d5df5522c6e45d801a6b4ad6891f@couralet.eu>


> But I don't understand the difference between Firefox and Chrome on 
> this.
> 
This made me understand that difference :

https://stackoverflow.com/questions/15512331/chrome-adding-origin-header-to-same-origin-request



From cedric at couralet.eu  Fri Nov 16 13:28:43 2018
From: cedric at couralet.eu (=?UTF-8?Q?C=C3=A9dric_Couralet?=)
Date: Fri, 16 Nov 2018 19:28:43 +0100
Subject: [keycloak-user] Keycloak 4.6.0.Final released
In-Reply-To: <9eb67585f0b666a05c8d0aeb564adfe6@couralet.eu>
References: <CAJgngAc2vsKfyM7s9MEhrbNBvmBgRpdYyUY29Js6Cw5gS62+Rg@mail.gmail.com>
	<9721fa600ae28dd56d6eecabe76ec884@couralet.eu>
	<CAA9R9O6ZSj3Yrn30Wk6YwP+cA+EH3q-VdgATM8tSPKY_3KLnjg@mail.gmail.com>
	<cd4e7c1c-b50b-6707-eb4c-1bb70489682a@redhat.com>
	<6a959a9d128ff9715a66e3b26d993740@couralet.eu>
	<CAHzT=q_6-4ugB4ue7t+bcOwdu8jQKL4+K-hL8_rcjRGV9-5DfA@mail.gmail.com>
	<9eb67585f0b666a05c8d0aeb564adfe6@couralet.eu>
Message-ID: <c3e7ea664f5c22fa93f02e9849a91427@couralet.eu>

Le 2018-11-16 19:19, C?dric Couralet a ?crit?:
> Le 2018-11-16 18:49, Geoffrey Cleaves a ?crit?:
>> I'm unable to get 4.6.0.Final or 4.7.0.Snapshot Docker images to work
>> properly.  The Admin Console throws an error with every action. I've
>> added new info to this ticket
>> https://issues.jboss.org/browse/KEYCLOAK-8832 [3] including this
>> screen cast to prove I'm not loco:
>> https://www.youtube.com/watch?v=prEO19-UQsk [4]
>> 
>> Geoff
>> 
> 
> Hello,
> 
> I manage to get those error by using DEBUG Log level and using chrome
> to access admin console.
> 
> I think the problem is here :
> https://github.com/keycloak/keycloak/blob/e5bb25dd2f8460bfa818a1cbed0b26c3e88d69db/services/src/main/java/org/keycloak/services/resources/Cors.java#L193
> 
> in the debug message allowedOrigins..toArray() is called even when 
> null.
> But I don't understand the difference between Firefox and Chrome on 
> this.
> 

This made me understand that difference :

https://stackoverflow.com/questions/15512331/chrome-adding-origin-header-to-same-origin-request


From geoff at opticks.io  Fri Nov 16 15:43:17 2018
From: geoff at opticks.io (Geoffrey Cleaves)
Date: Fri, 16 Nov 2018 21:43:17 +0100
Subject: [keycloak-user] Keycloak 4.6.0.Final released
In-Reply-To: <c3e7ea664f5c22fa93f02e9849a91427@couralet.eu>
References: <CAJgngAc2vsKfyM7s9MEhrbNBvmBgRpdYyUY29Js6Cw5gS62+Rg@mail.gmail.com>
	<9721fa600ae28dd56d6eecabe76ec884@couralet.eu>
	<CAA9R9O6ZSj3Yrn30Wk6YwP+cA+EH3q-VdgATM8tSPKY_3KLnjg@mail.gmail.com>
	<cd4e7c1c-b50b-6707-eb4c-1bb70489682a@redhat.com>
	<6a959a9d128ff9715a66e3b26d993740@couralet.eu>
	<CAHzT=q_6-4ugB4ue7t+bcOwdu8jQKL4+K-hL8_rcjRGV9-5DfA@mail.gmail.com>
	<9eb67585f0b666a05c8d0aeb564adfe6@couralet.eu>
	<c3e7ea664f5c22fa93f02e9849a91427@couralet.eu>
Message-ID: <CAHzT=q-euiKU8B64vCx1+xNExHafP0Ce+_buiVnLJysKj8ks_w@mail.gmail.com>

Thanks, changing the logging level solved the issue.

Regards,
Geoffrey Cleaves







On Fri, 16 Nov 2018 at 19:28, C?dric Couralet <cedric at couralet.eu> wrote:

> Le 2018-11-16 19:19, C?dric Couralet a ?crit :
> > Le 2018-11-16 18:49, Geoffrey Cleaves a ?crit :
> >> I'm unable to get 4.6.0.Final or 4.7.0.Snapshot Docker images to work
> >> properly.  The Admin Console throws an error with every action. I've
> >> added new info to this ticket
> >> https://issues.jboss.org/browse/KEYCLOAK-8832 [3] including this
> >> screen cast to prove I'm not loco:
> >> https://www.youtube.com/watch?v=prEO19-UQsk [4]
> >>
> >> Geoff
> >>
> >
> > Hello,
> >
> > I manage to get those error by using DEBUG Log level and using chrome
> > to access admin console.
> >
> > I think the problem is here :
> >
> https://github.com/keycloak/keycloak/blob/e5bb25dd2f8460bfa818a1cbed0b26c3e88d69db/services/src/main/java/org/keycloak/services/resources/Cors.java#L193
> >
> > in the debug message allowedOrigins..toArray() is called even when
> > null.
> > But I don't understand the difference between Firefox and Chrome on
> > this.
> >
>
> This made me understand that difference :
>
>
> https://stackoverflow.com/questions/15512331/chrome-adding-origin-header-to-same-origin-request
>
>

From slyge2001 at yahoo.fr  Fri Nov 16 17:19:45 2018
From: slyge2001 at yahoo.fr (ge sly)
Date: Fri, 16 Nov 2018 22:19:45 +0000 (UTC)
Subject: [keycloak-user] Re :Keycloak Idp SLO response location
In-Reply-To: <1665888810.3194155.1542406492861@mail.yahoo.com>
References: <1665888810.3194155.1542406492861.ref@mail.yahoo.com>
	<1665888810.3194155.1542406492861@mail.yahoo.com>
Message-ID: <873954453.3176887.1542406785280@mail.yahoo.com>



  Hi
I am tringle to configure Keycloak as an Idp with OIOSAML as a SP.
OIOSAML has 2 urls for the single logout:
<md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://localhost:8443/oiosaml2-demo.java/saml/LogoutServiceHTTPPost" ResponseLocation="https://localhost:8443/oiosaml2-demo.java/saml/LogoutServiceHTTPRedirectResponse"/>
I dont see how to enter the Location and the ResponseLocation in the Clients config. If I import the metadata only the Location is used.?
Thanks?
Regards?Sylvain
Envoy? depuis Yahoo Mail pour Android  

From dt at acutus.pro  Fri Nov 16 19:15:01 2018
From: dt at acutus.pro (Dmitry Telegin)
Date: Sat, 17 Nov 2018 03:15:01 +0300
Subject: [keycloak-user] Re :Keycloak Idp SLO response location
In-Reply-To: <873954453.3176887.1542406785280@mail.yahoo.com>
References: <1665888810.3194155.1542406492861.ref@mail.yahoo.com>
	<1665888810.3194155.1542406492861@mail.yahoo.com>
	<873954453.3176887.1542406785280@mail.yahoo.com>
Message-ID: <1542413701.2114.1.camel@acutus.pro>

Hello Sylvain,

These settings are under the "Fine Grain SAML Endpoint Configuration" section in the client settings.

Cheers,
Dmitry Telegin
CTO, Acutus s.r.o.
Keycloak Consulting and Training

Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
+42 (022) 888-30-71
E-mail: info at acutus.pro 

On Fri, 2018-11-16 at 22:19 +0000, ge sly wrote:
> 
> ? Hi
> I am tringle to configure Keycloak as an Idp with OIOSAML as a SP.
> OIOSAML has 2 urls for the single logout:
> <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://localhost:8443/oiosaml2-demo.java/saml/LogoutServiceHTTPPost" ResponseLocation="https://localhost:8443/oiosaml2-demo.java/saml/LogoutServiceHTTPRedirectResponse"/>
> I dont see how to enter the Location and the ResponseLocation in the Clients config. If I import the metadata only the Location is used.?
> Thanks?
> Regards?Sylvain
> Envoy? depuis Yahoo Mail pour Android??
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From slyge2001 at yahoo.fr  Sat Nov 17 02:43:37 2018
From: slyge2001 at yahoo.fr (ge sly)
Date: Sat, 17 Nov 2018 07:43:37 +0000 (UTC)
Subject: [keycloak-user] Re :Re:  Re :Keycloak Idp SLO response location
In-Reply-To: <1542413701.2114.1.camel@acutus.pro>
References: <1665888810.3194155.1542406492861.ref@mail.yahoo.com>
	<1665888810.3194155.1542406492861@mail.yahoo.com>
	<873954453.3176887.1542406785280@mail.yahoo.com>
	<1542413701.2114.1.camel@acutus.pro>
Message-ID: <848358272.3247455.1542440617860@mail.yahoo.com>

Hi Dmitry?
Yes I saw it but here is only 2 urls:
   
   - Logout Service POST Binding URL
      -    
POST Binding URL for the Logout Service.

   - Logout Service Redirect Binding URL
      -    
Redirect Binding URL for the Logout Service
   
   

   
Where can I set the?

Logout Service POST Binding Response URL
and
Logout Service Redirect Response Binding URL
 

They are optional attributes in the SAML spec?
<complexType?name="EndpointType"><sequence><any?namespace="##other"processContents="lax"?minOccurs="0"maxOccurs="unbounded"/></sequence><attribute?name="Binding"?type="anyURI"use="required"/><attribute?name="Location"?type="anyURI"use="required"/><attribute?name="ResponseLocation"type="anyURI"?use="optional"/><anyAttribute?namespace="##other"processContents="lax"/></complexType>
ThanksRegardsSylvain

 
  Le sam., nov. 17, 2018 ? 1:15, Dmitry Telegin<dt at acutus.pro> a ?crit :   Hello Sylvain,

These settings are under the "Fine Grain SAML Endpoint Configuration" section in the client settings.

Cheers,
Dmitry Telegin
CTO, Acutus s.r.o.
Keycloak Consulting and Training

Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
+42 (022) 888-30-71
E-mail: info at acutus.pro 

On Fri, 2018-11-16 at 22:19 +0000, ge sly wrote:
> 
> ? Hi
> I am tringle to configure Keycloak as an Idp with OIOSAML as a SP.
> OIOSAML has 2 urls for the single logout:
> <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://localhost:8443/oiosaml2-demo.java/saml/LogoutServiceHTTPPost" ResponseLocation="https://localhost:8443/oiosaml2-demo.java/saml/LogoutServiceHTTPRedirectResponse"/>
> I dont see how to enter the Location and the ResponseLocation in the Clients config. If I import the metadata only the Location is used.?
> Thanks?
> Regards?Sylvain
> Envoy? depuis Yahoo Mail pour Android??
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
  

From zitrone at gmx-topmail.de  Sat Nov 17 06:08:49 2018
From: zitrone at gmx-topmail.de (zitrone at gmx-topmail.de)
Date: Sat, 17 Nov 2018 12:08:49 +0100
Subject: [keycloak-user] Adding attributes during login
In-Reply-To: <1542148837.10365.2.camel@acutus.pro>
References: <1541914268.3830.1.camel@acutus.pro>
	<7d9b9737-12f5-a48a-7ead-3355f55c257b@gmx-topmail.de>
	<1542148837.10365.2.camel@acutus.pro>
Message-ID: <669483c6-f462-4c7d-67a5-9d40284ae2a2@gmx-topmail.de>

Thank you very much.

For anyone interested, here is my full script. I check for the Referer 
header first, if it is empty i go for the direct parameters. Also 
restricted it to a certain role.

/ import enum for error lookup
AuthenticationFlowError = 
Java.type("org.keycloak.authentication.AuthenticationFlowError");

function authenticate(context) {
if (user.hasRole(realm.getRole("AllowedRole"))){
 ? ? var username = user ? user.username : "anonymous";
 ? ? var referer = httpRequest.httpHeaders.getHeaderString("Referer");
 ? ? var _foo;
 ? ? if (referer !== null){
 ? ? ? ? var uri = new java.net.URI(referer);
 ? ? ? ? var uriInfo = new org.jboss.resteasy.spi.ResteasyUriInfo(uri);
 ? ? ? ? _foo = uriInfo.queryParameters.coBrowsingSSOId;
 ? ? } else {
 ? ? ? ? _foo = httpRequest.uri.queryParameters.coBrowsingSSOId;
 ? ? }
 ? ? if (_foo !== null ){
 ? ? ? ? var foo = _foo[0]; // uriInfo.queryParameters is a multivalued map
 ? ? ? ? LOG.error(script.name + ": " + username + " foo =" + foo);
 ? ? ? ? authenticationSession.setUserSessionNote("foo", foo);
 ? ? ? ? context.success();
 ? ? } else {
 ? ? ? ? LOG.error("Missing query parameter 'foo'");
 ? ? ? ? context.failure(AuthenticationFlowError.INVALID_USER);
 ? ? }
} else {
 ? ? context.success();
}
}

Regards

Am 13.11.2018 um 23:40 schrieb Dmitry Telegin:
> Hi, you're welcome,
>
> In the second scenario (cookie-based auth), there is no HTTP redirect, hence your query params are in the actual URL, not in the referer header. You can extract them as follows:
>
> var _foo = httpRequest.uri.queryParameters['foo']);
> if (_foo !== null)
>    var foo = _foo[0];
>
> Good luck!
> Dmitry
>
> On Tue, 2018-11-13 at 20:11 +0100, zitrone at gmx-topmail.de wrote:
>> Hi,
>>
>> i'm working on a similar problem. I managed to set up a script
>> authenticator and a User Session Note Mapper. Works fine on first
>> request (like, on the first try. Thanks for the code!). I send the query
>> parameter to the auth endpoint, enter the credentials and get a code.
>> The token i get for the code contains the query parameter as a field.
>>
>> But when i query the auth endpoint a second time, it authenticates via
>> cookie. Then it starts the script and the script throws a null pointer
>> exception. The problen is, that the "Referer" header is null.
>>
>> The idea behind the second call is to "update" the session note. Any
>> ideas how to get the query parameter in this case? Or why it vanishes in
>> the first place?
>>
>>
>> Regards
>>
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user



From luca.stancapiano at vige.it  Sat Nov 17 06:35:29 2018
From: luca.stancapiano at vige.it (Luca Stancapiano)
Date: Sat, 17 Nov 2018 12:35:29 +0100 (CET)
Subject: [keycloak-user] Keycloak + JACC
Message-ID: <1535719027.93766.1542454529352@pim.register.it>

I'm trying out the quickstart example at https://github.com/keycloak/keycloak-quickstarts. 

I use a keycloak 4.5.0.Final server distribution and a Wildfly 14.0.1 that opts the keycloak adapter and the web application. 

Once the client is installed on the server distribution and added the correct keycloak.json as required in the README on https://github.com/keycloak/keycloak-quickstarts/blob/latest/app-authz-jee-vanilla/README.md , the application works well. 

I would like to understand though if JACC can be used as a standard in web applications. For example, if I try to use the PolicyContext class inside a controller class method:

????public boolean isLoggedIn (HttpServletRequest req) throws PolicyContextException {
????         System.out.println ("subject:" + PolicyContext.getContext ("javax.security.auth.Subject.container"));
????????     return getSession (req)! = null;
????}

I get null. Also trying to configure a JACC policy like:
/Subsystem=elytron/policy=JACC:add(JACC-policy={})
/Subsystem=undertow/application-security-domain=other:write-attribute(name=enable-JACC,value=true)

?I always get null. Is it possible to use JACC inside keycloak?


From luca.stancapiano at vige.it  Sat Nov 17 07:18:12 2018
From: luca.stancapiano at vige.it (Luca Stancapiano)
Date: Sat, 17 Nov 2018 13:18:12 +0100 (CET)
Subject: [keycloak-user] Keycloak + JACC
In-Reply-To: <1535719027.93766.1542454529352@pim.register.it>
References: <1535719027.93766.1542454529352@pim.register.it>
Message-ID: <2010368485.94191.1542457093148@pim.register.it>

The startguide sample I'm using is https://github.com/keycloak/keycloak-quickstarts/tree/latest/app-authz-jee-vanilla

> Il 17 novembre 2018 alle 12.35 Luca Stancapiano <luca.stancapiano at vige.it> ha scritto:
> 
> 
> I'm trying out the quickstart example at https://github.com/keycloak/keycloak-quickstarts. 
> 
> I use a keycloak 4.5.0.Final server distribution and a Wildfly 14.0.1 that opts the keycloak adapter and the web application. 
> 
> Once the client is installed on the server distribution and added the correct keycloak.json as required in the README on https://github.com/keycloak/keycloak-quickstarts/blob/latest/app-authz-jee-vanilla/README.md , the application works well. 
> 
> I would like to understand though if JACC can be used as a standard in web applications. For example, if I try to use the PolicyContext class inside a controller class method:
> 
>     public boolean isLoggedIn (HttpServletRequest req) throws PolicyContextException {
>              System.out.println ("subject:" + PolicyContext.getContext ("javax.security.auth.Subject.container"));
>              return getSession (req)! = null;
>     }
> 
> I get null. Also trying to configure a JACC policy like:
> /Subsystem=elytron/policy=JACC:add(JACC-policy={})
> /Subsystem=undertow/application-security-domain=other:write-attribute(name=enable-JACC,value=true)
> 
>  I always get null. Is it possible to use JACC inside keycloak?
> 
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From sakodiya at grepruby.com  Sat Nov 17 08:46:39 2018
From: sakodiya at grepruby.com (Shubham Akodiya)
Date: Sat, 17 Nov 2018 19:16:39 +0530
Subject: [keycloak-user] Create user with API & update the client role
Message-ID: <CAN2cN6f6fDfQO4UyDW-unSCyZE4-cX6FdEM4bRYkzRaLQ0tcVg@mail.gmail.com>

Hi,

Is there any way to create the user with default password using the API and
update the user client role while creating the user? It would be more
helpful If you provide any working example of nodeJS for this or suggest
the APIs.

I've already gone through the link
<https://www.keycloak.org/docs-api/4.5/rest-api/index.html#_users_resource>but
still, seems incomplete as per my requirement.

Thanks,
Shubham Akodiya

From willyvic17 at gmail.com  Sat Nov 17 20:11:04 2018
From: willyvic17 at gmail.com (William Nankap)
Date: Sun, 18 Nov 2018 02:11:04 +0100
Subject: [keycloak-user] Deploy keycloak to Kubernetes Cluster on GCP
Message-ID: <CAFmsN6z6vhFqWRqNhpRp9K10vxXGkKoLG2_84nROu9K3u8oVuw@mail.gmail.com>

Hi every one,

when i deploy docker keycloak4.5.0.Final to kubernetes cluster on GCP i can
normaly access to keycloak interface via the extern ip address on port
8080. But i can't access to the WILDFLY Management Interface on port 9990.
My questions:

1/ What are the recommandation to use keycloak in production?
     a/ Install keycloak server side an wildfly server to use it correctly?
     b/ Install only the keycloak server. How can i manage deployment for
an app if i can't access to the wildfly management interface? Is it
imperativ to access it?

2/ Need you more details on my deployment to help me? If yes, which?

3/ How can i get the wildfly management interface on my GCP deployment to
deploy my app?

4/ Have you suggestions for me, the best way to use keycloak in production?
Some support?

I will be very thankful for your answer.

Kindest regards...

From geoff at opticks.io  Sun Nov 18 06:27:33 2018
From: geoff at opticks.io (Geoffrey Cleaves)
Date: Sun, 18 Nov 2018 12:27:33 +0100
Subject: [keycloak-user] Querying permissions of the Policy API always empty
Message-ID: <CAHzT=q-=wofkEzCCmUm7mn47VLKD6Da60uztjg7e4EwZ_umhZA@mail.gmail.com>

Hi,

I'm sending GET requests to
http://${host}:${post}/auth/realms/${realm}/authz/protection/uma-policy
but only get an empty array. I have a permission/policy assigned to
hundreds of resources belonging to dozens of users and some resources owned
by the resource server itself. Reading the docs
<https://www.keycloak.org/docs/latest/authorization_services/index.html#_service_authorization_uma_policy_api>,
I expect to be able to get a list of all permissions or query by name.

Perhaps I am misunderstanding this:

This API is protected by a bearer token that must represent a consent
granted by the user to the resource server to manage permissions on his
behalf. The bearer token can be a regular access token obtained from the
token endpoint using:


   - Resource Owner Password Credentials Grant Type
      - Token Exchange, in order to exchange an access token granted to
      some client (public client) for a token where audience is the resource
      server

But I don't think so because if my token were wrong I'd get a 401 or 403
instead of 200 with an empty array. In any case I've tried with Client
Credentials Grant and Resource Owner Password Credentials Grant Type.

[image: Screen Shot 2018-11-18 at 12.19.25.png]
curl -D - -X GET \
   https://.../authz/protection/uma-policy \
   -H 'Authorization: Bearer eyJh' \
   -H 'Cache-Control: no-cache' \
   -H 'Postman-Token: deb09a7a-0499-430f-8164-3097e5ac145d' \
   -H 'cache-control: no-cache'

HTTP/1.1 200 OK
Server: nginx/1.11.10
Date: Sun, 18 Nov 2018 11:23:41 GMT
Content-Type: application/json
Content-Length: 2
Connection: keep-alive
Cache-Control: no-cache
[]

Any advise?
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Screen Shot 2018-11-18 at 12.19.25.png
Type: image/png
Size: 140604 bytes
Desc: not available
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20181118/8b97b534/attachment-0001.png 

From sakodiya at grepruby.com  Sun Nov 18 08:54:51 2018
From: sakodiya at grepruby.com (Shubham Akodiya)
Date: Sun, 18 Nov 2018 19:24:51 +0530
Subject: [keycloak-user] Getting 404 error while calling the create user API
	of keycloak 4.5
Message-ID: <CAN2cN6e8UEdjN1OQSMW8+a+4e0qYSKfEgr9GHf58CCmM31rPnA@mail.gmail.com>

Hi,

I'm getting the 404 error while calling the create user API. I've gone
through the steps which are explained in this link
<https://www.keycloak.org/docs-api/4.5/rest-api/index.html#_users_resource> but
still, it gives the 404 error.
URL - http://localhost:8080/auth/{realm_name}/users
METHOD - Post
Headers -
  Content-Type =  "application/json"
  Authorization = "bearer <token>"
Body -
{
    "username": "rodrigo.sasaki",
    "enabled": true,
    "totp": false,
    "emailVerified": false,
    "firstName": "Rodrigo",
    "lastName": "Sasaki",
    "email": "rodrigo.sasaki at email.com.br",
    "credentials": [
        {
            "type": "password",
            "value": "myPassword"
        }
    ]
}

From geoff at opticks.io  Sun Nov 18 09:51:14 2018
From: geoff at opticks.io (Geoffrey Cleaves)
Date: Sun, 18 Nov 2018 15:51:14 +0100
Subject: [keycloak-user] Querying permissions of the Policy API always
	empty
In-Reply-To: <CAHzT=q-=wofkEzCCmUm7mn47VLKD6Da60uztjg7e4EwZ_umhZA@mail.gmail.com>
References: <CAHzT=q-=wofkEzCCmUm7mn47VLKD6Da60uztjg7e4EwZ_umhZA@mail.gmail.com>
Message-ID: <CAHzT=q_tUDQU1J_kSL4_gpTnA5sra69sp=Bj4FK5NzNE4Pd=sw@mail.gmail.com>

I now see that I do get a list of *UMA permissions* when using the Resource
Owner Password Credentials Grant Type. I has wrongly expected to see the
permissions I had created as admin via the Admin Console.

Shouldn't it be possible for the resource server's service account to view
and create UMA permissions without needing to know the end users'
credentials for the Resource Owner Password Credentials Grant Type? Or
perhaps that is the whole point of UMA...

On Sun, 18 Nov 2018 at 12:27, Geoffrey Cleaves <geoff at opticks.io> wrote:

> Hi,
>
> I'm sending GET requests to http://${host}:${post}/auth/realms/${realm}/authz/protection/uma-policy
> but only get an empty array. I have a permission/policy assigned to
> hundreds of resources belonging to dozens of users and some resources owned
> by the resource server itself. Reading the docs
> <https://www.keycloak.org/docs/latest/authorization_services/index.html#_service_authorization_uma_policy_api>,
> I expect to be able to get a list of all permissions or query by name.
>
> Perhaps I am misunderstanding this:
>
> This API is protected by a bearer token that must represent a consent
> granted by the user to the resource server to manage permissions on his
> behalf. The bearer token can be a regular access token obtained from the
> token endpoint using:
>
>
>    - Resource Owner Password Credentials Grant Type
>       - Token Exchange, in order to exchange an access token granted to
>       some client (public client) for a token where audience is the resource
>       server
>
> But I don't think so because if my token were wrong I'd get a 401 or 403
> instead of 200 with an empty array. In any case I've tried with Client
> Credentials Grant and Resource Owner Password Credentials Grant Type.
>
> [image: Screen Shot 2018-11-18 at 12.19.25.png]
> curl -D - -X GET \
>    https://.../authz/protection/uma-policy \
>    -H 'Authorization: Bearer eyJh' \
>    -H 'Cache-Control: no-cache' \
>    -H 'Postman-Token: deb09a7a-0499-430f-8164-3097e5ac145d' \
>    -H 'cache-control: no-cache'
>
> HTTP/1.1 200 OK
> Server: nginx/1.11.10
> Date: Sun, 18 Nov 2018 11:23:41 GMT
> Content-Type: application/json
> Content-Length: 2
> Connection: keep-alive
> Cache-Control: no-cache
> []
>
> Any advise?
>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Screen Shot 2018-11-18 at 12.19.25.png
Type: image/png
Size: 140604 bytes
Desc: not available
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20181118/806b81ab/attachment-0001.png 

From robert.richter.02 at gmail.com  Sun Nov 18 10:01:16 2018
From: robert.richter.02 at gmail.com (Robert Richter)
Date: Sun, 18 Nov 2018 16:01:16 +0100
Subject: [keycloak-user] internal server error on /permission endpoint
Message-ID: <CADijGMuTZgiakvqk+y2hC2wW2K+HDuW0g=VKqev_+Lp0o6xxJA@mail.gmail.com>

 Hi all,
I'm using keycloak 4.5.0-FINAL in docker (
https://hub.docker.com/r/jboss/keycloak/)

I try to issue a permission ticket. Therefore I have requested a PAT for
the client "resource-provider" and send this along with the following json
body (with and without scopes). I received a http-500 internal server
error.

without scopes:{
    "resource_id": "resource-provider"
}
with scopes:
{
    "resource_id": "resource-provider",
    "resource_scopes": [
      "private-data.read"
    ]
}

Did I miss something? I also tried to investigate the log file
(/opt/jboss/keycloak/standalone/log/server.log) and increase the log level
in standalone.xml, but it seems that nothing is written to that file. I
restarted jboss with jboss-cli.sh /:reload. Do you have any suggestions for
me?

Kind regards
Tobert

From sakodiya at grepruby.com  Sun Nov 18 10:48:31 2018
From: sakodiya at grepruby.com (Shubham Akodiya)
Date: Sun, 18 Nov 2018 21:18:31 +0530
Subject: [keycloak-user] Assigning clientRoles while creating the new user
	through API
Message-ID: <CAN2cN6fEgjhk4Nf4F_vLY9u7dG6Fft_Jypm3uX_uOpM1rSJZnw@mail.gmail.com>

Hi,

I want to assign the clientRoles while creating the user. I've gone through
the link
https://www.keycloak.org/docs-api/4.5/rest-api/index.html#_userrepresentation
but
here the format of clientRoles is not specified. (It specified as a map but
no other info provided)

Could you please tell me how to assign the clientRoles while creating the
user through API?

Thanks,
Shubham Akodiya

From geoff at opticks.io  Sun Nov 18 12:55:14 2018
From: geoff at opticks.io (Geoffrey Cleaves)
Date: Sun, 18 Nov 2018 18:55:14 +0100
Subject: [keycloak-user] internal server error on /permission endpoint
In-Reply-To: <CADijGMuTZgiakvqk+y2hC2wW2K+HDuW0g=VKqev_+Lp0o6xxJA@mail.gmail.com>
References: <CADijGMuTZgiakvqk+y2hC2wW2K+HDuW0g=VKqev_+Lp0o6xxJA@mail.gmail.com>
Message-ID: <CAHzT=q8KigjZynir3eODT40zHDT1R9tZpZk8=phop4GpDGZ5TA@mail.gmail.com>

Is it possible you've got the wrong resource_id? The resource_id should
*not* be your client_id and you said the client is resource-provider.

I think the Docker images use the standalone-ha.xml. I usually do a docker
restart keycloak to reload config files, maybe jboss-cli.sh /:reload works
though.

On Sun, 18 Nov 2018 at 16:04, Robert Richter <robert.richter.02 at gmail.com>
wrote:

>  Hi all,
> I'm using keycloak 4.5.0-FINAL in docker (
> https://hub.docker.com/r/jboss/keycloak/)
>
> I try to issue a permission ticket. Therefore I have requested a PAT for
> the client "resource-provider" and send this along with the following json
> body (with and without scopes). I received a http-500 internal server
> error.
>
> without scopes:{
>     "resource_id": "resource-provider"
> }
> with scopes:
> {
>     "resource_id": "resource-provider",
>     "resource_scopes": [
>       "private-data.read"
>     ]
> }
>
> Did I miss something? I also tried to investigate the log file
> (/opt/jboss/keycloak/standalone/log/server.log) and increase the log level
> in standalone.xml, but it seems that nothing is written to that file. I
> restarted jboss with jboss-cli.sh /:reload. Do you have any suggestions for
> me?
>
> Kind regards
> Tobert
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

From geoff at opticks.io  Sun Nov 18 12:57:41 2018
From: geoff at opticks.io (Geoffrey Cleaves)
Date: Sun, 18 Nov 2018 18:57:41 +0100
Subject: [keycloak-user] Assigning clientRoles while creating the new
 user through API
In-Reply-To: <CAN2cN6fEgjhk4Nf4F_vLY9u7dG6Fft_Jypm3uX_uOpM1rSJZnw@mail.gmail.com>
References: <CAN2cN6fEgjhk4Nf4F_vLY9u7dG6Fft_Jypm3uX_uOpM1rSJZnw@mail.gmail.com>
Message-ID: <CAHzT=q-+YDN-27JD22GcsC7qsMA19NNXsKsrwVqkeoGQf95XoA@mail.gmail.com>

I don't have a direct answer for you, but you could try assigning a client
role to a user using the Admin Console and then listing the users via the
Admin Rest API to see the format.

Regards,
Geoffrey Cleaves

On Sun, 18 Nov 2018 at 17:03, Shubham Akodiya <sakodiya at grepruby.com> wrote:

> Hi,
>
> I want to assign the clientRoles while creating the user. I've gone through
> the link
>
> https://www.keycloak.org/docs-api/4.5/rest-api/index.html#_userrepresentation
> but
> here the format of clientRoles is not specified. (It specified as a map but
> no other info provided)
>
> Could you please tell me how to assign the clientRoles while creating the
> user through API?
>
> Thanks,
> Shubham Akodiya
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

From geoff at opticks.io  Sun Nov 18 13:00:28 2018
From: geoff at opticks.io (Geoffrey Cleaves)
Date: Sun, 18 Nov 2018 19:00:28 +0100
Subject: [keycloak-user] internal server error on /permission endpoint
In-Reply-To: <CAHzT=q8KigjZynir3eODT40zHDT1R9tZpZk8=phop4GpDGZ5TA@mail.gmail.com>
References: <CADijGMuTZgiakvqk+y2hC2wW2K+HDuW0g=VKqev_+Lp0o6xxJA@mail.gmail.com>
	<CAHzT=q8KigjZynir3eODT40zHDT1R9tZpZk8=phop4GpDGZ5TA@mail.gmail.com>
Message-ID: <CAHzT=q-rsBLkAEZgXFrmMMm2TUnUF+5HcvA-nUS7fiD1ZE956g@mail.gmail.com>

And I examine the docker logs with

docker logs -f keycloak

Regards,
Geoffrey Cleaves







On Sun, 18 Nov 2018 at 18:55, Geoffrey Cleaves <geoff at opticks.io> wrote:

> Is it possible you've got the wrong resource_id? The resource_id should
> *not* be your client_id and you said the client is resource-provider.
>
> I think the Docker images use the standalone-ha.xml. I usually do a docker
> restart keycloak to reload config files, maybe jboss-cli.sh /:reload works
> though.
>
> On Sun, 18 Nov 2018 at 16:04, Robert Richter <robert.richter.02 at gmail.com>
> wrote:
>
>>  Hi all,
>> I'm using keycloak 4.5.0-FINAL in docker (
>> https://hub.docker.com/r/jboss/keycloak/)
>>
>> I try to issue a permission ticket. Therefore I have requested a PAT for
>> the client "resource-provider" and send this along with the following json
>> body (with and without scopes). I received a http-500 internal server
>> error.
>>
>> without scopes:{
>>     "resource_id": "resource-provider"
>> }
>> with scopes:
>> {
>>     "resource_id": "resource-provider",
>>     "resource_scopes": [
>>       "private-data.read"
>>     ]
>> }
>>
>> Did I miss something? I also tried to investigate the log file
>> (/opt/jboss/keycloak/standalone/log/server.log) and increase the log level
>> in standalone.xml, but it seems that nothing is written to that file. I
>> restarted jboss with jboss-cli.sh /:reload. Do you have any suggestions
>> for
>> me?
>>
>> Kind regards
>> Tobert
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>

From dt at acutus.pro  Sun Nov 18 19:05:10 2018
From: dt at acutus.pro (Dmitry Telegin)
Date: Mon, 19 Nov 2018 03:05:10 +0300
Subject: [keycloak-user] Authenticated Protocol Mapper?
In-Reply-To: <E04CDA9B-0911-4881-B00D-87B51DD97BF8@cern.ch>
References: <B838B9AA-27B8-4518-996E-9B006102D083@cern.ch>
	<1542220061.2133.7.camel@acutus.pro>
	<E04CDA9B-0911-4881-B00D-87B51DD97BF8@cern.ch>
Message-ID: <1542585910.2445.7.camel@acutus.pro>

Hello Hannah, you're welcome,

Seems like your initial approach (Client Credentials grant aka service account) makes perfect sense. With the only one exception: you don't need that roundabout with authenticating service account and exchanging tokens. As the mapper code is executed on behalf of Keycloak, you're free to generate any token you want programmatically using Keycloak internal APIs.

This is how Keycloak produces access token in response to Client Credentials grant request:
https://github.com/keycloak/keycloak/blob/master/services/src/main/java/org/keycloak/protocol/oidc/endpoints/TokenEndpoint.java#L585

This is where it ends up inside a TokenManager:
https://github.com/keycloak/keycloak/blob/master/services/src/main/java/org/keycloak/protocol/oidc/TokenManager.java#L606

I think your code could be a simplified combination thereof. You need to construct a truly minimal access token without creating user sessions and stuff. I hope I'll be able to spend some time on a PoC this week.

On the other hand, the overall workflow seems a little cumbersome to me. Do you really need to invoke an external REST service each time your mapper is called, which could become a serious performance penalty? Maybe it would be sufficient to do it just once, during login, and then simply propagate the data to the tokens?
Could you please elaborate on the overall problem and what you're trying to achieve?

Cheers,
Dmitry Telegin
CTO, Acutus s.r.o.
Keycloak Consulting and Training

Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
+42 (022) 888-30-71
E-mail: info at acutus.pro

On Thu, 2018-11-15 at 10:13 +0000, Hannah Short wrote:
> Hi Dmitry,?
> 
> Thanks for your help!
> 
> > Just to make it clear: is your API secured by the same Keycloak instance? does it belong to the same realm?
> 
> Yes, both the same Keycloak instance and realm.
> 
> For the offline tokens approach, I?ve understood that they can only be generated programatically, and for a user. In our case this would be an offline token for the API (we could create a user to ?own" this token) - is there a way to generate tokens through the Keycloak UI??
> 
> Cheers,
> Hannah
> 
> > > > On 14 Nov 2018, at 19:27, Dmitry Telegin <dt at acutus.pro> wrote:
> > 
> > Hello Hannah,
> > 
> > Just to make it clear: is your API secured by the same Keycloak instance? does it belong to the same realm?
> > 
> > If so, this is probably a use case for offline tokens and/or impersonation. The idea is, the mapper is executed with Keycloak's privileges, hence no need to perform "honest" authentication; you can in fact produce any token you need to act on behalf of another identity.
> > 
> > However, I'd also suggest that you try to "short-circuit" the whole operation, maybe with the help of RMI/RPC. Is that possible? REST has more overhead, which can come to the fore under high load.
> > 
> > Cheers,
> > Dmitry Telegin
> > CTO, Acutus s.r.o.
> > Keycloak Consulting and Training
> > 
> > Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
> > +42 (022) 888-30-71
> > E-mail: info at acutus.pro
> > 
> > On Wed, 2018-11-14 at 11:24 +0000, Hannah Short wrote:
> > > Hi,?
> > > 
> > > I?d like to deploy a custom OIDC Protocol Mapper that is itself a client of Keycloak. Is this possible??
> > > 
> > > The objective is for the mapper to be able to call an API that is protected also by Keycloak.
> > > 
> > > The current approach was for the mapper to use the Client Credentials flow to authenticate, exchange the access token for one for the API client, and use it to call the API. This works OK until I deploy the mapper to Keycloak, where it throws various exceptions and does not seem to attempt the Client Credentials flow.
> > > 
> > > Any guidance, including alternative approaches, would be appreciated!
> > > 
> > > Cheers,
> > > Hannah
> > > 
> > > _______________________________________________
> > > keycloak-user mailing list
> > > keycloak-user at lists.jboss.org
> > > https://lists.jboss.org/mailman/listinfo/keycloak-user
> 
> 

From dt at acutus.pro  Sun Nov 18 19:15:47 2018
From: dt at acutus.pro (Dmitry Telegin)
Date: Mon, 19 Nov 2018 03:15:47 +0300
Subject: [keycloak-user] SSO experience
In-Reply-To: <AM0PR06MB554092D546413DC77E09919492DC0@AM0PR06MB5540.eurprd06.prod.outlook.com>
References: <AM0PR06MB55401025C96174BB7FE8465F92C30@AM0PR06MB5540.eurprd06.prod.outlook.com>
	<1542220463.2133.9.camel@acutus.pro>
	<AM0PR06MB554092D546413DC77E09919492DC0@AM0PR06MB5540.eurprd06.prod.outlook.com>
Message-ID: <1542586547.2445.9.camel@acutus.pro>

Hi Ori, you're welcome,

On Thu, 2018-11-15 at 09:15 +0000, Ori Doolman wrote:
> Hi Dmitry,
> Thank you for answering.
> In fact, the desktop app is not yet integrated to Keycloak and it is work to be done.?
> I'm not familiar with the desktop app since it is a 3rd party app not written by us. If Java based, I thought of using one of the Keycloak Java adapters. If not, just get the token with an HTTP[S] call (which seems that this is also what kcinit and KeycloakInstalled are doing as well).
> I was not familiar with kcinit or KeycloakInstalled before.?
> KeycloakInstalled might be a solution, but with limitations:
> 1) The desktop app must be written in Java.
> 2) It must be acceptable by the app designers to launch a browser for login.?
> 3) If I understand correctly, it only performs a client level authentication, not supporting username/password credentials authentication.
> 
> That leads me to the original question - can I have SSO without using cookies, and by simply send the token to my web app as part of the starting URL (the desktop app will launch the web app in a browser)?

Is this correct that your desktop app uses direct grant to authenticate a user with login/password and to obtain tokens from Keycloak OIDC endpoint? This would imply that the features like e.g. password reset or conditional OTP, available via Keycloak interactive login only, would be unavailable.

If you're ok with this, I think what you're talking about should be possible.?Token size (and hence URL length) shouldn't be the issue, since modern browsers are able to swallow really gigantic URLs (like "data:"). Obviously, it will be the responsibility of your webapp to parse the token out of URL.

And please don't forget that you'll have to pass refresh token too, since access tokens are short-lived and you'll need to refresh them.

Good luck,
Dmitry Telegin
CTO, Acutus s.r.o.
Keycloak Consulting and Training

Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
+42 (022) 888-30-71
E-mail: info at acutus.pro

> 
> 
> Thanks,
> 
> Ori Doolman
> Lead Software Architect
> Amdocs Optima
> 
> +972 9 778 6914 (office)
> +972 50 9111442 (mobile)
> 
> 
> 
> -----Original Message-----
> > From: Dmitry Telegin <dt at acutus.pro>?
> Sent: Wednesday, November 14, 2018 20:34
> > To: Ori Doolman <Ori.Doolman at Amdocs.com>; keycloak-user at lists.jboss.org
> Subject: Re: [keycloak-user] SSO experience
> 
> Hello Ori,
> 
> How do you implement SSO for your desktop application? Are you using kcinit [1] or KeycloakInstalled [2]?
> 
> Both will do interactive login via the system browser, that means, SSO cookies should be shared with whatever web application that is run therein.
> 
> Cheers,
> Dmitry Telegin
> CTO, Acutus s.r.o.
> Keycloak Consulting and Training
> 
> Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
> +42 (022) 888-30-71
> E-mail: info at acutus.pro
> 
> [1] https://github.com/keycloak/kcinit
> [2] https://www.keycloak.org/docs/latest/securing_apps/index.html#_installed_adapter
> 
> On Wed, 2018-11-14 at 10:36 +0000, Ori Doolman wrote:
> > Hi,
> > I have 2 applications: one is desktop (Windows) and the other one is a web application.
> > My desktop application performs authentication and login using Keycloak, and getting a JWT Access Token.
> > My web application is using the Keycloak JS adapter to perform the same.
> > 
> > After I login to my desktop application, is there a way to pass the generated access token to the web application and continue the same session? Or at least have an SSO experience and get another token for the user without the user entering the credentials again?
> > 
> > 
> > 
> > Maybe I can pass the token and refresh token from desktop application as init parameters to the Keycloak-JS ?
> > I see the following code is checking if initOptions contains the token:
> > 
> > 
> > ????????????function processInit() {
> > ????????????????var callback = parseCallback(window.location.href);
> > 
> > ????????????????if (callback) {
> > ????????????????????window.history.replaceState({}, null, callback.newUrl);
> > ????????????????}
> > 
> > ????????????????if (callback && callback.valid) {
> > ????????????????????return setupCheckLoginIframe().success(function() {
> > ????????????????????????processCallback(callback, initPromise);
> > ????????????????????}).error(function (e) {
> > ????????????????????????initPromise.setError();
> > ????????????????????});
> > ????????????????} else if (initOptions) {
> > ????????????????????if (initOptions.token && initOptions.refreshToken) {
> > ????????????????????????setToken(initOptions.token, initOptions.refreshToken, initOptions.idToken);
> > 
> > 
> > 
> > 
> > 
> > 
> > Thanks,
> > 
> > Ori Doolman
> > Lead Software Architect
> > Amdocs Optima
> > 
> > 
> > > [cid:image001.png at 01D2C8DE.BFF33E10]
> > 
> > ?Amdocs? email platform is based on a third-party, worldwide, cloud-based system. Any emails sent to Amdocs will be processed and stored using such system and are accessible by third party providers of such system on a limited basis. Your sending of emails to Amdocs evidences your consent to the use of such system and such processing, storing and access?.
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
> 
> ?Amdocs? email platform is based on a third-party, worldwide, cloud-based system. Any emails sent to Amdocs will be processed and stored using such system and are accessible by third party providers of such system on a limited basis. Your sending of emails to Amdocs evidences your consent to the use of such system and such processing, storing and access?.

From dt at acutus.pro  Sun Nov 18 19:17:50 2018
From: dt at acutus.pro (Dmitry Telegin)
Date: Mon, 19 Nov 2018 03:17:50 +0300
Subject: [keycloak-user] ldaps configuration --> Bug or regression with
 ldap connection ulr
In-Reply-To: <CAF83W6L7Tz2w-1cOwUubk5bY16G3z_N8rn27PMmp9g-bZZyK2g@mail.gmail.com>
References: <CAF83W6L7Tz2w-1cOwUubk5bY16G3z_N8rn27PMmp9g-bZZyK2g@mail.gmail.com>
Message-ID: <1542586670.2445.11.camel@acutus.pro>

Meissa,

This looks like an unconfigured SSL truststore. Could it be that you have configured it in standalone.xml instead of standalone-ha.xml (which is used by default in Docker image for Keycloak 4.5.0+)?

Cheers,
Dmitry Telegin
CTO, Acutus s.r.o.
Keycloak Consulting and Training

Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
+42 (022) 888-30-71
E-mail: info at acutus.pro

On Thu, 2018-11-15 at 10:12 +0100, Meissa M'baye Sakho wrote:
> Hello everyone,
> I'm facing a very strange behaviour using keycloak 4.5 Final while
> configuring my realm user federation with ldaps.
> When I set the ldap connection URL to ldaps://myldaphost. It works fine.
> When I change it to LDAPS://myldaphost, the test connexion fails with the
> exception below (extract):
> 
> *KC-SERVICES0055: Error when connecting to LDAP:
> intra-dev01.bdf-dev01.local:636: javax.naming.CommunicationException:
> intra-dev01.bdf-dev01.local:636 [Root exception is
> javax.net.ssl.SSLHandshakeException:
> sun.security.validator.ValidatorException: PKIX path building failed:
> sun.security.provider.certpath.SunCertPathBuilderException: unable to find
> valid certification path to requested target]*
> *????????at com.sun.jndi.ldap.Connection.<init>(Connection.java:238)*
> *????????at com.sun.jndi.ldap.LdapClient.<init>(LdapClient.java:137)*
> *????????at com.sun.jndi.ldap.LdapClient.getInstance(LdapClient.java:1615)*
> *????????at com.sun.jndi.ldap.LdapCtx.connect(LdapCtx.java:2749)*
> *????????at com.sun.jndi.ldap.LdapCtx.<init>(LdapCtx.java:319)*
> *????????at
> com.sun.jndi.ldap.LdapCtxFactory.getUsingURL(LdapCtxFactory.java:192)*
> *????????at
> com.sun.jndi.ldap.LdapCtxFactory.getUsingURLs(LdapCtxFactory.java:210)*
> 
> * Caused by: javax.net.ssl.SSLHandshakeException:
> sun.security.validator.ValidatorException: PKIX path building failed:
> sun.security.provider.certpath.SunCertPathBuilderException: unable to find
> valid certification path to requested target*
> *????????at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)*
> *????????at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1964)*
> 
> With Keycloak 3.4.3Final, I used LDAPS without any problem.
> Any advice?
> Meissa
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From ashutosh.kanthi at exfo.com  Mon Nov 19 02:11:40 2018
From: ashutosh.kanthi at exfo.com (Ashutosh Kanthi)
Date: Mon, 19 Nov 2018 07:11:40 +0000
Subject: [keycloak-user] Keycloak Session timeout issue
Message-ID: <616f0c82ace0445abf1114b4b980d7a3@exfo.com>

Hi,

We are using Keycloak 2.5.5 and we are facing issues with regard to keycloak session timeout.


  1.  Even after session timeout for a particular user, keycloak is maintaining session for that particular user for some extended time.
  2.  And if the same user log in again then keycloak is showing that the same user maintains 2 sessions in active session section. (Previous session [it is no longer exists for him at application level] and current session.)

We have done following keycloak settings just for checking above scenario.  Could anyone please suggest what are the settings to be done in keycloak so that above mentioned scenario could be avoided?

[cid:image002.jpg at 01D48002.E6221430]

Thanks & regards,
Ashutosh Kanthi

Le contenu de ce courriel et de toute pi?ce jointe est destin? ? l?usage exclusif de son destinataire. Il contient des renseignements exclusifs, privil?gi?s, confidentiels ou assujettis au droit d?auteur. Toute divulgation, distribution ou reproduction non autoris?e est strictement interdite. Si vous n??tes pas le destinataire pr?vu, veuillez-nous en aviser imm?diatement et supprimer toutes les copies de ce courriel et des pi?ces jointes. Les courriels sont susceptibles d?alt?ration. EXFO Inc. et ses soci?t?s affili?es ne seront pas tenues responsables du message s?il a ?t? contrefait, modifi? ou falsifi?.

The content of this email and any of its attachments is intended for the exclusive use of its recipient. It contains information that is proprietary, privileged, confidential and/or subject to copyright. Any unauthorized disclosure, distribution or reproduction is strictly prohibited. If you are not the intended recipient, please notify us immediately and delete all copies of this email and any attachments. E-mails are susceptible to alteration. EXFO Inc. and its affiliates shall not be liable for the message if altered, changed or falsified.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image002.jpg
Type: image/jpeg
Size: 23507 bytes
Desc: image002.jpg
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20181119/cdc83ffa/attachment-0001.jpg 

From dt at acutus.pro  Mon Nov 19 02:34:03 2018
From: dt at acutus.pro (Dmitry Telegin)
Date: Mon, 19 Nov 2018 10:34:03 +0300
Subject: [keycloak-user] Keycloak Session timeout issue
In-Reply-To: <616f0c82ace0445abf1114b4b980d7a3@exfo.com>
References: <616f0c82ace0445abf1114b4b980d7a3@exfo.com>
Message-ID: <1542612843.2282.1.camel@acutus.pro>

Hello Ashutosh,

Could you please try to reproduce this with the latest Keycloak (4.6.0)? Version 2.5.5 has been released around 1.5 years ago, quite a lot has been done since then, including session management.

Cheers,
Dmitry Telegin
CTO, Acutus s.r.o.
Keycloak Consulting and Training

Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
+42 (022) 888-30-71
E-mail: info at acutus.pro

On Mon, 2018-11-19 at 07:11 +0000, Ashutosh Kanthi wrote:
> Hi,
> 
> We are using Keycloak 2.5.5 and we are facing issues with regard to keycloak session timeout.
> 
> 
> ? 1.??Even after session timeout for a particular user, keycloak is maintaining session for that particular user for some extended time.
> ? 2.??And if the same user log in again then keycloak is showing that the same user maintains 2 sessions in active session section. (Previous session [it is no longer exists for him at application level] and current session.)
> 
> We have done following keycloak settings just for checking above scenario.??Could anyone please suggest what are the settings to be done in keycloak so that above mentioned scenario could be avoided?
> 
> > [cid:image002.jpg at 01D48002.E6221430]
> 
> Thanks & regards,
> Ashutosh Kanthi
> 
> Le contenu de ce courriel et de toute pi?ce jointe est destin? ? l?usage exclusif de son destinataire. Il contient des renseignements exclusifs, privil?gi?s, confidentiels ou assujettis au droit d?auteur. Toute divulgation, distribution ou reproduction non autoris?e est strictement interdite. Si vous n??tes pas le destinataire pr?vu, veuillez-nous en aviser imm?diatement et supprimer toutes les copies de ce courriel et des pi?ces jointes. Les courriels sont susceptibles d?alt?ration. EXFO Inc. et ses soci?t?s affili?es ne seront pas tenues responsables du message s?il a ?t? contrefait, modifi? ou falsifi?.
> 
> The content of this email and any of its attachments is intended for the exclusive use of its recipient. It contains information that is proprietary, privileged, confidential and/or subject to copyright. Any unauthorized disclosure, distribution or reproduction is strictly prohibited. If you are not the intended recipient, please notify us immediately and delete all copies of this email and any attachments. E-mails are susceptible to alteration. EXFO Inc. and its affiliates shall not be liable for the message if altered, changed or falsified.
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From robert.richter.02 at gmail.com  Mon Nov 19 02:46:32 2018
From: robert.richter.02 at gmail.com (Robert Richter)
Date: Mon, 19 Nov 2018 08:46:32 +0100
Subject: [keycloak-user] internal server error on /permission endpoint
In-Reply-To: <CAHzT=q-rsBLkAEZgXFrmMMm2TUnUF+5HcvA-nUS7fiD1ZE956g@mail.gmail.com>
References: <CADijGMuTZgiakvqk+y2hC2wW2K+HDuW0g=VKqev_+Lp0o6xxJA@mail.gmail.com>
	<CAHzT=q8KigjZynir3eODT40zHDT1R9tZpZk8=phop4GpDGZ5TA@mail.gmail.com>
	<CAHzT=q-rsBLkAEZgXFrmMMm2TUnUF+5HcvA-nUS7fiD1ZE956g@mail.gmail.com>
Message-ID: <CADijGMsgvTfz6ivhDxu22AzF-aBZXbeDgN26Y2jXb+vJSU=sAg@mail.gmail.com>

Hi Geoffrey,
you are absolutely right. I didn't use the resource-id, I was using the
client-id and your hint to inspect the docker logs shows a parsing error of
the request. I missed that the request body has to be a json-array. Now I
received a ticket :) wonderful!

Am So., 18. Nov. 2018 um 19:00 Uhr schrieb Geoffrey Cleaves <
geoff at opticks.io>:

> And I examine the docker logs with
>
> docker logs -f keycloak
>
> Regards,
> Geoffrey Cleaves
>
>
>
>
>
>
>
> On Sun, 18 Nov 2018 at 18:55, Geoffrey Cleaves <geoff at opticks.io> wrote:
>
>> Is it possible you've got the wrong resource_id? The resource_id should
>> *not* be your client_id and you said the client is resource-provider.
>>
>> I think the Docker images use the standalone-ha.xml. I usually do a
>> docker restart keycloak to reload config files, maybe jboss-cli.sh /:reload
>> works though.
>>
>> On Sun, 18 Nov 2018 at 16:04, Robert Richter <robert.richter.02 at gmail.com>
>> wrote:
>>
>>>  Hi all,
>>> I'm using keycloak 4.5.0-FINAL in docker (
>>> https://hub.docker.com/r/jboss/keycloak/)
>>>
>>> I try to issue a permission ticket. Therefore I have requested a PAT for
>>> the client "resource-provider" and send this along with the following
>>> json
>>> body (with and without scopes). I received a http-500 internal server
>>> error.
>>>
>>> without scopes:{
>>>     "resource_id": "resource-provider"
>>> }
>>> with scopes:
>>> {
>>>     "resource_id": "resource-provider",
>>>     "resource_scopes": [
>>>       "private-data.read"
>>>     ]
>>> }
>>>
>>> Did I miss something? I also tried to investigate the log file
>>> (/opt/jboss/keycloak/standalone/log/server.log) and increase the log
>>> level
>>> in standalone.xml, but it seems that nothing is written to that file. I
>>> restarted jboss with jboss-cli.sh /:reload. Do you have any suggestions
>>> for
>>> me?
>>>
>>> Kind regards
>>> Tobert
>>> _______________________________________________
>>> keycloak-user mailing list
>>> keycloak-user at lists.jboss.org
>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>
>>

From dt at acutus.pro  Mon Nov 19 03:52:13 2018
From: dt at acutus.pro (Dmitry Telegin)
Date: Mon, 19 Nov 2018 11:52:13 +0300
Subject: [keycloak-user] group mapper per client
In-Reply-To: <1541805512.2031.3.camel@acutus.pro>
References: <VI1PR0402MB3696F22D057049DF4B800480E9F30@VI1PR0402MB3696.eurprd04.prod.outlook.com>
	<1540868804.2121.1.camel@acutus.pro>
	<VI1PR0402MB3696AC0B264006DEB14A50EDE9CD0@VI1PR0402MB3696.eurprd04.prod.outlook.com>
	<1541805512.2031.3.camel@acutus.pro>
Message-ID: <1542617533.2282.3.camel@acutus.pro>

Hello Ronald,

It has turned out there's an easy way to overcome the issue with SSO cookie, without turning off SSO itself.

Let's imagine that your script authenticator looks like the following:

=============================================================
AuthenticationFlowError = Java.type("org.keycloak.authentication.AuthenticationFlowError");

function invalidGroup(context) {
    return context.form()
            .setError("Invalid group membership", []).createLogin();
}

function authenticate(context) {

    var clientId = authenticationSession.client.clientId;
    var username = user ? user.username : "anonymous";
    LOG.info(script.name + " trace auth for: " + username);
    
    var groups = Java.from(user.groups)
        .filter(function(group) {
            return RegExp("(.*)-" + clientId + "-(.*)", "i").test(group.name);
        });

    var authShouldFail = !(groups.length);
    
    if (authShouldFail) {
        var challengeResponse = invalidGroup(context)
        context.failureChallenge(AuthenticationFlowError.INVALID_CREDENTIALS, challengeResponse);
        return;
    }

    context.success();
    
}
=============================================================

The idea is to wrap Keycloak's standard browser flow into a subflow, add your authenticator after it, and make both REQUIRED (see attached image).

In this case, the authenticator will be executed unconditionally, even in the case of SSO cookie presence (in the opposite to ALTERNATIVE). This should finally solve the problem.

Good luck,
Dmitry Telegin
CTO, Acutus s.r.o.
Keycloak Consulting and Training

Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
+42 (022) 888-30-71
E-mail: info at acutus.pro

On Sat, 2018-11-10 at 02:18 +0300, Dmitry Telegin wrote:
> Ronald, glad to hear it worked,
> 
> There is however an important moment regarding potential security issue with your authenticator.
> 
> Imagine the following scenario:
> 1. a user?with the correct group membership logs into the client app A;
> 2. the same user tries to access client B (for which he/she doesn't have group membership);
> 3. client B redirects the user to Keycloak for authentication;
> 4. due to cookie-based SSO, Keycloak decides that the user is already authenticated and logs him/her in client B.
> 
> To avoid this, you should turn off cookie-based auth for your restricted clients. Go to Authentication, create a copy of your browser flow (which should already have your script authenticator), remove Cookie, then go to your clients' settings and configure Authentication Flow Overrides for browser flow.
> 
> This will actually disable SSO to your clients. If this is not acceptable, there are some other options to consider (however more complex).
> 
> You should also make sure you don't enable token exchange between clients [1] (this is disabled by default).
> 
> [1] https://www.keycloak.org/docs/latest/securing_apps/index.html#internal-token-to-internal-token-exchange
> 
> Good luck,
> Dmitry Telegin
> CTO, Acutus s.r.o.
> Keycloak Consulting and Training
> 
> Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
> +42 (022) 888-30-71
> E-mail: info at acutus.pro
> 
> On Wed, 2018-10-31 at 13:49 +0000, Ronald Demneri wrote:
> > Hello everyone,
> > 
> > So, thankfully, after some careful reading, I managed to solve the first issue regarding clientSession.client.clientId, which in fact shoud be authenticationSession.client.clientId (there was a mention on using loginSession.client.clientId in place of clientSession.client.clientId on this link https://issues.jboss.org/browse/KEYCLOAK-4505, which I tried to use, without success).
> > 
> > 
> > Regards,
> > Ronald
> > 
> > -----Original Message-----
> > From: Ronald Demneri?
> > Sent: 30.Oct.2018 3:48 PM
> > > To: 'Dmitry Telegin' <dt at acutus.pro>; keycloak-user at lists.jboss.org
> > 
> > Subject: RE: [keycloak-user] group mapper per client
> > 
> > Almost forgot, If I set a static group name to compare against (which is not our goal, but just for testing), it works correctly if the account is member of that group. If the user is not a member, then it'll display an error like "Invalid username or password". Is it possible to modify the response in such cases, stating that the account is not a member of required groups, or at least have it like "Invalid group membership".
> > 
> > 
> > Looking forward to hearing from you!
> > 
> > 
> > Regards,
> > Ronald
> > 
> > -----Original Message-----
> > > From: Dmitry Telegin <dt at acutus.pro>?
> > 
> > Sent: 30.Oct.2018 4:07 AM
> > > To: Ronald Demneri <ronald.demneri at amdtia.com>; keycloak-user at lists.jboss.org
> > 
> > Subject: Re: [keycloak-user] group mapper per client
> > 
> > Hello Ronald,
> > 
> > If there is a literal correspondence between your AD group names and client names (like e.g. if the client is named "foo", and the corresponding AD group is "AD_group_foo"), you can do the following trick:
> > - make sure you have group-ldap-mapper configured in LDAP mappers, i.e. AD groups are synced to Keycloak groups;
> > - create a Javascript authenticator that would check client name against user's groups, and add it to your authentication flow. If the user tries to authenticate against the client without being a member of the corresponding group, the authenticator should deny login.
> > 
> > If there is no such correspondence (e.g. the client is named "foo", and the group is "AD_group_bar"), you still have the following options:
> > - map AD groups to Keycloak roles using role-ldap-mapper, then use your adapter's configuration to restrict access only to the users with this role (e.g. <security-constraint> in web.xml);
> > - or map AD groups to Keycloak groups, enable authorization services and use group policy (if your client adapter supports authorization, of course).
> > 
> > This, however, will need to be configured per each client, on the contrary to the first approach (configured once per realm).
> > 
> > Let me know if you need further explanations, Dmitry Telegin CTO, Acutus s.r.o.
> > Keycloak Consulting and Training
> > 
> > Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
> > +42 (022) 888-30-71
> > E-mail: info at acutus.pro
> > 
> > On Mon, 2018-10-29 at 15:35 +0000, Ronald Demneri wrote:
> > > Hello everyone,
> > > 
> > > Please forgive me if this was already asked previously. After creating the LDAP connection (read-only) and some LDAP mappers, I am trying to figure out a way how to allow login to clients for users in respective groups in AD, for example for client app1 allow login to users that are members of AD_group_app1; if account is not a member of the app1 group in AD, then he should not be allowed to login. Is it also possible to do it via role mappings? Please note that we'd like to avoid modification of AD at all costs.
> > > 
> > > 
> > > Thanks in advance,
> > > Ronald
> > > _______________________________________________
> > > keycloak-user mailing list
> > > keycloak-user at lists.jboss.org
> > > https://lists.jboss.org/mailman/listinfo/keycloak-user
> 
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
-------------- next part --------------
A non-text attachment was scrubbed...
Name: auth-flow-Ronald.png
Type: image/png
Size: 53760 bytes
Desc: not available
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20181119/63092bcf/attachment-0001.png 

From luca.stancapiano at vige.it  Mon Nov 19 04:06:07 2018
From: luca.stancapiano at vige.it (Luca Stancapiano)
Date: Mon, 19 Nov 2018 10:06:07 +0100 (CET)
Subject: [keycloak-user] Get current user through JACC
In-Reply-To: <1542612843.2282.1.camel@acutus.pro>
References: <616f0c82ace0445abf1114b4b980d7a3@exfo.com>
	<1542612843.2282.1.camel@acutus.pro>
Message-ID: <1470827227.112986.1542618368007@pim.register.it>

I'm testing a javaee webapp inside a Wildfly with a 4.5.0.Final keycloak adapter installed. The authentication is ok but now I would get in my web app the current user id.

Using this code:

javax.security.jacc.PolicyContext.getContext("javax.security.auth.Subject.container");

I get null. How I miss to receive the user id?

You can test the sample of the keycloak quickstart from https://github.com/keycloak/keycloak-quickstarts/tree/latest/app-authz-jee-vanilla and add that code in the Controller class where do you want.

From slyge2001 at yahoo.fr  Mon Nov 19 05:19:53 2018
From: slyge2001 at yahoo.fr (ge sly)
Date: Mon, 19 Nov 2018 10:19:53 +0000 (UTC)
Subject: [keycloak-user] Re :Re:  Re :Keycloak Idp SLO response location
In-Reply-To: <848358272.3247455.1542440617860@mail.yahoo.com>
References: <1665888810.3194155.1542406492861.ref@mail.yahoo.com>
	<1665888810.3194155.1542406492861@mail.yahoo.com>
	<873954453.3176887.1542406785280@mail.yahoo.com>
	<1542413701.2114.1.camel@acutus.pro>
	<848358272.3247455.1542440617860@mail.yahoo.com>
Message-ID: <586659305.4611156.1542622793046@mail.yahoo.com>

"They are optional attributes in the SAML spec"?I mean the ResponseLocation attribute. Where can I configure it?


 
 
  Le sam., nov. 17, 2018 ? 8:43, ge sly<slyge2001 at yahoo.fr> a ?crit :   Hi Dmitry?
Yes I saw it but here is only 2 urls:
   
   - Logout Service POST Binding URL
      -    
POST Binding URL for the Logout Service.

   - Logout Service Redirect Binding URL
      -    
Redirect Binding URL for the Logout Service
   
   

   
Where can I set the?

Logout Service POST Binding Response URL
and
Logout Service Redirect Response Binding URL
 

They are optional attributes in the SAML spec?
<complexType?name="EndpointType"><sequence><any?namespace="##other"processContents="lax"?minOccurs="0"maxOccurs="unbounded"/></sequence><attribute?name="Binding"?type="anyURI"use="required"/><attribute?name="Location"?type="anyURI"use="required"/><attribute?name="ResponseLocation"type="anyURI"?use="optional"/><anyAttribute?namespace="##other"processContents="lax"/></complexType>
ThanksRegardsSylvain

 
  Le sam., nov. 17, 2018 ? 1:15, Dmitry Telegin<dt at acutus.pro> a ?crit :   Hello Sylvain,

These settings are under the "Fine Grain SAML Endpoint Configuration" section in the client settings.

Cheers,
Dmitry Telegin
CTO, Acutus s.r.o.
Keycloak Consulting and Training

Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
+42 (022) 888-30-71
E-mail: info at acutus.pro 

On Fri, 2018-11-16 at 22:19 +0000, ge sly wrote:
> 
> ? Hi
> I am tringle to configure Keycloak as an Idp with OIOSAML as a SP.
> OIOSAML has 2 urls for the single logout:
> <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://localhost:8443/oiosaml2-demo.java/saml/LogoutServiceHTTPPost" ResponseLocation="https://localhost:8443/oiosaml2-demo.java/saml/LogoutServiceHTTPRedirectResponse"/>
> I dont see how to enter the Location and the ResponseLocation in the Clients config. If I import the metadata only the Location is used.?
> Thanks?
> Regards?Sylvain
> Envoy? depuis Yahoo Mail pour Android??
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
  
  

From geoff at opticks.io  Mon Nov 19 05:56:44 2018
From: geoff at opticks.io (Geoffrey Cleaves)
Date: Mon, 19 Nov 2018 11:56:44 +0100
Subject: [keycloak-user] Permission tab missing, token exchange impossible
Message-ID: <CAHzT=q9TttPN_QLvNKOjM+MVqiqw21Wujtq6UdXr5YvSc66=Gw@mail.gmail.com>

Hello. In Keycloak 4.6, the Permissions tab is gone. The documentation for
allowing token exchange depends on the Permissions tab, is this a bug?

[image: Screen Shot 2018-11-19 at 11.53.56.png]

Somebody else is asking the same question:
https://stackoverflow.com/questions/53367566/unable-to-setup-idp-token-exchange-in-keycloak-4-6-0-final

Geoff
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Screen Shot 2018-11-19 at 11.53.56.png
Type: image/png
Size: 36928 bytes
Desc: not available
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20181119/84fccb6c/attachment-0001.png 

From psilva at redhat.com  Mon Nov 19 06:34:25 2018
From: psilva at redhat.com (Pedro Igor Silva)
Date: Mon, 19 Nov 2018 09:34:25 -0200
Subject: [keycloak-user] Permission tab missing,
	token exchange impossible
In-Reply-To: <CAHzT=q9TttPN_QLvNKOjM+MVqiqw21Wujtq6UdXr5YvSc66=Gw@mail.gmail.com>
References: <CAHzT=q9TttPN_QLvNKOjM+MVqiqw21Wujtq6UdXr5YvSc66=Gw@mail.gmail.com>
Message-ID: <CAJrcDBeXgdoGQOUwbeeNDwArpUEJr=6sEOqFOP1pad=rGymE7w@mail.gmail.com>

Hi,

It is not a bug. We no longer enable tech preview features by default. You
need to enable the feature you want, such as admin fine grained
permissions, by passing a specific environment variable. Try to boot your
server using this system property:

    - Dkeycloak.profile.feature.admin_fine_grained_authz=enabled

Docs are not reflecting these changes, created
https://issues.jboss.org/browse/KEYCLOAK-8865.

Regards.
Pedro Igor

On Mon, Nov 19, 2018 at 9:02 AM Geoffrey Cleaves <geoff at opticks.io> wrote:

> Hello. In Keycloak 4.6, the Permissions tab is gone. The documentation for
> allowing token exchange depends on the Permissions tab, is this a bug?
>
> [image: Screen Shot 2018-11-19 at 11.53.56.png]
>
> Somebody else is asking the same question:
>
> https://stackoverflow.com/questions/53367566/unable-to-setup-idp-token-exchange-in-keycloak-4-6-0-final
>
> Geoff
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From psilva at redhat.com  Mon Nov 19 06:44:36 2018
From: psilva at redhat.com (Pedro Igor Silva)
Date: Mon, 19 Nov 2018 09:44:36 -0200
Subject: [keycloak-user] Querying permissions of the Policy API always
	empty
In-Reply-To: <CAHzT=q_tUDQU1J_kSL4_gpTnA5sra69sp=Bj4FK5NzNE4Pd=sw@mail.gmail.com>
References: <CAHzT=q-=wofkEzCCmUm7mn47VLKD6Da60uztjg7e4EwZ_umhZA@mail.gmail.com>
	<CAHzT=q_tUDQU1J_kSL4_gpTnA5sra69sp=Bj4FK5NzNE4Pd=sw@mail.gmail.com>
Message-ID: <CAJrcDBcbWBy7Z+f7rHQ0F9WzSXDb+wF9HVcvB89TfS7-c-9k=g@mail.gmail.com>

Permissions managed through the console are not really UMA. Even though
they might be associated with policies that enforce access only to the
owner.

UMA permissions are managed differently and are only created when you are
using the UMA flow, using permission tickets, etc. The /uma-policy endpoint
is an extension to the specification from where you can manage additional
policies for a resource owner resource, so you could create those
additional policies and still let the resource owner to revoke these
policies through the account service. For instance, you might want to grant
access to a specific resource to a specific group in your organization and
still let the user revoke access to this group if he wants to.

Regards.
Pedro Igor

On Sun, Nov 18, 2018 at 12:57 PM Geoffrey Cleaves <geoff at opticks.io> wrote:

> I now see that I do get a list of *UMA permissions* when using the Resource
> Owner Password Credentials Grant Type. I has wrongly expected to see the
> permissions I had created as admin via the Admin Console.
>
> Shouldn't it be possible for the resource server's service account to view
> and create UMA permissions without needing to know the end users'
> credentials for the Resource Owner Password Credentials Grant Type? Or
> perhaps that is the whole point of UMA...
>
> On Sun, 18 Nov 2018 at 12:27, Geoffrey Cleaves <geoff at opticks.io> wrote:
>
> > Hi,
> >
> > I'm sending GET requests to http://
> ${host}:${post}/auth/realms/${realm}/authz/protection/uma-policy
> > but only get an empty array. I have a permission/policy assigned to
> > hundreds of resources belonging to dozens of users and some resources
> owned
> > by the resource server itself. Reading the docs
> > <
> https://www.keycloak.org/docs/latest/authorization_services/index.html#_service_authorization_uma_policy_api
> >,
> > I expect to be able to get a list of all permissions or query by name.
> >
> > Perhaps I am misunderstanding this:
> >
> > This API is protected by a bearer token that must represent a consent
> > granted by the user to the resource server to manage permissions on his
> > behalf. The bearer token can be a regular access token obtained from the
> > token endpoint using:
> >
> >
> >    - Resource Owner Password Credentials Grant Type
> >       - Token Exchange, in order to exchange an access token granted to
> >       some client (public client) for a token where audience is the
> resource
> >       server
> >
> > But I don't think so because if my token were wrong I'd get a 401 or 403
> > instead of 200 with an empty array. In any case I've tried with Client
> > Credentials Grant and Resource Owner Password Credentials Grant Type.
> >
> > [image: Screen Shot 2018-11-18 at 12.19.25.png]
> > curl -D - -X GET \
> >    https://.../authz/protection/uma-policy \
> >    -H 'Authorization: Bearer eyJh' \
> >    -H 'Cache-Control: no-cache' \
> >    -H 'Postman-Token: deb09a7a-0499-430f-8164-3097e5ac145d' \
> >    -H 'cache-control: no-cache'
> >
> > HTTP/1.1 200 OK
> > Server: nginx/1.11.10
> > Date: Sun, 18 Nov 2018 11:23:41 GMT
> > Content-Type: application/json
> > Content-Length: 2
> > Connection: keep-alive
> > Cache-Control: no-cache
> > []
> >
> > Any advise?
> >
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From geoff at opticks.io  Mon Nov 19 06:59:00 2018
From: geoff at opticks.io (Geoffrey Cleaves)
Date: Mon, 19 Nov 2018 12:59:00 +0100
Subject: [keycloak-user] Policy API endpoint lacks crucial information (in
	my opinion ; )
Message-ID: <CAHzT=q_GF01UOxU+OOMGQ7wJwd9zohH-_goN_9uLH+o5jfX0Vg@mail.gmail.com>

Hi. When querying the
http://${host}:${post}/auth/realms/${realm}/authz/protection/uma-policy
endpoint I get a response similar to this:

[
    {
        "id": "6d5ffed7-5f1c-4b43-b2a8-986528aaee92",
        "name": "b189864a-754e-4b5d-9c5b-f36fd9aad102",
        "type": "uma",
        "scopes": [
            "campaign:view"
        ],
        "logic": "POSITIVE",
        "decisionStrategy": "UNANIMOUS",
        "owner": "45cb05ba-5485-459e-9cfc-25128adb1854",
        "users": [
            "user at domain.com"
        ]
    }
]

The problem here is that we don't know what resource this policy applies
to. As far as I know, there is no way to extract that information. Please
let me know if I am missing something.

I tried inspecting the network calls that the Admin Console does when
listing a user's UMA policies, but unfortunately for me the information
seems to be rendered server side instead of using the UMA REST API.

The goal is to recreate and enhance the Keycloak supplied UMA My Resources
functionality.

From psilva at redhat.com  Mon Nov 19 07:54:45 2018
From: psilva at redhat.com (Pedro Igor Silva)
Date: Mon, 19 Nov 2018 10:54:45 -0200
Subject: [keycloak-user] Policy API endpoint lacks crucial information
 (in my opinion ; )
In-Reply-To: <CAHzT=q_GF01UOxU+OOMGQ7wJwd9zohH-_goN_9uLH+o5jfX0Vg@mail.gmail.com>
References: <CAHzT=q_GF01UOxU+OOMGQ7wJwd9zohH-_goN_9uLH+o5jfX0Vg@mail.gmail.com>
Message-ID: <CAJrcDBdoEFiTES7igsGqvo=NOkZo07q5SXmiRGCmfX10stggbg@mail.gmail.com>

We should return the resource too, not only the scopes. Created
https://issues.jboss.org/browse/KEYCLOAK-8867 to include resource id to the
responses.

Regards.
Pedro Igor

On Mon, Nov 19, 2018 at 10:03 AM Geoffrey Cleaves <geoff at opticks.io> wrote:

> Hi. When querying the
> http://${host}:${post}/auth/realms/${realm}/authz/protection/uma-policy
> endpoint I get a response similar to this:
>
> [
>     {
>         "id": "6d5ffed7-5f1c-4b43-b2a8-986528aaee92",
>         "name": "b189864a-754e-4b5d-9c5b-f36fd9aad102",
>         "type": "uma",
>         "scopes": [
>             "campaign:view"
>         ],
>         "logic": "POSITIVE",
>         "decisionStrategy": "UNANIMOUS",
>         "owner": "45cb05ba-5485-459e-9cfc-25128adb1854",
>         "users": [
>             "user at domain.com"
>         ]
>     }
> ]
>
> The problem here is that we don't know what resource this policy applies
> to. As far as I know, there is no way to extract that information. Please
> let me know if I am missing something.
>
> I tried inspecting the network calls that the Admin Console does when
> listing a user's UMA policies, but unfortunately for me the information
> seems to be rendered server side instead of using the UMA REST API.
>
> The goal is to recreate and enhance the Keycloak supplied UMA My Resources
> functionality.
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

From msakho at redhat.com  Mon Nov 19 08:27:10 2018
From: msakho at redhat.com (Meissa M'baye Sakho)
Date: Mon, 19 Nov 2018 14:27:10 +0100
Subject: [keycloak-user] ldaps configuration --> Bug or regression with
 ldap connection ulr
In-Reply-To: <1542586670.2445.11.camel@acutus.pro>
References: <CAF83W6L7Tz2w-1cOwUubk5bY16G3z_N8rn27PMmp9g-bZZyK2g@mail.gmail.com>
	<1542586670.2445.11.camel@acutus.pro>
Message-ID: <CAF83W6Lqi9aUqBNdPWPPZXqaELoRCFz1zhux1=YYFLYG6igkaw@mail.gmail.com>

Dmitry,
I'm using the standalone-ha.xml.
I've checked the truststore configuration. Everything is ok.
Changing the ldap protocole from LDAPS to ldaps make it works. So it could
not be a truststore configuration issue.
Meissa

Le lun. 19 nov. 2018 ? 01:18, Dmitry Telegin <dt at acutus.pro> a ?crit :

> Meissa,
>
> This looks like an unconfigured SSL truststore. Could it be that you have
> configured it in standalone.xml instead of standalone-ha.xml (which is used
> by default in Docker image for Keycloak 4.5.0+)?
>
> Cheers,
> Dmitry Telegin
> CTO, Acutus s.r.o.
> Keycloak Consulting and Training
>
> Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
> +42 (022) 888-30-71
> E-mail: info at acutus.pro
>
> On Thu, 2018-11-15 at 10:12 +0100, Meissa M'baye Sakho wrote:
> > Hello everyone,
> > I'm facing a very strange behaviour using keycloak 4.5 Final while
> > configuring my realm user federation with ldaps.
> > When I set the ldap connection URL to ldaps://myldaphost. It works fine.
> > When I change it to LDAPS://myldaphost, the test connexion fails with the
> > exception below (extract):
> >
> > *KC-SERVICES0055: Error when connecting to LDAP:
> > intra-dev01.bdf-dev01.local:636: javax.naming.CommunicationException:
> > intra-dev01.bdf-dev01.local:636 [Root exception is
> > javax.net.ssl.SSLHandshakeException:
> > sun.security.validator.ValidatorException: PKIX path building failed:
> > sun.security.provider.certpath.SunCertPathBuilderException: unable to
> find
> > valid certification path to requested target]*
> > *        at com.sun.jndi.ldap.Connection.<init>(Connection.java:238)*
> > *        at com.sun.jndi.ldap.LdapClient.<init>(LdapClient.java:137)*
> > *        at
> com.sun.jndi.ldap.LdapClient.getInstance(LdapClient.java:1615)*
> > *        at com.sun.jndi.ldap.LdapCtx.connect(LdapCtx.java:2749)*
> > *        at com.sun.jndi.ldap.LdapCtx.<init>(LdapCtx.java:319)*
> > *        at
> > com.sun.jndi.ldap.LdapCtxFactory.getUsingURL(LdapCtxFactory.java:192)*
> > *        at
> > com.sun.jndi.ldap.LdapCtxFactory.getUsingURLs(LdapCtxFactory.java:210)*
> >
> > * Caused by: javax.net.ssl.SSLHandshakeException:
> > sun.security.validator.ValidatorException: PKIX path building failed:
> > sun.security.provider.certpath.SunCertPathBuilderException: unable to
> find
> > valid certification path to requested target*
> > *        at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)*
> > *        at
> sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1964)*
> >
> > With Keycloak 3.4.3Final, I used LDAPS without any problem.
> > Any advice?
> > Meissa
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
>

From lists at merit.unu.edu  Mon Nov 19 09:44:07 2018
From: lists at merit.unu.edu (mj)
Date: Mon, 19 Nov 2018 15:44:07 +0100
Subject: [keycloak-user] SaaS idp brokering
In-Reply-To: <1542219315.2133.5.camel@acutus.pro>
References: <b41e8da8-5a8e-99da-05ad-76959b65fa07@merit.unu.edu>
	<1542165306.10365.8.camel@acutus.pro>
	<7e9acb90-50cb-262d-73c3-421214dc88ac@merit.unu.edu>
	<1542219315.2133.5.camel@acutus.pro>
Message-ID: <de63055b-d57d-34aa-b1b0-a924fe4b85e6@merit.unu.edu>

Hi Dmitri,

Just to say thank you for your comments.

MJ

On 11/14/18 7:15 PM, Dmitry Telegin wrote:
> 
> I used to work with PingIdentity (or rather on-premise PingFederate)
> and Okta, using SAML in both cases, and the results were perfect. For
> Okta, I'd recommend an excellent article by Michael Furman [1].
> Michael uses SAML too; don't know if you're going to use SAML or
> OpenID Connect, but in the latter case the process should be similar.
> Please read this [2] on the protocol choice.
> 
> NB you can use whatever combination of protocols you like (OIDC at
> Keycloak + SAML at Saas IdP or vice versa), but probably unless
> you're seriously considering IdP-initiated login. In that case,
> things work more smoothly with pure SAML.
> 

From rsbaibi at hotmail.com  Mon Nov 19 09:57:25 2018
From: rsbaibi at hotmail.com (rachid sbaibi)
Date: Mon, 19 Nov 2018 14:57:25 +0000
Subject: [keycloak-user] Restrict user's access to a client on
	keycloak-3.4.3.Final
Message-ID: <VI1P18901MB00457F08DA490A6CD6316991AFD80@VI1P18901MB0045.EURP189.PROD.OUTLOOK.COM>

Hi all,
I'm using keycloak-3.4.3.Final.
For our UXP applications we delegate the authentication to Keycloak but we need to do some additional checks before granting access to the user.
Our use case is quite simple: Not All registered users in Keycloak have access to our applications. So we need to insure that the user has permition to access our applications before granting him access to UXP. This is done in the backend.
I tried to map roles to user and client but this does not work.

Is there a way to achieve that?

Thanks in advance.
Rachid.




From dt at acutus.pro  Mon Nov 19 10:21:37 2018
From: dt at acutus.pro (Dmitry Telegin)
Date: Mon, 19 Nov 2018 18:21:37 +0300
Subject: [keycloak-user] Re :Keycloak Idp SLO response location
In-Reply-To: <586659305.4611156.1542622793046@mail.yahoo.com>
References: <1665888810.3194155.1542406492861.ref@mail.yahoo.com>
	<1665888810.3194155.1542406492861@mail.yahoo.com>
	<873954453.3176887.1542406785280@mail.yahoo.com>
	<1542413701.2114.1.camel@acutus.pro>
	<848358272.3247455.1542440617860@mail.yahoo.com>
	<586659305.4611156.1542622793046@mail.yahoo.com>
Message-ID: <1542640897.2122.1.camel@acutus.pro>

Hello Sylvain,

Seems like this feature is not supported in Keycloak yet: https://issues.jboss.org/browse/KEYCLOAK-6822

Dmitry

On Mon, 2018-11-19 at 10:19 +0000, ge sly wrote:
> "They are optional attributes in the SAML spec"
> ?I mean the ResponseLocation attribute. Where can I configure it?
> 
> 
> 
> Le sam., nov. 17, 2018 ? 8:43, ge sly
> > <slyge2001 at yahoo.fr> a ?crit :
> Hi Dmitry?
> 
> Yes I saw it but here is only 2 urls:
> 
> Logout Service POST Binding URL
> POST Binding URL for the Logout Service.
> 
> Logout Service Redirect Binding URL
> Redirect Binding URL for the Logout Service
> 
> 
> 
> Where can I set the?
> 
> Logout Service POST Binding Response URL
> 
> and
> 
> Logout Service Redirect Response Binding URL
> 
> 
> They are optional attributes in the SAML spec?
> 
> <complexType?name="EndpointType">
> <sequence>
> <any?namespace="##other"processContents="lax"?minOccurs="0"maxOccurs="unbounded"/>
> </sequence>
> <attribute?name="Binding"?type="anyURI"use="required"/>
> <attribute?name="Location"?type="anyURI"use="required"/>
> <attribute?name="ResponseLocation"type="anyURI"?use="optional"/>
> <anyAttribute?namespace="##other"processContents="lax"/>
> </complexType>
> 
> Thanks
> Regards
> Sylvain
> 
> 
> Le sam., nov. 17, 2018 ? 1:15, Dmitry Telegin
> > <dt at acutus.pro> a ?crit :
> Hello Sylvain,
> 
> These settings are under the "Fine Grain SAML Endpoint Configuration" section in the client settings.
> 
> Cheers,
> Dmitry Telegin
> CTO, Acutus s.r.o.
> Keycloak Consulting and Training
> 
> Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
> +42 (022) 888-30-71
> > E-mail: info at acutus.pro?
> 
> On Fri, 2018-11-16 at 22:19 +0000, ge sly wrote:
> >?
> > ? Hi
> > I am tringle to configure Keycloak as an Idp with OIOSAML as a SP.
> > OIOSAML has 2 urls for the single logout:
> > <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://localhost:8443/oiosaml2-demo.java/saml/LogoutServiceHTTPPost" ResponseLocation="https://localhost:8443/oiosaml2-demo.java/saml/LogoutServiceHTTPRedirectResponse"/>
> > I dont see how to enter the Location and the ResponseLocation in the Clients config. If I import the metadata only the Location is used.?
> > Thanks?
> > Regards?Sylvain
> > Envoy? depuis Yahoo Mail pour Android??
> 
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
> 

From geoff at opticks.io  Mon Nov 19 10:57:22 2018
From: geoff at opticks.io (Geoffrey Cleaves)
Date: Mon, 19 Nov 2018 16:57:22 +0100
Subject: [keycloak-user] Permission tab missing,
	token exchange impossible
In-Reply-To: <CAJrcDBeXgdoGQOUwbeeNDwArpUEJr=6sEOqFOP1pad=rGymE7w@mail.gmail.com>
References: <CAHzT=q9TttPN_QLvNKOjM+MVqiqw21Wujtq6UdXr5YvSc66=Gw@mail.gmail.com>
	<CAJrcDBeXgdoGQOUwbeeNDwArpUEJr=6sEOqFOP1pad=rGymE7w@mail.gmail.com>
Message-ID: <CAHzT=q9T=TWkVPVJti5oy4iwQcnYv8-70vNFyCvX14VgnKTvJw@mail.gmail.com>

Thanks, I've got the Permissions tab working but am now having trouble
exchanging a token. Perhaps my thought process is incorrect.

My idea was for the resource server to take the end user's auth token sent
by the Javascript front end public client and exchange it for a token which
would allow the resource server to list UMA permissions of that user. In
other words, the end user logs into the SPA front end (via Keycloak of
course) and then sees the UMA resources he is sharing.

I set permissions for the public client to exchange token for resource
server client as described in the docs
<https://www.keycloak.org/docs/latest/securing_apps/index.html#internal-token-to-internal-token-exchange>.
The starting client is the public client and the target client is the
resource server.
[image: Screen Shot 2018-11-19 at 16.45.51.png]

The problem is that when I try to exchange the token Keycloak gives me
different errors depending on how I send the token exchange request:

grant_type: urn:ietf:params:oauth:grant-type:token-exchange
audience: opticks-rs (resource server)
requested_token_type: urn:ietf:params:oauth:token-type:refresh_token
subject_token: End user's Bearer token received from SPA public client

If I don't send client_id and client_secret I get a 400 Bad Request and
"INVALID_CREDENTIALS: Invalid client credentials" error. I thought I could
skip these fields as the subject_token would server as authentication.
If I send cliend_id=opticks-rs and the client_secret, I get a 501 Not
Implemented error:

15:49:43,491 ERROR [org.keycloak.services.error.KeycloakErrorHandler]
(default task-10) Uncaught server error:
javax.ws.rs.WebApplicationException: Feature not enabled

at org.keycloak.utils.ProfileHelper.requireFeature(ProfileHelper.java:32)

at
org.keycloak.protocol.oidc.endpoints.TokenEndpoint.tokenExchange(TokenEndpoint.java:658)

at
org.keycloak.protocol.oidc.endpoints.TokenEndpoint.processGrantRequest(TokenEndpoint.java:190)

at sun.reflect.GeneratedMethodAccessor770.invoke(Unknown Source)

at
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)

at java.lang.reflect.Method.invoke(Method.java:498)

at
org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java:140)

at
org.jboss.resteasy.core.ResourceMethodInvoker.internalInvokeOnTarget(ResourceMethodInvoker.java:509)

at
org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTargetAfterFilter(ResourceMethodInvoker.java:399)

at
org.jboss.resteasy.core.ResourceMethodInvoker.lambda$invokeOnTarget$0(ResourceMethodInvoker.java:363)

at
org.jboss.resteasy.core.interception.PreMatchContainerRequestContext.filter(PreMatchContainerRequestContext.java:358)

at
org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTarget(ResourceMethodInvoker.java:365)

at
org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:337)

at
org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(ResourceLocatorInvoker.java:137)

at
org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:106)

at
org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(ResourceLocatorInvoker.java:132)

at
org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:100)

at
org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:443)

at
org.jboss.resteasy.core.SynchronousDispatcher.lambda$invoke$4(SynchronousDispatcher.java:233)

at
org.jboss.resteasy.core.SynchronousDispatcher.lambda$preprocess$0(SynchronousDispatcher.java:139)

at
org.jboss.resteasy.core.interception.PreMatchContainerRequestContext.filter(PreMatchContainerRequestContext.java:358)

at
org.jboss.resteasy.core.SynchronousDispatcher.preprocess(SynchronousDispatcher.java:142)

at
org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:219)

at
org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:227)

at
org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56)

at
org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51)

at javax.servlet.http.HttpServlet.service(HttpServlet.java:791)

at
io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:74)

at
io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129)

at
org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:90)

at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61)

at
io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)

at
io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84)

at
io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62)

at
io.undertow.servlet.handlers.ServletChain$1.handleRequest(ServletChain.java:68)

at
io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)

at
org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78)

at
io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)

at
io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:132)

at
io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57)

at
io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)

at
io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)

at
io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)

at
io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)

at
io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77)

at
io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50)

at
io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)

at
io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)

at
org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)

at
io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)

at
org.wildfly.extension.undertow.deployment.GlobalRequestControllerHandler.handleRequest(GlobalRequestControllerHandler.java:68)

at
io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)

at
io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:292)

at
io.undertow.servlet.handlers.ServletInitialHandler.access$100(ServletInitialHandler.java:81)

at
io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:138)

at
io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:135)

at
io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:48)

at
io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43)

at
org.wildfly.extension.undertow.security.SecurityContextThreadSetupAction.lambda$create$0(SecurityContextThreadSetupAction.java:105)

at
org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)

at
org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)

at
org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)

at
org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)

at
io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:272)

at
io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81)

at
io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:104)

at io.undertow.server.Connectors.executeRootHandler(Connectors.java:360)

at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:830)

at
org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35)

at
org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1985)

at
org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1487)

at
org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1378)

at java.lang.Thread.run(Thread.java:748)


If I set the client_id to the public-client-id and remove client_secret,
since it is public and has none, I again get the 501 Not Implemented.

Any help clearing this up is appreciated.

On Mon, 19 Nov 2018 at 12:34, Pedro Igor Silva <psilva at redhat.com> wrote:

> Hi,
>
> It is not a bug. We no longer enable tech preview features by default. You
> need to enable the feature you want, such as admin fine grained
> permissions, by passing a specific environment variable. Try to boot your
> server using this system property:
>
>     - Dkeycloak.profile.feature.admin_fine_grained_authz=enabled
>
> Docs are not reflecting these changes, created
> https://issues.jboss.org/browse/KEYCLOAK-8865.
>
> Regards.
> Pedro Igor
>
> On Mon, Nov 19, 2018 at 9:02 AM Geoffrey Cleaves <geoff at opticks.io> wrote:
>
>> Hello. In Keycloak 4.6, the Permissions tab is gone. The documentation for
>> allowing token exchange depends on the Permissions tab, is this a bug?
>>
>> [image: Screen Shot 2018-11-19 at 11.53.56.png]
>>
>> Somebody else is asking the same question:
>>
>> https://stackoverflow.com/questions/53367566/unable-to-setup-idp-token-exchange-in-keycloak-4-6-0-final
>>
>> Geoff
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Screen Shot 2018-11-19 at 16.45.51.png
Type: image/png
Size: 62094 bytes
Desc: not available
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20181119/130a959e/attachment-0001.png 

From slyge2001 at yahoo.fr  Mon Nov 19 11:49:00 2018
From: slyge2001 at yahoo.fr (ge sly)
Date: Mon, 19 Nov 2018 16:49:00 +0000 (UTC)
Subject: [keycloak-user] Re :Re: Re: Re :Keycloak Idp SLO response location
In-Reply-To: <1542640897.2122.1.camel@acutus.pro>
References: <1665888810.3194155.1542406492861.ref@mail.yahoo.com>
	<1665888810.3194155.1542406492861@mail.yahoo.com>
	<873954453.3176887.1542406785280@mail.yahoo.com>
	<1542413701.2114.1.camel@acutus.pro>
	<848358272.3247455.1542440617860@mail.yahoo.com>
	<586659305.4611156.1542622793046@mail.yahoo.com>
	<1542640897.2122.1.camel@acutus.pro>
Message-ID: <1186662752.5110928.1542646140991@mail.yahoo.com>

Hi Dmitry
Ok that is what I suspected.If it is in the roadmap then it is great.?
Many thanks for your answersRegardsSylvain

Envoy? depuis Yahoo Mail pour Android 
 
  Le lun., nov. 19, 2018 ? 16:21, Dmitry Telegin<dt at acutus.pro> a ?crit :   Hello Sylvain,

Seems like this feature is not supported in Keycloak yet: https://issues.jboss.org/browse/KEYCLOAK-6822

Dmitry

On Mon, 2018-11-19 at 10:19 +0000, ge sly wrote:
> "They are optional attributes in the SAML spec"
> ?I mean the ResponseLocation attribute. Where can I configure it?
> 
> 
> 
> Le sam., nov. 17, 2018 ? 8:43, ge sly
> > <slyge2001 at yahoo.fr> a ?crit :
> Hi Dmitry?
> 
> Yes I saw it but here is only 2 urls:
> 
> Logout Service POST Binding URL
> POST Binding URL for the Logout Service.
> 
> Logout Service Redirect Binding URL
> Redirect Binding URL for the Logout Service
> 
> 
> 
> Where can I set the?
> 
> Logout Service POST Binding Response URL
> 
> and
> 
> Logout Service Redirect Response Binding URL
> 
> 
> They are optional attributes in the SAML spec?
> 
> <complexType?name="EndpointType">
> <sequence>
> <any?namespace="##other"processContents="lax"?minOccurs="0"maxOccurs="unbounded"/>
> </sequence>
> <attribute?name="Binding"?type="anyURI"use="required"/>
> <attribute?name="Location"?type="anyURI"use="required"/>
> <attribute?name="ResponseLocation"type="anyURI"?use="optional"/>
> <anyAttribute?namespace="##other"processContents="lax"/>
> </complexType>
> 
> Thanks
> Regards
> Sylvain
> 
> 
> Le sam., nov. 17, 2018 ? 1:15, Dmitry Telegin
> > <dt at acutus.pro> a ?crit :
> Hello Sylvain,
> 
> These settings are under the "Fine Grain SAML Endpoint Configuration" section in the client settings.
> 
> Cheers,
> Dmitry Telegin
> CTO, Acutus s.r.o.
> Keycloak Consulting and Training
> 
> Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
> +42 (022) 888-30-71
> > E-mail: info at acutus.pro?
> 
> On Fri, 2018-11-16 at 22:19 +0000, ge sly wrote:
> >?
> > ? Hi
> > I am tringle to configure Keycloak as an Idp with OIOSAML as a SP.
> > OIOSAML has 2 urls for the single logout:
> > <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://localhost:8443/oiosaml2-demo.java/saml/LogoutServiceHTTPPost" ResponseLocation="https://localhost:8443/oiosaml2-demo.java/saml/LogoutServiceHTTPRedirectResponse"/>
> > I dont see how to enter the Location and the ResponseLocation in the Clients config. If I import the metadata only the Location is used.?
> > Thanks?
> > Regards?Sylvain
> > Envoy? depuis Yahoo Mail pour Android??
> 
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
> 
  

From dt at acutus.pro  Mon Nov 19 14:11:26 2018
From: dt at acutus.pro (Dmitry Telegin)
Date: Mon, 19 Nov 2018 22:11:26 +0300
Subject: [keycloak-user] Deploy keycloak to Kubernetes Cluster on GCP
In-Reply-To: <CAFmsN6z6vhFqWRqNhpRp9K10vxXGkKoLG2_84nROu9K3u8oVuw@mail.gmail.com>
References: <CAFmsN6z6vhFqWRqNhpRp9K10vxXGkKoLG2_84nROu9K3u8oVuw@mail.gmail.com>
Message-ID: <1542654686.15835.1.camel@acutus.pro>

Hello William, answers inline,

On Sun, 2018-11-18 at 02:11 +0100, William Nankap wrote:
> Hi every one,
> 
> when i deploy docker keycloak4.5.0.Final to kubernetes cluster on GCP i can
> normaly access to keycloak interface via the extern ip address on port
> 8080. But i can't access to the WILDFLY Management Interface on port 9990.

This is because by default Keycloak/Wildfly opens management?ports (9990 and 9993) on the local IP only (127.0.0.1). To override this, you can append the following to the command line of your image:

-bmanagement=0.0.0.0

This will bind management interface to all the IPs on the host. However, you shouldn't access your plain HTTP management interface (9990) from the external IP, but rather use HTTPS on port 9993. Google "Wildfly management https" for how to configure it.

Alternatively, you can use reverse proxy / load balancer to terminate SSL.

> My questions:
> 
> 1/ What are the recommandation to use keycloak in production?
> ?????a/ Install keycloak server side an wildfly server to use it correctly?
> ?????b/ Install only the keycloak server. How can i manage deployment for
> an app if i can't access to the wildfly management interface? Is it
> imperativ to access it?

You mean -?should you install separate Keycloak and application server instances, or is it possible to deploy WARs right into Keycloak? The answer to the second question is yes in theory, but in practice this is not recommended by many reasons.

Your typical setup would include Keycloak as an identity and authentication server, and another app server (Wildfly, Tomcat, Jetty etc.) to host your actual applications that you want secured by Keycloak.

> 
> 2/ Need you more details on my deployment to help me? If yes, which?
> 
> 3/ How can i get the wildfly management interface on my GCP deployment to
> deploy my app?

Please see above.?Alternatively, you can use jboss-cli tool in the container which operates locally and doesn't require external IP.

Finally, you can deploy applications by simply dropping them into the standalone/deployments directory.

> 4/ Have you suggestions for me, the best way to use keycloak in production?
> Some support?

Everything depends on your particular problem. The bare minimum is that you should have a "real" DBMS (PostgreSQL, MySQL etc.) and not an embedded one.

> 
> I will be very thankful for your answer.
> 
> Kindest regards...
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From dt at acutus.pro  Mon Nov 19 14:14:17 2018
From: dt at acutus.pro (Dmitry Telegin)
Date: Mon, 19 Nov 2018 22:14:17 +0300
Subject: [keycloak-user] Adding attributes during login
In-Reply-To: <669483c6-f462-4c7d-67a5-9d40284ae2a2@gmx-topmail.de>
References: <1541914268.3830.1.camel@acutus.pro>
	<7d9b9737-12f5-a48a-7ead-3355f55c257b@gmx-topmail.de>
	<1542148837.10365.2.camel@acutus.pro>
	<669483c6-f462-4c7d-67a5-9d40284ae2a2@gmx-topmail.de>
Message-ID: <1542654857.15835.3.camel@acutus.pro>

Hi, glad to hear it worked!

Another idea might be to install servlet filter into Keycloak that would parse URL param and (re)attach it to HttpSession. This would in theory eliminate the need for such an heuristics, but this needs to be investigated further.

Dmitry

On Sat, 2018-11-17 at 12:08 +0100, zitrone at gmx-topmail.de wrote:
> Thank you very much.
> 
> For anyone interested, here is my full script. I check for the Referer header first, if it is empty i go for the direct parameters. Also restricted it to a certain role.
> 
> / import enum for error lookup?
> AuthenticationFlowError = Java.type("org.keycloak.authentication.AuthenticationFlowError");?
> 
> function authenticate(context) {?
> ? ? if (user.hasRole(realm.getRole("AllowedRole"))){?
> ? ? ? ? var username = user ? user.username : "anonymous";?
> ? ? ? ? var referer = httpRequest.httpHeaders.getHeaderString("Referer");?
> ? ? ? ? var _foo;?
> ? ? ? ? if (referer !== null){?
> ? ? ? ? ? ? var uri = new java.net.URI(referer);?
> ? ? ? ? ? ? var uriInfo = new org.jboss.resteasy.spi.ResteasyUriInfo(uri);?
> ? ? ? ? ? ? _foo = uriInfo.queryParameters.coBrowsingSSOId;?
> ? ? ? ? } else {?
> ? ? ? ? ? ? _foo = httpRequest.uri.queryParameters.coBrowsingSSOId;?
> ? ? ? ? }?
> ? ? ? ? if (_foo !== null ){?
> ? ? ? ? ? ? var foo = _foo[0]; // uriInfo.queryParameters is a multivalued map?
> ? ? ? ? ? ? LOG.error(script.name + ": " + username + " foo =" + foo);?
> ? ? ? ? ? ? authenticationSession.setUserSessionNote("foo", foo);?
> ? ? ? ? ? ? context.success();?
> ? ? ? ? } else {?
> ? ? ? ? ? ? LOG.error("Missing query parameter 'foo'");?
> ? ? ? ? ? ? context.failure(AuthenticationFlowError.INVALID_USER);?
> ? ? ? ? }?
> ? ? } else {?
> ? ? ? ? context.success();?
> ? ? }?
> }
> 
> Regards
> 
> Am 13.11.2018 um 23:40 schrieb Dmitry Telegin:
> > Hi, you're welcome,
> > 
> > In the second scenario (cookie-based auth), there is no HTTP redirect, hence your query params are in the actual URL, not in the referer header. You can extract them as follows:
> > 
> > var _foo = httpRequest.uri.queryParameters['foo']);
> > if (_foo !== null)
> > ? var foo = _foo[0];
> > 
> > Good luck!
> > Dmitry
> > 
> > > > On Tue, 2018-11-13 at 20:11 +0100, zitrone at gmx-topmail.de wrote:
> > > Hi,
> > > 
> > > i'm working on a similar problem. I managed to set up a script?
> > > authenticator and a User Session Note Mapper. Works fine on first?
> > > request (like, on the first try. Thanks for the code!). I send the query?
> > > parameter to the auth endpoint, enter the credentials and get a code.?
> > > The token i get for the code contains the query parameter as a field.
> > > 
> > > But when i query the auth endpoint a second time, it authenticates via?
> > > cookie. Then it starts the script and the script throws a null pointer?
> > > exception. The problen is, that the "Referer" header is null.
> > > 
> > > The idea behind the second call is to "update" the session note. Any?
> > > ideas how to get the query parameter in this case? Or why it vanishes in?
> > > the first place?
> > > 
> > > 
> > > Regards
> > > 
> > > _______________________________________________
> > > keycloak-user mailing list
> > > keycloak-user at lists.jboss.org
> > > https://lists.jboss.org/mailman/listinfo/keycloak-user
> 
> 

From dt at acutus.pro  Mon Nov 19 14:29:24 2018
From: dt at acutus.pro (Dmitry Telegin)
Date: Mon, 19 Nov 2018 22:29:24 +0300
Subject: [keycloak-user] Deploy keycloak to Kubernetes Cluster on GCP
In-Reply-To: <1542654686.15835.1.camel@acutus.pro>
References: <CAFmsN6z6vhFqWRqNhpRp9K10vxXGkKoLG2_84nROu9K3u8oVuw@mail.gmail.com>
	<1542654686.15835.1.camel@acutus.pro>
Message-ID: <1542655764.15835.6.camel@acutus.pro>

P.S. Probably THE article on how to enable HTTPS on management interface:
http://www.mastertheboss.com/jboss-server/jboss-security/securing-access-to-jboss-wildfly-management-console

Cheers,
Dmitry Telegin
CTO, Acutus s.r.o.
Keycloak Consulting and Training

Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
+42 (022) 888-30-71
E-mail: info at acutus.pro 

On Mon, 2018-11-19 at 22:11 +0300, Dmitry Telegin wrote:
> Hello William, answers inline,
> 
> On Sun, 2018-11-18 at 02:11 +0100, William Nankap wrote:
> > Hi every one,
> > 
> > when i deploy docker keycloak4.5.0.Final to kubernetes cluster on GCP i can
> > normaly access to keycloak interface via the extern ip address on port
> > 8080. But i can't access to the WILDFLY Management Interface on port 9990.
> 
> This is because by default Keycloak/Wildfly opens management?ports (9990 and 9993) on the local IP only (127.0.0.1). To override this, you can append the following to the command line of your image:
> 
> -bmanagement=0.0.0.0
> 
> This will bind management interface to all the IPs on the host. However, you shouldn't access your plain HTTP management interface (9990) from the external IP, but rather use HTTPS on port 9993. Google "Wildfly management https" for how to configure it.
> 
> Alternatively, you can use reverse proxy / load balancer to terminate SSL.
> 
> > My questions:
> > 
> > 1/ What are the recommandation to use keycloak in production?
> > ?????a/ Install keycloak server side an wildfly server to use it correctly?
> > ?????b/ Install only the keycloak server. How can i manage deployment for
> > an app if i can't access to the wildfly management interface? Is it
> > imperativ to access it?
> 
> You mean -?should you install separate Keycloak and application server instances, or is it possible to deploy WARs right into Keycloak? The answer to the second question is yes in theory, but in practice this is not recommended by many reasons.
> 
> Your typical setup would include Keycloak as an identity and authentication server, and another app server (Wildfly, Tomcat, Jetty etc.) to host your actual applications that you want secured by Keycloak.
> 
> > 
> > 2/ Need you more details on my deployment to help me? If yes, which?
> > 
> > 3/ How can i get the wildfly management interface on my GCP deployment to
> > deploy my app?
> 
> Please see above.?Alternatively, you can use jboss-cli tool in the container which operates locally and doesn't require external IP.
> 
> Finally, you can deploy applications by simply dropping them into the standalone/deployments directory.
> 
> > 4/ Have you suggestions for me, the best way to use keycloak in production?
> > Some support?
> 
> Everything depends on your particular problem. The bare minimum is that you should have a "real" DBMS (PostgreSQL, MySQL etc.) and not an embedded one.
> 
> > 
> > I will be very thankful for your answer.
> > 
> > Kindest regards...
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
> 
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From dt at acutus.pro  Mon Nov 19 14:30:49 2018
From: dt at acutus.pro (Dmitry Telegin)
Date: Mon, 19 Nov 2018 22:30:49 +0300
Subject: [keycloak-user] krbLastPwdChange - can we use this attribute
In-Reply-To: <21B3C608-679D-4F3F-8587-769C3BFDC4B2@well.ox.ac.uk>
References: <76219A0B-5737-47FC-9B90-8D805B4BA0F8@well.ox.ac.uk>
	<21B3C608-679D-4F3F-8587-769C3BFDC4B2@well.ox.ac.uk>
Message-ID: <1542655849.15835.7.camel@acutus.pro>

Hello Callum,

If you want a 100% pure Keycloak solution, you can implement your own mapper by extending this one:
https://github.com/keycloak/keycloak/blob/master/federation/ldap/src/main/java/org/keycloak/storage/ldap/mappers/msad/MSADUserAccountControlStorageMapper.java

and modifying it so that it uses krbLastPwdChange instead of pwdLastSet (LDAPConstants.PWD_LAST_SET).

Then deploy it as a provider and use on your LDAP definition instead of the built-in "msad-user-account-control-mapper".

Feel free to ask questions on provider development. Good luck,
Dmitry Telegin
CTO, Acutus s.r.o.
Keycloak Consulting and Training

Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
+42 (022) 888-30-71
E-mail: info at acutus.pro 

On Fri, 2018-11-16 at 16:27 +0000, Callum Smith wrote:
> Dear All,
> 
> I've implemented this as a python script for now, hopefully this is useful to some, and hopefully something similar could be implemented for LDAP (although I imagine politically since SSSD cannot provide this data, and that's the preferred connection route for FreeIPA, it's not going to happen soon).
> 
> requirements: ldap3, python-keycloak
> 
> 
> import python_freeipa
> import json
> import ldap3
> from keycloak import KeycloakAdmin
> from datetime import datetime
> 
> options['ipa_host']??????????????= ''
> options['ipa_admin_user']????????= ''
> options['ipa_base_dn']???????????= ''
> options['ipa_admin_dn']??????????= ','+options['ipa_base_dn']
> options['keycloak_host']?????????= ''
> options['keycloak_admin_user']???= ''
> options['keycloak_storage_id']???= ''
> 
> # Begin Keycloak Clietn
> keycloakClient = KeycloakAdmin(server_url='https://'+options['keycloak_host']+'/auth/', username=options['keycloak_admin_user'], password=keycloakAdminPassword, realm_name='master<https://'+options['keycloak_host']+'/auth/',%20username=options['keycloak_admin_user'],%20password=keycloakAdminPassword,%20realm_name='master>', verify=False)
> 
> # Begin LDAP client
> ldapServer = ldap3.Server(options['ipa_host'])
> ldapClient = ldap3.Connection(ldapServer, user=options['ipa_admin_dn'], password=ipaAdminPassword, auto_bind=True)
> 
> # Generate datestamp
> date = datetime.utcnow().strftime('%Y%m%d%H%M%S')+'Z'
> 
> # Perform an LDAP sync for Keycloak
> keycloakClient.sync_users(storage_id=options['keycloak_storage_id'], action="triggerFullSync")
> 
> # Search LDAP for expired passwords
> ldapClient.search('cn=users,cn=accounts,'+options['ipa_base_dn'], '(|(krbPasswordExpiration<='+date+')(!(krbPasswordExpiration=*)))', attributes=['uid','cn','krbLastPwdChange','krbPasswordExpiration','dn'])
> resetPasswordUsers = ldapClient.entries
> 
> for user in resetPasswordUsers:
> ? user_id = keycloakClient.get_user_id(user.uid)
> ? keycloakClient.update_user(user_id=user_id, payload={"requiredActions":['UPDATE_PASSWORD']})
> 
> 
> # Search LDAP for valid passwords
> ldapClient.search('cn=users,cn=accounts,'+options['ipa_base_dn'], '(krbPasswordExpiration>='+date+')', attributes=['uid','cn','krbLastPwdChange','krbPasswordExpiration','dn'])
> validPasswordUsers = ldapClient.entries
> 
> for user in validPasswordUsers:
> ? user_id = keycloakClient.get_user_id(user.uid)
> ? keycloakClient.update_user(user_id=user_id, payload={"requiredActions":[]})
> 
> 
> 
> 
> I've chopped some domain specific stuff from this so it might not be flawless, but hopefully a start for someone. Also no error checking involved here.
> 
> Regards,
> Callum
> 
> --
> 
> Callum Smith
> Research Computing Core
> Wellcome Trust Centre for Human Genetics
> University of Oxford
> > > e. callum at well.ox.ac.uk<mailto:callum at well.ox.ac.uk>
> 
> > On 16 Nov 2018, at 09:16, Callum Smith <callum at well.ox.ac.uk<mailto:callum at well.ox.ac.uk>> wrote:
> 
> Dear Keycloakers,
> 
> I was wondering, if Keycloak can accept the pwdLastSet from MSAD, why can it not use krbLastPwdChange from FreeIPA to allow for better integration of password resets? Surely this is possible and potentially even trivial to implement?
> 
> Regards,
> Callum
> 
> --
> 
> Callum Smith
> Research Computing Core
> Wellcome Trust Centre for Human Genetics
> University of Oxford
> > > e. callum at well.ox.ac.uk<mailto:callum at well.ox.ac.uk><mailto:callum at well.ox.ac.uk>
> 
> _______________________________________________
> keycloak-user mailing list
> > keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>
> https://lists.jboss.org/mailman/listinfo/keycloak-user
> 
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From dt at acutus.pro  Mon Nov 19 14:52:00 2018
From: dt at acutus.pro (Dmitry Telegin)
Date: Mon, 19 Nov 2018 22:52:00 +0300
Subject: [keycloak-user] Keycloak SAML IdP and URL parameter
In-Reply-To: <etPan.5beed899.50b9905b.11539@yahoo.com>
References: <etPan.5beed899.50b9905b.11539@yahoo.com>
Message-ID: <1542657120.15835.9.camel@acutus.pro>

Hello Sud,

Please check out this thread:
http://lists.jboss.org/pipermail/keycloak-user/2018-November/016228.html

The problem under discussion is almost identical to yours, with the only exception being OIDC instead of SAML. But I believe the general principle (fishing request parameters out of the Referer header) remains the same.

Another question: is it possible to use SAML RelayState to pass the same parameter? Custom authenticators have direct access to that field via client session note with the same name ("RelayState"), which could let you avoid the hacks like above.

Cheers,
Dmitry Telegin
CTO, Acutus s.r.o.
Keycloak Consulting and Training

Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
+42 (022) 888-30-71
E-mail: info at acutus.pro 

On Fri, 2018-11-16 at 09:47 -0500, Sud Ramasamy wrote:
> Hi,
> 
> We are using Keycloak as a SAML IdP and have plugged in a custom authenticator to handle the browser flow. The authenticator relies on a custom URL parameter that is present in the initial SAML Authn request to Keycloak.?
> 
> We found that when the Keycloak SAML IdP receives a SAML Authn request (which also contains our custom URL parameter) it exchanges that request with a code and redirects the browser to itself at which point the control reaches our custom authenticator. This redirect causes our custom URL parameter from the initial request to not be available to our custom authenticator. Is there anyway to propagate our custom URL parameter to this second request and thereby have it available to our custom authenticator.
> 
> Thanks in advance for your help.
> 
> Regards
> -sud?
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From dt at acutus.pro  Mon Nov 19 15:08:40 2018
From: dt at acutus.pro (Dmitry Telegin)
Date: Mon, 19 Nov 2018 23:08:40 +0300
Subject: [keycloak-user] How to package a provider as EAR
In-Reply-To: <8C6AB5C1-40DA-4AC2-8A9C-A25337D9709B@daimler.com>
References: <1C82FBF5-3E14-4E86-B0F1-5D6FECB2229C@daimler.com>
	<8C6AB5C1-40DA-4AC2-8A9C-A25337D9709B@daimler.com>
Message-ID: <1542658120.15835.11.camel@acutus.pro>

Marco, Mike,

Please take a look at the BeerCloak example:
https://github.com/dteleguin/beercloak

It fully implements EAR packaging for Keycloak providers. In your case probably there won't be similar "beercloak-core" module, but rather a bunch of external dependencies. The rest remains roughly the same.

Cheers,
Dmitry Telegin
CTO, Acutus s.r.o.
Keycloak Consulting and Training

Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
+42 (022) 888-30-71
E-mail: info at acutus.pro 

On Fri, 2018-11-16 at 08:12 +0000, marco.scheuermann at daimler.com wrote:
> Hi together,
> 
> do you have any example how to package a provider implementation as an EAR file?
> I packaged it as JAR and it works but then I added some external libs (JARS) so I have the requirement to
> package it as an EAR.
> 
> Thank you,
> Marco
> 
> 
> Marco Scheuermann
> 
> Dipl.-Informatiker
> 
> > ?[id:image001.png at 01D3CB2E.313F1BF0]
> 
> Software Engineer
> RD/UIA ? Team Rising Stars
> Tel.:???????+49 151 5860 5255
> E-Mail:??marco.scheuermann at daimler.com
> 
> Daimler AG
> Sitz und Registergericht/Domicile and Court of Registry: Stuttgart
> HRB-Nr./Commercial Register No. 19360
> Vorsitzender des Aufsichtsrats/Chairman of the Supervisory Board: Manfred Bischoff
> Vorstand/Board of Management: Dieter Zetsche (Vorsitzender/Chairman), Wolfgang Bernhard, Renata Jungo Br?ngger, Ola K?llenius, Wilfried Porth, Hubertus Troska, Bodo Uebber, Thomas Weber
> 
> 
> If you are not the addressee, please inform us immediately that you have received this e-mail by mistake, and delete it. We thank you for your support.
> 
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From geoff at opticks.io  Mon Nov 19 15:22:28 2018
From: geoff at opticks.io (Geoffrey Cleaves)
Date: Mon, 19 Nov 2018 21:22:28 +0100
Subject: [keycloak-user] Permission tab missing,
	token exchange impossible
In-Reply-To: <CAHzT=q9T=TWkVPVJti5oy4iwQcnYv8-70vNFyCvX14VgnKTvJw@mail.gmail.com>
References: <CAHzT=q9TttPN_QLvNKOjM+MVqiqw21Wujtq6UdXr5YvSc66=Gw@mail.gmail.com>
	<CAJrcDBeXgdoGQOUwbeeNDwArpUEJr=6sEOqFOP1pad=rGymE7w@mail.gmail.com>
	<CAHzT=q9T=TWkVPVJti5oy4iwQcnYv8-70vNFyCvX14VgnKTvJw@mail.gmail.com>
Message-ID: <CAHzT=q8h6HYm94+qQy4bgfrY176S_XLTa-=vxfnUMryMViX5Wg@mail.gmail.com>

I guess you're putting me to the test, huh, Pedro? ;) So I figured it out.
Token exchange is also a preview feature, so I had to start the server with:
  -Dkeycloak.profile.feature.admin_fine_grained_authz=enabled
  -Dkeycloak.profile.feature.token_exchange=enabled

Then to get the token exchange right I had to use the resource server
client_id and secret.

Regards,
Geoffrey Cleaves

On Mon, 19 Nov 2018 at 16:57, Geoffrey Cleaves <geoff at opticks.io> wrote:

> Thanks, I've got the Permissions tab working but am now having trouble
> exchanging a token. Perhaps my thought process is incorrect.
>
> My idea was for the resource server to take the end user's auth token sent
> by the Javascript front end public client and exchange it for a token which
> would allow the resource server to list UMA permissions of that user. In
> other words, the end user logs into the SPA front end (via Keycloak of
> course) and then sees the UMA resources he is sharing.
>
> I set permissions for the public client to exchange token for resource
> server client as described in the docs
> <https://www.keycloak.org/docs/latest/securing_apps/index.html#internal-token-to-internal-token-exchange>.
> The starting client is the public client and the target client is the
> resource server.
> [image: Screen Shot 2018-11-19 at 16.45.51.png]
>
> The problem is that when I try to exchange the token Keycloak gives me
> different errors depending on how I send the token exchange request:
>
> grant_type: urn:ietf:params:oauth:grant-type:token-exchange
> audience: opticks-rs (resource server)
> requested_token_type: urn:ietf:params:oauth:token-type:refresh_token
> subject_token: End user's Bearer token received from SPA public client
>
> If I don't send client_id and client_secret I get a 400 Bad Request and
> "INVALID_CREDENTIALS: Invalid client credentials" error. I thought I could
> skip these fields as the subject_token would server as authentication.
> If I send cliend_id=opticks-rs and the client_secret, I get a 501 Not
> Implemented error:
>
> 15:49:43,491 ERROR [org.keycloak.services.error.KeycloakErrorHandler]
> (default task-10) Uncaught server error:
> javax.ws.rs.WebApplicationException: Feature not enabled
>
> at org.keycloak.utils.ProfileHelper.requireFeature(ProfileHelper.java:32)
>
> at
> org.keycloak.protocol.oidc.endpoints.TokenEndpoint.tokenExchange(TokenEndpoint.java:658)
>
> at
> org.keycloak.protocol.oidc.endpoints.TokenEndpoint.processGrantRequest(TokenEndpoint.java:190)
>
> at sun.reflect.GeneratedMethodAccessor770.invoke(Unknown Source)
>
> at
> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
>
> at java.lang.reflect.Method.invoke(Method.java:498)
>
> at
> org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java:140)
>
> at
> org.jboss.resteasy.core.ResourceMethodInvoker.internalInvokeOnTarget(ResourceMethodInvoker.java:509)
>
> at
> org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTargetAfterFilter(ResourceMethodInvoker.java:399)
>
> at
> org.jboss.resteasy.core.ResourceMethodInvoker.lambda$invokeOnTarget$0(ResourceMethodInvoker.java:363)
>
> at
> org.jboss.resteasy.core.interception.PreMatchContainerRequestContext.filter(PreMatchContainerRequestContext.java:358)
>
> at
> org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTarget(ResourceMethodInvoker.java:365)
>
> at
> org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:337)
>
> at
> org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(ResourceLocatorInvoker.java:137)
>
> at
> org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:106)
>
> at
> org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(ResourceLocatorInvoker.java:132)
>
> at
> org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:100)
>
> at
> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:443)
>
> at
> org.jboss.resteasy.core.SynchronousDispatcher.lambda$invoke$4(SynchronousDispatcher.java:233)
>
> at
> org.jboss.resteasy.core.SynchronousDispatcher.lambda$preprocess$0(SynchronousDispatcher.java:139)
>
> at
> org.jboss.resteasy.core.interception.PreMatchContainerRequestContext.filter(PreMatchContainerRequestContext.java:358)
>
> at
> org.jboss.resteasy.core.SynchronousDispatcher.preprocess(SynchronousDispatcher.java:142)
>
> at
> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:219)
>
> at
> org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:227)
>
> at
> org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56)
>
> at
> org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51)
>
> at javax.servlet.http.HttpServlet.service(HttpServlet.java:791)
>
> at
> io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:74)
>
> at
> io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129)
>
> at
> org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:90)
>
> at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61)
>
> at
> io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
>
> at
> io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84)
>
> at
> io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62)
>
> at
> io.undertow.servlet.handlers.ServletChain$1.handleRequest(ServletChain.java:68)
>
> at
> io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
>
> at
> org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78)
>
> at
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>
> at
> io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:132)
>
> at
> io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57)
>
> at
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>
> at
> io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)
>
> at
> io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)
>
> at
> io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)
>
> at
> io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77)
>
> at
> io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50)
>
> at
> io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)
>
> at
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>
> at
> org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)
>
> at
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>
> at
> org.wildfly.extension.undertow.deployment.GlobalRequestControllerHandler.handleRequest(GlobalRequestControllerHandler.java:68)
>
> at
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>
> at
> io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:292)
>
> at
> io.undertow.servlet.handlers.ServletInitialHandler.access$100(ServletInitialHandler.java:81)
>
> at
> io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:138)
>
> at
> io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:135)
>
> at
> io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:48)
>
> at
> io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43)
>
> at
> org.wildfly.extension.undertow.security.SecurityContextThreadSetupAction.lambda$create$0(SecurityContextThreadSetupAction.java:105)
>
> at
> org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)
>
> at
> org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)
>
> at
> org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)
>
> at
> org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)
>
> at
> io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:272)
>
> at
> io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81)
>
> at
> io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:104)
>
> at io.undertow.server.Connectors.executeRootHandler(Connectors.java:360)
>
> at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:830)
>
> at
> org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35)
>
> at
> org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1985)
>
> at
> org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1487)
>
> at
> org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1378)
>
> at java.lang.Thread.run(Thread.java:748)
>
>
> If I set the client_id to the public-client-id and remove client_secret,
> since it is public and has none, I again get the 501 Not Implemented.
>
> Any help clearing this up is appreciated.
>
> On Mon, 19 Nov 2018 at 12:34, Pedro Igor Silva <psilva at redhat.com> wrote:
>
>> Hi,
>>
>> It is not a bug. We no longer enable tech preview features by default.
>> You need to enable the feature you want, such as admin fine grained
>> permissions, by passing a specific environment variable. Try to boot your
>> server using this system property:
>>
>>     - Dkeycloak.profile.feature.admin_fine_grained_authz=enabled
>>
>> Docs are not reflecting these changes, created
>> https://issues.jboss.org/browse/KEYCLOAK-8865.
>>
>> Regards.
>> Pedro Igor
>>
>> On Mon, Nov 19, 2018 at 9:02 AM Geoffrey Cleaves <geoff at opticks.io>
>> wrote:
>>
>>> Hello. In Keycloak 4.6, the Permissions tab is gone. The documentation
>>> for
>>> allowing token exchange depends on the Permissions tab, is this a bug?
>>>
>>> [image: Screen Shot 2018-11-19 at 11.53.56.png]
>>>
>>> Somebody else is asking the same question:
>>>
>>> https://stackoverflow.com/questions/53367566/unable-to-setup-idp-token-exchange-in-keycloak-4-6-0-final
>>>
>>> Geoff
>>> _______________________________________________
>>> keycloak-user mailing list
>>> keycloak-user at lists.jboss.org
>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Screen Shot 2018-11-19 at 16.45.51.png
Type: image/png
Size: 62094 bytes
Desc: not available
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20181119/ce8b7f8b/attachment-0001.png 

From dt at acutus.pro  Mon Nov 19 15:24:45 2018
From: dt at acutus.pro (Dmitry Telegin)
Date: Mon, 19 Nov 2018 23:24:45 +0300
Subject: [keycloak-user] Welcome Email after Verification Success
In-Reply-To: <e9085b5b5cde43159f6ab8f21e95378f@bedag.ch>
References: <a37b2c9ec0c6466f8da31509479ef2fd@bedag.ch>
	<1542005910.7421.11.camel@acutus.pro>
	<e9085b5b5cde43159f6ab8f21e95378f@bedag.ch>
Message-ID: <1542659085.15835.14.camel@acutus.pro>

Hello Rajib, glad it worked,

On Mon, 2018-11-12 at 08:38 +0000, Mitra Rajib, Bedag wrote:
> Hi Dmitry,
> 
> Thanks for your reply! I ended up implementing my own EventListenerProvider / Theme-Extension, like you mentioned.
> 
> Unfortunately a few things with this solution are not ideal:
> 
> 1) The EventListenerProviderFactory-Interface resides in a "private" module, assuming meaning the SPI could change at any time (see https://issues.jboss.org/browse/KEYCLOAK-6071).

Well, I've been using private SPIs in my projects for years, luckily nothing terrible happened yet :)

> 2) The event-type that is sent in my case after a user verified his email is a CUSTOM_REQUIRED_ACTION (see http://lists.jboss.org/pipermail/keycloak-user/2018-May/013935.html), so I have to provide this .ftl accordingly. The event contains a detail so I can differentiate it from other custom required actions. But unfortunately since the template is shared between all the custom required actions, I can only have one email for all of events of the same type. Or I could introduce FreeMaker if-else-statements to differentiate what should be displayed according to the event-detail.

Sounds like a definite bug to me. I'd suggest that you file a JIRA issue, but not before you test it with the recent Keycloak. I'm suggesting this because the code from master branch seemingly handles everything correctly (though I didn't test it):
https://github.com/keycloak/keycloak/blob/master/services/src/main/java/org/keycloak/authentication/actiontoken/verifyemail/VerifyEmailActionTokenHandler.java#L71

> 3) Since I use the sendEvent-Method, I can't introduce my own attributes for the email-template (e.g. realmName, Custom-Link, etc.).
> 
> 
> 2) and 3) could be mitigated by providing a new method in FreeMarkerEmailTemplateProvider that could be named for example sendWelcomeEmail, accepting additional attributes as a parameter for the email-template.?
> Do you think this is worth contacting the dev-mailing list for? I would be happy to provide a PR for this change with the new EventListener, since I am sure this is a common requirement.

Yep absolutely. Please also check out this: https://issues.jboss.org/browse/KEYCLOAK-1835 (that's why I'd suggest also putting Thomas in CC).

Good luck!
Dmitry

> 
> 
> Best,
> Rajib
> 
> 
> -----Urspr?ngliche Nachricht-----
> > Von: Dmitry Telegin [mailto:dt at acutus.pro]?
> Gesendet: Montag, 12. November 2018 07:59
> An: Mitra Rajib, Bedag; keycloak-user at lists.jboss.org
> Betreff: Re: [keycloak-user] Welcome Email after Verification Success
> 
> Hello Rajib,
> 
> The phrase in the doc "The Email Event Listener only supports the following events at the moment" and those 4 types boil down to the following 4 template files:
> 
> event-login_error.ftl
> event-remove_totp.ftl
> event-update_password.ftl
> event-update_totp.ftl
> 
> They can be found under "html" and "text" subdirs under this subtree:
> https://github.com/keycloak/keycloak/tree/master/themes/src/main/resources/theme/base/email
> 
> Other than that, there are no restrictions on email event types.?See this:
> https://github.com/keycloak/keycloak/blob/master/services/src/main/java/org/keycloak/email/freemarker/FreeMarkerEmailTemplateProvider.java#L109
> 
> Basically, you need to define your own email theme and include event-verify_email.ftl in it.
> See this on creating and deploying custom themes:
> https://www.keycloak.org/docs/latest/server_development/index.html#_themes
> 
> Good luck,
> Dmitry Telegin
> CTO, Acutus s.r.o.
> Keycloak Consulting and Training
> 
> Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
> +42 (022) 888-30-71
> E-mail: info at acutus.pro
> 
> On Tue, 2018-11-06 at 16:26 +0000, Mitra Rajib, Bedag wrote:
> > Hi!
> > 
> > I use Keycloak for User-Registration and would like to send a realm-customized "Welcome"-Email after the user verified his email-account.
> > 
> > The doc at https://www.keycloak.org/docs/3.2/server_admin/topics/events/login.html mentions 4 different type of email events, but none of these events fit my use-case.
> > Is there any other way I can (easily) implement such a functionality ?
> > 
> > Thanks,
> > Rajib
> > 
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user

From dt at acutus.pro  Mon Nov 19 15:41:37 2018
From: dt at acutus.pro (Dmitry Telegin)
Date: Mon, 19 Nov 2018 23:41:37 +0300
Subject: [keycloak-user] Configure EMail failed
In-Reply-To: <CACz=5kkxO3RYmf0A0utZqNxx-PmF9d-V2468=qfwinLryG0G8A@mail.gmail.com>
References: <CACz=5kkxO3RYmf0A0utZqNxx-PmF9d-V2468=qfwinLryG0G8A@mail.gmail.com>
Message-ID: <1542660097.15835.16.camel@acutus.pro>

Hello Sofiane,

There is no built-in functionality for this, but there are at least two ways to solve it:

1. Extend EmailEventListenerProvider [1] and make it route messages to admin instead of user. The solution should be quite concise but will still require coding;
2. Use standard jboss-logging event listener and feed your logs to Logstash [2]. With it, not only you will have instant email notifications (Logstash has them OOTB), but also registration statistics with ElasticSearch [3] and visualization with Kibana [4].

The second solution is obviously more heavyweight, but also much more powerful. I suggest that you'd give it a shot, especially if you're interested in statistics and analysis.

[1] https://github.com/keycloak/keycloak/blob/master/services/src/main/java/org/keycloak/events/email/EmailEventListenerProvider.java
[2] https://www.elastic.co/products/logstash
[3] https://www.elastic.co/products/elasticsearch
[4] https://www.elastic.co/products/kibana

Cheers,
Dmitry Telegin
CTO, Acutus s.r.o.
Keycloak Consulting and Training

Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
+42 (022) 888-30-71
E-mail: info at acutus.pro 

On Fri, 2018-10-19 at 15:14 +0200, So Be wrote:
> Hi,
> 
> as an administrator, I like to receive notifications when users log into
> Keycloak.
> I tried to configure the EMail for the realm but I got
> 
> Logged in user does not have an e-mail.
> 
> Any idea about what causing this?
> 
> Thank you.
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From to_sud at yahoo.com  Mon Nov 19 15:55:46 2018
From: to_sud at yahoo.com (Sud Ramasamy)
Date: Mon, 19 Nov 2018 15:55:46 -0500
Subject: [keycloak-user] Keycloak SAML IdP and URL parameter
In-Reply-To: <1542657120.15835.9.camel@acutus.pro>
References: <etPan.5beed899.50b9905b.11539@yahoo.com>
	<1542657120.15835.9.camel@acutus.pro>
Message-ID: <etPan.5bf32352.43b06c87.11539@yahoo.com>

Thanks. This is a handy little tip to use the JS Authenticators.

We found another way accomplish this using a JAX-RS feature to parse the custom URL parameter out in the first request and stuff it into the context where we could retrieve it from in the second request processing flow. Please let me know if for any reason this is approach is discouraged.

Regards
-sud




On November 19, 2018 at 2:52:05 PM, Dmitry Telegin (dt at acutus.pro) wrote:

Hello Sud,  

Please check out this thread:  
http://lists.jboss.org/pipermail/keycloak-user/2018-November/016228.html  

The problem under discussion is almost identical to yours, with the only exception being OIDC instead of SAML. But I believe the general principle (fishing request parameters out of the Referer header) remains the same.  

Another question: is it possible to use SAML RelayState to pass the same parameter? Custom authenticators have direct access to that field via client session note with the same name ("RelayState"), which could let you avoid the hacks like above.  

Cheers,  
Dmitry Telegin  
CTO, Acutus s.r.o.  
Keycloak Consulting and Training  

Pod lipami street 339/52, 130 00 Prague 3, Czech Republic  
+42 (022) 888-30-71  
E-mail: info at acutus.pro  

On Fri, 2018-11-16 at 09:47 -0500, Sud Ramasamy wrote:  
> Hi,  
>  
> We are using Keycloak as a SAML IdP and have plugged in a custom authenticator to handle the browser flow. The authenticator relies on a custom URL parameter that is present in the initial SAML Authn request to Keycloak.?  
>  
> We found that when the Keycloak SAML IdP receives a SAML Authn request (which also contains our custom URL parameter) it exchanges that request with a code and redirects the browser to itself at which point the control reaches our custom authenticator. This redirect causes our custom URL parameter from the initial request to not be available to our custom authenticator. Is there anyway to propagate our custom URL parameter to this second request and thereby have it available to our custom authenticator.  
>  
> Thanks in advance for your help.  
>  
> Regards  
> -sud?  
> _______________________________________________  
> keycloak-user mailing list  
> keycloak-user at lists.jboss.org  
> https://lists.jboss.org/mailman/listinfo/keycloak-user  

From dt at acutus.pro  Mon Nov 19 16:13:22 2018
From: dt at acutus.pro (Dmitry Telegin)
Date: Tue, 20 Nov 2018 00:13:22 +0300
Subject: [keycloak-user] Users/Groups access restrictions
In-Reply-To: <f30de906363761cd39b1413cfd65eba61a1c5dd2.camel@enalean.com>
References: <f30de906363761cd39b1413cfd65eba61a1c5dd2.camel@enalean.com>
Message-ID: <1542662002.15835.22.camel@acutus.pro>

Hello Lyderic, sorry for late reply,

The similar problem has surfaced on the ML several times recently. There are different ways to solve it; let's start by finding out whether your apps A, B and C are Java EE apps using Keycloak adapter.

In this case, you should be able to use Keycloak authorization services. Otherwise, the problem could be solved with the help of script authenticator.

Let me know if this is still topical for you,
Dmitry Telegin
CTO, Acutus s.r.o.
Keycloak Consulting and Training

Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
+42 (022) 888-30-71
E-mail: info at acutus.pro 

On Tue, 2018-11-06 at 10:54 +0100, Lyderic Dubut wrote:
> Hi Keycloak peoples!
> 
> I'm slowly introduce keycloak in production environnement, but I still
> do not Know how to restric permissions to users or groups.
> 
> To picture my words,?
> I have 3 Applications A,B and C
> 
> All company people can access to the application A
> 
> For the application B I want prohibit access to non-admin group member.
> So when a non-admin clic on OIDC button to login in app an redirect to
> keycloak, I wan't a message like "you don't have permissions".
> 
> 
> And for the application C all people can access except Bob because he
> have broken twice this application :-)
> 
> 
> It's posisble to do it??
> 
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From Gregor.Tudan at cofinpro.de  Mon Nov 19 20:15:26 2018
From: Gregor.Tudan at cofinpro.de (Gregor Tudan)
Date: Tue, 20 Nov 2018 01:15:26 +0000
Subject: [keycloak-user] Persistent Redirect Params in Registration
Message-ID: <22421F9C-BF93-4833-92A0-F37CEB6E00DC@cofinpro.de>

Hi,

I?m trying to find a solution for passing redirect parameters reliably through the registration page.

Our users will go through some steps prior to the registration. We generate an anonymous profile for saving the user input of this step. Then we trigger a registration in Keycloak and pass the id of the profile as parameter in the redirect url. 

This works fine in happy path, but breaks on some occasions: 
- we use email-verification. If registration works, but the user fails to confirm the mail-address before the link expires, he will be promted to complete the confirmation the next time he logs in. But the mail in the Confirmation-link will now no longer contain the redirect params of the original mail
- if an error occurs during the registration (the user fails multiple times to fill out the form) an error message will be shown prompting the user to restart the registration. The original params will be lost.

Is there a way to pass the query params in a more reliable manner through Keycloak?
Or is it better to implement this kind of logic in the application code? If so, are there any recommendations? Email-Verification makes this quiet hard to do, as the registration can be completed on a completely different device.

Thanks,
Gregor 


From David.Leonard at flexential.com  Tue Nov 20 00:50:29 2018
From: David.Leonard at flexential.com (David Leonard)
Date: Tue, 20 Nov 2018 05:50:29 +0000
Subject: [keycloak-user] Using Gatekeeper with ingress-nginx
Message-ID: <MWHPR11MB177310401B8E69612804E36B96D90@MWHPR11MB1773.namprd11.prod.outlook.com>

Hello everyone,

We're attempting to use Gatekeeper to integrate into a workflow with auth_request to provide authorization from Keycloak. We're wanting to use this in our Kubernetes stack to sidecar Gatekeeper to our nginx-ingress controller.

We're attempting to follow a setup similar to https://github.com/kubernetes/ingress-nginx/tree/master/docs/examples/auth/oauth-external-auth but replacing oauth2_proxy with Gatekeeper. We are able to complete a full authorization cycle using /oauth/expired to test if we have a current token.

This doesn't seem to work though because the X-Auth-* headers get passed only into the "proxied" application. Specifically oauth2_proxy provides the following config item:

  -set-xauthrequest: set X-Auth-Request-User and X-Auth-Request-Email response headers (useful in Nginx auth_request mode)

We're wanting to sidecar Gatekeeper because we get the infinite flexibility of nginx-ingress. Is it possible to set a flag similar to -set-xauthrequest? Looking at the code itself it seems this is not possible, as the headers are only ever set in the middleware.

Thanks!


--

David Leonard

Director of Professional Services, South Region

303.245.4509

3010 Waterview Parkway, Richardson, TX, 75080



This message contains information that may be confidential, privileged or otherwise protected by law from disclosure. It is intended for the exclusive use of the addressee(s) and only the addressee or authorized agent of the addressee may review, copy, distribute or disclose to anyone the message or any information contained within. If you are not the addressee, please contact the sender by electronic reply and immediately delete all copies of the message. This message is not an offer capable of acceptance, does not create an obligation of any kind and no recipient may rely on this message.

From kkcmadhu at yahoo.com  Tue Nov 20 04:27:21 2018
From: kkcmadhu at yahoo.com (Madhu)
Date: Tue, 20 Nov 2018 09:27:21 +0000 (UTC)
Subject: [keycloak-user] null pointer in
 org.keycloak.models.jpa.JpaUserProvider.getUsersCount(JpaUserProvider.java:598)
 while starting keycloak
References: <150793993.3088662.1542706041246.ref@mail.yahoo.com>
Message-ID: <150793993.3088662.1542706041246@mail.yahoo.com>

Hi ,I am starting keycloak where i have about 400 realms and the startup was timing out, after i tweaked the wildfly? ?server setting , i get the following error ,and the application fails to start.
Help will be appriciated., why is? getUsersCount throwoing null pointer?
Caused by: java.lang.NullPointerException? ? ? ? at org.keycloak.models.jpa.JpaUserProvider.getUsersCount(JpaUserProvider.java:598)? ? ? ? at org.keycloak.storage.UserStorageManager.getUsersCount(UserStorageManager.java:451)? ? ? ? at org.keycloak.storage.UserStorageManager.getUsersCount(UserStorageManager.java:460)? ? ? ? at org.keycloak.services.managers.ApplianceBootstrap.isNoMasterUser(ApplianceBootstrap.java:55)

:07:24,279 INFO? [org.hibernate.dialect.Dialect] (ServerService Thread Pool -- 62) HHH000400: Using dialect: org.hibernate.dialect.MySQL5Dialect09:07:24,323 INFO? [org.hibernate.envers.boot.internal.EnversServiceImpl] (ServerService Thread Pool -- 62) Envers integration enabled? : true09:07:24,893 INFO? [org.hibernate.validator.internal.util.Version] (ServerService Thread Pool -- 62) HV000001: Hibernate Validator 5.3.6.Final09:07:25,718 INFO? [org.hibernate.hql.internal.QueryTranslatorFactoryInitiator] (ServerService Thread Pool -- 62) HHH000397: Using ASTQueryTranslatorFactory09:13:12,576 ERROR [org.jboss.msc.service.fail] (ServerService Thread Pool -- 62) MSC000001: Failed to start service jboss.undertow.deployment.default-server.default-host./auth: org.jboss.msc.service.StartException in service jboss.undertow.deployment.default-server.default-host./auth: java.lang.RuntimeException: RESTEASY003325: Failed to construct public org.keycloak.services.resources.KeycloakApplication(javax.servlet.ServletContext,org.jboss.resteasy.core.Dispatcher)? ? ? ? at org.wildfly.extension.undertow.deployment.UndertowDeploymentService$1.run(UndertowDeploymentService.java:81)? ? ? ? at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)? ? ? ? at java.util.concurrent.FutureTask.run(FutureTask.java:266)? ? ? ? at org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35)? ? ? ? at org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1985)? ? ? ? at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1487)? ? ? ? at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1378)? ? ? ? at java.lang.Thread.run(Thread.java:748)? ? ? ? at org.jboss.threads.JBossThread.run(JBossThread.java:485)Caused by: java.lang.RuntimeException: RESTEASY003325: Failed to construct public org.keycloak.services.resources.KeycloakApplication(javax.servlet.ServletContext,org.jboss.resteasy.core.Dispatcher)? ? ? ? at org.jboss.resteasy.core.ConstructorInjectorImpl.construct(ConstructorInjectorImpl.java:162)? ? ? ? at org.jboss.resteasy.spi.ResteasyProviderFactory.createProviderInstance(ResteasyProviderFactory.java:2676)? ? ? ? at org.jboss.resteasy.spi.ResteasyDeployment.createApplication(ResteasyDeployment.java:361)? ? ? ? at org.jboss.resteasy.spi.ResteasyDeployment.startInternal(ResteasyDeployment.java:274)? ? ? ? at org.jboss.resteasy.spi.ResteasyDeployment.start(ResteasyDeployment.java:86)? ? ? ? at org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.init(ServletContainerDispatcher.java:119)? ? ? ? at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.init(HttpServletDispatcher.java:36)? ? ? ? at io.undertow.servlet.core.LifecyleInterceptorInvocation.proceed(LifecyleInterceptorInvocation.java:117)? ? ? ? at org.wildfly.extension.undertow.security.RunAsLifecycleInterceptor.init(RunAsLifecycleInterceptor.java:78)? ? ? ? at io.undertow.servlet.core.LifecyleInterceptorInvocation.proceed(LifecyleInterceptorInvocation.java:103)? ? ? ? at io.undertow.servlet.core.ManagedServlet$DefaultInstanceStrategy.start(ManagedServlet.java:300)? ? ? ? at io.undertow.servlet.core.ManagedServlet.createServlet(ManagedServlet.java:140)? ? ? ? at io.undertow.servlet.core.DeploymentManagerImpl$2.call(DeploymentManagerImpl.java:584)? ? ? ? at io.undertow.servlet.core.DeploymentManagerImpl$2.call(DeploymentManagerImpl.java:555)? ? ? ? at io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:42)? ? ? ? at io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43)? ? ? ? at org.wildfly.extension.undertow.security.SecurityContextThreadSetupAction.lambda$create$0(SecurityContextThreadSetupAction.java:105)? ? ? ? at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1514)? ? ? ? at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1514)? ? ? ? at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1514)? ? ? ? at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1514)? ? ? ? at io.undertow.servlet.core.DeploymentManagerImpl.start(DeploymentManagerImpl.java:597)? ? ? ? at org.wildfly.extension.undertow.deployment.UndertowDeploymentService.startContext(UndertowDeploymentService.java:97)? ? ? ? at org.wildfly.extension.undertow.deployment.UndertowDeploymentService$1.run(UndertowDeploymentService.java:78)? ? ? ? ... 8 moreCaused by: java.lang.NullPointerException? ? ? ? at org.keycloak.models.jpa.JpaUserProvider.getUsersCount(JpaUserProvider.java:598)? ? ? ? at org.keycloak.storage.UserStorageManager.getUsersCount(UserStorageManager.java:451)? ? ? ? at org.keycloak.storage.UserStorageManager.getUsersCount(UserStorageManager.java:460)? ? ? ? at org.keycloak.services.managers.ApplianceBootstrap.isNoMasterUser(ApplianceBootstrap.java:55)? ? ? ? at org.keycloak.services.resources.KeycloakApplication$2.run(KeycloakApplication.java:163)? ? ? ? at org.keycloak.models.utils.KeycloakModelUtils.runJobInTransaction(KeycloakModelUtils.java:227)? ? ? ? at org.keycloak.services.resources.KeycloakApplication.<init>(KeycloakApplication.java:159)? ? ? ? at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)? ? ? ? at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)? ? ? ? at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)? ? ? ? at java.lang.reflect.Constructor.newInstance(Constructor.java:423)? ? ? ? at org.jboss.resteasy.core.ConstructorInjectorImpl.construct(ConstructorInjectorImpl.java:150)? ? ? ? ... 31 more
09:13:12,581 INFO? [org.jboss.as.server] (Thread-2) WFLYSRV0220: Server shutdown has been requested via an OS signal09:13:12,654 INFO? [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-3) ISPN000080: Disconnecting JGroups channel ee09:13:12,662 INFO? [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-1) ISPN000080: Disconnecting JGroups channel ee09:13:12,663 INFO? [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thre

From nocquidant at gmail.com  Tue Nov 20 05:04:09 2018
From: nocquidant at gmail.com (Nicolas Ocquidant)
Date: Tue, 20 Nov 2018 11:04:09 +0100
Subject: [keycloak-user] OOM at startup with 1 million sessions
Message-ID: <CABS93FQGAHmzfy8FGRUu+ct_PXoAcwuMu4g9c0dM0u0T7fmxXw@mail.gmail.com>

Hi

My UC is to keep one year of sessions, this is what I have done to simulate
it:

1. I use JDBC to store 1 million of session objects, 2.8KB (in memory) each
2. I start one Infinispan node with passivation=false and shared=true, and
Xmx=8G
3. I start one Keycloak node configured with a remote-cache and Xmx=4G

Note that I use a remote-store in KC as it is the only way to set
passivation=false and shared=true (see
http://lists.jboss.org/pipermail/keycloak-user/2018-November/016180.html).

No problem in step 2, ISPN process is less than 300MB large in memory. But
after 3, ISPN process goes up to around 6GB.

See below for the traces, but basically I get OOM.

Using the debugger, I can see that getting the size of the cache is a
really slow operation, and bump memory to 3GB in ISPN process.

From
org.keycloak.models.sessions.infinispan.initializer.InfinispanCacheInitializer:

RemoteCacheSessionsLoader.computeLoaderContext(KeycloakSession session)
   // ...
    int sessionsTotal = remoteCache.size(); <--- HERE
   //...
}

And then (OOM here):

InfinispanCacheInitializer.startLoadingImpl(InitializerState state,
SessionLoader.LoaderContext ctx) {
  // ...
   for (Future<WorkerResult> future : futures) {
     // Called 4X (ie the number of segments), but 1st one does not
terminate: OOM
     // ->
org.infinispan.distexec.DefaultExecutorService$LocalDistributedTaskPart
    WorkerResult result = future.get(); <--- Very slow and bump mem to 8GB
     // ...
}

So, with 1M of sessions in store, I cannot get KC/ISPN to start. And I am
far from my goal which is to keep one year of sessions (which has been
estimated to ~52M of sessions)...

Is it something I can't achieve with KC/ISPN?
Any help appreciated.

Thanks
nick

Note, versions I used are:

* ISPN 9.4.1 Wildfly
* KC 4.6.0 Wildfly

-- ISPN process

10:42:22,969 ERROR [stderr] (Periodic Recovery) Exception in thread
"Periodic Recovery" java.lang.OutOfMemoryError: Java heap space
10:42:22,977 ERROR [stderr] (Periodic Recovery)         at
sun.text.resources.fr.FormatData_fr.getContents(FormatData_fr.java:86)
10:42:22,975 ERROR
[org.infinispan.persistence.jdbc.connectionfactory.ManagedConnectionFactory]
(pool-9-thread-1) ISPN008018: Sql failure retrieving connection from
datasource: java.sql.SQLException: javax.resource.ResourceException:
IJ000456: Unchecked throwable in ManagedConnection.getConnection()
cl=org.jboss.jca.core.connectionmanager.listener.TxConnectionListener at 3e3890ff[state=NORMAL
managed
connection=org.jboss.jca.adapters.jdbc.local.LocalManagedConnection at 3f033728
connection handles=0 lastReturned=1542706942971 lastValidated=1542706738387
lastCheckedOut=1542706916019 trackByTx=false
pool=org.jboss.jca.core.connectionmanager.pool.strategy.OnePool at 2772dcff
mcp=SemaphoreConcurrentLinkedQueueManagedConnectionPool at 5e82b87d[pool=InfinispanDS]
xaResource=LocalXAResourceImpl at 308d2c98[connectionListener=3e3890ff
connectionManager=1691f7d6 warned=false currentXid=null
productName=PostgreSQL productVersion=10.5
jndiName=java:jboss/datasources/InfinispanDS] txSync=null]
        at
org.jboss.jca.adapters.jdbc.WrapperDataSource.getConnection(WrapperDataSource.java:146)
        at
org.jboss.as.connector.subsystems.datasources.WildFlyDataSource.getConnection(WildFlyDataSource.java:64)
        at
org.infinispan.persistence.jdbc.connectionfactory.ManagedConnectionFactory.getConnection(ManagedConnectionFactory.java:83)
        at
org.infinispan.persistence.jdbc.stringbased.JdbcStringBasedStore.purge(JdbcStringBasedStore.java:461)
        at
org.infinispan.persistence.manager.PersistenceManagerImpl.lambda$purgeExpired$6(PersistenceManagerImpl.java:459)
        at java.util.ArrayList.forEach(ArrayList.java:1257)
        at
org.infinispan.persistence.manager.PersistenceManagerImpl.purgeExpired(PersistenceManagerImpl.java:462)
        at
org.infinispan.expiration.impl.ClusterExpirationManager.processExpiration(ClusterExpirationManager.java:119)
        at
org.infinispan.expiration.impl.ExpirationManagerImpl$ScheduledTask.run(ExpirationManagerImpl.java:245)
        at
java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
        at java.util.concurrent.FutureTask.runAndReset(FutureTask.java:308)
        at
java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$301(ScheduledThreadPoolExecutor.java:180)
        at
java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:294)
        at
java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
        at
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
        at java.lang.Thread.run(Thread.java:748)
Caused by: javax.resource.ResourceException: IJ000456: Unchecked throwable
in ManagedConnection.getConnection()
cl=org.jboss.jca.core.connectionmanager.listener.TxConnectionListener at 3e3890ff[state=NORMAL
managed
connection=org.jboss.jca.adapters.jdbc.local.LocalManagedConnection at 3f033728
connection handles=0 lastReturned=1542706942971 lastValidated=1542706738387
lastCheckedOut=1542706916019 trackByTx=false
pool=org.jboss.jca.core.connectionmanager.pool.strategy.OnePool at 2772dcff
mcp=SemaphoreConcurrentLinkedQueueManagedConnectionPool at 5e82b87d[pool=InfinispanDS]
xaResource=LocalXAResourceImpl at 308d2c98[connectionListener=3e3890ff
connectionManager=1691f7d6 warned=false currentXid=null
productName=PostgreSQL productVersion=10.5
jndiName=java:jboss/datasources/InfinispanDS] txSync=null]
        at
org.jboss.jca.core.connectionmanager.AbstractConnectionManager.allocateConnection(AbstractConnectionManager.java:811)
        at
org.jboss.jca.adapters.jdbc.WrapperDataSource.getConnection(WrapperDataSource.java:138)
        ... 15 more
Caused by: java.lang.OutOfMemoryError: Java heap space


-- KC process

10:42:23,216 WARN  [org.infinispan.client.hotrod.impl.protocol.Codec21]
(Thread-0) ISPN004005: Error received from the server:
java.lang.RuntimeException: java.sql.SQLException: Error

java.sql.SQLException: Error
java.lang.OutOfMemoryError: Java heap space
10:42:23,359 WARN
[org.keycloak.models.sessions.infinispan.remotestore.RemoteCacheSessionsLoader]
(pool-16-thread-4) Error loading sessions from remote cache 'sessions' for
segment '3':
org.infinispan.client.hotrod.exceptions.HotRodClientException:Request for
messageId=55 returned server error (status=0x85):
java.lang.RuntimeException: java.sql.SQLException: Error
java.sql.SQLException: Error
java.lang.OutOfMemoryError: Java heap space
        at
org.infinispan.client.hotrod.impl.protocol.Codec20.checkForErrorsInResponseStatus(Codec20.java:333)
        at
org.infinispan.client.hotrod.impl.protocol.Codec20.readHeader(Codec20.java:179)
        at
org.infinispan.client.hotrod.impl.transport.netty.HeaderDecoder.decode(HeaderDecoder.java:138)
        at
org.infinispan.client.hotrod.impl.transport.netty.HintedReplayingDecoder.callDecode(HintedReplayingDecoder.java:98)
        at
io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:265)
        at
io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362)
        at
io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348)
        at
io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340)
        at
io.netty.handler.timeout.IdleStateHandler.channelRead(IdleStateHandler.java:286)
        at
io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362)
        at
io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348)
        at
io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340)
        at
io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1434)
        at
io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362)
        at
io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348)
        at
io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:965)
        at
io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:163)
        at
io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:647)
        at
io.netty.channel.nio.NioEventLoop.processSelectedKeysOptimized(NioEventLoop.java:582)
        at
io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:499)
        at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:461)
        at
io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:884)
        at
java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
        at
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
        at java.lang.Thread.run(Thread.java:748)

From nocquidant at gmail.com  Tue Nov 20 05:25:02 2018
From: nocquidant at gmail.com (Nicolas Ocquidant)
Date: Tue, 20 Nov 2018 11:25:02 +0100
Subject: [keycloak-user] Unable to unmarshall bytes for
	CLIENT_CACHE_ENTRY_CREATED
Message-ID: <CABS93FQwgVeMXx9=ep_fzR48nH2VY01YQPvUe2OFaQfDpS4vFg@mail.gmail.com>

Hi

This is my very simple UC to reproduce:

1. Start one Infinispan node with passivation=false and shared=true (I
don't think parameters are important here)
2. Start one Keycloak node configured with a remote-cache
3. Populate Keycloak  using admin console (one realm, one client, one role
and one user)
3. Ask for an access token with curl (no client_secret)

Than, in Codec21.readCacheEvent():

case CLIENT_CACHE_ENTRY_CREATED:
   Object createdKey = dataFormat.keyToObj(ByteBufUtil.readArray(buf),
status, whitelist); <-- BOOM

My config is:

<distributed-cache name="sessions" owners="1" remote-timeout="600000"
statistics-enabled="true">
<binary-memory eviction-type="COUNT" size="10000"/>
<remote-store cache="sessions" socket-timeout="600000"
remote-servers="remote-cache" passivation="false" fetch-state="false"
purge="false" preload="false" shared="true">
<property name="rawValues">true</property>
<property
name="marshaller">org.keycloak.cluster.infinispan.KeycloakHotRodMarshallerFactory</property>
</remote-store>
</distributed-cache>

The stack trace is (see below).

It is a config issue?
Thanks for your help
--nick

11:09:13,373 WARN
[org.infinispan.client.hotrod.impl.transport.netty.HeaderDecoder]
(Thread-0) ISPN004039: Unable to complete reading event from server /
127.0.0.1:11222:
org.infinispan.client.hotrod.exceptions.HotRodClientException:: ISPN004034:
Unable to unmarshall bytes
01012926033E2439633136373130642D653432332D343134342D396163652D393461356564353639313462
        at
org.infinispan.client.hotrod.marshall.MarshallerUtil.bytes2obj(MarshallerUtil.java:48)
        at
org.infinispan.client.hotrod.DataFormat.keyToObj(DataFormat.java:93)
        at
org.infinispan.client.hotrod.impl.protocol.Codec21.readCacheEvent(Codec21.java:75)
        at
org.infinispan.client.hotrod.impl.transport.netty.HeaderDecoder.decode(HeaderDecoder.java:153)
        at
org.infinispan.client.hotrod.impl.transport.netty.HintedReplayingDecoder.callDecode(HintedReplayingDecoder.java:98)
        at
io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:265)
        at
io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362)
        at
io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348)
        at
io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340)
        at
io.netty.handler.timeout.IdleStateHandler.channelRead(IdleStateHandler.java:286)
        at
io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362)
        at
io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348)
        at
io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340)
        at
io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1434)
        at
io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362)
        at
io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348)
        at
io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:965)
        at
io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:163)
        at
io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:647)
        at
io.netty.channel.nio.NioEventLoop.processSelectedKeysOptimized(NioEventLoop.java:582)
        at
io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:499)
        at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:461)
        at
io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:884)
        at
java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
        at
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
        at java.lang.Thread.run(Thread.java:748)
Caused by: java.io.IOException: Unsupported protocol version 1
        at
org.jboss.marshalling.river.RiverUnmarshaller.start(RiverUnmarshaller.java:1349)
        at
org.infinispan.commons.marshall.jboss.AbstractJBossMarshaller.startObjectInput(AbstractJBossMarshaller.java:129)
        at
org.infinispan.commons.marshall.jboss.AbstractJBossMarshaller.objectFromByteBuffer(AbstractJBossMarshaller.java:110)
        at
org.infinispan.commons.marshall.AbstractMarshaller.objectFromByteBuffer(AbstractMarshaller.java:82)
        at
org.infinispan.client.hotrod.marshall.MarshallerUtil.bytes2obj(MarshallerUtil.java:32)
        ... 25 more

From psilva at redhat.com  Tue Nov 20 05:49:40 2018
From: psilva at redhat.com (Pedro Igor Silva)
Date: Tue, 20 Nov 2018 08:49:40 -0200
Subject: [keycloak-user] Permission tab missing,
	token exchange impossible
In-Reply-To: <CAHzT=q8h6HYm94+qQy4bgfrY176S_XLTa-=vxfnUMryMViX5Wg@mail.gmail.com>
References: <CAHzT=q9TttPN_QLvNKOjM+MVqiqw21Wujtq6UdXr5YvSc66=Gw@mail.gmail.com>
	<CAJrcDBeXgdoGQOUwbeeNDwArpUEJr=6sEOqFOP1pad=rGymE7w@mail.gmail.com>
	<CAHzT=q9T=TWkVPVJti5oy4iwQcnYv8-70vNFyCvX14VgnKTvJw@mail.gmail.com>
	<CAHzT=q8h6HYm94+qQy4bgfrY176S_XLTa-=vxfnUMryMViX5Wg@mail.gmail.com>
Message-ID: <CAJrcDBeZNRqQtb=_op8oMJHXxPWatZYBM-OGHs110ApSbk2Mwg@mail.gmail.com>

Yeah, and you are passing the test :) I've submitted a PR with changes to
documentation.

Thanks.
Pedro Igor

On Mon, Nov 19, 2018 at 6:22 PM Geoffrey Cleaves <geoff at opticks.io> wrote:

> I guess you're putting me to the test, huh, Pedro? ;) So I figured it out.
> Token exchange is also a preview feature, so I had to start the server with:
>   -Dkeycloak.profile.feature.admin_fine_grained_authz=enabled
>   -Dkeycloak.profile.feature.token_exchange=enabled
>
> Then to get the token exchange right I had to use the resource server
> client_id and secret.
>
> Regards,
> Geoffrey Cleaves
>
> On Mon, 19 Nov 2018 at 16:57, Geoffrey Cleaves <geoff at opticks.io> wrote:
>
>> Thanks, I've got the Permissions tab working but am now having trouble
>> exchanging a token. Perhaps my thought process is incorrect.
>>
>> My idea was for the resource server to take the end user's auth token
>> sent by the Javascript front end public client and exchange it for a token
>> which would allow the resource server to list UMA permissions of that user.
>> In other words, the end user logs into the SPA front end (via Keycloak of
>> course) and then sees the UMA resources he is sharing.
>>
>> I set permissions for the public client to exchange token for resource
>> server client as described in the docs
>> <https://www.keycloak.org/docs/latest/securing_apps/index.html#internal-token-to-internal-token-exchange>.
>> The starting client is the public client and the target client is the
>> resource server.
>> [image: Screen Shot 2018-11-19 at 16.45.51.png]
>>
>> The problem is that when I try to exchange the token Keycloak gives me
>> different errors depending on how I send the token exchange request:
>>
>> grant_type: urn:ietf:params:oauth:grant-type:token-exchange
>> audience: opticks-rs (resource server)
>> requested_token_type: urn:ietf:params:oauth:token-type:refresh_token
>> subject_token: End user's Bearer token received from SPA public client
>>
>> If I don't send client_id and client_secret I get a 400 Bad Request and
>> "INVALID_CREDENTIALS: Invalid client credentials" error. I thought I could
>> skip these fields as the subject_token would server as authentication.
>> If I send cliend_id=opticks-rs and the client_secret, I get a 501 Not
>> Implemented error:
>>
>> 15:49:43,491 ERROR [org.keycloak.services.error.KeycloakErrorHandler]
>> (default task-10) Uncaught server error:
>> javax.ws.rs.WebApplicationException: Feature not enabled
>>
>> at org.keycloak.utils.ProfileHelper.requireFeature(ProfileHelper.java:32)
>>
>> at
>> org.keycloak.protocol.oidc.endpoints.TokenEndpoint.tokenExchange(TokenEndpoint.java:658)
>>
>> at
>> org.keycloak.protocol.oidc.endpoints.TokenEndpoint.processGrantRequest(TokenEndpoint.java:190)
>>
>> at sun.reflect.GeneratedMethodAccessor770.invoke(Unknown Source)
>>
>> at
>> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
>>
>> at java.lang.reflect.Method.invoke(Method.java:498)
>>
>> at
>> org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java:140)
>>
>> at
>> org.jboss.resteasy.core.ResourceMethodInvoker.internalInvokeOnTarget(ResourceMethodInvoker.java:509)
>>
>> at
>> org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTargetAfterFilter(ResourceMethodInvoker.java:399)
>>
>> at
>> org.jboss.resteasy.core.ResourceMethodInvoker.lambda$invokeOnTarget$0(ResourceMethodInvoker.java:363)
>>
>> at
>> org.jboss.resteasy.core.interception.PreMatchContainerRequestContext.filter(PreMatchContainerRequestContext.java:358)
>>
>> at
>> org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTarget(ResourceMethodInvoker.java:365)
>>
>> at
>> org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:337)
>>
>> at
>> org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(ResourceLocatorInvoker.java:137)
>>
>> at
>> org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:106)
>>
>> at
>> org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(ResourceLocatorInvoker.java:132)
>>
>> at
>> org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:100)
>>
>> at
>> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:443)
>>
>> at
>> org.jboss.resteasy.core.SynchronousDispatcher.lambda$invoke$4(SynchronousDispatcher.java:233)
>>
>> at
>> org.jboss.resteasy.core.SynchronousDispatcher.lambda$preprocess$0(SynchronousDispatcher.java:139)
>>
>> at
>> org.jboss.resteasy.core.interception.PreMatchContainerRequestContext.filter(PreMatchContainerRequestContext.java:358)
>>
>> at
>> org.jboss.resteasy.core.SynchronousDispatcher.preprocess(SynchronousDispatcher.java:142)
>>
>> at
>> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:219)
>>
>> at
>> org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:227)
>>
>> at
>> org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56)
>>
>> at
>> org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51)
>>
>> at javax.servlet.http.HttpServlet.service(HttpServlet.java:791)
>>
>> at
>> io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:74)
>>
>> at
>> io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129)
>>
>> at
>> org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:90)
>>
>> at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61)
>>
>> at
>> io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
>>
>> at
>> io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84)
>>
>> at
>> io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62)
>>
>> at
>> io.undertow.servlet.handlers.ServletChain$1.handleRequest(ServletChain.java:68)
>>
>> at
>> io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
>>
>> at
>> org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78)
>>
>> at
>> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>>
>> at
>> io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:132)
>>
>> at
>> io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57)
>>
>> at
>> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>>
>> at
>> io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)
>>
>> at
>> io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)
>>
>> at
>> io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)
>>
>> at
>> io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77)
>>
>> at
>> io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50)
>>
>> at
>> io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)
>>
>> at
>> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>>
>> at
>> org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)
>>
>> at
>> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>>
>> at
>> org.wildfly.extension.undertow.deployment.GlobalRequestControllerHandler.handleRequest(GlobalRequestControllerHandler.java:68)
>>
>> at
>> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>>
>> at
>> io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:292)
>>
>> at
>> io.undertow.servlet.handlers.ServletInitialHandler.access$100(ServletInitialHandler.java:81)
>>
>> at
>> io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:138)
>>
>> at
>> io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:135)
>>
>> at
>> io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:48)
>>
>> at
>> io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43)
>>
>> at
>> org.wildfly.extension.undertow.security.SecurityContextThreadSetupAction.lambda$create$0(SecurityContextThreadSetupAction.java:105)
>>
>> at
>> org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)
>>
>> at
>> org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)
>>
>> at
>> org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)
>>
>> at
>> org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)
>>
>> at
>> io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:272)
>>
>> at
>> io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81)
>>
>> at
>> io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:104)
>>
>> at io.undertow.server.Connectors.executeRootHandler(Connectors.java:360)
>>
>> at
>> io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:830)
>>
>> at
>> org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35)
>>
>> at
>> org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1985)
>>
>> at
>> org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1487)
>>
>> at
>> org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1378)
>>
>> at java.lang.Thread.run(Thread.java:748)
>>
>>
>> If I set the client_id to the public-client-id and remove client_secret,
>> since it is public and has none, I again get the 501 Not Implemented.
>>
>> Any help clearing this up is appreciated.
>>
>> On Mon, 19 Nov 2018 at 12:34, Pedro Igor Silva <psilva at redhat.com> wrote:
>>
>>> Hi,
>>>
>>> It is not a bug. We no longer enable tech preview features by default.
>>> You need to enable the feature you want, such as admin fine grained
>>> permissions, by passing a specific environment variable. Try to boot your
>>> server using this system property:
>>>
>>>     - Dkeycloak.profile.feature.admin_fine_grained_authz=enabled
>>>
>>> Docs are not reflecting these changes, created
>>> https://issues.jboss.org/browse/KEYCLOAK-8865.
>>>
>>> Regards.
>>> Pedro Igor
>>>
>>> On Mon, Nov 19, 2018 at 9:02 AM Geoffrey Cleaves <geoff at opticks.io>
>>> wrote:
>>>
>>>> Hello. In Keycloak 4.6, the Permissions tab is gone. The documentation
>>>> for
>>>> allowing token exchange depends on the Permissions tab, is this a bug?
>>>>
>>>> [image: Screen Shot 2018-11-19 at 11.53.56.png]
>>>>
>>>> Somebody else is asking the same question:
>>>>
>>>> https://stackoverflow.com/questions/53367566/unable-to-setup-idp-token-exchange-in-keycloak-4-6-0-final
>>>>
>>>> Geoff
>>>> _______________________________________________
>>>> keycloak-user mailing list
>>>> keycloak-user at lists.jboss.org
>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>
>>>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Screen Shot 2018-11-19 at 16.45.51.png
Type: image/png
Size: 62094 bytes
Desc: not available
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20181120/25cfb099/attachment-0001.png 

From dt at acutus.pro  Tue Nov 20 07:00:51 2018
From: dt at acutus.pro (Dmitry Telegin)
Date: Tue, 20 Nov 2018 15:00:51 +0300
Subject: [keycloak-user] Persistent Redirect Params in Registration
In-Reply-To: <22421F9C-BF93-4833-92A0-F37CEB6E00DC@cofinpro.de>
References: <22421F9C-BF93-4833-92A0-F37CEB6E00DC@cofinpro.de>
Message-ID: <1542715251.2146.1.camel@acutus.pro>

Hi Gregor,

Is the overall idea the following: upon successful registration, the user should be redirected back to the application for which the anonymous profile has been created, and the app should know the profile ID to link the user to?

I think passing back the ID in the redirect URI is unreliable. I'd rather suggest that upon registration you persist the profile ID as a user attribute in Keycloak, and propagate it back to the application as a token claim. The application, obviously, will need to be modified to be able to handle that custom claim.
To extract the ID from the request URI and to persist it as an attribute in Keycloak, you can use custom execution within the Registration flow (I'd suggest script-based).
To push the attribute to the token claims, use custom protocol mapper.

To overcome the issue with?parameter loss due to restarted registration, I'd suggest that you use browser local storage to hold your profile ID. This will however require modifications to the Keycloak registration screens (via login theme) so that the ID could be retrieved from the local storage and sent to Keycloak.
Most likely your pre-Keycloak profile wizard will reside on a separate (sub)domain, so you should use some tricks to share your local storage between the domains (Google for "local storage shared"). This scheme will obviously rely on working JavaScript and local storage support?in the browser.

As for email verification,?this should be also mitigated by the
attribute/claim approach described above. If your user has reached this
step, this means that technically the registration has been successful,
and the profile ID attribute should have been created already. Upon
completing email verification, the user will be taken to the
application with the claim already in the token.

Feel free to ask any questions,
Dmitry Telegin
CTO, Acutus s.r.o.
Keycloak Consulting and Training

Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
+42 (022) 888-30-71
E-mail: info at acutus.pro

On Tue, 2018-11-20 at 01:15 +0000, Gregor Tudan wrote:
> Hi,
> 
> I?m trying to find a solution for passing redirect parameters reliably through the registration page.
> 
> Our users will go through some steps prior to the registration. We generate an anonymous profile for saving the user input of this step. Then we trigger a registration in Keycloak and pass the id of the profile as parameter in the redirect url.?
> 
> This works fine in happy path, but breaks on some occasions:?
> - we use email-verification. If registration works, but the user fails to confirm the mail-address before the link expires, he will be promted to complete the confirmation the next time he logs in. But the mail in the Confirmation-link will now no longer contain the redirect params of the original mail
> - if an error occurs during the registration (the user fails multiple times to fill out the form) an error message will be shown prompting the user to restart the registration. The original params will be lost.
> 
> Is there a way to pass the query params in a more reliable manner through Keycloak?
> Or is it better to implement this kind of logic in the application code? If so, are there any recommendations? Email-Verification makes this quiet hard to do, as the registration can be completed on a completely different device.
> 
> Thanks,
> Gregor?
> 
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From dt at acutus.pro  Tue Nov 20 07:04:43 2018
From: dt at acutus.pro (Dmitry Telegin)
Date: Tue, 20 Nov 2018 15:04:43 +0300
Subject: [keycloak-user] Keycloak SAML IdP and URL parameter
In-Reply-To: <etPan.5bf32352.43b06c87.11539@yahoo.com>
References: <etPan.5beed899.50b9905b.11539@yahoo.com>
	<1542657120.15835.9.camel@acutus.pro>
	<etPan.5bf32352.43b06c87.11539@yahoo.com>
Message-ID: <1542715483.2146.3.camel@acutus.pro>

Hello Sud,

On Mon, 2018-11-19 at 15:55 -0500, Sud Ramasamy wrote:
> Thanks. This is a handy little tip to use the JS Authenticators.
> 
> We found another way accomplish this using a JAX-RS feature to parse the custom URL parameter out in the first request and stuff it into the context where we could retrieve it from in the second request processing flow. Please let me know if for any reason this is approach is discouraged.

In fact I?was thinking about something similar, but with servlet filter rather than JAX-RS feature. Your solution seems even better. Do you register a JAX-RS interceptor on SamlService endpoint and push the extracted parameter into a session context?

Dmitry

> 
> Regards
> -sud
> 
> 
> 
> 
> > On November 19, 2018 at 2:52:05 PM, Dmitry Telegin (dt at acutus.pro) wrote:
> 
> Hello Sud,??
> 
> Please check out this thread:??
> http://lists.jboss.org/pipermail/keycloak-user/2018-November/016228.html??
> 
> The problem under discussion is almost identical to yours, with the only exception being OIDC instead of SAML. But I believe the general principle (fishing request parameters out of the Referer header) remains the same.??
> 
> Another question: is it possible to use SAML RelayState to pass the same parameter? Custom authenticators have direct access to that field via client session note with the same name ("RelayState"), which could let you avoid the hacks like above.??
> 
> Cheers,??
> Dmitry Telegin??
> CTO, Acutus s.r.o.??
> Keycloak Consulting and Training??
> 
> Pod lipami street 339/52, 130 00 Prague 3, Czech Republic??
> +42 (022) 888-30-71??
> > E-mail: info at acutus.pro??
> 
> On Fri, 2018-11-16 at 09:47 -0500, Sud Ramasamy wrote:??
> > Hi,??
> > ?
> > We are using Keycloak as a SAML IdP and have plugged in a custom authenticator to handle the browser flow. The authenticator relies on a custom URL parameter that is present in the initial SAML Authn request to Keycloak.???
> > ?
> > We found that when the Keycloak SAML IdP receives a SAML Authn request (which also contains our custom URL parameter) it exchanges that request with a code and redirects the browser to itself at which point the control reaches our custom authenticator. This redirect causes our custom URL parameter from the initial request to not be available to our custom authenticator. Is there anyway to propagate our custom URL parameter to this second request and thereby have it available to our custom authenticator.??
> > ?
> > Thanks in advance for your help.??
> > ?
> > Regards??
> > -sud???
> > _______________________________________________??
> > keycloak-user mailing list??
> > keycloak-user at lists.jboss.org??
> > https://lists.jboss.org/mailman/listinfo/keycloak-user??
> 
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From slaskawi at redhat.com  Tue Nov 20 07:42:10 2018
From: slaskawi at redhat.com (Sebastian Laskawiec)
Date: Tue, 20 Nov 2018 13:42:10 +0100
Subject: [keycloak-user] OOM at startup with 1 million sessions
In-Reply-To: <CABS93FQGAHmzfy8FGRUu+ct_PXoAcwuMu4g9c0dM0u0T7fmxXw@mail.gmail.com>
References: <CABS93FQGAHmzfy8FGRUu+ct_PXoAcwuMu4g9c0dM0u0T7fmxXw@mail.gmail.com>
Message-ID: <CAA9R9O7vyWdVvHaPNYdM0+9E9aPN+eFDvGv2rN60kg_VOXFD+w@mail.gmail.com>

If I'm not mistaken (+William Burns <wburns at redhat.com> is an expert here),
invoking RemoteCache#size() method requires to pull all entries from the
store into the memory. If so, that's why it blows up.

The only way that comes into my mind is to get rid of RemoteCache#size()
calls from Keycloak (+Marek Posolda <mposolda at redhat.com> WDYT, is it
doable?).

I'm just wondering if adding more memory to the ISPN process is an option
in your case?

On Tue, Nov 20, 2018 at 11:12 AM Nicolas Ocquidant <nocquidant at gmail.com>
wrote:

> Hi
>
> My UC is to keep one year of sessions, this is what I have done to simulate
> it:
>
> 1. I use JDBC to store 1 million of session objects, 2.8KB (in memory) each
> 2. I start one Infinispan node with passivation=false and shared=true, and
> Xmx=8G
> 3. I start one Keycloak node configured with a remote-cache and Xmx=4G
>
> Note that I use a remote-store in KC as it is the only way to set
> passivation=false and shared=true (see
> http://lists.jboss.org/pipermail/keycloak-user/2018-November/016180.html).
>
> No problem in step 2, ISPN process is less than 300MB large in memory. But
> after 3, ISPN process goes up to around 6GB.
>
> See below for the traces, but basically I get OOM.
>
> Using the debugger, I can see that getting the size of the cache is a
> really slow operation, and bump memory to 3GB in ISPN process.
>
> From
>
> org.keycloak.models.sessions.infinispan.initializer.InfinispanCacheInitializer:
>
> RemoteCacheSessionsLoader.computeLoaderContext(KeycloakSession session)
>    // ...
>     int sessionsTotal = remoteCache.size(); <--- HERE
>    //...
> }
>
> And then (OOM here):
>
> InfinispanCacheInitializer.startLoadingImpl(InitializerState state,
> SessionLoader.LoaderContext ctx) {
>   // ...
>    for (Future<WorkerResult> future : futures) {
>      // Called 4X (ie the number of segments), but 1st one does not
> terminate: OOM
>      // ->
> org.infinispan.distexec.DefaultExecutorService$LocalDistributedTaskPart
>     WorkerResult result = future.get(); <--- Very slow and bump mem to 8GB
>      // ...
> }
>
> So, with 1M of sessions in store, I cannot get KC/ISPN to start. And I am
> far from my goal which is to keep one year of sessions (which has been
> estimated to ~52M of sessions)...
>
> Is it something I can't achieve with KC/ISPN?
> Any help appreciated.
>
> Thanks
> nick
>
> Note, versions I used are:
>
> * ISPN 9.4.1 Wildfly
> * KC 4.6.0 Wildfly
>
> -- ISPN process
>
> 10:42:22,969 ERROR [stderr] (Periodic Recovery) Exception in thread
> "Periodic Recovery" java.lang.OutOfMemoryError: Java heap space
> 10:42:22,977 ERROR [stderr] (Periodic Recovery)         at
> sun.text.resources.fr.FormatData_fr.getContents(FormatData_fr.java:86)
> 10:42:22,975 ERROR
>
> [org.infinispan.persistence.jdbc.connectionfactory.ManagedConnectionFactory]
> (pool-9-thread-1) ISPN008018: Sql failure retrieving connection from
> datasource: java.sql.SQLException: javax.resource.ResourceException:
> IJ000456: Unchecked throwable in ManagedConnection.getConnection()
>
> cl=org.jboss.jca.core.connectionmanager.listener.TxConnectionListener at 3e3890ff
> [state=NORMAL
> managed
>
> connection=org.jboss.jca.adapters.jdbc.local.LocalManagedConnection at 3f033728
> connection handles=0 lastReturned=1542706942971 lastValidated=1542706738387
> lastCheckedOut=1542706916019 trackByTx=false
> pool=org.jboss.jca.core.connectionmanager.pool.strategy.OnePool at 2772dcff
> mcp=SemaphoreConcurrentLinkedQueueManagedConnectionPool at 5e82b87d
> [pool=InfinispanDS]
> xaResource=LocalXAResourceImpl at 308d2c98[connectionListener=3e3890ff
> connectionManager=1691f7d6 warned=false currentXid=null
> productName=PostgreSQL productVersion=10.5
> jndiName=java:jboss/datasources/InfinispanDS] txSync=null]
>         at
>
> org.jboss.jca.adapters.jdbc.WrapperDataSource.getConnection(WrapperDataSource.java:146)
>         at
>
> org.jboss.as.connector.subsystems.datasources.WildFlyDataSource.getConnection(WildFlyDataSource.java:64)
>         at
>
> org.infinispan.persistence.jdbc.connectionfactory.ManagedConnectionFactory.getConnection(ManagedConnectionFactory.java:83)
>         at
>
> org.infinispan.persistence.jdbc.stringbased.JdbcStringBasedStore.purge(JdbcStringBasedStore.java:461)
>         at
>
> org.infinispan.persistence.manager.PersistenceManagerImpl.lambda$purgeExpired$6(PersistenceManagerImpl.java:459)
>         at java.util.ArrayList.forEach(ArrayList.java:1257)
>         at
>
> org.infinispan.persistence.manager.PersistenceManagerImpl.purgeExpired(PersistenceManagerImpl.java:462)
>         at
>
> org.infinispan.expiration.impl.ClusterExpirationManager.processExpiration(ClusterExpirationManager.java:119)
>         at
>
> org.infinispan.expiration.impl.ExpirationManagerImpl$ScheduledTask.run(ExpirationManagerImpl.java:245)
>         at
> java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
>         at java.util.concurrent.FutureTask.runAndReset(FutureTask.java:308)
>         at
>
> java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$301(ScheduledThreadPoolExecutor.java:180)
>         at
>
> java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:294)
>         at
>
> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
>         at
>
> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
>         at java.lang.Thread.run(Thread.java:748)
> Caused by: javax.resource.ResourceException: IJ000456: Unchecked throwable
> in ManagedConnection.getConnection()
>
> cl=org.jboss.jca.core.connectionmanager.listener.TxConnectionListener at 3e3890ff
> [state=NORMAL
> managed
>
> connection=org.jboss.jca.adapters.jdbc.local.LocalManagedConnection at 3f033728
> connection handles=0 lastReturned=1542706942971 lastValidated=1542706738387
> lastCheckedOut=1542706916019 trackByTx=false
> pool=org.jboss.jca.core.connectionmanager.pool.strategy.OnePool at 2772dcff
> mcp=SemaphoreConcurrentLinkedQueueManagedConnectionPool at 5e82b87d
> [pool=InfinispanDS]
> xaResource=LocalXAResourceImpl at 308d2c98[connectionListener=3e3890ff
> connectionManager=1691f7d6 warned=false currentXid=null
> productName=PostgreSQL productVersion=10.5
> jndiName=java:jboss/datasources/InfinispanDS] txSync=null]
>         at
>
> org.jboss.jca.core.connectionmanager.AbstractConnectionManager.allocateConnection(AbstractConnectionManager.java:811)
>         at
>
> org.jboss.jca.adapters.jdbc.WrapperDataSource.getConnection(WrapperDataSource.java:138)
>         ... 15 more
> Caused by: java.lang.OutOfMemoryError: Java heap space
>
>
> -- KC process
>
> 10:42:23,216 WARN  [org.infinispan.client.hotrod.impl.protocol.Codec21]
> (Thread-0) ISPN004005: Error received from the server:
> java.lang.RuntimeException: java.sql.SQLException: Error
>
> java.sql.SQLException: Error
> java.lang.OutOfMemoryError: Java heap space
> 10:42:23,359 WARN
>
> [org.keycloak.models.sessions.infinispan.remotestore.RemoteCacheSessionsLoader]
> (pool-16-thread-4) Error loading sessions from remote cache 'sessions' for
> segment '3':
> org.infinispan.client.hotrod.exceptions.HotRodClientException:Request for
> messageId=55 returned server error (status=0x85):
> java.lang.RuntimeException: java.sql.SQLException: Error
> java.sql.SQLException: Error
> java.lang.OutOfMemoryError: Java heap space
>         at
>
> org.infinispan.client.hotrod.impl.protocol.Codec20.checkForErrorsInResponseStatus(Codec20.java:333)
>         at
>
> org.infinispan.client.hotrod.impl.protocol.Codec20.readHeader(Codec20.java:179)
>         at
>
> org.infinispan.client.hotrod.impl.transport.netty.HeaderDecoder.decode(HeaderDecoder.java:138)
>         at
>
> org.infinispan.client.hotrod.impl.transport.netty.HintedReplayingDecoder.callDecode(HintedReplayingDecoder.java:98)
>         at
>
> io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:265)
>         at
>
> io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362)
>         at
>
> io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348)
>         at
>
> io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340)
>         at
>
> io.netty.handler.timeout.IdleStateHandler.channelRead(IdleStateHandler.java:286)
>         at
>
> io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362)
>         at
>
> io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348)
>         at
>
> io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340)
>         at
>
> io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1434)
>         at
>
> io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362)
>         at
>
> io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348)
>         at
>
> io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:965)
>         at
>
> io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:163)
>         at
> io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:647)
>         at
>
> io.netty.channel.nio.NioEventLoop.processSelectedKeysOptimized(NioEventLoop.java:582)
>         at
>
> io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:499)
>         at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:461)
>         at
>
> io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:884)
>         at
>
> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
>         at
>
> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
>         at java.lang.Thread.run(Thread.java:748)
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

From mposolda at redhat.com  Tue Nov 20 08:11:55 2018
From: mposolda at redhat.com (Marek Posolda)
Date: Tue, 20 Nov 2018 14:11:55 +0100
Subject: [keycloak-user] OOM at startup with 1 million sessions
In-Reply-To: <CAA9R9O7vyWdVvHaPNYdM0+9E9aPN+eFDvGv2rN60kg_VOXFD+w@mail.gmail.com>
References: <CABS93FQGAHmzfy8FGRUu+ct_PXoAcwuMu4g9c0dM0u0T7fmxXw@mail.gmail.com>
	<CAA9R9O7vyWdVvHaPNYdM0+9E9aPN+eFDvGv2rN60kg_VOXFD+w@mail.gmail.com>
Message-ID: <b6898fab-6a81-15a4-23a0-51301493df2b@redhat.com>

On 20/11/2018 13:42, Sebastian Laskawiec wrote:
> If I'm not mistaken (+William Burns <mailto:wburns at redhat.com>?is an 
> expert here), invoking RemoteCache#size() method requires to pull all 
> entries from the store into the memory. If so, that's why it blows up.
>
> The only way that comes into my mind is to get rid of 
> RemoteCache#size() calls from Keycloak (+Marek Posolda 
> <mailto:mposolda at redhat.com>?WDYT, is it doable?).

Hmm... I think that remoteCache#size doesn't need to load the entries to 
the memory? I see that HotRod protocol has "size" operation and that one 
seem to be called under the covers when you call RemoteCache#size (on 
client side, the Java class is 
org.infinispan.client.hotrod.impl.operations.SizeOperation ).

I am not sure how much memory is needed to have 1 million of user 
sessions. We plan to have some tests for this, but didn't test yet this 
with the cross-dc enabled. Do you have both JDG and Keycloak on same 
machine? Maybe it will help to increase or decrease the value of "Xmx" 
for both JDG and Keycloak. AFAIK if it's too big, it means that garbage 
collectors are not called very often and new records are added to the 
memory and JDK process doesn't have enough space to handle it. But not 
100% sure if that can help.

Marek

>
> I'm just wondering if adding more memory to the ISPN process is an 
> option in your case?
>
> On Tue, Nov 20, 2018 at 11:12 AM Nicolas Ocquidant 
> <nocquidant at gmail.com <mailto:nocquidant at gmail.com>> wrote:
>
>     Hi
>
>     My UC is to keep one year of sessions, this is what I have done to
>     simulate
>     it:
>
>     1. I use JDBC to store 1 million of session objects, 2.8KB (in
>     memory) each
>     2. I start one Infinispan node with passivation=false and
>     shared=true, and
>     Xmx=8G
>     3. I start one Keycloak node configured with a remote-cache and Xmx=4G
>
>     Note that I use a remote-store in KC as it is the only way to set
>     passivation=false and shared=true (see
>     http://lists.jboss.org/pipermail/keycloak-user/2018-November/016180.html).
>
>     No problem in step 2, ISPN process is less than 300MB large in
>     memory. But
>     after 3, ISPN process goes up to around 6GB.
>
>     See below for the traces, but basically I get OOM.
>
>     Using the debugger, I can see that getting the size of the cache is a
>     really slow operation, and bump memory to 3GB in ISPN process.
>
>     From
>     org.keycloak.models.sessions.infinispan.initializer.InfinispanCacheInitializer:
>
>     RemoteCacheSessionsLoader.computeLoaderContext(KeycloakSession
>     session)
>     ? ?// ...
>     ? ? int sessionsTotal = remoteCache.size(); <--- HERE
>     ? ?//...
>     }
>
>     And then (OOM here):
>
>     InfinispanCacheInitializer.startLoadingImpl(InitializerState state,
>     SessionLoader.LoaderContext ctx) {
>     ? // ...
>     ? ?for (Future<WorkerResult> future : futures) {
>     ? ? ?// Called 4X (ie the number of segments), but 1st one does not
>     terminate: OOM
>     ? ? ?// ->
>     org.infinispan.distexec.DefaultExecutorService$LocalDistributedTaskPart
>     ? ? WorkerResult result = future.get(); <--- Very slow and bump
>     mem to 8GB
>     ? ? ?// ...
>     }
>
>     So, with 1M of sessions in store, I cannot get KC/ISPN to start.
>     And I am
>     far from my goal which is to keep one year of sessions (which has been
>     estimated to ~52M of sessions)...
>
>     Is it something I can't achieve with KC/ISPN?
>     Any help appreciated.
>
>     Thanks
>     nick
>
>     Note, versions I used are:
>
>     * ISPN 9.4.1 Wildfly
>     * KC 4.6.0 Wildfly
>
>     -- ISPN process
>
>     10:42:22,969 ERROR [stderr] (Periodic Recovery) Exception in thread
>     "Periodic Recovery" java.lang.OutOfMemoryError: Java heap space
>     10:42:22,977 ERROR [stderr] (Periodic Recovery)? ? ? ? ?at
>     sun.text.resources.fr
>     <http://sun.text.resources.fr>.FormatData_fr.getContents(FormatData_fr.java:86)
>     10:42:22,975 ERROR
>     [org.infinispan.persistence.jdbc.connectionfactory.ManagedConnectionFactory]
>     (pool-9-thread-1) ISPN008018: Sql failure retrieving connection from
>     datasource: java.sql.SQLException: javax.resource.ResourceException:
>     IJ000456: Unchecked throwable in ManagedConnection.getConnection()
>     cl=org.jboss.jca.core.connectionmanager.listener.TxConnectionListener at 3e3890ff[state=NORMAL
>     managed
>     connection=org.jboss.jca.adapters.jdbc.local.LocalManagedConnection at 3f033728
>     connection handles=0 lastReturned=1542706942971
>     lastValidated=1542706738387
>     lastCheckedOut=1542706916019 trackByTx=false
>     pool=org.jboss.jca.core.connectionmanager.pool.strategy.OnePool at 2772dcff
>     mcp=SemaphoreConcurrentLinkedQueueManagedConnectionPool at 5e82b87d[pool=InfinispanDS]
>     xaResource=LocalXAResourceImpl at 308d2c98[connectionListener=3e3890ff
>     connectionManager=1691f7d6 warned=false currentXid=null
>     productName=PostgreSQL productVersion=10.5
>     jndiName=java:jboss/datasources/InfinispanDS] txSync=null]
>     ? ? ? ? at
>     org.jboss.jca.adapters.jdbc.WrapperDataSource.getConnection(WrapperDataSource.java:146)
>     ? ? ? ? at
>     org.jboss.as.connector.subsystems.datasources.WildFlyDataSource.getConnection(WildFlyDataSource.java:64)
>     ? ? ? ? at
>     org.infinispan.persistence.jdbc.connectionfactory.ManagedConnectionFactory.getConnection(ManagedConnectionFactory.java:83)
>     ? ? ? ? at
>     org.infinispan.persistence.jdbc.stringbased.JdbcStringBasedStore.purge(JdbcStringBasedStore.java:461)
>     ? ? ? ? at
>     org.infinispan.persistence.manager.PersistenceManagerImpl.lambda$purgeExpired$6(PersistenceManagerImpl.java:459)
>     ? ? ? ? at java.util.ArrayList.forEach(ArrayList.java:1257)
>     ? ? ? ? at
>     org.infinispan.persistence.manager.PersistenceManagerImpl.purgeExpired(PersistenceManagerImpl.java:462)
>     ? ? ? ? at
>     org.infinispan.expiration.impl.ClusterExpirationManager.processExpiration(ClusterExpirationManager.java:119)
>     ? ? ? ? at
>     org.infinispan.expiration.impl.ExpirationManagerImpl$ScheduledTask.run(ExpirationManagerImpl.java:245)
>     ? ? ? ? at
>     java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
>     ? ? ? ? at
>     java.util.concurrent.FutureTask.runAndReset(FutureTask.java:308)
>     ? ? ? ? at
>     java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$301(ScheduledThreadPoolExecutor.java:180)
>     ? ? ? ? at
>     java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:294)
>     ? ? ? ? at
>     java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
>     ? ? ? ? at
>     java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
>     ? ? ? ? at java.lang.Thread.run(Thread.java:748)
>     Caused by: javax.resource.ResourceException: IJ000456: Unchecked
>     throwable
>     in ManagedConnection.getConnection()
>     cl=org.jboss.jca.core.connectionmanager.listener.TxConnectionListener at 3e3890ff[state=NORMAL
>     managed
>     connection=org.jboss.jca.adapters.jdbc.local.LocalManagedConnection at 3f033728
>     connection handles=0 lastReturned=1542706942971
>     lastValidated=1542706738387
>     lastCheckedOut=1542706916019 trackByTx=false
>     pool=org.jboss.jca.core.connectionmanager.pool.strategy.OnePool at 2772dcff
>     mcp=SemaphoreConcurrentLinkedQueueManagedConnectionPool at 5e82b87d[pool=InfinispanDS]
>     xaResource=LocalXAResourceImpl at 308d2c98[connectionListener=3e3890ff
>     connectionManager=1691f7d6 warned=false currentXid=null
>     productName=PostgreSQL productVersion=10.5
>     jndiName=java:jboss/datasources/InfinispanDS] txSync=null]
>     ? ? ? ? at
>     org.jboss.jca.core.connectionmanager.AbstractConnectionManager.allocateConnection(AbstractConnectionManager.java:811)
>     ? ? ? ? at
>     org.jboss.jca.adapters.jdbc.WrapperDataSource.getConnection(WrapperDataSource.java:138)
>     ? ? ? ? ... 15 more
>     Caused by: java.lang.OutOfMemoryError: Java heap space
>
>
>     -- KC process
>
>     10:42:23,216 WARN [org.infinispan.client.hotrod.impl.protocol.Codec21]
>     (Thread-0) ISPN004005: Error received from the server:
>     java.lang.RuntimeException: java.sql.SQLException: Error
>
>     java.sql.SQLException: Error
>     java.lang.OutOfMemoryError: Java heap space
>     10:42:23,359 WARN
>     [org.keycloak.models.sessions.infinispan.remotestore.RemoteCacheSessionsLoader]
>     (pool-16-thread-4) Error loading sessions from remote cache
>     'sessions' for
>     segment '3':
>     org.infinispan.client.hotrod.exceptions.HotRodClientException:Request
>     for
>     messageId=55 returned server error (status=0x85):
>     java.lang.RuntimeException: java.sql.SQLException: Error
>     java.sql.SQLException: Error
>     java.lang.OutOfMemoryError: Java heap space
>     ? ? ? ? at
>     org.infinispan.client.hotrod.impl.protocol.Codec20.checkForErrorsInResponseStatus(Codec20.java:333)
>     ? ? ? ? at
>     org.infinispan.client.hotrod.impl.protocol.Codec20.readHeader(Codec20.java:179)
>     ? ? ? ? at
>     org.infinispan.client.hotrod.impl.transport.netty.HeaderDecoder.decode(HeaderDecoder.java:138)
>     ? ? ? ? at
>     org.infinispan.client.hotrod.impl.transport.netty.HintedReplayingDecoder.callDecode(HintedReplayingDecoder.java:98)
>     ? ? ? ? at
>     io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:265)
>     ? ? ? ? at
>     io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362)
>     ? ? ? ? at
>     io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348)
>     ? ? ? ? at
>     io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340)
>     ? ? ? ? at
>     io.netty.handler.timeout.IdleStateHandler.channelRead(IdleStateHandler.java:286)
>     ? ? ? ? at
>     io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362)
>     ? ? ? ? at
>     io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348)
>     ? ? ? ? at
>     io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340)
>     ? ? ? ? at
>     io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1434)
>     ? ? ? ? at
>     io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362)
>     ? ? ? ? at
>     io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348)
>     ? ? ? ? at
>     io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:965)
>     ? ? ? ? at
>     io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:163)
>     ? ? ? ? at
>     io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:647)
>     ? ? ? ? at
>     io.netty.channel.nio.NioEventLoop.processSelectedKeysOptimized(NioEventLoop.java:582)
>     ? ? ? ? at
>     io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:499)
>     ? ? ? ? at
>     io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:461)
>     ? ? ? ? at
>     io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:884)
>     ? ? ? ? at
>     java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
>     ? ? ? ? at
>     java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
>     ? ? ? ? at java.lang.Thread.run(Thread.java:748)
>     _______________________________________________
>     keycloak-user mailing list
>     keycloak-user at lists.jboss.org <mailto:keycloak-user at lists.jboss.org>
>     https://lists.jboss.org/mailman/listinfo/keycloak-user
>


From chapani at protonmail.com  Tue Nov 20 08:27:58 2018
From: chapani at protonmail.com (chapani)
Date: Tue, 20 Nov 2018 13:27:58 +0000
Subject: [keycloak-user] how to get a token in js webapp for bearer-only
	backend api client
Message-ID: <95vk969vP7l6RZk3M-aDsc-GFmOTK15dymTcMmoR2zk7q9wWDoGIAgu8BOTKL7K33IsWCIATlFZ7YQe7MHkl3miLbTGhKqKKNK_GWSI5xVg=@protonmail.com>

Hi,

I got this setup for my app:

1. Keycloak server
2. Keycloak-protected nodejs backend (bearer-only)
3. PHP/Reactjs frontend

The frontend is optionally login-protected. For some users it will be required to login which will redirect the user to Keycloak server. After a user is logged in, the frontend will have a bearer token to make api calls to the keycloak-protected backend.

My problem is how to get a bearer token for users that don't need to be logged in (anonymous users).

I tried this approach:

1. Created "confidential" client to be used by PHP.
2. Frontend PHP gets a bearer token using client_id and client_secret and passes them to javascript (by that I mean, printing out token values inside <script> tag which is a global variable)
3. Initially, the frontend makes successful api calls because the access_token passed by php is fresh/valid.
4. After the access_token is expired, I will need to fetch a new one using refresh_token.
5. But, for that I need client_secret which is not available in the js app (and it's not recommended to save client_secret and password in js app, as you know).

I'm stuck here. I researched, read a lot of documentation, but failed to find a way to achieve that.

One other idea that crossed my mind was to make the bearer access_token long-lived; 6 hours, for instance. But, some users may use the app for more than that.

What options do I have?

Sent with [ProtonMail](https://protonmail.com) Secure Email.

From nocquidant at gmail.com  Tue Nov 20 08:41:58 2018
From: nocquidant at gmail.com (Nicolas Ocquidant)
Date: Tue, 20 Nov 2018 14:41:58 +0100
Subject: [keycloak-user] OOM at startup with 1 million sessions
In-Reply-To: <b6898fab-6a81-15a4-23a0-51301493df2b@redhat.com>
References: <CABS93FQGAHmzfy8FGRUu+ct_PXoAcwuMu4g9c0dM0u0T7fmxXw@mail.gmail.com>
	<CAA9R9O7vyWdVvHaPNYdM0+9E9aPN+eFDvGv2rN60kg_VOXFD+w@mail.gmail.com>
	<b6898fab-6a81-15a4-23a0-51301493df2b@redhat.com>
Message-ID: <CABS93FSJwkHcsv6wH4WLwR=b=0RHEFLOmOEckWaT6H4ZOsdbQg@mail.gmail.com>

Actually, the OOM does not come right after remoteCache#size, and maybe it
consumes up to 3GB because I have enough heap space (my laptop has 16GB
RAM)...

HeapDumpOnOutOfMemory from the ISPN process shows that the heap is full of
byte[3][] objects (4 threads):
https://gist.github.com/nocquidant/4e84eb8d704b56221a9865cb63951734

According to me, OOM occurs in the following method (KC side), when getting
from the future:

    protected void startLoadingImpl(InitializerState state,
SessionLoader.LoaderContext ctx) {
        // Assume each worker has same processor's count
        int processors = Runtime.getRuntime().availableProcessors();

        ExecutorService localExecutor = Executors.newCachedThreadPool();
        Transport transport = workCache.getCacheManager().getTransport();
        boolean distributed = transport != null;
        ExecutorService executorService = distributed ? new
DefaultExecutorService(workCache, localExecutor) : localExecutor;

        int errors = 0;

        try {
            while (!state.isFinished()) {
                int nodesCount = transport==null ? 1 :
transport.getMembers().size();
                int distributedWorkersCount = processors * nodesCount;

                log.debugf("Starting next iteration with %d workers",
distributedWorkersCount);

                List<Integer> segments =
state.getUnfinishedSegments(distributedWorkersCount);

                if (log.isTraceEnabled()) {
                    log.trace("unfinished segments for this iteration: " +
segments);
                }

                List<Future<WorkerResult>> futures = new LinkedList<>();
                for (Integer segment : segments) {
                    SessionInitializerWorker worker = new
SessionInitializerWorker();
                    worker.setWorkerEnvironment(segment, ctx,
sessionLoader);
                    if (!distributed) {
                        worker.setEnvironment(workCache, null);
                    }

                    Future<WorkerResult> future =
executorService.submit(worker);
                    futures.add(future);
                }

                for (Future<WorkerResult> future : futures) {
                    try {
                        WorkerResult result = future.get(); <--- HERE

                        if (result.getSuccess()) {
                            int computedSegment = result.getSegment();
                            state.markSegmentFinished(computedSegment);
                        } else {
                            if (log.isTraceEnabled()) {
                                log.tracef("Segment %d failed to compute",
result.getSegment());
                            }
                        }
                    } catch (InterruptedException ie) {
                        errors++;
                        log.error("Interruped exception when computed
future. Errors: " + errors, ie);
                    } catch (ExecutionException ee) {
                        errors++;
                        log.error("ExecutionException when computed future.
Errors: " + errors, ee);
                    }
                }

                if (errors >= maxErrors) {
                    throw new RuntimeException("Maximum count of worker
errors occured. Limit was " + maxErrors + ". See server.log for details");
                }

                saveStateToCache(state);

                log.debugf("New initializer state pushed. The state is:
%s", state);
            }

            // Loader callback after the task is finished
            this.sessionLoader.afterAllSessionsLoaded(this);

        } finally {
            if (distributed) {
                executorService.shutdown();
            }
            localExecutor.shutdown();
        }
    }




Le mar. 20 nov. 2018 ? 14:11, Marek Posolda <mposolda at redhat.com> a ?crit :

> On 20/11/2018 13:42, Sebastian Laskawiec wrote:
>
> If I'm not mistaken (+William Burns <wburns at redhat.com> is an expert
> here), invoking RemoteCache#size() method requires to pull all entries from
> the store into the memory. If so, that's why it blows up.
>
> The only way that comes into my mind is to get rid of RemoteCache#size()
> calls from Keycloak (+Marek Posolda <mposolda at redhat.com> WDYT, is it
> doable?).
>
> Hmm... I think that remoteCache#size doesn't need to load the entries to
> the memory? I see that HotRod protocol has "size" operation and that one
> seem to be called under the covers when you call RemoteCache#size (on
> client side, the Java class is
> org.infinispan.client.hotrod.impl.operations.SizeOperation ).
>
> I am not sure how much memory is needed to have 1 million of user
> sessions. We plan to have some tests for this, but didn't test yet this
> with the cross-dc enabled. Do you have both JDG and Keycloak on same
> machine? Maybe it will help to increase or decrease the value of "Xmx" for
> both JDG and Keycloak. AFAIK if it's too big, it means that garbage
> collectors are not called very often and new records are added to the
> memory and JDK process doesn't have enough space to handle it. But not 100%
> sure if that can help.
>
> Marek
>
>
> I'm just wondering if adding more memory to the ISPN process is an option
> in your case?
>
> On Tue, Nov 20, 2018 at 11:12 AM Nicolas Ocquidant <nocquidant at gmail.com>
> wrote:
>
>> Hi
>>
>> My UC is to keep one year of sessions, this is what I have done to
>> simulate
>> it:
>>
>> 1. I use JDBC to store 1 million of session objects, 2.8KB (in memory)
>> each
>> 2. I start one Infinispan node with passivation=false and shared=true, and
>> Xmx=8G
>> 3. I start one Keycloak node configured with a remote-cache and Xmx=4G
>>
>> Note that I use a remote-store in KC as it is the only way to set
>> passivation=false and shared=true (see
>> http://lists.jboss.org/pipermail/keycloak-user/2018-November/016180.html
>> ).
>>
>> No problem in step 2, ISPN process is less than 300MB large in memory. But
>> after 3, ISPN process goes up to around 6GB.
>>
>> See below for the traces, but basically I get OOM.
>>
>> Using the debugger, I can see that getting the size of the cache is a
>> really slow operation, and bump memory to 3GB in ISPN process.
>>
>> From
>>
>> org.keycloak.models.sessions.infinispan.initializer.InfinispanCacheInitializer:
>>
>> RemoteCacheSessionsLoader.computeLoaderContext(KeycloakSession session)
>>    // ...
>>     int sessionsTotal = remoteCache.size(); <--- HERE
>>    //...
>> }
>>
>> And then (OOM here):
>>
>> InfinispanCacheInitializer.startLoadingImpl(InitializerState state,
>> SessionLoader.LoaderContext ctx) {
>>   // ...
>>    for (Future<WorkerResult> future : futures) {
>>      // Called 4X (ie the number of segments), but 1st one does not
>> terminate: OOM
>>      // ->
>> org.infinispan.distexec.DefaultExecutorService$LocalDistributedTaskPart
>>     WorkerResult result = future.get(); <--- Very slow and bump mem to 8GB
>>      // ...
>> }
>>
>> So, with 1M of sessions in store, I cannot get KC/ISPN to start. And I am
>> far from my goal which is to keep one year of sessions (which has been
>> estimated to ~52M of sessions)...
>>
>> Is it something I can't achieve with KC/ISPN?
>> Any help appreciated.
>>
>> Thanks
>> nick
>>
>> Note, versions I used are:
>>
>> * ISPN 9.4.1 Wildfly
>> * KC 4.6.0 Wildfly
>>
>> -- ISPN process
>>
>> 10:42:22,969 ERROR [stderr] (Periodic Recovery) Exception in thread
>> "Periodic Recovery" java.lang.OutOfMemoryError: Java heap space
>> 10:42:22,977 ERROR [stderr] (Periodic Recovery)         at
>> sun.text.resources.fr.FormatData_fr.getContents(FormatData_fr.java:86)
>> 10:42:22,975 ERROR
>>
>> [org.infinispan.persistence.jdbc.connectionfactory.ManagedConnectionFactory]
>> (pool-9-thread-1) ISPN008018: Sql failure retrieving connection from
>> datasource: java.sql.SQLException: javax.resource.ResourceException:
>> IJ000456: Unchecked throwable in ManagedConnection.getConnection()
>>
>> cl=org.jboss.jca.core.connectionmanager.listener.TxConnectionListener at 3e3890ff
>> [state=NORMAL
>> managed
>>
>> connection=org.jboss.jca.adapters.jdbc.local.LocalManagedConnection at 3f033728
>> connection handles=0 lastReturned=1542706942971
>> lastValidated=1542706738387
>> lastCheckedOut=1542706916019 trackByTx=false
>> pool=org.jboss.jca.core.connectionmanager.pool.strategy.OnePool at 2772dcff
>> mcp=SemaphoreConcurrentLinkedQueueManagedConnectionPool at 5e82b87d
>> [pool=InfinispanDS]
>> xaResource=LocalXAResourceImpl at 308d2c98[connectionListener=3e3890ff
>> connectionManager=1691f7d6 warned=false currentXid=null
>> productName=PostgreSQL productVersion=10.5
>> jndiName=java:jboss/datasources/InfinispanDS] txSync=null]
>>         at
>>
>> org.jboss.jca.adapters.jdbc.WrapperDataSource.getConnection(WrapperDataSource.java:146)
>>         at
>>
>> org.jboss.as.connector.subsystems.datasources.WildFlyDataSource.getConnection(WildFlyDataSource.java:64)
>>         at
>>
>> org.infinispan.persistence.jdbc.connectionfactory.ManagedConnectionFactory.getConnection(ManagedConnectionFactory.java:83)
>>         at
>>
>> org.infinispan.persistence.jdbc.stringbased.JdbcStringBasedStore.purge(JdbcStringBasedStore.java:461)
>>         at
>>
>> org.infinispan.persistence.manager.PersistenceManagerImpl.lambda$purgeExpired$6(PersistenceManagerImpl.java:459)
>>         at java.util.ArrayList.forEach(ArrayList.java:1257)
>>         at
>>
>> org.infinispan.persistence.manager.PersistenceManagerImpl.purgeExpired(PersistenceManagerImpl.java:462)
>>         at
>>
>> org.infinispan.expiration.impl.ClusterExpirationManager.processExpiration(ClusterExpirationManager.java:119)
>>         at
>>
>> org.infinispan.expiration.impl.ExpirationManagerImpl$ScheduledTask.run(ExpirationManagerImpl.java:245)
>>         at
>> java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
>>         at
>> java.util.concurrent.FutureTask.runAndReset(FutureTask.java:308)
>>         at
>>
>> java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$301(ScheduledThreadPoolExecutor.java:180)
>>         at
>>
>> java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:294)
>>         at
>>
>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
>>         at
>>
>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
>>         at java.lang.Thread.run(Thread.java:748)
>> Caused by: javax.resource.ResourceException: IJ000456: Unchecked throwable
>> in ManagedConnection.getConnection()
>>
>> cl=org.jboss.jca.core.connectionmanager.listener.TxConnectionListener at 3e3890ff
>> [state=NORMAL
>> managed
>>
>> connection=org.jboss.jca.adapters.jdbc.local.LocalManagedConnection at 3f033728
>> connection handles=0 lastReturned=1542706942971
>> lastValidated=1542706738387
>> lastCheckedOut=1542706916019 trackByTx=false
>> pool=org.jboss.jca.core.connectionmanager.pool.strategy.OnePool at 2772dcff
>> mcp=SemaphoreConcurrentLinkedQueueManagedConnectionPool at 5e82b87d
>> [pool=InfinispanDS]
>> xaResource=LocalXAResourceImpl at 308d2c98[connectionListener=3e3890ff
>> connectionManager=1691f7d6 warned=false currentXid=null
>> productName=PostgreSQL productVersion=10.5
>> jndiName=java:jboss/datasources/InfinispanDS] txSync=null]
>>         at
>>
>> org.jboss.jca.core.connectionmanager.AbstractConnectionManager.allocateConnection(AbstractConnectionManager.java:811)
>>         at
>>
>> org.jboss.jca.adapters.jdbc.WrapperDataSource.getConnection(WrapperDataSource.java:138)
>>         ... 15 more
>> Caused by: java.lang.OutOfMemoryError: Java heap space
>>
>>
>> -- KC process
>>
>> 10:42:23,216 WARN  [org.infinispan.client.hotrod.impl.protocol.Codec21]
>> (Thread-0) ISPN004005: Error received from the server:
>> java.lang.RuntimeException: java.sql.SQLException: Error
>>
>> java.sql.SQLException: Error
>> java.lang.OutOfMemoryError: Java heap space
>> 10:42:23,359 WARN
>>
>> [org.keycloak.models.sessions.infinispan.remotestore.RemoteCacheSessionsLoader]
>> (pool-16-thread-4) Error loading sessions from remote cache 'sessions' for
>> segment '3':
>> org.infinispan.client.hotrod.exceptions.HotRodClientException:Request for
>> messageId=55 returned server error (status=0x85):
>> java.lang.RuntimeException: java.sql.SQLException: Error
>> java.sql.SQLException: Error
>> java.lang.OutOfMemoryError: Java heap space
>>         at
>>
>> org.infinispan.client.hotrod.impl.protocol.Codec20.checkForErrorsInResponseStatus(Codec20.java:333)
>>         at
>>
>> org.infinispan.client.hotrod.impl.protocol.Codec20.readHeader(Codec20.java:179)
>>         at
>>
>> org.infinispan.client.hotrod.impl.transport.netty.HeaderDecoder.decode(HeaderDecoder.java:138)
>>         at
>>
>> org.infinispan.client.hotrod.impl.transport.netty.HintedReplayingDecoder.callDecode(HintedReplayingDecoder.java:98)
>>         at
>>
>> io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:265)
>>         at
>>
>> io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362)
>>         at
>>
>> io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348)
>>         at
>>
>> io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340)
>>         at
>>
>> io.netty.handler.timeout.IdleStateHandler.channelRead(IdleStateHandler.java:286)
>>         at
>>
>> io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362)
>>         at
>>
>> io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348)
>>         at
>>
>> io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340)
>>         at
>>
>> io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1434)
>>         at
>>
>> io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362)
>>         at
>>
>> io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348)
>>         at
>>
>> io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:965)
>>         at
>>
>> io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:163)
>>         at
>>
>> io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:647)
>>         at
>>
>> io.netty.channel.nio.NioEventLoop.processSelectedKeysOptimized(NioEventLoop.java:582)
>>         at
>>
>> io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:499)
>>         at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:461)
>>         at
>>
>> io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:884)
>>         at
>>
>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
>>         at
>>
>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
>>         at java.lang.Thread.run(Thread.java:748)
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>
>

From danielfr at cern.ch  Tue Nov 20 09:38:08 2018
From: danielfr at cern.ch (Daniel Fernandez Rodriguez)
Date: Tue, 20 Nov 2018 15:38:08 +0100
Subject: [keycloak-user] NullPointerException in PolicyResourceService.java
 token-exchange permissions
Message-ID: <ab161830-6c95-c0a6-d6a3-8d367a406625@cern.ch>

Hi All,

I've been using policies and token-exchange permissions extensively for 
some of my clients for a while now.

All worked as expected but since a few weeks ago I'm experiencing some 
errors when trying to delete old policies, add new ones or create new 
token-exchange permission. From the WebUI I always get the same generic 
error saying:

*> Error!* An unexpected server error has occurred

Checking the server logs it seems there is uncaught NullPointerException 
in PolicyResourceService.java. (stack trace when attempting to create 
new policy)

Nov 20 14:27:36 keycloak-dev-01.cern.ch launch.sh[17095]: 14:27:36,328 
DEBUG [org.hibernate.internal.util.EntityPrinter] (default task-7) 
*org.keycloak.authorization.jpa.entities.PolicyEntity*{owner=null, 
resourceServer=org.keycloak.authorization.jpa.entities.ResourceServerEntity#7fd6467c-9f95-4cbd-90b2-3586ba308dda, 
name=deleteme, description=null, resources=[], 
id=c6a35294-3031-4674-bcfc-3957ca4af846, logic=0, scopes=[], 
associatedPolicies=[], type=client, config=[], decisionStrategy=1}
Nov 20 14:27:36 keycloak-dev-01.cern.ch launch.sh[17095]: 14:27:36,328 
DEBUG [org.hibernate.internal.util.EntityPrinter] (default task-7) 
org.keycloak.authorization.jpa.entities.ResourceServerEntity{id=7fd6467c-9f95-4cbd-90b2-3586ba308dda, 
allowRemoteResourceManagement=false, policyEnforcementMode=0}
Nov 20 14:27:36 keycloak-dev-01.cern.ch launch.sh[17095]: 14:27:36,328 
DEBUG [org.hibernate.SQL] (default task-7)
Nov 20 14:27:36 keycloak-dev-01.cern.ch launch.sh[17095]: select
Nov 20 14:27:36 keycloak-dev-01.cern.ch launch.sh[17095]: 
cliententi0_.ID as col_0_0_
Nov 20 14:27:36 keycloak-dev-01.cern.ch launch.sh[17095]: from
Nov 20 14:27:36 keycloak-dev-01.cern.ch launch.sh[17095]: CLIENT 
cliententi0_
Nov 20 14:27:36 keycloak-dev-01.cern.ch launch.sh[17095]: where
Nov 20 14:27:36 keycloak-dev-01.cern.ch launch.sh[17095]: 
cliententi0_.CLIENT_ID=?
Nov 20 14:27:36 keycloak-dev-01.cern.ch launch.sh[17095]: and 
cliententi0_.REALM_ID=?
Nov 20 14:27:36 keycloak-dev-01.cern.ch launch.sh[17095]: 14:27:36,330 
DEBUG 
[org.hibernate.resource.jdbc.internal.LogicalConnectionManagedImpl] 
(default task-7) Initiating JDBC connection release from afterStatement
Nov 20 14:27:36 keycloak-dev-01.cern.ch launch.sh[17095]: 14:27:36,333 
ERROR [org.keycloak.services.error.KeycloakErrorHandler] (default 
task-7) *Uncaught server error: java.lang.NullPointerException*
Nov 20 14:27:36 keycloak-dev-01.cern.ch launch.sh[17095]: at 
*org.keycloak.authorization.admin.PolicyService.audit(PolicyService.java:334)*
Nov 20 14:27:36 keycloak-dev-01.cern.ch launch.sh[17095]: at 
org.keycloak.authorization.admin.PolicyService.create(PolicyService.java:124)
Nov 20 14:27:36 keycloak-dev-01.cern.ch launch.sh[17095]: at 
sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
Nov 20 14:27:36 keycloak-dev-01.cern.ch launch.sh[17095]: at 
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
Nov 20 14:27:36 keycloak-dev-01.cern.ch launch.sh[17095]: at 
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
Nov 20 14:27:36 keycloak-dev-01.cern.ch launch.sh[17095]: at 
java.lang.reflect.Method.invoke(Method.java:498)

Is there something I can do to fix it? Since these errors appeared the 
service became pretty unresponsive giving me a lot of errors (exporting 
clients does not work anymore and many other small things)

I'm using keycloak 4.5.0Final with an external mysql database.

Thanks a lot for your help,

Daniel.




From willyvic17 at gmail.com  Tue Nov 20 09:47:44 2018
From: willyvic17 at gmail.com (William Nankap)
Date: Tue, 20 Nov 2018 15:47:44 +0100
Subject: [keycloak-user] Fwd: Deploy keycloak to Kubernetes Cluster on GCP
In-Reply-To: <1542655764.15835.6.camel@acutus.pro>
References: <CAFmsN6z6vhFqWRqNhpRp9K10vxXGkKoLG2_84nROu9K3u8oVuw@mail.gmail.com>
	<1542654686.15835.1.camel@acutus.pro>
	<1542655764.15835.6.camel@acutus.pro>
Message-ID: <CAFmsN6wkRy9-S+gWnj3p2M0gPbNABrpFSvatVF1W8qm8TujuoA@mail.gmail.com>

Hello Dimitry, thanks for your answer.

P.S. Probably THE article on how to enable HTTPS on management interface:
http://www.mastertheboss.com/jboss-server/jboss-security/securing-access-to-jboss-wildfly-management-console

1- Thanks


On Mon, 2018-11-19 at 22:11 +0300, Dmitry Telegin wrote:
> Hello William, answers inline,
>
> On Sun, 2018-11-18 at 02:11 +0100, William Nankap wrote:
> > Hi every one,
> >
> > when i deploy docker keycloak4.5.0.Final to kubernetes cluster on GCP i
can
> > normaly access to keycloak interface via the extern ip address on port
> > 8080. But i can't access to the WILDFLY Management Interface on port
9990.
>
> This is because by default Keycloak/Wildfly opens management ports (9990
and 9993) on the local IP only (127.0.0.1). To override this, you can
append the following to the command line of your image:
>
> -bmanagement=0.0.0.0
>
> This will bind management interface to all the IPs on the host. However,
you shouldn't access your plain HTTP management interface (9990) from the
external IP, but rather use HTTPS on port 9993. Google "Wildfly management
https" for how to configure it.
>
> Alternatively, you can use reverse proxy / load balancer to terminate SSL.
>
    1- How can i add this command  *-bmanagement=0.0.0.0* on my docker
image ? a link for help please

 2- i can access the standalone.xml but i can't modify. to access this i
run early the command
             *kubectl exec -it [PODNAME] /bin/bash*
          that open  *[**jboss at podname]$ cd
keycloak/standalone/configuration*
          how can i modify the standalone.xml?

3-  after deployed my keycloak docker on my cluster, i expose that by
create a service which is loadbalancer. i open port 80 that read keycloak
interface, but when i open port 9990 i get error connexion refused


> > My questions:
> >
> > 1/ What are the recommandation to use keycloak in production?
> >      a/ Install keycloak server side an wildfly server to use it
correctly?
> >      b/ Install only the keycloak server. How can i manage deployment
for
> > an app if i can't access to the wildfly management interface? Is it
> > imperativ to access it?
>
> You mean - should you install separate Keycloak and application server
instances, or is it possible to deploy WARs right into Keycloak? The answer
to the second question is yes in theory, but in practice this is not
recommended by many reasons.
>
> Your typical setup would include Keycloak as an identity and
authentication server, and another app server (Wildfly, Tomcat, Jetty etc.)
to host your actual applications that you want secured by Keycloak.
>
> >
> > 2/ Need you more details on my deployment to help me? If yes, which?
> >
> > 3/ How can i get the wildfly management interface on my GCP deployment
to
> > deploy my app?
>
> Please see above. Alternatively, you can use jboss-cli tool in the
container which operates locally and doesn't require external IP.
>
> Finally, you can deploy applications by simply dropping them into the
standalone/deployments directory.
>

1- i can't paste a file on this directory. may be i don't the good method.
can you help me?


> > 4/ Have you suggestions for me, the best way to use keycloak in
production?
> > Some support?
>
> Everything depends on your particular problem. The bare minimum is that
you should have a "real" DBMS (PostgreSQL, MySQL etc.) and not an embedded
one.
>
> >
> > I will be very thankful for your answer.
> >
> > Kindest regards...
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From thesofiane at gmail.com  Tue Nov 20 09:50:30 2018
From: thesofiane at gmail.com (So Be)
Date: Tue, 20 Nov 2018 15:50:30 +0100
Subject: [keycloak-user] Logging not working properly
Message-ID: <CACz=5k=yTybjn1KMJrLFobTV_u2MFwV3tfkHSfQK=72hLrAYfQ@mail.gmail.com>

I see this in keycloak log:

LogManager error of type FORMAT_FAILURE: Formatting error
java.util.IllegalFormatConversionException: d != java.util.UUID

...

Anyone knows the cause of this issue?

Sofiane.

From wburns at redhat.com  Tue Nov 20 10:33:02 2018
From: wburns at redhat.com (William Burns)
Date: Tue, 20 Nov 2018 10:33:02 -0500 (EST)
Subject: [keycloak-user] OOM at startup with 1 million sessions
In-Reply-To: <CABS93FSJwkHcsv6wH4WLwR=b=0RHEFLOmOEckWaT6H4ZOsdbQg@mail.gmail.com>
References: <CABS93FQGAHmzfy8FGRUu+ct_PXoAcwuMu4g9c0dM0u0T7fmxXw@mail.gmail.com>
	<CAA9R9O7vyWdVvHaPNYdM0+9E9aPN+eFDvGv2rN60kg_VOXFD+w@mail.gmail.com>
	<b6898fab-6a81-15a4-23a0-51301493df2b@redhat.com>
	<CABS93FSJwkHcsv6wH4WLwR=b=0RHEFLOmOEckWaT6H4ZOsdbQg@mail.gmail.com>
Message-ID: <1015169332.70327608.1542727982870.JavaMail.zimbra@redhat.com>



----- Original Message -----
> From: "Nicolas Ocquidant" <nocquidant at gmail.com>
> To: mposolda at redhat.com
> Cc: slaskawi at redhat.com, wburns at redhat.com, keycloak-user at lists.jboss.org
> Sent: Tuesday, November 20, 2018 8:41:58 AM
> Subject: Re: [keycloak-user] OOM at startup with 1 million sessions
> 
> Actually, the OOM does not come right after remoteCache#size, and maybe it
> consumes up to 3GB because I have enough heap space (my laptop has 16GB
> RAM)...
> 
> HeapDumpOnOutOfMemory from the ISPN process shows that the heap is full of
> byte[3][] objects (4 threads):
> https://gist.github.com/nocquidant/4e84eb8d704b56221a9865cb63951734

Okay, I did some digging and it looks like the fetch size is ignored when running the select against postgres. The cause is postgres doesn't do paging unless auto-commit is disabled on the connection [1]. This is causing all the entries to be in memory at once. This will be fixed in [2].

Also a side note for keycloak, I would recommend adding some backpressure support at [3] - if the puts are too slow you could end up with a large amount of entries in memory at the same time.

[1] https://jdbc.postgresql.org/documentation/83/query.html#query-with-cursor
[2] https://issues.jboss.org/browse/ISPN-9752
[3] https://github.com/keycloak/keycloak/blob/4.6.0.Final/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/remotestore/RemoteCacheSessionsLoader.java#L111

> 
> According to me, OOM occurs in the following method (KC side), when getting
> from the future:
> 
>     protected void startLoadingImpl(InitializerState state,
> SessionLoader.LoaderContext ctx) {
>         // Assume each worker has same processor's count
>         int processors = Runtime.getRuntime().availableProcessors();
> 
>         ExecutorService localExecutor = Executors.newCachedThreadPool();
>         Transport transport = workCache.getCacheManager().getTransport();
>         boolean distributed = transport != null;
>         ExecutorService executorService = distributed ? new
> DefaultExecutorService(workCache, localExecutor) : localExecutor;
> 
>         int errors = 0;
> 
>         try {
>             while (!state.isFinished()) {
>                 int nodesCount = transport==null ? 1 :
> transport.getMembers().size();
>                 int distributedWorkersCount = processors * nodesCount;
> 
>                 log.debugf("Starting next iteration with %d workers",
> distributedWorkersCount);
> 
>                 List<Integer> segments =
> state.getUnfinishedSegments(distributedWorkersCount);
> 
>                 if (log.isTraceEnabled()) {
>                     log.trace("unfinished segments for this iteration: " +
> segments);
>                 }
> 
>                 List<Future<WorkerResult>> futures = new LinkedList<>();
>                 for (Integer segment : segments) {
>                     SessionInitializerWorker worker = new
> SessionInitializerWorker();
>                     worker.setWorkerEnvironment(segment, ctx,
> sessionLoader);
>                     if (!distributed) {
>                         worker.setEnvironment(workCache, null);
>                     }
> 
>                     Future<WorkerResult> future =
> executorService.submit(worker);
>                     futures.add(future);
>                 }
> 
>                 for (Future<WorkerResult> future : futures) {
>                     try {
>                         WorkerResult result = future.get(); <--- HERE
> 
>                         if (result.getSuccess()) {
>                             int computedSegment = result.getSegment();
>                             state.markSegmentFinished(computedSegment);
>                         } else {
>                             if (log.isTraceEnabled()) {
>                                 log.tracef("Segment %d failed to compute",
> result.getSegment());
>                             }
>                         }
>                     } catch (InterruptedException ie) {
>                         errors++;
>                         log.error("Interruped exception when computed
> future. Errors: " + errors, ie);
>                     } catch (ExecutionException ee) {
>                         errors++;
>                         log.error("ExecutionException when computed future.
> Errors: " + errors, ee);
>                     }
>                 }
> 
>                 if (errors >= maxErrors) {
>                     throw new RuntimeException("Maximum count of worker
> errors occured. Limit was " + maxErrors + ". See server.log for details");
>                 }
> 
>                 saveStateToCache(state);
> 
>                 log.debugf("New initializer state pushed. The state is:
> %s", state);
>             }
> 
>             // Loader callback after the task is finished
>             this.sessionLoader.afterAllSessionsLoaded(this);
> 
>         } finally {
>             if (distributed) {
>                 executorService.shutdown();
>             }
>             localExecutor.shutdown();
>         }
>     }
> 
> 
> 
> 
> Le mar. 20 nov. 2018 ? 14:11, Marek Posolda <mposolda at redhat.com> a ?crit :
> 
> > On 20/11/2018 13:42, Sebastian Laskawiec wrote:
> >
> > If I'm not mistaken (+William Burns <wburns at redhat.com> is an expert
> > here), invoking RemoteCache#size() method requires to pull all entries from
> > the store into the memory. If so, that's why it blows up.

To confirm Infinispan iteration only pulls a batch at a time. In 9.4 we are using rxjava2 Publisher which batches 128 entries at a time. Unfortunately, the fetch size on the JDBC connection alone was not enough to have the JDBC driver batch though :P

> >
> > The only way that comes into my mind is to get rid of RemoteCache#size()
> > calls from Keycloak (+Marek Posolda <mposolda at redhat.com> WDYT, is it
> > doable?).
> >
> > Hmm... I think that remoteCache#size doesn't need to load the entries to
> > the memory? I see that HotRod protocol has "size" operation and that one
> > seem to be called under the covers when you call RemoteCache#size (on
> > client side, the Java class is
> > org.infinispan.client.hotrod.impl.operations.SizeOperation ).
> >
> > I am not sure how much memory is needed to have 1 million of user
> > sessions. We plan to have some tests for this, but didn't test yet this
> > with the cross-dc enabled. Do you have both JDG and Keycloak on same
> > machine? Maybe it will help to increase or decrease the value of "Xmx" for
> > both JDG and Keycloak. AFAIK if it's too big, it means that garbage
> > collectors are not called very often and new records are added to the
> > memory and JDK process doesn't have enough space to handle it. But not 100%
> > sure if that can help.
> >
> > Marek
> >
> >
> > I'm just wondering if adding more memory to the ISPN process is an option
> > in your case?
> >
> > On Tue, Nov 20, 2018 at 11:12 AM Nicolas Ocquidant <nocquidant at gmail.com>
> > wrote:
> >
> >> Hi
> >>
> >> My UC is to keep one year of sessions, this is what I have done to
> >> simulate
> >> it:
> >>
> >> 1. I use JDBC to store 1 million of session objects, 2.8KB (in memory)
> >> each
> >> 2. I start one Infinispan node with passivation=false and shared=true, and
> >> Xmx=8G
> >> 3. I start one Keycloak node configured with a remote-cache and Xmx=4G
> >>
> >> Note that I use a remote-store in KC as it is the only way to set
> >> passivation=false and shared=true (see
> >> http://lists.jboss.org/pipermail/keycloak-user/2018-November/016180.html
> >> ).
> >>
> >> No problem in step 2, ISPN process is less than 300MB large in memory. But
> >> after 3, ISPN process goes up to around 6GB.
> >>
> >> See below for the traces, but basically I get OOM.
> >>
> >> Using the debugger, I can see that getting the size of the cache is a
> >> really slow operation, and bump memory to 3GB in ISPN process.
> >>
> >> From
> >>
> >> org.keycloak.models.sessions.infinispan.initializer.InfinispanCacheInitializer:
> >>
> >> RemoteCacheSessionsLoader.computeLoaderContext(KeycloakSession session)
> >>    // ...
> >>     int sessionsTotal = remoteCache.size(); <--- HERE
> >>    //...
> >> }
> >>
> >> And then (OOM here):
> >>
> >> InfinispanCacheInitializer.startLoadingImpl(InitializerState state,
> >> SessionLoader.LoaderContext ctx) {
> >>   // ...
> >>    for (Future<WorkerResult> future : futures) {
> >>      // Called 4X (ie the number of segments), but 1st one does not
> >> terminate: OOM
> >>      // ->
> >> org.infinispan.distexec.DefaultExecutorService$LocalDistributedTaskPart
> >>     WorkerResult result = future.get(); <--- Very slow and bump mem to 8GB
> >>      // ...
> >> }
> >>
> >> So, with 1M of sessions in store, I cannot get KC/ISPN to start. And I am
> >> far from my goal which is to keep one year of sessions (which has been
> >> estimated to ~52M of sessions)...
> >>
> >> Is it something I can't achieve with KC/ISPN?
> >> Any help appreciated.
> >>
> >> Thanks
> >> nick
> >>
> >> Note, versions I used are:
> >>
> >> * ISPN 9.4.1 Wildfly
> >> * KC 4.6.0 Wildfly
> >>
> >> -- ISPN process
> >>
> >> 10:42:22,969 ERROR [stderr] (Periodic Recovery) Exception in thread
> >> "Periodic Recovery" java.lang.OutOfMemoryError: Java heap space
> >> 10:42:22,977 ERROR [stderr] (Periodic Recovery)         at
> >> sun.text.resources.fr.FormatData_fr.getContents(FormatData_fr.java:86)
> >> 10:42:22,975 ERROR
> >>
> >> [org.infinispan.persistence.jdbc.connectionfactory.ManagedConnectionFactory]
> >> (pool-9-thread-1) ISPN008018: Sql failure retrieving connection from
> >> datasource: java.sql.SQLException: javax.resource.ResourceException:
> >> IJ000456: Unchecked throwable in ManagedConnection.getConnection()
> >>
> >> cl=org.jboss.jca.core.connectionmanager.listener.TxConnectionListener at 3e3890ff
> >> [state=NORMAL
> >> managed
> >>
> >> connection=org.jboss.jca.adapters.jdbc.local.LocalManagedConnection at 3f033728
> >> connection handles=0 lastReturned=1542706942971
> >> lastValidated=1542706738387
> >> lastCheckedOut=1542706916019 trackByTx=false
> >> pool=org.jboss.jca.core.connectionmanager.pool.strategy.OnePool at 2772dcff
> >> mcp=SemaphoreConcurrentLinkedQueueManagedConnectionPool at 5e82b87d
> >> [pool=InfinispanDS]
> >> xaResource=LocalXAResourceImpl at 308d2c98[connectionListener=3e3890ff
> >> connectionManager=1691f7d6 warned=false currentXid=null
> >> productName=PostgreSQL productVersion=10.5
> >> jndiName=java:jboss/datasources/InfinispanDS] txSync=null]
> >>         at
> >>
> >> org.jboss.jca.adapters.jdbc.WrapperDataSource.getConnection(WrapperDataSource.java:146)
> >>         at
> >>
> >> org.jboss.as.connector.subsystems.datasources.WildFlyDataSource.getConnection(WildFlyDataSource.java:64)
> >>         at
> >>
> >> org.infinispan.persistence.jdbc.connectionfactory.ManagedConnectionFactory.getConnection(ManagedConnectionFactory.java:83)
> >>         at
> >>
> >> org.infinispan.persistence.jdbc.stringbased.JdbcStringBasedStore.purge(JdbcStringBasedStore.java:461)
> >>         at
> >>
> >> org.infinispan.persistence.manager.PersistenceManagerImpl.lambda$purgeExpired$6(PersistenceManagerImpl.java:459)
> >>         at java.util.ArrayList.forEach(ArrayList.java:1257)
> >>         at
> >>
> >> org.infinispan.persistence.manager.PersistenceManagerImpl.purgeExpired(PersistenceManagerImpl.java:462)
> >>         at
> >>
> >> org.infinispan.expiration.impl.ClusterExpirationManager.processExpiration(ClusterExpirationManager.java:119)
> >>         at
> >>
> >> org.infinispan.expiration.impl.ExpirationManagerImpl$ScheduledTask.run(ExpirationManagerImpl.java:245)
> >>         at
> >> java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
> >>         at
> >> java.util.concurrent.FutureTask.runAndReset(FutureTask.java:308)
> >>         at
> >>
> >> java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$301(ScheduledThreadPoolExecutor.java:180)
> >>         at
> >>
> >> java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:294)
> >>         at
> >>
> >> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
> >>         at
> >>
> >> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
> >>         at java.lang.Thread.run(Thread.java:748)
> >> Caused by: javax.resource.ResourceException: IJ000456: Unchecked throwable
> >> in ManagedConnection.getConnection()
> >>
> >> cl=org.jboss.jca.core.connectionmanager.listener.TxConnectionListener at 3e3890ff
> >> [state=NORMAL
> >> managed
> >>
> >> connection=org.jboss.jca.adapters.jdbc.local.LocalManagedConnection at 3f033728
> >> connection handles=0 lastReturned=1542706942971
> >> lastValidated=1542706738387
> >> lastCheckedOut=1542706916019 trackByTx=false
> >> pool=org.jboss.jca.core.connectionmanager.pool.strategy.OnePool at 2772dcff
> >> mcp=SemaphoreConcurrentLinkedQueueManagedConnectionPool at 5e82b87d
> >> [pool=InfinispanDS]
> >> xaResource=LocalXAResourceImpl at 308d2c98[connectionListener=3e3890ff
> >> connectionManager=1691f7d6 warned=false currentXid=null
> >> productName=PostgreSQL productVersion=10.5
> >> jndiName=java:jboss/datasources/InfinispanDS] txSync=null]
> >>         at
> >>
> >> org.jboss.jca.core.connectionmanager.AbstractConnectionManager.allocateConnection(AbstractConnectionManager.java:811)
> >>         at
> >>
> >> org.jboss.jca.adapters.jdbc.WrapperDataSource.getConnection(WrapperDataSource.java:138)
> >>         ... 15 more
> >> Caused by: java.lang.OutOfMemoryError: Java heap space
> >>
> >>
> >> -- KC process
> >>
> >> 10:42:23,216 WARN  [org.infinispan.client.hotrod.impl.protocol.Codec21]
> >> (Thread-0) ISPN004005: Error received from the server:
> >> java.lang.RuntimeException: java.sql.SQLException: Error
> >>
> >> java.sql.SQLException: Error
> >> java.lang.OutOfMemoryError: Java heap space
> >> 10:42:23,359 WARN
> >>
> >> [org.keycloak.models.sessions.infinispan.remotestore.RemoteCacheSessionsLoader]
> >> (pool-16-thread-4) Error loading sessions from remote cache 'sessions' for
> >> segment '3':
> >> org.infinispan.client.hotrod.exceptions.HotRodClientException:Request for
> >> messageId=55 returned server error (status=0x85):
> >> java.lang.RuntimeException: java.sql.SQLException: Error
> >> java.sql.SQLException: Error
> >> java.lang.OutOfMemoryError: Java heap space
> >>         at
> >>
> >> org.infinispan.client.hotrod.impl.protocol.Codec20.checkForErrorsInResponseStatus(Codec20.java:333)
> >>         at
> >>
> >> org.infinispan.client.hotrod.impl.protocol.Codec20.readHeader(Codec20.java:179)
> >>         at
> >>
> >> org.infinispan.client.hotrod.impl.transport.netty.HeaderDecoder.decode(HeaderDecoder.java:138)
> >>         at
> >>
> >> org.infinispan.client.hotrod.impl.transport.netty.HintedReplayingDecoder.callDecode(HintedReplayingDecoder.java:98)
> >>         at
> >>
> >> io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:265)
> >>         at
> >>
> >> io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362)
> >>         at
> >>
> >> io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348)
> >>         at
> >>
> >> io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340)
> >>         at
> >>
> >> io.netty.handler.timeout.IdleStateHandler.channelRead(IdleStateHandler.java:286)
> >>         at
> >>
> >> io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362)
> >>         at
> >>
> >> io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348)
> >>         at
> >>
> >> io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340)
> >>         at
> >>
> >> io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1434)
> >>         at
> >>
> >> io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362)
> >>         at
> >>
> >> io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348)
> >>         at
> >>
> >> io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:965)
> >>         at
> >>
> >> io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:163)
> >>         at
> >>
> >> io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:647)
> >>         at
> >>
> >> io.netty.channel.nio.NioEventLoop.processSelectedKeysOptimized(NioEventLoop.java:582)
> >>         at
> >>
> >> io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:499)
> >>         at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:461)
> >>         at
> >>
> >> io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:884)
> >>         at
> >>
> >> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
> >>         at
> >>
> >> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
> >>         at java.lang.Thread.run(Thread.java:748)
> >> _______________________________________________
> >> keycloak-user mailing list
> >> keycloak-user at lists.jboss.org
> >> https://lists.jboss.org/mailman/listinfo/keycloak-user
> >>
> >
> >
> 


From deruere.julien at gmail.com  Tue Nov 20 10:43:57 2018
From: deruere.julien at gmail.com (Julien Deruere)
Date: Tue, 20 Nov 2018 10:43:57 -0500
Subject: [keycloak-user]  Requires uma_protection scope
Message-ID: <CAOPHCg_qifS4Bmywnn05v_TuoKbxmLVVhwr+XAfhK=mQZnak8A@mail.gmail.com>

Any update on this?
I got the exact same message when using POSTMAN :

I fist do this (with grant_type=client_credentials):
http://localhost:8080/auth/realms/sg2b/protocol/openid-connect/token

And then this with the token I received:
GET
http://localhost:8080/auth/realms/sg2b/authz/protection/resource_set?type=zone
Which answer me this:
{
    "error": "invalid_scope",
    "error_description": "Requires uma_protection scope."
}

From psilva at redhat.com  Tue Nov 20 10:48:29 2018
From: psilva at redhat.com (Pedro Igor Silva)
Date: Tue, 20 Nov 2018 13:48:29 -0200
Subject: [keycloak-user] NullPointerException in
 PolicyResourceService.java token-exchange permissions
In-Reply-To: <ab161830-6c95-c0a6-d6a3-8d367a406625@cern.ch>
References: <ab161830-6c95-c0a6-d6a3-8d367a406625@cern.ch>
Message-ID: <CAJrcDBceAwVAbNCFmOXQ4+VFhv92RjkELQTgihHHe07sEOSG4A@mail.gmail.com>

It should be fixed in 4.6.0.Final. The issue is related to admin events
being enabled and causing that NPE. Please, try to upgrade or disable admin
events (if possible).

On Tue, Nov 20, 2018 at 12:41 PM Daniel Fernandez Rodriguez <
danielfr at cern.ch> wrote:

> Hi All,
>
> I've been using policies and token-exchange permissions extensively for
> some of my clients for a while now.
>
> All worked as expected but since a few weeks ago I'm experiencing some
> errors when trying to delete old policies, add new ones or create new
> token-exchange permission. From the WebUI I always get the same generic
> error saying:
>
> *> Error!* An unexpected server error has occurred
>
> Checking the server logs it seems there is uncaught NullPointerException
> in PolicyResourceService.java. (stack trace when attempting to create
> new policy)
>
> Nov 20 14:27:36 keycloak-dev-01.cern.ch launch.sh[17095]: 14:27:36,328
> DEBUG [org.hibernate.internal.util.EntityPrinter] (default task-7)
> *org.keycloak.authorization.jpa.entities.PolicyEntity*{owner=null,
> resourceServer=org.keycloak.authorization.jpa.entities.ResourceServerEntity#7fd6467c-9f95-4cbd-90b2-3586ba308dda,
>
> name=deleteme, description=null, resources=[],
> id=c6a35294-3031-4674-bcfc-3957ca4af846, logic=0, scopes=[],
> associatedPolicies=[], type=client, config=[], decisionStrategy=1}
> Nov 20 14:27:36 keycloak-dev-01.cern.ch launch.sh[17095]: 14:27:36,328
> DEBUG [org.hibernate.internal.util.EntityPrinter] (default task-7)
> org.keycloak.authorization.jpa.entities.ResourceServerEntity{id=7fd6467c-9f95-4cbd-90b2-3586ba308dda,
>
> allowRemoteResourceManagement=false, policyEnforcementMode=0}
> Nov 20 14:27:36 keycloak-dev-01.cern.ch launch.sh[17095]: 14:27:36,328
> DEBUG [org.hibernate.SQL] (default task-7)
> Nov 20 14:27:36 keycloak-dev-01.cern.ch launch.sh[17095]: select
> Nov 20 14:27:36 keycloak-dev-01.cern.ch launch.sh[17095]:
> cliententi0_.ID as col_0_0_
> Nov 20 14:27:36 keycloak-dev-01.cern.ch launch.sh[17095]: from
> Nov 20 14:27:36 keycloak-dev-01.cern.ch launch.sh[17095]: CLIENT
> cliententi0_
> Nov 20 14:27:36 keycloak-dev-01.cern.ch launch.sh[17095]: where
> Nov 20 14:27:36 keycloak-dev-01.cern.ch launch.sh[17095]:
> cliententi0_.CLIENT_ID=?
> Nov 20 14:27:36 keycloak-dev-01.cern.ch launch.sh[17095]: and
> cliententi0_.REALM_ID=?
> Nov 20 14:27:36 keycloak-dev-01.cern.ch launch.sh[17095]: 14:27:36,330
> DEBUG
> [org.hibernate.resource.jdbc.internal.LogicalConnectionManagedImpl]
> (default task-7) Initiating JDBC connection release from afterStatement
> Nov 20 14:27:36 keycloak-dev-01.cern.ch launch.sh[17095]: 14:27:36,333
> ERROR [org.keycloak.services.error.KeycloakErrorHandler] (default
> task-7) *Uncaught server error: java.lang.NullPointerException*
> Nov 20 14:27:36 keycloak-dev-01.cern.ch launch.sh[17095]: at
>
> *org.keycloak.authorization.admin.PolicyService.audit(PolicyService.java:334)*
> Nov 20 14:27:36 keycloak-dev-01.cern.ch launch.sh[17095]: at
>
> org.keycloak.authorization.admin.PolicyService.create(PolicyService.java:124)
> Nov 20 14:27:36 keycloak-dev-01.cern.ch launch.sh[17095]: at
> sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
> Nov 20 14:27:36 keycloak-dev-01.cern.ch launch.sh[17095]: at
>
> sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
> Nov 20 14:27:36 keycloak-dev-01.cern.ch launch.sh[17095]: at
>
> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
> Nov 20 14:27:36 keycloak-dev-01.cern.ch launch.sh[17095]: at
> java.lang.reflect.Method.invoke(Method.java:498)
>
> Is there something I can do to fix it? Since these errors appeared the
> service became pretty unresponsive giving me a lot of errors (exporting
> clients does not work anymore and many other small things)
>
> I'm using keycloak 4.5.0Final with an external mysql database.
>
> Thanks a lot for your help,
>
> Daniel.
>
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

From psilva at redhat.com  Tue Nov 20 10:54:20 2018
From: psilva at redhat.com (Pedro Igor Silva)
Date: Tue, 20 Nov 2018 13:54:20 -0200
Subject: [keycloak-user] Requires uma_protection scope
In-Reply-To: <CAOPHCg_qifS4Bmywnn05v_TuoKbxmLVVhwr+XAfhK=mQZnak8A@mail.gmail.com>
References: <CAOPHCg_qifS4Bmywnn05v_TuoKbxmLVVhwr+XAfhK=mQZnak8A@mail.gmail.com>
Message-ID: <CAJrcDBfRaj1g0nJR6kiNu9E0KhfaTiQy=V0niz-X-k2aaO4_5A@mail.gmail.com>

Hi,

You need to grant uma_protection client scope (it should be available as
one of the roles associated with your resource server) to the user to which
you are issuing tokens for.

On Tue, Nov 20, 2018 at 1:52 PM Julien Deruere <deruere.julien at gmail.com>
wrote:

> Any update on this?
> I got the exact same message when using POSTMAN :
>
> I fist do this (with grant_type=client_credentials):
> http://localhost:8080/auth/realms/sg2b/protocol/openid-connect/token
>
> And then this with the token I received:
> GET
>
> http://localhost:8080/auth/realms/sg2b/authz/protection/resource_set?type=zone
> Which answer me this:
> {
>     "error": "invalid_scope",
>     "error_description": "Requires uma_protection scope."
> }
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

From deruere.julien at gmail.com  Tue Nov 20 11:01:13 2018
From: deruere.julien at gmail.com (Julien Deruere)
Date: Tue, 20 Nov 2018 11:01:13 -0500
Subject: [keycloak-user] Requires uma_protection scope
In-Reply-To: <CAJrcDBfRaj1g0nJR6kiNu9E0KhfaTiQy=V0niz-X-k2aaO4_5A@mail.gmail.com>
References: <CAOPHCg_qifS4Bmywnn05v_TuoKbxmLVVhwr+XAfhK=mQZnak8A@mail.gmail.com>
	<CAJrcDBfRaj1g0nJR6kiNu9E0KhfaTiQy=V0niz-X-k2aaO4_5A@mail.gmail.com>
Message-ID: <CAOPHCg8fss_TT+R9BU0TRSA_N0EFjdcauco==aGSwqQ7G+T-bQ@mail.gmail.com>

In this case I'm using protection API:

curl -X POST \
    -H "Content-Type: application/x-www-form-urlencoded" \
    -d 'grant_type=client_credentials&client_id=${client_id}&client_secret=${client_secret}'
\
    "http://localhost:8080/auth/realms/${realm_name}/protocol/openid-connect/token"


I'm asking a token as a client, not as a user. And I checked, my client has
the uma_protection role in Service Account Role.

I don't know where I'm wrong?

Le mar. 20 nov. 2018 10:54, Pedro Igor Silva <psilva at redhat.com> a ?crit :

> Hi,
>
> You need to grant uma_protection client scope (it should be available as
> one of the roles associated with your resource server) to the user to which
> you are issuing tokens for.
>
> On Tue, Nov 20, 2018 at 1:52 PM Julien Deruere <deruere.julien at gmail.com>
> wrote:
>
>> Any update on this?
>> I got the exact same message when using POSTMAN :
>>
>> I fist do this (with grant_type=client_credentials):
>> http://localhost:8080/auth/realms/sg2b/protocol/openid-connect/token
>>
>> And then this with the token I received:
>> GET
>>
>> http://localhost:8080/auth/realms/sg2b/authz/protection/resource_set?type=zone
>> Which answer me this:
>> {
>>     "error": "invalid_scope",
>>     "error_description": "Requires uma_protection scope."
>> }
>>
> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>

From danielfr at cern.ch  Tue Nov 20 11:19:44 2018
From: danielfr at cern.ch (Daniel Fernandez Rodriguez)
Date: Tue, 20 Nov 2018 17:19:44 +0100
Subject: [keycloak-user] NullPointerException in
 PolicyResourceService.java token-exchange permissions
In-Reply-To: <CAJrcDBceAwVAbNCFmOXQ4+VFhv92RjkELQTgihHHe07sEOSG4A@mail.gmail.com>
References: <ab161830-6c95-c0a6-d6a3-8d367a406625@cern.ch>
	<CAJrcDBceAwVAbNCFmOXQ4+VFhv92RjkELQTgihHHe07sEOSG4A@mail.gmail.com>
Message-ID: <5a41c5f2-4f90-3e6a-1f42-63f7421455e2@cern.ch>

Hi Pedro,

thanks a lot for your answer. I upgraded to 4.6.0.Final and added the 
couple of env variables to enable admin fine grained permissions [*].

I don't see those errors anymore \o/

Thanks again,

Daniel.

[*] 
https://stackoverflow.com/questions/53367566/unable-to-setup-idp-token-exchange-in-keycloak-4-6-0-final

On 20/11/2018 16:48, Pedro Igor Silva wrote:
> It should be fixed in 4.6.0.Final. The issue is related to admin 
> events being enabled and causing that NPE. Please, try to upgrade or 
> disable admin events (if possible).

From marian.petrik at esgroup.ch  Tue Nov 20 11:23:30 2018
From: marian.petrik at esgroup.ch (Marian Petrik)
Date: Tue, 20 Nov 2018 16:23:30 +0000
Subject: [keycloak-user] Saas muti-tenant architecture with multi-step
 authentication process
In-Reply-To: <1532560134.2078.1.camel@acutus.pro>
References: <1532560134.2078.1.camel@acutus.pro>
Message-ID: <3f5f29c4-7e9a-6aad-20ae-9877bc121f5f@esgroup.ch>

Hi Dimitri, Olivier,

We are actually currently looking into the same topic, trying to secure 
our multi-tenant angular based mobile app and implement server side 
realm selection based on user's login (email address).

@Dimitri: Do you know if there is an sample implementation of the 
approach you described?

@Olivier: did you guys proceed with the implementation? Can you share 
the experience?


Best regards,

Marian Petrik




From to_sud at yahoo.com  Tue Nov 20 11:34:48 2018
From: to_sud at yahoo.com (Sud Ramasamy)
Date: Tue, 20 Nov 2018 11:34:48 -0500
Subject: [keycloak-user] Keycloak SAML IdP and URL parameter
In-Reply-To: <1542715483.2146.3.camel@acutus.pro>
References: <etPan.5beed899.50b9905b.11539@yahoo.com>
	<1542657120.15835.9.camel@acutus.pro>
	<etPan.5bf32352.43b06c87.11539@yahoo.com>
	<1542715483.2146.3.camel@acutus.pro>
Message-ID: <etPan.5bf437a8.72555d6f.11539@yahoo.com>

Yes. We register a JAX-RS?ContainerResponseFilter on the SamlService endpoint that does what you said as far as extracting the parameter into the session context. The limitation with this approach is that we cannot scope the filter registration to the specific realm that we want to apply this filter too.?

Instead we have to have code in the filter itself to check the incoming request for whether we need to apply the logic for the realm or not. This isn?t ideal but we don?t see a way around it.

On a slightly different tangent, this triggered us to consider the JS authenticator that you?d suggested. It looks like the JS authenticator approach will work better because it will be scoped to just the realm that we want it.

Thanks for your insight.
-sud ?



On November 20, 2018 at 7:04:48 AM, Dmitry Telegin (dt at acutus.pro) wrote:

Hello Sud,  

On Mon, 2018-11-19 at 15:55 -0500, Sud Ramasamy wrote:  
> Thanks. This is a handy little tip to use the JS Authenticators.  
>  
> We found another way accomplish this using a JAX-RS feature to parse the custom URL parameter out in the first request and stuff it into the context where we could retrieve it from in the second request processing flow. Please let me know if for any reason this is approach is discouraged.  

In fact I?was thinking about something similar, but with servlet filter rather than JAX-RS feature. Your solution seems even better. Do you register a JAX-RS interceptor on SamlService endpoint and push the extracted parameter into a session context?  

Dmitry  

>  
> Regards  
> -sud  
>  
>  
>  
>  
> > On November 19, 2018 at 2:52:05 PM, Dmitry Telegin (dt at acutus.pro) wrote:  
>  
> Hello Sud,??  
>  
> Please check out this thread:??  
> http://lists.jboss.org/pipermail/keycloak-user/2018-November/016228.html??  
>  
> The problem under discussion is almost identical to yours, with the only exception being OIDC instead of SAML. But I believe the general principle (fishing request parameters out of the Referer header) remains the same.??  
>  
> Another question: is it possible to use SAML RelayState to pass the same parameter? Custom authenticators have direct access to that field via client session note with the same name ("RelayState"), which could let you avoid the hacks like above.??  
>  
> Cheers,??  
> Dmitry Telegin??  
> CTO, Acutus s.r.o.??  
> Keycloak Consulting and Training??  
>  
> Pod lipami street 339/52, 130 00 Prague 3, Czech Republic??  
> +42 (022) 888-30-71??  
> > E-mail: info at acutus.pro??  
>  
> On Fri, 2018-11-16 at 09:47 -0500, Sud Ramasamy wrote:??  
> > Hi,??  
> > ?  
> > We are using Keycloak as a SAML IdP and have plugged in a custom authenticator to handle the browser flow. The authenticator relies on a custom URL parameter that is present in the initial SAML Authn request to Keycloak.???  
> > ?  
> > We found that when the Keycloak SAML IdP receives a SAML Authn request (which also contains our custom URL parameter) it exchanges that request with a code and redirects the browser to itself at which point the control reaches our custom authenticator. This redirect causes our custom URL parameter from the initial request to not be available to our custom authenticator. Is there anyway to propagate our custom URL parameter to this second request and thereby have it available to our custom authenticator.??  
> > ?  
> > Thanks in advance for your help.??  
> > ?  
> > Regards??  
> > -sud???  
> > _______________________________________________??  
> > keycloak-user mailing list??  
> > keycloak-user at lists.jboss.org??  
> > https://lists.jboss.org/mailman/listinfo/keycloak-user??  
>  
> _______________________________________________  
> keycloak-user mailing list  
> keycloak-user at lists.jboss.org  
> https://lists.jboss.org/mailman/listinfo/keycloak-user  

From psilva at redhat.com  Tue Nov 20 11:53:18 2018
From: psilva at redhat.com (Pedro Igor Silva)
Date: Tue, 20 Nov 2018 14:53:18 -0200
Subject: [keycloak-user] Requires uma_protection scope
In-Reply-To: <CAOPHCg8fss_TT+R9BU0TRSA_N0EFjdcauco==aGSwqQ7G+T-bQ@mail.gmail.com>
References: <CAOPHCg_qifS4Bmywnn05v_TuoKbxmLVVhwr+XAfhK=mQZnak8A@mail.gmail.com>
	<CAJrcDBfRaj1g0nJR6kiNu9E0KhfaTiQy=V0niz-X-k2aaO4_5A@mail.gmail.com>
	<CAOPHCg8fss_TT+R9BU0TRSA_N0EFjdcauco==aGSwqQ7G+T-bQ@mail.gmail.com>
Message-ID: <CAJrcDBfHnOAnmn66CSHvOOrxyDgY2-qiu31=TZtmZS9GWBFhfw@mail.gmail.com>

This role should be a client role. For instance, if you are trying to
create resources for C1 the service account must be granted with client
role C1/uma-protection. See screenshot attached.

Regards.

On Tue, Nov 20, 2018 at 2:01 PM Julien Deruere <deruere.julien at gmail.com>
wrote:

> In this case I'm using protection API:
>
> curl -X POST \
>     -H "Content-Type: application/x-www-form-urlencoded" \
>     -d 'grant_type=client_credentials&client_id=${client_id}&client_secret=${client_secret}' \
>     "http://localhost:8080/auth/realms/${realm_name}/protocol/openid-connect/token"
>
>
> I'm asking a token as a client, not as a user. And I checked, my client
> has the uma_protection role in Service Account Role.
>
> I don't know where I'm wrong?
>
> Le mar. 20 nov. 2018 10:54, Pedro Igor Silva <psilva at redhat.com> a ?crit :
>
>> Hi,
>>
>> You need to grant uma_protection client scope (it should be available as
>> one of the roles associated with your resource server) to the user to which
>> you are issuing tokens for.
>>
>> On Tue, Nov 20, 2018 at 1:52 PM Julien Deruere <deruere.julien at gmail.com>
>> wrote:
>>
>>> Any update on this?
>>> I got the exact same message when using POSTMAN :
>>>
>>> I fist do this (with grant_type=client_credentials):
>>> http://localhost:8080/auth/realms/sg2b/protocol/openid-connect/token
>>>
>>> And then this with the token I received:
>>> GET
>>>
>>> http://localhost:8080/auth/realms/sg2b/authz/protection/resource_set?type=zone
>>> Which answer me this:
>>> {
>>>     "error": "invalid_scope",
>>>     "error_description": "Requires uma_protection scope."
>>> }
>>>
>> _______________________________________________
>>> keycloak-user mailing list
>>> keycloak-user at lists.jboss.org
>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>
>>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Screenshot from 2018-11-20 14-52-31.png
Type: image/png
Size: 103492 bytes
Desc: not available
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20181120/679146ff/attachment-0001.png 

From deruere.julien at gmail.com  Tue Nov 20 11:55:30 2018
From: deruere.julien at gmail.com (Julien Deruere)
Date: Tue, 20 Nov 2018 11:55:30 -0500
Subject: [keycloak-user] Requires uma_protection scope
In-Reply-To: <CAJrcDBfHnOAnmn66CSHvOOrxyDgY2-qiu31=TZtmZS9GWBFhfw@mail.gmail.com>
References: <CAOPHCg_qifS4Bmywnn05v_TuoKbxmLVVhwr+XAfhK=mQZnak8A@mail.gmail.com>
	<CAJrcDBfRaj1g0nJR6kiNu9E0KhfaTiQy=V0niz-X-k2aaO4_5A@mail.gmail.com>
	<CAOPHCg8fss_TT+R9BU0TRSA_N0EFjdcauco==aGSwqQ7G+T-bQ@mail.gmail.com>
	<CAJrcDBfHnOAnmn66CSHvOOrxyDgY2-qiu31=TZtmZS9GWBFhfw@mail.gmail.com>
Message-ID: <CAOPHCg8WvftbwOd=wc4=krj2g2h1-NvE3oGCnVyoDgx8kfXb1A@mail.gmail.com>

That's exactly what I did/checked. That's why I can't figure out why it's
not working :(

Le mar. 20 nov. 2018 11:53, Pedro Igor Silva <psilva at redhat.com> a ?crit :

> This role should be a client role. For instance, if you are trying to
> create resources for C1 the service account must be granted with client
> role C1/uma-protection. See screenshot attached.
>
> Regards.
>
> On Tue, Nov 20, 2018 at 2:01 PM Julien Deruere <deruere.julien at gmail.com>
> wrote:
>
>> In this case I'm using protection API:
>>
>> curl -X POST \
>>     -H "Content-Type: application/x-www-form-urlencoded" \
>>     -d 'grant_type=client_credentials&client_id=${client_id}&client_secret=${client_secret}' \
>>     "http://localhost:8080/auth/realms/${realm_name}/protocol/openid-connect/token"
>>
>>
>> I'm asking a token as a client, not as a user. And I checked, my client
>> has the uma_protection role in Service Account Role.
>>
>> I don't know where I'm wrong?
>>
>> Le mar. 20 nov. 2018 10:54, Pedro Igor Silva <psilva at redhat.com> a
>> ?crit :
>>
>>> Hi,
>>>
>>> You need to grant uma_protection client scope (it should be available as
>>> one of the roles associated with your resource server) to the user to which
>>> you are issuing tokens for.
>>>
>>> On Tue, Nov 20, 2018 at 1:52 PM Julien Deruere <deruere.julien at gmail.com>
>>> wrote:
>>>
>>>> Any update on this?
>>>> I got the exact same message when using POSTMAN :
>>>>
>>>> I fist do this (with grant_type=client_credentials):
>>>> http://localhost:8080/auth/realms/sg2b/protocol/openid-connect/token
>>>>
>>>> And then this with the token I received:
>>>> GET
>>>>
>>>> http://localhost:8080/auth/realms/sg2b/authz/protection/resource_set?type=zone
>>>> Which answer me this:
>>>> {
>>>>     "error": "invalid_scope",
>>>>     "error_description": "Requires uma_protection scope."
>>>> }
>>>>
>>> _______________________________________________
>>>> keycloak-user mailing list
>>>> keycloak-user at lists.jboss.org
>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>
>>>

From vedavallyabhilash at gmail.com  Tue Nov 20 13:53:43 2018
From: vedavallyabhilash at gmail.com (abhilashreddy abhi)
Date: Tue, 20 Nov 2018 13:53:43 -0500
Subject: [keycloak-user] Keycloak notify admin via ,
 when a new user is registered using keycloak registration page
Message-ID: <CAHr-Nxfsyzc=Pcrrm76hJxQsP+BFEaaZS5b-hTHANjxvrMa=uQ@mail.gmail.com>

Hello,

Is there a way to notify keycloak admin users via email whenever a new user
is registered using keycloak registration page?
I dint see email event listener for Register action.Please guide me to this
feature if it is hidden somewhere in admin console  or if it is not
implemented is it possible to write any custom email event listener for a
new user registration?

Thanks
Abhilash

From geoff at opticks.io  Tue Nov 20 14:22:29 2018
From: geoff at opticks.io (Geoffrey Cleaves)
Date: Tue, 20 Nov 2018 20:22:29 +0100
Subject: [keycloak-user] Requires uma_protection scope
In-Reply-To: <CAOPHCg8WvftbwOd=wc4=krj2g2h1-NvE3oGCnVyoDgx8kfXb1A@mail.gmail.com>
References: <CAOPHCg_qifS4Bmywnn05v_TuoKbxmLVVhwr+XAfhK=mQZnak8A@mail.gmail.com>
	<CAJrcDBfRaj1g0nJR6kiNu9E0KhfaTiQy=V0niz-X-k2aaO4_5A@mail.gmail.com>
	<CAOPHCg8fss_TT+R9BU0TRSA_N0EFjdcauco==aGSwqQ7G+T-bQ@mail.gmail.com>
	<CAJrcDBfHnOAnmn66CSHvOOrxyDgY2-qiu31=TZtmZS9GWBFhfw@mail.gmail.com>
	<CAOPHCg8WvftbwOd=wc4=krj2g2h1-NvE3oGCnVyoDgx8kfXb1A@mail.gmail.com>
Message-ID: <CAHzT=q-qGvat3+dMkrR0AodYx1gNhnz6EA1xcsuNrBD850YBVw@mail.gmail.com>

I understand that the client is supposed to have the role given the Admin
Console settings, but does the token show that role when you introspect it?

On Tue, Nov 20, 2018, 18:02 Julien Deruere <deruere.julien at gmail.com wrote:

> That's exactly what I did/checked. That's why I can't figure out why it's
> not working :(
>
> Le mar. 20 nov. 2018 11:53, Pedro Igor Silva <psilva at redhat.com> a ?crit :
>
> > This role should be a client role. For instance, if you are trying to
> > create resources for C1 the service account must be granted with client
> > role C1/uma-protection. See screenshot attached.
> >
> > Regards.
> >
> > On Tue, Nov 20, 2018 at 2:01 PM Julien Deruere <deruere.julien at gmail.com
> >
> > wrote:
> >
> >> In this case I'm using protection API:
> >>
> >> curl -X POST \
> >>     -H "Content-Type: application/x-www-form-urlencoded" \
> >>     -d
> 'grant_type=client_credentials&client_id=${client_id}&client_secret=${client_secret}'
> \
> >>     "
> http://localhost:8080/auth/realms/${realm_name}/protocol/openid-connect/token
> "
> >>
> >>
> >> I'm asking a token as a client, not as a user. And I checked, my client
> >> has the uma_protection role in Service Account Role.
> >>
> >> I don't know where I'm wrong?
> >>
> >> Le mar. 20 nov. 2018 10:54, Pedro Igor Silva <psilva at redhat.com> a
> >> ?crit :
> >>
> >>> Hi,
> >>>
> >>> You need to grant uma_protection client scope (it should be available
> as
> >>> one of the roles associated with your resource server) to the user to
> which
> >>> you are issuing tokens for.
> >>>
> >>> On Tue, Nov 20, 2018 at 1:52 PM Julien Deruere <
> deruere.julien at gmail.com>
> >>> wrote:
> >>>
> >>>> Any update on this?
> >>>> I got the exact same message when using POSTMAN :
> >>>>
> >>>> I fist do this (with grant_type=client_credentials):
> >>>> http://localhost:8080/auth/realms/sg2b/protocol/openid-connect/token
> >>>>
> >>>> And then this with the token I received:
> >>>> GET
> >>>>
> >>>>
> http://localhost:8080/auth/realms/sg2b/authz/protection/resource_set?type=zone
> >>>> Which answer me this:
> >>>> {
> >>>>     "error": "invalid_scope",
> >>>>     "error_description": "Requires uma_protection scope."
> >>>> }
> >>>>
> >>> _______________________________________________
> >>>> keycloak-user mailing list
> >>>> keycloak-user at lists.jboss.org
> >>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
> >>>>
> >>>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From dt at acutus.pro  Tue Nov 20 14:37:03 2018
From: dt at acutus.pro (Dmitry Telegin)
Date: Tue, 20 Nov 2018 22:37:03 +0300
Subject: [keycloak-user] Keycloak notify admin via ,
 when a new user is registered using keycloak registration page
In-Reply-To: <CAHr-Nxfsyzc=Pcrrm76hJxQsP+BFEaaZS5b-hTHANjxvrMa=uQ@mail.gmail.com>
References: <CAHr-Nxfsyzc=Pcrrm76hJxQsP+BFEaaZS5b-hTHANjxvrMa=uQ@mail.gmail.com>
Message-ID: <1542742623.15719.1.camel@acutus.pro>

Hello Abhilash,

Please check out this thread: http://lists.jboss.org/pipermail/keycloak-user/2018-November/016387.html

There's no built-in functionality, but you can implement this either by extending Keycloak or by using an external log processor like Logstash.

Cheers,
Dmitry Telegin
CTO, Acutus s.r.o.
Keycloak Consulting and Training

Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
+42 (022) 888-30-71
E-mail: info at acutus.pro

On Tue, 2018-11-20 at 13:53 -0500, abhilashreddy abhi wrote:
> Hello,
> 
> Is there a way to notify keycloak admin users via email whenever a new user
> is registered using keycloak registration page?
> I dint see email event listener for Register action.Please guide me to this
> feature if it is hidden somewhere in admin console??or if it is not
> implemented is it possible to write any custom email event listener for a
> new user registration?
> 
> Thanks
> Abhilash
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From mposolda at redhat.com  Tue Nov 20 15:29:25 2018
From: mposolda at redhat.com (Marek Posolda)
Date: Tue, 20 Nov 2018 21:29:25 +0100
Subject: [keycloak-user] OOM at startup with 1 million sessions
In-Reply-To: <1015169332.70327608.1542727982870.JavaMail.zimbra@redhat.com>
References: <CABS93FQGAHmzfy8FGRUu+ct_PXoAcwuMu4g9c0dM0u0T7fmxXw@mail.gmail.com>
	<CAA9R9O7vyWdVvHaPNYdM0+9E9aPN+eFDvGv2rN60kg_VOXFD+w@mail.gmail.com>
	<b6898fab-6a81-15a4-23a0-51301493df2b@redhat.com>
	<CABS93FSJwkHcsv6wH4WLwR=b=0RHEFLOmOEckWaT6H4ZOsdbQg@mail.gmail.com>
	<1015169332.70327608.1542727982870.JavaMail.zimbra@redhat.com>
Message-ID: <a69d7663-ff22-b17f-5d67-cd43bf10d261@redhat.com>

On 20/11/2018 16:33, William Burns wrote:
>
> ----- Original Message -----
>> From: "Nicolas Ocquidant" <nocquidant at gmail.com>
>> To: mposolda at redhat.com
>> Cc: slaskawi at redhat.com, wburns at redhat.com, keycloak-user at lists.jboss.org
>> Sent: Tuesday, November 20, 2018 8:41:58 AM
>> Subject: Re: [keycloak-user] OOM at startup with 1 million sessions
>>
>> Actually, the OOM does not come right after remoteCache#size, and maybe it
>> consumes up to 3GB because I have enough heap space (my laptop has 16GB
>> RAM)...
>>
>> HeapDumpOnOutOfMemory from the ISPN process shows that the heap is full of
>> byte[3][] objects (4 threads):
>> https://gist.github.com/nocquidant/4e84eb8d704b56221a9865cb63951734
> Okay, I did some digging and it looks like the fetch size is ignored when running the select against postgres. The cause is postgres doesn't do paging unless auto-commit is disabled on the connection [1]. This is causing all the entries to be in memory at once. This will be fixed in [2].
>
> Also a side note for keycloak, I would recommend adding some backpressure support at [3] - if the puts are too slow you could end up with a large amount of entries in memory at the same time.
>
> [1] https://jdbc.postgresql.org/documentation/83/query.html#query-with-cursor
> [2] https://issues.jboss.org/browse/ISPN-9752
> [3] https://github.com/keycloak/keycloak/blob/4.6.0.Final/model/infinispan/src/main/java/org/keycloak/models/sessions/infinispan/remotestore/RemoteCacheSessionsLoader.java#L111

Thanks for that point. Maybe we can improve this by calling 
"cache.putAll" instead? It is synchronous operation and should help with 
the "backpressure" and at the same time, it doesn't send big number of 
messages across network. I mean if I have distributed cache with 2 
owners, then calling "cache.putAll" with 100 records won't send 50 
messages across the network to the second cluster node, but instead just 
1 message with 50 records (remaining 50 records will be saved on local 
cluster node and no need to send over the network)?

Another possibility is to remove a need for preloading entirely - this 
can be possible if we have a way to skip saving sessions on KC side at 
all and have them saved just on remote JDG server. Not yet sure if this 
is possible... Looking forward for next week to discuss with you :)

Marek

>
>> According to me, OOM occurs in the following method (KC side), when getting
>> from the future:
>>
>>      protected void startLoadingImpl(InitializerState state,
>> SessionLoader.LoaderContext ctx) {
>>          // Assume each worker has same processor's count
>>          int processors = Runtime.getRuntime().availableProcessors();
>>
>>          ExecutorService localExecutor = Executors.newCachedThreadPool();
>>          Transport transport = workCache.getCacheManager().getTransport();
>>          boolean distributed = transport != null;
>>          ExecutorService executorService = distributed ? new
>> DefaultExecutorService(workCache, localExecutor) : localExecutor;
>>
>>          int errors = 0;
>>
>>          try {
>>              while (!state.isFinished()) {
>>                  int nodesCount = transport==null ? 1 :
>> transport.getMembers().size();
>>                  int distributedWorkersCount = processors * nodesCount;
>>
>>                  log.debugf("Starting next iteration with %d workers",
>> distributedWorkersCount);
>>
>>                  List<Integer> segments =
>> state.getUnfinishedSegments(distributedWorkersCount);
>>
>>                  if (log.isTraceEnabled()) {
>>                      log.trace("unfinished segments for this iteration: " +
>> segments);
>>                  }
>>
>>                  List<Future<WorkerResult>> futures = new LinkedList<>();
>>                  for (Integer segment : segments) {
>>                      SessionInitializerWorker worker = new
>> SessionInitializerWorker();
>>                      worker.setWorkerEnvironment(segment, ctx,
>> sessionLoader);
>>                      if (!distributed) {
>>                          worker.setEnvironment(workCache, null);
>>                      }
>>
>>                      Future<WorkerResult> future =
>> executorService.submit(worker);
>>                      futures.add(future);
>>                  }
>>
>>                  for (Future<WorkerResult> future : futures) {
>>                      try {
>>                          WorkerResult result = future.get(); <--- HERE
>>
>>                          if (result.getSuccess()) {
>>                              int computedSegment = result.getSegment();
>>                              state.markSegmentFinished(computedSegment);
>>                          } else {
>>                              if (log.isTraceEnabled()) {
>>                                  log.tracef("Segment %d failed to compute",
>> result.getSegment());
>>                              }
>>                          }
>>                      } catch (InterruptedException ie) {
>>                          errors++;
>>                          log.error("Interruped exception when computed
>> future. Errors: " + errors, ie);
>>                      } catch (ExecutionException ee) {
>>                          errors++;
>>                          log.error("ExecutionException when computed future.
>> Errors: " + errors, ee);
>>                      }
>>                  }
>>
>>                  if (errors >= maxErrors) {
>>                      throw new RuntimeException("Maximum count of worker
>> errors occured. Limit was " + maxErrors + ". See server.log for details");
>>                  }
>>
>>                  saveStateToCache(state);
>>
>>                  log.debugf("New initializer state pushed. The state is:
>> %s", state);
>>              }
>>
>>              // Loader callback after the task is finished
>>              this.sessionLoader.afterAllSessionsLoaded(this);
>>
>>          } finally {
>>              if (distributed) {
>>                  executorService.shutdown();
>>              }
>>              localExecutor.shutdown();
>>          }
>>      }
>>
>>
>>
>>
>> Le mar. 20 nov. 2018 ? 14:11, Marek Posolda <mposolda at redhat.com> a ?crit :
>>
>>> On 20/11/2018 13:42, Sebastian Laskawiec wrote:
>>>
>>> If I'm not mistaken (+William Burns <wburns at redhat.com> is an expert
>>> here), invoking RemoteCache#size() method requires to pull all entries from
>>> the store into the memory. If so, that's why it blows up.
> To confirm Infinispan iteration only pulls a batch at a time. In 9.4 we are using rxjava2 Publisher which batches 128 entries at a time. Unfortunately, the fetch size on the JDBC connection alone was not enough to have the JDBC driver batch though :P
>
>>> The only way that comes into my mind is to get rid of RemoteCache#size()
>>> calls from Keycloak (+Marek Posolda <mposolda at redhat.com> WDYT, is it
>>> doable?).
>>>
>>> Hmm... I think that remoteCache#size doesn't need to load the entries to
>>> the memory? I see that HotRod protocol has "size" operation and that one
>>> seem to be called under the covers when you call RemoteCache#size (on
>>> client side, the Java class is
>>> org.infinispan.client.hotrod.impl.operations.SizeOperation ).
>>>
>>> I am not sure how much memory is needed to have 1 million of user
>>> sessions. We plan to have some tests for this, but didn't test yet this
>>> with the cross-dc enabled. Do you have both JDG and Keycloak on same
>>> machine? Maybe it will help to increase or decrease the value of "Xmx" for
>>> both JDG and Keycloak. AFAIK if it's too big, it means that garbage
>>> collectors are not called very often and new records are added to the
>>> memory and JDK process doesn't have enough space to handle it. But not 100%
>>> sure if that can help.
>>>
>>> Marek
>>>
>>>
>>> I'm just wondering if adding more memory to the ISPN process is an option
>>> in your case?
>>>
>>> On Tue, Nov 20, 2018 at 11:12 AM Nicolas Ocquidant <nocquidant at gmail.com>
>>> wrote:
>>>
>>>> Hi
>>>>
>>>> My UC is to keep one year of sessions, this is what I have done to
>>>> simulate
>>>> it:
>>>>
>>>> 1. I use JDBC to store 1 million of session objects, 2.8KB (in memory)
>>>> each
>>>> 2. I start one Infinispan node with passivation=false and shared=true, and
>>>> Xmx=8G
>>>> 3. I start one Keycloak node configured with a remote-cache and Xmx=4G
>>>>
>>>> Note that I use a remote-store in KC as it is the only way to set
>>>> passivation=false and shared=true (see
>>>> http://lists.jboss.org/pipermail/keycloak-user/2018-November/016180.html
>>>> ).
>>>>
>>>> No problem in step 2, ISPN process is less than 300MB large in memory. But
>>>> after 3, ISPN process goes up to around 6GB.
>>>>
>>>> See below for the traces, but basically I get OOM.
>>>>
>>>> Using the debugger, I can see that getting the size of the cache is a
>>>> really slow operation, and bump memory to 3GB in ISPN process.
>>>>
>>>> From
>>>>
>>>> org.keycloak.models.sessions.infinispan.initializer.InfinispanCacheInitializer:
>>>>
>>>> RemoteCacheSessionsLoader.computeLoaderContext(KeycloakSession session)
>>>>     // ...
>>>>      int sessionsTotal = remoteCache.size(); <--- HERE
>>>>     //...
>>>> }
>>>>
>>>> And then (OOM here):
>>>>
>>>> InfinispanCacheInitializer.startLoadingImpl(InitializerState state,
>>>> SessionLoader.LoaderContext ctx) {
>>>>    // ...
>>>>     for (Future<WorkerResult> future : futures) {
>>>>       // Called 4X (ie the number of segments), but 1st one does not
>>>> terminate: OOM
>>>>       // ->
>>>> org.infinispan.distexec.DefaultExecutorService$LocalDistributedTaskPart
>>>>      WorkerResult result = future.get(); <--- Very slow and bump mem to 8GB
>>>>       // ...
>>>> }
>>>>
>>>> So, with 1M of sessions in store, I cannot get KC/ISPN to start. And I am
>>>> far from my goal which is to keep one year of sessions (which has been
>>>> estimated to ~52M of sessions)...
>>>>
>>>> Is it something I can't achieve with KC/ISPN?
>>>> Any help appreciated.
>>>>
>>>> Thanks
>>>> nick
>>>>
>>>> Note, versions I used are:
>>>>
>>>> * ISPN 9.4.1 Wildfly
>>>> * KC 4.6.0 Wildfly
>>>>
>>>> -- ISPN process
>>>>
>>>> 10:42:22,969 ERROR [stderr] (Periodic Recovery) Exception in thread
>>>> "Periodic Recovery" java.lang.OutOfMemoryError: Java heap space
>>>> 10:42:22,977 ERROR [stderr] (Periodic Recovery)         at
>>>> sun.text.resources.fr.FormatData_fr.getContents(FormatData_fr.java:86)
>>>> 10:42:22,975 ERROR
>>>>
>>>> [org.infinispan.persistence.jdbc.connectionfactory.ManagedConnectionFactory]
>>>> (pool-9-thread-1) ISPN008018: Sql failure retrieving connection from
>>>> datasource: java.sql.SQLException: javax.resource.ResourceException:
>>>> IJ000456: Unchecked throwable in ManagedConnection.getConnection()
>>>>
>>>> cl=org.jboss.jca.core.connectionmanager.listener.TxConnectionListener at 3e3890ff
>>>> [state=NORMAL
>>>> managed
>>>>
>>>> connection=org.jboss.jca.adapters.jdbc.local.LocalManagedConnection at 3f033728
>>>> connection handles=0 lastReturned=1542706942971
>>>> lastValidated=1542706738387
>>>> lastCheckedOut=1542706916019 trackByTx=false
>>>> pool=org.jboss.jca.core.connectionmanager.pool.strategy.OnePool at 2772dcff
>>>> mcp=SemaphoreConcurrentLinkedQueueManagedConnectionPool at 5e82b87d
>>>> [pool=InfinispanDS]
>>>> xaResource=LocalXAResourceImpl at 308d2c98[connectionListener=3e3890ff
>>>> connectionManager=1691f7d6 warned=false currentXid=null
>>>> productName=PostgreSQL productVersion=10.5
>>>> jndiName=java:jboss/datasources/InfinispanDS] txSync=null]
>>>>          at
>>>>
>>>> org.jboss.jca.adapters.jdbc.WrapperDataSource.getConnection(WrapperDataSource.java:146)
>>>>          at
>>>>
>>>> org.jboss.as.connector.subsystems.datasources.WildFlyDataSource.getConnection(WildFlyDataSource.java:64)
>>>>          at
>>>>
>>>> org.infinispan.persistence.jdbc.connectionfactory.ManagedConnectionFactory.getConnection(ManagedConnectionFactory.java:83)
>>>>          at
>>>>
>>>> org.infinispan.persistence.jdbc.stringbased.JdbcStringBasedStore.purge(JdbcStringBasedStore.java:461)
>>>>          at
>>>>
>>>> org.infinispan.persistence.manager.PersistenceManagerImpl.lambda$purgeExpired$6(PersistenceManagerImpl.java:459)
>>>>          at java.util.ArrayList.forEach(ArrayList.java:1257)
>>>>          at
>>>>
>>>> org.infinispan.persistence.manager.PersistenceManagerImpl.purgeExpired(PersistenceManagerImpl.java:462)
>>>>          at
>>>>
>>>> org.infinispan.expiration.impl.ClusterExpirationManager.processExpiration(ClusterExpirationManager.java:119)
>>>>          at
>>>>
>>>> org.infinispan.expiration.impl.ExpirationManagerImpl$ScheduledTask.run(ExpirationManagerImpl.java:245)
>>>>          at
>>>> java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
>>>>          at
>>>> java.util.concurrent.FutureTask.runAndReset(FutureTask.java:308)
>>>>          at
>>>>
>>>> java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$301(ScheduledThreadPoolExecutor.java:180)
>>>>          at
>>>>
>>>> java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:294)
>>>>          at
>>>>
>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
>>>>          at
>>>>
>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
>>>>          at java.lang.Thread.run(Thread.java:748)
>>>> Caused by: javax.resource.ResourceException: IJ000456: Unchecked throwable
>>>> in ManagedConnection.getConnection()
>>>>
>>>> cl=org.jboss.jca.core.connectionmanager.listener.TxConnectionListener at 3e3890ff
>>>> [state=NORMAL
>>>> managed
>>>>
>>>> connection=org.jboss.jca.adapters.jdbc.local.LocalManagedConnection at 3f033728
>>>> connection handles=0 lastReturned=1542706942971
>>>> lastValidated=1542706738387
>>>> lastCheckedOut=1542706916019 trackByTx=false
>>>> pool=org.jboss.jca.core.connectionmanager.pool.strategy.OnePool at 2772dcff
>>>> mcp=SemaphoreConcurrentLinkedQueueManagedConnectionPool at 5e82b87d
>>>> [pool=InfinispanDS]
>>>> xaResource=LocalXAResourceImpl at 308d2c98[connectionListener=3e3890ff
>>>> connectionManager=1691f7d6 warned=false currentXid=null
>>>> productName=PostgreSQL productVersion=10.5
>>>> jndiName=java:jboss/datasources/InfinispanDS] txSync=null]
>>>>          at
>>>>
>>>> org.jboss.jca.core.connectionmanager.AbstractConnectionManager.allocateConnection(AbstractConnectionManager.java:811)
>>>>          at
>>>>
>>>> org.jboss.jca.adapters.jdbc.WrapperDataSource.getConnection(WrapperDataSource.java:138)
>>>>          ... 15 more
>>>> Caused by: java.lang.OutOfMemoryError: Java heap space
>>>>
>>>>
>>>> -- KC process
>>>>
>>>> 10:42:23,216 WARN  [org.infinispan.client.hotrod.impl.protocol.Codec21]
>>>> (Thread-0) ISPN004005: Error received from the server:
>>>> java.lang.RuntimeException: java.sql.SQLException: Error
>>>>
>>>> java.sql.SQLException: Error
>>>> java.lang.OutOfMemoryError: Java heap space
>>>> 10:42:23,359 WARN
>>>>
>>>> [org.keycloak.models.sessions.infinispan.remotestore.RemoteCacheSessionsLoader]
>>>> (pool-16-thread-4) Error loading sessions from remote cache 'sessions' for
>>>> segment '3':
>>>> org.infinispan.client.hotrod.exceptions.HotRodClientException:Request for
>>>> messageId=55 returned server error (status=0x85):
>>>> java.lang.RuntimeException: java.sql.SQLException: Error
>>>> java.sql.SQLException: Error
>>>> java.lang.OutOfMemoryError: Java heap space
>>>>          at
>>>>
>>>> org.infinispan.client.hotrod.impl.protocol.Codec20.checkForErrorsInResponseStatus(Codec20.java:333)
>>>>          at
>>>>
>>>> org.infinispan.client.hotrod.impl.protocol.Codec20.readHeader(Codec20.java:179)
>>>>          at
>>>>
>>>> org.infinispan.client.hotrod.impl.transport.netty.HeaderDecoder.decode(HeaderDecoder.java:138)
>>>>          at
>>>>
>>>> org.infinispan.client.hotrod.impl.transport.netty.HintedReplayingDecoder.callDecode(HintedReplayingDecoder.java:98)
>>>>          at
>>>>
>>>> io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:265)
>>>>          at
>>>>
>>>> io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362)
>>>>          at
>>>>
>>>> io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348)
>>>>          at
>>>>
>>>> io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340)
>>>>          at
>>>>
>>>> io.netty.handler.timeout.IdleStateHandler.channelRead(IdleStateHandler.java:286)
>>>>          at
>>>>
>>>> io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362)
>>>>          at
>>>>
>>>> io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348)
>>>>          at
>>>>
>>>> io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340)
>>>>          at
>>>>
>>>> io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1434)
>>>>          at
>>>>
>>>> io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362)
>>>>          at
>>>>
>>>> io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348)
>>>>          at
>>>>
>>>> io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:965)
>>>>          at
>>>>
>>>> io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:163)
>>>>          at
>>>>
>>>> io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:647)
>>>>          at
>>>>
>>>> io.netty.channel.nio.NioEventLoop.processSelectedKeysOptimized(NioEventLoop.java:582)
>>>>          at
>>>>
>>>> io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:499)
>>>>          at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:461)
>>>>          at
>>>>
>>>> io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:884)
>>>>          at
>>>>
>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
>>>>          at
>>>>
>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
>>>>          at java.lang.Thread.run(Thread.java:748)
>>>> _______________________________________________
>>>> keycloak-user mailing list
>>>> keycloak-user at lists.jboss.org
>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>
>>>


From willyvic17 at gmail.com  Tue Nov 20 17:12:15 2018
From: willyvic17 at gmail.com (William Nankap)
Date: Tue, 20 Nov 2018 23:12:15 +0100
Subject: [keycloak-user] Deploy keycloak to Kubernetes Cluster on GCP
In-Reply-To: <CAFmsN6wkRy9-S+gWnj3p2M0gPbNABrpFSvatVF1W8qm8TujuoA@mail.gmail.com>
References: <CAFmsN6z6vhFqWRqNhpRp9K10vxXGkKoLG2_84nROu9K3u8oVuw@mail.gmail.com>
	<1542654686.15835.1.camel@acutus.pro>
	<1542655764.15835.6.camel@acutus.pro>
	<CAFmsN6wkRy9-S+gWnj3p2M0gPbNABrpFSvatVF1W8qm8TujuoA@mail.gmail.com>
Message-ID: <CAFmsN6w6wbP7rXfHv4GHpVHKRAwo1uUKHiHtRNuDba49TCsVnA@mail.gmail.com>

hello Dimitry

i had tried the lodbalancer with ingress in kubernetes on google cloud
i can access to keycloak interface but not on the wildfly interface.

i had expose my keycloak deployment on one service with 2 ports 8080 and
9990 on type=Nodeport (as the documentation)
and create 2 ingress service one for the port 8080 and another for 9990
(but can't access to wildfly).

where is my mystake? Can you help me please

Le mar. 20 nov. 2018 ? 15:47, William Nankap <willyvic17 at gmail.com> a
?crit :

> Hello Dimitry, thanks for your answer.
>
> P.S. Probably THE article on how to enable HTTPS on management interface:
>
> http://www.mastertheboss.com/jboss-server/jboss-security/securing-access-to-jboss-wildfly-management-console
>
> 1- Thanks
>
>
> On Mon, 2018-11-19 at 22:11 +0300, Dmitry Telegin wrote:
> > Hello William, answers inline,
> >
> > On Sun, 2018-11-18 at 02:11 +0100, William Nankap wrote:
> > > Hi every one,
> > >
> > > when i deploy docker keycloak4.5.0.Final to kubernetes cluster on GCP
> i can
> > > normaly access to keycloak interface via the extern ip address on port
> > > 8080. But i can't access to the WILDFLY Management Interface on port
> 9990.
> >
> > This is because by default Keycloak/Wildfly opens management ports (9990
> and 9993) on the local IP only (127.0.0.1). To override this, you can
> append the following to the command line of your image:
> >
> > -bmanagement=0.0.0.0
> >
> > This will bind management interface to all the IPs on the host. However,
> you shouldn't access your plain HTTP management interface (9990) from the
> external IP, but rather use HTTPS on port 9993. Google "Wildfly management
> https" for how to configure it.
> >
> > Alternatively, you can use reverse proxy / load balancer to terminate
> SSL.
> >
>     1- How can i add this command  *-bmanagement=0.0.0.0* on my docker
> image ? a link for help please
>
>  2- i can access the standalone.xml but i can't modify. to access this i
> run early the command
>              *kubectl exec -it [PODNAME] /bin/bash*
>           that open  *[**jboss at podname]$ cd
> keycloak/standalone/configuration*
>           how can i modify the standalone.xml?
>
> 3-  after deployed my keycloak docker on my cluster, i expose that by
> create a service which is loadbalancer. i open port 80 that read keycloak
> interface, but when i open port 9990 i get error connexion refused
>
>
> > > My questions:
> > >
> > > 1/ What are the recommandation to use keycloak in production?
> > >      a/ Install keycloak server side an wildfly server to use it
> correctly?
> > >      b/ Install only the keycloak server. How can i manage deployment
> for
> > > an app if i can't access to the wildfly management interface? Is it
> > > imperativ to access it?
> >
> > You mean - should you install separate Keycloak and application server
> instances, or is it possible to deploy WARs right into Keycloak? The answer
> to the second question is yes in theory, but in practice this is not
> recommended by many reasons.
> >
> > Your typical setup would include Keycloak as an identity and
> authentication server, and another app server (Wildfly, Tomcat, Jetty etc.)
> to host your actual applications that you want secured by Keycloak.
> >
> > >
> > > 2/ Need you more details on my deployment to help me? If yes, which?
> > >
> > > 3/ How can i get the wildfly management interface on my GCP deployment
> to
> > > deploy my app?
> >
> > Please see above. Alternatively, you can use jboss-cli tool in the
> container which operates locally and doesn't require external IP.
> >
> > Finally, you can deploy applications by simply dropping them into the
> standalone/deployments directory.
> >
>
> 1- i can't paste a file on this directory. may be i don't the good method.
> can you help me?
>
>
> > > 4/ Have you suggestions for me, the best way to use keycloak in
> production?
> > > Some support?
> >
> > Everything depends on your particular problem. The bare minimum is that
> you should have a "real" DBMS (PostgreSQL, MySQL etc.) and not an embedded
> one.
> >
> > >
> > > I will be very thankful for your answer.
> > >
> > > Kindest regards...
> > > _______________________________________________
> > > keycloak-user mailing list
> > > keycloak-user at lists.jboss.org
> > > https://lists.jboss.org/mailman/listinfo/keycloak-user
> >
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
>

From akozichev at gmail.com  Tue Nov 20 19:01:06 2018
From: akozichev at gmail.com (Andrey Kozichev)
Date: Wed, 21 Nov 2018 00:01:06 +0000
Subject: [keycloak-user] can't use refresh token with keycloak-gatekeeper
Message-ID: <CACzr=FdkidXOJ2DDSbgW_yt_uJ4mPr+z56ARXJVna_-tUARGhQ@mail.gmail.com>

Hello!
has anyone come across use of refresh tokens with keyckloak-gatekeeper?

I've got a Web app running behind keycloak-gatekeeper. Currently session
expires after 5 minutes of inactivity. In the logs I see "session expired
and access token refreshing is disabled".

To avoid this, I am trying to enable "refresh tokens" on my gatekeeper
proxy by adding "*--enable-refresh-tokens=true"* , the full list of
configuration options:


        - --client-id=my_clientid
        - --discovery-url=<keycloak_url>
        - --enable-default-deny=false
        - --enable-json-logging=true
        - --enable-logging=true
        - --enable-request-id=true
        - --enable-encrypted-token=true
        - --encryption-key=<secret>
*        - --enable-refresh-tokens=true*
        - --enable-security-filter=true
        - --listen=0.0.0.0:8080
        - --preserve-host=true
        - --redirection-url=http://my-public-url
        - --resources=uri=/*|roles=user-role
        - --upstream-url=myservice.svc.cluster.local:8080

However after adding "*enable-refresh-tokens=true*" - I get 502 when trying
to login.
In the Gatekeeper logs I see below lines. Has anyone came across this? I
must be missing something obvious.


{"level":"info","ts":1542757702.835068,"msg":"issuing access token for
user","email":"myemail at gmail.com
","expires":"2018-11-20T23:53:22Z","duration":"4m59.164934314s"}

{"level":"info","ts":1542757702.8363702,"msg":"client
request","latency":0.05726285,"status":307,"bytes":37,"client_ip":"
10.44.1.32:60746","method":"GET","path":"/oauth/callback"}

*{"level":"error","ts":1542757702.8891447,"msg":"no session found in
request, redirecting for authorization","error":"authentication session not
found"}*

{"level":"info","ts":1542757702.8892436,"msg":"client
request","latency":0.000152955,"status":307,"bytes":75,"client_ip":"
10.44.1.32:60752","method":"GET","path":"/favicon.ico"}

{"level":"info","ts":1542757703.03116,"msg":"client
request","latency":0.001002773,"status":307,"bytes":319,"client_ip":"
10.44.1.32:60754","method":"GET","path":"/oauth/authorize"}

{"level":"info","ts":1542757703.108161,"msg":"issuing access token for
user","email":"myemail at gmail.com
","expires":"2018-11-20T23:53:23Z","duration":"4m59.891841634s"}

{"level":"info","ts":1542757703.109042,"msg":"client
request","latency":0.021427778,"status":307,"bytes":48,"client_ip":"
10.44.1.32:60758","method":"GET","path":"/oauth/callback"}


Regards,
Andrey

From marco.lamina at sap.com  Tue Nov 20 19:55:23 2018
From: marco.lamina at sap.com (Lamina, Marco)
Date: Wed, 21 Nov 2018 00:55:23 +0000
Subject: [keycloak-user] 4.6.0 Upgrade disables client scopes
Message-ID: <01F89E35-A10A-41BB-8570-73B08353AC62@sap.com>

Hi,
I upgraded to 4.6.0 using the Kubernetes Helm chart. After the upgrade, token exchange stopped working, which I was able to fix thanks to [1]. Unfortunately, none of my client scopes are working anymore. Trying to get a token using client credentials succeeds, but anything I pass into the ?scope? parameter is ignored and none of my default client scopes are applied. The ?scope? claim in the token endpoint response is always empty.
Is that a feature that needs to be enabled similar to the token exchange?

[1] https://stackoverflow.com/questions/53367566/unable-to-setup-idp-token-exchange-in-keycloak-4-6-0-final

Thanks,
Marco


From kkcmadhu at yahoo.com  Tue Nov 20 23:06:31 2018
From: kkcmadhu at yahoo.com (Madhu)
Date: Wed, 21 Nov 2018 04:06:31 +0000 (UTC)
Subject: [keycloak-user] running 2 different keycloak clusters sharing the
 same database ( 1 cluster to create new realms,
 and another for all other access)
References: <488776964.3402283.1542773191546.ref@mail.yahoo.com>
Message-ID: <488776964.3402283.1542773191546@mail.yahoo.com>

Hi,
Have a weird question,? I want to run 2 different keycloak clusters, one for creating realms and another for accessing realms/login and all other activity.
Is this kind of setup possible, have any body tried it before?
The 1st cluster just takes requests for provisioning new realms and any one time setup (like creating the admin user in realm, giving him specific access only etc)
After that, all interactions login, token creating, provisioning further user etc will take place through the other cluster..?
I see that realm creation in my case ( realm has few user groups, client scopes, mappers (java script mapper), other custom mappers, about 10 clients, client specific roles etc) is a cpu intensive process and realm creation when we have about 80 to 100 relams(tenants) takes any where between 20 to 30 sec with cpu usage spiking to 100%.
So, wanted to test if having a separate instance/cluster for realm creation will help and ease the load on other cluster which servers typical login/logout and all other requests. Any insights here will be much appreciated.
- Would like to know if this could corrupt the keycloak schema?- I am ok if the new realms are not eagerly loaded in infispan cache (of the other cluster which handles regular request), but this should start loading the new realm the moment a login request comes ( i am ok for the first few logins to be slow).

RegardsMadhu

From Deepti.Tyagi at halliburton.com  Wed Nov 21 02:28:40 2018
From: Deepti.Tyagi at halliburton.com (Deepti Tyagi)
Date: Wed, 21 Nov 2018 07:28:40 +0000
Subject: [keycloak-user] Keycloak Admin Realm is not upgraded on Keycloak
 upgrade from v3.0 to v4.5
Message-ID: <847A59EDBBC62D43BEE2CFA482C6CB6A648CDD29@NP1EXMB105.corp.halliburton.com>

Hi Team,

I am working on upgrading our in-house Keycloak Server from v3.0 to v4.5. Facing issue on trying to re-use old custom admin realm. Is there any way we can re-use the old admin realm or preserve at least users?

We have another Wildfly 10 application that use Keycloak v3.0 for authentication purpose using a custom admin realm (custom-realm.json) that have multiple clients, roles, users and protocol mappers.

While upgrading keycloak, I had run migration scripts to upgrade standalone, domain.xmls. Postgres DB also gets upgraded and able to login to Keycloak using the same admin user in v3.0.
Though, our Wildfly 10 application isn't able to authenticate with keycloak using that old custom-realm (with new jboss adapters even).
I had to re-create a new custom admin realm, created same clients, roles, users to make it work. And had to trash old realm that deleted all users also.

I also tried multiple workarounds like;
1. Created a new custom-realm on v4.5 and compared with v3.0 on keycloak UI, no visible difference.
2. Partially re-imported new custom realm having same clients and roles. No help.
3. Trashed old realm and imported new custom realm, then tried partially importing old custom realm users. Its not allowed. (KC-SERVICES0037: Error creating user: java.lang.RuntimeException: Unable to find client role mappings for client: ds-data)

With the 3rd attempt, I can see at least keycloak login page on our wildfly 10 application but can not login till I create admin user manually.

With 1st and 2nd attempt, I do not even see keycloak login page on our wildfly 10 application and below exception is thrown in keycloak server.log.

2018-11-20 23:56:30,691 WARN  [org.keycloak.events] (default task-2) type=LOGIN_ERROR, realmId=DecisionSpace_Integration_Server, clientId=dsis-console, userId=null, ipAddress=127.0.0.1, error=invalid_user_credentials, auth_method=openid-connect, auth_type=code, response_type=code, redirect_uri=http://localhost:8080/dsdataserver-console/, code_id=a50ff093-64b8-43d2-a353-2a3ec1346297, response_mode=query
2018-11-20 23:56:30,692 ERROR [org.keycloak.services.error.KeycloakErrorHandler] (default task-2) Uncaught server error: java.lang.NullPointerException
at org.keycloak.theme.ExtendingThemeManager.loadTheme(ExtendingThemeManager.java:117)
at org.keycloak.theme.ExtendingThemeManager.getTheme(ExtendingThemeManager.java:95)
at org.keycloak.theme.DefaultThemeManager.getTheme(DefaultThemeManager.java:26)
at org.keycloak.theme.DefaultThemeManager.getTheme(DefaultThemeManager.java:21)
at org.keycloak.forms.login.freemarker.FreeMarkerLoginFormsProvider.getTheme(FreeMarkerLoginFormsProvider.java:267)
at org.keycloak.forms.login.freemarker.FreeMarkerLoginFormsProvider.createResponse(FreeMarkerLoginFormsProvider.java:160)
at org.keycloak.forms.login.freemarker.FreeMarkerLoginFormsProvider.createErrorPage(FreeMarkerLoginFormsProvider.java:506)
at org.keycloak.services.ErrorPage.error(ErrorPage.java:31)
at org.keycloak.authentication.AuthenticationProcessor.handleBrowserException(AuthenticationProcessor.java:728)
at org.keycloak.protocol.AuthorizationEndpointBase.handleBrowserAuthenticationRequest(AuthorizationEndpointBase.java:143)
at org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint.buildAuthorizationCodeAuthorizationResponse(AuthorizationEndpoint.java:409)
at org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint.process(AuthorizationEndpoint.java:152)
at org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint.buildGet(AuthorizationEndpoint.java:108)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)
at org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java:140)
at org.jboss.resteasy.core.ResourceMethodInvoker.internalInvokeOnTarget(ResourceMethodInvoker.java:510)
at org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTargetAfterFilter(ResourceMethodInvoker.java:401)
at org.jboss.resteasy.core.ResourceMethodInvoker.lambda$invokeOnTarget$0(ResourceMethodInvoker.java:365)
at org.jboss.resteasy.core.interception.PreMatchContainerRequestContext.filter(PreMatchContainerRequestContext.java:361)
at org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTarget(ResourceMethodInvoker.java:367)
at org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:339)
at org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(ResourceLocatorInvoker.java:137)
at org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:106)
at org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(ResourceLocatorInvoker.java:132)
at org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:100)
at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:441)
at org.jboss.resteasy.core.SynchronousDispatcher.lambda$invoke$4(SynchronousDispatcher.java:231)
at org.jboss.resteasy.core.SynchronousDispatcher.lambda$preprocess$0(SynchronousDispatcher.java:137)
at org.jboss.resteasy.core.interception.PreMatchContainerRequestContext.filter(PreMatchContainerRequestContext.java:361)
at org.jboss.resteasy.core.SynchronousDispatcher.preprocess(SynchronousDispatcher.java:140)
at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:217)
at org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:227)
at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56)
at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:790)
at io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:74)
at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129)
at org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:90)
at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61)
at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
at io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84)
at io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62)
at io.undertow.servlet.handlers.ServletChain$1.handleRequest(ServletChain.java:68)
at io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
at org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78)
at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
at io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:132)
at io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57)
at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
at io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)
at io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)
at io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)
at io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77)
at io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50)
at io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)
at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
at org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)
at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
at org.wildfly.extension.undertow.deployment.GlobalRequestControllerHandler.handleRequest(GlobalRequestControllerHandler.java:68)
at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:292)
at io.undertow.servlet.handlers.ServletInitialHandler.access$100(ServletInitialHandler.java:81)
at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:138)
at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:135)
at io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:48)
at io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43)
at org.wildfly.extension.undertow.security.SecurityContextThreadSetupAction.lambda$create$0(SecurityContextThreadSetupAction.java:105)
at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1514)
at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1514)
at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1514)
at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1514)
at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:272)
at io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81)
at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:104)
at io.undertow.server.Connectors.executeRootHandler(Connectors.java:360)
at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:830)
at org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35)
at org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1985)
at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1487)
at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1378)
at java.lang.Thread.run(Thread.java:748)

Thanks,
Deepti

----------------------------------------------------------------------
This e-mail, including any attached files, may contain confidential and privileged information for the sole use of the intended recipient.  Any review, use, distribution, or disclosure by others is strictly prohibited.  If you are not the intended recipient (or authorized to receive information for the intended recipient), please contact the sender by reply e-mail and delete all copies of this message.

From ashutosh.kanthi at exfo.com  Wed Nov 21 03:05:54 2018
From: ashutosh.kanthi at exfo.com (Ashutosh Kanthi)
Date: Wed, 21 Nov 2018 08:05:54 +0000
Subject: [keycloak-user] Keycloak Session timeout issue
In-Reply-To: <1542612843.2282.1.camel@acutus.pro>
References: <616f0c82ace0445abf1114b4b980d7a3@exfo.com>
	<1542612843.2282.1.camel@acutus.pro>
Message-ID: <283d2201727143a08224982e77990ece@exfo.com>

Hi Dmitry,

We have used latest Keycloak (4.6.0) but still we are getting the same issue.

Could you please suggest something on this?

Thanks & regards,
Ashutosh Kanthi

-----Original Message-----
From: Dmitry Telegin <dt at acutus.pro>
Sent: 19 November 2018 13:04
To: Ashutosh Kanthi <ashutosh.kanthi at exfo.com>; keycloak-user at lists.jboss.org
Cc: Abhijit Mhaske <abhijit.mhaske at exfo.com>; Mohammed Mustafa N <mohammed.mustafa-n at exfo.com>; Sandeep Jalvi <sandeep.jalvi at exfo.com>
Subject: Re: [keycloak-user] Keycloak Session timeout issue

Hello Ashutosh,

Could you please try to reproduce this with the latest Keycloak (4.6.0)? Version 2.5.5 has been released around 1.5 years ago, quite a lot has been done since then, including session management.

Cheers,
Dmitry Telegin
CTO, Acutus s.r.o.
Keycloak Consulting and Training

Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
+42 (022) 888-30-71
E-mail: info at acutus.pro

On Mon, 2018-11-19 at 07:11 +0000, Ashutosh Kanthi wrote:
> Hi,
>
> We are using Keycloak 2.5.5 and we are facing issues with regard to keycloak session timeout.
>
>
>   1.  Even after session timeout for a particular user, keycloak is maintaining session for that particular user for some extended time.
>   2.  And if the same user log in again then keycloak is showing that the same user maintains 2 sessions in active session section. (Previous session [it is no longer exists for him at application level] and current session.)
>
> We have done following keycloak settings just for checking above scenario.  Could anyone please suggest what are the settings to be done in keycloak so that above mentioned scenario could be avoided?
>
> > [cid:image002.jpg at 01D48002.E6221430]
>
> Thanks & regards,
> Ashutosh Kanthi
>
> Le contenu de ce courriel et de toute pi?ce jointe est destin? ? l?usage exclusif de son destinataire. Il contient des renseignements exclusifs, privil?gi?s, confidentiels ou assujettis au droit d?auteur. Toute divulgation, distribution ou reproduction non autoris?e est strictement interdite. Si vous n??tes pas le destinataire pr?vu, veuillez-nous en aviser imm?diatement et supprimer toutes les copies de ce courriel et des pi?ces jointes. Les courriels sont susceptibles d?alt?ration. EXFO Inc. et ses soci?t?s affili?es ne seront pas tenues responsables du message s?il a ?t? contrefait, modifi? ou falsifi?.
>
> The content of this email and any of its attachments is intended for the exclusive use of its recipient. It contains information that is proprietary, privileged, confidential and/or subject to copyright. Any unauthorized disclosure, distribution or reproduction is strictly prohibited. If you are not the intended recipient, please notify us immediately and delete all copies of this email and any attachments. E-mails are susceptible to alteration. EXFO Inc. and its affiliates shall not be liable for the message if altered, changed or falsified.
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
Le contenu de ce courriel et de toute pi?ce jointe est destin? ? l?usage exclusif de son destinataire. Il contient des renseignements exclusifs, privil?gi?s, confidentiels ou assujettis au droit d?auteur. Toute divulgation, distribution ou reproduction non autoris?e est strictement interdite. Si vous n??tes pas le destinataire pr?vu, veuillez-nous en aviser imm?diatement et supprimer toutes les copies de ce courriel et des pi?ces jointes. Les courriels sont susceptibles d?alt?ration. EXFO Inc. et ses soci?t?s affili?es ne seront pas tenues responsables du message s?il a ?t? contrefait, modifi? ou falsifi?.

The content of this email and any of its attachments is intended for the exclusive use of its recipient. It contains information that is proprietary, privileged, confidential and/or subject to copyright. Any unauthorized disclosure, distribution or reproduction is strictly prohibited. If you are not the intended recipient, please notify us immediately and delete all copies of this email and any attachments. E-mails are susceptible to alteration. EXFO Inc. and its affiliates shall not be liable for the message if altered, changed or falsified.


From ronald.demneri at amdtia.com  Wed Nov 21 04:06:28 2018
From: ronald.demneri at amdtia.com (Ronald Demneri)
Date: Wed, 21 Nov 2018 09:06:28 +0000
Subject: [keycloak-user] group mapper per client
In-Reply-To: <1542617533.2282.3.camel@acutus.pro>
References: <VI1PR0402MB3696F22D057049DF4B800480E9F30@VI1PR0402MB3696.eurprd04.prod.outlook.com>
	<1540868804.2121.1.camel@acutus.pro>
	<VI1PR0402MB3696AC0B264006DEB14A50EDE9CD0@VI1PR0402MB3696.eurprd04.prod.outlook.com>
	<1541805512.2031.3.camel@acutus.pro>
	<1542617533.2282.3.camel@acutus.pro>
Message-ID: <VI1PR0402MB3696E444AAB354F8B93A8305E9DA0@VI1PR0402MB3696.eurprd04.prod.outlook.com>

Dear Dmitry,

I tested your suggestion and it is working as per our needs/requirements. Many thanks for the support, very appreciated!


Best Regards,
Ronald

-----Original Message-----
From: Dmitry Telegin <dt at acutus.pro> 
Sent: 19.Nov.2018 9:52 AM
To: Ronald Demneri <ronald.demneri at amdtia.com>; keycloak-user at lists.jboss.org
Subject: Re: [keycloak-user] group mapper per client

Hello Ronald,

It has turned out there's an easy way to overcome the issue with SSO cookie, without turning off SSO itself.

Let's imagine that your script authenticator looks like the following:

=============================================================
AuthenticationFlowError = Java.type("org.keycloak.authentication.AuthenticationFlowError");

function invalidGroup(context) {
    return context.form()
            .setError("Invalid group membership", []).createLogin(); }

function authenticate(context) {

    var clientId = authenticationSession.client.clientId;
    var username = user ? user.username : "anonymous";
    LOG.info(script.name + " trace auth for: " + username);
    
    var groups = Java.from(user.groups)
        .filter(function(group) {
            return RegExp("(.*)-" + clientId + "-(.*)", "i").test(group.name);
        });

    var authShouldFail = !(groups.length);
    
    if (authShouldFail) {
        var challengeResponse = invalidGroup(context)
        context.failureChallenge(AuthenticationFlowError.INVALID_CREDENTIALS, challengeResponse);
        return;
    }

    context.success();
    
}
=============================================================

The idea is to wrap Keycloak's standard browser flow into a subflow, add your authenticator after it, and make both REQUIRED (see attached image).

In this case, the authenticator will be executed unconditionally, even in the case of SSO cookie presence (in the opposite to ALTERNATIVE). This should finally solve the problem.

Good luck,
Dmitry Telegin
CTO, Acutus s.r.o.
Keycloak Consulting and Training

Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
+42 (022) 888-30-71
E-mail: info at acutus.pro

On Sat, 2018-11-10 at 02:18 +0300, Dmitry Telegin wrote:
> Ronald, glad to hear it worked,
> 
> There is however an important moment regarding potential security issue with your authenticator.
> 
> Imagine the following scenario:
> 1. a user?with the correct group membership logs into the client app 
> A; 2. the same user tries to access client B (for which he/she doesn't 
> have group membership); 3. client B redirects the user to Keycloak for 
> authentication; 4. due to cookie-based SSO, Keycloak decides that the user is already authenticated and logs him/her in client B.
> 
> To avoid this, you should turn off cookie-based auth for your restricted clients. Go to Authentication, create a copy of your browser flow (which should already have your script authenticator), remove Cookie, then go to your clients' settings and configure Authentication Flow Overrides for browser flow.
> 
> This will actually disable SSO to your clients. If this is not acceptable, there are some other options to consider (however more complex).
> 
> You should also make sure you don't enable token exchange between clients [1] (this is disabled by default).
> 
> [1] 
> https://www.keycloak.org/docs/latest/securing_apps/index.html#internal
> -token-to-internal-token-exchange
> 
> Good luck,
> Dmitry Telegin
> CTO, Acutus s.r.o.
> Keycloak Consulting and Training
> 
> Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
> +42 (022) 888-30-71
> E-mail: info at acutus.pro
> 
> On Wed, 2018-10-31 at 13:49 +0000, Ronald Demneri wrote:
> > Hello everyone,
> > 
> > So, thankfully, after some careful reading, I managed to solve the first issue regarding clientSession.client.clientId, which in fact shoud be authenticationSession.client.clientId (there was a mention on using loginSession.client.clientId in place of clientSession.client.clientId on this link https://issues.jboss.org/browse/KEYCLOAK-4505, which I tried to use, without success).
> > 
> > 
> > Regards,
> > Ronald
> > 
> > -----Original Message-----
> > From: Ronald Demneri
> > Sent: 30.Oct.2018 3:48 PM
> > > To: 'Dmitry Telegin' <dt at acutus.pro>; 
> > > keycloak-user at lists.jboss.org
> > 
> > Subject: RE: [keycloak-user] group mapper per client
> > 
> > Almost forgot, If I set a static group name to compare against (which is not our goal, but just for testing), it works correctly if the account is member of that group. If the user is not a member, then it'll display an error like "Invalid username or password". Is it possible to modify the response in such cases, stating that the account is not a member of required groups, or at least have it like "Invalid group membership".
> > 
> > 
> > Looking forward to hearing from you!
> > 
> > 
> > Regards,
> > Ronald
> > 
> > -----Original Message-----
> > > From: Dmitry Telegin <dt at acutus.pro>
> > 
> > Sent: 30.Oct.2018 4:07 AM
> > > To: Ronald Demneri <ronald.demneri at amdtia.com>; 
> > > keycloak-user at lists.jboss.org
> > 
> > Subject: Re: [keycloak-user] group mapper per client
> > 
> > Hello Ronald,
> > 
> > If there is a literal correspondence between your AD group names and client names (like e.g. if the client is named "foo", and the corresponding AD group is "AD_group_foo"), you can do the following trick:
> > - make sure you have group-ldap-mapper configured in LDAP mappers, 
> > i.e. AD groups are synced to Keycloak groups;
> > - create a Javascript authenticator that would check client name against user's groups, and add it to your authentication flow. If the user tries to authenticate against the client without being a member of the corresponding group, the authenticator should deny login.
> > 
> > If there is no such correspondence (e.g. the client is named "foo", and the group is "AD_group_bar"), you still have the following options:
> > - map AD groups to Keycloak roles using role-ldap-mapper, then use 
> > your adapter's configuration to restrict access only to the users 
> > with this role (e.g. <security-constraint> in web.xml);
> > - or map AD groups to Keycloak groups, enable authorization services and use group policy (if your client adapter supports authorization, of course).
> > 
> > This, however, will need to be configured per each client, on the contrary to the first approach (configured once per realm).
> > 
> > Let me know if you need further explanations, Dmitry Telegin CTO, Acutus s.r.o.
> > Keycloak Consulting and Training
> > 
> > Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
> > +42 (022) 888-30-71
> > E-mail: info at acutus.pro
> > 
> > On Mon, 2018-10-29 at 15:35 +0000, Ronald Demneri wrote:
> > > Hello everyone,
> > > 
> > > Please forgive me if this was already asked previously. After creating the LDAP connection (read-only) and some LDAP mappers, I am trying to figure out a way how to allow login to clients for users in respective groups in AD, for example for client app1 allow login to users that are members of AD_group_app1; if account is not a member of the app1 group in AD, then he should not be allowed to login. Is it also possible to do it via role mappings? Please note that we'd like to avoid modification of AD at all costs.
> > > 
> > > 
> > > Thanks in advance,
> > > Ronald
> > > _______________________________________________
> > > keycloak-user mailing list
> > > keycloak-user at lists.jboss.org
> > > https://lists.jboss.org/mailman/listinfo/keycloak-user
> 
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user


From ronald.demneri at amdtia.com  Wed Nov 21 04:11:50 2018
From: ronald.demneri at amdtia.com (Ronald Demneri)
Date: Wed, 21 Nov 2018 09:11:50 +0000
Subject: [keycloak-user] group mapper per client
In-Reply-To: <VI1PR0402MB3696E444AAB354F8B93A8305E9DA0@VI1PR0402MB3696.eurprd04.prod.outlook.com>
References: <VI1PR0402MB3696F22D057049DF4B800480E9F30@VI1PR0402MB3696.eurprd04.prod.outlook.com>
	<1540868804.2121.1.camel@acutus.pro>
	<VI1PR0402MB3696AC0B264006DEB14A50EDE9CD0@VI1PR0402MB3696.eurprd04.prod.outlook.com>
	<1541805512.2031.3.camel@acutus.pro>	<1542617533.2282.3.camel@acutus.pro>
	<VI1PR0402MB3696E444AAB354F8B93A8305E9DA0@VI1PR0402MB3696.eurprd04.prod.outlook.com>
Message-ID: <VI1PR0402MB3696DDAC0203A15B8A3D4000E9DA0@VI1PR0402MB3696.eurprd04.prod.outlook.com>

Btw, how's the blog post on Groups shaping up? Can you provide a link once you post it?


Regards,
Ronald

-----Original Message-----
From: keycloak-user-bounces at lists.jboss.org <keycloak-user-bounces at lists.jboss.org> On Behalf Of Ronald Demneri
Sent: 21.Nov.2018 10:06 AM
To: Dmitry Telegin <dt at acutus.pro>; keycloak-user at lists.jboss.org
Subject: Re: [keycloak-user] group mapper per client

Dear Dmitry,

I tested your suggestion and it is working as per our needs/requirements. Many thanks for the support, very appreciated!


Best Regards,
Ronald

-----Original Message-----
From: Dmitry Telegin <dt at acutus.pro>
Sent: 19.Nov.2018 9:52 AM
To: Ronald Demneri <ronald.demneri at amdtia.com>; keycloak-user at lists.jboss.org
Subject: Re: [keycloak-user] group mapper per client

Hello Ronald,

It has turned out there's an easy way to overcome the issue with SSO cookie, without turning off SSO itself.

Let's imagine that your script authenticator looks like the following:

=============================================================
AuthenticationFlowError = Java.type("org.keycloak.authentication.AuthenticationFlowError");

function invalidGroup(context) {
    return context.form()
            .setError("Invalid group membership", []).createLogin(); }

function authenticate(context) {

    var clientId = authenticationSession.client.clientId;
    var username = user ? user.username : "anonymous";
    LOG.info(script.name + " trace auth for: " + username);
    
    var groups = Java.from(user.groups)
        .filter(function(group) {
            return RegExp("(.*)-" + clientId + "-(.*)", "i").test(group.name);
        });

    var authShouldFail = !(groups.length);
    
    if (authShouldFail) {
        var challengeResponse = invalidGroup(context)
        context.failureChallenge(AuthenticationFlowError.INVALID_CREDENTIALS, challengeResponse);
        return;
    }

    context.success();
    
}
=============================================================

The idea is to wrap Keycloak's standard browser flow into a subflow, add your authenticator after it, and make both REQUIRED (see attached image).

In this case, the authenticator will be executed unconditionally, even in the case of SSO cookie presence (in the opposite to ALTERNATIVE). This should finally solve the problem.

Good luck,
Dmitry Telegin
CTO, Acutus s.r.o.
Keycloak Consulting and Training

Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
+42 (022) 888-30-71
E-mail: info at acutus.pro

On Sat, 2018-11-10 at 02:18 +0300, Dmitry Telegin wrote:
> Ronald, glad to hear it worked,
> 
> There is however an important moment regarding potential security issue with your authenticator.
> 
> Imagine the following scenario:
> 1. a user?with the correct group membership logs into the client app 
> A; 2. the same user tries to access client B (for which he/she doesn't 
> have group membership); 3. client B redirects the user to Keycloak for 
> authentication; 4. due to cookie-based SSO, Keycloak decides that the user is already authenticated and logs him/her in client B.
> 
> To avoid this, you should turn off cookie-based auth for your restricted clients. Go to Authentication, create a copy of your browser flow (which should already have your script authenticator), remove Cookie, then go to your clients' settings and configure Authentication Flow Overrides for browser flow.
> 
> This will actually disable SSO to your clients. If this is not acceptable, there are some other options to consider (however more complex).
> 
> You should also make sure you don't enable token exchange between clients [1] (this is disabled by default).
> 
> [1]
> https://www.keycloak.org/docs/latest/securing_apps/index.html#internal
> -token-to-internal-token-exchange
> 
> Good luck,
> Dmitry Telegin
> CTO, Acutus s.r.o.
> Keycloak Consulting and Training
> 
> Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
> +42 (022) 888-30-71
> E-mail: info at acutus.pro
> 
> On Wed, 2018-10-31 at 13:49 +0000, Ronald Demneri wrote:
> > Hello everyone,
> > 
> > So, thankfully, after some careful reading, I managed to solve the first issue regarding clientSession.client.clientId, which in fact shoud be authenticationSession.client.clientId (there was a mention on using loginSession.client.clientId in place of clientSession.client.clientId on this link https://issues.jboss.org/browse/KEYCLOAK-4505, which I tried to use, without success).
> > 
> > 
> > Regards,
> > Ronald
> > 
> > -----Original Message-----
> > From: Ronald Demneri
> > Sent: 30.Oct.2018 3:48 PM
> > > To: 'Dmitry Telegin' <dt at acutus.pro>; 
> > > keycloak-user at lists.jboss.org
> > 
> > Subject: RE: [keycloak-user] group mapper per client
> > 
> > Almost forgot, If I set a static group name to compare against (which is not our goal, but just for testing), it works correctly if the account is member of that group. If the user is not a member, then it'll display an error like "Invalid username or password". Is it possible to modify the response in such cases, stating that the account is not a member of required groups, or at least have it like "Invalid group membership".
> > 
> > 
> > Looking forward to hearing from you!
> > 
> > 
> > Regards,
> > Ronald
> > 
> > -----Original Message-----
> > > From: Dmitry Telegin <dt at acutus.pro>
> > 
> > Sent: 30.Oct.2018 4:07 AM
> > > To: Ronald Demneri <ronald.demneri at amdtia.com>; 
> > > keycloak-user at lists.jboss.org
> > 
> > Subject: Re: [keycloak-user] group mapper per client
> > 
> > Hello Ronald,
> > 
> > If there is a literal correspondence between your AD group names and client names (like e.g. if the client is named "foo", and the corresponding AD group is "AD_group_foo"), you can do the following trick:
> > - make sure you have group-ldap-mapper configured in LDAP mappers, 
> > i.e. AD groups are synced to Keycloak groups;
> > - create a Javascript authenticator that would check client name against user's groups, and add it to your authentication flow. If the user tries to authenticate against the client without being a member of the corresponding group, the authenticator should deny login.
> > 
> > If there is no such correspondence (e.g. the client is named "foo", and the group is "AD_group_bar"), you still have the following options:
> > - map AD groups to Keycloak roles using role-ldap-mapper, then use 
> > your adapter's configuration to restrict access only to the users 
> > with this role (e.g. <security-constraint> in web.xml);
> > - or map AD groups to Keycloak groups, enable authorization services and use group policy (if your client adapter supports authorization, of course).
> > 
> > This, however, will need to be configured per each client, on the contrary to the first approach (configured once per realm).
> > 
> > Let me know if you need further explanations, Dmitry Telegin CTO, Acutus s.r.o.
> > Keycloak Consulting and Training
> > 
> > Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
> > +42 (022) 888-30-71
> > E-mail: info at acutus.pro
> > 
> > On Mon, 2018-10-29 at 15:35 +0000, Ronald Demneri wrote:
> > > Hello everyone,
> > > 
> > > Please forgive me if this was already asked previously. After creating the LDAP connection (read-only) and some LDAP mappers, I am trying to figure out a way how to allow login to clients for users in respective groups in AD, for example for client app1 allow login to users that are members of AD_group_app1; if account is not a member of the app1 group in AD, then he should not be allowed to login. Is it also possible to do it via role mappings? Please note that we'd like to avoid modification of AD at all costs.
> > > 
> > > 
> > > Thanks in advance,
> > > Ronald
> > > _______________________________________________
> > > keycloak-user mailing list
> > > keycloak-user at lists.jboss.org
> > > https://lists.jboss.org/mailman/listinfo/keycloak-user
> 
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user


From marian.petrik at esgroup.ch  Wed Nov 21 05:30:54 2018
From: marian.petrik at esgroup.ch (Marian Petrik)
Date: Wed, 21 Nov 2018 10:30:54 +0000
Subject: [keycloak-user] Realm resolution by username
In-Reply-To: <CAEJ3w4WGjYiRxM0JGr0QGuVZjt31sALjr27KRTOzStzmA8Zt5w@mail.gmail.com>
Message-ID: <1a28c9c5b0b7212a780ade7255d850b6a425b6d3.camel@esgroup.ch>

Hi Ian,

We are facing similar question with Keycloak and multi-tenancy. We would also prefer a single login page and resolve realm from email domain. Did yo find a solution to this?

Best regards,
Marian

From psilva at redhat.com  Wed Nov 21 05:57:27 2018
From: psilva at redhat.com (Pedro Igor Silva)
Date: Wed, 21 Nov 2018 08:57:27 -0200
Subject: [keycloak-user] Requires uma_protection scope
In-Reply-To: <CAHzT=q-qGvat3+dMkrR0AodYx1gNhnz6EA1xcsuNrBD850YBVw@mail.gmail.com>
References: <CAOPHCg_qifS4Bmywnn05v_TuoKbxmLVVhwr+XAfhK=mQZnak8A@mail.gmail.com>
	<CAJrcDBfRaj1g0nJR6kiNu9E0KhfaTiQy=V0niz-X-k2aaO4_5A@mail.gmail.com>
	<CAOPHCg8fss_TT+R9BU0TRSA_N0EFjdcauco==aGSwqQ7G+T-bQ@mail.gmail.com>
	<CAJrcDBfHnOAnmn66CSHvOOrxyDgY2-qiu31=TZtmZS9GWBFhfw@mail.gmail.com>
	<CAOPHCg8WvftbwOd=wc4=krj2g2h1-NvE3oGCnVyoDgx8kfXb1A@mail.gmail.com>
	<CAHzT=q-qGvat3+dMkrR0AodYx1gNhnz6EA1xcsuNrBD850YBVw@mail.gmail.com>
Message-ID: <CAJrcDBdK36FTaJ+o6_=X0WozvMXADvhS_85wZrER_SzvrFcONg@mail.gmail.com>

Yes, you should see a claim like this:

"resource_access": {
    "{client_id}": {
      "roles": [
        "{client_role}"
      ]
    }
  }

On Tue, Nov 20, 2018 at 5:22 PM Geoffrey Cleaves <geoff at opticks.io> wrote:

> I understand that the client is supposed to have the role given the Admin
> Console settings, but does the token show that role when you introspect it?
>
> On Tue, Nov 20, 2018, 18:02 Julien Deruere <deruere.julien at gmail.com
> wrote:
>
>> That's exactly what I did/checked. That's why I can't figure out why it's
>> not working :(
>>
>> Le mar. 20 nov. 2018 11:53, Pedro Igor Silva <psilva at redhat.com> a ?crit
>> :
>>
>> > This role should be a client role. For instance, if you are trying to
>> > create resources for C1 the service account must be granted with client
>> > role C1/uma-protection. See screenshot attached.
>> >
>> > Regards.
>> >
>> > On Tue, Nov 20, 2018 at 2:01 PM Julien Deruere <
>> deruere.julien at gmail.com>
>> > wrote:
>> >
>> >> In this case I'm using protection API:
>> >>
>> >> curl -X POST \
>> >>     -H "Content-Type: application/x-www-form-urlencoded" \
>> >>     -d
>> 'grant_type=client_credentials&client_id=${client_id}&client_secret=${client_secret}'
>> \
>> >>     "
>> http://localhost:8080/auth/realms/${realm_name}/protocol/openid-connect/token
>> "
>> >>
>> >>
>> >> I'm asking a token as a client, not as a user. And I checked, my client
>> >> has the uma_protection role in Service Account Role.
>> >>
>> >> I don't know where I'm wrong?
>> >>
>> >> Le mar. 20 nov. 2018 10:54, Pedro Igor Silva <psilva at redhat.com> a
>> >> ?crit :
>> >>
>> >>> Hi,
>> >>>
>> >>> You need to grant uma_protection client scope (it should be available
>> as
>> >>> one of the roles associated with your resource server) to the user to
>> which
>> >>> you are issuing tokens for.
>> >>>
>> >>> On Tue, Nov 20, 2018 at 1:52 PM Julien Deruere <
>> deruere.julien at gmail.com>
>> >>> wrote:
>> >>>
>> >>>> Any update on this?
>> >>>> I got the exact same message when using POSTMAN :
>> >>>>
>> >>>> I fist do this (with grant_type=client_credentials):
>> >>>> http://localhost:8080/auth/realms/sg2b/protocol/openid-connect/token
>> >>>>
>> >>>> And then this with the token I received:
>> >>>> GET
>> >>>>
>> >>>>
>> http://localhost:8080/auth/realms/sg2b/authz/protection/resource_set?type=zone
>> >>>> Which answer me this:
>> >>>> {
>> >>>>     "error": "invalid_scope",
>> >>>>     "error_description": "Requires uma_protection scope."
>> >>>> }
>> >>>>
>> >>> _______________________________________________
>> >>>> keycloak-user mailing list
>> >>>> keycloak-user at lists.jboss.org
>> >>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>> >>>>
>> >>>
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
>

From marian.petrik at esgroup.ch  Wed Nov 21 06:12:28 2018
From: marian.petrik at esgroup.ch (Marian Petrik)
Date: Wed, 21 Nov 2018 11:12:28 +0000
Subject: [keycloak-user] Keycloak realm detection from email domain
In-Reply-To: <89416374424943dd95047cbe0645a187@FERB.ppg.lan>
Message-ID: <97da62996c48b3c8cb9ed1eed37df978f3a331f5.camel@esgroup.ch>

Hi Scot,


We are facing similar issue with keyclaok but would prefer to have the realm resolution implemented in keycloak (not like Kevin suggests on client side).


Can you maybe share your experience and the approach you finally implemented?


Best regards,

Marian




-----Original Message-----

Hi Scott,

Wouldn't it be much easier to implement this "proxy" logic in the mobile app itself? Adding a new layer in your infrastructure could mean another single point of failure and doesn't add much value to it either. Of course, you can write some logic by modifying Keycloak but it could rejected by the community and then you'd have to main your logic in Keycloak yourself. It could break anytime Keycloak has another update and Keycloak is updated frequently.

I'd honestly stick by implementing this behavior in your client. Before you redirect your user to the login page or pass his credentials to the Keycloak instance, validate the email and direct the user to the proper realm then. This way you'd have to maintain only a small part of your mobile app and doesn't contain the complexity by maintaining another component in your infrastructure.

I hope this will give you some thoughts :-) !

Kind regards,

Kevin

-----Original Message-----
From: keycloak-user-bounces at lists.jboss.org<https://lists.jboss.org/mailman/listinfo/keycloak-user> [mailto:keycloak-user-bounces at lists.jboss.org<https://lists.jboss.org/mailman/listinfo/keycloak-user>] On Behalf Of Scott Hezzell
Sent: Tuesday, November 28, 2017 1:40 PM
To: keycloak-user at lists.jboss.org<https://lists.jboss.org/mailman/listinfo/keycloak-user>
Subject: [keycloak-user] Keycloak realm detection from email domain

Hi


I am building a multi-tenant mobile application that uses keycloak as a SSO server.  We will pre-load users in keycloak using their email address as their username with a separate realm for each tenant. When a user logs into the mobile app I need to detect the realm from a user's email domain and redirect to the appropriate authorisation end point for the realm. Has anyone faced a similar problem?


My thoughts at the moment is to build a proxy api that the mobile application redirects to that prompts the user for their email address, look up the configured tenant form the email domain and redirects to the appropriate realm's login page passing the mobile app credentials it passes to the proxy api and the entered user email as a login_hint.


Can anyone see any issues with this approach? Or a suggest a better approach?


Thanks

Scott

From geoff at opticks.io  Wed Nov 21 06:28:36 2018
From: geoff at opticks.io (Geoffrey Cleaves)
Date: Wed, 21 Nov 2018 12:28:36 +0100
Subject: [keycloak-user] Feature request: create UMA permission ticket by
	resource_type
Message-ID: <CAHzT=q8jm8Eo6m4zJ057J7_ypFb_o-+AM5HfpBR7sozzWzBv+Q@mail.gmail.com>

It occurs to me that it might be useful to create permission tickets by
resource_type and I don't think it's possible today.

If I am a resource server and somebody hits the GET endpoint /api/recipes
where recipe is a resource_type, then we would request a ticket that has
the permissions to all recipes. That way the resource server knows which
ones to list while easing the load a little bit on Keycloack by not asking
to evaluate all the resources, only recipes.

Makes sense to you, Pedro? If so, I can open a feature request in JIRA.

Geoff

From anpasq at gmail.com  Wed Nov 21 07:30:27 2018
From: anpasq at gmail.com (Andrea Pasqualini)
Date: Wed, 21 Nov 2018 13:30:27 +0100
Subject: [keycloak-user] Client Registration performance
Message-ID: <CADYG=JesOqJb0_3S06sgtqSDKt-wAXVpAij=BJ2+DE9P6n7Lmw@mail.gmail.com>

As you can see here,
https://issues.jboss.org/browse/KEYCLOAK-8275
It seems that there are currently problems with a large number of clients.

This is becoming a big lack for keycloaks

Andrea Pasqualini

>Hello Keycloak Users!
>
>We are planning on using the Client Registration flow for setting up
>clients on login.
>This is mainly to more clearly identify each individual device a user
>has logged in with.
>
>Are there anyone using this feature in production with a large number
>of clients?
>With our current stats, we would probably end up with a few million
>clients by the end of the year.
>
>1. Will this scale well with the way Keycloak works?
>2. If a user loses their device, how should a full revoke & logout be performed?
>3. Is there an alternative approach to give each user more control
>over their device and session?
>
>Thanks,
>Eivind Larsen

From psilva at redhat.com  Wed Nov 21 08:07:29 2018
From: psilva at redhat.com (Pedro Igor Silva)
Date: Wed, 21 Nov 2018 11:07:29 -0200
Subject: [keycloak-user] Feature request: create UMA permission ticket
	by resource_type
In-Reply-To: <CAHzT=q8jm8Eo6m4zJ057J7_ypFb_o-+AM5HfpBR7sozzWzBv+Q@mail.gmail.com>
References: <CAHzT=q8jm8Eo6m4zJ057J7_ypFb_o-+AM5HfpBR7sozzWzBv+Q@mail.gmail.com>
Message-ID: <CAJrcDBd9Kd_KOk8GOUiXb52i9SzaX6ALdSnAa1_6==eDWO6ZNw@mail.gmail.com>

Yeah, I think it makes sense. Please, create the RFE.

Regards.
Pedro Igor

On Wed, Nov 21, 2018 at 9:31 AM Geoffrey Cleaves <geoff at opticks.io> wrote:

> It occurs to me that it might be useful to create permission tickets by
> resource_type and I don't think it's possible today.
>
> If I am a resource server and somebody hits the GET endpoint /api/recipes
> where recipe is a resource_type, then we would request a ticket that has
> the permissions to all recipes. That way the resource server knows which
> ones to list while easing the load a little bit on Keycloack by not asking
> to evaluate all the resources, only recipes.
>
> Makes sense to you, Pedro? If so, I can open a feature request in JIRA.
>
> Geoff
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

From mposolda at redhat.com  Wed Nov 21 08:18:53 2018
From: mposolda at redhat.com (Marek Posolda)
Date: Wed, 21 Nov 2018 14:18:53 +0100
Subject: [keycloak-user] 4.6.0 Upgrade disables client scopes
In-Reply-To: <01F89E35-A10A-41BB-8570-73B08353AC62@sap.com>
References: <01F89E35-A10A-41BB-8570-73B08353AC62@sap.com>
Message-ID: <99650048-66d6-e6e5-fee6-e092c0439c9b@redhat.com>

No, it doesn't need to be updated in any profile like Token Exchange.

Question is, from which version you upgraded? Note that during upgrade 
to 4.0.0, the realm default client scopes are not automatically linked 
to the clients. Thing is, that clients from previous version already has 
some protocolMappers defined on them, so the clientScopes are not added 
to it. You may need to do change your clients manually and remove 
protocolMappers from them and link them to default client scopes.

Just the new clients, which you will create now through admin UI, will 
have the client scopes added to them. See details in the docs: 
https://www.keycloak.org/docs/latest/upgrading/index.html#client-templates-changed-to-client-scopes

BTV. When you're on client, you can click to "Client Scopes" and then 
"Evaluate" to see what are applied client scopes and check what 
clientScopes will be applied based on the value of "scope" parameter.

Marek

On 21/11/2018 01:55, Lamina, Marco wrote:
> Hi,
> I upgraded to 4.6.0 using the Kubernetes Helm chart. After the upgrade, token exchange stopped working, which I was able to fix thanks to [1]. Unfortunately, none of my client scopes are working anymore. Trying to get a token using client credentials succeeds, but anything I pass into the ?scope? parameter is ignored and none of my default client scopes are applied. The ?scope? claim in the token endpoint response is always empty.
> Is that a feature that needs to be enabled similar to the token exchange?
>
> [1] https://stackoverflow.com/questions/53367566/unable-to-setup-idp-token-exchange-in-keycloak-4-6-0-final
>
> Thanks,
> Marco
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user



From viktor.chuchurski at gmail.com  Wed Nov 21 08:20:35 2018
From: viktor.chuchurski at gmail.com (Viktor Chuchurski)
Date: Wed, 21 Nov 2018 14:20:35 +0100
Subject: [keycloak-user] Limit re-send verification emails
Message-ID: <CADy1qmm-wPQumivt_2z25kTW=uC4BOqv2PYhuHXLWHm-v4WvJQ@mail.gmail.com>

Hello all,

I have a question regarding re-sending of verification emails.

Is it somehow possible to configure how often can the user request a
re-send?
As far as I looked, currently there is no check when the last re-send was
requested, which allows a third party to spam "click" the resend button and
cause problems on the mail server.

Thanks in advance,
Viktor

From deruere.julien at gmail.com  Wed Nov 21 09:40:54 2018
From: deruere.julien at gmail.com (Julien Deruere)
Date: Wed, 21 Nov 2018 09:40:54 -0500
Subject: [keycloak-user] Requires uma_protection scope
In-Reply-To: <CAJrcDBdK36FTaJ+o6_=X0WozvMXADvhS_85wZrER_SzvrFcONg@mail.gmail.com>
References: <CAOPHCg_qifS4Bmywnn05v_TuoKbxmLVVhwr+XAfhK=mQZnak8A@mail.gmail.com>
	<CAJrcDBfRaj1g0nJR6kiNu9E0KhfaTiQy=V0niz-X-k2aaO4_5A@mail.gmail.com>
	<CAOPHCg8fss_TT+R9BU0TRSA_N0EFjdcauco==aGSwqQ7G+T-bQ@mail.gmail.com>
	<CAJrcDBfHnOAnmn66CSHvOOrxyDgY2-qiu31=TZtmZS9GWBFhfw@mail.gmail.com>
	<CAOPHCg8WvftbwOd=wc4=krj2g2h1-NvE3oGCnVyoDgx8kfXb1A@mail.gmail.com>
	<CAHzT=q-qGvat3+dMkrR0AodYx1gNhnz6EA1xcsuNrBD850YBVw@mail.gmail.com>
	<CAJrcDBdK36FTaJ+o6_=X0WozvMXADvhS_85wZrER_SzvrFcONg@mail.gmail.com>
Message-ID: <CAOPHCg-dKPkATXV7_uPGvSD_hjgHNJzWVvHs9+O68ctO=zB7VA@mail.gmail.com>

This is all I see

{
  "jti": "6cfa6dd3-a3dd-4f5b-8560-f91832e7a35f",
  "exp": 1542811409,
  "nbf": 0,
  "iat": 1542811109,
  "iss": "http://my-keycloak:8080/auth/realms/my-realm",
  "sub": "055a376e-d8eb-49cf-9d5f-a83226448131",
  "typ": "Bearer",
  "azp": "my-api-gateway",
  "auth_time": 0,
  "session_state": "10853e1d-ff27-4f4c-b9e1-31339774c5e4",
  "acr": "1",
  "scope": "profile email",
  "clientId": "my-api-gateway",
  "clientHost": "172.19.0.1",
  "email_verified": false,
  "preferred_username": "service-account-my-api-gateway",
  "clientAddress": "172.19.0.1",
  "email": "service-account-my-api-gateway at placeholder.org"
}

Le mer. 21 nov. 2018 ? 05:57, Pedro Igor Silva <psilva at redhat.com> a ?crit :

> Yes, you should see a claim like this:
>
> "resource_access": {
>     "{client_id}": {
>       "roles": [
>         "{client_role}"
>       ]
>     }
>   }
>
> On Tue, Nov 20, 2018 at 5:22 PM Geoffrey Cleaves <geoff at opticks.io> wrote:
>
>> I understand that the client is supposed to have the role given the Admin
>> Console settings, but does the token show that role when you introspect it?
>>
>> On Tue, Nov 20, 2018, 18:02 Julien Deruere <deruere.julien at gmail.com
>> wrote:
>>
>>> That's exactly what I did/checked. That's why I can't figure out why it's
>>> not working :(
>>>
>>> Le mar. 20 nov. 2018 11:53, Pedro Igor Silva <psilva at redhat.com> a
>>> ?crit :
>>>
>>> > This role should be a client role. For instance, if you are trying to
>>> > create resources for C1 the service account must be granted with client
>>> > role C1/uma-protection. See screenshot attached.
>>> >
>>> > Regards.
>>> >
>>> > On Tue, Nov 20, 2018 at 2:01 PM Julien Deruere <
>>> deruere.julien at gmail.com>
>>> > wrote:
>>> >
>>> >> In this case I'm using protection API:
>>> >>
>>> >> curl -X POST \
>>> >>     -H "Content-Type: application/x-www-form-urlencoded" \
>>> >>     -d
>>> 'grant_type=client_credentials&client_id=${client_id}&client_secret=${client_secret}'
>>> \
>>> >>     "
>>> http://localhost:8080/auth/realms/${realm_name}/protocol/openid-connect/token
>>> "
>>> >>
>>> >>
>>> >> I'm asking a token as a client, not as a user. And I checked, my
>>> client
>>> >> has the uma_protection role in Service Account Role.
>>> >>
>>> >> I don't know where I'm wrong?
>>> >>
>>> >> Le mar. 20 nov. 2018 10:54, Pedro Igor Silva <psilva at redhat.com> a
>>> >> ?crit :
>>> >>
>>> >>> Hi,
>>> >>>
>>> >>> You need to grant uma_protection client scope (it should be
>>> available as
>>> >>> one of the roles associated with your resource server) to the user
>>> to which
>>> >>> you are issuing tokens for.
>>> >>>
>>> >>> On Tue, Nov 20, 2018 at 1:52 PM Julien Deruere <
>>> deruere.julien at gmail.com>
>>> >>> wrote:
>>> >>>
>>> >>>> Any update on this?
>>> >>>> I got the exact same message when using POSTMAN :
>>> >>>>
>>> >>>> I fist do this (with grant_type=client_credentials):
>>> >>>>
>>> http://localhost:8080/auth/realms/sg2b/protocol/openid-connect/token
>>> >>>>
>>> >>>> And then this with the token I received:
>>> >>>> GET
>>> >>>>
>>> >>>>
>>> http://localhost:8080/auth/realms/sg2b/authz/protection/resource_set?type=zone
>>> >>>> Which answer me this:
>>> >>>> {
>>> >>>>     "error": "invalid_scope",
>>> >>>>     "error_description": "Requires uma_protection scope."
>>> >>>> }
>>> >>>>
>>> >>> _______________________________________________
>>> >>>> keycloak-user mailing list
>>> >>>> keycloak-user at lists.jboss.org
>>> >>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>> >>>>
>>> >>>
>>> _______________________________________________
>>> keycloak-user mailing list
>>> keycloak-user at lists.jboss.org
>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>>

From geoff at opticks.io  Wed Nov 21 09:53:20 2018
From: geoff at opticks.io (Geoffrey Cleaves)
Date: Wed, 21 Nov 2018 15:53:20 +0100
Subject: [keycloak-user] Requires uma_protection scope
In-Reply-To: <CAOPHCg-dKPkATXV7_uPGvSD_hjgHNJzWVvHs9+O68ctO=zB7VA@mail.gmail.com>
References: <CAOPHCg_qifS4Bmywnn05v_TuoKbxmLVVhwr+XAfhK=mQZnak8A@mail.gmail.com>
	<CAJrcDBfRaj1g0nJR6kiNu9E0KhfaTiQy=V0niz-X-k2aaO4_5A@mail.gmail.com>
	<CAOPHCg8fss_TT+R9BU0TRSA_N0EFjdcauco==aGSwqQ7G+T-bQ@mail.gmail.com>
	<CAJrcDBfHnOAnmn66CSHvOOrxyDgY2-qiu31=TZtmZS9GWBFhfw@mail.gmail.com>
	<CAOPHCg8WvftbwOd=wc4=krj2g2h1-NvE3oGCnVyoDgx8kfXb1A@mail.gmail.com>
	<CAHzT=q-qGvat3+dMkrR0AodYx1gNhnz6EA1xcsuNrBD850YBVw@mail.gmail.com>
	<CAJrcDBdK36FTaJ+o6_=X0WozvMXADvhS_85wZrER_SzvrFcONg@mail.gmail.com>
	<CAOPHCg-dKPkATXV7_uPGvSD_hjgHNJzWVvHs9+O68ctO=zB7VA@mail.gmail.com>
Message-ID: <CAHzT=q8ZCqo5tpY1Fd_XND1JNDq4EoWGZv=z_+1Gq-UXE0-Rxw@mail.gmail.com>

My tokens look like this. What if you "reboot", create a new client and
test it there.

{
    "jti": "5c5a8",
    "exp": 1542812146,
    "nbf": 0,
    "iat": 1542811846,
    "iss": "https://fblah",
    "aud": [
        "account",
        "opticks-rs"
    ],
    "sub": "dee58194-6b2b31d",
    "typ": "Bearer",
    "azp": "rs",
    "auth_time": 0,
    "session_state": "a96958c1e5",
    "preferred_username": "service-account-rs",
    "email": "service-account-rs at placeholder.org",
    "email_verified": false,
    "acr": "1",
    "realm_access": {
        "roles": [
            "offline_access",
            "uma_authorization"
        ]
    },
    "resource_access": {
        "account": {
            "roles": [
                "manage-account",
                "manage-account-links",
                "view-profile"
            ]
        },
        "opticks-rs": {
            "roles": [
                "uma_protection"
            ]
        }
    },
    "scope": "email profile",
    "clientId": "rs",
    "clientHost": "0.0.0.0",
    "clientAddress": "0.0.0.0",
    "client_id": "rs",
    "username": "service-account-rs",
    "active": true
}

On Wed, 21 Nov 2018 at 15:41, Julien Deruere <deruere.julien at gmail.com>
wrote:

> This is all I see
>
> {
>   "jti": "6cfa6dd3-a3dd-4f5b-8560-f91832e7a35f",
>   "exp": 1542811409,
>   "nbf": 0,
>   "iat": 1542811109,
>   "iss": "http://my-keycloak:8080/auth/realms/my-realm",
>   "sub": "055a376e-d8eb-49cf-9d5f-a83226448131",
>   "typ": "Bearer",
>   "azp": "my-api-gateway",
>   "auth_time": 0,
>   "session_state": "10853e1d-ff27-4f4c-b9e1-31339774c5e4",
>   "acr": "1",
>   "scope": "profile email",
>   "clientId": "my-api-gateway",
>   "clientHost": "172.19.0.1",
>   "email_verified": false,
>   "preferred_username": "service-account-my-api-gateway",
>   "clientAddress": "172.19.0.1",
>   "email": "service-account-my-api-gateway at placeholder.org"
> }
>
> Le mer. 21 nov. 2018 ? 05:57, Pedro Igor Silva <psilva at redhat.com> a
> ?crit :
>
>> Yes, you should see a claim like this:
>>
>> "resource_access": {
>>     "{client_id}": {
>>       "roles": [
>>         "{client_role}"
>>       ]
>>     }
>>   }
>>
>> On Tue, Nov 20, 2018 at 5:22 PM Geoffrey Cleaves <geoff at opticks.io>
>> wrote:
>>
>>> I understand that the client is supposed to have the role given the
>>> Admin Console settings, but does the token show that role when you
>>> introspect it?
>>>
>>> On Tue, Nov 20, 2018, 18:02 Julien Deruere <deruere.julien at gmail.com
>>> wrote:
>>>
>>>> That's exactly what I did/checked. That's why I can't figure out why
>>>> it's
>>>> not working :(
>>>>
>>>> Le mar. 20 nov. 2018 11:53, Pedro Igor Silva <psilva at redhat.com> a
>>>> ?crit :
>>>>
>>>> > This role should be a client role. For instance, if you are trying to
>>>> > create resources for C1 the service account must be granted with
>>>> client
>>>> > role C1/uma-protection. See screenshot attached.
>>>> >
>>>> > Regards.
>>>> >
>>>> > On Tue, Nov 20, 2018 at 2:01 PM Julien Deruere <
>>>> deruere.julien at gmail.com>
>>>> > wrote:
>>>> >
>>>> >> In this case I'm using protection API:
>>>> >>
>>>> >> curl -X POST \
>>>> >>     -H "Content-Type: application/x-www-form-urlencoded" \
>>>> >>     -d
>>>> 'grant_type=client_credentials&client_id=${client_id}&client_secret=${client_secret}'
>>>> \
>>>> >>     "
>>>> http://localhost:8080/auth/realms/${realm_name}/protocol/openid-connect/token
>>>> "
>>>> >>
>>>> >>
>>>> >> I'm asking a token as a client, not as a user. And I checked, my
>>>> client
>>>> >> has the uma_protection role in Service Account Role.
>>>> >>
>>>> >> I don't know where I'm wrong?
>>>> >>
>>>> >> Le mar. 20 nov. 2018 10:54, Pedro Igor Silva <psilva at redhat.com> a
>>>> >> ?crit :
>>>> >>
>>>> >>> Hi,
>>>> >>>
>>>> >>> You need to grant uma_protection client scope (it should be
>>>> available as
>>>> >>> one of the roles associated with your resource server) to the user
>>>> to which
>>>> >>> you are issuing tokens for.
>>>> >>>
>>>> >>> On Tue, Nov 20, 2018 at 1:52 PM Julien Deruere <
>>>> deruere.julien at gmail.com>
>>>> >>> wrote:
>>>> >>>
>>>> >>>> Any update on this?
>>>> >>>> I got the exact same message when using POSTMAN :
>>>> >>>>
>>>> >>>> I fist do this (with grant_type=client_credentials):
>>>> >>>>
>>>> http://localhost:8080/auth/realms/sg2b/protocol/openid-connect/token
>>>> >>>>
>>>> >>>> And then this with the token I received:
>>>> >>>> GET
>>>> >>>>
>>>> >>>>
>>>> http://localhost:8080/auth/realms/sg2b/authz/protection/resource_set?type=zone
>>>> >>>> Which answer me this:
>>>> >>>> {
>>>> >>>>     "error": "invalid_scope",
>>>> >>>>     "error_description": "Requires uma_protection scope."
>>>> >>>> }
>>>> >>>>
>>>> >>> _______________________________________________
>>>> >>>> keycloak-user mailing list
>>>> >>>> keycloak-user at lists.jboss.org
>>>> >>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>> >>>>
>>>> >>>
>>>> _______________________________________________
>>>> keycloak-user mailing list
>>>> keycloak-user at lists.jboss.org
>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>
>>>

From deruere.julien at gmail.com  Wed Nov 21 09:58:34 2018
From: deruere.julien at gmail.com (Julien Deruere)
Date: Wed, 21 Nov 2018 09:58:34 -0500
Subject: [keycloak-user] Requires uma_protection scope
In-Reply-To: <CAHzT=q8ZCqo5tpY1Fd_XND1JNDq4EoWGZv=z_+1Gq-UXE0-Rxw@mail.gmail.com>
References: <CAOPHCg_qifS4Bmywnn05v_TuoKbxmLVVhwr+XAfhK=mQZnak8A@mail.gmail.com>
	<CAJrcDBfRaj1g0nJR6kiNu9E0KhfaTiQy=V0niz-X-k2aaO4_5A@mail.gmail.com>
	<CAOPHCg8fss_TT+R9BU0TRSA_N0EFjdcauco==aGSwqQ7G+T-bQ@mail.gmail.com>
	<CAJrcDBfHnOAnmn66CSHvOOrxyDgY2-qiu31=TZtmZS9GWBFhfw@mail.gmail.com>
	<CAOPHCg8WvftbwOd=wc4=krj2g2h1-NvE3oGCnVyoDgx8kfXb1A@mail.gmail.com>
	<CAHzT=q-qGvat3+dMkrR0AodYx1gNhnz6EA1xcsuNrBD850YBVw@mail.gmail.com>
	<CAJrcDBdK36FTaJ+o6_=X0WozvMXADvhS_85wZrER_SzvrFcONg@mail.gmail.com>
	<CAOPHCg-dKPkATXV7_uPGvSD_hjgHNJzWVvHs9+O68ctO=zB7VA@mail.gmail.com>
	<CAHzT=q8ZCqo5tpY1Fd_XND1JNDq4EoWGZv=z_+1Gq-UXE0-Rxw@mail.gmail.com>
Message-ID: <CAOPHCg8n8gW4yA4skechUGqi6Vt7i=KP50YYD4XAHDfJci_VGw@mail.gmail.com>

Right, definitely something wrong with my client. I'll checkout.

{
  "jti": "5c75799a-9e76-4802-8f71-ff20e72fea8c",
  "exp": 1542812525,
  "nbf": 0,
  "iat": 1542812225,
  "iss": "http://my-keycloak:8080/auth/realms/new_realm",
  "aud": [
    "new_client",
    "account"
  ],
  "sub": "df1d7282-6044-4c1d-8c0a-cb4bef82633c",
  "typ": "Bearer",
  "azp": "new_client",
  "auth_time": 0,
  "session_state": "5f45d8f3-fe88-487f-82fb-3e5eae4eb4b1",
  "acr": "1",
  "realm_access": {
    "roles": [
      "offline_access",
      "uma_authorization"
    ]
  },
  "resource_access": {
    "new_client": {
      "roles": [
        "uma_protection"
      ]
    },
    "account": {
      "roles": [
        "manage-account",
        "manage-account-links",
        "view-profile"
      ]
    }
  },
  "scope": "email profile",
  "clientHost": "172.19.0.1",
  "clientId": "new_client",
  "email_verified": false,
  "preferred_username": "service-account-new_client",
  "clientAddress": "172.19.0.1",
  "email": "service-account-new_client at placeholder.org"
}

Le mer. 21 nov. 2018 ? 09:53, Geoffrey Cleaves <geoff at opticks.io> a ?crit :

> My tokens look like this. What if you "reboot", create a new client and
> test it there.
>
> {
>     "jti": "5c5a8",
>     "exp": 1542812146,
>     "nbf": 0,
>     "iat": 1542811846,
>     "iss": "https://fblah",
>     "aud": [
>         "account",
>         "opticks-rs"
>     ],
>     "sub": "dee58194-6b2b31d",
>     "typ": "Bearer",
>     "azp": "rs",
>     "auth_time": 0,
>     "session_state": "a96958c1e5",
>     "preferred_username": "service-account-rs",
>     "email": "service-account-rs at placeholder.org",
>     "email_verified": false,
>     "acr": "1",
>     "realm_access": {
>         "roles": [
>             "offline_access",
>             "uma_authorization"
>         ]
>     },
>     "resource_access": {
>         "account": {
>             "roles": [
>                 "manage-account",
>                 "manage-account-links",
>                 "view-profile"
>             ]
>         },
>         "opticks-rs": {
>             "roles": [
>                 "uma_protection"
>             ]
>         }
>     },
>     "scope": "email profile",
>     "clientId": "rs",
>     "clientHost": "0.0.0.0",
>     "clientAddress": "0.0.0.0",
>     "client_id": "rs",
>     "username": "service-account-rs",
>     "active": true
> }
>
> On Wed, 21 Nov 2018 at 15:41, Julien Deruere <deruere.julien at gmail.com>
> wrote:
>
>> This is all I see
>>
>> {
>>   "jti": "6cfa6dd3-a3dd-4f5b-8560-f91832e7a35f",
>>   "exp": 1542811409,
>>   "nbf": 0,
>>   "iat": 1542811109,
>>   "iss": "http://my-keycloak:8080/auth/realms/my-realm",
>>   "sub": "055a376e-d8eb-49cf-9d5f-a83226448131",
>>   "typ": "Bearer",
>>   "azp": "my-api-gateway",
>>   "auth_time": 0,
>>   "session_state": "10853e1d-ff27-4f4c-b9e1-31339774c5e4",
>>   "acr": "1",
>>   "scope": "profile email",
>>   "clientId": "my-api-gateway",
>>   "clientHost": "172.19.0.1",
>>   "email_verified": false,
>>   "preferred_username": "service-account-my-api-gateway",
>>   "clientAddress": "172.19.0.1",
>>   "email": "service-account-my-api-gateway at placeholder.org"
>> }
>>
>> Le mer. 21 nov. 2018 ? 05:57, Pedro Igor Silva <psilva at redhat.com> a
>> ?crit :
>>
>>> Yes, you should see a claim like this:
>>>
>>> "resource_access": {
>>>     "{client_id}": {
>>>       "roles": [
>>>         "{client_role}"
>>>       ]
>>>     }
>>>   }
>>>
>>> On Tue, Nov 20, 2018 at 5:22 PM Geoffrey Cleaves <geoff at opticks.io>
>>> wrote:
>>>
>>>> I understand that the client is supposed to have the role given the
>>>> Admin Console settings, but does the token show that role when you
>>>> introspect it?
>>>>
>>>> On Tue, Nov 20, 2018, 18:02 Julien Deruere <deruere.julien at gmail.com
>>>> wrote:
>>>>
>>>>> That's exactly what I did/checked. That's why I can't figure out why
>>>>> it's
>>>>> not working :(
>>>>>
>>>>> Le mar. 20 nov. 2018 11:53, Pedro Igor Silva <psilva at redhat.com> a
>>>>> ?crit :
>>>>>
>>>>> > This role should be a client role. For instance, if you are trying to
>>>>> > create resources for C1 the service account must be granted with
>>>>> client
>>>>> > role C1/uma-protection. See screenshot attached.
>>>>> >
>>>>> > Regards.
>>>>> >
>>>>> > On Tue, Nov 20, 2018 at 2:01 PM Julien Deruere <
>>>>> deruere.julien at gmail.com>
>>>>> > wrote:
>>>>> >
>>>>> >> In this case I'm using protection API:
>>>>> >>
>>>>> >> curl -X POST \
>>>>> >>     -H "Content-Type: application/x-www-form-urlencoded" \
>>>>> >>     -d
>>>>> 'grant_type=client_credentials&client_id=${client_id}&client_secret=${client_secret}'
>>>>> \
>>>>> >>     "
>>>>> http://localhost:8080/auth/realms/${realm_name}/protocol/openid-connect/token
>>>>> "
>>>>> >>
>>>>> >>
>>>>> >> I'm asking a token as a client, not as a user. And I checked, my
>>>>> client
>>>>> >> has the uma_protection role in Service Account Role.
>>>>> >>
>>>>> >> I don't know where I'm wrong?
>>>>> >>
>>>>> >> Le mar. 20 nov. 2018 10:54, Pedro Igor Silva <psilva at redhat.com> a
>>>>> >> ?crit :
>>>>> >>
>>>>> >>> Hi,
>>>>> >>>
>>>>> >>> You need to grant uma_protection client scope (it should be
>>>>> available as
>>>>> >>> one of the roles associated with your resource server) to the user
>>>>> to which
>>>>> >>> you are issuing tokens for.
>>>>> >>>
>>>>> >>> On Tue, Nov 20, 2018 at 1:52 PM Julien Deruere <
>>>>> deruere.julien at gmail.com>
>>>>> >>> wrote:
>>>>> >>>
>>>>> >>>> Any update on this?
>>>>> >>>> I got the exact same message when using POSTMAN :
>>>>> >>>>
>>>>> >>>> I fist do this (with grant_type=client_credentials):
>>>>> >>>>
>>>>> http://localhost:8080/auth/realms/sg2b/protocol/openid-connect/token
>>>>> >>>>
>>>>> >>>> And then this with the token I received:
>>>>> >>>> GET
>>>>> >>>>
>>>>> >>>>
>>>>> http://localhost:8080/auth/realms/sg2b/authz/protection/resource_set?type=zone
>>>>> >>>> Which answer me this:
>>>>> >>>> {
>>>>> >>>>     "error": "invalid_scope",
>>>>> >>>>     "error_description": "Requires uma_protection scope."
>>>>> >>>> }
>>>>> >>>>
>>>>> >>> _______________________________________________
>>>>> >>>> keycloak-user mailing list
>>>>> >>>> keycloak-user at lists.jboss.org
>>>>> >>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>> >>>>
>>>>> >>>
>>>>> _______________________________________________
>>>>> keycloak-user mailing list
>>>>> keycloak-user at lists.jboss.org
>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>
>>>>

From deruere.julien at gmail.com  Wed Nov 21 10:06:18 2018
From: deruere.julien at gmail.com (Julien Deruere)
Date: Wed, 21 Nov 2018 10:06:18 -0500
Subject: [keycloak-user] Requires uma_protection scope
In-Reply-To: <CAOPHCg8n8gW4yA4skechUGqi6Vt7i=KP50YYD4XAHDfJci_VGw@mail.gmail.com>
References: <CAOPHCg_qifS4Bmywnn05v_TuoKbxmLVVhwr+XAfhK=mQZnak8A@mail.gmail.com>
	<CAJrcDBfRaj1g0nJR6kiNu9E0KhfaTiQy=V0niz-X-k2aaO4_5A@mail.gmail.com>
	<CAOPHCg8fss_TT+R9BU0TRSA_N0EFjdcauco==aGSwqQ7G+T-bQ@mail.gmail.com>
	<CAJrcDBfHnOAnmn66CSHvOOrxyDgY2-qiu31=TZtmZS9GWBFhfw@mail.gmail.com>
	<CAOPHCg8WvftbwOd=wc4=krj2g2h1-NvE3oGCnVyoDgx8kfXb1A@mail.gmail.com>
	<CAHzT=q-qGvat3+dMkrR0AodYx1gNhnz6EA1xcsuNrBD850YBVw@mail.gmail.com>
	<CAJrcDBdK36FTaJ+o6_=X0WozvMXADvhS_85wZrER_SzvrFcONg@mail.gmail.com>
	<CAOPHCg-dKPkATXV7_uPGvSD_hjgHNJzWVvHs9+O68ctO=zB7VA@mail.gmail.com>
	<CAHzT=q8ZCqo5tpY1Fd_XND1JNDq4EoWGZv=z_+1Gq-UXE0-Rxw@mail.gmail.com>
	<CAOPHCg8n8gW4yA4skechUGqi6Vt7i=KP50YYD4XAHDfJci_VGw@mail.gmail.com>
Message-ID: <CAOPHCg-PZiRQ5tcTxbfwHgZA2WE+O5qpK5V1HpiJQSQ9zBPATA@mail.gmail.com>

The difference between my two clients was in "Client Scopes", "web-origins"
and "profile" were not assign. Are these new scope? Cause in another
environment there are also not assigned by default (the client was created
in a previous version of Keycloak)

Le mer. 21 nov. 2018 ? 09:58, Julien Deruere <deruere.julien at gmail.com> a
?crit :

> Right, definitely something wrong with my client. I'll checkout.
>
> {
>   "jti": "5c75799a-9e76-4802-8f71-ff20e72fea8c",
>   "exp": 1542812525,
>   "nbf": 0,
>   "iat": 1542812225,
>   "iss": "http://my-keycloak:8080/auth/realms/new_realm",
>   "aud": [
>     "new_client",
>     "account"
>   ],
>   "sub": "df1d7282-6044-4c1d-8c0a-cb4bef82633c",
>   "typ": "Bearer",
>   "azp": "new_client",
>   "auth_time": 0,
>   "session_state": "5f45d8f3-fe88-487f-82fb-3e5eae4eb4b1",
>   "acr": "1",
>   "realm_access": {
>     "roles": [
>       "offline_access",
>       "uma_authorization"
>     ]
>   },
>   "resource_access": {
>     "new_client": {
>       "roles": [
>         "uma_protection"
>       ]
>     },
>     "account": {
>       "roles": [
>         "manage-account",
>         "manage-account-links",
>         "view-profile"
>       ]
>     }
>   },
>   "scope": "email profile",
>   "clientHost": "172.19.0.1",
>   "clientId": "new_client",
>   "email_verified": false,
>   "preferred_username": "service-account-new_client",
>   "clientAddress": "172.19.0.1",
>   "email": "service-account-new_client at placeholder.org"
> }
>
> Le mer. 21 nov. 2018 ? 09:53, Geoffrey Cleaves <geoff at opticks.io> a
> ?crit :
>
>> My tokens look like this. What if you "reboot", create a new client and
>> test it there.
>>
>> {
>>     "jti": "5c5a8",
>>     "exp": 1542812146,
>>     "nbf": 0,
>>     "iat": 1542811846,
>>     "iss": "https://fblah",
>>     "aud": [
>>         "account",
>>         "opticks-rs"
>>     ],
>>     "sub": "dee58194-6b2b31d",
>>     "typ": "Bearer",
>>     "azp": "rs",
>>     "auth_time": 0,
>>     "session_state": "a96958c1e5",
>>     "preferred_username": "service-account-rs",
>>     "email": "service-account-rs at placeholder.org",
>>     "email_verified": false,
>>     "acr": "1",
>>     "realm_access": {
>>         "roles": [
>>             "offline_access",
>>             "uma_authorization"
>>         ]
>>     },
>>     "resource_access": {
>>         "account": {
>>             "roles": [
>>                 "manage-account",
>>                 "manage-account-links",
>>                 "view-profile"
>>             ]
>>         },
>>         "opticks-rs": {
>>             "roles": [
>>                 "uma_protection"
>>             ]
>>         }
>>     },
>>     "scope": "email profile",
>>     "clientId": "rs",
>>     "clientHost": "0.0.0.0",
>>     "clientAddress": "0.0.0.0",
>>     "client_id": "rs",
>>     "username": "service-account-rs",
>>     "active": true
>> }
>>
>> On Wed, 21 Nov 2018 at 15:41, Julien Deruere <deruere.julien at gmail.com>
>> wrote:
>>
>>> This is all I see
>>>
>>> {
>>>   "jti": "6cfa6dd3-a3dd-4f5b-8560-f91832e7a35f",
>>>   "exp": 1542811409,
>>>   "nbf": 0,
>>>   "iat": 1542811109,
>>>   "iss": "http://my-keycloak:8080/auth/realms/my-realm",
>>>   "sub": "055a376e-d8eb-49cf-9d5f-a83226448131",
>>>   "typ": "Bearer",
>>>   "azp": "my-api-gateway",
>>>   "auth_time": 0,
>>>   "session_state": "10853e1d-ff27-4f4c-b9e1-31339774c5e4",
>>>   "acr": "1",
>>>   "scope": "profile email",
>>>   "clientId": "my-api-gateway",
>>>   "clientHost": "172.19.0.1",
>>>   "email_verified": false,
>>>   "preferred_username": "service-account-my-api-gateway",
>>>   "clientAddress": "172.19.0.1",
>>>   "email": "service-account-my-api-gateway at placeholder.org"
>>> }
>>>
>>> Le mer. 21 nov. 2018 ? 05:57, Pedro Igor Silva <psilva at redhat.com> a
>>> ?crit :
>>>
>>>> Yes, you should see a claim like this:
>>>>
>>>> "resource_access": {
>>>>     "{client_id}": {
>>>>       "roles": [
>>>>         "{client_role}"
>>>>       ]
>>>>     }
>>>>   }
>>>>
>>>> On Tue, Nov 20, 2018 at 5:22 PM Geoffrey Cleaves <geoff at opticks.io>
>>>> wrote:
>>>>
>>>>> I understand that the client is supposed to have the role given the
>>>>> Admin Console settings, but does the token show that role when you
>>>>> introspect it?
>>>>>
>>>>> On Tue, Nov 20, 2018, 18:02 Julien Deruere <deruere.julien at gmail.com
>>>>> wrote:
>>>>>
>>>>>> That's exactly what I did/checked. That's why I can't figure out why
>>>>>> it's
>>>>>> not working :(
>>>>>>
>>>>>> Le mar. 20 nov. 2018 11:53, Pedro Igor Silva <psilva at redhat.com> a
>>>>>> ?crit :
>>>>>>
>>>>>> > This role should be a client role. For instance, if you are trying
>>>>>> to
>>>>>> > create resources for C1 the service account must be granted with
>>>>>> client
>>>>>> > role C1/uma-protection. See screenshot attached.
>>>>>> >
>>>>>> > Regards.
>>>>>> >
>>>>>> > On Tue, Nov 20, 2018 at 2:01 PM Julien Deruere <
>>>>>> deruere.julien at gmail.com>
>>>>>> > wrote:
>>>>>> >
>>>>>> >> In this case I'm using protection API:
>>>>>> >>
>>>>>> >> curl -X POST \
>>>>>> >>     -H "Content-Type: application/x-www-form-urlencoded" \
>>>>>> >>     -d
>>>>>> 'grant_type=client_credentials&client_id=${client_id}&client_secret=${client_secret}'
>>>>>> \
>>>>>> >>     "
>>>>>> http://localhost:8080/auth/realms/${realm_name}/protocol/openid-connect/token
>>>>>> "
>>>>>> >>
>>>>>> >>
>>>>>> >> I'm asking a token as a client, not as a user. And I checked, my
>>>>>> client
>>>>>> >> has the uma_protection role in Service Account Role.
>>>>>> >>
>>>>>> >> I don't know where I'm wrong?
>>>>>> >>
>>>>>> >> Le mar. 20 nov. 2018 10:54, Pedro Igor Silva <psilva at redhat.com> a
>>>>>> >> ?crit :
>>>>>> >>
>>>>>> >>> Hi,
>>>>>> >>>
>>>>>> >>> You need to grant uma_protection client scope (it should be
>>>>>> available as
>>>>>> >>> one of the roles associated with your resource server) to the
>>>>>> user to which
>>>>>> >>> you are issuing tokens for.
>>>>>> >>>
>>>>>> >>> On Tue, Nov 20, 2018 at 1:52 PM Julien Deruere <
>>>>>> deruere.julien at gmail.com>
>>>>>> >>> wrote:
>>>>>> >>>
>>>>>> >>>> Any update on this?
>>>>>> >>>> I got the exact same message when using POSTMAN :
>>>>>> >>>>
>>>>>> >>>> I fist do this (with grant_type=client_credentials):
>>>>>> >>>>
>>>>>> http://localhost:8080/auth/realms/sg2b/protocol/openid-connect/token
>>>>>> >>>>
>>>>>> >>>> And then this with the token I received:
>>>>>> >>>> GET
>>>>>> >>>>
>>>>>> >>>>
>>>>>> http://localhost:8080/auth/realms/sg2b/authz/protection/resource_set?type=zone
>>>>>> >>>> Which answer me this:
>>>>>> >>>> {
>>>>>> >>>>     "error": "invalid_scope",
>>>>>> >>>>     "error_description": "Requires uma_protection scope."
>>>>>> >>>> }
>>>>>> >>>>
>>>>>> >>> _______________________________________________
>>>>>> >>>> keycloak-user mailing list
>>>>>> >>>> keycloak-user at lists.jboss.org
>>>>>> >>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>>> >>>>
>>>>>> >>>
>>>>>> _______________________________________________
>>>>>> keycloak-user mailing list
>>>>>> keycloak-user at lists.jboss.org
>>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>>
>>>>>

From dt at acutus.pro  Wed Nov 21 10:13:21 2018
From: dt at acutus.pro (Dmitry Telegin)
Date: Wed, 21 Nov 2018 18:13:21 +0300
Subject: [keycloak-user] Limit re-send verification emails
In-Reply-To: <CADy1qmm-wPQumivt_2z25kTW=uC4BOqv2PYhuHXLWHm-v4WvJQ@mail.gmail.com>
References: <CADy1qmm-wPQumivt_2z25kTW=uC4BOqv2PYhuHXLWHm-v4WvJQ@mail.gmail.com>
Message-ID: <1542813201.5656.7.camel@acutus.pro>

Hello Viktor,

I'm afraid this is not out-of-the-box in Keycloak, but the good news is that you can implement it yourself.

Create a RequiredActionProvider by extending org.keycloak.authentication.requiredactions.VerifyEmail, override processAction() and implement the necessary throttling. You can store the timestamp of the last re-send as a user attribute.

I'd also suggest that you create a JIRA ticket so that this feature gets included into upstream Keycloak.

Good luck,
Dmitry Telegin
CTO, Acutus s.r.o.
Keycloak Consulting and Training

Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
+42 (022) 888-30-71
E-mail: info at acutus.pro

On Wed, 2018-11-21 at 14:20 +0100, Viktor Chuchurski wrote:
> Hello all,
> 
> I have a question regarding re-sending of verification emails.
> 
> Is it somehow possible to configure how often can the user request a
> re-send?
> As far as I looked, currently there is no check when the last re-send was
> requested, which allows a third party to spam "click" the resend button and
> cause problems on the mail server.
> 
> Thanks in advance,
> Viktor
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From dt at acutus.pro  Wed Nov 21 10:17:27 2018
From: dt at acutus.pro (Dmitry Telegin)
Date: Wed, 21 Nov 2018 18:17:27 +0300
Subject: [keycloak-user] group mapper per client
In-Reply-To: <VI1PR0402MB3696DDAC0203A15B8A3D4000E9DA0@VI1PR0402MB3696.eurprd04.prod.outlook.com>
References: <VI1PR0402MB3696F22D057049DF4B800480E9F30@VI1PR0402MB3696.eurprd04.prod.outlook.com>
	<1540868804.2121.1.camel@acutus.pro>
	<VI1PR0402MB3696AC0B264006DEB14A50EDE9CD0@VI1PR0402MB3696.eurprd04.prod.outlook.com>
	<1541805512.2031.3.camel@acutus.pro>	<1542617533.2282.3.camel@acutus.pro>
	<VI1PR0402MB3696E444AAB354F8B93A8305E9DA0@VI1PR0402MB3696.eurprd04.prod.outlook.com>
	<VI1PR0402MB3696DDAC0203A15B8A3D4000E9DA0@VI1PR0402MB3696.eurprd04.prod.outlook.com>
Message-ID: <1542813447.5656.9.camel@acutus.pro>

Hi Ronald,

On Wed, 2018-11-21 at 09:11 +0000, Ronald Demneri wrote:
> Btw, how's the blog post on Groups shaping up? Can you provide a link once you post it?

Sure, I'll post the link under this thread and also in LinkedIn. Stay tuned :)

Dmitry

> 
> 
> Regards,
> Ronald
> 
> -----Original Message-----
> > From: keycloak-user-bounces at lists.jboss.org <keycloak-user-bounces at lists.jboss.org> On Behalf Of Ronald Demneri
> Sent: 21.Nov.2018 10:06 AM
> > To: Dmitry Telegin <dt at acutus.pro>; keycloak-user at lists.jboss.org
> Subject: Re: [keycloak-user] group mapper per client
> 
> Dear Dmitry,
> 
> I tested your suggestion and it is working as per our needs/requirements. Many thanks for the support, very appreciated!
> 
> 
> Best Regards,
> Ronald
> 
> -----Original Message-----
> > From: Dmitry Telegin <dt at acutus.pro>
> Sent: 19.Nov.2018 9:52 AM
> > To: Ronald Demneri <ronald.demneri at amdtia.com>; keycloak-user at lists.jboss.org
> Subject: Re: [keycloak-user] group mapper per client
> 
> Hello Ronald,
> 
> It has turned out there's an easy way to overcome the issue with SSO cookie, without turning off SSO itself.
> 
> Let's imagine that your script authenticator looks like the following:
> 
> =============================================================
> AuthenticationFlowError = Java.type("org.keycloak.authentication.AuthenticationFlowError");
> 
> function invalidGroup(context) {
> ????return context.form()
> ????????????.setError("Invalid group membership", []).createLogin(); }
> 
> function authenticate(context) {
> 
> ????var clientId = authenticationSession.client.clientId;
> ????var username = user ? user.username : "anonymous";
> ????LOG.info(script.name + " trace auth for: " + username);
> ????
> ????var groups = Java.from(user.groups)
> ????????.filter(function(group) {
> ????????????return RegExp("(.*)-" + clientId + "-(.*)", "i").test(group.name);
> ????????});
> 
> ????var authShouldFail = !(groups.length);
> ????
> ????if (authShouldFail) {
> ????????var challengeResponse = invalidGroup(context)
> ????????context.failureChallenge(AuthenticationFlowError.INVALID_CREDENTIALS, challengeResponse);
> ????????return;
> ????}
> 
> ????context.success();
> ????
> }
> =============================================================
> 
> The idea is to wrap Keycloak's standard browser flow into a subflow, add your authenticator after it, and make both REQUIRED (see attached image).
> 
> In this case, the authenticator will be executed unconditionally, even in the case of SSO cookie presence (in the opposite to ALTERNATIVE). This should finally solve the problem.
> 
> Good luck,
> Dmitry Telegin
> CTO, Acutus s.r.o.
> Keycloak Consulting and Training
> 
> Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
> +42 (022) 888-30-71
> E-mail: info at acutus.pro
> 
> On Sat, 2018-11-10 at 02:18 +0300, Dmitry Telegin wrote:
> > Ronald, glad to hear it worked,
> > 
> > There is however an important moment regarding potential security issue with your authenticator.
> > 
> > Imagine the following scenario:
> > 1. a user?with the correct group membership logs into the client app?
> > A; 2. the same user tries to access client B (for which he/she doesn't?
> > have group membership); 3. client B redirects the user to Keycloak for?
> > authentication; 4. due to cookie-based SSO, Keycloak decides that the user is already authenticated and logs him/her in client B.
> > 
> > To avoid this, you should turn off cookie-based auth for your restricted clients. Go to Authentication, create a copy of your browser flow (which should already have your script authenticator), remove Cookie, then go to your clients' settings and configure Authentication Flow Overrides for browser flow.
> > 
> > This will actually disable SSO to your clients. If this is not acceptable, there are some other options to consider (however more complex).
> > 
> > You should also make sure you don't enable token exchange between clients [1] (this is disabled by default).
> > 
> > [1]
> > https://www.keycloak.org/docs/latest/securing_apps/index.html#internal
> > -token-to-internal-token-exchange
> > 
> > Good luck,
> > Dmitry Telegin
> > CTO, Acutus s.r.o.
> > Keycloak Consulting and Training
> > 
> > Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
> > +42 (022) 888-30-71
> > E-mail: info at acutus.pro
> > 
> > On Wed, 2018-10-31 at 13:49 +0000, Ronald Demneri wrote:
> > > Hello everyone,
> > > 
> > > So, thankfully, after some careful reading, I managed to solve the first issue regarding clientSession.client.clientId, which in fact shoud be authenticationSession.client.clientId (there was a mention on using loginSession.client.clientId in place of clientSession.client.clientId on this link https://issues.jboss.org/browse/KEYCLOAK-4505, which I tried to use, without success).
> > > 
> > > 
> > > Regards,
> > > Ronald
> > > 
> > > -----Original Message-----
> > > From: Ronald Demneri
> > > Sent: 30.Oct.2018 3:48 PM
> > > > > > > > To: 'Dmitry Telegin' <dt at acutus.pro>;?
> > > > keycloak-user at lists.jboss.org
> > > 
> > > Subject: RE: [keycloak-user] group mapper per client
> > > 
> > > Almost forgot, If I set a static group name to compare against (which is not our goal, but just for testing), it works correctly if the account is member of that group. If the user is not a member, then it'll display an error like "Invalid username or password". Is it possible to modify the response in such cases, stating that the account is not a member of required groups, or at least have it like "Invalid group membership".
> > > 
> > > 
> > > Looking forward to hearing from you!
> > > 
> > > 
> > > Regards,
> > > Ronald
> > > 
> > > -----Original Message-----
> > > > From: Dmitry Telegin <dt at acutus.pro>
> > > 
> > > Sent: 30.Oct.2018 4:07 AM
> > > > > > > > To: Ronald Demneri <ronald.demneri at amdtia.com>;?
> > > > keycloak-user at lists.jboss.org
> > > 
> > > Subject: Re: [keycloak-user] group mapper per client
> > > 
> > > Hello Ronald,
> > > 
> > > If there is a literal correspondence between your AD group names and client names (like e.g. if the client is named "foo", and the corresponding AD group is "AD_group_foo"), you can do the following trick:
> > > - make sure you have group-ldap-mapper configured in LDAP mappers,?
> > > i.e. AD groups are synced to Keycloak groups;
> > > - create a Javascript authenticator that would check client name against user's groups, and add it to your authentication flow. If the user tries to authenticate against the client without being a member of the corresponding group, the authenticator should deny login.
> > > 
> > > If there is no such correspondence (e.g. the client is named "foo", and the group is "AD_group_bar"), you still have the following options:
> > > - map AD groups to Keycloak roles using role-ldap-mapper, then use?
> > > your adapter's configuration to restrict access only to the users?
> > > with this role (e.g. <security-constraint> in web.xml);
> > > - or map AD groups to Keycloak groups, enable authorization services and use group policy (if your client adapter supports authorization, of course).
> > > 
> > > This, however, will need to be configured per each client, on the contrary to the first approach (configured once per realm).
> > > 
> > > Let me know if you need further explanations, Dmitry Telegin CTO, Acutus s.r.o.
> > > Keycloak Consulting and Training
> > > 
> > > Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
> > > +42 (022) 888-30-71
> > > E-mail: info at acutus.pro
> > > 
> > > On Mon, 2018-10-29 at 15:35 +0000, Ronald Demneri wrote:
> > > > Hello everyone,
> > > > 
> > > > Please forgive me if this was already asked previously. After creating the LDAP connection (read-only) and some LDAP mappers, I am trying to figure out a way how to allow login to clients for users in respective groups in AD, for example for client app1 allow login to users that are members of AD_group_app1; if account is not a member of the app1 group in AD, then he should not be allowed to login. Is it also possible to do it via role mappings? Please note that we'd like to avoid modification of AD at all costs.
> > > > 
> > > > 
> > > > Thanks in advance,
> > > > Ronald
> > > > _______________________________________________
> > > > keycloak-user mailing list
> > > > keycloak-user at lists.jboss.org
> > > > https://lists.jboss.org/mailman/listinfo/keycloak-user
> > 
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
> 
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From dt at acutus.pro  Wed Nov 21 10:30:00 2018
From: dt at acutus.pro (Dmitry Telegin)
Date: Wed, 21 Nov 2018 18:30:00 +0300
Subject: [keycloak-user] Keycloak Admin Realm is not upgraded on
 Keycloak upgrade from v3.0 to v4.5
In-Reply-To: <847A59EDBBC62D43BEE2CFA482C6CB6A648CDD29@NP1EXMB105.corp.halliburton.com>
References: <847A59EDBBC62D43BEE2CFA482C6CB6A648CDD29@NP1EXMB105.corp.halliburton.com>
Message-ID: <1542814200.5656.13.camel@acutus.pro>

Hello Deepti,

On terminology: by "custom admin realm", do you mean simply a non-master realm in Keycloak that you've created yourself?

On upgrade process: normally, you don't need to export/import realm data during upgrades, since schema+data migration will be performed by Keycloak itself (it uses Liquibase under the hood). You only migrate your .xml configs, and then simply run the new Keycloak version with the same database connection. Did you try this?

Generally, it's not easy to troubleshoot issues like this without having access to the realm data. Could you please try to prepare a minimal working example that a) would demonstrate your issue, b) would be reproducible?
Like e.g.:
1. Install Keycloak 3.0;
2. Add a non-master realm;
3. Add a user;
4. Configure a client;
5. Install Wildfly adapter;
6. Upgrade Keycloak 4.5;
7. Observe authentication errors

That would be really helpful. Cheers,
Dmitry Telegin
CTO, Acutus s.r.o.
Keycloak Consulting and Training

Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
+42 (022) 888-30-71
E-mail: info at acutus.pro

On Wed, 2018-11-21 at 07:28 +0000, Deepti Tyagi wrote:
> Hi Team,
> 
> I am working on upgrading our in-house Keycloak Server from v3.0 to v4.5. Facing issue on trying to re-use old custom admin realm. Is there any way we can re-use the old admin realm or preserve at least users?
> 
> We have another Wildfly 10 application that use Keycloak v3.0 for authentication purpose using a custom admin realm (custom-realm.json) that have multiple clients, roles, users and protocol mappers.
> 
> While upgrading keycloak, I had run migration scripts to upgrade standalone, domain.xmls. Postgres DB also gets upgraded and able to login to Keycloak using the same admin user in v3.0.
> Though, our Wildfly 10 application isn't able to authenticate with keycloak using that old custom-realm (with new jboss adapters even).
> I had to re-create a new custom admin realm, created same clients, roles, users to make it work. And had to trash old realm that deleted all users also.
> 
> I also tried multiple workarounds like;
> 1. Created a new custom-realm on v4.5 and compared with v3.0 on keycloak UI, no visible difference.
> 2. Partially re-imported new custom realm having same clients and roles. No help.
> 3. Trashed old realm and imported new custom realm, then tried partially importing old custom realm users. Its not allowed. (KC-SERVICES0037: Error creating user: java.lang.RuntimeException: Unable to find client role mappings for client: ds-data)
> 
> With the 3rd attempt, I can see at least keycloak login page on our wildfly 10 application but can not login till I create admin user manually.
> 
> With 1st and 2nd attempt, I do not even see keycloak login page on our wildfly 10 application and below exception is thrown in keycloak server.log.
> 
> 2018-11-20 23:56:30,691 WARN??[org.keycloak.events] (default task-2) type=LOGIN_ERROR, realmId=DecisionSpace_Integration_Server, clientId=dsis-console, userId=null, ipAddress=127.0.0.1, error=invalid_user_credentials, auth_method=openid-connect, auth_type=code, response_type=code, redirect_uri=http://localhost:8080/dsdataserver-console/, code_id=a50ff093-64b8-43d2-a353-2a3ec1346297, response_mode=query
> 2018-11-20 23:56:30,692 ERROR [org.keycloak.services.error.KeycloakErrorHandler] (default task-2) Uncaught server error: java.lang.NullPointerException
> at org.keycloak.theme.ExtendingThemeManager.loadTheme(ExtendingThemeManager.java:117)
> at org.keycloak.theme.ExtendingThemeManager.getTheme(ExtendingThemeManager.java:95)
> at org.keycloak.theme.DefaultThemeManager.getTheme(DefaultThemeManager.java:26)
> at org.keycloak.theme.DefaultThemeManager.getTheme(DefaultThemeManager.java:21)
> at org.keycloak.forms.login.freemarker.FreeMarkerLoginFormsProvider.getTheme(FreeMarkerLoginFormsProvider.java:267)
> at org.keycloak.forms.login.freemarker.FreeMarkerLoginFormsProvider.createResponse(FreeMarkerLoginFormsProvider.java:160)
> at org.keycloak.forms.login.freemarker.FreeMarkerLoginFormsProvider.createErrorPage(FreeMarkerLoginFormsProvider.java:506)
> at org.keycloak.services.ErrorPage.error(ErrorPage.java:31)
> at org.keycloak.authentication.AuthenticationProcessor.handleBrowserException(AuthenticationProcessor.java:728)
> at org.keycloak.protocol.AuthorizationEndpointBase.handleBrowserAuthenticationRequest(AuthorizationEndpointBase.java:143)
> at org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint.buildAuthorizationCodeAuthorizationResponse(AuthorizationEndpoint.java:409)
> at org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint.process(AuthorizationEndpoint.java:152)
> at org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint.buildGet(AuthorizationEndpoint.java:108)
> at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
> at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
> at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
> at java.lang.reflect.Method.invoke(Method.java:498)
> at org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java:140)
> at org.jboss.resteasy.core.ResourceMethodInvoker.internalInvokeOnTarget(ResourceMethodInvoker.java:510)
> at org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTargetAfterFilter(ResourceMethodInvoker.java:401)
> at org.jboss.resteasy.core.ResourceMethodInvoker.lambda$invokeOnTarget$0(ResourceMethodInvoker.java:365)
> at org.jboss.resteasy.core.interception.PreMatchContainerRequestContext.filter(PreMatchContainerRequestContext.java:361)
> at org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTarget(ResourceMethodInvoker.java:367)
> at org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:339)
> at org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(ResourceLocatorInvoker.java:137)
> at org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:106)
> at org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(ResourceLocatorInvoker.java:132)
> at org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:100)
> at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:441)
> at org.jboss.resteasy.core.SynchronousDispatcher.lambda$invoke$4(SynchronousDispatcher.java:231)
> at org.jboss.resteasy.core.SynchronousDispatcher.lambda$preprocess$0(SynchronousDispatcher.java:137)
> at org.jboss.resteasy.core.interception.PreMatchContainerRequestContext.filter(PreMatchContainerRequestContext.java:361)
> at org.jboss.resteasy.core.SynchronousDispatcher.preprocess(SynchronousDispatcher.java:140)
> at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:217)
> at org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:227)
> at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56)
> at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51)
> at javax.servlet.http.HttpServlet.service(HttpServlet.java:790)
> at io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:74)
> at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129)
> at org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:90)
> at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61)
> at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
> at io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84)
> at io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62)
> at io.undertow.servlet.handlers.ServletChain$1.handleRequest(ServletChain.java:68)
> at io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
> at org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78)
> at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
> at io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:132)
> at io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57)
> at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
> at io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)
> at io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)
> at io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)
> at io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77)
> at io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50)
> at io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)
> at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
> at org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)
> at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
> at org.wildfly.extension.undertow.deployment.GlobalRequestControllerHandler.handleRequest(GlobalRequestControllerHandler.java:68)
> at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
> at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:292)
> at io.undertow.servlet.handlers.ServletInitialHandler.access$100(ServletInitialHandler.java:81)
> at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:138)
> at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:135)
> at io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:48)
> at io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43)
> at org.wildfly.extension.undertow.security.SecurityContextThreadSetupAction.lambda$create$0(SecurityContextThreadSetupAction.java:105)
> at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1514)
> at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1514)
> at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1514)
> at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1514)
> at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:272)
> at io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81)
> at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:104)
> at io.undertow.server.Connectors.executeRootHandler(Connectors.java:360)
> at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:830)
> at org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35)
> at org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1985)
> at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1487)
> at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1378)
> at java.lang.Thread.run(Thread.java:748)
> 
> Thanks,
> Deepti
> 
> ----------------------------------------------------------------------
> This e-mail, including any attached files, may contain confidential and privileged information for the sole use of the intended recipient.??Any review, use, distribution, or disclosure by others is strictly prohibited.??If you are not the intended recipient (or authorized to receive information for the intended recipient), please contact the sender by reply e-mail and delete all copies of this message.
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From dt at acutus.pro  Wed Nov 21 10:58:11 2018
From: dt at acutus.pro (Dmitry Telegin)
Date: Wed, 21 Nov 2018 18:58:11 +0300
Subject: [keycloak-user] running 2 different keycloak clusters sharing
 the same database ( 1 cluster to create new realms,
 and another for all other access)
In-Reply-To: <488776964.3402283.1542773191546@mail.yahoo.com>
References: <488776964.3402283.1542773191546.ref@mail.yahoo.com>
	<488776964.3402283.1542773191546@mail.yahoo.com>
Message-ID: <1542815891.5656.17.camel@acutus.pro>

Hello Madhu,

Technically, these don't need to be separate "clusters". Clustering in Keycloak assumes that all the nodes should be the members of the same Infinispan pool. But you can configure your loadbalancer so that requests to a special hostname (like eg. "admin.your-domain.tld") are dispatched to a subset of dedicated nodes.

But the overall approach seems suboptimal to me. While not performing admin tasks like creating realms, your dedicated nodes will stay idle and just eat RAM. I'd rather suggest that you consider the scenario where your loadbalancer should monitor node CPU load via e.g. SNMP, and use that metrics for dynamic round-robin load-balancing.

Cheers,
Dmitry Telegin
CTO, Acutus s.r.o.
Keycloak Consulting and Training

Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
+42 (022) 888-30-71
E-mail: info at acutus.pro

On Wed, 2018-11-21 at 04:06 +0000, Madhu wrote:
> Hi,
> Have a weird question,? I want to run 2 different keycloak clusters, one for creating realms and another for accessing realms/login and all other activity.
> Is this kind of setup possible, have any body tried it before?
> The 1st cluster just takes requests for provisioning new realms and any one time setup (like creating the admin user in realm, giving him specific access only etc)
> After that, all interactions login, token creating, provisioning further user etc will take place through the other cluster..?
> I see that realm creation in my case ( realm has few user groups, client scopes, mappers (java script mapper), other custom mappers, about 10 clients, client specific roles etc) is a cpu intensive process and realm creation when we have about 80 to 100 relams(tenants) takes any where between 20 to 30 sec with cpu usage spiking to 100%.
> So, wanted to test if having a separate instance/cluster for realm creation will help and ease the load on other cluster which servers typical login/logout and all other requests. Any insights here will be much appreciated.
> - Would like to know if this could corrupt the keycloak schema?- I am ok if the new realms are not eagerly loaded in infispan cache (of the other cluster which handles regular request), but this should start loading the new realm the moment a login request comes ( i am ok for the first few logins to be slow).
> 
> RegardsMadhu
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From psilva at redhat.com  Wed Nov 21 11:32:37 2018
From: psilva at redhat.com (Pedro Igor Silva)
Date: Wed, 21 Nov 2018 14:32:37 -0200
Subject: [keycloak-user] Requires uma_protection scope
In-Reply-To: <CAOPHCg-PZiRQ5tcTxbfwHgZA2WE+O5qpK5V1HpiJQSQ9zBPATA@mail.gmail.com>
References: <CAOPHCg_qifS4Bmywnn05v_TuoKbxmLVVhwr+XAfhK=mQZnak8A@mail.gmail.com>
	<CAJrcDBfRaj1g0nJR6kiNu9E0KhfaTiQy=V0niz-X-k2aaO4_5A@mail.gmail.com>
	<CAOPHCg8fss_TT+R9BU0TRSA_N0EFjdcauco==aGSwqQ7G+T-bQ@mail.gmail.com>
	<CAJrcDBfHnOAnmn66CSHvOOrxyDgY2-qiu31=TZtmZS9GWBFhfw@mail.gmail.com>
	<CAOPHCg8WvftbwOd=wc4=krj2g2h1-NvE3oGCnVyoDgx8kfXb1A@mail.gmail.com>
	<CAHzT=q-qGvat3+dMkrR0AodYx1gNhnz6EA1xcsuNrBD850YBVw@mail.gmail.com>
	<CAJrcDBdK36FTaJ+o6_=X0WozvMXADvhS_85wZrER_SzvrFcONg@mail.gmail.com>
	<CAOPHCg-dKPkATXV7_uPGvSD_hjgHNJzWVvHs9+O68ctO=zB7VA@mail.gmail.com>
	<CAHzT=q8ZCqo5tpY1Fd_XND1JNDq4EoWGZv=z_+1Gq-UXE0-Rxw@mail.gmail.com>
	<CAOPHCg8n8gW4yA4skechUGqi6Vt7i=KP50YYD4XAHDfJci_VGw@mail.gmail.com>
	<CAOPHCg-PZiRQ5tcTxbfwHgZA2WE+O5qpK5V1HpiJQSQ9zBPATA@mail.gmail.com>
Message-ID: <CAJrcDBdN-6+JyAAATyc2pyQvLyGU75gWC++2c+e6ndw2YXPb8g@mail.gmail.com>

What about the "roles" client scope ? You should have this one too assigned
to your client ...

On Wed, Nov 21, 2018 at 1:06 PM Julien Deruere <deruere.julien at gmail.com>
wrote:

> The difference between my two clients was in "Client Scopes",
> "web-origins" and "profile" were not assign. Are these new scope? Cause in
> another environment there are also not assigned by default (the client was
> created in a previous version of Keycloak)
>
> Le mer. 21 nov. 2018 ? 09:58, Julien Deruere <deruere.julien at gmail.com> a
> ?crit :
>
>> Right, definitely something wrong with my client. I'll checkout.
>>
>> {
>>   "jti": "5c75799a-9e76-4802-8f71-ff20e72fea8c",
>>   "exp": 1542812525,
>>   "nbf": 0,
>>   "iat": 1542812225,
>>   "iss": "http://my-keycloak:8080/auth/realms/new_realm",
>>   "aud": [
>>     "new_client",
>>     "account"
>>   ],
>>   "sub": "df1d7282-6044-4c1d-8c0a-cb4bef82633c",
>>   "typ": "Bearer",
>>   "azp": "new_client",
>>   "auth_time": 0,
>>   "session_state": "5f45d8f3-fe88-487f-82fb-3e5eae4eb4b1",
>>   "acr": "1",
>>   "realm_access": {
>>     "roles": [
>>       "offline_access",
>>       "uma_authorization"
>>     ]
>>   },
>>   "resource_access": {
>>     "new_client": {
>>       "roles": [
>>         "uma_protection"
>>       ]
>>     },
>>     "account": {
>>       "roles": [
>>         "manage-account",
>>         "manage-account-links",
>>         "view-profile"
>>       ]
>>     }
>>   },
>>   "scope": "email profile",
>>   "clientHost": "172.19.0.1",
>>   "clientId": "new_client",
>>   "email_verified": false,
>>   "preferred_username": "service-account-new_client",
>>   "clientAddress": "172.19.0.1",
>>   "email": "service-account-new_client at placeholder.org"
>> }
>>
>> Le mer. 21 nov. 2018 ? 09:53, Geoffrey Cleaves <geoff at opticks.io> a
>> ?crit :
>>
>>> My tokens look like this. What if you "reboot", create a new client and
>>> test it there.
>>>
>>> {
>>>     "jti": "5c5a8",
>>>     "exp": 1542812146,
>>>     "nbf": 0,
>>>     "iat": 1542811846,
>>>     "iss": "https://fblah",
>>>     "aud": [
>>>         "account",
>>>         "opticks-rs"
>>>     ],
>>>     "sub": "dee58194-6b2b31d",
>>>     "typ": "Bearer",
>>>     "azp": "rs",
>>>     "auth_time": 0,
>>>     "session_state": "a96958c1e5",
>>>     "preferred_username": "service-account-rs",
>>>     "email": "service-account-rs at placeholder.org",
>>>     "email_verified": false,
>>>     "acr": "1",
>>>     "realm_access": {
>>>         "roles": [
>>>             "offline_access",
>>>             "uma_authorization"
>>>         ]
>>>     },
>>>     "resource_access": {
>>>         "account": {
>>>             "roles": [
>>>                 "manage-account",
>>>                 "manage-account-links",
>>>                 "view-profile"
>>>             ]
>>>         },
>>>         "opticks-rs": {
>>>             "roles": [
>>>                 "uma_protection"
>>>             ]
>>>         }
>>>     },
>>>     "scope": "email profile",
>>>     "clientId": "rs",
>>>     "clientHost": "0.0.0.0",
>>>     "clientAddress": "0.0.0.0",
>>>     "client_id": "rs",
>>>     "username": "service-account-rs",
>>>     "active": true
>>> }
>>>
>>> On Wed, 21 Nov 2018 at 15:41, Julien Deruere <deruere.julien at gmail.com>
>>> wrote:
>>>
>>>> This is all I see
>>>>
>>>> {
>>>>   "jti": "6cfa6dd3-a3dd-4f5b-8560-f91832e7a35f",
>>>>   "exp": 1542811409,
>>>>   "nbf": 0,
>>>>   "iat": 1542811109,
>>>>   "iss": "http://my-keycloak:8080/auth/realms/my-realm",
>>>>   "sub": "055a376e-d8eb-49cf-9d5f-a83226448131",
>>>>   "typ": "Bearer",
>>>>   "azp": "my-api-gateway",
>>>>   "auth_time": 0,
>>>>   "session_state": "10853e1d-ff27-4f4c-b9e1-31339774c5e4",
>>>>   "acr": "1",
>>>>   "scope": "profile email",
>>>>   "clientId": "my-api-gateway",
>>>>   "clientHost": "172.19.0.1",
>>>>   "email_verified": false,
>>>>   "preferred_username": "service-account-my-api-gateway",
>>>>   "clientAddress": "172.19.0.1",
>>>>   "email": "service-account-my-api-gateway at placeholder.org"
>>>> }
>>>>
>>>> Le mer. 21 nov. 2018 ? 05:57, Pedro Igor Silva <psilva at redhat.com> a
>>>> ?crit :
>>>>
>>>>> Yes, you should see a claim like this:
>>>>>
>>>>> "resource_access": {
>>>>>     "{client_id}": {
>>>>>       "roles": [
>>>>>         "{client_role}"
>>>>>       ]
>>>>>     }
>>>>>   }
>>>>>
>>>>> On Tue, Nov 20, 2018 at 5:22 PM Geoffrey Cleaves <geoff at opticks.io>
>>>>> wrote:
>>>>>
>>>>>> I understand that the client is supposed to have the role given the
>>>>>> Admin Console settings, but does the token show that role when you
>>>>>> introspect it?
>>>>>>
>>>>>> On Tue, Nov 20, 2018, 18:02 Julien Deruere <deruere.julien at gmail.com
>>>>>> wrote:
>>>>>>
>>>>>>> That's exactly what I did/checked. That's why I can't figure out why
>>>>>>> it's
>>>>>>> not working :(
>>>>>>>
>>>>>>> Le mar. 20 nov. 2018 11:53, Pedro Igor Silva <psilva at redhat.com> a
>>>>>>> ?crit :
>>>>>>>
>>>>>>> > This role should be a client role. For instance, if you are trying
>>>>>>> to
>>>>>>> > create resources for C1 the service account must be granted with
>>>>>>> client
>>>>>>> > role C1/uma-protection. See screenshot attached.
>>>>>>> >
>>>>>>> > Regards.
>>>>>>> >
>>>>>>> > On Tue, Nov 20, 2018 at 2:01 PM Julien Deruere <
>>>>>>> deruere.julien at gmail.com>
>>>>>>> > wrote:
>>>>>>> >
>>>>>>> >> In this case I'm using protection API:
>>>>>>> >>
>>>>>>> >> curl -X POST \
>>>>>>> >>     -H "Content-Type: application/x-www-form-urlencoded" \
>>>>>>> >>     -d
>>>>>>> 'grant_type=client_credentials&client_id=${client_id}&client_secret=${client_secret}'
>>>>>>> \
>>>>>>> >>     "
>>>>>>> http://localhost:8080/auth/realms/${realm_name}/protocol/openid-connect/token
>>>>>>> "
>>>>>>> >>
>>>>>>> >>
>>>>>>> >> I'm asking a token as a client, not as a user. And I checked, my
>>>>>>> client
>>>>>>> >> has the uma_protection role in Service Account Role.
>>>>>>> >>
>>>>>>> >> I don't know where I'm wrong?
>>>>>>> >>
>>>>>>> >> Le mar. 20 nov. 2018 10:54, Pedro Igor Silva <psilva at redhat.com>
>>>>>>> a
>>>>>>> >> ?crit :
>>>>>>> >>
>>>>>>> >>> Hi,
>>>>>>> >>>
>>>>>>> >>> You need to grant uma_protection client scope (it should be
>>>>>>> available as
>>>>>>> >>> one of the roles associated with your resource server) to the
>>>>>>> user to which
>>>>>>> >>> you are issuing tokens for.
>>>>>>> >>>
>>>>>>> >>> On Tue, Nov 20, 2018 at 1:52 PM Julien Deruere <
>>>>>>> deruere.julien at gmail.com>
>>>>>>> >>> wrote:
>>>>>>> >>>
>>>>>>> >>>> Any update on this?
>>>>>>> >>>> I got the exact same message when using POSTMAN :
>>>>>>> >>>>
>>>>>>> >>>> I fist do this (with grant_type=client_credentials):
>>>>>>> >>>>
>>>>>>> http://localhost:8080/auth/realms/sg2b/protocol/openid-connect/token
>>>>>>> >>>>
>>>>>>> >>>> And then this with the token I received:
>>>>>>> >>>> GET
>>>>>>> >>>>
>>>>>>> >>>>
>>>>>>> http://localhost:8080/auth/realms/sg2b/authz/protection/resource_set?type=zone
>>>>>>> >>>> Which answer me this:
>>>>>>> >>>> {
>>>>>>> >>>>     "error": "invalid_scope",
>>>>>>> >>>>     "error_description": "Requires uma_protection scope."
>>>>>>> >>>> }
>>>>>>> >>>>
>>>>>>> >>> _______________________________________________
>>>>>>> >>>> keycloak-user mailing list
>>>>>>> >>>> keycloak-user at lists.jboss.org
>>>>>>> >>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>>>> >>>>
>>>>>>> >>>
>>>>>>> _______________________________________________
>>>>>>> keycloak-user mailing list
>>>>>>> keycloak-user at lists.jboss.org
>>>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>>>
>>>>>>

From pnowak.pierre at gmail.com  Wed Nov 21 11:51:14 2018
From: pnowak.pierre at gmail.com (Pierre Nowak)
Date: Wed, 21 Nov 2018 17:51:14 +0100
Subject: [keycloak-user] docker images 4.6.0.Final
Message-ID: <CAHgxc_wvS+YoGU8mQ2uN1Gd9+Vyf=EB1WWssyC2ovVGY-iOnSQ@mail.gmail.com>

Hello,

When I login to the admin console and do any operation I get an error, the
logs are :

16:35:35,883 ERROR [org.keycloak.services.error.KeycloakErrorHandler]
(default task-2) Uncaught server error: java.lang.NullPointerException
at org.keycloak.services.resources.Cors.build(Cors.java:193)
at
org.keycloak.services.resources.admin.AdminRoot.getRealmsAdmin(AdminRoot.java:211)
at sun.reflect.GeneratedMethodAccessor444.invoke(Unknown Source)
at
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)
at
org.jboss.resteasy.core.ResourceLocatorInvoker.createResource(ResourceLocatorInvoker.java:69)
at
org.jboss.resteasy.core.ResourceLocatorInvoker.createResource(ResourceLocatorInvoker.java:48)
at
org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:99)
at
org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:443)
at
org.jboss.resteasy.core.SynchronousDispatcher.lambda$invoke$4(SynchronousDispatcher.java:233)
at
org.jboss.resteasy.core.SynchronousDispatcher.lambda$preprocess$0(SynchronousDispatcher.java:139)
at
org.jboss.resteasy.core.interception.PreMatchContainerRequestContext.filter(PreMatchContainerRequestContext.java:358)
at
org.jboss.resteasy.core.SynchronousDispatcher.preprocess(SynchronousDispatcher.java:142)
at
org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:219)
at
org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:227)
at
org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56)
at
org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:791)
at
io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:74)
at
io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129)
at
org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:90)
at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61)
at
io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
at
io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84)
at
io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62)
at
io.undertow.servlet.handlers.ServletChain$1.handleRequest(ServletChain.java:68)
at
io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
at
org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78)
at
io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
at
io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:132)
at
io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57)
at
io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
at
io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)
at
io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)
at
io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)
at
io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77)
at
io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50)
at
io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)
at
io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
at
org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)
at
io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
at
org.wildfly.extension.undertow.deployment.GlobalRequestControllerHandler.handleRequest(GlobalRequestControllerHandler.java:68)
at
io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
at
io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:292)
at
io.undertow.servlet.handlers.ServletInitialHandler.access$100(ServletInitialHandler.java:81)
at
io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:138)
at
io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:135)
at
io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:48)
at
io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43)
at
org.wildfly.extension.undertow.security.SecurityContextThreadSetupAction.lambda$create$0(SecurityContextThreadSetupAction.java:105)
at
org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)
at
org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)
at
org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)
at
org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)
at
io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:272)
at
io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81)
at
io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:104)
at io.undertow.server.Connectors.executeRootHandler(Connectors.java:360)
at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:830)
at
org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35)
at
org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1985)
at
org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1487)
at
org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1378)
at java.lang.Thread.run(Thread.java:748)


with the  4.3.0.Final tag it works but with 4.6 (& 4.5) it's broken, any
idea ?

btw I run keycloak with the following comand:


docker run -d --name keycloak \
-p 8080:8080 \
--restart always \
--net keycloak \
-e "DB_VENDOR=MYSQL" \
-e "KEYCLOAK_USER=${KEYCLOAK_USER}" \
-e "KEYCLOAK_PASSWORD=${KEYCLOAK_PASSWORD}" \
-e "KEYCLOAK_LOGLEVEL=DEBUG" \
-e "PROXY_ADDRESS_FORWARDING=true" \
-e "DB_ADDR=mysql" \
-e "DB_DATABASE=keycloak" \
-e "DB_USER=${MYSQL_USER}" \
-e "DB_PASSWORD=${MYSQL_PASSWORD}" \
jboss/keycloak:4.6.0.Final

From marco.lamina at sap.com  Wed Nov 21 12:07:37 2018
From: marco.lamina at sap.com (Lamina, Marco)
Date: Wed, 21 Nov 2018 17:07:37 +0000
Subject: [keycloak-user] 4.6.0 Upgrade disables client scopes
In-Reply-To: <99650048-66d6-e6e5-fee6-e092c0439c9b@redhat.com>
References: <01F89E35-A10A-41BB-8570-73B08353AC62@sap.com>
	<99650048-66d6-e6e5-fee6-e092c0439c9b@redhat.com>
Message-ID: <C3579E6C-8263-47C3-9992-C7CCB0B53A11@sap.com>

To answer your questions:
- I upgraded from 4.5.0 to 4.6.0
- Clicking on "Client Scopes" and "Evaluate", all scopes are shown as expected
- Even when I create a new client and add the scope, it is not added to the token

Thanks,
Marco
 

?On 11/21/18, 5:19 AM, "Marek Posolda" <mposolda at redhat.com> wrote:

    No, it doesn't need to be updated in any profile like Token Exchange.
    
    Question is, from which version you upgraded? Note that during upgrade 
    to 4.0.0, the realm default client scopes are not automatically linked 
    to the clients. Thing is, that clients from previous version already has 
    some protocolMappers defined on them, so the clientScopes are not added 
    to it. You may need to do change your clients manually and remove 
    protocolMappers from them and link them to default client scopes.
    
    Just the new clients, which you will create now through admin UI, will 
    have the client scopes added to them. See details in the docs: 
    https://www.keycloak.org/docs/latest/upgrading/index.html#client-templates-changed-to-client-scopes
    
    BTV. When you're on client, you can click to "Client Scopes" and then 
    "Evaluate" to see what are applied client scopes and check what 
    clientScopes will be applied based on the value of "scope" parameter.
    
    Marek
    
    On 21/11/2018 01:55, Lamina, Marco wrote:
    > Hi,
    > I upgraded to 4.6.0 using the Kubernetes Helm chart. After the upgrade, token exchange stopped working, which I was able to fix thanks to [1]. Unfortunately, none of my client scopes are working anymore. Trying to get a token using client credentials succeeds, but anything I pass into the ?scope? parameter is ignored and none of my default client scopes are applied. The ?scope? claim in the token endpoint response is always empty.
    > Is that a feature that needs to be enabled similar to the token exchange?
    >
    > [1] https://stackoverflow.com/questions/53367566/unable-to-setup-idp-token-exchange-in-keycloak-4-6-0-final
    >
    > Thanks,
    > Marco
    >
    > _______________________________________________
    > keycloak-user mailing list
    > keycloak-user at lists.jboss.org
    > https://lists.jboss.org/mailman/listinfo/keycloak-user
    
    
    



From geoff at opticks.io  Wed Nov 21 12:45:53 2018
From: geoff at opticks.io (Geoffrey Cleaves)
Date: Wed, 21 Nov 2018 18:45:53 +0100
Subject: [keycloak-user] docker images 4.6.0.Final
In-Reply-To: <CAHgxc_wvS+YoGU8mQ2uN1Gd9+Vyf=EB1WWssyC2ovVGY-iOnSQ@mail.gmail.com>
References: <CAHgxc_wvS+YoGU8mQ2uN1Gd9+Vyf=EB1WWssyC2ovVGY-iOnSQ@mail.gmail.com>
Message-ID: <CAHzT=q_x1ov01gLv4LWmJgoZ6g1cW9hj6Y1okWnUStsJrme2ww@mail.gmail.com>

Lower debug level to info or use Firefox. See earlier messages about this
issue.

On Wed, Nov 21, 2018, 18:13 Pierre Nowak <pnowak.pierre at gmail.com wrote:

> Hello,
>
> When I login to the admin console and do any operation I get an error, the
> logs are :
>
> 16:35:35,883 ERROR [org.keycloak.services.error.KeycloakErrorHandler]
> (default task-2) Uncaught server error: java.lang.NullPointerException
> at org.keycloak.services.resources.Cors.build(Cors.java:193)
> at
>
> org.keycloak.services.resources.admin.AdminRoot.getRealmsAdmin(AdminRoot.java:211)
> at sun.reflect.GeneratedMethodAccessor444.invoke(Unknown Source)
> at
>
> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
> at java.lang.reflect.Method.invoke(Method.java:498)
> at
>
> org.jboss.resteasy.core.ResourceLocatorInvoker.createResource(ResourceLocatorInvoker.java:69)
> at
>
> org.jboss.resteasy.core.ResourceLocatorInvoker.createResource(ResourceLocatorInvoker.java:48)
> at
>
> org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:99)
> at
>
> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:443)
> at
>
> org.jboss.resteasy.core.SynchronousDispatcher.lambda$invoke$4(SynchronousDispatcher.java:233)
> at
>
> org.jboss.resteasy.core.SynchronousDispatcher.lambda$preprocess$0(SynchronousDispatcher.java:139)
> at
>
> org.jboss.resteasy.core.interception.PreMatchContainerRequestContext.filter(PreMatchContainerRequestContext.java:358)
> at
>
> org.jboss.resteasy.core.SynchronousDispatcher.preprocess(SynchronousDispatcher.java:142)
> at
>
> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:219)
> at
>
> org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:227)
> at
>
> org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56)
> at
>
> org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51)
> at javax.servlet.http.HttpServlet.service(HttpServlet.java:791)
> at
>
> io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:74)
> at
>
> io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129)
> at
>
> org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:90)
> at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61)
> at
>
> io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
> at
>
> io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84)
> at
>
> io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62)
> at
>
> io.undertow.servlet.handlers.ServletChain$1.handleRequest(ServletChain.java:68)
> at
>
> io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
> at
>
> org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78)
> at
>
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
> at
>
> io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:132)
> at
>
> io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57)
> at
>
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
> at
>
> io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)
> at
>
> io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)
> at
>
> io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)
> at
>
> io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77)
> at
>
> io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50)
> at
>
> io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)
> at
>
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
> at
>
> org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)
> at
>
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
> at
>
> org.wildfly.extension.undertow.deployment.GlobalRequestControllerHandler.handleRequest(GlobalRequestControllerHandler.java:68)
> at
>
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
> at
>
> io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:292)
> at
>
> io.undertow.servlet.handlers.ServletInitialHandler.access$100(ServletInitialHandler.java:81)
> at
>
> io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:138)
> at
>
> io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:135)
> at
>
> io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:48)
> at
>
> io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43)
> at
>
> org.wildfly.extension.undertow.security.SecurityContextThreadSetupAction.lambda$create$0(SecurityContextThreadSetupAction.java:105)
> at
>
> org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)
> at
>
> org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)
> at
>
> org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)
> at
>
> org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)
> at
>
> io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:272)
> at
>
> io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81)
> at
>
> io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:104)
> at io.undertow.server.Connectors.executeRootHandler(Connectors.java:360)
> at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:830)
> at
>
> org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35)
> at
>
> org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1985)
> at
>
> org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1487)
> at
>
> org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1378)
> at java.lang.Thread.run(Thread.java:748)
>
>
> with the  4.3.0.Final tag it works but with 4.6 (& 4.5) it's broken, any
> idea ?
>
> btw I run keycloak with the following comand:
>
>
> docker run -d --name keycloak \
> -p 8080:8080 \
> --restart always \
> --net keycloak \
> -e "DB_VENDOR=MYSQL" \
> -e "KEYCLOAK_USER=${KEYCLOAK_USER}" \
> -e "KEYCLOAK_PASSWORD=${KEYCLOAK_PASSWORD}" \
> -e "KEYCLOAK_LOGLEVEL=DEBUG" \
> -e "PROXY_ADDRESS_FORWARDING=true" \
> -e "DB_ADDR=mysql" \
> -e "DB_DATABASE=keycloak" \
> -e "DB_USER=${MYSQL_USER}" \
> -e "DB_PASSWORD=${MYSQL_PASSWORD}" \
> jboss/keycloak:4.6.0.Final
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

From pnowak.pierre at gmail.com  Wed Nov 21 12:53:47 2018
From: pnowak.pierre at gmail.com (Pierre Nowak)
Date: Wed, 21 Nov 2018 18:53:47 +0100
Subject: [keycloak-user] docker images 4.6.0.Final
In-Reply-To: <CAHzT=q_x1ov01gLv4LWmJgoZ6g1cW9hj6Y1okWnUStsJrme2ww@mail.gmail.com>
References: <CAHgxc_wvS+YoGU8mQ2uN1Gd9+Vyf=EB1WWssyC2ovVGY-iOnSQ@mail.gmail.com>
	<CAHzT=q_x1ov01gLv4LWmJgoZ6g1cW9hj6Y1okWnUStsJrme2ww@mail.gmail.com>
Message-ID: <CAHgxc_xCnuyg8ygvY_YA_xrNmhmt8rV9fbDsw3-F5S=KJLTTiA@mail.gmail.com>

Lower debug level to info => it worked thanks

Le mer. 21 nov. 2018 ? 18:46, Geoffrey Cleaves <geoff at opticks.io> a ?crit :

> Lower debug level to info or use Firefox. See earlier messages about this
> issue.
>
> On Wed, Nov 21, 2018, 18:13 Pierre Nowak <pnowak.pierre at gmail.com wrote:
>
>> Hello,
>>
>> When I login to the admin console and do any operation I get an error, the
>> logs are :
>>
>> 16:35:35,883 ERROR [org.keycloak.services.error.KeycloakErrorHandler]
>> (default task-2) Uncaught server error: java.lang.NullPointerException
>> at org.keycloak.services.resources.Cors.build(Cors.java:193)
>> at
>>
>> org.keycloak.services.resources.admin.AdminRoot.getRealmsAdmin(AdminRoot.java:211)
>> at sun.reflect.GeneratedMethodAccessor444.invoke(Unknown Source)
>> at
>>
>> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
>> at java.lang.reflect.Method.invoke(Method.java:498)
>> at
>>
>> org.jboss.resteasy.core.ResourceLocatorInvoker.createResource(ResourceLocatorInvoker.java:69)
>> at
>>
>> org.jboss.resteasy.core.ResourceLocatorInvoker.createResource(ResourceLocatorInvoker.java:48)
>> at
>>
>> org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:99)
>> at
>>
>> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:443)
>> at
>>
>> org.jboss.resteasy.core.SynchronousDispatcher.lambda$invoke$4(SynchronousDispatcher.java:233)
>> at
>>
>> org.jboss.resteasy.core.SynchronousDispatcher.lambda$preprocess$0(SynchronousDispatcher.java:139)
>> at
>>
>> org.jboss.resteasy.core.interception.PreMatchContainerRequestContext.filter(PreMatchContainerRequestContext.java:358)
>> at
>>
>> org.jboss.resteasy.core.SynchronousDispatcher.preprocess(SynchronousDispatcher.java:142)
>> at
>>
>> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:219)
>> at
>>
>> org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:227)
>> at
>>
>> org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56)
>> at
>>
>> org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51)
>> at javax.servlet.http.HttpServlet.service(HttpServlet.java:791)
>> at
>>
>> io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:74)
>> at
>>
>> io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129)
>> at
>>
>> org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:90)
>> at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61)
>> at
>>
>> io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
>> at
>>
>> io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84)
>> at
>>
>> io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62)
>> at
>>
>> io.undertow.servlet.handlers.ServletChain$1.handleRequest(ServletChain.java:68)
>> at
>>
>> io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
>> at
>>
>> org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78)
>> at
>>
>> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>> at
>>
>> io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:132)
>> at
>>
>> io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57)
>> at
>>
>> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>> at
>>
>> io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)
>> at
>>
>> io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)
>> at
>>
>> io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)
>> at
>>
>> io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77)
>> at
>>
>> io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50)
>> at
>>
>> io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)
>> at
>>
>> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>> at
>>
>> org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)
>> at
>>
>> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>> at
>>
>> org.wildfly.extension.undertow.deployment.GlobalRequestControllerHandler.handleRequest(GlobalRequestControllerHandler.java:68)
>> at
>>
>> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>> at
>>
>> io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:292)
>> at
>>
>> io.undertow.servlet.handlers.ServletInitialHandler.access$100(ServletInitialHandler.java:81)
>> at
>>
>> io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:138)
>> at
>>
>> io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:135)
>> at
>>
>> io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:48)
>> at
>>
>> io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43)
>> at
>>
>> org.wildfly.extension.undertow.security.SecurityContextThreadSetupAction.lambda$create$0(SecurityContextThreadSetupAction.java:105)
>> at
>>
>> org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)
>> at
>>
>> org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)
>> at
>>
>> org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)
>> at
>>
>> org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)
>> at
>>
>> io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:272)
>> at
>>
>> io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81)
>> at
>>
>> io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:104)
>> at io.undertow.server.Connectors.executeRootHandler(Connectors.java:360)
>> at
>> io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:830)
>> at
>>
>> org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35)
>> at
>>
>> org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1985)
>> at
>>
>> org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1487)
>> at
>>
>> org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1378)
>> at java.lang.Thread.run(Thread.java:748)
>>
>>
>> with the  4.3.0.Final tag it works but with 4.6 (& 4.5) it's broken, any
>> idea ?
>>
>> btw I run keycloak with the following comand:
>>
>>
>> docker run -d --name keycloak \
>> -p 8080:8080 \
>> --restart always \
>> --net keycloak \
>> -e "DB_VENDOR=MYSQL" \
>> -e "KEYCLOAK_USER=${KEYCLOAK_USER}" \
>> -e "KEYCLOAK_PASSWORD=${KEYCLOAK_PASSWORD}" \
>> -e "KEYCLOAK_LOGLEVEL=DEBUG" \
>> -e "PROXY_ADDRESS_FORWARDING=true" \
>> -e "DB_ADDR=mysql" \
>> -e "DB_DATABASE=keycloak" \
>> -e "DB_USER=${MYSQL_USER}" \
>> -e "DB_PASSWORD=${MYSQL_PASSWORD}" \
>> jboss/keycloak:4.6.0.Final
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>

From bruno at abstractj.org  Wed Nov 21 13:14:52 2018
From: bruno at abstractj.org (Bruno Oliveira)
Date: Wed, 21 Nov 2018 16:14:52 -0200
Subject: [keycloak-user] docker images 4.6.0.Final
In-Reply-To: <CAHgxc_xCnuyg8ygvY_YA_xrNmhmt8rV9fbDsw3-F5S=KJLTTiA@mail.gmail.com>
References: <CAHgxc_wvS+YoGU8mQ2uN1Gd9+Vyf=EB1WWssyC2ovVGY-iOnSQ@mail.gmail.com>
	<CAHzT=q_x1ov01gLv4LWmJgoZ6g1cW9hj6Y1okWnUStsJrme2ww@mail.gmail.com>
	<CAHgxc_xCnuyg8ygvY_YA_xrNmhmt8rV9fbDsw3-F5S=KJLTTiA@mail.gmail.com>
Message-ID: <CAM5SUC5Fw4XM2OjsGOxLHRifYQXFw4EYW34y2k+W33_o3u7qEg@mail.gmail.com>

I believe this relates to
https://issues.jboss.org/browse/KEYCLOAK-8916. Feel free to comment on
that if you would like to provide more details.
On Wed, Nov 21, 2018 at 3:56 PM Pierre Nowak <pnowak.pierre at gmail.com> wrote:
>
> Lower debug level to info => it worked thanks
>
> Le mer. 21 nov. 2018 ? 18:46, Geoffrey Cleaves <geoff at opticks.io> a ?crit :
>
> > Lower debug level to info or use Firefox. See earlier messages about this
> > issue.
> >
> > On Wed, Nov 21, 2018, 18:13 Pierre Nowak <pnowak.pierre at gmail.com wrote:
> >
> >> Hello,
> >>
> >> When I login to the admin console and do any operation I get an error, the
> >> logs are :
> >>
> >> 16:35:35,883 ERROR [org.keycloak.services.error.KeycloakErrorHandler]
> >> (default task-2) Uncaught server error: java.lang.NullPointerException
> >> at org.keycloak.services.resources.Cors.build(Cors.java:193)
> >> at
> >>
> >> org.keycloak.services.resources.admin.AdminRoot.getRealmsAdmin(AdminRoot.java:211)
> >> at sun.reflect.GeneratedMethodAccessor444.invoke(Unknown Source)
> >> at
> >>
> >> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
> >> at java.lang.reflect.Method.invoke(Method.java:498)
> >> at
> >>
> >> org.jboss.resteasy.core.ResourceLocatorInvoker.createResource(ResourceLocatorInvoker.java:69)
> >> at
> >>
> >> org.jboss.resteasy.core.ResourceLocatorInvoker.createResource(ResourceLocatorInvoker.java:48)
> >> at
> >>
> >> org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:99)
> >> at
> >>
> >> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:443)
> >> at
> >>
> >> org.jboss.resteasy.core.SynchronousDispatcher.lambda$invoke$4(SynchronousDispatcher.java:233)
> >> at
> >>
> >> org.jboss.resteasy.core.SynchronousDispatcher.lambda$preprocess$0(SynchronousDispatcher.java:139)
> >> at
> >>
> >> org.jboss.resteasy.core.interception.PreMatchContainerRequestContext.filter(PreMatchContainerRequestContext.java:358)
> >> at
> >>
> >> org.jboss.resteasy.core.SynchronousDispatcher.preprocess(SynchronousDispatcher.java:142)
> >> at
> >>
> >> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:219)
> >> at
> >>
> >> org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:227)
> >> at
> >>
> >> org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56)
> >> at
> >>
> >> org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51)
> >> at javax.servlet.http.HttpServlet.service(HttpServlet.java:791)
> >> at
> >>
> >> io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:74)
> >> at
> >>
> >> io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129)
> >> at
> >>
> >> org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:90)
> >> at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61)
> >> at
> >>
> >> io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
> >> at
> >>
> >> io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84)
> >> at
> >>
> >> io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62)
> >> at
> >>
> >> io.undertow.servlet.handlers.ServletChain$1.handleRequest(ServletChain.java:68)
> >> at
> >>
> >> io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
> >> at
> >>
> >> org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78)
> >> at
> >>
> >> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
> >> at
> >>
> >> io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:132)
> >> at
> >>
> >> io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57)
> >> at
> >>
> >> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
> >> at
> >>
> >> io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)
> >> at
> >>
> >> io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)
> >> at
> >>
> >> io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)
> >> at
> >>
> >> io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77)
> >> at
> >>
> >> io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50)
> >> at
> >>
> >> io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)
> >> at
> >>
> >> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
> >> at
> >>
> >> org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)
> >> at
> >>
> >> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
> >> at
> >>
> >> org.wildfly.extension.undertow.deployment.GlobalRequestControllerHandler.handleRequest(GlobalRequestControllerHandler.java:68)
> >> at
> >>
> >> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
> >> at
> >>
> >> io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:292)
> >> at
> >>
> >> io.undertow.servlet.handlers.ServletInitialHandler.access$100(ServletInitialHandler.java:81)
> >> at
> >>
> >> io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:138)
> >> at
> >>
> >> io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:135)
> >> at
> >>
> >> io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:48)
> >> at
> >>
> >> io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43)
> >> at
> >>
> >> org.wildfly.extension.undertow.security.SecurityContextThreadSetupAction.lambda$create$0(SecurityContextThreadSetupAction.java:105)
> >> at
> >>
> >> org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)
> >> at
> >>
> >> org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)
> >> at
> >>
> >> org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)
> >> at
> >>
> >> org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)
> >> at
> >>
> >> io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:272)
> >> at
> >>
> >> io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81)
> >> at
> >>
> >> io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:104)
> >> at io.undertow.server.Connectors.executeRootHandler(Connectors.java:360)
> >> at
> >> io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:830)
> >> at
> >>
> >> org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35)
> >> at
> >>
> >> org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1985)
> >> at
> >>
> >> org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1487)
> >> at
> >>
> >> org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1378)
> >> at java.lang.Thread.run(Thread.java:748)
> >>
> >>
> >> with the  4.3.0.Final tag it works but with 4.6 (& 4.5) it's broken, any
> >> idea ?
> >>
> >> btw I run keycloak with the following comand:
> >>
> >>
> >> docker run -d --name keycloak \
> >> -p 8080:8080 \
> >> --restart always \
> >> --net keycloak \
> >> -e "DB_VENDOR=MYSQL" \
> >> -e "KEYCLOAK_USER=${KEYCLOAK_USER}" \
> >> -e "KEYCLOAK_PASSWORD=${KEYCLOAK_PASSWORD}" \
> >> -e "KEYCLOAK_LOGLEVEL=DEBUG" \
> >> -e "PROXY_ADDRESS_FORWARDING=true" \
> >> -e "DB_ADDR=mysql" \
> >> -e "DB_DATABASE=keycloak" \
> >> -e "DB_USER=${MYSQL_USER}" \
> >> -e "DB_PASSWORD=${MYSQL_PASSWORD}" \
> >> jboss/keycloak:4.6.0.Final
> >> _______________________________________________
> >> keycloak-user mailing list
> >> keycloak-user at lists.jboss.org
> >> https://lists.jboss.org/mailman/listinfo/keycloak-user
> >>
> >
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user



-- 
- abstractj


From Betty.Louie at leidos.com  Wed Nov 21 15:28:37 2018
From: Betty.Louie at leidos.com (Louie, Betty)
Date: Wed, 21 Nov 2018 20:28:37 +0000
Subject: [keycloak-user] Prefill Custom Attribute for User
Message-ID: <D81B2A24.29F8%betty.louie@leidos.com>

Hi All,

I?m trying to pass along a value to be set as a custom attribute on the user when they register for a keycloak account. I was trying to implement something along the lines of this http://lists.jboss.org/pipermail/keycloak-user/2018-May/013874.html where the value gets passed along as a query param and I grab the value from the query string and set it as a user attribute in a script. This isn?t reliable because if the registration form doesn?t pass the necessary validation, the page is refreshed and the query parameters are removed from the url.

I was wondering if anyone else has needed to pass along a value to be prefilled on the registration form and how you were able to get around it or if there is another way to keep hold of some value before and after the user registers for an account.

Thanks,
Betty

From deruere.julien at gmail.com  Wed Nov 21 15:47:28 2018
From: deruere.julien at gmail.com (Julien Deruere)
Date: Wed, 21 Nov 2018 15:47:28 -0500
Subject: [keycloak-user] Requires uma_protection scope
In-Reply-To: <CAJrcDBdN-6+JyAAATyc2pyQvLyGU75gWC++2c+e6ndw2YXPb8g@mail.gmail.com>
References: <CAOPHCg_qifS4Bmywnn05v_TuoKbxmLVVhwr+XAfhK=mQZnak8A@mail.gmail.com>
	<CAJrcDBfRaj1g0nJR6kiNu9E0KhfaTiQy=V0niz-X-k2aaO4_5A@mail.gmail.com>
	<CAOPHCg8fss_TT+R9BU0TRSA_N0EFjdcauco==aGSwqQ7G+T-bQ@mail.gmail.com>
	<CAJrcDBfHnOAnmn66CSHvOOrxyDgY2-qiu31=TZtmZS9GWBFhfw@mail.gmail.com>
	<CAOPHCg8WvftbwOd=wc4=krj2g2h1-NvE3oGCnVyoDgx8kfXb1A@mail.gmail.com>
	<CAHzT=q-qGvat3+dMkrR0AodYx1gNhnz6EA1xcsuNrBD850YBVw@mail.gmail.com>
	<CAJrcDBdK36FTaJ+o6_=X0WozvMXADvhS_85wZrER_SzvrFcONg@mail.gmail.com>
	<CAOPHCg-dKPkATXV7_uPGvSD_hjgHNJzWVvHs9+O68ctO=zB7VA@mail.gmail.com>
	<CAHzT=q8ZCqo5tpY1Fd_XND1JNDq4EoWGZv=z_+1Gq-UXE0-Rxw@mail.gmail.com>
	<CAOPHCg8n8gW4yA4skechUGqi6Vt7i=KP50YYD4XAHDfJci_VGw@mail.gmail.com>
	<CAOPHCg-PZiRQ5tcTxbfwHgZA2WE+O5qpK5V1HpiJQSQ9zBPATA@mail.gmail.com>
	<CAJrcDBdN-6+JyAAATyc2pyQvLyGU75gWC++2c+e6ndw2YXPb8g@mail.gmail.com>
Message-ID: <CAOPHCg8JD9e6NOPj3fW_Hb+pB0fKFzX7i1mHGSgkuvcVjf2bEA@mail.gmail.com>

Yes this one was already assigned, it was just about "web-origins" and
"profile".

Le mer. 21 nov. 2018 ? 11:32, Pedro Igor Silva <psilva at redhat.com> a ?crit :

> What about the "roles" client scope ? You should have this one too
> assigned to your client ...
>
> On Wed, Nov 21, 2018 at 1:06 PM Julien Deruere <deruere.julien at gmail.com>
> wrote:
>
>> The difference between my two clients was in "Client Scopes",
>> "web-origins" and "profile" were not assign. Are these new scope? Cause in
>> another environment there are also not assigned by default (the client was
>> created in a previous version of Keycloak)
>>
>> Le mer. 21 nov. 2018 ? 09:58, Julien Deruere <deruere.julien at gmail.com>
>> a ?crit :
>>
>>> Right, definitely something wrong with my client. I'll checkout.
>>>
>>> {
>>>   "jti": "5c75799a-9e76-4802-8f71-ff20e72fea8c",
>>>   "exp": 1542812525,
>>>   "nbf": 0,
>>>   "iat": 1542812225,
>>>   "iss": "http://my-keycloak:8080/auth/realms/new_realm",
>>>   "aud": [
>>>     "new_client",
>>>     "account"
>>>   ],
>>>   "sub": "df1d7282-6044-4c1d-8c0a-cb4bef82633c",
>>>   "typ": "Bearer",
>>>   "azp": "new_client",
>>>   "auth_time": 0,
>>>   "session_state": "5f45d8f3-fe88-487f-82fb-3e5eae4eb4b1",
>>>   "acr": "1",
>>>   "realm_access": {
>>>     "roles": [
>>>       "offline_access",
>>>       "uma_authorization"
>>>     ]
>>>   },
>>>   "resource_access": {
>>>     "new_client": {
>>>       "roles": [
>>>         "uma_protection"
>>>       ]
>>>     },
>>>     "account": {
>>>       "roles": [
>>>         "manage-account",
>>>         "manage-account-links",
>>>         "view-profile"
>>>       ]
>>>     }
>>>   },
>>>   "scope": "email profile",
>>>   "clientHost": "172.19.0.1",
>>>   "clientId": "new_client",
>>>   "email_verified": false,
>>>   "preferred_username": "service-account-new_client",
>>>   "clientAddress": "172.19.0.1",
>>>   "email": "service-account-new_client at placeholder.org"
>>> }
>>>
>>> Le mer. 21 nov. 2018 ? 09:53, Geoffrey Cleaves <geoff at opticks.io> a
>>> ?crit :
>>>
>>>> My tokens look like this. What if you "reboot", create a new client and
>>>> test it there.
>>>>
>>>> {
>>>>     "jti": "5c5a8",
>>>>     "exp": 1542812146,
>>>>     "nbf": 0,
>>>>     "iat": 1542811846,
>>>>     "iss": "https://fblah",
>>>>     "aud": [
>>>>         "account",
>>>>         "opticks-rs"
>>>>     ],
>>>>     "sub": "dee58194-6b2b31d",
>>>>     "typ": "Bearer",
>>>>     "azp": "rs",
>>>>     "auth_time": 0,
>>>>     "session_state": "a96958c1e5",
>>>>     "preferred_username": "service-account-rs",
>>>>     "email": "service-account-rs at placeholder.org",
>>>>     "email_verified": false,
>>>>     "acr": "1",
>>>>     "realm_access": {
>>>>         "roles": [
>>>>             "offline_access",
>>>>             "uma_authorization"
>>>>         ]
>>>>     },
>>>>     "resource_access": {
>>>>         "account": {
>>>>             "roles": [
>>>>                 "manage-account",
>>>>                 "manage-account-links",
>>>>                 "view-profile"
>>>>             ]
>>>>         },
>>>>         "opticks-rs": {
>>>>             "roles": [
>>>>                 "uma_protection"
>>>>             ]
>>>>         }
>>>>     },
>>>>     "scope": "email profile",
>>>>     "clientId": "rs",
>>>>     "clientHost": "0.0.0.0",
>>>>     "clientAddress": "0.0.0.0",
>>>>     "client_id": "rs",
>>>>     "username": "service-account-rs",
>>>>     "active": true
>>>> }
>>>>
>>>> On Wed, 21 Nov 2018 at 15:41, Julien Deruere <deruere.julien at gmail.com>
>>>> wrote:
>>>>
>>>>> This is all I see
>>>>>
>>>>> {
>>>>>   "jti": "6cfa6dd3-a3dd-4f5b-8560-f91832e7a35f",
>>>>>   "exp": 1542811409,
>>>>>   "nbf": 0,
>>>>>   "iat": 1542811109,
>>>>>   "iss": "http://my-keycloak:8080/auth/realms/my-realm",
>>>>>   "sub": "055a376e-d8eb-49cf-9d5f-a83226448131",
>>>>>   "typ": "Bearer",
>>>>>   "azp": "my-api-gateway",
>>>>>   "auth_time": 0,
>>>>>   "session_state": "10853e1d-ff27-4f4c-b9e1-31339774c5e4",
>>>>>   "acr": "1",
>>>>>   "scope": "profile email",
>>>>>   "clientId": "my-api-gateway",
>>>>>   "clientHost": "172.19.0.1",
>>>>>   "email_verified": false,
>>>>>   "preferred_username": "service-account-my-api-gateway",
>>>>>   "clientAddress": "172.19.0.1",
>>>>>   "email": "service-account-my-api-gateway at placeholder.org"
>>>>> }
>>>>>
>>>>> Le mer. 21 nov. 2018 ? 05:57, Pedro Igor Silva <psilva at redhat.com> a
>>>>> ?crit :
>>>>>
>>>>>> Yes, you should see a claim like this:
>>>>>>
>>>>>> "resource_access": {
>>>>>>     "{client_id}": {
>>>>>>       "roles": [
>>>>>>         "{client_role}"
>>>>>>       ]
>>>>>>     }
>>>>>>   }
>>>>>>
>>>>>> On Tue, Nov 20, 2018 at 5:22 PM Geoffrey Cleaves <geoff at opticks.io>
>>>>>> wrote:
>>>>>>
>>>>>>> I understand that the client is supposed to have the role given the
>>>>>>> Admin Console settings, but does the token show that role when you
>>>>>>> introspect it?
>>>>>>>
>>>>>>> On Tue, Nov 20, 2018, 18:02 Julien Deruere <deruere.julien at gmail.com
>>>>>>> wrote:
>>>>>>>
>>>>>>>> That's exactly what I did/checked. That's why I can't figure out
>>>>>>>> why it's
>>>>>>>> not working :(
>>>>>>>>
>>>>>>>> Le mar. 20 nov. 2018 11:53, Pedro Igor Silva <psilva at redhat.com> a
>>>>>>>> ?crit :
>>>>>>>>
>>>>>>>> > This role should be a client role. For instance, if you are
>>>>>>>> trying to
>>>>>>>> > create resources for C1 the service account must be granted with
>>>>>>>> client
>>>>>>>> > role C1/uma-protection. See screenshot attached.
>>>>>>>> >
>>>>>>>> > Regards.
>>>>>>>> >
>>>>>>>> > On Tue, Nov 20, 2018 at 2:01 PM Julien Deruere <
>>>>>>>> deruere.julien at gmail.com>
>>>>>>>> > wrote:
>>>>>>>> >
>>>>>>>> >> In this case I'm using protection API:
>>>>>>>> >>
>>>>>>>> >> curl -X POST \
>>>>>>>> >>     -H "Content-Type: application/x-www-form-urlencoded" \
>>>>>>>> >>     -d
>>>>>>>> 'grant_type=client_credentials&client_id=${client_id}&client_secret=${client_secret}'
>>>>>>>> \
>>>>>>>> >>     "
>>>>>>>> http://localhost:8080/auth/realms/${realm_name}/protocol/openid-connect/token
>>>>>>>> "
>>>>>>>> >>
>>>>>>>> >>
>>>>>>>> >> I'm asking a token as a client, not as a user. And I checked, my
>>>>>>>> client
>>>>>>>> >> has the uma_protection role in Service Account Role.
>>>>>>>> >>
>>>>>>>> >> I don't know where I'm wrong?
>>>>>>>> >>
>>>>>>>> >> Le mar. 20 nov. 2018 10:54, Pedro Igor Silva <psilva at redhat.com>
>>>>>>>> a
>>>>>>>> >> ?crit :
>>>>>>>> >>
>>>>>>>> >>> Hi,
>>>>>>>> >>>
>>>>>>>> >>> You need to grant uma_protection client scope (it should be
>>>>>>>> available as
>>>>>>>> >>> one of the roles associated with your resource server) to the
>>>>>>>> user to which
>>>>>>>> >>> you are issuing tokens for.
>>>>>>>> >>>
>>>>>>>> >>> On Tue, Nov 20, 2018 at 1:52 PM Julien Deruere <
>>>>>>>> deruere.julien at gmail.com>
>>>>>>>> >>> wrote:
>>>>>>>> >>>
>>>>>>>> >>>> Any update on this?
>>>>>>>> >>>> I got the exact same message when using POSTMAN :
>>>>>>>> >>>>
>>>>>>>> >>>> I fist do this (with grant_type=client_credentials):
>>>>>>>> >>>>
>>>>>>>> http://localhost:8080/auth/realms/sg2b/protocol/openid-connect/token
>>>>>>>> >>>>
>>>>>>>> >>>> And then this with the token I received:
>>>>>>>> >>>> GET
>>>>>>>> >>>>
>>>>>>>> >>>>
>>>>>>>> http://localhost:8080/auth/realms/sg2b/authz/protection/resource_set?type=zone
>>>>>>>> >>>> Which answer me this:
>>>>>>>> >>>> {
>>>>>>>> >>>>     "error": "invalid_scope",
>>>>>>>> >>>>     "error_description": "Requires uma_protection scope."
>>>>>>>> >>>> }
>>>>>>>> >>>>
>>>>>>>> >>> _______________________________________________
>>>>>>>> >>>> keycloak-user mailing list
>>>>>>>> >>>> keycloak-user at lists.jboss.org
>>>>>>>> >>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>>>>> >>>>
>>>>>>>> >>>
>>>>>>>> _______________________________________________
>>>>>>>> keycloak-user mailing list
>>>>>>>> keycloak-user at lists.jboss.org
>>>>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>>>>
>>>>>>>

From andrew.murphy at confido.ie  Wed Nov 21 16:40:07 2018
From: andrew.murphy at confido.ie (Andrew Murphy)
Date: Wed, 21 Nov 2018 21:40:07 +0000
Subject: [keycloak-user] NotSerializableException:
	org.keycloak.adapters.elytron.ElytronAccount
Message-ID: <CAF0ec6+-bfe3xjWFkRD2JzypN_nmcooVxi5wDSETt=xLdbtJFw@mail.gmail.com>

I've installed the keycloak-wildfly-adapter-dist-4.6.0.Final.zip adapter in
a clean version of WildFly Full 14.0.1.Final, running on Windows 8.1. The
keycloak server is running on a separate port.

When I configure the adapter subsystem (server not running) with the newer
Elytron adapter using

> cd bin
> jboss-cli.bat --file=adapter-elytron-install-offline.cli -Dserver.config=standalone-full.xml

and thereafter attempt to sign into a basic war application I get the
keycloak login page, followed by an error page once credentials are posted.
The server.log reports the following (abbreviated) error stacktrace

2018-11-21 20:17:37,654 ERROR [io.undertow.request] (default task-1)
UT005023: Exception handling request to /curo-crm/:
java.lang.IllegalArgumentException:
org.infinispan.commons.marshall.NotSerializableException:
org.keycloak.adapters.elytron.ElytronAccount
    at
org.wildfly.clustering.web.infinispan.session.coarse.CoarseSessionAttributes.setAttribute(CoarseSessionAttributes.java:71)
[snip]
Caused by: org.infinispan.commons.marshall.NotSerializableException:
org.keycloak.adapters.elytron.ElytronAccount

Now, if I configure the adapter subsystem with the legacy non-Elytron
adapter on WildFly using

> cd bin
> jboss-cli.bat --file=adapter-install-offline.cli -Dserver.config=standalone-full.xml

everything works without errors i.e. I can access the protected web app on
login success.

Question 1: Have I missed something in the server configuration that is
causing the NotSerializableException?
Question 2: The keycloak config documentation recommends the use of the
newer Elytron adapter over the legacy non-Elytron adapter, but gives no
reasoning. Are there drawbacks to using the legacy version?

Thanks

From dt at acutus.pro  Wed Nov 21 18:38:12 2018
From: dt at acutus.pro (Dmitry Telegin)
Date: Thu, 22 Nov 2018 02:38:12 +0300
Subject: [keycloak-user] Prefill Custom Attribute for User
In-Reply-To: <D81B2A24.29F8%betty.louie@leidos.com>
References: <D81B2A24.29F8%betty.louie@leidos.com>
Message-ID: <1542843492.19885.3.camel@acutus.pro>

Hello Betty,

Please also check these out:
http://lists.jboss.org/pipermail/keycloak-user/2018-November/016390.html
http://lists.jboss.org/pipermail/keycloak-user/2018-November/016383.html
http://lists.jboss.org/pipermail/keycloak-user/2018-November/016228.html

Yes, the similar problems have already popped up at least three times during November only (!), let alone earlier postings. I think it deserves a streamlined solution, so I'll probably post this to keycloak-dev ML. After all, Keycloak already does the same for kc_idp_hint URL parameter, why not doing this for all the kc_* params?

At the moment, there are at least three known workarounds:
1. fish the param out of URL or Referer header (depending on the context) and attach it to user session in Keycloak (search for "user session notes");
2. use JAX-RS interceptor on the protocol endpoint + plain HTTP session for the same;
3. use browser local storage and custom JavaScript injected into login / registration forms.

I'll put everybody in CC: when posting to the dev ML. Good luck and stay tuned,
Dmitry Telegin
CTO, Acutus s.r.o.
Keycloak Consulting and Training

Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
+42 (022) 888-30-71
E-mail: info at acutus.pro

On Wed, 2018-11-21 at 20:28 +0000, Louie, Betty wrote:
> Hi All,
> 
> I?m trying to pass along a value to be set as a custom attribute on the user when they register for a keycloak account. I was trying to implement something along the lines of this http://lists.jboss.org/pipermail/keycloak-user/2018-May/013874.html where the value gets passed along as a query param and I grab the value from the query string and set it as a user attribute in a script. This isn?t reliable because if the registration form doesn?t pass the necessary validation, the page is refreshed and the query parameters are removed from the url.
> 
> I was wondering if anyone else has needed to pass along a value to be prefilled on the registration form and how you were able to get around it or if there is another way to keep hold of some value before and after the user registers for an account.
> 
> Thanks,
> Betty
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From marco.scheuermann at daimler.com  Thu Nov 22 03:11:26 2018
From: marco.scheuermann at daimler.com (marco.scheuermann at daimler.com)
Date: Thu, 22 Nov 2018 08:11:26 +0000
Subject: [keycloak-user] Library for external HTTP calls.
Message-ID: <92354AED-8A39-4C8D-BC9E-7399D08E8373@daimler.com>

Hi community,

I wrote a keycloak extension based on Authenticator SPI.
What is currently the preferred way to do HTTP calls to an external system within a provider module?
Which library should I use for that purpose?
Should I use an external one, like e.g. Apache HTTP Client or a lib already packaged with keycloak.

Thank you,
Marco


Marco Scheuermann

Dipl.-Informatiker

 [id:image001.png at 01D3CB2E.313F1BF0]

Software Engineer
RD/UIA ? Team Rising Stars
Tel.:       +49 151 5860 5255
E-Mail:  marco.scheuermann at daimler.com

Daimler AG
Sitz und Registergericht/Domicile and Court of Registry: Stuttgart
HRB-Nr./Commercial Register No. 19360
Vorsitzender des Aufsichtsrats/Chairman of the Supervisory Board: Manfred Bischoff
Vorstand/Board of Management: Dieter Zetsche (Vorsitzender/Chairman), Wolfgang Bernhard, Renata Jungo Br?ngger, Ola K?llenius, Wilfried Porth, Hubertus Troska, Bodo Uebber, Thomas Weber


If you are not the addressee, please inform us immediately that you have received this e-mail by mistake, and delete it. We thank you for your support.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.png
Type: image/png
Size: 6522 bytes
Desc: image001.png
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20181122/68c09821/attachment.png 

From nocquidant at gmail.com  Thu Nov 22 03:17:13 2018
From: nocquidant at gmail.com (Nicolas Ocquidant)
Date: Thu, 22 Nov 2018 09:17:13 +0100
Subject: [keycloak-user] NPE in SegmentKeyTracker.track method
Message-ID: <CABS93FTJMVorBswhCytwgUDtOvU0zfUor2BqdoAYf=YVOo1tdA@mail.gmail.com>

Hi

Still trying to start KC with millions of sessions in my JDBC store (remote
cache):
http://lists.jboss.org/pipermail/keycloak-user/2018-November/016393.html

So now, and after the patch made by William Burns, no more OOM, see
https://issues.jboss.org/browse/ISPN-9752

But then, I got the following exception during startup, see below. Note,
there is a TODO in the code:

public boolean track(byte[] key, short status, ClassWhiteList whitelist) {
   int segment = HotRodConstants.hasCompatibility(status) ?
         segmentConsistentHash.getSegment(dataFormat.keyToObj(key,
status, whitelist)) :
         segmentConsistentHash.getSegment(key);
   Set<WrappedByteArray> keys = keysPerSegment.get(segment);
   // TODO: this assertion may fail due to ISPN
   assert keys != null : "Segment " + segment + " not initialized,
tracking key " + Util.toStr(key);
   boolean result = keys.add(new WrappedByteArray(key));
   if (trace)
      log.trackingSegmentKey(Util.printArray(key), segment, !result);
   return result;
}

Do I have a workaround?
Thanks
--nick

22:35:55,749 WARN
[org.infinispan.client.hotrod.impl.iteration.RemoteCloseableIterator]
(pool-16-thread-3) Error reaching the server during iteration:
org.infinispan.client.hotrod.exceptions.TransportException::
java.lang.NullPointerException
        at org.infinispan.client.hotrod.impl.Util.rewrap(Util.java:54)
        at org.infinispan.client.hotrod.impl.Util.await(Util.java:27)
        at
org.infinispan.client.hotrod.impl.iteration.RemoteCloseableIterator.fetch(RemoteCloseableIterator.java:117)
        at
org.infinispan.client.hotrod.impl.iteration.RemoteCloseableIterator.fetch(RemoteCloseableIterator.java:131)
        at
org.infinispan.client.hotrod.impl.iteration.RemoteCloseableIterator.fetch(RemoteCloseableIterator.java:131)
        at
org.infinispan.client.hotrod.impl.iteration.RemoteCloseableIterator.fetch(RemoteCloseableIterator.java:131)
        at
org.infinispan.client.hotrod.impl.iteration.RemoteCloseableIterator.fetch(RemoteCloseableIterator.java:131)
        at
org.infinispan.client.hotrod.impl.iteration.RemoteCloseableIterator.hasNext(RemoteCloseableIterator.java:99)
        at
org.keycloak.models.sessions.infinispan.remotestore.RemoteCacheSessionsLoader.loadSessions(RemoteCacheSessionsLoader.java:108)
        at
org.keycloak.models.sessions.infinispan.remotestore.RemoteCacheSessionsLoader.loadSessions(RemoteCacheSessionsLoader.java:45)
        at
org.keycloak.models.sessions.infinispan.initializer.SessionInitializerWorker$1.run(SessionInitializerWorker.java:71)
        at
org.keycloak.models.utils.KeycloakModelUtils.runJobInTransaction(KeycloakModelUtils.java:228)
        at
org.keycloak.models.sessions.infinispan.initializer.SessionInitializerWorker.call(SessionInitializerWorker.java:67)
        at
org.keycloak.models.sessions.infinispan.initializer.SessionInitializerWorker.call(SessionInitializerWorker.java:34)
        at
org.infinispan.commands.read.DistributedExecuteCommand.invokeAsync(DistributedExecuteCommand.java:99)
        at
org.infinispan.distexec.DefaultExecutorService$LocalDistributedTaskPart.lambda$execute$1(DefaultExecutorService.java:1060)
        at
java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
        at
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
        at java.lang.Thread.run(Thread.java:748)
Caused by: java.lang.NullPointerException
        at
org.infinispan.client.hotrod.impl.iteration.SegmentKeyTracker.track(SegmentKeyTracker.java:50)
        at
org.infinispan.client.hotrod.impl.operations.IterationNextOperation.acceptResponse(IterationNextOperation.java:111)
        at
org.infinispan.client.hotrod.impl.transport.netty.HeaderDecoder.decode(HeaderDecoder.java:144)
        at
org.infinispan.client.hotrod.impl.transport.netty.HintedReplayingDecoder.callDecode(HintedReplayingDecoder.java:98)
        at
io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:265)
        at
io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362)
        at
io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348)
        at
io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340)
        at
io.netty.handler.timeout.IdleStateHandler.channelRead(IdleStateHandler.java:286)
        at
io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362)
        at
io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348)
        at
io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:340)
        at
io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1434)
        at
io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:362)
        at
io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:348)
        at
io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:965)
        at
io.netty.channel.nio.AbstractNioByteChannel$NioByteUnsafe.read(AbstractNioByteChannel.java:163)
        at
io.netty.channel.nio.NioEventLoop.processSelectedKey(NioEventLoop.java:647)
        at
io.netty.channel.nio.NioEventLoop.processSelectedKeysOptimized(NioEventLoop.java:582)
        at
io.netty.channel.nio.NioEventLoop.processSelectedKeys(NioEventLoop.java:499)
        at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:461)
        at
io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:884)
        ... 3 more

From Bjoern.Peemoeller at berenberg.de  Thu Nov 22 03:59:07 2018
From: Bjoern.Peemoeller at berenberg.de (=?iso-8859-1?Q?Peem=F6ller=2C_Bj=F6rn?=)
Date: Thu, 22 Nov 2018 08:59:07 +0000
Subject: [keycloak-user] LDAP role mapper loses client on client renaming
Message-ID: <CB46949C2F22AC48BDB4771532A5FC735D87A42E@NT-EX02.dnsbego.de>

Hi all,

in our Keycloak installation we have connected Keycloak to an internal AD using user federation and configured a role-ldap-mapper as described in https://www.keycloak.org/docs/latest/server_admin/index.html#_ldap_mappers .

We now discovered that if we rename a client, than the associated LDAP mapper loses the connection to the client, as it stores only the client name but not its internal id in the mapper configuration.

Currently, we therefore need to reconfigure all associated mappers once we rename a client.

Is it possible to avoid this problem (or wouldn't it be even better to store the internal UUID)?

Kind regards,
Bj?rn

Bj?rn Peem?ller
IT & IT Operations

BERENBERG
Joh. Berenberg, Gossler & Co. KG
Neuer Jungfernstieg 20
20354 Hamburg

Telefon +49 40 350 60-8548
Telefax +49 40 350 60-900
E-Mail bjoern.peemoeller at berenberg.de<mailto:bjoern.peemoeller at berenberg.de>
www.berenberg.de<http://www.berenberg.de/>

Sitz: Hamburg - Amtsgericht Hamburg HRA 42659


Bei Berenberg hat der Schutz Ihrer Daten seit jeher h?chste Priorit?t. Informationen zum Umgang mit personenbezogenen Daten finden Sie hier: https://www.berenberg.de/files/Rechtliche%20Hinweise/DSGVO/DSGVO-Kundeninformation%20-%20Binder%20-%20D.pdf
Diese Nachricht einschliesslich etwa beigefuegter Anhaenge ist vertraulich und kann dem Bank- und Datengeheimnis unterliegen oder sonst rechtlich geschuetzte Daten und Informationen enthalten. Wenn Sie nicht der richtige Adressat sind oder diese Nachricht irrtuemlich erhalten haben, informieren Sie bitte sofort den Absender ?ber die Antwortfunktion. Anschliessend moechten Sie bitte diese Nachricht einschliesslich etwa beigefuegter Anhaenge unverzueglich vollstaendig loeschen. Das unerlaubte Kopieren oder Speichern dieser Nachricht und/oder der ihr etwa beigefuegten Anhaenge sowie die unbefugte Weitergabe der darin enthaltenen Daten und Informationen sind nicht gestattet. Wir weisen darauf hin, dass rechtsverbindliche Erklaerungen namens unseres Hauses grundsaetzlich der Unterschriften zweier ausreichend bevollmaechtigter Vertreter unseres Hauses beduerfen. Wir verschicken daher keine rechtsverbindlichen Erklaerungen per E-Mail an Dritte. Demgemaess nehmen wir per E-Mail auch keine rechtsverbindlichen Erklaerungen oder Auftraege von Dritten entgegen. 
Sollten Sie Schwierigkeiten beim Oeffnen dieser E-Mail haben, wenden Sie sich bitte an den Absender oder an info at berenberg.de. Please refer to https://www.berenberg.de/files/Rechtliche%20Hinweise/DSGVO/DSGVO-Kundeninformation-Binder%20EN%20L%20Webdsite.pdf for our confidentiality notice.


From dt at acutus.pro  Thu Nov 22 04:17:29 2018
From: dt at acutus.pro (Dmitry Telegin)
Date: Thu, 22 Nov 2018 12:17:29 +0300
Subject: [keycloak-user] Library for external HTTP calls.
In-Reply-To: <92354AED-8A39-4C8D-BC9E-7399D08E8373@daimler.com>
References: <92354AED-8A39-4C8D-BC9E-7399D08E8373@daimler.com>
Message-ID: <1542878249.3526.2.camel@acutus.pro>

Hello Marco,

Keycloak ships Apache HttpClient, and offers HttpClientSpi for obtaining a preconfigured HttpClient instance:

HttpClientProvider provider = session.getProvider(HttpClientProvider.class);

InputStream is = provider.get("http://...");
// or
in rc = provider.postText("http://...", "foo=bar");
// or
HttpClient httpClient = provider.getHttpClient();

See org.keycloak.connections.httpclient.DefaultHttpClientFactory::lazyInit() for the list of configurable options.

Cheers,
Dmitry Telegin
CTO, Acutus s.r.o.
Keycloak Consulting and Training

Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
+42 (022) 888-30-71
E-mail: info at acutus.pro

On Thu, 2018-11-22 at 08:11 +0000, marco.scheuermann at daimler.com wrote:
> Hi community,
> 
> I wrote a keycloak extension based on Authenticator SPI.
> What is currently the preferred way to do HTTP calls to an external system within a provider module?
> Which library should I use for that purpose?
> Should I use an external one, like e.g. Apache HTTP Client or a lib already packaged with keycloak.
> 
> Thank you,
> Marco
> 
> 
> Marco Scheuermann
> 
> Dipl.-Informatiker
> 
> > ?[id:image001.png at 01D3CB2E.313F1BF0]
> 
> Software Engineer
> RD/UIA ? Team Rising Stars
> Tel.:???????+49 151 5860 5255
> E-Mail:??marco.scheuermann at daimler.com
> 
> Daimler AG
> Sitz und Registergericht/Domicile and Court of Registry: Stuttgart
> HRB-Nr./Commercial Register No. 19360
> Vorsitzender des Aufsichtsrats/Chairman of the Supervisory Board: Manfred Bischoff
> Vorstand/Board of Management: Dieter Zetsche (Vorsitzender/Chairman), Wolfgang Bernhard, Renata Jungo Br?ngger, Ola K?llenius, Wilfried Porth, Hubertus Troska, Bodo Uebber, Thomas Weber
> 
> 
> If you are not the addressee, please inform us immediately that you have received this e-mail by mistake, and delete it. We thank you for your support.
> 
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From dharlaftis at ekt.gr  Thu Nov 22 04:33:56 2018
From: dharlaftis at ekt.gr (Dimitris Charlaftis)
Date: Thu, 22 Nov 2018 11:33:56 +0200
Subject: [keycloak-user] keucloak Hash Algorithm
Message-ID: <915b0473-2e52-3947-e136-99ebb8470f0c@ekt.gr>

Hello,
I use keykloak 4.5 and i have set up a user federation to an ldap directory
that uses SHA-1 password encoding.

In order to login to a realm that is connected to that ldap, I use the ldap
username and the SHA-1 encoded password in the login form for the time
being.

This is not good for common users!

 ?All i want is this:

The user puts his username / password in plain text and keycloak transforms
that password in plain text in the login form to the SHA-1 equivalent (that's how our ldap directory works..) , so
that the ldap authorization succeeds.

In your password policy docs you state "See the Server Developer
Guide<https://keycloak.gitbooks.io/server-developer-guide/content/>  on how
to plug in your own algorithm". Server dev guide does not have that
information, where is it?

Thanks in advance,
Dimitris

-- 
_____________________________

Dimitris Charlaftis
Software Engineer

National Documentation Center
email: dharlaftis at ekt.gr
_____________________________


From erlend at hamnaberg.net  Thu Nov 22 04:45:34 2018
From: erlend at hamnaberg.net (Erlend Hamnaberg)
Date: Thu, 22 Nov 2018 10:45:34 +0100
Subject: [keycloak-user] User session creation
Message-ID: <CAGuwm8UzLNFTw4-zhofMvhVt+ujFQ7MaMq40ynGjR_JBUtvYEw@mail.gmail.com>

Hello all.

This is a bit hard to explain.

I have created a IDP which uses CAS ( Central Authentication Service) as
its backend.

Our KC instance is again used by a clients KC instance. They have chosen to
disable their persistent cookie handling, and thereby our by passing
"prompt=login" to the login request.
We are passing on the prompt=login by passing on renew=true to CAS.

We get a token back, and verify that. However; Since the user session is
not refreshed by the cookie handling, it seems like we are then timing out
intermittently.

Is there a problem with creating/refreshing the user session in the
authenticationFinished Method in the gist below?

https://gist.github.com/hamnis/547c550a532be7e8235aa653725b2ba2

Thanks.

/Erlend

From erlend at hamnaberg.net  Thu Nov 22 04:51:02 2018
From: erlend at hamnaberg.net (Erlend Hamnaberg)
Date: Thu, 22 Nov 2018 10:51:02 +0100
Subject: [keycloak-user] User session creation
In-Reply-To: <CAGuwm8UzLNFTw4-zhofMvhVt+ujFQ7MaMq40ynGjR_JBUtvYEw@mail.gmail.com>
References: <CAGuwm8UzLNFTw4-zhofMvhVt+ujFQ7MaMq40ynGjR_JBUtvYEw@mail.gmail.com>
Message-ID: <CAGuwm8WudHxQL4g9q-bg_khRYFghtVFyBmUWhF865D5NCPSkQw@mail.gmail.com>

I forgot to mention that we are using KC-4.6.0.Final.

If we do not refresh the user session we sometimes get an "Action Timeout"
error message.

/Erlend

On Thu, Nov 22, 2018 at 10:45 AM Erlend Hamnaberg <erlend at hamnaberg.net>
wrote:

> Hello all.
>
> This is a bit hard to explain.
>
> I have created a IDP which uses CAS ( Central Authentication Service) as
> its backend.
>
> Our KC instance is again used by a clients KC instance. They have chosen
> to disable their persistent cookie handling, and thereby our by passing
> "prompt=login" to the login request.
> We are passing on the prompt=login by passing on renew=true to CAS.
>
> We get a token back, and verify that. However; Since the user session is
> not refreshed by the cookie handling, it seems like we are then timing out
> intermittently.
>
> Is there a problem with creating/refreshing the user session in the
> authenticationFinished Method in the gist below?
>
> https://gist.github.com/hamnis/547c550a532be7e8235aa653725b2ba2
>
> Thanks.
>
> /Erlend
>

From l.lech at ringler.ch  Thu Nov 22 04:57:33 2018
From: l.lech at ringler.ch (Lukasz Lech)
Date: Thu, 22 Nov 2018 09:57:33 +0000
Subject: [keycloak-user] Keycloak javascript client iframe policy
Message-ID: <5E48B917000C984B86B77170F441903A11DE8315@exch.ringler.ch>

Hello,

I haven't looked in internals how Javascript Keycloak client is speaking with keycloak server until the token refresh has stopped to work in one of our instalations, which was because firewall was adding per default HTTP header X-Frame-Options: sameorigin. Then I've found out Keycloak client is creating and manipulating iframe.

Is this solution really safe against CSRF attacks? I'm not an expert in that domain, but I've read recommendations to use Authorization: Bearer headers and call API directly, so I don't understand, why is this Iframe needed.

I have a bit problem now explaining WHY do we need to use Iframes and how (un)safe is it...

Best regards,
Lukasz Lech




From uo67113 at gmail.com  Thu Nov 22 05:18:19 2018
From: uo67113 at gmail.com (=?UTF-8?Q?Luis_Rodr=C3=ADguez_Fern=C3=A1ndez?=)
Date: Thu, 22 Nov 2018 11:18:19 +0100
Subject: [keycloak-user] SPI with a third party database. Could not find any
 META-INF/persistence.xml file in the classpath
Message-ID: <CACp70MkktkrmSCuKiE0gmAbGB1a_ePCaSpGiC_LYAc00RpcL1A@mail.gmail.com>

Hello there,

I am using the standalone server distribution [1].

We need to extend the keycloak server [2] and we need to access a third
party database to get some data.

I developed a sample domain extension based on the keycloak example domain
extension [3]. The deployment of this example one works at the first try,
thanks!!!

My sample domain extension access a third party database (mysql), so in
wildfly...

- I install the mysql driver
- I create a datasource

... and in my sample I create a META-INF/persistence.xml

<persistence version>
    <persistence-unit name="JavaHelps" transaction-type="RESOURCE_LOCAL">
        <non-jta-data-source>java:/MySqlDS</non-jta-data-source>
<class>my.entity.Class</class>
<properties>
         <property name="hibernate.dialect"
value="org.hibernate.dialect.MySQLDialect"/>
</properties>
    </persistence-unit>
</persistence>

I add my sample  $KEYCLOAK_HOME/bin/jboss-cli.sh --command="module add
--name=...

And it seems that wildfly likes evrything (from standard output), you can
see below part of the wildfly output at startup time. However when I run it
I get:

Uncaught server error: java.lang.ExceptionInInitializerError.... Caused by:
javax.persistence.PersistenceException: No Persistence provider for
EntityManager named JavaHelps

I found a workaround: having a deeper look at the standard output I saw
this message...

parse checking if
"$KEYCLOAK_HOMEl/modules/system/layers/keycloak/org/keycloak/keycloak-server-subsystem/main/server-war/WEB-INF/classes/META-INF/persistence.xml"
exists, result = false
10:59:55,279 TRACE [org.jboss.as.jpa] (MSC service thread 1-1) parsed
persistence unit definitions for war server-war

... so if I copy my persistence.xml to that location my domain extension
sample WORKS! My question is WHY???

Any thoughts on this?

Thanks in advance,

Luis

[1]
https://downloads.jboss.org/keycloak/4.6.0.Final/keycloak-4.6.0.Final.zip
[2]
https://www.keycloak.org/docs/latest/server_development/index.html#_extensions
[3]
https://github.com/keycloak/keycloak/tree/master/examples/providers/domain-extension

10:59:54,575 INFO  [org.jboss.as.connector.subsystems.datasources]
(ServerService Thread Pool -- 28) WFLYJCA0005: Deploying non-JDBC-compliant
driver class com.mysql.jdbc.Driver (version 5.1)

10:59:55,071 INFO  [org.jboss.as.connector.subsystems.datasources] (MSC
service thread 1-8) WFLYJCA0001: Bound data source [java:/MySqlDS]

10:59:55,158 TRACE [org.jboss.as.jpa] (MSC service thread 1-7) parse
checking if
"/content/domain-extension-example.jar/META-INF/persistence.xml" exists,
result = true
10:59:55,163 TRACE [org.jboss.as.jpa] (MSC service thread 1-7) parse
persistence.xml: attribute value(0) = JavaHelps
10:59:55,163 TRACE [org.jboss.as.jpa] (MSC service thread 1-7) parse
persistence.xml: attribute value(1) = RESOURCE_LOCAL
10:59:55,164 TRACE [org.jboss.as.jpa] (MSC service thread 1-7) parse
persistence.xml: element=non-jta-data-source
10:59:55,164 TRACE [org.jboss.as.jpa] (MSC service thread 1-7) parse
persistence.xml: element=class
10:59:55,164 TRACE [org.jboss.as.jpa] (MSC service thread 1-7) parse
persistence.xml: element=properties
10:59:55,165 TRACE [org.jboss.as.jpa] (MSC service thread 1-7) parse
persistence.xml: reached ending persistence-unit tag
10:59:55,165 INFO  [org.jboss.as.jpa] (MSC service thread 1-7) WFLYJPA0002:
Read persistence.xml for JavaHelps
10:59:55,166 TRACE [org.jboss.as.jpa] (MSC service thread 1-7)
PersistenceUnitMetadataImpl(version=2.1) [
name: JavaHelps
jtaDataSource: null
nonJtaDataSource: java:/MySqlDS
transactionType: RESOURCE_LOCAL
provider: org.hibernate.jpa.HibernatePersistenceProvider
classes[
com.javahelps.jpa.Student ]
packages[
]
mappingFiles[
]
jarFiles[
]
validation-mode: AUTO
shared-cache-mode: UNSPECIFIED
properties[
hibernate.dialect: org.hibernate.dialect.MySQLDialect
]]
10:59:55,167 TRACE [org.jboss.as.jpa] (MSC service thread 1-7) parsed
persistence unit definitions for jar domain-extension-example.jar
10:59:55,168 TRACE [org.jboss.as.jpa] (MSC service thread 1-7) incrementing
PU count for domain-extension-example.jar by 1
10:59:55,174 DEBUG [org.jboss.as.jpa] (MSC service thread 1-3) added
javax.persistence.api dependency to domain-extension-example.jar
10:59:55,174 DEBUG [org.jboss.as.jpa] (MSC service thread 1-3) added
org.hibernate.bytecodetransformer dependency to domain-extension-example.jar
10:59:55,175 DEBUG [org.jboss.as.jpa] (MSC service thread 1-3) added
org.jboss.as.jpa dependency to domain-extension-example.jar
10:59:55,175 DEBUG [org.jboss.as.jpa] (MSC service thread 1-3) added
org.jboss.as.jpa.spi dependency to domain-extension-example.jar
10:59:55,175 DEBUG [org.jboss.as.jpa] (MSC service thread 1-3) added
(default provider) org.hibernate dependency to domain-extension-example.jar
(since 1 PU(s) didn't specify jboss.as.jpa.providerModule)
10:59:55,175 DEBUG [org.jboss.as.jpa] (MSC service thread 1-3) added
org.hibernate dependency to domain-extension-example.jar
10:59:55,196 TRACE [org.jboss.as.jpa] (MSC service thread 1-8) install
persistence unit definition for jar domain-extension-example.jar
10:59:55,196 TRACE [org.jboss.as.jpa] (MSC service thread 1-8) adding
'vfs:/content/domain-extension-example.jar/' to annotation index map
10:59:55,196 TRACE [org.jboss.as.jpa] (MSC service thread 1-8) returning
global (module) Persistence Provider
org.hibernate.jpa.HibernatePersistenceProvider
10:59:55,199 DEBUG [org.jboss.as.jpa] (MSC service thread 1-8) loaded
persistence provider adapter
org.jboss.as.jpa.hibernate5.HibernatePersistenceProviderAdaptor from
classloader ModuleClassLoader for Module "org.hibernate" version
5.3.6.Final from local module loader @400cff1a (finder: local module finder
@275710fc (roots:
/media/hdd/keycloak-4.6.0.Final/modules,/media/hdd/keycloak-4.6.0.Final/modules/system/layers/keycloak,/media/hdd/keycloak-4.6.0.Final/modules/system/layers/base))
10:59:55,202 TRACE [org.jboss.as.jpa] (MSC service thread 1-8) add second
level cache dependencies with properties '{caches=entity,
container=hibernate}'
10:59:55,203 TRACE [org.jboss.as.jpa] (MSC service thread 1-8) added
PersistenceUnitService (phase 1 of 2) for 'service
jboss.persistenceunit."domain-extension-example.jar#JavaHelps".__FIRST_PHASE__'.
PU is ready for injector action.
10:59:55,204 TRACE [org.jboss.as.jpa] (MSC service thread 1-8) returning
global (module) Persistence Provider
org.hibernate.jpa.HibernatePersistenceProvider
10:59:55,206 INFO
[org.keycloak.subsystem.server.extension.KeycloakProviderDeploymentProcessor]
(MSC service thread 1-4) Deploying Keycloak provider:
domain-extension-example.jar
10:59:55,234 TRACE [org.jboss.as.jpa] (MSC service thread 1-6) install
persistence unit definition for jar domain-extension-example.jar
10:59:55,234 TRACE [org.jboss.as.jpa] (MSC service thread 1-6) adding
'vfs:/content/domain-extension-example.jar/' to annotation index map
10:59:55,234 TRACE [org.jboss.as.jpa] (MSC service thread 1-6) returning
global (module) Persistence Provider
org.hibernate.jpa.HibernatePersistenceProvider
10:59:55,235 TRACE [org.jboss.as.jpa] (MSC service thread 1-6) add second
level cache dependencies with properties '{caches=entity,
container=hibernate}'
10:59:55,235 TRACE [org.jboss.as.jpa] (MSC service thread 1-6) added
PersistenceUnitService (phase 2 of 2) for 'service
jboss.persistenceunit."domain-extension-example.jar#JavaHelps"'.  PU is
ready for injector action.

10:59:55,645 INFO  [org.jboss.as.jpa] (ServerService Thread Pool -- 57)
WFLYJPA0010: Starting Persistence Unit (phase 1 of 2) Service
'domain-extension-example.jar#JavaHelps'
10:59:55,695 INFO  [org.hibernate.jpa.internal.util.LogHelper]
(ServerService Thread Pool -- 57) HHH000204: Processing PersistenceUnitInfo
[
name: JavaHelps
...]

10:59:56,038 INFO  [org.jboss.as.jpa] (ServerService Thread Pool -- 57)
WFLYJPA0010: Starting Persistence Unit (phase 2 of 2) Service
'domain-extension-example.jar#JavaHelps'


-- 

"Ever tried. Ever failed. No matter. Try Again. Fail again. Fail better."

- Samuel Beckett

From dt at acutus.pro  Thu Nov 22 05:55:36 2018
From: dt at acutus.pro (Dmitry Telegin)
Date: Thu, 22 Nov 2018 13:55:36 +0300
Subject: [keycloak-user] SPI with a third party database. Could not find
 any META-INF/persistence.xml file in the classpath
In-Reply-To: <CACp70MkktkrmSCuKiE0gmAbGB1a_ePCaSpGiC_LYAc00RpcL1A@mail.gmail.com>
References: <CACp70MkktkrmSCuKiE0gmAbGB1a_ePCaSpGiC_LYAc00RpcL1A@mail.gmail.com>
Message-ID: <1542884136.3526.4.camel@acutus.pro>

Hello Luis,

The path to persistence.xml you've found in the logs is the default location of persistence.xml for Keycloak's main module (server-war). But it is unused, since Keycloak uses custom persistence.xml location:
https://github.com/keycloak/keycloak/blob/master/model/jpa/src/main/java/org/keycloak/connections/jpa/util/JpaUtils.java#L47

You can use the same method (or at least the same technique) to load yours.

Cheers,
Dmitry Telegin
CTO, Acutus s.r.o.
Keycloak Consulting and Training

Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
+42 (022) 888-30-71
E-mail: info at acutus.pro

On Thu, 2018-11-22 at 11:18 +0100, Luis Rodr?guez Fern?ndez wrote:
> Hello there,
> 
> I am using the standalone server distribution [1].
> 
> We need to extend the keycloak server [2] and we need to access a third
> party database to get some data.
> 
> I developed a sample domain extension based on the keycloak example domain
> extension [3]. The deployment of this example one works at the first try,
> thanks!!!
> 
> My sample domain extension access a third party database (mysql), so in
> wildfly...
> 
> - I install the mysql driver
> - I create a datasource
> 
> ... and in my sample I create a META-INF/persistence.xml
> 
> <persistence version>
> ????<persistence-unit name="JavaHelps" transaction-type="RESOURCE_LOCAL">
> ????????<non-jta-data-source>java:/MySqlDS</non-jta-data-source>
> <class>my.entity.Class</class>
> <properties>
> ?????????<property name="hibernate.dialect"
> value="org.hibernate.dialect.MySQLDialect"/>
> </properties>
> ????</persistence-unit>
> </persistence>
> 
> I add my sample??$KEYCLOAK_HOME/bin/jboss-cli.sh --command="module add
> --name=...
> 
> And it seems that wildfly likes evrything (from standard output), you can
> see below part of the wildfly output at startup time. However when I run it
> I get:
> 
> Uncaught server error: java.lang.ExceptionInInitializerError.... Caused by:
> javax.persistence.PersistenceException: No Persistence provider for
> EntityManager named JavaHelps
> 
> I found a workaround: having a deeper look at the standard output I saw
> this message...
> 
> parse checking if
> "$KEYCLOAK_HOMEl/modules/system/layers/keycloak/org/keycloak/keycloak-server-subsystem/main/server-war/WEB-INF/classes/META-INF/persistence.xml"
> exists, result = false
> 10:59:55,279 TRACE [org.jboss.as.jpa] (MSC service thread 1-1) parsed
> persistence unit definitions for war server-war
> 
> ... so if I copy my persistence.xml to that location my domain extension
> sample WORKS! My question is WHY???
> 
> Any thoughts on this?
> 
> Thanks in advance,
> 
> Luis
> 
> [1]
> https://downloads.jboss.org/keycloak/4.6.0.Final/keycloak-4.6.0.Final.zip
> [2]
> https://www.keycloak.org/docs/latest/server_development/index.html#_extensions
> [3]
> https://github.com/keycloak/keycloak/tree/master/examples/providers/domain-extension
> 
> 10:59:54,575 INFO??[org.jboss.as.connector.subsystems.datasources]
> (ServerService Thread Pool -- 28) WFLYJCA0005: Deploying non-JDBC-compliant
> driver class com.mysql.jdbc.Driver (version 5.1)
> 
> 10:59:55,071 INFO??[org.jboss.as.connector.subsystems.datasources] (MSC
> service thread 1-8) WFLYJCA0001: Bound data source [java:/MySqlDS]
> 
> 10:59:55,158 TRACE [org.jboss.as.jpa] (MSC service thread 1-7) parse
> checking if
> "/content/domain-extension-example.jar/META-INF/persistence.xml" exists,
> result = true
> 10:59:55,163 TRACE [org.jboss.as.jpa] (MSC service thread 1-7) parse
> persistence.xml: attribute value(0) = JavaHelps
> 10:59:55,163 TRACE [org.jboss.as.jpa] (MSC service thread 1-7) parse
> persistence.xml: attribute value(1) = RESOURCE_LOCAL
> 10:59:55,164 TRACE [org.jboss.as.jpa] (MSC service thread 1-7) parse
> persistence.xml: element=non-jta-data-source
> 10:59:55,164 TRACE [org.jboss.as.jpa] (MSC service thread 1-7) parse
> persistence.xml: element=class
> 10:59:55,164 TRACE [org.jboss.as.jpa] (MSC service thread 1-7) parse
> persistence.xml: element=properties
> 10:59:55,165 TRACE [org.jboss.as.jpa] (MSC service thread 1-7) parse
> persistence.xml: reached ending persistence-unit tag
> 10:59:55,165 INFO??[org.jboss.as.jpa] (MSC service thread 1-7) WFLYJPA0002:
> Read persistence.xml for JavaHelps
> 10:59:55,166 TRACE [org.jboss.as.jpa] (MSC service thread 1-7)
> PersistenceUnitMetadataImpl(version=2.1) [
> name: JavaHelps
> jtaDataSource: null
> nonJtaDataSource: java:/MySqlDS
> transactionType: RESOURCE_LOCAL
> provider: org.hibernate.jpa.HibernatePersistenceProvider
> classes[
> com.javahelps.jpa.Student ]
> packages[
> ]
> mappingFiles[
> ]
> jarFiles[
> ]
> validation-mode: AUTO
> shared-cache-mode: UNSPECIFIED
> properties[
> hibernate.dialect: org.hibernate.dialect.MySQLDialect
> ]]
> 10:59:55,167 TRACE [org.jboss.as.jpa] (MSC service thread 1-7) parsed
> persistence unit definitions for jar domain-extension-example.jar
> 10:59:55,168 TRACE [org.jboss.as.jpa] (MSC service thread 1-7) incrementing
> PU count for domain-extension-example.jar by 1
> 10:59:55,174 DEBUG [org.jboss.as.jpa] (MSC service thread 1-3) added
> javax.persistence.api dependency to domain-extension-example.jar
> 10:59:55,174 DEBUG [org.jboss.as.jpa] (MSC service thread 1-3) added
> org.hibernate.bytecodetransformer dependency to domain-extension-example.jar
> 10:59:55,175 DEBUG [org.jboss.as.jpa] (MSC service thread 1-3) added
> org.jboss.as.jpa dependency to domain-extension-example.jar
> 10:59:55,175 DEBUG [org.jboss.as.jpa] (MSC service thread 1-3) added
> org.jboss.as.jpa.spi dependency to domain-extension-example.jar
> 10:59:55,175 DEBUG [org.jboss.as.jpa] (MSC service thread 1-3) added
> (default provider) org.hibernate dependency to domain-extension-example.jar
> (since 1 PU(s) didn't specify jboss.as.jpa.providerModule)
> 10:59:55,175 DEBUG [org.jboss.as.jpa] (MSC service thread 1-3) added
> org.hibernate dependency to domain-extension-example.jar
> 10:59:55,196 TRACE [org.jboss.as.jpa] (MSC service thread 1-8) install
> persistence unit definition for jar domain-extension-example.jar
> 10:59:55,196 TRACE [org.jboss.as.jpa] (MSC service thread 1-8) adding
> 'vfs:/content/domain-extension-example.jar/' to annotation index map
> 10:59:55,196 TRACE [org.jboss.as.jpa] (MSC service thread 1-8) returning
> global (module) Persistence Provider
> org.hibernate.jpa.HibernatePersistenceProvider
> 10:59:55,199 DEBUG [org.jboss.as.jpa] (MSC service thread 1-8) loaded
> persistence provider adapter
> org.jboss.as.jpa.hibernate5.HibernatePersistenceProviderAdaptor from
> classloader ModuleClassLoader for Module "org.hibernate" version
> 5.3.6.Final from local module loader @400cff1a (finder: local module finder
> @275710fc (roots:
> /media/hdd/keycloak-4.6.0.Final/modules,/media/hdd/keycloak-4.6.0.Final/modules/system/layers/keycloak,/media/hdd/keycloak-4.6.0.Final/modules/system/layers/base))
> 10:59:55,202 TRACE [org.jboss.as.jpa] (MSC service thread 1-8) add second
> level cache dependencies with properties '{caches=entity,
> container=hibernate}'
> 10:59:55,203 TRACE [org.jboss.as.jpa] (MSC service thread 1-8) added
> PersistenceUnitService (phase 1 of 2) for 'service
> jboss.persistenceunit."domain-extension-example.jar#JavaHelps".__FIRST_PHASE__'.
> PU is ready for injector action.
> 10:59:55,204 TRACE [org.jboss.as.jpa] (MSC service thread 1-8) returning
> global (module) Persistence Provider
> org.hibernate.jpa.HibernatePersistenceProvider
> 10:59:55,206 INFO
> [org.keycloak.subsystem.server.extension.KeycloakProviderDeploymentProcessor]
> (MSC service thread 1-4) Deploying Keycloak provider:
> domain-extension-example.jar
> 10:59:55,234 TRACE [org.jboss.as.jpa] (MSC service thread 1-6) install
> persistence unit definition for jar domain-extension-example.jar
> 10:59:55,234 TRACE [org.jboss.as.jpa] (MSC service thread 1-6) adding
> 'vfs:/content/domain-extension-example.jar/' to annotation index map
> 10:59:55,234 TRACE [org.jboss.as.jpa] (MSC service thread 1-6) returning
> global (module) Persistence Provider
> org.hibernate.jpa.HibernatePersistenceProvider
> 10:59:55,235 TRACE [org.jboss.as.jpa] (MSC service thread 1-6) add second
> level cache dependencies with properties '{caches=entity,
> container=hibernate}'
> 10:59:55,235 TRACE [org.jboss.as.jpa] (MSC service thread 1-6) added
> PersistenceUnitService (phase 2 of 2) for 'service
> jboss.persistenceunit."domain-extension-example.jar#JavaHelps"'.??PU is
> ready for injector action.
> 
> 10:59:55,645 INFO??[org.jboss.as.jpa] (ServerService Thread Pool -- 57)
> WFLYJPA0010: Starting Persistence Unit (phase 1 of 2) Service
> 'domain-extension-example.jar#JavaHelps'
> 10:59:55,695 INFO??[org.hibernate.jpa.internal.util.LogHelper]
> (ServerService Thread Pool -- 57) HHH000204: Processing PersistenceUnitInfo
> [
> name: JavaHelps
> ...]
> 
> 10:59:56,038 INFO??[org.jboss.as.jpa] (ServerService Thread Pool -- 57)
> WFLYJPA0010: Starting Persistence Unit (phase 2 of 2) Service
> 'domain-extension-example.jar#JavaHelps'
> 
> 

From dt at acutus.pro  Thu Nov 22 06:14:47 2018
From: dt at acutus.pro (Dmitry Telegin)
Date: Thu, 22 Nov 2018 14:14:47 +0300
Subject: [keycloak-user] keucloak Hash Algorithm
In-Reply-To: <915b0473-2e52-3947-e136-99ebb8470f0c@ekt.gr>
References: <915b0473-2e52-3947-e136-99ebb8470f0c@ekt.gr>
Message-ID: <1542885287.3526.6.camel@acutus.pro>

Hello Dimitris,

Is it correct that your LDAP directory expects simple bind with username and password already hashed with SHA1 on the client side? This is very odd and not how LDAP normally operates. I'd suggest that you consider reconfiguring your LDAP to accept plain-text passwords, store them hashed (like "{SHA1}...") and use transport-layer security to protect them en route.

Otherwise, you will have to implement your own UserStorageProvider by extending org.keycloak.storage.ldap.LDAPStorageProvider and overriding isValid() method.

The mechanism for pluggable hash algorithms defines how Keycloak stores credentials inside its database, and therefore is irrelevant here.

Good luck,
Dmitry Telegin
CTO, Acutus s.r.o.
Keycloak Consulting and Training

Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
+42 (022) 888-30-71
E-mail: info at acutus.pro

On Thu, 2018-11-22 at 11:33 +0200, Dimitris Charlaftis wrote:
> Hello,
> I use keykloak 4.5 and i have set up a user federation to an ldap directory
> that uses SHA-1 password encoding.
> 
> In order to login to a realm that is connected to that ldap, I use the ldap
> username and the SHA-1 encoded password in the login form for the time
> being.
> 
> This is not good for common users!
> 
> ??All i want is this:
> 
> The user puts his username / password in plain text and keycloak transforms
> that password in plain text in the login form to the SHA-1 equivalent (that's how our ldap directory works..) , so
> that the ldap authorization succeeds.
> 
> In your password policy docs you state "See the Server Developer
> > Guide<https://keycloak.gitbooks.io/server-developer-guide/content/>??on how
> to plug in your own algorithm". Server dev guide does not have that
> information, where is it?
> 
> Thanks in advance,
> Dimitris
> 

From Christian.Fraenkel at actico.com  Thu Nov 22 06:26:54 2018
From: Christian.Fraenkel at actico.com (=?iso-8859-1?Q?Christian_Fr=E4nkel?=)
Date: Thu, 22 Nov 2018 11:26:54 +0000
Subject: [keycloak-user] can't use refresh token with keycloak-gatekeeper
In-Reply-To: <CACzr=FdkidXOJ2DDSbgW_yt_uJ4mPr+z56ARXJVna_-tUARGhQ@mail.gmail.com>
References: <CACzr=FdkidXOJ2DDSbgW_yt_uJ4mPr+z56ARXJVna_-tUARGhQ@mail.gmail.com>
Message-ID: <448921bb27c642d5b5bbb5110bfc29dc@DEIMSV0003.BFS-intra.net>

Hi,

I've encountered a similar issue and haven't been able to get the token refresh to work. I've also tried using a persistent boltdb store too without much luck.

My current configuration is the following (discovery url etc. are configured in the yaml config):
          - --config=/tmp/service.yaml
          - --enable-refresh-tokens
          - --enable-encrypted-token
          - --enable-logging=true
          - --enable-security-filter=true
          - --verbose

Here's an excerpt of my logs:
1.5428809565823147e+09  debug   keycloak-gatekeeper/middleware.go:337   access permitted to resource    {"access": "permitted", "email": "christian.fraenkel at actico.com", "expires": 29.417686616, "resource": "/api/console/*"}
1.5428809566050725e+09  info    keycloak-gatekeeper/middleware.go:90    client request  {"latency": 0.025043756, "status": 200, "bytes": 0, "client_ip": "192.168.201.89:43778", "method": "POST", "path": "/api/console/proxy"}

1.5428810165834415e+09  debug   keycloak-gatekeeper/session.go:51       found the user identity {"id": "b841a9ec-04e6-4284-9eeb-0999d9748900", "name": "chrfra01", "email": "christian.fraenkel at actico.com", "roles": "offline_access,uma_authorization,employee,test:user,kibana:user,account:manage-account,account:manage-account-links,account:view-profile"}
1.5428810165833974e+09  info    keycloak-gatekeeper/middleware.go:154   accces token for user has expired, attemping to refresh the token       {"client_ip": "192.168.201.89:44036", "email": "christian.fraenkel at actico.com"}
1.5428810168737714e+09  info    keycloak-gatekeeper/middleware.go:190   injecting the refreshed access token cookie     {"client_ip": "192.168.201.89:44036", "cookie_name": "kc-access", "email": "christian.fraenkel at actico.com", "expires_in": 299.126230477}
1.5428810168739688e+09  debug   keycloak-gatekeeper/middleware.go:337   access permitted to resource    {"access": "permitted", "email": "christian.fraenkel at actico.com", "expires": -30.873967499, "resource": "/api/console/*"}
1.5428810168941607e+09  info    keycloak-gatekeeper/middleware.go:90    client request  {"latency": 0.311326585, "status": 200, "bytes": 0, "client_ip": "192.168.201.89:44036", "method": "POST", "path": "/api/console/proxy"}

Once the expiration goes negative each request results in a new "injecting the refreshed access token cookie" line.
Once enough time has passed (expiery > 1500 in my case) I get the following message:

1.5428825166849744e+09  warn    keycloak-gatekeeper/middleware.go:175   refresh token has expired, cannot retrieve access token {"client_ip": "192.168.201.89:51046", "email": "christian.fraenkel at actico.com"}

After this line access is no longer possible and I get redirected to the login screen.


I've also found the following comment on a github commit where somebody else is encountering issues with refresh tokens:
https://github.com/keycloak/keycloak-gatekeeper/commit/0bb1c03b03c574542bd601d6f2df77c4dc06bc36#commitcomment-31130509


It would be nice to get the refresh token switch working. I'm also looking for solutions / input on this.

Regards,

Christian

-----Urspr?ngliche Nachricht-----
Von: keycloak-user-bounces at lists.jboss.org <keycloak-user-bounces at lists.jboss.org> Im Auftrag von Andrey Kozichev
Gesendet: Mittwoch, 21. November 2018 01:01
An: keycloak-user at lists.jboss.org
Betreff: [keycloak-user] can't use refresh token with keycloak-gatekeeper

Hello!
has anyone come across use of refresh tokens with keyckloak-gatekeeper?

I've got a Web app running behind keycloak-gatekeeper. Currently session expires after 5 minutes of inactivity. In the logs I see "session expired and access token refreshing is disabled".

To avoid this, I am trying to enable "refresh tokens" on my gatekeeper proxy by adding "*--enable-refresh-tokens=true"* , the full list of configuration options:


        - --client-id=my_clientid
        - --discovery-url=<keycloak_url>
        - --enable-default-deny=false
        - --enable-json-logging=true
        - --enable-logging=true
        - --enable-request-id=true
        - --enable-encrypted-token=true
        - --encryption-key=<secret>
*        - --enable-refresh-tokens=true*
        - --enable-security-filter=true
        - --listen=0.0.0.0:8080
        - --preserve-host=true
        - --redirection-url=http://my-public-url
        - --resources=uri=/*|roles=user-role
        - --upstream-url=myservice.svc.cluster.local:8080

However after adding "*enable-refresh-tokens=true*" - I get 502 when trying to login.
In the Gatekeeper logs I see below lines. Has anyone came across this? I must be missing something obvious.


{"level":"info","ts":1542757702.835068,"msg":"issuing access token for user","email":"myemail at gmail.com ","expires":"2018-11-20T23:53:22Z","duration":"4m59.164934314s"}

{"level":"info","ts":1542757702.8363702,"msg":"client
request","latency":0.05726285,"status":307,"bytes":37,"client_ip":"
10.44.1.32:60746","method":"GET","path":"/oauth/callback"}

*{"level":"error","ts":1542757702.8891447,"msg":"no session found in request, redirecting for authorization","error":"authentication session not
found"}*

{"level":"info","ts":1542757702.8892436,"msg":"client
request","latency":0.000152955,"status":307,"bytes":75,"client_ip":"
10.44.1.32:60752","method":"GET","path":"/favicon.ico"}

{"level":"info","ts":1542757703.03116,"msg":"client
request","latency":0.001002773,"status":307,"bytes":319,"client_ip":"
10.44.1.32:60754","method":"GET","path":"/oauth/authorize"}

{"level":"info","ts":1542757703.108161,"msg":"issuing access token for user","email":"myemail at gmail.com ","expires":"2018-11-20T23:53:23Z","duration":"4m59.891841634s"}

{"level":"info","ts":1542757703.109042,"msg":"client
request","latency":0.021427778,"status":307,"bytes":48,"client_ip":"
10.44.1.32:60758","method":"GET","path":"/oauth/callback"}


Regards,
Andrey
_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user


From sakodiya at grepruby.com  Thu Nov 22 10:01:26 2018
From: sakodiya at grepruby.com (Shubham Akodiya)
Date: Thu, 22 Nov 2018 20:31:26 +0530
Subject: [keycloak-user] How to add Authorization (policies) for public
	clients in keycloak
Message-ID: <CAN2cN6c0Sd8qxa2V_7sdpSD5XOtaFVLA6YLPa+73vyTKa6Vp4A@mail.gmail.com>

Hi,

I've one public client 'react' which uses the implicit grant for
authentication. Now I want to secure this app back-end APIs, thus need to
apply the authorization (policy, resource) settings. Is there any way to
use the *Authorization* settings for the public client?

As per my understanding, Authorization (policy, resource, scope) settings
does not apply for *Public (Client Protocol)* client, It only for *Credential
(Client Protocol) *client. Now the problem here is that when a user tries
to log in using *credential-keycloak-client, *In that case, we need to use
the *client_secret key* in front-end which would make the application more
vulnerable.

Let me know If my understanding is incorrect and feel free to share another
approach to resolve this issue.

Thanks,
Shubham Akodiya

From uo67113 at gmail.com  Thu Nov 22 10:29:34 2018
From: uo67113 at gmail.com (=?UTF-8?Q?Luis_Rodr=C3=ADguez_Fern=C3=A1ndez?=)
Date: Thu, 22 Nov 2018 16:29:34 +0100
Subject: [keycloak-user] SPI with a third party database. Could not find
 any META-INF/persistence.xml file in the classpath
In-Reply-To: <1542884136.3526.4.camel@acutus.pro>
References: <CACp70MkktkrmSCuKiE0gmAbGB1a_ePCaSpGiC_LYAc00RpcL1A@mail.gmail.com>
	<1542884136.3526.4.camel@acutus.pro>
Message-ID: <CACp70Mm1zodG6SEss6N-yny4y6B7esEr5t8mbSjZRQB58a4zyw@mail.gmail.com>

Hello Dmitry,

Thanks for your prompt response!

I will give it a try and let you know.

Cheers,

Luis











El jue., 22 nov. 2018 a las 11:55, Dmitry Telegin (<dt at acutus.pro>)
escribi?:

> Hello Luis,
>
> The path to persistence.xml you've found in the logs is the default
> location of persistence.xml for Keycloak's main module (server-war). But it
> is unused, since Keycloak uses custom persistence.xml location:
>
> https://github.com/keycloak/keycloak/blob/master/model/jpa/src/main/java/org/keycloak/connections/jpa/util/JpaUtils.java#L47
>
> You can use the same method (or at least the same technique) to load yours.
>
> Cheers,
> Dmitry Telegin
> CTO, Acutus s.r.o.
> Keycloak Consulting and Training
>
> Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
> +42 (022) 888-30-71
> E-mail: info at acutus.pro
>
> On Thu, 2018-11-22 at 11:18 +0100, Luis Rodr?guez Fern?ndez wrote:
> > Hello there,
> >
> > I am using the standalone server distribution [1].
> >
> > We need to extend the keycloak server [2] and we need to access a third
> > party database to get some data.
> >
> > I developed a sample domain extension based on the keycloak example
> domain
> > extension [3]. The deployment of this example one works at the first try,
> > thanks!!!
> >
> > My sample domain extension access a third party database (mysql), so in
> > wildfly...
> >
> > - I install the mysql driver
> > - I create a datasource
> >
> > ... and in my sample I create a META-INF/persistence.xml
> >
> > <persistence version>
> >     <persistence-unit name="JavaHelps" transaction-type="RESOURCE_LOCAL">
> >         <non-jta-data-source>java:/MySqlDS</non-jta-data-source>
> > <class>my.entity.Class</class>
> > <properties>
> >          <property name="hibernate.dialect"
> > value="org.hibernate.dialect.MySQLDialect"/>
> > </properties>
> >     </persistence-unit>
> > </persistence>
> >
> > I add my sample  $KEYCLOAK_HOME/bin/jboss-cli.sh --command="module add
> > --name=...
> >
> > And it seems that wildfly likes evrything (from standard output), you can
> > see below part of the wildfly output at startup time. However when I run
> it
> > I get:
> >
> > Uncaught server error: java.lang.ExceptionInInitializerError.... Caused
> by:
> > javax.persistence.PersistenceException: No Persistence provider for
> > EntityManager named JavaHelps
> >
> > I found a workaround: having a deeper look at the standard output I saw
> > this message...
> >
> > parse checking if
> >
> "$KEYCLOAK_HOMEl/modules/system/layers/keycloak/org/keycloak/keycloak-server-subsystem/main/server-war/WEB-INF/classes/META-INF/persistence.xml"
> > exists, result = false
> > 10:59:55,279 TRACE [org.jboss.as.jpa] (MSC service thread 1-1) parsed
> > persistence unit definitions for war server-war
> >
> > ... so if I copy my persistence.xml to that location my domain extension
> > sample WORKS! My question is WHY???
> >
> > Any thoughts on this?
> >
> > Thanks in advance,
> >
> > Luis
> >
> > [1]
> >
> https://downloads.jboss.org/keycloak/4.6.0.Final/keycloak-4.6.0.Final.zip
> > [2]
> >
> https://www.keycloak.org/docs/latest/server_development/index.html#_extensions
> > [3]
> >
> https://github.com/keycloak/keycloak/tree/master/examples/providers/domain-extension
> >
> > 10:59:54,575 INFO  [org.jboss.as.connector.subsystems.datasources]
> > (ServerService Thread Pool -- 28) WFLYJCA0005: Deploying
> non-JDBC-compliant
> > driver class com.mysql.jdbc.Driver (version 5.1)
> >
> > 10:59:55,071 INFO  [org.jboss.as.connector.subsystems.datasources] (MSC
> > service thread 1-8) WFLYJCA0001: Bound data source [java:/MySqlDS]
> >
> > 10:59:55,158 TRACE [org.jboss.as.jpa] (MSC service thread 1-7) parse
> > checking if
> > "/content/domain-extension-example.jar/META-INF/persistence.xml" exists,
> > result = true
> > 10:59:55,163 TRACE [org.jboss.as.jpa] (MSC service thread 1-7) parse
> > persistence.xml: attribute value(0) = JavaHelps
> > 10:59:55,163 TRACE [org.jboss.as.jpa] (MSC service thread 1-7) parse
> > persistence.xml: attribute value(1) = RESOURCE_LOCAL
> > 10:59:55,164 TRACE [org.jboss.as.jpa] (MSC service thread 1-7) parse
> > persistence.xml: element=non-jta-data-source
> > 10:59:55,164 TRACE [org.jboss.as.jpa] (MSC service thread 1-7) parse
> > persistence.xml: element=class
> > 10:59:55,164 TRACE [org.jboss.as.jpa] (MSC service thread 1-7) parse
> > persistence.xml: element=properties
> > 10:59:55,165 TRACE [org.jboss.as.jpa] (MSC service thread 1-7) parse
> > persistence.xml: reached ending persistence-unit tag
> > 10:59:55,165 INFO  [org.jboss.as.jpa] (MSC service thread 1-7)
> WFLYJPA0002:
> > Read persistence.xml for JavaHelps
> > 10:59:55,166 TRACE [org.jboss.as.jpa] (MSC service thread 1-7)
> > PersistenceUnitMetadataImpl(version=2.1) [
> > name: JavaHelps
> > jtaDataSource: null
> > nonJtaDataSource: java:/MySqlDS
> > transactionType: RESOURCE_LOCAL
> > provider: org.hibernate.jpa.HibernatePersistenceProvider
> > classes[
> > com.javahelps.jpa.Student ]
> > packages[
> > ]
> > mappingFiles[
> > ]
> > jarFiles[
> > ]
> > validation-mode: AUTO
> > shared-cache-mode: UNSPECIFIED
> > properties[
> > hibernate.dialect: org.hibernate.dialect.MySQLDialect
> > ]]
> > 10:59:55,167 TRACE [org.jboss.as.jpa] (MSC service thread 1-7) parsed
> > persistence unit definitions for jar domain-extension-example.jar
> > 10:59:55,168 TRACE [org.jboss.as.jpa] (MSC service thread 1-7)
> incrementing
> > PU count for domain-extension-example.jar by 1
> > 10:59:55,174 DEBUG [org.jboss.as.jpa] (MSC service thread 1-3) added
> > javax.persistence.api dependency to domain-extension-example.jar
> > 10:59:55,174 DEBUG [org.jboss.as.jpa] (MSC service thread 1-3) added
> > org.hibernate.bytecodetransformer dependency to
> domain-extension-example.jar
> > 10:59:55,175 DEBUG [org.jboss.as.jpa] (MSC service thread 1-3) added
> > org.jboss.as.jpa dependency to domain-extension-example.jar
> > 10:59:55,175 DEBUG [org.jboss.as.jpa] (MSC service thread 1-3) added
> > org.jboss.as.jpa.spi dependency to domain-extension-example.jar
> > 10:59:55,175 DEBUG [org.jboss.as.jpa] (MSC service thread 1-3) added
> > (default provider) org.hibernate dependency to
> domain-extension-example.jar
> > (since 1 PU(s) didn't specify jboss.as.jpa.providerModule)
> > 10:59:55,175 DEBUG [org.jboss.as.jpa] (MSC service thread 1-3) added
> > org.hibernate dependency to domain-extension-example.jar
> > 10:59:55,196 TRACE [org.jboss.as.jpa] (MSC service thread 1-8) install
> > persistence unit definition for jar domain-extension-example.jar
> > 10:59:55,196 TRACE [org.jboss.as.jpa] (MSC service thread 1-8) adding
> > 'vfs:/content/domain-extension-example.jar/' to annotation index map
> > 10:59:55,196 TRACE [org.jboss.as.jpa] (MSC service thread 1-8) returning
> > global (module) Persistence Provider
> > org.hibernate.jpa.HibernatePersistenceProvider
> > 10:59:55,199 DEBUG [org.jboss.as.jpa] (MSC service thread 1-8) loaded
> > persistence provider adapter
> > org.jboss.as.jpa.hibernate5.HibernatePersistenceProviderAdaptor from
> > classloader ModuleClassLoader for Module "org.hibernate" version
> > 5.3.6.Final from local module loader @400cff1a (finder: local module
> finder
> > @275710fc (roots:
> >
> /media/hdd/keycloak-4.6.0.Final/modules,/media/hdd/keycloak-4.6.0.Final/modules/system/layers/keycloak,/media/hdd/keycloak-4.6.0.Final/modules/system/layers/base))
> > 10:59:55,202 TRACE [org.jboss.as.jpa] (MSC service thread 1-8) add second
> > level cache dependencies with properties '{caches=entity,
> > container=hibernate}'
> > 10:59:55,203 TRACE [org.jboss.as.jpa] (MSC service thread 1-8) added
> > PersistenceUnitService (phase 1 of 2) for 'service
> >
> jboss.persistenceunit."domain-extension-example.jar#JavaHelps".__FIRST_PHASE__'.
> > PU is ready for injector action.
> > 10:59:55,204 TRACE [org.jboss.as.jpa] (MSC service thread 1-8) returning
> > global (module) Persistence Provider
> > org.hibernate.jpa.HibernatePersistenceProvider
> > 10:59:55,206 INFO
> >
> [org.keycloak.subsystem.server.extension.KeycloakProviderDeploymentProcessor]
> > (MSC service thread 1-4) Deploying Keycloak provider:
> > domain-extension-example.jar
> > 10:59:55,234 TRACE [org.jboss.as.jpa] (MSC service thread 1-6) install
> > persistence unit definition for jar domain-extension-example.jar
> > 10:59:55,234 TRACE [org.jboss.as.jpa] (MSC service thread 1-6) adding
> > 'vfs:/content/domain-extension-example.jar/' to annotation index map
> > 10:59:55,234 TRACE [org.jboss.as.jpa] (MSC service thread 1-6) returning
> > global (module) Persistence Provider
> > org.hibernate.jpa.HibernatePersistenceProvider
> > 10:59:55,235 TRACE [org.jboss.as.jpa] (MSC service thread 1-6) add second
> > level cache dependencies with properties '{caches=entity,
> > container=hibernate}'
> > 10:59:55,235 TRACE [org.jboss.as.jpa] (MSC service thread 1-6) added
> > PersistenceUnitService (phase 2 of 2) for 'service
> > jboss.persistenceunit."domain-extension-example.jar#JavaHelps"'.  PU is
> > ready for injector action.
> >
> > 10:59:55,645 INFO  [org.jboss.as.jpa] (ServerService Thread Pool -- 57)
> > WFLYJPA0010: Starting Persistence Unit (phase 1 of 2) Service
> > 'domain-extension-example.jar#JavaHelps'
> > 10:59:55,695 INFO  [org.hibernate.jpa.internal.util.LogHelper]
> > (ServerService Thread Pool -- 57) HHH000204: Processing
> PersistenceUnitInfo
> > [
> > name: JavaHelps
> > ...]
> >
> > 10:59:56,038 INFO  [org.jboss.as.jpa] (ServerService Thread Pool -- 57)
> > WFLYJPA0010: Starting Persistence Unit (phase 2 of 2) Service
> > 'domain-extension-example.jar#JavaHelps'
> >
> >
>


-- 

"Ever tried. Ever failed. No matter. Try Again. Fail again. Fail better."

- Samuel Beckett

From danielfr at cern.ch  Thu Nov 22 10:52:39 2018
From: danielfr at cern.ch (Daniel Fernandez Rodriguez)
Date: Thu, 22 Nov 2018 16:52:39 +0100
Subject: [keycloak-user] Theoretical max number of clients Kecyloak can
	handle
Message-ID: <d8e906a1-fc59-d7ca-c380-a702cba7acce@cern.ch>

Hi All,

What's the theoretical max number of clients Keycloak can handle 
efficiently?

I'm doing some tests where I created around 10000 clients (saml & 
openid, all under the same realm) and now every operation that has to do 
with clients (list them, create new one, get one by ID, etc) became 
extremely slow and sometimes they even timeout. The other API endpoints 
seem to perform just fine.

I'm using 4.6.0.Final and MySQL DB as a data store.

Are there some options I can tweak to improve the performance with a few 
thousands clients (ideally around 50K)? Will postgres perform better?

Thanks a lot,

Daniel.


From rafaelweingartner at gmail.com  Thu Nov 22 11:40:54 2018
From: rafaelweingartner at gmail.com (=?UTF-8?Q?Rafael_Weing=C3=A4rtner?=)
Date: Thu, 22 Nov 2018 14:40:54 -0200
Subject: [keycloak-user] Admin like user that is only enabled to
	create/delete/manage other users?
Message-ID: <CAG97radgtfSD9YbSeYkci-k7jx0H9HXmasQVPJkp1n9gcWw4VA@mail.gmail.com>

Hello Keycloakers,

I have been wondering, is it possible to configure a role (or do some other
configurations) that would allow me to create a user type that is able to
manage other users, but not changing/seeing other realm settings?

--
Rafael Weing?rtner

From rafaelweingartner at gmail.com  Thu Nov 22 13:01:29 2018
From: rafaelweingartner at gmail.com (=?UTF-8?Q?Rafael_Weing=C3=A4rtner?=)
Date: Thu, 22 Nov 2018 16:01:29 -0200
Subject: [keycloak-user] Admin like user that is only enabled to
 create/delete/manage other users?
In-Reply-To: <CAG97radgtfSD9YbSeYkci-k7jx0H9HXmasQVPJkp1n9gcWw4VA@mail.gmail.com>
References: <CAG97radgtfSD9YbSeYkci-k7jx0H9HXmasQVPJkp1n9gcWw4VA@mail.gmail.com>
Message-ID: <CAG97rae4mK8EMCZsBDqFK8tqyXtU9mys9o-bFtwJB-DzUEPsKA@mail.gmail.com>

Never mind. I just found a way to do that ;)

On Thu, Nov 22, 2018 at 2:40 PM Rafael Weing?rtner <
rafaelweingartner at gmail.com> wrote:

> Hello Keycloakers,
>
> I have been wondering, is it possible to configure a role (or do some
> other configurations) that would allow me to create a user type that is
> able to manage other users, but not changing/seeing other realm settings?
>
> --
> Rafael Weing?rtner
>


-- 
Rafael Weing?rtner

From psilva at redhat.com  Thu Nov 22 13:36:11 2018
From: psilva at redhat.com (Pedro Igor Silva)
Date: Thu, 22 Nov 2018 16:36:11 -0200
Subject: [keycloak-user] How to add Authorization (policies) for public
 clients in keycloak
In-Reply-To: <CAN2cN6c0Sd8qxa2V_7sdpSD5XOtaFVLA6YLPa+73vyTKa6Vp4A@mail.gmail.com>
References: <CAN2cN6c0Sd8qxa2V_7sdpSD5XOtaFVLA6YLPa+73vyTKa6Vp4A@mail.gmail.com>
Message-ID: <CAJrcDBdaODBCzjEnSYHFBNypM9xe-bkRW=WqzK87XYsZ0=YOMg@mail.gmail.com>

For public clients, you can use access tokens (as a bearer) to send
authorization requests to the server. Please, take a look here [1].

[1]
https://www.keycloak.org/docs/latest/authorization_services/index.html#_service_obtaining_permissions

Regards.
Pedro Igor

On Thu, Nov 22, 2018 at 1:05 PM Shubham Akodiya <sakodiya at grepruby.com>
wrote:

> Hi,
>
> I've one public client 'react' which uses the implicit grant for
> authentication. Now I want to secure this app back-end APIs, thus need to
> apply the authorization (policy, resource) settings. Is there any way to
> use the *Authorization* settings for the public client?
>
> As per my understanding, Authorization (policy, resource, scope) settings
> does not apply for *Public (Client Protocol)* client, It only for
> *Credential
> (Client Protocol) *client. Now the problem here is that when a user tries
> to log in using *credential-keycloak-client, *In that case, we need to use
> the *client_secret key* in front-end which would make the application more
> vulnerable.
>
> Let me know If my understanding is incorrect and feel free to share another
> approach to resolve this issue.
>
> Thanks,
> Shubham Akodiya
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

From mposolda at redhat.com  Fri Nov 23 02:27:15 2018
From: mposolda at redhat.com (Marek Posolda)
Date: Fri, 23 Nov 2018 08:27:15 +0100
Subject: [keycloak-user] LDAP role mapper loses client on client renaming
In-Reply-To: <CB46949C2F22AC48BDB4771532A5FC735D87A42E@NT-EX02.dnsbego.de>
References: <CB46949C2F22AC48BDB4771532A5FC735D87A42E@NT-EX02.dnsbego.de>
Message-ID: <b9db3fba-6895-b1aa-69b1-c14bf4377033@redhat.com>

Hi,

feel free to create JIRA for this if it doesn't yet exists. Maybe this 
can be improved, but not sure...

BTV. If you have a chance, you? can try to configure some other mappers 
dependent on client as I think that this issue is not specific to LDAP 
mappers (EG. hardcodedRole protocol mapper in the "mappers" tab of some 
client "clientA" and which will point to the client role of "clientB", 
and check if it handles renaming of clientB etc.)

Thanks,
Marek

On 22/11/2018 09:59, Peem?ller, Bj?rn wrote:
> Hi all,
>
> in our Keycloak installation we have connected Keycloak to an internal AD using user federation and configured a role-ldap-mapper as described in https://www.keycloak.org/docs/latest/server_admin/index.html#_ldap_mappers .
>
> We now discovered that if we rename a client, than the associated LDAP mapper loses the connection to the client, as it stores only the client name but not its internal id in the mapper configuration.
>
> Currently, we therefore need to reconfigure all associated mappers once we rename a client.
>
> Is it possible to avoid this problem (or wouldn't it be even better to store the internal UUID)?
>
> Kind regards,
> Bj?rn
>
> Bj?rn Peem?ller
> IT & IT Operations
>
> BERENBERG
> Joh. Berenberg, Gossler & Co. KG
> Neuer Jungfernstieg 20
> 20354 Hamburg
>
> Telefon +49 40 350 60-8548
> Telefax +49 40 350 60-900
> E-Mail bjoern.peemoeller at berenberg.de<mailto:bjoern.peemoeller at berenberg.de>
> www.berenberg.de<http://www.berenberg.de/>
>
> Sitz: Hamburg - Amtsgericht Hamburg HRA 42659
>
>
> Bei Berenberg hat der Schutz Ihrer Daten seit jeher h?chste Priorit?t. Informationen zum Umgang mit personenbezogenen Daten finden Sie hier: https://www.berenberg.de/files/Rechtliche%20Hinweise/DSGVO/DSGVO-Kundeninformation%20-%20Binder%20-%20D.pdf
> Diese Nachricht einschliesslich etwa beigefuegter Anhaenge ist vertraulich und kann dem Bank- und Datengeheimnis unterliegen oder sonst rechtlich geschuetzte Daten und Informationen enthalten. Wenn Sie nicht der richtige Adressat sind oder diese Nachricht irrtuemlich erhalten haben, informieren Sie bitte sofort den Absender ?ber die Antwortfunktion. Anschliessend moechten Sie bitte diese Nachricht einschliesslich etwa beigefuegter Anhaenge unverzueglich vollstaendig loeschen. Das unerlaubte Kopieren oder Speichern dieser Nachricht und/oder der ihr etwa beigefuegten Anhaenge sowie die unbefugte Weitergabe der darin enthaltenen Daten und Informationen sind nicht gestattet. Wir weisen darauf hin, dass rechtsverbindliche Erklaerungen namens unseres Hauses grundsaetzlich der Unterschriften zweier ausreichend bevollmaechtigter Vertreter unseres Hauses beduerfen. Wir verschicken daher keine rechtsverbindlichen Erklaerungen per E-Mail an Dritte. Demgemaess nehmen wir per E-Mail auch keine rechtsverbindlichen Erklaerungen oder Auftraege von Dritten entgegen.
> Sollten Sie Schwierigkeiten beim Oeffnen dieser E-Mail haben, wenden Sie sich bitte an den Absender oder an info at berenberg.de. Please refer to https://www.berenberg.de/files/Rechtliche%20Hinweise/DSGVO/DSGVO-Kundeninformation-Binder%20EN%20L%20Webdsite.pdf for our confidentiality notice.
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user





From Alexander.Philippi at abas.de  Fri Nov 23 03:33:57 2018
From: Alexander.Philippi at abas.de (Alexander Philippi)
Date: Fri, 23 Nov 2018 08:33:57 +0000
Subject: [keycloak-user] Keycloak-js adapter ES6/Promise
Message-ID: <6ad8e6d8511046bfbf417fcae68f9fc7@vm-johndoe.abasag.intra>

Hi,
I start using the javascript adapter this week. The documentation https://www.keycloak.org/docs/4.6/securing_apps/#_javascript_adapter "says" that the init(...) function should returns a Promise.
After installing the official(?) javascript adapter with "npm install keycloak-js" I only get the old "success" function as return value.

I don't understand what I am doing wrong here. Shouldn't I get a keycloak.js file with a Promise in it? Also I wonder if the keycloak-js adapter should be on ES6 so I am able to do an "import Keycloak from "keycloak-js"". I don't find any information about on https://github.com/keycloak/keycloak-js-bower. Since 4.0.0-beta nothing changed here.

Best Regards
Alex

From geoff at opticks.io  Fri Nov 23 04:00:43 2018
From: geoff at opticks.io (Geoffrey Cleaves)
Date: Fri, 23 Nov 2018 10:00:43 +0100
Subject: [keycloak-user] Keycloak-js adapter ES6/Promise
In-Reply-To: <6ad8e6d8511046bfbf417fcae68f9fc7@vm-johndoe.abasag.intra>
References: <6ad8e6d8511046bfbf417fcae68f9fc7@vm-johndoe.abasag.intra>
Message-ID: <CAHzT=q9s4x2z4gwf9rHzQiQ=cA6pBkVRHwcfZ19sDYPASxpb2A@mail.gmail.com>

The JS adapters workings have changed in 4.6 and the docs have not been
updated:
https://github.com/keycloak/keycloak-documentation/pull/521#pullrequestreview-176267613

Regards,
Geoffrey Cleaves







On Fri, 23 Nov 2018 at 09:43, Alexander Philippi <Alexander.Philippi at abas.de>
wrote:

> Hi,
> I start using the javascript adapter this week. The documentation
> https://www.keycloak.org/docs/4.6/securing_apps/#_javascript_adapter
> "says" that the init(...) function should returns a Promise.
> After installing the official(?) javascript adapter with "npm install
> keycloak-js" I only get the old "success" function as return value.
>
> I don't understand what I am doing wrong here. Shouldn't I get a
> keycloak.js file with a Promise in it? Also I wonder if the keycloak-js
> adapter should be on ES6 so I am able to do an "import Keycloak from
> "keycloak-js"". I don't find any information about on
> https://github.com/keycloak/keycloak-js-bower. Since 4.0.0-beta nothing
> changed here.
>
> Best Regards
> Alex
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

From marco.scheuermann at daimler.com  Fri Nov 23 04:59:59 2018
From: marco.scheuermann at daimler.com (marco.scheuermann at daimler.com)
Date: Fri, 23 Nov 2018 09:59:59 +0000
Subject: [keycloak-user] Updating user attributes within an Authenticator
Message-ID: <3F8C44A8-8771-4ADC-9743-44274A868D5D@daimler.com>

Hi community,

is there a way to update custom user attributes within an Authenticator?
I currently cannot find any API which allows to update an existing user.

I only can find this for credentials:

UserCredentialModel userCredentialModel = new UserCredentialModel();

userCredentialModel.setType(UserCredentialModel.PASSWORD);

userCredentialModel.setValue(?password?);

session.userCredentialManager().updateCredential(realmModel, userModel, userCredentialModel);

How can I update custom user attributes?

Thank you,
Marco


If you are not the addressee, please inform us immediately that you have received this e-mail by mistake, and delete it. We thank you for your support.


From dt at acutus.pro  Fri Nov 23 05:29:16 2018
From: dt at acutus.pro (Dmitry Telegin)
Date: Fri, 23 Nov 2018 13:29:16 +0300
Subject: [keycloak-user] Updating user attributes within an Authenticator
In-Reply-To: <3F8C44A8-8771-4ADC-9743-44274A868D5D@daimler.com>
References: <3F8C44A8-8771-4ADC-9743-44274A868D5D@daimler.com>
Message-ID: <1542968956.2058.0.camel@acutus.pro>

Hello Marco,

Please check this out: http://lists.jboss.org/pipermail/keycloak-user/2018-November/016299.html

Cheers,
Dmitry Telegin
CTO, Acutus s.r.o.
Keycloak Consulting and Training

Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
+42 (022) 888-30-71
E-mail: info at acutus.pro

On Fri, 2018-11-23 at 09:59 +0000, marco.scheuermann at daimler.com wrote:
> Hi community,
> 
> is there a way to update custom user attributes within an Authenticator?
> I currently cannot find any API which allows to update an existing user.
> 
> I only can find this for credentials:
> 
> UserCredentialModel userCredentialModel = new UserCredentialModel();
> 
> userCredentialModel.setType(UserCredentialModel.PASSWORD);
> 
> userCredentialModel.setValue(?password?);
> 
> session.userCredentialManager().updateCredential(realmModel, userModel, userCredentialModel);
> 
> How can I update custom user attributes?
> 
> Thank you,
> Marco
> 
> 
> If you are not the addressee, please inform us immediately that you have received this e-mail by mistake, and delete it. We thank you for your support.
> 
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From bruno at abstractj.org  Fri Nov 23 05:48:02 2018
From: bruno at abstractj.org (Bruno Oliveira)
Date: Fri, 23 Nov 2018 08:48:02 -0200
Subject: [keycloak-user] Keycloak-js adapter ES6/Promise
In-Reply-To: <CAHzT=q9s4x2z4gwf9rHzQiQ=cA6pBkVRHwcfZ19sDYPASxpb2A@mail.gmail.com>
References: <6ad8e6d8511046bfbf417fcae68f9fc7@vm-johndoe.abasag.intra>
	<CAHzT=q9s4x2z4gwf9rHzQiQ=cA6pBkVRHwcfZ19sDYPASxpb2A@mail.gmail.com>
Message-ID: <20181123104802.GA31688@abstractj.org>

Hi Geoffrey, 

I believe this change has to wait until the next release to go live.

On 2018-11-23, Geoffrey Cleaves wrote:
> The JS adapters workings have changed in 4.6 and the docs have not been
> updated:
> https://github.com/keycloak/keycloak-documentation/pull/521#pullrequestreview-176267613
> 
> Regards,
> Geoffrey Cleaves
> 
> 
> 
> 
> 
> 
> 
> On Fri, 23 Nov 2018 at 09:43, Alexander Philippi <Alexander.Philippi at abas.de>
> wrote:
> 
> > Hi,
> > I start using the javascript adapter this week. The documentation
> > https://www.keycloak.org/docs/4.6/securing_apps/#_javascript_adapter
> > "says" that the init(...) function should returns a Promise.
> > After installing the official(?) javascript adapter with "npm install
> > keycloak-js" I only get the old "success" function as return value.
> >
> > I don't understand what I am doing wrong here. Shouldn't I get a
> > keycloak.js file with a Promise in it? Also I wonder if the keycloak-js
> > adapter should be on ES6 so I am able to do an "import Keycloak from
> > "keycloak-js"". I don't find any information about on
> > https://github.com/keycloak/keycloak-js-bower. Since 4.0.0-beta nothing
> > changed here.
> >
> > Best Regards
> > Alex
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
> >
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

-- 

abstractj

From bruno at abstractj.org  Fri Nov 23 05:51:41 2018
From: bruno at abstractj.org (Bruno Oliveira)
Date: Fri, 23 Nov 2018 08:51:41 -0200
Subject: [keycloak-user] Logging not working properly
In-Reply-To: <CACz=5k=yTybjn1KMJrLFobTV_u2MFwV3tfkHSfQK=72hLrAYfQ@mail.gmail.com>
References: <CACz=5k=yTybjn1KMJrLFobTV_u2MFwV3tfkHSfQK=72hLrAYfQ@mail.gmail.com>
Message-ID: <20181123105141.GB31688@abstractj.org>

What are the steps to reproduce this output? Which Keycloak release are
we talking?

On 2018-11-20, So Be wrote:
> I see this in keycloak log:
> 
> LogManager error of type FORMAT_FAILURE: Formatting error
> java.util.IllegalFormatConversionException: d != java.util.UUID
> 
> ...
> 
> Anyone knows the cause of this issue?
> 
> Sofiane.
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

-- 

abstractj

From geoff at opticks.io  Fri Nov 23 06:55:12 2018
From: geoff at opticks.io (Geoffrey Cleaves)
Date: Fri, 23 Nov 2018 12:55:12 +0100
Subject: [keycloak-user] Keycloak-js adapter ES6/Promise
In-Reply-To: <20181123104802.GA31688@abstractj.org>
References: <6ad8e6d8511046bfbf417fcae68f9fc7@vm-johndoe.abasag.intra>
	<CAHzT=q9s4x2z4gwf9rHzQiQ=cA6pBkVRHwcfZ19sDYPASxpb2A@mail.gmail.com>
	<20181123104802.GA31688@abstractj.org>
Message-ID: <CAHzT=q9=DgFenfVYLHqbb1afwkYY7Ybx5Xg018FLEVzgvnVqaQ@mail.gmail.com>

Hi Bruno, are you referring to the changes I made to the documentation
reflecting the new way that the JS adaptor works? Hopefully the
documentation releases move at a faster pace than Keycloak releases,
otherwise the public facing documentation could be wrong for weeks even
though it has been corrected in the master branch.


On Fri, 23 Nov 2018 at 11:48, Bruno Oliveira <bruno at abstractj.org> wrote:

> Hi Geoffrey,
>
> I believe this change has to wait until the next release to go live.
>
> On 2018-11-23, Geoffrey Cleaves wrote:
> > The JS adapters workings have changed in 4.6 and the docs have not been
> > updated:
> >
> https://github.com/keycloak/keycloak-documentation/pull/521#pullrequestreview-176267613
> >
> > Regards,
> > Geoffrey Cleaves
> >
> >
> >
> >
> >
> >
> >
> > On Fri, 23 Nov 2018 at 09:43, Alexander Philippi <
> Alexander.Philippi at abas.de>
> > wrote:
> >
> > > Hi,
> > > I start using the javascript adapter this week. The documentation
> > > https://www.keycloak.org/docs/4.6/securing_apps/#_javascript_adapter
> > > "says" that the init(...) function should returns a Promise.
> > > After installing the official(?) javascript adapter with "npm install
> > > keycloak-js" I only get the old "success" function as return value.
> > >
> > > I don't understand what I am doing wrong here. Shouldn't I get a
> > > keycloak.js file with a Promise in it? Also I wonder if the keycloak-js
> > > adapter should be on ES6 so I am able to do an "import Keycloak from
> > > "keycloak-js"". I don't find any information about on
> > > https://github.com/keycloak/keycloak-js-bower. Since 4.0.0-beta
> nothing
> > > changed here.
> > >
> > > Best Regards
> > > Alex
> > > _______________________________________________
> > > keycloak-user mailing list
> > > keycloak-user at lists.jboss.org
> > > https://lists.jboss.org/mailman/listinfo/keycloak-user
> > >
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
>
> --
>
> abstractj
>

From akozichev at gmail.com  Fri Nov 23 10:21:33 2018
From: akozichev at gmail.com (Andrey Kozichev)
Date: Fri, 23 Nov 2018 15:21:33 +0000
Subject: [keycloak-user] can't use refresh token with keycloak-gatekeeper
In-Reply-To: <CACzr=FdkidXOJ2DDSbgW_yt_uJ4mPr+z56ARXJVna_-tUARGhQ@mail.gmail.com>
References: <CACzr=FdkidXOJ2DDSbgW_yt_uJ4mPr+z56ARXJVna_-tUARGhQ@mail.gmail.com>
Message-ID: <CACzr=Fc2Ld4cXnNX6Y=VtW24+q1KOYwMA0cABUfFKmoqU0s5tw@mail.gmail.com>

replying to my own question. Looks like all configuration was correct. The
issues was specific only to the particular test user.
Newly created user works as expected.

After removing Test User from multiple roles/groups the issue disappeared.
Can't tell for sure which group membership was causing it.

Thank you All!

Regards,
Andrey
---
https://getantler.io/

On Wed, 21 Nov 2018 at 00:01, Andrey Kozichev <akozichev at gmail.com> wrote:

> Hello!
> has anyone come across use of refresh tokens with keyckloak-gatekeeper?
>
> I've got a Web app running behind keycloak-gatekeeper. Currently session
> expires after 5 minutes of inactivity. In the logs I see "session expired
> and access token refreshing is disabled".
>
> To avoid this, I am trying to enable "refresh tokens" on my gatekeeper
> proxy by adding "*--enable-refresh-tokens=true"* , the full list of
> configuration options:
>
>
>         - --client-id=my_clientid
>         - --discovery-url=<keycloak_url>
>         - --enable-default-deny=false
>         - --enable-json-logging=true
>         - --enable-logging=true
>         - --enable-request-id=true
>         - --enable-encrypted-token=true
>         - --encryption-key=<secret>
> *        - --enable-refresh-tokens=true*
>         - --enable-security-filter=true
>         - --listen=0.0.0.0:8080
>         - --preserve-host=true
>         - --redirection-url=http://my-public-url
>         - --resources=uri=/*|roles=user-role
>         - --upstream-url=myservice.svc.cluster.local:8080
>
> However after adding "*enable-refresh-tokens=true*" - I get 502 when
> trying to login.
> In the Gatekeeper logs I see below lines. Has anyone came across this? I
> must be missing something obvious.
>
>
> {"level":"info","ts":1542757702.835068,"msg":"issuing access token for
> user","email":"myemail at gmail.com
> ","expires":"2018-11-20T23:53:22Z","duration":"4m59.164934314s"}
>
> {"level":"info","ts":1542757702.8363702,"msg":"client
> request","latency":0.05726285,"status":307,"bytes":37,"client_ip":"
> 10.44.1.32:60746","method":"GET","path":"/oauth/callback"}
>
> *{"level":"error","ts":1542757702.8891447,"msg":"no session found in
> request, redirecting for authorization","error":"authentication session not
> found"}*
>
> {"level":"info","ts":1542757702.8892436,"msg":"client
> request","latency":0.000152955,"status":307,"bytes":75,"client_ip":"
> 10.44.1.32:60752","method":"GET","path":"/favicon.ico"}
>
> {"level":"info","ts":1542757703.03116,"msg":"client
> request","latency":0.001002773,"status":307,"bytes":319,"client_ip":"
> 10.44.1.32:60754","method":"GET","path":"/oauth/authorize"}
>
> {"level":"info","ts":1542757703.108161,"msg":"issuing access token for
> user","email":"myemail at gmail.com
> ","expires":"2018-11-20T23:53:23Z","duration":"4m59.891841634s"}
>
> {"level":"info","ts":1542757703.109042,"msg":"client
> request","latency":0.021427778,"status":307,"bytes":48,"client_ip":"
> 10.44.1.32:60758","method":"GET","path":"/oauth/callback"}
>
>
> Regards,
> Andrey
>

From anpasq at gmail.com  Fri Nov 23 11:29:12 2018
From: anpasq at gmail.com (Andrea Pasqualini)
Date: Fri, 23 Nov 2018 17:29:12 +0100
Subject: [keycloak-user] Theoretical max number of clients Kecyloak can
	handle
Message-ID: <CADYG=Jc+=GmDCRcYVDkj-Giwz3Xv7APrDbg_zt6MeevvJEd9kQ@mail.gmail.com>

Hi Daniel

Unfortunately as you can see here https://issues.jboss.org/browse/KEYCLOAK-8275
keycloak does not properly handle large numbers of clients.

Vote the issue if you are interested.

Regards
Andrea

>Hi All,
>
>What's the theoretical max number of clients Keycloak can handle
>efficiently?
>
>I'm doing some tests where I created around 10000 clients (saml &
>openid, all under the same realm) and now every operation that has to do
>with clients (list them, create new one, get one by ID, etc) became
>extremely slow and sometimes they even timeout. The other API endpoints
>seem to perform just fine.
>
>I'm using 4.6.0.Final and MySQL DB as a data store.
>
>Are there some options I can tweak to improve the performance with a few
>thousands clients (ideally around 50K)? Will postgres perform better?
>
>Thanks a lot,
>
>Daniel.

From ljbanii at gmail.com  Sat Nov 24 00:47:28 2018
From: ljbanii at gmail.com (Joe Livu)
Date: Sat, 24 Nov 2018 16:47:28 +1100
Subject: [keycloak-user] Securing an ASP.NET Core 2.1 Web API with KeyCloak
Message-ID: <CAJjftGAWdYKwOYhXqELJx+41End=Vi+Up_m754Y55qMr9OA7GA@mail.gmail.com>

Hi,

Has anyone had any success securing an ASP.NET Core 2.1 Web API with
KeyCloak? Am interested to learn more on such implementation.

Much appreciated for any assistance.

Regards,
Joe

From geoff at opticks.io  Sat Nov 24 02:37:52 2018
From: geoff at opticks.io (Geoffrey Cleaves)
Date: Sat, 24 Nov 2018 08:37:52 +0100
Subject: [keycloak-user] Clients purely for namespacing, makes sense?
Message-ID: <CAHzT=q9EM+7aTDJORchmf0Rzs3n7DJv0QQ25oCQW0+k6=B0UGA@mail.gmail.com>

Hi, looking for a little advise. I have a typical SPA front end and REST
API.

Each customer can have multiple users with different roles like admin or
user. It's conceivable for a single user to belong to two different
customer accounts.

Because a single user could be an admin to account A and only a user in
account B, I thought of using Keycloak clients for namespacing the roles. I
would create a disabled client for each account purely to namespace the
roles.

Make sense?

I believe I would continue to use a single public client for the SPA and
single bearer only client for the API resource server.

I've read that keycloak has issues with large numbers of clients, but I
only expect to reach a few hundred.

From robstyle1234 at gmail.com  Sat Nov 24 23:11:07 2018
From: robstyle1234 at gmail.com (ola rob)
Date: Sun, 25 Nov 2018 09:41:07 +0530
Subject: [keycloak-user] How to get access access token with
	SPNEGOAuthenticator?
Message-ID: <CAN7vkfjbpZ5NSLzWFAk7KhVfPhwgiJrxMEzZU19DZ6uROKPRDQ@mail.gmail.com>

Hi,

For some legacy reasons, we are using keycloak API/services for
authentication but not redirecting our application to keycloak. We are able
to get access token and refresh token (AccessTokenResponse.class) when we
authenticate using login API by sending username and password. But we are
unable to get them when authenticating using spnego token.
The SPNEGOAuthenticator class doesn't return any access token after
successful authentication. We need these tokens to manage our application
session internally. So, how can we get access and refresh token or response
similar to username password authentication?

 SPNEGOAuthenticator spnegoAuthenticator = new
SPNEGOAuthenticator(kerberosConfig, kerberosAuth, spnegoToken);
spnegoAuthenticator.authenticate();
 if (spnegoAuthenticator.isAuthenticated()) {
String username = spnegoAuthenticator.getAuthenticatedUsername(); //
returning the username correctly.
}

Thanks in advance!

From craig at baseventure.com  Sun Nov 25 17:47:10 2018
From: craig at baseventure.com (Craig Setera)
Date: Sun, 25 Nov 2018 16:47:10 -0600
Subject: [keycloak-user] Temporary support for current sign-in flow
Message-ID: <CAPVdwjoKQZT251dL0b9ije5MVMLh3+uc4kWK34pSFdhOtJ2GDw@mail.gmail.com>

As everyone is probably painfully aware from all of my questions, we are in
the midst of replacing our proprietary login flow with a Keycloak
OpenID-based flow.  The eventual goal is to use the standard Keycloak login
pages to allow for extra factors of authentication such as Google
Authenticator.

One option that we've allowed until now is for customers to host custom
login HTML forms (just username and password) on their sites.  This is
something that we are (most likely) going to remove support for in the long
run, but in the short term, I think we are going to need to support this if
only to allow for a transition period.  The login flow is:

Customer Site (HTML form) ->
Login Handler (JEE Session) ->
Redirect browser to SPA along with JSESSIONID

All API calls use JEE sessions for "authentication".  What I'm hoping to do
somehow in the short term is:

Customer Site (HTML form) ->
Login Handler ->
Keycloak ->
Redirect browser to SPA with OAuth codes/tokens

What is the best/correct way to do something like this?  Should I be using
the authorization code grant in this case?

Thanks for any insights.
Craig

=================================
*Craig Setera*

*Chief Technology Officer*

From msakho at redhat.com  Mon Nov 26 06:49:19 2018
From: msakho at redhat.com (Meissa M'baye Sakho)
Date: Mon, 26 Nov 2018 12:49:19 +0100
Subject: [keycloak-user] Keycloak Gatekeeper on macos
Message-ID: <CAF83W6K5gEhiK0VVn36MoJLGyJBvHW7yeRniUeKg-jwjGLMDNQ@mail.gmail.com>

Hello everyone,
Is it possible to install keycloak Gatekeeper on macos?
thanks,
Meissa

From anpasq.keycloak at gmail.com  Mon Nov 26 07:11:09 2018
From: anpasq.keycloak at gmail.com (Andrea Pasqualini)
Date: Mon, 26 Nov 2018 13:11:09 +0100
Subject: [keycloak-user] Client Registration performance
In-Reply-To: <CAF4REn7C_8XY+NtiPBYV+20dssYGYewDM2bUMC+2+9F8VmAQmA@mail.gmail.com>
Message-ID: <89da3cae-c510-6f1d-6996-31d1836fe6c7@gmail.com>

Unfortunately, as you can see herehttps://issues.jboss.org/browse/KEYCLOAK-8275
keycloak does not properly handle large numbers of clients.

Vote the issue if you are interested.

Regards
Andrea


 >Hello Keycloak Users!
 >
 >We are planning on using the Client Registration flow for setting up
 >clients on login.
 >This is mainly to more clearly identify each individual device a user
 >has logged in with.
 >
 >Are there anyone using this feature in production with a large number
 >of clients?
 >With our current stats, we would probably end up with a few million
 >clients by the end of the year.
 >
 >1. Will this scale well with the way Keycloak works?
 >2. If a user loses their device, how should a full revoke & logout be 
performed?
 >3. Is there an alternative approach to give each user more control
 >over their device and session?
 >
 >Thanks,
 >Eivind Larsen


From jan.lengenfeld at gbtec.de  Mon Nov 26 09:00:12 2018
From: jan.lengenfeld at gbtec.de (Lengenfeld, Jan)
Date: Mon, 26 Nov 2018 14:00:12 +0000
Subject: [keycloak-user] Script Mapper can not create json arrays?
Message-ID: <7a070db5bf2a41fd9826340f3793027a@gbtec.de>

Hello,

we want to add groups and their ids in the following format to the token:
{
    // ... other values omitted for readability ...
    "userGroups": [
        {
            "id": "b6ebc9af-3355-462b-ab1e-583a24f094aa",
            "name": "my-group"
        },
        {
            "id": "92b0c111-510c-4da9-a978-d980c3893eac",
            "name": "my-other-group"
        }
    ]
}

But all we get is:
{
    // ... other values omitted for readability ...
    "userGroups": {
        "0": {
            "id": "b6ebc9af-3355-462b-ab1e-583a24f094aa",
            "name": "my-group"
        },
        "1": {
            "id": "92b0c111-510c-4da9-a978-d980c3893eac",
            "name": "my-other-group"
        }
    }
}

We are using the Script Mapper with the following code:

var groups = user.groups;

var simplifiedGroupsForToken = [];

for each (var group in groups) {
    simplifiedGroupsForToken.push({"id": group.id, "name": group.name});
}
simplifiedGroupsForToken;


Do you have any suggestions how to solve our problem? Thanks in advance.

Best regards,
Jan Lengenfeld


From vedavallyabhilash at gmail.com  Mon Nov 26 09:58:54 2018
From: vedavallyabhilash at gmail.com (abhilashreddy abhi)
Date: Mon, 26 Nov 2018 09:58:54 -0500
Subject: [keycloak-user] Event-listener-sysout example not working ,
	v4.6.0.Final
Message-ID: <CAHr-Nxc7DiA+AS=SuRDhX0qHvLqdOb5B_GH5WPoR-6eeQ6fgEg@mail.gmail.com>

Hello,

I am using 4.6.0.Final keycloak version and  trying out event-sysout
example (
https://github.com/keycloak/keycloak/tree/master/examples/providers/event-listener-sysout)
,but i am unable to make it work and getting following errors

1) I have created a spring boot application with following classes
                      --Application.class (Contains Main method)
                      --SysoutEventListenerProvider
                     ---SysoutEventListenerProviderFactory
    I have placed org.keycloak.events.EventListenerProviderFactory file in
src/main/resources/META-INF/services  which points to my
SysoutEventListenerProviderFactory.
    Did a maven clean install and took the jar from target folder and tried
placing it any one of  standalone/deployments folder ,
Keycloak_Home/providers folder and also created as a module as per
    instructions in documentation  but all of the above methods throws the
following error.

Caused by: java.util.ServiceConfigurationError:
org.keycloak.events.EventListenerProviderFactory: Provider
com.example.demo.springboot.SysoutEventListenerProviderFactory not found
        at java.util.ServiceLoader.fail(Unknown Source)
        at java.util.ServiceLoader.access$300(Unknown Source)
        at java.util.ServiceLoader$LazyIterator.nextService(Unknown Source)
        at java.util.ServiceLoader$LazyIterator.next(Unknown Source)
        at java.util.ServiceLoader$1.next(Unknown Source)
        at
org.keycloak.provider.DefaultProviderLoader.load(DefaultProviderLoader.java:60)
        at
org.keycloak.provider.ProviderManager.load(ProviderManager.java:92)
        at
org.keycloak.services.DefaultKeycloakSessionFactory.loadFactories(DefaultKeycloakSessionFactory.java:214)
        at
org.keycloak.services.DefaultKeycloakSessionFactory.init(DefaultKeycloakSessionFactory.java:80)
        at
org.keycloak.services.resources.KeycloakApplication.createSessionFactory(KeycloakApplication.java:331)
        at
org.keycloak.services.resources.KeycloakApplication.<init>(KeycloakApplication.java:118)

2) This time, I have removed Application.class and exported the jar using
export->jar in eclipse and tried placing it in deployment folder or
providers or as a module  and the application starts   but throws the
 following log.

               ERROR [org.keycloak.events.EventBuilder] (default task-1)
Event listener 'sysout' registered, but provider not found

Can you please help me what I am missing?

Thanks
Abhilash

From dt at acutus.pro  Mon Nov 26 10:07:02 2018
From: dt at acutus.pro (Dmitry Telegin)
Date: Mon, 26 Nov 2018 18:07:02 +0300
Subject: [keycloak-user] Script Mapper can not create json arrays?
In-Reply-To: <7a070db5bf2a41fd9826340f3793027a@gbtec.de>
References: <7a070db5bf2a41fd9826340f3793027a@gbtec.de>
Message-ID: <1543244822.2116.8.camel@acutus.pro>

Hello Jan,

This is how JavaScript arrays get serialized into JSON by default. To overcome it, you should convert it into a Java array first using Java.to(foo, "java.lang.String[]").

Check this out for a complete example of the JavaScript group mapper:
http://lists.jboss.org/pipermail/keycloak-user/2018-November/016223.html

Good luck!
Dmitry Telegin
CTO, Acutus s.r.o.
Keycloak Consulting and Training

Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
+42 (022) 888-30-71
E-mail: info at acutus.pro

On Mon, 2018-11-26 at 14:00 +0000, Lengenfeld, Jan wrote:
> Hello,
> 
> we want to add groups and their ids in the following format to the token:
> {
> ????// ... other values omitted for readability ...
> ????"userGroups": [
> ????????{
> ????????????"id": "b6ebc9af-3355-462b-ab1e-583a24f094aa",
> ????????????"name": "my-group"
> ????????},
> ????????{
> ????????????"id": "92b0c111-510c-4da9-a978-d980c3893eac",
> ????????????"name": "my-other-group"
> ????????}
> ????]
> }
> 
> But all we get is:
> {
> ????// ... other values omitted for readability ...
> ????"userGroups": {
> ????????"0": {
> ????????????"id": "b6ebc9af-3355-462b-ab1e-583a24f094aa",
> ????????????"name": "my-group"
> ????????},
> ????????"1": {
> ????????????"id": "92b0c111-510c-4da9-a978-d980c3893eac",
> ????????????"name": "my-other-group"
> ????????}
> ????}
> }
> 
> We are using the Script Mapper with the following code:
> 
> var groups = user.groups;
> 
> var simplifiedGroupsForToken = [];
> 
> for each (var group in groups) {
> ????simplifiedGroupsForToken.push({"id": group.id, "name": group.name});
> }
> simplifiedGroupsForToken;
> 
> 
> Do you have any suggestions how to solve our problem? Thanks in advance.
> 
> Best regards,
> Jan Lengenfeld
> 
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From wyllys.ingersoll at keepertech.com  Mon Nov 26 10:39:15 2018
From: wyllys.ingersoll at keepertech.com (Wyllys Ingersoll)
Date: Mon, 26 Nov 2018 10:39:15 -0500
Subject: [keycloak-user] group federation?
Message-ID: <CAGbvivKA7OYskkkZp-YSPj0VuE8ppSo7EcL+SuAXZbvUzOyS6A@mail.gmail.com>

We have a realm configured to get federated users from our Active Directory
domain server. Is there a way to also get the list of federated group
information for each user (i.e. include the AD groups that the AD user is a
member of in the federated user information) ?

thanks...

From andreas.lau at outlook.com  Mon Nov 26 11:00:52 2018
From: andreas.lau at outlook.com (Andreas Lau)
Date: Mon, 26 Nov 2018 16:00:52 +0000
Subject: [keycloak-user] Send welcome mail after successful registration
Message-ID: <VI1PR10MB044556F392027E6AD30B8BE5E4D70@VI1PR10MB0445.EURPRD10.PROD.OUTLOOK.COM>

Hey,
i'd like keycloak to send a welcome mail after the user has successfully registered and verified his email. Currently I don't know how to do it. I found jira [1] feature request proposing a extension to support welcome email by configuration (I think). In the comments someone suggested to use SMTP provider and EventListener. The next comment has a Link [3] to a EventListener sample but I can not figure out what I have to do.
I think they suggested the follwing workflow:
1. registration finished
2. listener invokes - how to tell Listener to listen on the registration event (how is the event named)
3. SMTP provider sends a email

Hope someone is able to help me out.

Andreas
[1] https://issues.jboss.org/browse/KEYCLOAK-1835
[2] https://github.com/keycloak/keycloak/tree/master/examples/providers/event-listener-sysout


From cristian.schuszter at cern.ch  Mon Nov 26 11:49:46 2018
From: cristian.schuszter at cern.ch (Cristian Schuszter)
Date: Mon, 26 Nov 2018 17:49:46 +0100
Subject: [keycloak-user] Motivation behind the removal of client_id from
	"aud" in the JWT
Message-ID: <3d828dce-4fad-9934-1e72-6e711f62c227@cern.ch>

Hi!

We just updated from release 4.5.0 to 4.6.0 and discovered that the 
"aud" field has been changed to "aud": "account", rather than the 
client-id of the application.

After a bit of digging, we found the commit and associated pull request 
for the change: 
https://github.com/keycloak/keycloak/commit/f67d6f96607e51b1839501203342faf9f6987503#diff-d45230ec2a55480bbaf022aee366e898R85

Unfortunately, *KEYCLOAK-8482* issue seems to be hidden, as I couldn't 
find it on the Jira board.

We were counting on the "client_id" being present in the audiences, as 
the Microsoft.NET core validators target specifically the audiences in 
the JWT token, with no option of targeting the "azp" field.

Could anybody shed some light as to why the *client_id* was removed from 
the audiences?


Best regards,

Cristian Schuszter


From to_sud at yahoo.com  Mon Nov 26 13:50:10 2018
From: to_sud at yahoo.com (Sud Ramasamy)
Date: Mon, 26 Nov 2018 13:50:10 -0500
Subject: [keycloak-user] custom cache
Message-ID: <etPan.5bfc4062.6e5d288.11539@yahoo.com>

Hi,

We?ve developed a custom authenticator that we?ve been able o plugin into Keycloak to handle a custom authentication mechanism. The authenticator has some state that needs to be available across the cluster. We could store the state in the database and thereby make it available to other nodes in the cluster. But this seems a little heavy weight.

Instead we were hoping to be able to use the Infinispan capabilities in the Keycloak/Wildfly distribution to cache and distribute the state to nodes in the cluster. Is this possible without forking the Keycloak codebase? We noticed that the Keycloak infinispan model module provides the existing caching mechanism for the User, Realm and Session cache. Was wondering if there is a way to possibly plugin our own infinispan Cache Provider for our custom object and thereby use this cache in our custom authenticator in a similar way that the User, Realm and Session caches are used.

Or what our alternatives might we have.

Thanks in advance.
-sud

From dt at acutus.pro  Mon Nov 26 14:45:16 2018
From: dt at acutus.pro (Dmitry Telegin)
Date: Mon, 26 Nov 2018 22:45:16 +0300
Subject: [keycloak-user] custom cache
In-Reply-To: <etPan.5bfc4062.6e5d288.11539@yahoo.com>
References: <etPan.5bfc4062.6e5d288.11539@yahoo.com>
Message-ID: <1543261516.23743.5.camel@acutus.pro>

Hello Sud,

Keycloak's Infinispan subsystem doesn't restrict you to the predefined caches only. In your authenticator factory, you can retrieve?an InfinispanConnectionProvider:

InfinispanConnectionProvider icp = session.getProvider(InfinispanConnectionProvider.class);

and then ask it to create and return your custom cache:

Cache<K, V> cache = icp.getCache("foobar");

That's basically what happens when you obtain any of the predefined caches. The only difference is that Keycloak preconfigures some defaults for them (see DefaultInfinispanConnectionProviderFactory).

Cheers,
Dmitry Telegin
CTO, Acutus s.r.o.
Keycloak Consulting and Training

Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
+42 (022) 888-30-71
E-mail: info at acutus.pro

On Mon, 2018-11-26 at 13:50 -0500, Sud Ramasamy wrote:
> Hi,
> 
> We?ve developed a custom authenticator that we?ve been able o plugin into Keycloak to handle a custom authentication mechanism. The authenticator has some state that needs to be available across the cluster. We could store the state in the database and thereby make it available to other nodes in the cluster. But this seems a little heavy weight.
> 
> Instead we were hoping to be able to use the Infinispan capabilities in the Keycloak/Wildfly distribution to cache and distribute the state to nodes in the cluster. Is this possible without forking the Keycloak codebase? We noticed that the Keycloak infinispan model module provides the existing caching mechanism for the User, Realm and Session cache. Was wondering if there is a way to possibly plugin our own infinispan Cache Provider for our custom object and thereby use this cache in our custom authenticator in a similar way that the User, Realm and Session caches are used.
> 
> Or what our alternatives might we have.
> 
> Thanks in advance.
> -sud
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From marco.lamina at sap.com  Mon Nov 26 16:14:26 2018
From: marco.lamina at sap.com (Lamina, Marco)
Date: Mon, 26 Nov 2018 21:14:26 +0000
Subject: [keycloak-user] Motivation behind the removal of client_id from
 "aud" in the JWT
In-Reply-To: <3d828dce-4fad-9934-1e72-6e711f62c227@cern.ch>
References: <3d828dce-4fad-9934-1e72-6e711f62c227@cern.ch>
Message-ID: <F420F3F4-2EF4-416F-BBA7-AF51ABD6CA61@sap.com>

I've encountered a similar issue when switching from 4.5 to 4.6:
http://lists.jboss.org/pipermail/keycloak-user/2018-November/016445.html

I've been using the audience token mapper, which stopped working after the upgrade. Maybe these issues are related?
 

?On 11/26/18, 9:01 AM, "keycloak-user-bounces at lists.jboss.org on behalf of Cristian Schuszter" <keycloak-user-bounces at lists.jboss.org on behalf of cristian.schuszter at cern.ch> wrote:

    Hi!
    
    We just updated from release 4.5.0 to 4.6.0 and discovered that the 
    "aud" field has been changed to "aud": "account", rather than the 
    client-id of the application.
    
    After a bit of digging, we found the commit and associated pull request 
    for the change: 
    https://github.com/keycloak/keycloak/commit/f67d6f96607e51b1839501203342faf9f6987503#diff-d45230ec2a55480bbaf022aee366e898R85
    
    Unfortunately, *KEYCLOAK-8482* issue seems to be hidden, as I couldn't 
    find it on the Jira board.
    
    We were counting on the "client_id" being present in the audiences, as 
    the Microsoft.NET core validators target specifically the audiences in 
    the JWT token, with no option of targeting the "azp" field.
    
    Could anybody shed some light as to why the *client_id* was removed from 
    the audiences?
    
    
    Best regards,
    
    Cristian Schuszter
    
    _______________________________________________
    keycloak-user mailing list
    keycloak-user at lists.jboss.org
    https://lists.jboss.org/mailman/listinfo/keycloak-user
    



From craig at baseventure.com  Mon Nov 26 17:20:25 2018
From: craig at baseventure.com (Craig Setera)
Date: Mon, 26 Nov 2018 16:20:25 -0600
Subject: [keycloak-user] Simple server OAuth client?
Message-ID: <CAPVdwjpzWGKGsAs2qMhdJwwm1iiC54QkKeGCkyjOMarj_ri6GQ@mail.gmail.com>

I have a need to do a service-level account connection between two
servers.  I believe that the client credentials grant and Keycloak service
accounts are the proper way to handle this.  What I'm wondering is if there
is a simple to use OAuth authentication client built into the Keycloak code
that can be used for this purpose?  In particular, something that manages
refresh token and such.

It appears like a lot of the logic of interest is available in
RefreshableKeycloakSecurityContext, however I'm not sure if this is really
meant to be consumed as a generic OAuth client library?

Thanks,
Craig

=================================
*Craig Setera*

*Chief Technology Officer*

From bruno at abstractj.org  Mon Nov 26 17:51:05 2018
From: bruno at abstractj.org (Bruno Oliveira)
Date: Mon, 26 Nov 2018 20:51:05 -0200
Subject: [keycloak-user] Keycloak Gatekeeper on macos
In-Reply-To: <CAF83W6K5gEhiK0VVn36MoJLGyJBvHW7yeRniUeKg-jwjGLMDNQ@mail.gmail.com>
References: <CAF83W6K5gEhiK0VVn36MoJLGyJBvHW7yeRniUeKg-jwjGLMDNQ@mail.gmail.com>
Message-ID: <CAM5SUC5STJWxdBmpxAXaZT-vy=7CD6NuYtTgh=YU9d9nWn+gyA@mail.gmail.com>

Sure, see
https://downloads.jboss.org/keycloak/4.6.0.Final/gatekeeper/keycloak-gatekeeper-darwin-amd64.tar.gz.tar.gz

On Mon, Nov 26, 2018, 9:56 AM Meissa M'baye Sakho <msakho at redhat.com> wrote:

> Hello everyone,
> Is it possible to install keycloak Gatekeeper on macos?
> thanks,
> Meissa
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

From sstark at redhat.com  Mon Nov 26 18:17:08 2018
From: sstark at redhat.com (Scott Stark)
Date: Mon, 26 Nov 2018 23:17:08 +0000
Subject: [keycloak-user] Keycloak Gatekeeper on macos
In-Reply-To: <CAM5SUC5STJWxdBmpxAXaZT-vy=7CD6NuYtTgh=YU9d9nWn+gyA@mail.gmail.com>
References: <CAF83W6K5gEhiK0VVn36MoJLGyJBvHW7yeRniUeKg-jwjGLMDNQ@mail.gmail.com>
	<CAM5SUC5STJWxdBmpxAXaZT-vy=7CD6NuYtTgh=YU9d9nWn+gyA@mail.gmail.com>
Message-ID: <CAHyjRvAXWGxV37Y8PaepOmSN2PPT_v9TnuOVyykO6AXrSEW-cw@mail.gmail.com>

That link has a double .tar.gz suffix. Corrected link is:
https://downloads.jboss.org/keycloak/4.6.0.Final/gatekeeper/keycloak-gatekeeper-darwin-amd64.tar.gz

On Mon, Nov 26, 2018 at 10:58 PM Bruno Oliveira <bruno at abstractj.org> wrote:

> Sure, see
>
> https://downloads.jboss.org/keycloak/4.6.0.Final/gatekeeper/keycloak-gatekeeper-darwin-amd64.tar.gz.tar.gz
>
> On Mon, Nov 26, 2018, 9:56 AM Meissa M'baye Sakho <msakho at redhat.com>
> wrote:
>
> > Hello everyone,
> > Is it possible to install keycloak Gatekeeper on macos?
> > thanks,
> > Meissa
>
>

From dt at acutus.pro  Mon Nov 26 18:18:19 2018
From: dt at acutus.pro (Dmitry Telegin)
Date: Tue, 27 Nov 2018 02:18:19 +0300
Subject: [keycloak-user] Simple server OAuth client?
In-Reply-To: <CAPVdwjpzWGKGsAs2qMhdJwwm1iiC54QkKeGCkyjOMarj_ri6GQ@mail.gmail.com>
References: <CAPVdwjpzWGKGsAs2qMhdJwwm1iiC54QkKeGCkyjOMarj_ri6GQ@mail.gmail.com>
Message-ID: <1543274299.23743.7.camel@acutus.pro>

Hi Craig, do you mean "between two Keycloak servers"? Any similarities to this case? 
http://lists.jboss.org/pipermail/keycloak-user/2018-November/016287.html

Cheers,
Dmitry Telegin
CTO, Acutus s.r.o.
Keycloak Consulting and Training

Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
+42 (022) 888-30-71
E-mail: info at acutus.pro

On Mon, 2018-11-26 at 16:20 -0600, Craig Setera wrote:
> I have a need to do a service-level account connection between two
> servers.??I believe that the client credentials grant and Keycloak service
> accounts are the proper way to handle this.??What I'm wondering is if there
> is a simple to use OAuth authentication client built into the Keycloak code
> that can be used for this purpose???In particular, something that manages
> refresh token and such.
> 
> It appears like a lot of the logic of interest is available in
> RefreshableKeycloakSecurityContext, however I'm not sure if this is really
> meant to be consumed as a generic OAuth client library?
> 
> Thanks,
> Craig
> 
> =================================
> *Craig Setera*
> 
> *Chief Technology Officer*
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From wolfbro92 at gmail.com  Mon Nov 26 23:22:10 2018
From: wolfbro92 at gmail.com (Kunal Kumar)
Date: Tue, 27 Nov 2018 12:22:10 +0800
Subject: [keycloak-user] How to retrieve user ID from Keycloak to my web app
Message-ID: <CAE5MKW9c-suoF1s0eUKSaG_nv_LA0E0AvJkLRWkFc_hTQzUu3g@mail.gmail.com>

Before, my web app is has its own login form to authenticate users.

But since I have connected my web app to Keycloak to authenticate the users
now, my web app does not need to have the login form anymore, hence I need
to remove it.

This was roughly how I retrieved the users information before Keycloak:-

if (chkLogin(getUserID(), getUserPwd())) {
            MaintainUser mu = new MaintainUser();
            this.usrInfo = null;
            String[] usr = mu.validatePassword(getUserID(), getUserPwd()); }

This is not the full coding, but basically I use the getUserID method to
retrieve the users info and check it for authentication before. How do I
perform this if I want to retrieve the user ID from the Keycloak admin
console?


Regards,

Kunal Kumar

From dhara.basida at azilen.com  Tue Nov 27 00:28:00 2018
From: dhara.basida at azilen.com (Dhara Basida)
Date: Tue, 27 Nov 2018 10:58:00 +0530
Subject: [keycloak-user] Issue in keycloak
Message-ID: <54c93551-6389-2369-2c07-b4792b83afaf@azilen.com>

Hey,

I had installed keycloak version 4.6.0. I am unable to find Client
Permissions Tab as mentioned in your doc for managing single client.It
would be a great appreciation to your help in advance.

Thanks and Regards,

Dhara Basida


From marco.lamina at sap.com  Mon Nov 26 19:00:16 2018
From: marco.lamina at sap.com (Lamina, Marco)
Date: Tue, 27 Nov 2018 00:00:16 +0000
Subject: [keycloak-user] Admin console permissions vs. UMA Policies
Message-ID: <EFCCD4C7-43FC-4C8E-80AB-969D68750319@sap.com>

Hi,
I am unsure if my understanding of Keycloaks permission evaluation engine is flawed, or if there?s a bug in the system. I have a resource that is protected by multiple permissions. What is the expected behavior if one permission decides to DENY and another decides to PERMIT? I would expect that the overall decision would be PERMIT.
However, I can create both scenarios ? overall decision PERMIT / DENY ? depending on which permissions I set (see screenshots for details). I wasn?t able to find a detailed explanation in the docs, so I would be grateful for some clarity.

Thanks,
Marco

[cid:image001.png at 01D485A1.1D536320][cid:image002.png at 01D485A1.1D536320]
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.png
Type: image/png
Size: 113909 bytes
Desc: image001.png
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20181127/b93fb9d1/attachment-0002.png 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image002.png
Type: image/png
Size: 129167 bytes
Desc: image002.png
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20181127/b93fb9d1/attachment-0003.png 

From sthorger at redhat.com  Tue Nov 27 01:17:05 2018
From: sthorger at redhat.com (Stian Thorgersen)
Date: Tue, 27 Nov 2018 07:17:05 +0100
Subject: [keycloak-user] Motivation behind the removal of client_id from
 "aud" in the JWT
In-Reply-To: <F420F3F4-2EF4-416F-BBA7-AF51ABD6CA61@sap.com>
References: <3d828dce-4fad-9934-1e72-6e711f62c227@cern.ch>
	<F420F3F4-2EF4-416F-BBA7-AF51ABD6CA61@sap.com>
Message-ID: <CAJgngAftd4Tg0jvF3-8476z9sAOpq+65Mi2_DZuia3KRHurcFQ@mail.gmail.com>

The ID token which is aimed at the RP (authenticating application) includes
the RP client in the audience. The access token which is aimed at invoking
external services doesn't include this by default.

On Mon, 26 Nov 2018, 22:22 Lamina, Marco <marco.lamina at sap.com wrote:

> I've encountered a similar issue when switching from 4.5 to 4.6:
> http://lists.jboss.org/pipermail/keycloak-user/2018-November/016445.html
>
> I've been using the audience token mapper, which stopped working after the
> upgrade. Maybe these issues are related?
>
>
> ?On 11/26/18, 9:01 AM, "keycloak-user-bounces at lists.jboss.org on behalf
> of Cristian Schuszter" <keycloak-user-bounces at lists.jboss.org on behalf
> of cristian.schuszter at cern.ch> wrote:
>
>     Hi!
>
>     We just updated from release 4.5.0 to 4.6.0 and discovered that the
>     "aud" field has been changed to "aud": "account", rather than the
>     client-id of the application.
>
>     After a bit of digging, we found the commit and associated pull
> request
>     for the change:
>
> https://github.com/keycloak/keycloak/commit/f67d6f96607e51b1839501203342faf9f6987503#diff-d45230ec2a55480bbaf022aee366e898R85
>
>     Unfortunately, *KEYCLOAK-8482* issue seems to be hidden, as I couldn't
>     find it on the Jira board.
>
>     We were counting on the "client_id" being present in the audiences, as
>     the Microsoft.NET core validators target specifically the audiences in
>     the JWT token, with no option of targeting the "azp" field.
>
>     Could anybody shed some light as to why the *client_id* was removed
> from
>     the audiences?
>
>
>     Best regards,
>
>     Cristian Schuszter
>
>     _______________________________________________
>     keycloak-user mailing list
>     keycloak-user at lists.jboss.org
>     https://lists.jboss.org/mailman/listinfo/keycloak-user
>
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From Deepti.Tyagi at halliburton.com  Tue Nov 27 01:58:14 2018
From: Deepti.Tyagi at halliburton.com (Deepti Tyagi)
Date: Tue, 27 Nov 2018 06:58:14 +0000
Subject: [keycloak-user] [EXTERNAL] Re: Keycloak Admin Realm is not
 upgraded on Keycloak upgrade from v3.0 to v4.5
In-Reply-To: <847A59EDBBC62D43BEE2CFA482C6CB6A648D93EC@NP1EXMB105.corp.halliburton.com>
References: <847A59EDBBC62D43BEE2CFA482C6CB6A648CDD29@NP1EXMB105.corp.halliburton.com>
	,<1542814493.5656.15.camel@acutus.pro>
	<847A59EDBBC62D43BEE2CFA482C6CB6A648D930F@NP1EXMB105.corp.halliburton.com>,
	<1542987359.4610.1.camel@acutus.pro>,
	<847A59EDBBC62D43BEE2CFA482C6CB6A648D93EC@NP1EXMB105.corp.halliburton.com>
Message-ID: <847A59EDBBC62D43BEE2CFA482C6CB6A648DA554@NP1EXMB105.corp.halliburton.com>

Re-Sending email, received another email of rejection. Looks like its bounced back.

Thanks,
Deepti
________________________________
From: Deepti Tyagi
Sent: Monday, November 26, 2018 12:19 AM
To: Dmitry Telegin
Cc: Sachin Gandhi; Shankar Bhaskaran
Subject: RE: [EXTERNAL] Re: [keycloak-user] Keycloak Admin Realm is not upgraded on Keycloak upgrade from v3.0 to v4.5

Great Thanks Dmitri for your kind support.

Yes, you are right. On changing back to default keycloak theme, it worked. :)
I had left it to do later, didn't realize that it could be the reason.

Thank You once Again,
Deepti
________________________________
From: Dmitry Telegin [dt at acutus.pro]
Sent: Friday, November 23, 2018 9:35 AM
To: Deepti Tyagi
Cc: Sachin Gandhi; Shankar Bhaskaran
Subject: Re: [EXTERNAL] Re: [keycloak-user] Keycloak Admin Realm is not upgraded on Keycloak upgrade from v3.0 to v4.5

External Sender: Use caution with links/attachments.


Deepti,

Didn't you forget to migrate your themes? Your realm references a custom "darktheme", so you should either migrate it too or disable in the database (set REALM.LOGIN_THEME to "keycloak" or NULL). Having done the latter, I was able to login again with Keycloak 4.5.0.

Also it seems that we've found a regression. In the case of nonexistent theme, Keycloak 3.0.0 prints and error falls back to the built-in one, while Keycloak 4.5.0 throws an exception.

Let me know if it works and if I can reply to the ML, so that others could benefit from the answer too.

Good luck,
Dmitry Telegin
CTO, Acutus s.r.o.
Keycloak Consulting and Training

Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
+42 (022) 888-30-71
E-mail: info at acutus.pro<mailto:info at acutus.pro>

On Fri, 2018-11-23 at 09:06 +0000, Deepti Tyagi wrote:
Thanks Dmitry for the prompt reply.

It took some time to prepare an standalone reproducible example as you have asked for. Attached the same. Please follow steps mentioned below.
Standalone.xmls, a sample war and non-master realm are attached. I have used postgres DB and its jboss module, though H2 DB should also be fine.

Here you go.
1. Download Keycloak v3.0.0
2. Replace attached standalone.xml
3. Start the server in standalone mode.
4. Access Keycloak on localhost:8880. And upload attached non_master_realm.json
5. Download Wildfly v10.1
6. Install Keycloak adapters. (Keycloak v4.5 adapters also worked fine for me.)
7. Use attached standalone.xml and temp-console.war.
8. Start the server. War should be deployed.
9. Access url (http://localhost:8080/temp-console). It<https://urldefense.proofpoint.com/v2/url?u=http-3A__localhost-3A8080_temp-2Dconsole-29.-25A0It&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=kiIVNX_4UbpRFlrEchz0ztsI-FpmXQLmA3JE7AOf6UY&s=orvByITvM8pGhB-mr6kl_Iwj8xW4X94E5CBc11ISsWE&e=> should load a login page.
10. Stop Keycloak server.

11. Download Keycloak v4.5
12. Copy standalone, domain folders from old keycloak.
13. Execute below migration scripts.
jboss-cli.sh<https://urldefense.proofpoint.com/v2/url?u=http-3A__jboss-2Dcli.sh&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=kiIVNX_4UbpRFlrEchz0ztsI-FpmXQLmA3JE7AOf6UY&s=BRkkRo8u0h78ihBjUhaBMi-sFYmjstMAKu2TSmMflT4&e=> --file=migrate-standalone.cli
jboss-cli.sh<https://urldefense.proofpoint.com/v2/url?u=http-3A__jboss-2Dcli.sh&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=kiIVNX_4UbpRFlrEchz0ztsI-FpmXQLmA3JE7AOf6UY&s=BRkkRo8u0h78ihBjUhaBMi-sFYmjstMAKu2TSmMflT4&e=> --file=migrate-standalone-ha.cli
jboss-cli.sh<https://urldefense.proofpoint.com/v2/url?u=http-3A__jboss-2Dcli.sh&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=kiIVNX_4UbpRFlrEchz0ztsI-FpmXQLmA3JE7AOf6UY&s=BRkkRo8u0h78ihBjUhaBMi-sFYmjstMAKu2TSmMflT4&e=> --file=migrate-domain-clustered.cli
jboss-cli.sh<https://urldefense.proofpoint.com/v2/url?u=http-3A__jboss-2Dcli.sh&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=kiIVNX_4UbpRFlrEchz0ztsI-FpmXQLmA3JE7AOf6UY&s=BRkkRo8u0h78ihBjUhaBMi-sFYmjstMAKu2TSmMflT4&e=> --file=migrate-domain-standalone.cli
14. Start keycloak server and access on localhost:8880
15. Restart Wildfly server.
16. Access Wildfly Server Url (http://localhost:8080/temp-console<https://urldefense.proofpoint.com/v2/url?u=http-3A__localhost-3A8080_temp-2Dconsole&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=kiIVNX_4UbpRFlrEchz0ztsI-FpmXQLmA3JE7AOf6UY&s=5I10_CfMmMRyjqNt8v47-eizFNe8uhLqrHXx9SOSVpg&e=>). It should reproduce the issue.
17. Check Keycloak v4.5 server.log


Please find below answers to your questions.

On terminology: by "custom admin realm", do you mean simply a non-master realm in Keycloak that you've created yourself?
[D]: Yes
On upgrade process: normally, you don't need to export/import realm data during upgrades, since schema+data migration will be performed by Keycloak itself (it uses Liquibase under the hood).

You only migrate your .xml configs, and then simply run the new Keycloak version with the same database connection. Did you try this?


[D]: Yes. Exactly, same I have been doing.

Thanks,
Deepti
________________________________
From: Dmitry Telegin [dt at acutus.pro]
Sent: Wednesday, November 21, 2018 9:34 AM
To: Deepti Tyagi
Subject: [EXTERNAL] Re: [keycloak-user] Keycloak Admin Realm is not upgraded on Keycloak upgrade from v3.0 to v4.5

External Sender: Use caution with links/attachments.


Hi again Deepti,

Just FYI, our company provides a free-of-charge community support on a volunteer basis, but we generally can't afford to spend more than 1-2h per day on that.

For this all to be fruitful, I'd expect your active participation like preparing the reproducible example (see my reply to the ML). Good luck :)

Dmitry Telegin
CTO, Acutus s.r.o.
Keycloak Consulting and Training

Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
+42 (022) 888-30-71
E-mail: info at acutus.pro<mailto:info at acutus.pro>

On Wed, 2018-11-21 at 07:28 +0000, Deepti Tyagi wrote:
Hi Team,

I am working on upgrading our in-house Keycloak Server from v3.0 to v4.5. Facing issue on trying to re-use old custom admin realm. Is there any way we can re-use the old admin realm or preserve at least users?

We have another Wildfly 10 application that use Keycloak v3.0 for authentication purpose using a custom admin realm (custom-realm.json) that have multiple clients, roles, users and protocol mappers.

While upgrading keycloak, I had run migration scripts to upgrade standalone, domain.xmls. Postgres DB also gets upgraded and able to login to Keycloak using the same admin user in v3.0.
Though, our Wildfly 10 application isn't able to authenticate with keycloak using that old custom-realm (with new jboss adapters even).
I had to re-create a new custom admin realm, created same clients, roles, users to make it work. And had to trash old realm that deleted all users also.

I also tried multiple workarounds like;
1. Created a new custom-realm on v4.5 and compared with v3.0 on keycloak UI, no visible difference.
2. Partially re-imported new custom realm having same clients and roles. No help.
3. Trashed old realm and imported new custom realm, then tried partially importing old custom realm users. Its not allowed. (KC-SERVICES0037: Error creating user: java.lang.RuntimeException: Unable to find client role mappings for client: ds-data)

With the 3rd attempt, I can see at least keycloak login page on our wildfly 10 application but can not login till I create admin user manually.

With 1st and 2nd attempt, I do not even see keycloak login page on our wildfly 10 application and below exception is thrown in keycloak server.log.

2018-11-20 23:56:30,691 WARN  [org.keycloak.events<https://urldefense.proofpoint.com/v2/url?u=http-3A__org.keycloak.events&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=OZ3iTCoTFIxg04dEAwkIPBvOHOyA77vDW0WEqMPNg6Q&e=>] (default task-2) type=LOGIN_ERROR, realmId=DecisionSpace_Integration_Server, clientId=dsis-console, userId=null, ipAddress=127.0.0.1<https://urldefense.proofpoint.com/v2/url?u=http-3A__127.0.0.1&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=dxc3wds6clErrRdH0oJGAd1XVswSMtkA4e-DCXfkhPk&e=>, error=invalid_user_credentials, auth_method=openid-connect, auth_type=code, response_type=code, redirect_uri=http://localhost:8080/dsdataserver-console/<https://urldefense.proofpoint.com/v2/url?u=http-3A__localhost-3A8080_dsdataserver-2Dconsole_&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=dZeHOr9kWY13Xhn176TifjVRCP4EuzCVR27DvxffEcM&e=>, code_id=a50ff093-64b8-43d2-a353-2a3ec1346297, response_mode=query
2018-11-20 23:56:30,692 ERROR [org.keycloak.services.error.KeycloakErrorHandler] (default task-2) Uncaught server error: java.lang.NullPointerException
at org.keycloak.theme.ExtendingThemeManager.loadTheme(ExtendingThemeManager.java<https://urldefense.proofpoint.com/v2/url?u=http-3A__ExtendingThemeManager.java&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=Y2zULl5InTkHdS-UGHamKl-2kZPozy9qO281lSem2-k&e=>:117)
at org.keycloak.theme.ExtendingThemeManager.getTheme(ExtendingThemeManager.java<https://urldefense.proofpoint.com/v2/url?u=http-3A__ExtendingThemeManager.java&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=Y2zULl5InTkHdS-UGHamKl-2kZPozy9qO281lSem2-k&e=>:95)
at org.keycloak.theme.DefaultThemeManager.getTheme(DefaultThemeManager.java<https://urldefense.proofpoint.com/v2/url?u=http-3A__DefaultThemeManager.java&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=rr9KA7uCWEVINmlTi5l--dY1HJsnMCV-0KDLu6twOyo&e=>:26)
at org.keycloak.theme.DefaultThemeManager.getTheme(DefaultThemeManager.java<https://urldefense.proofpoint.com/v2/url?u=http-3A__DefaultThemeManager.java&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=rr9KA7uCWEVINmlTi5l--dY1HJsnMCV-0KDLu6twOyo&e=>:21)
at org.keycloak.forms.login.freemarker.FreeMarkerLoginFormsProvider.getTheme(FreeMarkerLoginFormsProvider.java<https://urldefense.proofpoint.com/v2/url?u=http-3A__FreeMarkerLoginFormsProvider.java&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=jZzLfGC_luB0AZyZ6kOtTvcX_zd8rvlM61gQ42FlynQ&e=>:267)
at org.keycloak.forms.login.freemarker.FreeMarkerLoginFormsProvider.createResponse(FreeMarkerLoginFormsProvider.java<https://urldefense.proofpoint.com/v2/url?u=http-3A__FreeMarkerLoginFormsProvider.java&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=jZzLfGC_luB0AZyZ6kOtTvcX_zd8rvlM61gQ42FlynQ&e=>:160)
at org.keycloak.forms.login.freemarker.FreeMarkerLoginFormsProvider.createErrorPage(FreeMarkerLoginFormsProvider.java<https://urldefense.proofpoint.com/v2/url?u=http-3A__FreeMarkerLoginFormsProvider.java&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=jZzLfGC_luB0AZyZ6kOtTvcX_zd8rvlM61gQ42FlynQ&e=>:506)
at org.keycloak.services.ErrorPage.error(ErrorPage.java<https://urldefense.proofpoint.com/v2/url?u=http-3A__ErrorPage.java&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=Ht3ZRixIC6q3I1V6RnAVOppxJYtma0G4nKAiX1DhOJk&e=>:31)
at org.keycloak.authentication.AuthenticationProcessor.handleBrowserException(AuthenticationProcessor.java<https://urldefense.proofpoint.com/v2/url?u=http-3A__AuthenticationProcessor.java&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=gNRht1jHMVuAeP2v5i1ubP1WHrn9cxMBq3QdyjWwB7E&e=>:728)
at org.keycloak.protocol.AuthorizationEndpointBase.handleBrowserAuthenticationRequest(AuthorizationEndpointBase.java<https://urldefense.proofpoint.com/v2/url?u=http-3A__AuthorizationEndpointBase.java&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=hoHDPVnjF9oSnFlJIp-RTX_GzZ8PSS1vMvxri2O6sNM&e=>:143)
at org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint.buildAuthorizationCodeAuthorizationResponse(AuthorizationEndpoint.java<https://urldefense.proofpoint.com/v2/url?u=http-3A__AuthorizationEndpoint.java&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=RbYTvFNl7XG06WyV0o2Vz0N7KluR-TDknjlLFzfNtNg&e=>:409)
at org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint.process(AuthorizationEndpoint.java<https://urldefense.proofpoint.com/v2/url?u=http-3A__AuthorizationEndpoint.java&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=RbYTvFNl7XG06WyV0o2Vz0N7KluR-TDknjlLFzfNtNg&e=>:152)
at org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint.buildGet(AuthorizationEndpoint.java<https://urldefense.proofpoint.com/v2/url?u=http-3A__AuthorizationEndpoint.java&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=RbYTvFNl7XG06WyV0o2Vz0N7KluR-TDknjlLFzfNtNg&e=>:108)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java<https://urldefense.proofpoint.com/v2/url?u=http-3A__NativeMethodAccessorImpl.java&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=BpiGGRAvkiM7w5sz_SHBK_4HQAt-4aqGMDX_y0dlHB4&e=>:62)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java<https://urldefense.proofpoint.com/v2/url?u=http-3A__DelegatingMethodAccessorImpl.java&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=Anntht2lN-dmbBIiw4jKHIEqs23AHDTl-5uHXWadkao&e=>:43)
at java.lang.reflect.Method.invoke(Method.java<https://urldefense.proofpoint.com/v2/url?u=http-3A__Method.java&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=BclejXjSKCkjCFjAgpzaJbg5md8iHa-KuNxsn4Lac2Q&e=>:498)
at org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java<https://urldefense.proofpoint.com/v2/url?u=http-3A__MethodInjectorImpl.java&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=HOenPVjNSXGc_8nP0JUG1D2rHRY0JK7_2HMBQcguW1M&e=>:140)
at org.jboss.resteasy.core.ResourceMethodInvoker.internalInvokeOnTarget(ResourceMethodInvoker.java<https://urldefense.proofpoint.com/v2/url?u=http-3A__ResourceMethodInvoker.java&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=J9Gn_qpIfO9Y9Y4b9WWszJkSVKuaTENmt4kDpza8vxM&e=>:510)
at org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTargetAfterFilter(ResourceMethodInvoker.java<https://urldefense.proofpoint.com/v2/url?u=http-3A__ResourceMethodInvoker.java&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=J9Gn_qpIfO9Y9Y4b9WWszJkSVKuaTENmt4kDpza8vxM&e=>:401)
at org.jboss.resteasy.core.ResourceMethodInvoker.lambda$invokeOnTarget$0(ResourceMethodInvoker.java<https://urldefense.proofpoint.com/v2/url?u=http-3A__ResourceMethodInvoker.java&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=J9Gn_qpIfO9Y9Y4b9WWszJkSVKuaTENmt4kDpza8vxM&e=>:365)
at org.jboss.resteasy.core.interception.PreMatchContainerRequestContext.filter(PreMatchContainerRequestContext.java<https://urldefense.proofpoint.com/v2/url?u=http-3A__PreMatchContainerRequestContext.java&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=RFje4VaWssmPwjG4eGrUqN2SMswRojeQwx6LcA0NR_U&e=>:361)
at org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTarget(ResourceMethodInvoker.java<https://urldefense.proofpoint.com/v2/url?u=http-3A__ResourceMethodInvoker.java&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=J9Gn_qpIfO9Y9Y4b9WWszJkSVKuaTENmt4kDpza8vxM&e=>:367)
at org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java<https://urldefense.proofpoint.com/v2/url?u=http-3A__ResourceMethodInvoker.java&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=J9Gn_qpIfO9Y9Y4b9WWszJkSVKuaTENmt4kDpza8vxM&e=>:339)
at org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(ResourceLocatorInvoker.java<https://urldefense.proofpoint.com/v2/url?u=http-3A__ResourceLocatorInvoker.java&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=Sl3m_sZ-RQVc-1NUzwl6Rf8ICECGry9WWgWXtJINiD4&e=>:137)
at org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java<https://urldefense.proofpoint.com/v2/url?u=http-3A__ResourceLocatorInvoker.java&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=Sl3m_sZ-RQVc-1NUzwl6Rf8ICECGry9WWgWXtJINiD4&e=>:106)
at org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(ResourceLocatorInvoker.java<https://urldefense.proofpoint.com/v2/url?u=http-3A__ResourceLocatorInvoker.java&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=Sl3m_sZ-RQVc-1NUzwl6Rf8ICECGry9WWgWXtJINiD4&e=>:132)
at org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java<https://urldefense.proofpoint.com/v2/url?u=http-3A__ResourceLocatorInvoker.java&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=Sl3m_sZ-RQVc-1NUzwl6Rf8ICECGry9WWgWXtJINiD4&e=>:100)
at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java<https://urldefense.proofpoint.com/v2/url?u=http-3A__SynchronousDispatcher.java&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=ajxWntc0XD8fJuzj_9DJfdkD-tJwb8d7vFkLayv2tI8&e=>:441)
at org.jboss.resteasy.core.SynchronousDispatcher.lambda$invoke$4(SynchronousDispatcher.java<https://urldefense.proofpoint.com/v2/url?u=http-3A__SynchronousDispatcher.java&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=ajxWntc0XD8fJuzj_9DJfdkD-tJwb8d7vFkLayv2tI8&e=>:231)
at org.jboss.resteasy.core.SynchronousDispatcher.lambda$preprocess$0(SynchronousDispatcher.java<https://urldefense.proofpoint.com/v2/url?u=http-3A__SynchronousDispatcher.java&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=ajxWntc0XD8fJuzj_9DJfdkD-tJwb8d7vFkLayv2tI8&e=>:137)
at org.jboss.resteasy.core.interception.PreMatchContainerRequestContext.filter(PreMatchContainerRequestContext.java<https://urldefense.proofpoint.com/v2/url?u=http-3A__PreMatchContainerRequestContext.java&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=RFje4VaWssmPwjG4eGrUqN2SMswRojeQwx6LcA0NR_U&e=>:361)
at org.jboss.resteasy.core.SynchronousDispatcher.preprocess(SynchronousDispatcher.java<https://urldefense.proofpoint.com/v2/url?u=http-3A__SynchronousDispatcher.java&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=ajxWntc0XD8fJuzj_9DJfdkD-tJwb8d7vFkLayv2tI8&e=>:140)
at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java<https://urldefense.proofpoint.com/v2/url?u=http-3A__SynchronousDispatcher.java&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=ajxWntc0XD8fJuzj_9DJfdkD-tJwb8d7vFkLayv2tI8&e=>:217)
at org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java<https://urldefense.proofpoint.com/v2/url?u=http-3A__ServletContainerDispatcher.java&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=yvR-CuQGpCfueskPMTbLe1IyDF550YfMs6RiAT6yXIY&e=>:227)
at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java<https://urldefense.proofpoint.com/v2/url?u=http-3A__HttpServletDispatcher.java&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=X5DdmfmzIElHWlCxgyGrznClr6mJwJPNwS4f7fXwLK0&e=>:56)
at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java<https://urldefense.proofpoint.com/v2/url?u=http-3A__HttpServletDispatcher.java&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=X5DdmfmzIElHWlCxgyGrznClr6mJwJPNwS4f7fXwLK0&e=>:51)
at javax.servlet.http.HttpServlet.service(HttpServlet.java<https://urldefense.proofpoint.com/v2/url?u=http-3A__HttpServlet.java&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=pvTUMWnuWjgBhN12j9aR1GpI0XJbtDyTU9s9KZ2MM_w&e=>:790)
at io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java<https://urldefense.proofpoint.com/v2/url?u=http-3A__ServletHandler.java&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=7wECEQFk9NvWJG6OjZ8z1ti01m5MHRohArJLLAqSMn4&e=>:74)
at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java<https://urldefense.proofpoint.com/v2/url?u=http-3A__FilterHandler.java&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=_pUDaDDH78Z3-FlgA10b_91aiRjmIvYP78qUUqPhqe8&e=>:129)
at org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java<https://urldefense.proofpoint.com/v2/url?u=http-3A__KeycloakSessionServletFilter.java&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=5fJ24KpoVpqmrIAyMkB3rSj8DAEnRyNEdLsQoKn3lGA&e=>:90)
at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java<https://urldefense.proofpoint.com/v2/url?u=http-3A__ManagedFilter.java&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=rBfOhNrFa0x2WwSgZiwWZqo5aEGwVCUw1EcYJlLwbEM&e=>:61)
at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java<https://urldefense.proofpoint.com/v2/url?u=http-3A__FilterHandler.java&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=_pUDaDDH78Z3-FlgA10b_91aiRjmIvYP78qUUqPhqe8&e=>:131)
at io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java<https://urldefense.proofpoint.com/v2/url?u=http-3A__FilterHandler.java&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=_pUDaDDH78Z3-FlgA10b_91aiRjmIvYP78qUUqPhqe8&e=>:84)
at io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java<https://urldefense.proofpoint.com/v2/url?u=http-3A__ServletSecurityRoleHandler.java&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=cSBRuu6tyZMmACuiZ6wEFnL_-JvjIIqT7u8sEQ1Kh8I&e=>:62)
at io.undertow.servlet.handlers.ServletChain$1.handleRequest(ServletChain.java<https://urldefense.proofpoint.com/v2/url?u=http-3A__ServletChain.java&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=dGVdUrzX_acJzX8WVrXrui_dNLQlPCL20OhIjIA94a4&e=>:68)
at io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java<https://urldefense.proofpoint.com/v2/url?u=http-3A__ServletDispatchingHandler.java&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=uNQzgFL51D3pcAJ2M3Em8AVvhYfyS0rNd64CgKK6A1g&e=>:36)
at org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java<https://urldefense.proofpoint.com/v2/url?u=http-3A__SecurityContextAssociationHandler.java&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=ZDwsgzs3tFQavs25ySlwfm4pKW77NG1ZrfDy3n_lDYU&e=>:78)
at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java<https://urldefense.proofpoint.com/v2/url?u=http-3A__PredicateHandler.java&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=PXbWDOJ_kbSW3Tvf3JVl2ubsvY5YsRUJwlsccMmsPeA&e=>:43)
at io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java<https://urldefense.proofpoint.com/v2/url?u=http-3A__SSLInformationAssociationHandler.java&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=I_-6z-fiZEePG5wZ9HHwSC2P5LBYr9MpHCpMqXPX0q0&e=>:132)
at io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java<https://urldefense.proofpoint.com/v2/url?u=http-3A__ServletAuthenticationCallHandler.java&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=1dDZWHBfXqH5MhSzJBoKiKsceEoF3lCvh0q5Jxh-GBU&e=>:57)
at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java<https://urldefense.proofpoint.com/v2/url?u=http-3A__PredicateHandler.java&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=PXbWDOJ_kbSW3Tvf3JVl2ubsvY5YsRUJwlsccMmsPeA&e=>:43)
at io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java<https://urldefense.proofpoint.com/v2/url?u=http-3A__AbstractConfidentialityHandler.java&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=ZwSLejZUSleMpRc4077w_zpEmjXBeIZC4S9JJlEK_QE&e=>:46)
at io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java<https://urldefense.proofpoint.com/v2/url?u=http-3A__ServletConfidentialityConstraintHandler.java&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=Dd3RFFAfQBmel9EElSRItGVdxRE7aDjOsZopCECDi0I&e=>:64)
at io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java<https://urldefense.proofpoint.com/v2/url?u=http-3A__AuthenticationMechanismsHandler.java&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=pEU4sUojcYQEpLZqO55iEfNg3y9nMP4sNQalrdIqYLo&e=>:60)
at io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java<https://urldefense.proofpoint.com/v2/url?u=http-3A__CachedAuthenticatedSessionHandler.java&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=OvD5yRY5je8c6qQIVMsEg-buKuHl4q2H1cCtn9FZR_0&e=>:77)
at io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java<https://urldefense.proofpoint.com/v2/url?u=http-3A__NotificationReceiverHandler.java&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=2S-TlCr5ZVAEYTwKfmy2jl8C_x0JjWWGwz0c4vZDevE&e=>:50)
at io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java<https://urldefense.proofpoint.com/v2/url?u=http-3A__AbstractSecurityContextAssociationHandler.java&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=oMpKLp9fs8F9WnMtNyAeFgq2gNDpVb4MgniCDywlbDs&e=>:43)
at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java<https://urldefense.proofpoint.com/v2/url?u=http-3A__PredicateHandler.java&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=PXbWDOJ_kbSW3Tvf3JVl2ubsvY5YsRUJwlsccMmsPeA&e=>:43)
at org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java<https://urldefense.proofpoint.com/v2/url?u=http-3A__JACCContextIdHandler.java&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=Tf29Rr9PGRcN_t9UJjnEIuOOg3essD9fu-MYrAUaiqo&e=>:61)
at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java<https://urldefense.proofpoint.com/v2/url?u=http-3A__PredicateHandler.java&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=PXbWDOJ_kbSW3Tvf3JVl2ubsvY5YsRUJwlsccMmsPeA&e=>:43)
at org.wildfly.extension.undertow.deployment.GlobalRequestControllerHandler.handleRequest(GlobalRequestControllerHandler.java<https://urldefense.proofpoint.com/v2/url?u=http-3A__GlobalRequestControllerHandler.java&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=8O01wfzWc036ndic1rTFRthOCwou89qUTN3U2zXJpGY&e=>:68)
at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java<https://urldefense.proofpoint.com/v2/url?u=http-3A__PredicateHandler.java&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=PXbWDOJ_kbSW3Tvf3JVl2ubsvY5YsRUJwlsccMmsPeA&e=>:43)
at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java<https://urldefense.proofpoint.com/v2/url?u=http-3A__ServletInitialHandler.java&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=QamkIbKQMWhFEejs33Gk7mvz1gx5A6Rv2zcanuAN3Hs&e=>:292)
at io.undertow.servlet.handlers.ServletInitialHandler.access$100(ServletInitialHandler.java<https://urldefense.proofpoint.com/v2/url?u=http-3A__ServletInitialHandler.java&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=QamkIbKQMWhFEejs33Gk7mvz1gx5A6Rv2zcanuAN3Hs&e=>:81)
at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java<https://urldefense.proofpoint.com/v2/url?u=http-3A__ServletInitialHandler.java&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=QamkIbKQMWhFEejs33Gk7mvz1gx5A6Rv2zcanuAN3Hs&e=>:138)
at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java<https://urldefense.proofpoint.com/v2/url?u=http-3A__ServletInitialHandler.java&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=QamkIbKQMWhFEejs33Gk7mvz1gx5A6Rv2zcanuAN3Hs&e=>:135)
at io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java<https://urldefense.proofpoint.com/v2/url?u=http-3A__ServletRequestContextThreadSetupAction.java&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=PavgV2KnQmbM9GAzwC-kp_ewRBsUPuWqAWZ95FUIJjU&e=>:48)
at io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java<https://urldefense.proofpoint.com/v2/url?u=http-3A__ContextClassLoaderSetupAction.java&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=ue7BdcrxoSCSikXBR3bNuEPYKO2q_kTXe6dBcvA_c_0&e=>:43)
at org.wildfly.extension.undertow.security.SecurityContextThreadSetupAction.lambda$create$0(SecurityContextThreadSetupAction.java<https://urldefense.proofpoint.com/v2/url?u=http-3A__SecurityContextThreadSetupAction.java&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=7hiQNqC0T66ZTeNE1H2SFd2kF9z58_LUX1UAlNckcPw&e=>:105)
at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java<https://urldefense.proofpoint.com/v2/url?u=http-3A__UndertowDeploymentInfoService.java&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=AlLYOJWkr03MUFt3f1gexmWGgunWNGId2H_-bxx144w&e=>:1514)
at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java<https://urldefense.proofpoint.com/v2/url?u=http-3A__UndertowDeploymentInfoService.java&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=AlLYOJWkr03MUFt3f1gexmWGgunWNGId2H_-bxx144w&e=>:1514)
at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java<https://urldefense.proofpoint.com/v2/url?u=http-3A__UndertowDeploymentInfoService.java&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=AlLYOJWkr03MUFt3f1gexmWGgunWNGId2H_-bxx144w&e=>:1514)
at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java<https://urldefense.proofpoint.com/v2/url?u=http-3A__UndertowDeploymentInfoService.java&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=AlLYOJWkr03MUFt3f1gexmWGgunWNGId2H_-bxx144w&e=>:1514)
at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java<https://urldefense.proofpoint.com/v2/url?u=http-3A__ServletInitialHandler.java&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=QamkIbKQMWhFEejs33Gk7mvz1gx5A6Rv2zcanuAN3Hs&e=>:272)
at io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java<https://urldefense.proofpoint.com/v2/url?u=http-3A__ServletInitialHandler.java&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=QamkIbKQMWhFEejs33Gk7mvz1gx5A6Rv2zcanuAN3Hs&e=>:81)
at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java<https://urldefense.proofpoint.com/v2/url?u=http-3A__ServletInitialHandler.java&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=QamkIbKQMWhFEejs33Gk7mvz1gx5A6Rv2zcanuAN3Hs&e=>:104)
at io.undertow.server.Connectors.executeRootHandler(Connectors.java<https://urldefense.proofpoint.com/v2/url?u=http-3A__Connectors.java&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=xwNHSXpUjEEHO6uxsOrWnwvLH-juLfKwfPS90R4MvHs&e=>:360)
at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java<https://urldefense.proofpoint.com/v2/url?u=http-3A__HttpServerExchange.java&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=rhZje1k9j79Fg_wmfu84NZ61Qev3Tek6u7rBamr8Nc4&e=>:830)
at org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java<https://urldefense.proofpoint.com/v2/url?u=http-3A__ContextClassLoaderSavingRunnable.java&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=g36VGm9F1kNbl371J3sj0yMhIAd07FK_PKnTaXmru1o&e=>:35)
at org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java<https://urldefense.proofpoint.com/v2/url?u=http-3A__EnhancedQueueExecutor.java&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=4xjhJporvIPokLuKD76PLR5CeHsN0UE1D2mrP0n6Nvg&e=>:1985)
at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java<https://urldefense.proofpoint.com/v2/url?u=http-3A__EnhancedQueueExecutor.java&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=4xjhJporvIPokLuKD76PLR5CeHsN0UE1D2mrP0n6Nvg&e=>:1487)
at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java<https://urldefense.proofpoint.com/v2/url?u=http-3A__EnhancedQueueExecutor.java&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=4xjhJporvIPokLuKD76PLR5CeHsN0UE1D2mrP0n6Nvg&e=>:1378)
at java.lang.Thread.run(Thread.java<https://urldefense.proofpoint.com/v2/url?u=http-3A__Thread.java&d=DwQFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=C_CfdUShSFCYs6zxVyHSnSz9fJShkEYKCGzxDFOo-H4&e=>:748)

Thanks,
Deepti

----------------------------------------------------------------------
This e-mail, including any attached files, may contain confidential and privileged information for the sole use of the intended recipient.  Any review, use, distribution, or disclosure by others is strictly prohibited.  If you are not the intended recipient (or authorized to receive information for the intended recipient), please contact the sender by reply e-mail and delete all copies of this message.
_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user<https://urldefense.proofpoint.com/v2/url?u=https-3A__lists.jboss.org_mailman_listinfo_keycloak-2Duser&d=DwMFaQ&c=PskvixtEUDK7wuWU-tIg6oKuGYBRbrMXk2FZvF0UfTo&r=1b2ea81izKhRr82oaQB3vmjRt84jwqG6AXlcGEOqxhc&m=3HgIHPDwIKDgnKpICRCE_4LA04bGWQRokC_9KV4yjMY&s=4l_9WcsXpVcxuRScEVbjh89_ajMB18r5eMv_syGAy20&e=>

From geoff at opticks.io  Tue Nov 27 03:21:23 2018
From: geoff at opticks.io (Geoffrey Cleaves)
Date: Tue, 27 Nov 2018 09:21:23 +0100
Subject: [keycloak-user] Issue in keycloak
In-Reply-To: <54c93551-6389-2369-2c07-b4792b83afaf@azilen.com>
References: <54c93551-6389-2369-2c07-b4792b83afaf@azilen.com>
Message-ID: <CAHzT=q_euCdtuyG88e5t7RhKWmkTVDLhjPfs56vFd49P+n27cA@mail.gmail.com>

Starting in 4.6, you need to explicitly enable preview features. See
https://stackoverflow.com/questions/53367566/unable-to-setup-idp-token-exchange-in-keycloak-4-6-0-final

Regards,
Geoffrey Cleaves







On Tue, 27 Nov 2018 at 06:32, Dhara Basida <dhara.basida at azilen.com> wrote:

> Hey,
>
> I had installed keycloak version 4.6.0. I am unable to find Client
> Permissions Tab as mentioned in your doc for managing single client.It
> would be a great appreciation to your help in advance.
>
> Thanks and Regards,
>
> Dhara Basida
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

From dhara.basida at azilen.com  Tue Nov 27 05:32:48 2018
From: dhara.basida at azilen.com (Dhara Basida)
Date: Tue, 27 Nov 2018 16:02:48 +0530
Subject: [keycloak-user] Issue to keycloak client access
Message-ID: <218a6568-8fd8-b62d-ad8a-bb4fa4cb0ce9@azilen.com>

Hey,

Greetings!

I am currently working on managing client in keycloak. I had set up 
proper roles and permission and added policy as required.I had created 
the client admin by following the steps given in the keycloak document , 
but I am unable to get access to client page. Any help would be appreciable.

Thanks and Regards,

Dhara Basida

-------------- next part --------------
A non-text attachment was scrubbed...
Name: keycloak-client.png
Type: image/png
Size: 62483 bytes
Desc: not available
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20181127/72f8fc11/attachment-0001.png 

From K.Buler at adbglobal.com  Tue Nov 27 05:41:43 2018
From: K.Buler at adbglobal.com (Karol Buler)
Date: Tue, 27 Nov 2018 10:41:43 +0000
Subject: [keycloak-user] Issue to keycloak client access
In-Reply-To: <218a6568-8fd8-b62d-ad8a-bb4fa4cb0ce9@azilen.com>
References: <218a6568-8fd8-b62d-ad8a-bb4fa4cb0ce9@azilen.com>
Message-ID: <8d412064-a278-9337-d441-7125b0103d85@adbglobal.com>

It looks like your user hasn't a proper roles.

On 27.11.2018 11:32, Dhara Basida wrote:
Hey,

Greetings!

I am currently working on managing client in keycloak. I had set up proper roles and permission and added policy as required.I had created the client admin by following the steps given in the keycloak document , but I am unable to get access to client page. Any help would be appreciable.

Thanks and Regards,

Dhara Basida




_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user

[https://www.adbglobal.com/wp-content/uploads/adb.png]
adbglobal.com<https://www.adbglobal.com>
This message (including any attachments) may contain confidential, proprietary, privileged and/or private information. The information is intended for the use of the individual or entity designated above. If you are not the intended recipient of this message, please notify the sender immediately, and delete the message and any attachments. Any disclosure, reproduction, distribution or other use of this message or any attachments by an individual or entity other than the intended recipient is STRICTLY PROHIBITED.
Please note that ADB protects your privacy. Any personal information we collect from you is used in accordance with our Privacy Policy<https://www.adbglobal.com/privacy-policy/> and in compliance with applicable European data protection law (Regulation (EU) 2016/679, General Data Protection Regulation) and other statutory provisions.

From kkcmadhu at yahoo.com  Tue Nov 27 06:46:13 2018
From: kkcmadhu at yahoo.com (Madhu)
Date: Tue, 27 Nov 2018 11:46:13 +0000 (UTC)
Subject: [keycloak-user] start up of keycloak nodes roughly increases two
 folds for every 100 tenants.
References: <2085409309.6617889.1543319173801.ref@mail.yahoo.com>
Message-ID: <2085409309.6617889.1543319173801@mail.yahoo.com>


Hi I am using keycloak 4.5. i created about 600+ tenants with 50 users each for a performance testing.

Upon creating tenants the start up time of keycloak increases drastically. This seems to be due to pretty much all entities at start up.. 
I tried disabling realm cache, user cache and did not help.. can you suggest how to bring down the start up time?

Is it absolutely necessary for keycloak to load every thing at start up??

This is an extract from hibernate stat i got on a c4 xlarge ec2 instance ( 4 core 8 gig), keycloak configured with xms=xmx=5g.

018-11-24 10:33:19,998 INFO [org.hibernate.envers.boot.internal.EnversServiceImpl] (ServerService Thread Pool ? 61) Envers integration enabled? : true
2018-11-24 10:33:20,499 INFO [org.hibernate.validator.internal.util.Version] (ServerService Thread Pool ? 61) HV000001: Hibernate Validator 5.3.6.Final
2018-11-24 10:33:21,296 INFO [org.hibernate.hql.internal.QueryTranslatorFactoryInitiator] (ServerService Thread Pool ? 61) HHH000397: Using ASTQueryTranslatorFactory
^C
[centos at ip-172-31-45-199 log]$ 11:10:45,750 INFO [org.hibernate.engi ne.internal.StatisticalLoggingSessionEventListener] (ServerService Th read Pool ? 61) Session Metrics {
 669457663 nanoseconds spent acquiring 92974 JDBC connections;
 148185664 nanoseconds spent releasing 92974 JDBC connections;
 1852958902 nanoseconds spent preparing 92974 JDBC statements;
 35866600579 nanoseconds spent executing 92974 JDBC statements;
 0 nanoseconds spent executing 0 JDBC batches;
 0 nanoseconds spent performing 0 L2C puts;
 0 nanoseconds spent performing 0 L2C hits;
 0 nanoseconds spent performing 0 L2C misses;
 543461113 nanoseconds spent executing 2 flushes (flushing a total of 227216 entities and 158902 collections);
 2197548626817 nanoseconds spent executing 14139 partial-flushes ( flushing a total of* 1042012050 entities and 1042012050 collections*)
}
11:10:45,780 INFO [org.hibernate.engine.internal.StatisticalLoggingS essionEventListener] (ServerService Thread Pool ? 61) Session Metric s 
{ 7689387 nanoseconds spent acquiring 1 JDBC connections; 34263 nanoseconds spent releasing 1 JDBC connections; 8025969 nanoseconds spent preparing 1 JDBC statements; 909784 nanoseconds spent executing 1 JDBC statements; 0 nanoseconds spent executing 0 JDBC batches; 0 nanoseconds spent performing 0 L2C puts; 0 nanoseconds spent performing 0 L2C hits; 0 nanoseconds spent performing 0 L2C misses; 3525215 nanoseconds spent executing 3 flushes (flushing a total o f 3 entities and 0 collections); 0 nanoseconds spent executing 0 partial-flushes (flushing a total  of 0 entities and 0 collections)}
11:10:45,795 INFO [org.hibernate.engine.internal.StatisticalLoggingS essionEventListener] (ServerService Thread Pool ? 61) Session Metric s {
 437680 nanoseconds spent acquiring 1 JDBC connections;
 10539 nanoseconds spent releasing 1 JDBC connections;
 465001 nanoseconds spent preparing 1 JDBC statements;
 719260 nanoseconds spent executing 1 JDBC statements;
 0 nanoseconds spent executing 0 JDBC batches;
 0 nanoseconds spent performing 0 L2C puts;
 0 nanoseconds spent performing 0 L2C hits;
 0 nanoseconds spent performing 0 L2C misses;
 0 nanoseconds spent executing 0 flushes (flushing a total of 0 en tities and 0 collections);
 17455 nanoseconds spent executing 1 partial-flushes (flushing a total of 0 entities and 0 collections)

All My 600 +realms are pretty much same i.e. each realm has a client scope, a java script mapper (to get all the realm roles into resouce role),couple of attribute mappers, 2 users groups ( 1 for admins) and 1 for other users. i have about 50 users in each realm and all the user belongs to one of the 2 user groups ( no custom roles though).. 

Also, I bench marked the start up time after creating 50 or 100 realms and the start up time increases as the number of realms increases .

I am able to manage as i have disabled the admin console and use rest endpoints.. but still the start up time and loading pretty much every thing seems little wiered.

Please correct my understanding if i am wrong here..

| No of Realms | Start up time in mins |
| 0 realms | 0.22 mins |
| 100 realms | 2.34 mins |
| 200 realms | 2.53 mins |
| 300 realms | 5.34 mins |
| 400 realms | 9.42 mins |
| 500 realms | 14.6 mins |
| 650 realms | 37 mins |


Like wise the time taken to create tenants too gradually increases ( i use import to create realms)

from about 3 seconds for first few realms to about 30 sec for 600th realm..

Any advise /help will be appreciated.

From craig at baseventure.com  Tue Nov 27 07:12:39 2018
From: craig at baseventure.com (Craig Setera)
Date: Tue, 27 Nov 2018 06:12:39 -0600
Subject: [keycloak-user] Simple server OAuth client?
In-Reply-To: <1543274299.23743.7.camel@acutus.pro>
References: <CAPVdwjpzWGKGsAs2qMhdJwwm1iiC54QkKeGCkyjOMarj_ri6GQ@mail.gmail.com>
	<1543274299.23743.7.camel@acutus.pro>
Message-ID: <CAPVdwjqP8ziXZdZ7mkVNow4oyRF7jQUpoVqdiAKCi0VRqak4AQ@mail.gmail.com>

No.  I was looking for something similar to
org.keycloak.authorization.client.util.TokenCallable.  However, this
appears to be more of an internal helper class versus a real utility
class.  With that said, I think I can build out something similar to
TokenCallable for my purposes.

=================================
*Craig Setera*

*Chief Technology Officer*




On Mon, Nov 26, 2018 at 5:18 PM Dmitry Telegin <dt at acutus.pro> wrote:

> Hi Craig, do you mean "between two Keycloak servers"? Any similarities to
> this case?
> http://lists.jboss.org/pipermail/keycloak-user/2018-November/016287.html
>
> Cheers,
> Dmitry Telegin
> CTO, Acutus s.r.o.
> Keycloak Consulting and Training
>
> Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
> +42 (022) 888-30-71
> E-mail: info at acutus.pro
>
> On Mon, 2018-11-26 at 16:20 -0600, Craig Setera wrote:
> > I have a need to do a service-level account connection between two
> > servers.  I believe that the client credentials grant and Keycloak
> service
> > accounts are the proper way to handle this.  What I'm wondering is if
> there
> > is a simple to use OAuth authentication client built into the Keycloak
> code
> > that can be used for this purpose?  In particular, something that manages
> > refresh token and such.
> >
> > It appears like a lot of the logic of interest is available in
> > RefreshableKeycloakSecurityContext, however I'm not sure if this is
> really
> > meant to be consumed as a generic OAuth client library?
> >
> > Thanks,
> > Craig
> >
> > =================================
> > *Craig Setera*
> >
> > *Chief Technology Officer*
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
>

From abhi.raghav007 at gmail.com  Tue Nov 27 08:06:19 2018
From: abhi.raghav007 at gmail.com (abhishek raghav)
Date: Tue, 27 Nov 2018 18:36:19 +0530
Subject: [keycloak-user] Custom verification mail with image
In-Reply-To: <81dc46cbda2c49baa370c903815c73c5@maurer-electronics.hr>
References: <81dc46cbda2c49baa370c903815c73c5@maurer-electronics.hr>
Message-ID: <CAJmz6fsaUWOfbeCAaEZ9NzAmiC38CJkE8U5K2fBRVoChcZWX4w@mail.gmail.com>

Hi Luka,

Were you able to find any workaround to include image in the custom email
template. I also encountered the same issue. It looks like keycloak does
not respect the same folder structure as maintained in login.


*- Best Regards*
   Abhishek Raghav








On Tue, Oct 16, 2018 at 10:43 PM Luka Odak <Luka.Odak at maurer-electronics.hr>
wrote:

> Hy,
>
> I'm trying to customize email which is sent on
> executeActionsEmail("VERIFY_EMAIL")
> In folder themes I created following structure
> mytheme
>     email
>         html
>         messages
>         text
>         resources
>             img
>             css
>         theme.properties
>
> and populated it with necessary files. When in messages_en.properties I
> set <img src=" ${url.resourcesPath}/img/ logo.jpg"> delivered mail is not
> stylized, but just plain text without image.
> I tried to move resources directory through structure but without success.
> Also I've tried to hardcode path to the image. That way I receive stylized
> email but without image.
> What am I doing wrong?
> Thanks.
>
>
> With best regards
> -------------------------------------------------------------
> Luka Odak
> Software Developer
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

From vedavallyabhilash at gmail.com  Tue Nov 27 09:50:30 2018
From: vedavallyabhilash at gmail.com (abhilashreddy abhi)
Date: Tue, 27 Nov 2018 09:50:30 -0500
Subject: [keycloak-user] Keycloak event-listener-sysout example not working ,
	v4.6.0.Final
Message-ID: <CAHr-Nxe6d5-FwF5or9tHyHnFRZe_-xMcRD3uPZSgFuu-z6h=vg@mail.gmail.com>

Hello,

I am using 4.6.0.Final keycloak version and  trying out event-sysout
example (
https://github.com/keycloak/keycloak/tree/master/examples/providers/event-listener-sysout)
,but i am unable to make it work and getting following errors

1) I have created a spring boot application with following classes
                      --Application.class (Contains Main method)
                      --SysoutEventListenerProvider
                     ---SysoutEventListenerProviderFactory
    I have placed org.keycloak.events.EventListenerProviderFactory file in
src/main/resources/META-INF/services  which points to my
SysoutEventListenerProviderFactory.
    Did a maven clean install and took the jar from target folder and tried
placing it any one of  standalone/deployments folder ,
Keycloak_Home/providers folder and also created as a module as per
    instructions in documentation  but all of the above methods throws the
following error.

Caused by: java.util.ServiceConfigurationError:
org.keycloak.events.EventListenerProviderFactory: Provider
com.example.demo.springboot.SysoutEventListenerProviderFactory not found
        at java.util.ServiceLoader.fail(Unknown Source)
        at java.util.ServiceLoader.access$300(Unknown Source)
        at java.util.ServiceLoader$LazyIterator.nextService(Unknown Source)
        at java.util.ServiceLoader$LazyIterator.next(Unknown Source)
        at java.util.ServiceLoader$1.next(Unknown Source)
        at
org.keycloak.provider.DefaultProviderLoader.load(DefaultProviderLoader.java:60)
        at
org.keycloak.provider.ProviderManager.load(ProviderManager.java:92)
        at
org.keycloak.services.DefaultKeycloakSessionFactory.loadFactories(DefaultKeycloakSessionFactory.java:214)
        at
org.keycloak.services.DefaultKeycloakSessionFactory.init(DefaultKeycloakSessionFactory.java:80)
        at
org.keycloak.services.resources.KeycloakApplication.createSessionFactory(KeycloakApplication.java:331)
        at
org.keycloak.services.resources.KeycloakApplication.<init>(KeycloakApplication.java:118)

2) This time, I have removed Application.class and exported the jar using
export->jar in eclipse and tried placing it in deployment folder or
providers or as a module  and the application starts   but throws the
 following log.

               ERROR [org.keycloak.events.EventBuilder] (default task-1)
Event listener 'sysout' registered, but provider not found

Can someone please help me with what I am missing?

Thanks
Abhilash

From A.Almalki at tamkeentech.sa  Tue Nov 27 10:37:57 2018
From: A.Almalki at tamkeentech.sa (Abdulaziz AlMalki)
Date: Tue, 27 Nov 2018 15:37:57 +0000
Subject: [keycloak-user] Host Fixed provider
Message-ID: <97b11b8a00fb4d60a26e2ae8656e3059@tamkeentech.sa>

Hi,


The documentation says that: "It is also possible to override the hostname for a specific realm through the configuration of the realm in the admin console."

https://www.keycloak.org/docs/latest/server_admin/index.html#fixed-provider


However, I cannot find any setting to override host name in the realm configuration. Am I missing anything? Is it really implemented?


Thanks..

From sthorger at redhat.com  Tue Nov 27 12:09:16 2018
From: sthorger at redhat.com (Stian Thorgersen)
Date: Tue, 27 Nov 2018 18:09:16 +0100
Subject: [keycloak-user] Host Fixed provider
In-Reply-To: <97b11b8a00fb4d60a26e2ae8656e3059@tamkeentech.sa>
References: <97b11b8a00fb4d60a26e2ae8656e3059@tamkeentech.sa>
Message-ID: <CAJgngAeUU+Z3TTLor432m8PvbWqB1bh=D-OP7SqZ+X_g_6PFvA@mail.gmail.com>

Did you enable the fixed provider? It has to be enabled first then you get
the option on the realm

On Tue, 27 Nov 2018, 16:40 Abdulaziz AlMalki <A.Almalki at tamkeentech.sa
wrote:

> Hi,
>
>
> The documentation says that: "It is also possible to override the hostname
> for a specific realm through the configuration of the realm in the admin
> console."
>
> https://www.keycloak.org/docs/latest/server_admin/index.html#fixed-provider
>
>
> However, I cannot find any setting to override host name in the realm
> configuration. Am I missing anything? Is it really implemented?
>
>
> Thanks..
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

From sthorger at redhat.com  Tue Nov 27 12:11:23 2018
From: sthorger at redhat.com (Stian Thorgersen)
Date: Tue, 27 Nov 2018 18:11:23 +0100
Subject: [keycloak-user] Keycloak event-listener-sysout example not
 working , v4.6.0.Final
In-Reply-To: <CAHr-Nxe6d5-FwF5or9tHyHnFRZe_-xMcRD3uPZSgFuu-z6h=vg@mail.gmail.com>
References: <CAHr-Nxe6d5-FwF5or9tHyHnFRZe_-xMcRD3uPZSgFuu-z6h=vg@mail.gmail.com>
Message-ID: <CAJgngAd9a_V4MMdHWgWU=LU8T2OpWv=X0vE5hHPnbFP9EvGQyg@mail.gmail.com>

Perhaps try deploying the example as is rather than modifying it? We don't
support use of spring Boot in providers.

On Tue, 27 Nov 2018, 15:52 abhilashreddy abhi <vedavallyabhilash at gmail.com
wrote:

> Hello,
>
> I am using 4.6.0.Final keycloak version and  trying out event-sysout
> example (
>
> https://github.com/keycloak/keycloak/tree/master/examples/providers/event-listener-sysout
> )
> ,but i am unable to make it work and getting following errors
>
> 1) I have created a spring boot application with following classes
>                       --Application.class (Contains Main method)
>                       --SysoutEventListenerProvider
>                      ---SysoutEventListenerProviderFactory
>     I have placed org.keycloak.events.EventListenerProviderFactory file in
> src/main/resources/META-INF/services  which points to my
> SysoutEventListenerProviderFactory.
>     Did a maven clean install and took the jar from target folder and tried
> placing it any one of  standalone/deployments folder ,
> Keycloak_Home/providers folder and also created as a module as per
>     instructions in documentation  but all of the above methods throws the
> following error.
>
> Caused by: java.util.ServiceConfigurationError:
> org.keycloak.events.EventListenerProviderFactory: Provider
> com.example.demo.springboot.SysoutEventListenerProviderFactory not found
>         at java.util.ServiceLoader.fail(Unknown Source)
>         at java.util.ServiceLoader.access$300(Unknown Source)
>         at java.util.ServiceLoader$LazyIterator.nextService(Unknown Source)
>         at java.util.ServiceLoader$LazyIterator.next(Unknown Source)
>         at java.util.ServiceLoader$1.next(Unknown Source)
>         at
>
> org.keycloak.provider.DefaultProviderLoader.load(DefaultProviderLoader.java:60)
>         at
> org.keycloak.provider.ProviderManager.load(ProviderManager.java:92)
>         at
>
> org.keycloak.services.DefaultKeycloakSessionFactory.loadFactories(DefaultKeycloakSessionFactory.java:214)
>         at
>
> org.keycloak.services.DefaultKeycloakSessionFactory.init(DefaultKeycloakSessionFactory.java:80)
>         at
>
> org.keycloak.services.resources.KeycloakApplication.createSessionFactory(KeycloakApplication.java:331)
>         at
>
> org.keycloak.services.resources.KeycloakApplication.<init>(KeycloakApplication.java:118)
>
> 2) This time, I have removed Application.class and exported the jar using
> export->jar in eclipse and tried placing it in deployment folder or
> providers or as a module  and the application starts   but throws the
>  following log.
>
>                ERROR [org.keycloak.events.EventBuilder] (default task-1)
> Event listener 'sysout' registered, but provider not found
>
> Can someone please help me with what I am missing?
>
> Thanks
> Abhilash
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

From A.Almalki at tamkeentech.sa  Tue Nov 27 12:30:08 2018
From: A.Almalki at tamkeentech.sa (Abdulaziz AlMalki)
Date: Tue, 27 Nov 2018 17:30:08 +0000
Subject: [keycloak-user] Host Fixed provider
In-Reply-To: <CAJgngAeUU+Z3TTLor432m8PvbWqB1bh=D-OP7SqZ+X_g_6PFvA@mail.gmail.com>
References: <97b11b8a00fb4d60a26e2ae8656e3059@tamkeentech.sa>,
	<CAJgngAeUU+Z3TTLor432m8PvbWqB1bh=D-OP7SqZ+X_g_6PFvA@mail.gmail.com>
Message-ID: <D2FD4F33949323B3.D53A7249-2FD2-474C-90FB-C4F92F0261EF@mail.outlook.com>

Hi Stian,

We use keycloak docker image, and as per it?s documentation, specifying KEYCLOAK_HOSTNAME env var will enqble fixed provider:

Specify hostname
To set a fixed hostname for Keycloak use the following environment value. This is highly recommended in production.

KEYCLOAK_HOSTNAME: Specify hostname for Keycloak (optional, default is retrieved from request, recommended in production)

Thanks


Get Outlook for iOS<https://aka.ms/o0ukef>
________________________________
From: Stian Thorgersen <sthorger at redhat.com>
Sent: Tuesday, November 27, 2018 8:09 PM
To: Abdulaziz AlMalki
Cc: keycloak-user
Subject: Re: [keycloak-user] Host Fixed provider

Did you enable the fixed provider? It has to be enabled first then you get the option on the realm

On Tue, 27 Nov 2018, 16:40 Abdulaziz AlMalki <A.Almalki at tamkeentech.sa<mailto:A.Almalki at tamkeentech.sa> wrote:
Hi,


The documentation says that: "It is also possible to override the hostname for a specific realm through the configuration of the realm in the admin console."

https://www.keycloak.org/docs/latest/server_admin/index.html#fixed-provider<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.keycloak.org_docs_latest_server-5Fadmin_index.html-23fixed-2Dprovider&d=DwMFaQ&c=n_xP_VG1y9Cwv5d8BRTUDpPdaSV5MYNDDitXxE7XNu0&r=wkiJsyWodOjgQdKqnaTilPZCZC8xLlNEwrid-H03wDA&m=aHE_Z6hN-2_LNwYkpZDYH33pYC9vphuMijps3CJK4NY&s=OwphhxVvcV3K9_W5mXbCiaT8g_80qLs3u_4Gdpdr-iY&e=>


However, I cannot find any setting to override host name in the realm configuration. Am I missing anything? Is it really implemented?


Thanks..
_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user<https://urldefense.proofpoint.com/v2/url?u=https-3A__lists.jboss.org_mailman_listinfo_keycloak-2Duser&d=DwMFaQ&c=n_xP_VG1y9Cwv5d8BRTUDpPdaSV5MYNDDitXxE7XNu0&r=wkiJsyWodOjgQdKqnaTilPZCZC8xLlNEwrid-H03wDA&m=aHE_Z6hN-2_LNwYkpZDYH33pYC9vphuMijps3CJK4NY&s=ohT6w1MbVWlH0pAiVphYxhfkDhDVngjjqEsePBZlB_k&e=>

From wyllys.ingersoll at keepertech.com  Tue Nov 27 17:01:55 2018
From: wyllys.ingersoll at keepertech.com (Wyllys Ingersoll)
Date: Tue, 27 Nov 2018 17:01:55 -0500
Subject: [keycloak-user] StackOverflowError when listing federated identities
Message-ID: <CAGbviv+YYjN5rVXwucZ57itemW45jVmP+7pQ5vKLTRCuHy8nzA@mail.gmail.com>

Using Keycloak 4.6.0.Final, when I query for all users in a realm which is
federated to an AD domain (only about 25 users in the domain), it pretty
consistently throws exceptions (see below).

Oddly enough, if I add the parameter "briefRepresentation=true", the list
is returned successfully.  I can query for individual users just fine
(brief or full).

This was not an issue in 4.5.0, Im only seeing now that I upgraded to 4.6.0.

Possibly a memory issue, but its hard to tell.
Any ideas?

thanks,
   Wyllys Ingersoll


21:32:11,324 ERROR [org.keycloak.services.error.KeycloakErrorHandler]
(default task-112) Uncaught server error: java.lang.StackOverflowError
at sun.reflect.GeneratedMethodAccessor378.invoke(Unknown Source)
at
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)
at
org.keycloak.connections.jpa.PersistenceExceptionConverter.invoke(PersistenceExceptionConverter.java:49)
at com.sun.proxy.$Proxy92.find(Unknown Source)
at
org.keycloak.models.jpa.JpaUserProvider.getUserById(JpaUserProvider.java:520)
at
org.keycloak.storage.UserStorageManager.getUserById(UserStorageManager.java:369)
at
org.keycloak.models.cache.infinispan.UserAdapter.getUserModel(UserAdapter.java:399)
at
org.keycloak.models.cache.infinispan.DefaultLazyLoader.get(DefaultLazyLoader.java:42)
at
org.keycloak.models.cache.infinispan.entities.CachedUser.getRequiredActions(CachedUser.java:111)
at
org.keycloak.models.cache.infinispan.UserAdapter.getRequiredActions(UserAdapter.java:173)
at
org.keycloak.models.utils.UserModelDelegate.getRequiredActions(UserModelDelegate.java:99)
at
org.keycloak.models.utils.UserModelDelegate.getRequiredActions(UserModelDelegate.java:99)
at
org.keycloak.models.utils.UserModelDelegate.getRequiredActions(UserModelDelegate.java:99)
at
org.keycloak.models.utils.UserModelDelegate.getRequiredActions(UserModelDelegate.java:99)
at
org.keycloak.models.utils.UserModelDelegate.getRequiredActions(UserModelDelegate.java:99)
at
org.keycloak.storage.ldap.mappers.msad.MSADUserAccountControlStorageMapper$MSADUserModelDelegate.getRequiredActions(MSADUserAccountControlStorageMapper.java:305)
at
org.keycloak.models.cache.infinispan.DefaultLazyLoader.get(DefaultLazyLoader.java:43)
at
org.keycloak.models.cache.infinispan.entities.CachedUser.getRequiredActions(CachedUser.java:111)
at
org.keycloak.models.cache.infinispan.UserAdapter.getRequiredActions(UserAdapter.java:173)
at
org.keycloak.models.utils.UserModelDelegate.getRequiredActions(UserModelDelegate.java:99)
at
org.keycloak.models.utils.UserModelDelegate.getRequiredActions(UserModelDelegate.java:99)
at
org.keycloak.models.utils.UserModelDelegate.getRequiredActions(UserModelDelegate.java:99)
at
org.keycloak.models.utils.UserModelDelegate.getRequiredActions(UserModelDelegate.java:99)
at
org.keycloak.models.utils.UserModelDelegate.getRequiredActions(UserModelDelegate.java:99)
at
org.keycloak.storage.ldap.mappers.msad.MSADUserAccountControlStorageMapper$MSADUserModelDelegate.getRequiredActions(MSADUserAccountControlStorageMapper.java:305)
at
org.keycloak.models.cache.infinispan.DefaultLazyLoader.get(DefaultLazyLoader.java:43)
at
org.keycloak.models.cache.infinispan.entities.CachedUser.getRequiredActions(CachedUser.java:111)
...

From Chris.Brandhorst at topicus.nl  Wed Nov 28 03:14:52 2018
From: Chris.Brandhorst at topicus.nl (Chris Brandhorst)
Date: Wed, 28 Nov 2018 08:14:52 +0000
Subject: [keycloak-user] Clustering + SAML = No backchannel logout. Why?
Message-ID: <CE440B41-30CA-4819-B8D9-33FA68DF7D67@topicus.nl>

Hi,

We can all see the following warning in the description of the Java Servlet Filter Adapter:

       Backchannel logout does not currently work when you have a clustered application that uses the SAML filter.

We are unable to find or guess what the reasons behind these are, so my question is: why? Could someone explain the details as to why this is the case? And on which side (KC or the SAML filter) side things go wrong?

Thanks,
Chris

From dharlaftis at ekt.gr  Wed Nov 28 03:50:52 2018
From: dharlaftis at ekt.gr (Dimitris Charlaftis)
Date: Wed, 28 Nov 2018 10:50:52 +0200
Subject: [keycloak-user] keycloak and nginx
Message-ID: <19669e24-de90-40ee-e0ff-f68423f1b65c@ekt.gr>

Hello,

I am trying to connect keycloak with an nginx reverse proxy. The nginx 
server will receive calls from protected sites , each configured per 
virtual host and send the request to keycloak for authorization. When 
nginx receives OK from keycloak it proxies back the authenticated call 
to client. Correct?

I assume I have to create a realm for that nginx and a client for each 
of these sites. Can you provide some configuration for the nginx server?

Regards,

Dimitris.

-- 
_____________________________

Dimitris Charlaftis
Software Engineer

National Documentation Center
email: dharlaftis at ekt.gr
_____________________________


From Marian.Rainer-Harbach at apa.at  Wed Nov 28 03:56:07 2018
From: Marian.Rainer-Harbach at apa.at (Rainer-Harbach Marian)
Date: Wed, 28 Nov 2018 08:56:07 +0000
Subject: [keycloak-user] Login after registration fails when other user was
	logged in before
Message-ID: <9b3ee83376a977a4a1251adb1a7953fd83c96ee7.camel@apa.at>

Hi,

we encountered a problem in a special use case (Keycloak 4.5.0.Final):
We'd like to display a registration button in our application even when
a user (user1) is logged in.

Directly calling the registration form seems to be supported according
to
http://lists.jboss.org/pipermail/keycloak-user/2016-August/007473.html

However, the login after the registration (of user2) fails when user1
was logged in before.

The problem can be reproduced by following these steps:
1. Log user1 into the account app
2. Open the registration form at https://<host>/auth/realms/<realm>/protocol/openid-connect/registrations?client_id=account&response_type=code&scope=openid+email&redirect_uri=<url_to_account_app>
3. Register user2
4. After registration, this message is shown: "We're sorry...
You are already authenticated as different user <user1> in this
session. Please logout first."
The message contains a link "Back to Application".

However, user1 is not logged in anymore and the link "Back to
Application" leads to the login form.

This situation is not straightforward for a user to resolve: user1 has
to log in again, then log out, and only then is user2 able to log in. 

The reason appears to be that opening the registration form in step 2
deletes the cookies KEYCLOAK_IDENTITY and KEYCLOAK_SESSION. However,
the cookie AUTH_SESSION_ID remains unchanged.

To me it seems that opening the registration form should cause a new
AUTH_SESSION_ID to be generated (beside KEYCLOAK_IDENTITY and
KEYCLOAK_SESSION being cleared).

I'd appreciate any thoughts on that!

Best regards,
Marian



From wolfbro92 at gmail.com  Wed Nov 28 03:59:53 2018
From: wolfbro92 at gmail.com (Kunal Kumar)
Date: Wed, 28 Nov 2018 16:59:53 +0800
Subject: [keycloak-user] (no subject)
Message-ID: <CAE5MKW__JnoWozY3MjQ31=xPNEoZRopWAROtvmdF+2qGiZQXmw@mail.gmail.com>

Hi all,

I am connecting 5 of my web apps to Keycloak for authentication. I already
know that we can change the theme of the Keycloak login page.

But what I am curious about is if the themes for the Keycloak login page
could be slightly different for each of the web app accessed. Is mapping
the theme to the particular redirect_uri of the web app possible?

For example, if a user wants to enter website A he will be redirected to
Keycloak of course, but with a redirect_uri of website A, but using that
redirect_uri value, determining the correct theme to be displayed during
the login.

Is this plausible or just pure fantasy, would like to know your thoughts on
this guys.

Regards,
Kunal Kumar

From thesofiane at gmail.com  Wed Nov 28 04:32:09 2018
From: thesofiane at gmail.com (So Be)
Date: Wed, 28 Nov 2018 10:32:09 +0100
Subject: [keycloak-user] Issues when modifying account.ftl
Message-ID: <CACz=5kk08r3XYGACgKaq3oOx8mi8N_h1CR1F7o8m0PR67pBqLA@mail.gmail.com>

Hi,

I added some attributes to registration page by following this link
https://www.keycloak.org/docs/latest/server_development/index.html#modifying-extending-the-registration-form

but I got this error:

Caused by: freemarker.core.ParseException: Syntax error in template
"account.ftl" in line 54, column 171:
11/28/2018 10:22:28 AMUsing ?html (legacy escaping) is not allowed when
auto-escaping is on with a markup output format (HTML), to avoid
double-escaping mistakes.
11/28/2018 10:22:28 AM at
freemarker.core.FMParser.BuiltIn(FMParser.java:1188)

....

Best,

Sofiane.

From nocquidant at gmail.com  Wed Nov 28 05:52:29 2018
From: nocquidant at gmail.com (Nicolas Ocquidant)
Date: Wed, 28 Nov 2018 11:52:29 +0100
Subject: [keycloak-user] Failed to replace entity
Message-ID: <CABS93FQnBk5YU66X9LE4DSv_O1R6RS7D2EOTHx-99ntZDzv_4A@mail.gmail.com>

Hi

I am currently testing KC and I get WARN messages in my console when I try
to refresh tokens.

11:42:54,245 WARN
[org.keycloak.models.sessions.infinispan.changes.InfinispanChangelogBasedTransaction]
(default task-1) Failed to replace entity
'9c206d08-8542-4385-ad97-61ae61ee4e00' in cache 'sessions'

Steps to reproduce :

   - start KC 4.6.0.Final
   - populate KC using the admin web console : realm=SpringBootKeycloak,
   client=login-app, role=user, user=user1/user1(role user)
   - use curl to login user1 :

tmp=$(curl -s -d
"grant_type=password&client_id=login-app&username=user1&password=user1" -X
POST -H "Content-Type: application/x-www-form-urlencoded"
http://localhost:8180/auth/realms/SpringBootKeycloak/protocol/openid-connect/token)
&& refresh_token1=$(echo "$tmp" | jq -r '.refresh_token') && echo "$tmp" |
jq .

   - use curl to refresh tokens of user1 :

curl -s -d
"grant_type=refresh_token&client_id=login-app&refresh_token=$refresh_token1"
-X POST -H "Content-Type: application/x-www-form-urlencoded"
http://localhost:8180/auth/realms/SpringBootKeycloak/protocol/openid-connect/token
| jq .

My config is as follow :

<distributed-cache name="sessions" owners="2" statistics-enabled="true"
remote-timeout="600000">
<state-transfer timeout="36000000"/>
<binary-memory eviction-type="COUNT" size="30000"/>
<expiration lifespan="86400000" interval="120000"/>
<jdbc-store data-source="InfinispanDS"
dialect="POSTGRES"
fetch-state="true"
passivation="true"
preload="false"
purge="false"
shared="false"
singleton="false">
<table prefix="ISPN_mbd_node1">
<id-column name="ID_COLUMN" type="VARCHAR(255)"/>
<data-column name="DATA_COLUMN" type="BYTEA"/>
<timestamp-column name="TIMESTAMP_COLUMN" type="BIGINT"/>
</table>
</jdbc-store>
</distributed-cache>

Shall I fill a Jira?
Thanks,
--nick

From dominic.michel01 at realdigital.de  Wed Nov 28 06:02:09 2018
From: dominic.michel01 at realdigital.de (dominic.michel01 at realdigital.de)
Date: Wed, 28 Nov 2018 11:02:09 +0000
Subject: [keycloak-user] Access to security-admin-console via SSL is
	prohibited?
Message-ID: <FF0BCE66D952254B942F978A64B2873D01A74BC7@FFM30MBXC03N.comm.madm.net>


Hi.

I've just deployed a keycloak which is only reachable via a haproxy that enforces SSL.
Now i'm trying to log into the security-admin-console via https://myserver.com/auth/admin/ which is redirecting me to https://mysever.com/auth/realms/master/protocol/openid-connect/auth?client_id=security-admin-console&redirect_uri=https%3A%2F%2Fmyserver.com%2Fauth%2Fadmin%2Fmaster%2Fconsole%2F&state=a69fd981-6daa-4cbd-a231-0907376a8338&response_mode=fragment&response_type=code&scope=openid&nonce=c8f30e79-f7a6-4cad-8ce3-c2aab81964e4

But this request ends in status 400 with the response "Invalid parameter: redirect_uri"
On a test environment without SSL it's actually working fine with an absolute uri using http. But here i cannot use http. The haproxy prevents it completely.
I tried changing the redirect_uri param to a relative one (redirect_uri=%2Fauth%2Fadmin%2Fmaster%2Fconsole%2F) but then keycloak responds with a non-SSL redirect to the base URL (http://myserver.com/auth/admin/master/console/)
which leaves my with an error in the browser because haproxy changes the call to https, but some content seems to be still embeded using http
---
Content Security Policy: The page?s settings blocked the loading of a resource at http://myserver.com/auth/realms/master/protocol/openid-connect/login-status-iframe.html?version=4.6.0.final (?frame-src?).
---

So it looks like i'm effectively locked out.

Based on my current situation i have three questions.
1. Why does keycloak respond with http redirects even though the issuing call (https://myserver.com/auth/realms/master/protocol/openid-connect/auth...) was using https and how can this be changed?
2. Given that the default redirect uri pattern for the security-admin-console is "/auth/admin/master/console/*", why is https://myserver.com/auth/admin/master/console not considered a valid redirect_uri but http://myserver.com/auth/admin/master/console is?
3. Does anybody know what to change now (via admin cli i guess) to get access to the UI?

Thanks for your help.

Kind regards,
Dominic
real,- Digital Services GmbH, Sitz: Duesseldorf

Amtsgericht Duesseldorf, HRB 75643

 

Geschaeftsfuehrer: Dr. Gerald Schoenbucher, Mehmet Toezge

 

Die in dieser E-Mail enthaltenen Nachrichten und Anhaenge sind ausschliesslich fuer den bezeichneten Adressaten bestimmt. Sie koennen rechtlich geschuetzte, vertrauliche Informationen enthalten. Falls Sie nicht der bezeichnete Empfaenger oder zum Empfang dieser E-Mail nicht berechtigt sind, ist die Verwendung, Vervielfaeltigung oder Weitergabe der Nachrichten und Anhaenge untersagt. Falls Sie diese E-Mail irrtuemlich erhalten haben, informieren Sie bitte unverzueglich den Absender und vernichten Sie die E-Mail.



From marco.scheuermann at daimler.com  Wed Nov 28 06:47:07 2018
From: marco.scheuermann at daimler.com (marco.scheuermann at daimler.com)
Date: Wed, 28 Nov 2018 11:47:07 +0000
Subject: [keycloak-user] Keycloak user sessions persistence
Message-ID: <3F517B20-9838-4EDB-8D43-D2B40A452989@daimler.com>

Hello Community,

after redeployment of keycloak we mentioned that all existing session are gone. Is there any way to persist the session, so that the also exist after server restart or redeployment?

Thank you,
Marco


If you are not the addressee, please inform us immediately that you have received this e-mail by mistake, and delete it. We thank you for your support.


From Rens.Verhage at topicus.nl  Wed Nov 28 09:02:19 2018
From: Rens.Verhage at topicus.nl (Rens Verhage)
Date: Wed, 28 Nov 2018 14:02:19 +0000
Subject: [keycloak-user] Auto refresh ADFS federation metadata.xml?
Message-ID: <1E52F058-A0BB-41DA-88C0-50C695D1447A@topicus.nl>

Hi all,

Can Keycloak automatically detect changes in metadata of SAML providers by polling the metadata URL? I?m asking because our clients regularly change their certificates and it would be nice not having to update them manually every time :)


Rens



From pcfleischer at outlook.com  Wed Nov 28 10:25:14 2018
From: pcfleischer at outlook.com (Phillip Fleischer)
Date: Wed, 28 Nov 2018 15:25:14 +0000
Subject: [keycloak-user] http connection/session timeout
In-Reply-To: <SN2PR0801MB22853502583434EBD107A746A6C40@SN2PR0801MB2285.namprd08.prod.outlook.com>
References: <SN2PR0801MB22853502583434EBD107A746A6C40@SN2PR0801MB2285.namprd08.prod.outlook.com>
Message-ID: <SN2PR0801MB2285DF50DDAC79C35EAA9CB7A6D10@SN2PR0801MB2285.namprd08.prod.outlook.com>

For what it?s worth this worked and brought our maximum duration down to 1 min rather than 30 minutes.

I?m not sure what?s running that long since the transaction timeout is lower than a minute but it helped improve our average response time.

> On Nov 7, 2018, at 10:12 AM, Phillip Fleischer <pcfleischer at outlook.com> wrote:
> 
> Hi,
> 
> We use new relic APM to monitor keycloak and seems that on occasion there will be transactions running for ~30min which seems to be exceptionally long.  We already lowered our database transaction timeouts, but thinking we should also add/change the wildly servlet timeout timeout from the default of 30 minutes.
> 
> 
> <servlet-container name="default" default-session-timeout="1">
>    <jsp-config/>
>    <websockets/>
> </servlet-container>
> 
> I can?t see this being related to any of the ?keycloak session? timeouts, just wondering if anyone would know if this is a terrible idea??
> 
> ? Phil
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://nam05.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.jboss.org%2Fmailman%2Flistinfo%2Fkeycloak-user&amp;data=02%7C01%7C%7C0f3ef93bc1ef43bee3e608d644c4bc2e%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636772009087404471&amp;sdata=uYp1kg1Qm%2FmDEokuBnZs7aGqHa1pHLfQ9qMoBtrJgvA%3D&amp;reserved=0



From ssilvert at redhat.com  Wed Nov 28 10:56:57 2018
From: ssilvert at redhat.com (Stan Silvert)
Date: Wed, 28 Nov 2018 10:56:57 -0500
Subject: [keycloak-user] Issues when modifying account.ftl
In-Reply-To: <CACz=5kk08r3XYGACgKaq3oOx8mi8N_h1CR1F7o8m0PR67pBqLA@mail.gmail.com>
References: <CACz=5kk08r3XYGACgKaq3oOx8mi8N_h1CR1F7o8m0PR67pBqLA@mail.gmail.com>
Message-ID: <1d1928ff-9676-6d48-7973-968834900bb5@redhat.com>

I'm not sure how the ?html got in there.? Was it included in the 
documentation?? If so, the doc needs to be changed.

To properly sanitize html in Keycloak you should use ?no_esc with 
kcSanitize.? Here is an example from account.ftl:

<a 
href="${url.referrerURI}">${kcSanitize(msg("backToApplication")?no_esc)}</a>


On 11/28/2018 4:32 AM, So Be wrote:
> Hi,
>
> I added some attributes to registration page by following this link
> https://www.keycloak.org/docs/latest/server_development/index.html#modifying-extending-the-registration-form
>
> but I got this error:
>
> Caused by: freemarker.core.ParseException: Syntax error in template
> "account.ftl" in line 54, column 171:
> 11/28/2018 10:22:28 AMUsing ?html (legacy escaping) is not allowed when
> auto-escaping is on with a markup output format (HTML), to avoid
> double-escaping mistakes.
> 11/28/2018 10:22:28 AM at
> freemarker.core.FMParser.BuiltIn(FMParser.java:1188)
>
> ....
>
> Best,
>
> Sofiane.
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user



From anpasq.keycloak at gmail.com  Thu Nov 29 03:34:00 2018
From: anpasq.keycloak at gmail.com (Andrea Pasqualini)
Date: Thu, 29 Nov 2018 09:34:00 +0100
Subject: [keycloak-user] Feature request : Support having large number of
 clients (KEYCLOAK-8275)
Message-ID: <1f47e529-93cf-6385-d05a-62011265e725@gmail.com>

Actually keycloak lacks support for large number of clients (over 10K)

Keycloak? Version 3.4.6 keeps all clients in memory and reloads them all 
(one by one) each time
a client is added or deleted, this behavior causes performance and 
deadlock issues (https://issues.jboss.org/browse/KEYCLOAK-3210).

In the following use cases :
.Mobile application instances dynamically registering themselves to get 
installation-specific credentials
.Clients registering with the OAuth server from a developer portal or 
API management system
Support for large number of clients is not an option

If you? are interested vote for this feature here
https://issues.jboss.org/browse/KEYCLOAK-8275


Regards
Andrea Pasqualini


From dhara.basida at azilen.com  Thu Nov 29 04:20:47 2018
From: dhara.basida at azilen.com (Dhara Basida)
Date: Thu, 29 Nov 2018 14:50:47 +0530
Subject: [keycloak-user] Issue in client admin- management
Message-ID: <44595dec-3f0f-7845-84ab-f6c5d177c3a3@azilen.com>

Hey,

I have created realm admin through which I created client and assigned 
client admin to one user.Now I logged in the system through that client 
admin but I am unable to manage that client.

I had referred the below link for managing this client admin,

https://www.keycloak.org/docs/latest/server_admin/index.html#_admin_permissions

As seen in the snap shot, when I click on any horizontal tab,I am 
getting a page with message Forbidden.

Please provide the steps through which I can manage the roles and 
permission for users? through client admin login.


Thanks and Regards,

Dhara Basida

-------------- next part --------------
A non-text attachment was scrubbed...
Name: keycloak-client-role.png
Type: image/png
Size: 116026 bytes
Desc: not available
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20181129/6479a3cb/attachment-0001.png 

From me at mpouss.in  Thu Nov 29 06:03:52 2018
From: me at mpouss.in (Mathieu Poussin)
Date: Thu, 29 Nov 2018 12:03:52 +0100
Subject: [keycloak-user] Internet facing Keycloak, security best practices ?
Message-ID: <1675f23ad0f.cb0392109589.2758734676603635492@mpouss.in>

Hello.

Is there any king of best practices on how to deploy and secure an internet facing Keycloak instance ?

So far I've been doing some filtering on my reverse proxy :

- Limit /auth/admin to trusted IP
- Block = /auth (The default auth page)

But I suppose there are maby other things that can be done ?
I could not find any official documentation.

Thanks.



From callum at well.ox.ac.uk  Thu Nov 29 07:57:24 2018
From: callum at well.ox.ac.uk (Callum Smith)
Date: Thu, 29 Nov 2018 12:57:24 +0000
Subject: [keycloak-user] krbLastPwdChange - can we use this attribute
In-Reply-To: <1542655849.15835.7.camel@acutus.pro>
References: <76219A0B-5737-47FC-9B90-8D805B4BA0F8@well.ox.ac.uk>
	<21B3C608-679D-4F3F-8587-769C3BFDC4B2@well.ox.ac.uk>
	<1542655849.15835.7.camel@acutus.pro>
Message-ID: <4AEB555E-249E-49B0-B63D-92D12ACD3B80@well.ox.ac.uk>

Dear Dmitry,

Using the same method might it be possible to integrate the FreeIPA record of a user's OTP setup and sync that into Keycloak as well? Whilst it's possible to integrate OTP using LDAP or SSSD, neither of these are ideal, as the workflow is wrong to allow federated identity:

If a user authenticates via external provider, OTP challenge should still be required. If the OTP is configured in Keycloak, this is done as a second authentication step which is perfect. If you are using LDAP/SSSD to do your OTP integration, the login step is bypassed with a federated account, and therefore the OTP step-up authentication is not performed.

Additionally, it would be nice to expose as a SAML attribute whether the authentication was done with 2FA or not, which again is not possible unless Keycloak is the one handling the 2FA.

So, in conclusion, could i sync OTP token data via the same LDAP connector or should I be looking to sync these externally? Another issue that I foresee - if the user is required to use OTP by the identity provider, then they are likely to need to enter the OTP at both the login AND the OTP step in Keycloak if this sync goes ahead, unless they use a federated identity. Which means that OTP has to be optional for the service by which Keycloak connects to IPA (LDAP) - even for users who we force OTP use.

Regards,
Callum

--

Callum Smith
Research Computing Core
Wellcome Trust Centre for Human Genetics
University of Oxford
e. callum at well.ox.ac.uk<mailto:callum at well.ox.ac.uk>

On 19 Nov 2018, at 19:30, Dmitry Telegin <dt at acutus.pro<mailto:dt at acutus.pro>> wrote:

Hello Callum,

If you want a 100% pure Keycloak solution, you can implement your own mapper by extending this one:
https://github.com/keycloak/keycloak/blob/master/federation/ldap/src/main/java/org/keycloak/storage/ldap/mappers/msad/MSADUserAccountControlStorageMapper.java

and modifying it so that it uses krbLastPwdChange instead of pwdLastSet (LDAPConstants.PWD_LAST_SET).

Then deploy it as a provider and use on your LDAP definition instead of the built-in "msad-user-account-control-mapper".

Feel free to ask questions on provider development. Good luck,
Dmitry Telegin
CTO, Acutus s.r.o.
Keycloak Consulting and Training

Pod lipami street 339/52, 130 00 Prague 3, Czech Republic
+42 (022) 888-30-71<tel:(022)%20888-30-71>
E-mail: info at acutus.pro<mailto:info at acutus.pro>

On Fri, 2018-11-16 at 16:27 +0000, Callum Smith wrote:
Dear All,

I've implemented this as a python script for now, hopefully this is useful to some, and hopefully something similar could be implemented for LDAP (although I imagine politically since SSSD cannot provide this data, and that's the preferred connection route for FreeIPA, it's not going to happen soon).

requirements: ldap3, python-keycloak


import python_freeipa
import json
import ldap3
from keycloak import KeycloakAdmin
from datetime import datetime

options['ipa_host']              = ''
options['ipa_admin_user']        = ''
options['ipa_base_dn']           = ''
options['ipa_admin_dn']          = ','+options['ipa_base_dn']
options['keycloak_host']         = ''
options['keycloak_admin_user']   = ''
options['keycloak_storage_id']   = ''

# Begin Keycloak Clietn
keycloakClient = KeycloakAdmin(server_url='https://'+options['keycloak_host']+'/auth/', username=options['keycloak_admin_user'], password=keycloakAdminPassword, realm_name='master<https://'+options['keycloak_host']+'/auth/',%20username=options['keycloak_admin_user'],%20password=keycloakAdminPassword,%20realm_name='master><https://'+options['keycloak_host']+'/auth/',%20username=options['keycloak_admin_user'],%20password=keycloakAdminPassword,%20realm_name='master<https://'+options['keycloak_host']+'/auth/',%20username=options['keycloak_admin_user'],%20password=keycloakAdminPassword,%20realm_name='master>>', verify=False)

# Begin LDAP client
ldapServer = ldap3.Server(options['ipa_host'])
ldapClient = ldap3.Connection(ldapServer, user=options['ipa_admin_dn'], password=ipaAdminPassword, auto_bind=True)

# Generate datestamp
date = datetime.utcnow().strftime('%Y%m%d%H%M%S')+'Z'

# Perform an LDAP sync for Keycloak
keycloakClient.sync_users(storage_id=options['keycloak_storage_id'], action="triggerFullSync")

# Search LDAP for expired passwords
ldapClient.search('cn=users,cn=accounts,'+options['ipa_base_dn'], '(|(krbPasswordExpiration<='+date+')(!(krbPasswordExpiration=*)))', attributes=['uid','cn','krbLastPwdChange','krbPasswordExpiration','dn'])
resetPasswordUsers = ldapClient.entries

for user in resetPasswordUsers:
  user_id = keycloakClient.get_user_id(user.uid)
  keycloakClient.update_user(user_id=user_id, payload={"requiredActions":['UPDATE_PASSWORD']})


# Search LDAP for valid passwords
ldapClient.search('cn=users,cn=accounts,'+options['ipa_base_dn'], '(krbPasswordExpiration>='+date+')', attributes=['uid','cn','krbLastPwdChange','krbPasswordExpiration','dn'])
validPasswordUsers = ldapClient.entries

for user in validPasswordUsers:
  user_id = keycloakClient.get_user_id(user.uid)
  keycloakClient.update_user(user_id=user_id, payload={"requiredActions":[]})




I've chopped some domain specific stuff from this so it might not be flawless, but hopefully a start for someone. Also no error checking involved here.

Regards,
Callum

--

Callum Smith
Research Computing Core
Wellcome Trust Centre for Human Genetics
University of Oxford
e. callum at well.ox.ac.uk<mailto:callum at well.ox.ac.uk><mailto:callum at well.ox.ac.uk>

On 16 Nov 2018, at 09:16, Callum Smith <callum at well.ox.ac.uk<mailto:callum at well.ox.ac.uk><mailto:callum at well.ox.ac.uk>> wrote:

Dear Keycloakers,

I was wondering, if Keycloak can accept the pwdLastSet from MSAD, why can it not use krbLastPwdChange from FreeIPA to allow for better integration of password resets? Surely this is possible and potentially even trivial to implement?

Regards,
Callum

--

Callum Smith
Research Computing Core
Wellcome Trust Centre for Human Genetics
University of Oxford
e. callum at well.ox.ac.uk<mailto:callum at well.ox.ac.uk><mailto:callum at well.ox.ac.uk><mailto:callum at well.ox.ac.uk>

_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org><mailto:keycloak-user at lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user

_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user


From max.allan+keycloak at surevine.com  Thu Nov 29 09:32:21 2018
From: max.allan+keycloak at surevine.com (Max Allan)
Date: Thu, 29 Nov 2018 14:32:21 +0000
Subject: [keycloak-user] (no subject)
Message-ID: <CADNp1BZXmWugg19gCYEOygzmdZ9O0obtw128Lb1szrDF85=+Zw@mail.gmail.com>

Hi,

I just installed 4.6.0-Final and started to configure a new site. I cannot
see the "Script" authentication execution type in the drop down menu.
I compared it with 4.5 and can see where it should be.

They're still in the documentation :
https://www.keycloak.org/docs/latest/server_admin/index.html#executions

Is there some new/different config required to make them work now?
I read the upgrade notes, even thought this is a new deployment. I found
some references to JavaScipt. Not a language I have heard of before.
https://www.keycloak.org/docs/latest/upgrading/index.html#javascipt-adapter-promise
I wonder if it is similar to JavaScript..

But no mention of script authentication executions.

Any ideas?

Thanks,
Max

From tim.hedlund at outlook.com  Thu Nov 29 10:02:27 2018
From: tim.hedlund at outlook.com (Tim Hedlund)
Date: Thu, 29 Nov 2018 15:02:27 +0000
Subject: [keycloak-user] Access to security-admin-console via SSL
	is	prohibited?
In-Reply-To: <FF0BCE66D952254B942F978A64B2873D01A74BC7@FFM30MBXC03N.comm.madm.net>
References: <FF0BCE66D952254B942F978A64B2873D01A74BC7@FFM30MBXC03N.comm.madm.net>
Message-ID: <SN4PR0801MB3821A25A3BCBFE7E628B9B32F8D20@SN4PR0801MB3821.namprd08.prod.outlook.com>

Dominic,

Did you try to add your response uri, i.e: "https://myserver.com/auth/admin/master/console/*" to the "Valid Redirect URIs" in the security-admin-console client?

Regards
Tim

-----Original Message-----
From: keycloak-user-bounces at lists.jboss.org [mailto:keycloak-user-bounces at lists.jboss.org] On Behalf Of dominic.michel01 at realdigital.de
Sent: den 28 november 2018 12:02
To: keycloak-user at lists.jboss.org
Subject: [keycloak-user] Access to security-admin-console via SSL is prohibited?


Hi.

I've just deployed a keycloak which is only reachable via a haproxy that enforces SSL.
Now i'm trying to log into the security-admin-console via https://myserver.com/auth/admin/ which is redirecting me to https://mysever.com/auth/realms/master/protocol/openid-connect/auth?client_id=security-admin-console&redirect_uri=https%3A%2F%2Fmyserver.com%2Fauth%2Fadmin%2Fmaster%2Fconsole%2F&state=a69fd981-6daa-4cbd-a231-0907376a8338&response_mode=fragment&response_type=code&scope=openid&nonce=c8f30e79-f7a6-4cad-8ce3-c2aab81964e4

But this request ends in status 400 with the response "Invalid parameter: redirect_uri"
On a test environment without SSL it's actually working fine with an absolute uri using http. But here i cannot use http. The haproxy prevents it completely.
I tried changing the redirect_uri param to a relative one (redirect_uri=%2Fauth%2Fadmin%2Fmaster%2Fconsole%2F) but then keycloak responds with a non-SSL redirect to the base URL (http://myserver.com/auth/admin/master/console/)
which leaves my with an error in the browser because haproxy changes the call to https, but some content seems to be still embeded using http
---
Content Security Policy: The page's settings blocked the loading of a resource at http://myserver.com/auth/realms/master/protocol/openid-connect/login-status-iframe.html?version=4.6.0.final ("frame-src").
---

So it looks like i'm effectively locked out.

Based on my current situation i have three questions.
1. Why does keycloak respond with http redirects even though the issuing call (https://myserver.com/auth/realms/master/protocol/openid-connect/auth...) was using https and how can this be changed?
2. Given that the default redirect uri pattern for the security-admin-console is "/auth/admin/master/console/*", why is https://myserver.com/auth/admin/master/console not considered a valid redirect_uri but http://myserver.com/auth/admin/master/console is?
3. Does anybody know what to change now (via admin cli i guess) to get access to the UI?

Thanks for your help.

Kind regards,
Dominic
real,- Digital Services GmbH, Sitz: Duesseldorf

Amtsgericht Duesseldorf, HRB 75643

 

Geschaeftsfuehrer: Dr. Gerald Schoenbucher, Mehmet Toezge

 

Die in dieser E-Mail enthaltenen Nachrichten und Anhaenge sind ausschliesslich fuer den bezeichneten Adressaten bestimmt. Sie koennen rechtlich geschuetzte, vertrauliche Informationen enthalten. Falls Sie nicht der bezeichnete Empfaenger oder zum Empfang dieser E-Mail nicht berechtigt sind, ist die Verwendung, Vervielfaeltigung oder Weitergabe der Nachrichten und Anhaenge untersagt. Falls Sie diese E-Mail irrtuemlich erhalten haben, informieren Sie bitte unverzueglich den Absender und vernichten Sie die E-Mail.


_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user


From geoff at opticks.io  Thu Nov 29 10:11:15 2018
From: geoff at opticks.io (Geoffrey Cleaves)
Date: Thu, 29 Nov 2018 16:11:15 +0100
Subject: [keycloak-user] (no subject)
In-Reply-To: <CADNp1BZXmWugg19gCYEOygzmdZ9O0obtw128Lb1szrDF85=+Zw@mail.gmail.com>
References: <CADNp1BZXmWugg19gCYEOygzmdZ9O0obtw128Lb1szrDF85=+Zw@mail.gmail.com>
Message-ID: <CAHzT=q9-Sfgc9zje3jBB=WtD2iZsWmrrPpaZB3yd07az2vebvw@mail.gmail.com>

I'm going to become the highest rated user in StackOverflow due to this.
Please see instructions (in the comments) at the link below. And while
you're at it, upvote my answer!

https://stackoverflow.com/questions/53367566/unable-to-setup-idp-token-exchange-in-keycloak-4-6-0-final



On Thu, 29 Nov 2018 at 15:36, Max Allan <max.allan+keycloak at surevine.com>
wrote:

> Hi,
>
> I just installed 4.6.0-Final and started to configure a new site. I cannot
> see the "Script" authentication execution type in the drop down menu.
> I compared it with 4.5 and can see where it should be.
>
> They're still in the documentation :
> https://www.keycloak.org/docs/latest/server_admin/index.html#executions
>
> Is there some new/different config required to make them work now?
> I read the upgrade notes, even thought this is a new deployment. I found
> some references to JavaScipt. Not a language I have heard of before.
>
> https://www.keycloak.org/docs/latest/upgrading/index.html#javascipt-adapter-promise
> I wonder if it is similar to JavaScript..
>
> But no mention of script authentication executions.
>
> Any ideas?
>
> Thanks,
> Max
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

From bruno at abstractj.org  Thu Nov 29 10:16:06 2018
From: bruno at abstractj.org (Bruno Oliveira)
Date: Thu, 29 Nov 2018 13:16:06 -0200
Subject: [keycloak-user] (no subject)
In-Reply-To: <CADNp1BZXmWugg19gCYEOygzmdZ9O0obtw128Lb1szrDF85=+Zw@mail.gmail.com>
References: <CADNp1BZXmWugg19gCYEOygzmdZ9O0obtw128Lb1szrDF85=+Zw@mail.gmail.com>
Message-ID: <CAM5SUC4OFkPGcKBt1ut4ZAYGM1S+2a2bGfvoUY1QOGgdD1aRPg@mail.gmail.com>

Hi Max, this was fixed here:
https://github.com/keycloak/keycloak-documentation/pull/527/files

On Thu, Nov 29, 2018, 12:32 PM Max Allan <max.allan+keycloak at surevine.com>
wrote:

> Hi,
>
> I just installed 4.6.0-Final and started to configure a new site. I cannot
> see the "Script" authentication execution type in the drop down menu.
> I compared it with 4.5 and can see where it should be.
>
> They're still in the documentation :
> https://www.keycloak.org/docs/latest/server_admin/index.html#executions
>
> Is there some new/different config required to make them work now?
> I read the upgrade notes, even thought this is a new deployment. I found
> some references to JavaScipt. Not a language I have heard of before.
>
> https://www.keycloak.org/docs/latest/upgrading/index.html#javascipt-adapter-promise
> I wonder if it is similar to JavaScript..
>
> But no mention of script authentication executions.
>
> Any ideas?
>
> Thanks,
> Max
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

From max.allan+keycloak at surevine.com  Thu Nov 29 12:10:52 2018
From: max.allan+keycloak at surevine.com (Max Allan)
Date: Thu, 29 Nov 2018 17:10:52 +0000
Subject: [keycloak-user] (no subject)
In-Reply-To: <CAM5SUC4OFkPGcKBt1ut4ZAYGM1S+2a2bGfvoUY1QOGgdD1aRPg@mail.gmail.com>
References: <CADNp1BZXmWugg19gCYEOygzmdZ9O0obtw128Lb1szrDF85=+Zw@mail.gmail.com>
	<CAM5SUC4OFkPGcKBt1ut4ZAYGM1S+2a2bGfvoUY1QOGgdD1aRPg@mail.gmail.com>
Message-ID: <CADNp1BaSBngh+DecKghGjT5_FUnD3CeaKtZSyxq7CG5ZY9Yqsw@mail.gmail.com>

As I start my keycloak with systemd, (following the wildfly setup
instructions). Rather than logging in and running standalone.sh all the
time, can you give more details about where to add this config to make it
permanent and upgrade resistant?

Would you recommend adding JAVA_OPTS to wildfly.conf?
JAVA_OPTS=-Dkeycloak.profile.feature.scripts=enabled
OR the documentation mentions a file called "profile.properties" without
giving any idea where it can be found. That sounds ideal, if only it was
clearer how to use it. Much cleaner than this -D on startup command line
mess that was created.

Also, I've added to KEYCLOAK-8872 that the other documentation needs fixing
:
https://www.keycloak.org/docs/latest/server_installation/index.html#profiles
States that "scripts" is called "script" and that it is enabled by default.
And the profile.properties file is mentioned without a location.


Max

From mwaki011 at gmail.com  Thu Nov 29 16:05:25 2018
From: mwaki011 at gmail.com (Mike Wakim)
Date: Thu, 29 Nov 2018 16:05:25 -0500
Subject: [keycloak-user] Default configuration of master realm
Message-ID: <CAJKiPVBXCC1YgD5W=bdorxmz=q2HMhSFarX+6fTYrd_y2Lv4KQ@mail.gmail.com>

Hello,

When the Keycloak server is started for the very first time, it
automatically creates a master realm with default configurations. Is it
possible to customize some of these default configurations during / prior
to the initial deployment?

For example, I want to change the master realm such that each time a
keycloak server gets deployed, the master realm by default has some
password policies (e.g. password expiry enabled).

I know that I can override the master realm with a JSON that has the
configurations that I need using
-Dkeycloak.migration.file=master-realm.json and
-Dkeycloak.migration.strategy=OVERWRITE_EXISTING, but I'd like to avoid the
overwrite and have the custom configurations applied upon the initial
creation of the master realm if possible.

Does anyone have any thoughts on this?

Thanks!

Mike

From bruno at abstractj.org  Thu Nov 29 17:37:23 2018
From: bruno at abstractj.org (Bruno Oliveira)
Date: Thu, 29 Nov 2018 20:37:23 -0200
Subject: [keycloak-user] permanent configuration for Keycloak
Message-ID: <20181129223723.GA20270@abstractj.org>

features
Reply-To: 
In-Reply-To: <CADNp1BaSBngh+DecKghGjT5_FUnD3CeaKtZSyxq7CG5ZY9Yqsw at mail.gmail.com>

Hi Max, if the documentation lacks of more information. Please, do not
hesitate to create a Jira mentioned which part is missing. That helps us
to improve the docs.

Indeed, the profile.properties file is the best place to put the
permanent configuration. For that, just create a file inside
$KEYCLOAK_SERVER/standalone/configuration called profile.properties,
with the following content:

feature.scripts=enabled

I created the following Jira to track this:
https://issues.jboss.org/browse/KEYCLOAK-8979

On 2018-11-29, Max Allan wrote:
> As I start my keycloak with systemd, (following the wildfly setup
> instructions). Rather than logging in and running standalone.sh all the
> time, can you give more details about where to add this config to make it
> permanent and upgrade resistant?
> 
> Would you recommend adding JAVA_OPTS to wildfly.conf?
> JAVA_OPTS=-Dkeycloak.profile.feature.scripts=enabled
> OR the documentation mentions a file called "profile.properties" without
> giving any idea where it can be found. That sounds ideal, if only it was
> clearer how to use it. Much cleaner than this -D on startup command line
> mess that was created.
> 
> Also, I've added to KEYCLOAK-8872 that the other documentation needs fixing
> :
> https://www.keycloak.org/docs/latest/server_installation/index.html#profiles
> States that "scripts" is called "script" and that it is enabled by default.
> And the profile.properties file is mentioned without a location.
> 
> 
> Max

-- 

abstractj

From andrew.murphy at confido.ie  Thu Nov 29 18:04:44 2018
From: andrew.murphy at confido.ie (Andrew Murphy)
Date: Thu, 29 Nov 2018 23:04:44 +0000
Subject: [keycloak-user] NotSerializableException:
	org.keycloak.adapters.elytron.ElytronAccount
In-Reply-To: <CAF0ec6+-bfe3xjWFkRD2JzypN_nmcooVxi5wDSETt=xLdbtJFw@mail.gmail.com>
References: <CAF0ec6+-bfe3xjWFkRD2JzypN_nmcooVxi5wDSETt=xLdbtJFw@mail.gmail.com>
Message-ID: <CAF0ec6KdYZy0nwjBD8xS7PiLS+Ay5HzOKGv2apDm98bEL+dwUg@mail.gmail.com>

 I have been pulling my hair out over this thinking something was amiss
with my configuration, but it turns out to be something unrelated. My
web.xml includes the <distributable/> attribute which I have subsequently
learnt contractually obligates you to ensure all session attributes are
serializable. The ElytronAccount object obviously isn't, which resulted in
the reported NotSerializableException in my webapp after successful
authentication.

I have since commented out <distributable/> in web.xml and all is working
flawlessly.

On Wed, 21 Nov 2018 at 21:40, Andrew Murphy <andrew.murphy at confido.ie>
wrote:

>
> I've installed the keycloak-wildfly-adapter-dist-4.6.0.Final.zip adapter
> in a clean version of WildFly Full 14.0.1.Final, running on Windows 8.1.
> The keycloak server is running on a separate port.
>
> When I configure the adapter subsystem (server not running) with the newer
> Elytron adapter using
>
> > cd bin
> > jboss-cli.bat --file=adapter-elytron-install-offline.cli -Dserver.config=standalone-full.xml
>
> and thereafter attempt to sign into a basic war application I get the
> keycloak login page, followed by an error page once credentials are posted.
> The server.log reports the following (abbreviated) error stacktrace
>
> 2018-11-21 20:17:37,654 ERROR [io.undertow.request] (default task-1)
> UT005023: Exception handling request to /curo-crm/:
> java.lang.IllegalArgumentException:
> org.infinispan.commons.marshall.NotSerializableException:
> org.keycloak.adapters.elytron.ElytronAccount
>     at
> org.wildfly.clustering.web.infinispan.session.coarse.CoarseSessionAttributes.setAttribute(CoarseSessionAttributes.java:71)
> [snip]
> Caused by: org.infinispan.commons.marshall.NotSerializableException:
> org.keycloak.adapters.elytron.ElytronAccount
>
> Now, if I configure the adapter subsystem with the legacy non-Elytron
> adapter on WildFly using
>
> > cd bin
> > jboss-cli.bat --file=adapter-install-offline.cli -Dserver.config=standalone-full.xml
>
> everything works without errors i.e. I can access the protected web app on
> login success.
>
> Question 1: Have I missed something in the server configuration that is
> causing the NotSerializableException?
> Question 2: The keycloak config documentation recommends the use of the
> newer Elytron adapter over the legacy non-Elytron adapter, but gives no
> reasoning. Are there drawbacks to using the legacy version?
>
> Thanks
>
>

-- 
Andrew Murphy
Mobile: +353 (0)8 3802 2469

From kkcmadhu at yahoo.com  Fri Nov 30 00:06:27 2018
From: kkcmadhu at yahoo.com (Madhu)
Date: Fri, 30 Nov 2018 05:06:27 +0000 (UTC)
Subject: [keycloak-user] back channel logout in case of keycloak adapter
 sitting behind reverse proxy.
References: <1013200587.132577.1543554387416.ref@mail.yahoo.com>
Message-ID: <1013200587.132577.1543554387416@mail.yahoo.com>

Hi,
I am exploring on how to implement back channel logouts/ sso logout properly and have a question in this regard.
I have a set of applications (say App1, App2, App3) which are integreated with keycloak through servelet adapter (keycloak-servlet-adapters and keycloak-spring-boot2-adapters)..? Each of this application for HA/scalablity resons sit behind their own reverse proxies..
So typically there will be multiple instance of each application App1-Node1, App1-Node2.. App1-Node'n' , like wise App2-Node1,App2-Node2,App2-Node'n'.. and so on for each of the Apps.

When a user u1,logs on to App1 and App2? an SSO session is establised in keycloak, and in the user sessions i see that user has connected to clients App1 and App2 ( app1 and app2 are clients in keycloak realm)..
When user logged on App1-Node1 took the request, and for App2, App2-Node2 took the request..

On the keycloak side, the admin urls are configured with the Reverse proxy url of the? each Apps ( same as the valid rediect and base url).
?When a SSO logout happens, how can i ensure that the keycloak server sends the SSO logout signal (k_logout) to the correct node? Will keycloak preserve the headers which came at the time of orignial login request and use them? while sending admin requests as well ?? ( so that the reverse proxy could dispatch the request to correct node, assuming that the application is configured to be sticky)..
Regards,Madhu


From hmlnarik at redhat.com  Fri Nov 30 02:01:40 2018
From: hmlnarik at redhat.com (Hynek Mlnarik)
Date: Fri, 30 Nov 2018 08:01:40 +0100
Subject: [keycloak-user] NotSerializableException:
	org.keycloak.adapters.elytron.ElytronAccount
In-Reply-To: <CAF0ec6KdYZy0nwjBD8xS7PiLS+Ay5HzOKGv2apDm98bEL+dwUg@mail.gmail.com>
References: <CAF0ec6+-bfe3xjWFkRD2JzypN_nmcooVxi5wDSETt=xLdbtJFw@mail.gmail.com>
	<CAF0ec6KdYZy0nwjBD8xS7PiLS+Ay5HzOKGv2apDm98bEL+dwUg@mail.gmail.com>
Message-ID: <CAMvXD=Fa1LsEN=uDPy=ncu32S7FVXb1UY7q6QfSd0BuS=XskMw@mail.gmail.com>

Thanks for the details. Created
https://issues.jboss.org/browse/KEYCLOAK-8980 for this issue.

On Fri, Nov 30, 2018 at 12:10 AM Andrew Murphy <andrew.murphy at confido.ie>
wrote:

>  I have been pulling my hair out over this thinking something was amiss
> with my configuration, but it turns out to be something unrelated. My
> web.xml includes the <distributable/> attribute which I have subsequently
> learnt contractually obligates you to ensure all session attributes are
> serializable. The ElytronAccount object obviously isn't, which resulted in
> the reported NotSerializableException in my webapp after successful
> authentication.
>
> I have since commented out <distributable/> in web.xml and all is working
> flawlessly.
>
> On Wed, 21 Nov 2018 at 21:40, Andrew Murphy <andrew.murphy at confido.ie>
> wrote:
>
> >
> > I've installed the keycloak-wildfly-adapter-dist-4.6.0.Final.zip adapter
> > in a clean version of WildFly Full 14.0.1.Final, running on Windows 8.1.
> > The keycloak server is running on a separate port.
> >
> > When I configure the adapter subsystem (server not running) with the
> newer
> > Elytron adapter using
> >
> > > cd bin
> > > jboss-cli.bat --file=adapter-elytron-install-offline.cli
> -Dserver.config=standalone-full.xml
> >
> > and thereafter attempt to sign into a basic war application I get the
> > keycloak login page, followed by an error page once credentials are
> posted.
> > The server.log reports the following (abbreviated) error stacktrace
> >
> > 2018-11-21 20:17:37,654 ERROR [io.undertow.request] (default task-1)
> > UT005023: Exception handling request to /curo-crm/:
> > java.lang.IllegalArgumentException:
> > org.infinispan.commons.marshall.NotSerializableException:
> > org.keycloak.adapters.elytron.ElytronAccount
> >     at
> >
> org.wildfly.clustering.web.infinispan.session.coarse.CoarseSessionAttributes.setAttribute(CoarseSessionAttributes.java:71)
> > [snip]
> > Caused by: org.infinispan.commons.marshall.NotSerializableException:
> > org.keycloak.adapters.elytron.ElytronAccount
> >
> > Now, if I configure the adapter subsystem with the legacy non-Elytron
> > adapter on WildFly using
> >
> > > cd bin
> > > jboss-cli.bat --file=adapter-install-offline.cli
> -Dserver.config=standalone-full.xml
> >
> > everything works without errors i.e. I can access the protected web app
> on
> > login success.
> >
> > Question 1: Have I missed something in the server configuration that is
> > causing the NotSerializableException?
> > Question 2: The keycloak config documentation recommends the use of the
> > newer Elytron adapter over the legacy non-Elytron adapter, but gives no
> > reasoning. Are there drawbacks to using the legacy version?
> >
> > Thanks
> >
> >
>
> --
> Andrew Murphy
> Mobile: +353 (0)8 3802 2469
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

From dominic.michel01 at realdigital.de  Fri Nov 30 02:27:51 2018
From: dominic.michel01 at realdigital.de (dominic.michel01 at realdigital.de)
Date: Fri, 30 Nov 2018 07:27:51 +0000
Subject: [keycloak-user] Access to security-admin-console via SSL
	is	prohibited?
In-Reply-To: <SN4PR0801MB3821A25A3BCBFE7E628B9B32F8D20@SN4PR0801MB3821.namprd08.prod.outlook.com>
References: <FF0BCE66D952254B942F978A64B2873D01A74BC7@FFM30MBXC03N.comm.madm.net>,
	<SN4PR0801MB3821A25A3BCBFE7E628B9B32F8D20@SN4PR0801MB3821.namprd08.prod.outlook.com>
Message-ID: <FF0BCE66D952254B942F978A64B2873D01A752E4@FFM30MBXC03N.comm.madm.net>

Hi.

Yes, i've added the https uri as well. Unfortunately, when accessing the login mask via https, the action of the login form is still using http. So i'm able to login but only see a blank page because the page content is blocked by the browser with this message:

Mixed Content: The page at 'https://myserver.com/auth/admin/master/console/' was loaded over HTTPS, but requested an insecure XMLHttpRequest endpoint 'http://myserver.com/auth/realms/master/protocol/openid-connect/token'. This request has been blocked; the content must be served over HTTPS.


According to https://www.keycloak.org/docs/4.6/server_admin/#_ssl_modes i figured it would be enough to configure SSL on the reverse proxy only, but now i wonder if it really is and how to convince keycloak to use https for all its form actions, XHRs etc.

Kind regards,
Dominic

________________________________________
From: Tim Hedlund [tim.hedlund at outlook.com]
Sent: Thursday, November 29, 2018 4:02 PM
To: Michel, Dominic; keycloak-user at lists.jboss.org
Subject: RE: [keycloak-user] Access to security-admin-console via SSL is        prohibited?

Dominic,

Did you try to add your response uri, i.e: "https://myserver.com/auth/admin/master/console/*" to the "Valid Redirect URIs" in the security-admin-console client?

Regards
Tim

-----Original Message-----
From: keycloak-user-bounces at lists.jboss.org [mailto:keycloak-user-bounces at lists.jboss.org] On Behalf Of dominic.michel01 at realdigital.de
Sent: den 28 november 2018 12:02
To: keycloak-user at lists.jboss.org
Subject: [keycloak-user] Access to security-admin-console via SSL is prohibited?


Hi.

I've just deployed a keycloak which is only reachable via a haproxy that enforces SSL.
Now i'm trying to log into the security-admin-console via https://myserver.com/auth/admin/ which is redirecting me to https://mysever.com/auth/realms/master/protocol/openid-connect/auth?client_id=security-admin-console&redirect_uri=https%3A%2F%2Fmyserver.com%2Fauth%2Fadmin%2Fmaster%2Fconsole%2F&state=a69fd981-6daa-4cbd-a231-0907376a8338&response_mode=fragment&response_type=code&scope=openid&nonce=c8f30e79-f7a6-4cad-8ce3-c2aab81964e4

But this request ends in status 400 with the response "Invalid parameter: redirect_uri"
On a test environment without SSL it's actually working fine with an absolute uri using http. But here i cannot use http. The haproxy prevents it completely.
I tried changing the redirect_uri param to a relative one (redirect_uri=%2Fauth%2Fadmin%2Fmaster%2Fconsole%2F) but then keycloak responds with a non-SSL redirect to the base URL (http://myserver.com/auth/admin/master/console/)
which leaves my with an error in the browser because haproxy changes the call to https, but some content seems to be still embeded using http
---
Content Security Policy: The page's settings blocked the loading of a resource at http://myserver.com/auth/realms/master/protocol/openid-connect/login-status-iframe.html?version=4.6.0.final ("frame-src").
---

So it looks like i'm effectively locked out.

Based on my current situation i have three questions.
1. Why does keycloak respond with http redirects even though the issuing call (https://myserver.com/auth/realms/master/protocol/openid-connect/auth...) was using https and how can this be changed?
2. Given that the default redirect uri pattern for the security-admin-console is "/auth/admin/master/console/*", why is https://myserver.com/auth/admin/master/console not considered a valid redirect_uri but http://myserver.com/auth/admin/master/console is?
3. Does anybody know what to change now (via admin cli i guess) to get access to the UI?

Thanks for your help.

Kind regards,
Dominic
real,- Digital Services GmbH, Sitz: Duesseldorf

Amtsgericht Duesseldorf, HRB 75643



Geschaeftsfuehrer: Dr. Gerald Schoenbucher, Mehmet Toezge



Die in dieser E-Mail enthaltenen Nachrichten und Anhaenge sind ausschliesslich fuer den bezeichneten Adressaten bestimmt. Sie koennen rechtlich geschuetzte, vertrauliche Informationen enthalten. Falls Sie nicht der bezeichnete Empfaenger oder zum Empfang dieser E-Mail nicht berechtigt sind, ist die Verwendung, Vervielfaeltigung oder Weitergabe der Nachrichten und Anhaenge untersagt. Falls Sie diese E-Mail irrtuemlich erhalten haben, informieren Sie bitte unverzueglich den Absender und vernichten Sie die E-Mail.


_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
real,- Digital Services GmbH, Sitz: Duesseldorf

Amtsgericht Duesseldorf, HRB 75643

 

Geschaeftsfuehrer: Dr. Gerald Schoenbucher, Mehmet Toezge

 

Die in dieser E-Mail enthaltenen Nachrichten und Anhaenge sind ausschliesslich fuer den bezeichneten Adressaten bestimmt. Sie koennen rechtlich geschuetzte, vertrauliche Informationen enthalten. Falls Sie nicht der bezeichnete Empfaenger oder zum Empfang dieser E-Mail nicht berechtigt sind, ist die Verwendung, Vervielfaeltigung oder Weitergabe der Nachrichten und Anhaenge untersagt. Falls Sie diese E-Mail irrtuemlich erhalten haben, informieren Sie bitte unverzueglich den Absender und vernichten Sie die E-Mail.



From manuel.waltschek at prisma-solutions.at  Fri Nov 30 05:09:19 2018
From: manuel.waltschek at prisma-solutions.at (Manuel Waltschek)
Date: Fri, 30 Nov 2018 10:09:19 +0000
Subject: [keycloak-user] WG: Using keycloak for SAML integration. confused
 by documentation. login loop
In-Reply-To: <0d14defddc104596890ef19ff306e2a8@EXMBX24.SFP-Net.skyfillers.local>
References: <0d14defddc104596890ef19ff306e2a8@EXMBX24.SFP-Net.skyfillers.local>
Message-ID: <fc63d6f642f049e1bc43a87afe733122@EXMBX24.SFP-Net.skyfillers.local>

Hello,

I am resending this, since I needed to confirm my subscription to this mailing list first and I got the "not allowed" message when I sent it fort he first time.

Regards,

Manuel Waltschek

Von: Manuel Waltschek
Gesendet: Donnerstag, 29. November 2018 18:27
An: 'keycloak-user at lists.jboss.org' <keycloak-user at lists.jboss.org>
Betreff: Using keycloak for SAML integration. confused by documentation. login loop

Hello there,

I'm sorry to bother you since this might have been asked quite a lot, but I am not able to configure my application as a SAML service provider to authenticate against an external IdP like https://samltest.id/saml/idp . I tried to use keycloak server as an identity broker but ran into different issues. I tried to follow instructions of this documentation: https://www.keycloak.org/docs/latest/securing_apps/index.html

If you want details on my configuration you can check out https://stackoverflow.com/questions/53487692/keycloak-saml-as-identity-broker-wiht-samltest-as-an-external-idp-misconfigurat but some aspects might have changed, since I tried an alternative.

Alternatively I tried to configure the Wildfly 10 system/application to use the external IdP directly, which kind of works. At least I am able to authenticate at the IdPs Website when I try to access a protected resource of my application, but when I get redirected to application-name/saml (which is my defined endpoint since it is described like this in the documentation. I do not understand how this should even work) I do not know how to access the assertion / the SAMLprincipal at this stage and if I register a ServletFilter in web.xml with an URL-pattern of /saml/* or /saml it won't trigger.

Also I do not know if this is even how it should work out, since I don't get how the keycloak server even fits into the equation, since it is not called or anything when SP communicates automatically with the external IdP. Also why does the KeycloakLoginModule never get called? What is it for? And how does the assertion actually get processed? I cannot find any reference on these topics.

I am getting really frustrated about this since the documentation is unclear (for me) about SAML and the use case I described and there are really no answers on public websites. I will be really happy if anyone could help me solve this issue. Do not hesitate to ask for more information/details.

Thank you in advance,

[relaunch]<https://www.prisma-solutions.com/>

Unsere Website erstrahlt im neuen Glanz und ganz im Corporate und selbstverst?ndlich Responsive Design.
Wenn Sie wissen wollen, wie wir Verkehrsmanagement digital unterst?tzen, wie St?dte eine vielf?ltige Fahrradkultur etablieren k?nnen, wo automatisierte Kleinbusse uns in Zukunft hinbringen werden oder wie die Lebenszykluskosten von Stra?eninfrastruktur evaluiert und optimiert werden, dann schauen Sie doch auf https://www.prisma-solutions.com vorbei!


[Logo]

Manuel Waltschek BSc.

+43 660 86655 47<tel:+436608665547>
manuel.waltschek at prisma-solutions.at<mailto:manuel.waltschek at prisma-solutions.at>
https://www.prisma-solutions.com

PRISMA solutions EDV-Dienstleistungen GmbH
Klostergasse 18, 2340 M?dling, Austria
Firmenbuch: FN 239449 g, Landesgericht Wiener Neustadt
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.png
Type: image/png
Size: 44259 bytes
Desc: image001.png
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20181130/0decd3b2/attachment-0002.png 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image002.png
Type: image/png
Size: 6418 bytes
Desc: image002.png
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20181130/0decd3b2/attachment-0003.png 

From fj.crujeiras at hocelot.com  Fri Nov 30 05:15:34 2018
From: fj.crujeiras at hocelot.com (Francisco Javier Crujeiras)
Date: Fri, 30 Nov 2018 11:15:34 +0100
Subject: [keycloak-user] Customize OpenID/OAuth token
Message-ID: <CAMte10hjFMszrZavfVX+yFXTEjonCR=WySi2QYcCiWis7c2vBw@mail.gmail.com>

Hi,

We're thinking on using Keycloak as our main IDP and SSO solution. At this
time, we're using a "custom" IDP server based on Spring and we are
investigating if we can migrate our client database to Keycloak without
disturbing our users.

So, we have seen that, by default, Keycloak answers a token request with a
complete JWT token, like this one:
{
"access_token":
"eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJEWk4wX1liZUZGNFZMUVdxQ2NWMGFWd0VFbXBlUGlnX1NFaWk3dkozSGRvIn0.eyJqdGkiOiI5YTc4MTY5NC04MGUwLTQ2OTEtOGY3Yi00MzQ5MzA3ZTBkYWIiLCJleHAiOjE1NDM1NzMxMDgsIm5iZiI6MCwiaWF0IjoxNTQzNTcyODA4LCJpc3MiOiJodHRwOi8vMTcyLjE4LjAuMzo4MDgwL2F1dGgvcmVhbG1zL3Rlc3QtcmVhbG0iLCJhdWQiOlsiaHR0K3EySUdZQkFHOHBkTDF4bHF4M0xxa1dtciIsImFjY291bnQiXSwic3ViIjoiYzgxNzYzNjgtMGI5NS00MWFmLTgzZDUtZTk4N2Y0ZWVlYTg3IiwidHlwIjoiQmVhcmVyIiwiYXpwIjoiaHR0K3EySUdZQkFHOHBkTDF4bHF4M0xxa1dtciIsImF1dGhfdGltZSI6MCwic2Vzc2lvbl9zdGF0ZSI6IjcyZWNiNzk4LWRiNTgtNDE2MS04ZTA5LTRhYWVkYjJlYWI4ZiIsImFjciI6IjEiLCJyZWFsbV9hY2Nlc3MiOnsicm9sZXMiOlsib2ZmbGluZV9hY2Nlc3MiLCJ1bWFfYXV0aG9yaXphdGlvbiJdfSwicmVzb3VyY2VfYWNjZXNzIjp7Imh0dCtxMklHWUJBRzhwZEwxeGxxeDNMcWtXbXIiOnsicm9sZXMiOlsidW1hX3Byb3RlY3Rpb24iXX0sImFjY291bnQiOnsicm9sZXMiOlsibWFuYWdlLWFjY291bnQiLCJtYW5hZ2UtYWNjb3VudC1saW5rcyIsInZpZXctcHJvZmlsZSJdfX0sInNjb3BlIjoicHJvZmlsZSBlbWFpbCIsImVtYWlsX3ZlcmlmaWVkIjpmYWxzZSwiY2xpZW50SG9zdCI6IjE3Mi4xOC4wLjEiLCJjbGllbnRJZCI6Imh0dCtxMklHWUJBRzhwZEwxeGxxeDNMcWtXbXIiLCJwcmVmZXJyZWRfdXNlcm5hbWUiOiJzZXJ2aWNlLWFjY291bnQtaHR0K3EyaWd5YmFnOHBkbDF4bHF4M2xxa3dtciIsImNsaWVudEFkZHJlc3MiOiIxNzIuMTguMC4xIiwiZW1haWwiOiJzZXJ2aWNlLWFjY291bnQtaHR0K3EyaWd5YmFnOHBkbDF4bHF4M2xxa3dtckBwbGFjZWhvbGRlci5vcmcifQ.BgF6v7VQGO4vH4Z0VLFZmiO1CARpaoE1V7MjaNIJB85QORfk3L431VFQr3WJdT5ZBeC0Q5mB5LB7f9gLAd2lso4P9AegYAi8PmjJRvI-oL59Qe0PfDn8fjfZdaC8i3K0ZrZNDS9ivTdqL-8Gvq2C1l8x4tZaSxw1Yu8hxrWEfgOfATdn9XL5cbYXWRkm6AoJkVFVd300fPr0k6f67Jb4WOJP72692g8QRTWkqCrZyz0DrJxgg7fSX6M_0bxOa-JOidmGuJIwScciT1b5IVvvcQi3hx4UMwRQFunq1j2T7iRCT_LB99oP480KtoSXyCUS3dDzj6wCp4BEHb5K792isg"
,
"expires_in": 300,
"refresh_expires_in": 1800,
"refresh_token":
"eyJhbGciOiJIUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJhNmQzZTgzZi1iZGUxLTQ3YjgtYmQ4Yy1hMjVhNDdjMmExZTYifQ.eyJqdGkiOiJmZWZhNTRjZS1hMjA0LTQ2NjAtODNkMC1kNDE0OWQwOTU0YWMiLCJleHAiOjE1NDM1NzQ2MDgsIm5iZiI6MCwiaWF0IjoxNTQzNTcyODA4LCJpc3MiOiJodHRwOi8vMTcyLjE4LjAuMzo4MDgwL2F1dGgvcmVhbG1zL3Rlc3QtcmVhbG0iLCJhdWQiOiJodHRwOi8vMTcyLjE4LjAuMzo4MDgwL2F1dGgvcmVhbG1zL3Rlc3QtcmVhbG0iLCJzdWIiOiJjODE3NjM2OC0wYjk1LTQxYWYtODNkNS1lOTg3ZjRlZWVhODciLCJ0eXAiOiJSZWZyZXNoIiwiYXpwIjoiaHR0K3EySUdZQkFHOHBkTDF4bHF4M0xxa1dtciIsImF1dGhfdGltZSI6MCwic2Vzc2lvbl9zdGF0ZSI6IjcyZWNiNzk4LWRiNTgtNDE2MS04ZTA5LTRhYWVkYjJlYWI4ZiIsInJlYWxtX2FjY2VzcyI6eyJyb2xlcyI6WyJvZmZsaW5lX2FjY2VzcyIsInVtYV9hdXRob3JpemF0aW9uIl19LCJyZXNvdXJjZV9hY2Nlc3MiOnsiaHR0K3EySUdZQkFHOHBkTDF4bHF4M0xxa1dtciI6eyJyb2xlcyI6WyJ1bWFfcHJvdGVjdGlvbiJdfSwiYWNjb3VudCI6eyJyb2xlcyI6WyJtYW5hZ2UtYWNjb3VudCIsIm1hbmFnZS1hY2NvdW50LWxpbmtzIiwidmlldy1wcm9maWxlIl19fSwic2NvcGUiOiJwcm9maWxlIGVtYWlsIn0.WTW9TwMnx4DSzRlLkDj_uXgabFAAUD4wDB5D084GMdY"
,
"token_type": "bearer",
"not-before-policy": 0,
"session_state": "72ecb798-db58-4161-8e09-4aaedb2eab8f",
"scope": "profile email"
}

But, we'd like to send a "non-JWT" token, like this one:
{

"access_token": "laskddjfnasdf7-fas45nfdsa-56kr-8uy7-fasd87fyasdf",
"token_type": "bearer",
"expires_in": 3600,
"scope": "scope-1 scope-2 scope-n"
}

We're not very experienced in Keycloak and we do not know if this is even
possible, but any help will make us very happy.

Thanks in advance!

Regards,

From dominic.michel01 at realdigital.de  Fri Nov 30 07:02:57 2018
From: dominic.michel01 at realdigital.de (dominic.michel01 at realdigital.de)
Date: Fri, 30 Nov 2018 12:02:57 +0000
Subject: [keycloak-user] Access to security-admin-console via
	SSL	is	prohibited?
In-Reply-To: <FF0BCE66D952254B942F978A64B2873D01A752E4@FFM30MBXC03N.comm.madm.net>
References: <FF0BCE66D952254B942F978A64B2873D01A74BC7@FFM30MBXC03N.comm.madm.net>,
	<SN4PR0801MB3821A25A3BCBFE7E628B9B32F8D20@SN4PR0801MB3821.namprd08.prod.outlook.com>,
	<FF0BCE66D952254B942F978A64B2873D01A752E4@FFM30MBXC03N.comm.madm.net>
Message-ID: <FF0BCE66D952254B942F978A64B2873D01A75342@FFM30MBXC03N.comm.madm.net>

Hi.

I found my mistake. The client is talking SSL with the reverse-proxy, but the reverse-proxy is only talking http with keycloak. So all i had to do is set proxy-address-forwarding="true" for the http-listener in order for keycloak to respect the X-Forwarded-Proto header and use https for redirects. Like described in this section of the documentation https://www.keycloak.org/docs/4.6/server_installation/index.html#identifying-client-ip-addresses

Thanks for your help Tim!

________________________________________
From: keycloak-user-bounces at lists.jboss.org [keycloak-user-bounces at lists.jboss.org] on behalf of dominic.michel01 at realdigital.de [dominic.michel01 at realdigital.de]
Sent: Friday, November 30, 2018 8:27 AM
To: tim.hedlund at outlook.com; keycloak-user at lists.jboss.org
Subject: Re: [keycloak-user] Access to security-admin-console via SSL   is      prohibited?

Hi.

Yes, i've added the https uri as well. Unfortunately, when accessing the login mask via https, the action of the login form is still using http. So i'm able to login but only see a blank page because the page content is blocked by the browser with this message:

Mixed Content: The page at 'https://myserver.com/auth/admin/master/console/' was loaded over HTTPS, but requested an insecure XMLHttpRequest endpoint 'http://myserver.com/auth/realms/master/protocol/openid-connect/token'. This request has been blocked; the content must be served over HTTPS.


According to https://www.keycloak.org/docs/4.6/server_admin/#_ssl_modes i figured it would be enough to configure SSL on the reverse proxy only, but now i wonder if it really is and how to convince keycloak to use https for all its form actions, XHRs etc.

Kind regards,
Dominic

________________________________________
From: Tim Hedlund [tim.hedlund at outlook.com]
Sent: Thursday, November 29, 2018 4:02 PM
To: Michel, Dominic; keycloak-user at lists.jboss.org
Subject: RE: [keycloak-user] Access to security-admin-console via SSL is        prohibited?

Dominic,

Did you try to add your response uri, i.e: "https://myserver.com/auth/admin/master/console/*" to the "Valid Redirect URIs" in the security-admin-console client?

Regards
Tim

-----Original Message-----
From: keycloak-user-bounces at lists.jboss.org [mailto:keycloak-user-bounces at lists.jboss.org] On Behalf Of dominic.michel01 at realdigital.de
Sent: den 28 november 2018 12:02
To: keycloak-user at lists.jboss.org
Subject: [keycloak-user] Access to security-admin-console via SSL is prohibited?


Hi.

I've just deployed a keycloak which is only reachable via a haproxy that enforces SSL.
Now i'm trying to log into the security-admin-console via https://myserver.com/auth/admin/ which is redirecting me to https://mysever.com/auth/realms/master/protocol/openid-connect/auth?client_id=security-admin-console&redirect_uri=https%3A%2F%2Fmyserver.com%2Fauth%2Fadmin%2Fmaster%2Fconsole%2F&state=a69fd981-6daa-4cbd-a231-0907376a8338&response_mode=fragment&response_type=code&scope=openid&nonce=c8f30e79-f7a6-4cad-8ce3-c2aab81964e4

But this request ends in status 400 with the response "Invalid parameter: redirect_uri"
On a test environment without SSL it's actually working fine with an absolute uri using http. But here i cannot use http. The haproxy prevents it completely.
I tried changing the redirect_uri param to a relative one (redirect_uri=%2Fauth%2Fadmin%2Fmaster%2Fconsole%2F) but then keycloak responds with a non-SSL redirect to the base URL (http://myserver.com/auth/admin/master/console/)
which leaves my with an error in the browser because haproxy changes the call to https, but some content seems to be still embeded using http
---
Content Security Policy: The page's settings blocked the loading of a resource at http://myserver.com/auth/realms/master/protocol/openid-connect/login-status-iframe.html?version=4.6.0.final ("frame-src").
---

So it looks like i'm effectively locked out.

Based on my current situation i have three questions.
1. Why does keycloak respond with http redirects even though the issuing call (https://myserver.com/auth/realms/master/protocol/openid-connect/auth...) was using https and how can this be changed?
2. Given that the default redirect uri pattern for the security-admin-console is "/auth/admin/master/console/*", why is https://myserver.com/auth/admin/master/console not considered a valid redirect_uri but http://myserver.com/auth/admin/master/console is?
3. Does anybody know what to change now (via admin cli i guess) to get access to the UI?

Thanks for your help.

Kind regards,
Dominic
real,- Digital Services GmbH, Sitz: Duesseldorf

Amtsgericht Duesseldorf, HRB 75643



Geschaeftsfuehrer: Dr. Gerald Schoenbucher, Mehmet Toezge



Die in dieser E-Mail enthaltenen Nachrichten und Anhaenge sind ausschliesslich fuer den bezeichneten Adressaten bestimmt. Sie koennen rechtlich geschuetzte, vertrauliche Informationen enthalten. Falls Sie nicht der bezeichnete Empfaenger oder zum Empfang dieser E-Mail nicht berechtigt sind, ist die Verwendung, Vervielfaeltigung oder Weitergabe der Nachrichten und Anhaenge untersagt. Falls Sie diese E-Mail irrtuemlich erhalten haben, informieren Sie bitte unverzueglich den Absender und vernichten Sie die E-Mail.


_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
real,- Digital Services GmbH, Sitz: Duesseldorf

Amtsgericht Duesseldorf, HRB 75643



Geschaeftsfuehrer: Dr. Gerald Schoenbucher, Mehmet Toezge



Die in dieser E-Mail enthaltenen Nachrichten und Anhaenge sind ausschliesslich fuer den bezeichneten Adressaten bestimmt. Sie koennen rechtlich geschuetzte, vertrauliche Informationen enthalten. Falls Sie nicht der bezeichnete Empfaenger oder zum Empfang dieser E-Mail nicht berechtigt sind, ist die Verwendung, Vervielfaeltigung oder Weitergabe der Nachrichten und Anhaenge untersagt. Falls Sie diese E-Mail irrtuemlich erhalten haben, informieren Sie bitte unverzueglich den Absender und vernichten Sie die E-Mail.


_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
real,- Digital Services GmbH, Sitz: Duesseldorf

Amtsgericht Duesseldorf, HRB 75643

 

Geschaeftsfuehrer: Dr. Gerald Schoenbucher, Mehmet Toezge

 

Die in dieser E-Mail enthaltenen Nachrichten und Anhaenge sind ausschliesslich fuer den bezeichneten Adressaten bestimmt. Sie koennen rechtlich geschuetzte, vertrauliche Informationen enthalten. Falls Sie nicht der bezeichnete Empfaenger oder zum Empfang dieser E-Mail nicht berechtigt sind, ist die Verwendung, Vervielfaeltigung oder Weitergabe der Nachrichten und Anhaenge untersagt. Falls Sie diese E-Mail irrtuemlich erhalten haben, informieren Sie bitte unverzueglich den Absender und vernichten Sie die E-Mail.



From jramos at redhat.com  Fri Nov 30 07:49:38 2018
From: jramos at redhat.com (Joao Paulo Ramos)
Date: Fri, 30 Nov 2018 10:49:38 -0200
Subject: [keycloak-user] Issue with CORS on Keycloak
Message-ID: <CAC6=1xzQqk4yyGSmmQspn5PmUePAQaq+QGyPdYL-ev5Lu5JafQ@mail.gmail.com>

Hi guys,

Sorry if it's not the correct place to make this question (please guide me
to the correct place).

I'm facing some problems with CORS when using rh-sso 7.1.
I'm using the following environment:
- JBoss EAP 7.1 with Resteasy in the backend ->
localhost:8080/accountmovement/api
- ReactJS in the frontend -> localhost:3000
- RH-SSO -> localhost:8180

The JBoss EAP is using the Wildfly/EAP Adapter from Red Hat, with the
configurations made on the standalone.xml file as a subsystem:

      <subsystem xmlns="urn:jboss:domain:keycloak:1.1">
            <secure-deployment name="accountmovement.war">
                <realm>demo</realm>
                <resource>accountmovement-backend</resource>

<use-resource-role-mappings>true</use-resource-role-mappings>
                <public-client>true</public-client>
                <auth-server-url>http://localhost:8180/auth
</auth-server-url>
                <ssl-required>EXTERNAL</ssl-required>
                <enable-cors>true</enable-cors>
            </secure-deployment>
       </subsystem>

I Already enabled the Web Origins to " * " in the RH-SSO Admin console for
both of the clients I'm using.

The error I receive is the following:

""
Failed to load
http://localhost:8080/accountmovement/api/accounts?_=1543522008489:
Redirect from '
http://localhost:8080/accountmovement/api/accounts?_=1543522008489' to '
http://localhost:8180/auth/realms/demo/protocol/openid-connect/auth?response_type=code&client_id=accountmovement-backend&redirect_uri=http%3A%2F%2Flocalhost%3A8080%2Faccountmovement%2Fapi%2Faccounts?_%3D1543522008489&state=ce5ee16c-f5f7-4a9e-affd-3316c4fad78f&login=true&scope=openid'
has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is
present on the requested resource. Origin 'http://localhost:3000' is
therefore not allowed access.
""

Do you have any idea for what can I do?

If you need more information just let me know!

Thank you,

JO?O PAULO RAMOS

BUSINESS FINANCE - DATA SCIENCE INTERN

Red Hat Brasil

jramos at redhat.com   M: +55-11-96505-6159
<https://red.ht/sig>