From patrice.amiel at thalesgroup.com  Mon Jul  1 09:31:26 2019
From: patrice.amiel at thalesgroup.com (AMIEL Patrice)
Date: Mon, 1 Jul 2019 13:31:26 +0000
Subject: [keycloak-user] How to achieve "service continuity" with
 KeyCloak in Standalone Cluster mode ?
In-Reply-To: <d2d7cb57d719d06c842f5c050e92b592fdfad209.camel@carretti.pro>
References: <PR1PR01MB493999E9FBFF07EFD826E3F2F6E00@PR1PR01MB4939.eurprd01.prod.exchangelabs.com>
	<PR1PR01MB4939C4A5802AEB44B9147462F6E00@PR1PR01MB4939.eurprd01.prod.exchangelabs.com>
	<d2d7cb57d719d06c842f5c050e92b592fdfad209.camel@carretti.pro>
Message-ID: <PR1PR01MB4939F3ED03631E6C1F179BC3F6F90@PR1PR01MB4939.eurprd01.prod.exchangelabs.com>

Thanks Dimitri,

You are right, the shutdown was not working properly: the SIGTERM signal was not reaching the JBoss process. To help other members of the community, here is what I did: I first set the LAUNCH_JBOSS_IN_BACKGROUND envvar so that the JBoss java process that is launched by the standalone.sh script is run in background. The "trap" commands are then automatically set to forward the various signals received by the standalone.sh process to the JBoss process.
I then updated my own Docker entrypoint shell script to have the same behavior (run standalone.sh un background, get the process id, and define the traps). At the end, SIGTERM sent by Kubernetes is correctly received by JBoss that exists properly the cluster.

Now, the cluster is more stable (much less errors encountered when scaling down, no more exception stack traces, and the cluster is not de-stabilized when an instance is stopped: less API calls falling into error), but it is still not perfect : I still encounter some errors during the scaling down transitions, even when setting the "owner" field of the "distributed-cache" descriptions to "2".
Indeed, I realizes that most (almost all) of the requests are processed by a single KeyCloak instance (often the oldest one) while I don't have any session affinity (Session Affinity = None) on the Kubernetes Service: why ?
As a consequence, when killing ("kubectl delete pod") the instance that is receiving (almost) none of the request, I don't have errors; but when deleting the instance that is processing (almost) all the requests, then I have errors! Again, setting the "owner" field of the "distributed-cache" description to "2" (expecting the cache data are duplicated on the 2 nodes) does not change things: I still have errors...

I tries to set the 'mode="SYNC"' like this:
<distributed-cache name="sessions" mode="SYNC" owners="2"/>
But the process does not start, with the following error:
13:17:32,080 ERROR [org.jboss.as.controller] (Controller Boot Thread)

OPVDX001: Validation error in standalone-ha.xml --------------------------------
|
|  338: </local-cache>
|  339: <replicated-cache name="work"/>
|  340: <distributed-cache name="sessions" mode="SYNC" owners="2"/>
|                                          ^^^^ 'mode' isn't an allowed attribute for the 'distributed-cache' element
|
|                                               Attributes allowed here are: capacity-factor,
|                                                 consistent-hash-strategy, l1-lifespan, owners, segments
|
|  341: <distributed-cache name="authenticationSessions" mode="SYNC" owners="2"/>
|  342: <distributed-cache name="offlineSessions" mode="SYNC" owners="2"/>
|  343: <distributed-cache name="clientSessions" mode="SYNC" owners="2"/>
|
| 'mode' is allowed on elements:
| - server > profile > {urn:jboss:domain:infinispan:7.0}subsystem > cache-container > local-cache > transaction

Where should I put the "mode" instead?
Any idea on why I still have some errors?

Thanks for your valuable help.

Patrice

PS: By the way, I fear there is a bug in the standalone.sh (but I'm not sure): the trap definitions are the following:
      trap "kill -HUP  $JBOSS_PID" HUP
      trap "kill -TERM $JBOSS_PID" INT
      trap "kill -QUIT $JBOSS_PID" QUIT
      trap "kill -PIPE $JBOSS_PID" PIPE
      trap "kill -TERM $JBOSS_PID" TERM

Each signal is forwarded to the JBoss process except the INT signal that is changed into a TERM signal ? Shouldn't we have
      trap "kill -INT $JBOSS_PID" INT
instead ?

-----Original Message-----
From: Dmitry Telegin [mailto:demetrio at carretti.pro]
Sent: lundi 24 juin 2019 19:19
To: AMIEL Patrice <Patrice.Amiel at gemalto.com>; keycloak-user at lists.jboss.org
Subject: Re: [keycloak-user] How to achieve "service continuity" with KeyCloak in Standalone Cluster mode ?

Hello Patrice,

Do you experience this even if the node is properly shutdown, i.e. via SIGTERM rather than SIGKILL? Keycloak does seem to properly shutdown caches [1], which, according to Infinispan doc [2], should result in a graceful leave.

Do you see messages like this in the log after shutdown has been triggered?

20:14:26,598 INFO  [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 62) WFLYCLINF0003: Stopped XXX cache from keycloak container

As for replicated caches, the issue might be triggered by mixing caches with different synchronization modes. Could you try to explicitly specify mode="SYNC", like here [3]?

[1] https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fkeycloak%2Fkeycloak%2Fblob%2F4.8.3.Final%2Fmodel%2Finfinispan%2Fsrc%2Fmain%2Fjava%2Forg%2Fkeycloak%2Fconnections%2Finfinispan%2FDefaultInfinispanConnectionProviderFactory.java%23L72&amp;data=02%7C01%7Cpatrice.amiel%40gemalto.com%7Cd1eda3ff5bf74dbc390408d6f8c80987%7C37d0a9db7c464096bfe31add5b495d6d%7C0%7C1%7C636969935378606026&amp;sdata=axZbKSSTl%2B%2BdsAPFf5Ow79ck328mwc9Uz7vqQm%2FNbfo%3D&amp;reserved=0
[2] https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Finfinispan.org%2Fdocs%2Fstable%2Fuser_guide%2Fuser_guide.html%23cache_manager&amp;data=02%7C01%7Cpatrice.amiel%40gemalto.com%7Cd1eda3ff5bf74dbc390408d6f8c80987%7C37d0a9db7c464096bfe31add5b495d6d%7C0%7C1%7C636969935378606026&amp;sdata=rTY8QFuuVIT5apHDQv1wvC52w0s1wjkrlzOtshhyTso%3D&amp;reserved=0
[3] https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Finfinispan.org%2Fdocs%2Fstable%2Fuser_guide%2Fuser_guide.html%23cache_configuration_declarative&amp;data=02%7C01%7Cpatrice.amiel%40gemalto.com%7Cd1eda3ff5bf74dbc390408d6f8c80987%7C37d0a9db7c464096bfe31add5b495d6d%7C0%7C1%7C636969935378606026&amp;sdata=P4io70GsZ%2FOMHxPsO3rWJyB%2FSy2D2mzVrXhQ9TIKJRk%3D&amp;reserved=0

Regards,
Dmitry Telegin

Carretti Consulting O? | Keycloak Consulting and Training Sepapaja 6, Tallinn 15551, Estonia | info at carretti.pro

On Mon, 2019-06-24 at 15:30 +0000, AMIEL Patrice wrote:
> Hi all,
>
> I'm trying to deploy KeyCloak (v 4.8.3-final) in Standalone Cluster mode in order to answer a very specific requirement: get continuity of service 1/ in case of crash of a KeyCloak instance, 2/ during the upgrade of my solution.
> However, I unfortunately don't get such results :(, despite the fact the cluster looks to be properly configured.
>
> First, as I'm deploying KeyCloak in Kubernetes, I configured KeyCloak in Standalone Cluster by using the DNS_PING and a TCP transport for JGroups. Instances of the cluster can discover/see each other and the cluster is working fine as soon as it is used a couple of seconds/minutes after starting the instances.
> I've created a simple script that just get in a loop the JWT tokens using the Token endpoint of a Realm, and I always have a 200 Ok status code whatever the KeyCloak instance that is hit through the Kubernetes Service.
>
> However, coming back to the 2 uses cases I'm interested in, it looks the KeyCloak instances are getting crazy as soon as the cluster is not "stable". By "cluster is not stable", I mean:
>
> -          When scaling down the number of Keycloak instances (whatever it is by killing a Container or by a smart scale down of the Kubernetes Deployment)
>
> -          When performing a rolling update of the Pods
>
> In both cases, during a particular time, most of the calls to get a JWT return a HTTP 499 status code and KeyCloak logs show the following:
> 08:14:56,785 ERROR [org.infinispan.interceptors.impl.InvocationContextInterceptor] (timeout-thread--p13-t1) ISPN000136: Error executing command GetKeyValueCommand, writing keys  ISPN000476: Timed out waiting for responses for request 1883 from id-provider-5c55bbd99d-kqr8v
>         at org.infinispan.remoting.transport.impl.MultiTargetRequest.onTimeout(MultiTargetRequest.java:167)
>         at org.infinispan.remoting.transport.jgroups.StaggeredRequest.onTimeout(StaggeredRequest.java:64)
>         at org.infinispan.remoting.transport.AbstractRequest.call(AbstractRequest.java:87)
>         at org.infinispan.remoting.transport.AbstractRequest.call(AbstractRequest.java:22)
>         at java.util.concurrent.FutureTask.run(FutureTask.java:266)
>         at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:180)
>         at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:293)
>         at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
>         at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
>         at java.lang.Thread.run(Thread.java:748)
>
> 08:14:56,790 ERROR [org.keycloak.services.error.KeycloakErrorHandler] (default task-992) Uncaught server error: org.infinispan.util.concurrent.TimeoutException: ISPN000476: Time-provider-5c55bbd99d-kqr8v
>         at org.infinispan.interceptors.impl.AsyncInterceptorChainImpl.invoke(AsyncInterceptorChainImpl.java:259)
>         at org.infinispan.cache.impl.CacheImpl.get(CacheImpl.java:479)
>         at org.infinispan.cache.impl.CacheImpl.get(CacheImpl.java:472)
>         at org.infinispan.cache.impl.AbstractDelegatingCache.get(AbstractDelegatingCache.java:348)
>         at org.infinispan.cache.impl.EncoderCache.get(EncoderCache.java:659)
>         at org.infinispan.cache.impl.AbstractDelegatingCache.get(AbstractDelegatingCache.java:348)
>         at org.keycloak.models.sessions.infinispan.changes.InfinispanChangelogBasedTransaction.get(InfinispanChangelogBasedTransaction.java:120)
>         at org.keycloak.models.sessions.infinispan.InfinispanUserSessionProvider.getLoginFailureEntity(InfinispanUserSessionProvider.java:678)
>         at org.keycloak.models.sessions.infinispan.InfinispanUserSessionProvider.getUserLoginFailure(InfinispanUserSessionProvider.java:672)
>         at org.keycloak.services.managers.DefaultBruteForceProtector.isTemporarilyDisabled(DefaultBruteForceProtector.java:306)
>         at org.keycloak.authentication.authenticators.directgrant.ValidateUsername.authenticate(ValidateUsername.java:85)
>         at org.keycloak.authentication.DefaultAuthenticationFlow.processFlow(DefaultAuthenticationFlow.java:221)
>         at org.keycloak.authentication.DefaultAuthenticationFlow.processFlow(DefaultAuthenticationFlow.java:148)
>         at org.keycloak.authentication.AuthenticationProcessor.authenticateOnly(AuthenticationProcessor.java:910)
>         at org.keycloak.protocol.oidc.endpoints.TokenEndpoint.resourceOwnerPasswordCredentialsGrant(TokenEndpoint.java:554)
>         at org.keycloak.protocol.oidc.endpoints.TokenEndpoint.processGrantRequest(TokenEndpoint.java:187)
>         at sun.reflect.GeneratedMethodAccessor449.invoke(Unknown Source)
>         at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
>         at java.lang.reflect.Method.invoke(Method.java:498)
>         at org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java:140)
>        at org.jboss.resteasy.core.ResourceMethodInvoker.internalInvokeOnTarget(ResourceMethodInvoker.java:509)
>         at org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTargetAfterFilter(ResourceMethodInvoker.java:399)
>         at org.jboss.resteasy.core.ResourceMethodInvoker.lambda$invokeOnTarget$0(ResourceMethodInvoker.java:363)
>         at org.jboss.resteasy.core.interception.PreMatchContainerRequestContext.filter(PreMatchContainerRequestContext.java:358)
>         at org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTarget(ResourceMethodInvoker.java:365)
>         at org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:337)
>         at org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(ResourceLocatorInvoker.java:137)
>         at org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:106)
>         at org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(ResourceLocatorInvoker.java:132)
>         at org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:100)
>         at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:443)
>         at org.jboss.resteasy.core.SynchronousDispatcher.lambda$invoke$4(SynchronousDispatcher.java:233)
>         at org.jboss.resteasy.core.SynchronousDispatcher.lambda$preprocess$0(SynchronousDispatcher.java:139)
>         at org.jboss.resteasy.core.interception.PreMatchContainerRequestContext.filter(PreMatchContainerRequestContext.java:358)
>         at org.jboss.resteasy.core.SynchronousDispatcher.preprocess(SynchronousDispatcher.java:142)
>         at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:219)
>         at org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:227)
>         at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56)
>         at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51)
>         at javax.servlet.http.HttpServlet.service(HttpServlet.java:791)
>         at io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:74)
>         at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129)
>         at org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:90)
>         at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61)
>         at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
>         at io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84)
>         at io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62)
>         at io.undertow.servlet.handlers.ServletChain$1.handleRequest(ServletChain.java:68)
>         at io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
>         at org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78)
>         at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>         at io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:132)
>         at io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57)
>         at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>         at io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)
>         at io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)
>         at io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)
>         at io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77)
>         at io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50)
>         at io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)
>         at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>         at org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)
>         at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>         at org.wildfly.extension.undertow.deployment.GlobalRequestControllerHandler.handleRequest(GlobalRequestControllerHandler.java:68)
>         at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>         at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:292)
>         at io.undertow.servlet.handlers.ServletInitialHandler.access$100(ServletInitialHandler.java:81)
>         at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:138)
>         at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:135)
>         at io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:48)
>         at io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43)
>         at org.wildfly.extension.undertow.security.SecurityContextThreadSetupAction.lambda$create$0(SecurityContextThreadSetupAction.java:105)
>         at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)
>         at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)
>         at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)
>         at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)
>         at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:272)
>         at io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81)
>         at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:104)
>         at io.undertow.server.Connectors.executeRootHandler(Connectors.java:360)
>         at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:830)
>         at org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35)
>         at org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1985)
>         at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1487)
>         at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1378)
>         at java.lang.Thread.run(Thread.java:748)
> Caused by: org.infinispan.util.concurrent.TimeoutException: ISPN000476: Timed out waiting for responses for request 1883 from id-provider-5c55bbd99d-kqr8v
>         at org.infinispan.remoting.transport.impl.MultiTargetRequest.onTimeout(MultiTargetRequest.java:167)
>         at org.infinispan.remoting.transport.jgroups.StaggeredRequest.onTimeout(StaggeredRequest.java:64)
>         at org.infinispan.remoting.transport.AbstractRequest.call(AbstractRequest.java:87)
>         at org.infinispan.remoting.transport.AbstractRequest.call(AbstractRequest.java:22)
>         at java.util.concurrent.FutureTask.run(FutureTask.java:266)
>         at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:180)
>         at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:293)
>         at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
>         at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
>         ... 1 more
>         Suppressed: org.infinispan.util.logging.TraceException
>                 at org.infinispan.interceptors.impl.SimpleAsyncInvocationStage.get(SimpleAsyncInvocationStage.java:41)
>                 at org.infinispan.interceptors.impl.AsyncInterceptorChainImpl.invoke(AsyncInterceptorChainImpl.java:250)
>                 at org.infinispan.cache.impl.CacheImpl.get(CacheImpl.java:479)
>                 at org.infinispan.cache.impl.CacheImpl.get(CacheImpl.java:472)
>                 at org.infinispan.cache.impl.AbstractDelegatingCache.get(AbstractDelegatingCache.java:348)
>                 at org.infinispan.cache.impl.EncoderCache.get(EncoderCache.java:659)
>                 at org.infinispan.cache.impl.AbstractDelegatingCache.get(AbstractDelegatingCache.java:348)
>                 at org.keycloak.models.sessions.infinispan.changes.InfinispanChangelogBasedTransaction.get(InfinispanChangelogBasedTransaction.java:120)
>                 at org.keycloak.models.sessions.infinispan.InfinispanUserSessionProvider.getLoginFailureEntity(InfinispanUserSessionProvider.java:678)
>                 at org.keycloak.models.sessions.infinispan.InfinispanUserSessionProvider.getUserLoginFailure(InfinispanUserSessionProvider.java:672)
>                 at org.keycloak.services.managers.DefaultBruteForceProtector.isTemporarilyDisabled(DefaultBruteForceProtector.java:306)
>                 at org.keycloak.authentication.authenticators.directgrant.ValidateUsername.authenticate(ValidateUsername.java:85)
>                 at org.keycloak.authentication.DefaultAuthenticationFlow.processFlow(DefaultAuthenticationFlow.java:221)
>                 at org.keycloak.authentication.DefaultAuthenticationFlow.processFlow(DefaultAuthenticationFlow.java:148)
>                 at org.keycloak.authentication.AuthenticationProcessor.authenticateOnly(AuthenticationProcessor.java:910)
>                 at org.keycloak.protocol.oidc.endpoints.TokenEndpoint.resourceOwnerPasswordCredentialsGrant(TokenEndpoint.java:554)
>                 at org.keycloak.protocol.oidc.endpoints.TokenEndpoint.processGrantRequest(TokenEndpoint.java:187)
>                 at sun.reflect.GeneratedMethodAccessor449.invoke(Unknown Source)
>                 at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
>                 at java.lang.reflect.Method.invoke(Method.java:498)
>                 at org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java:140)
>                 at org.jboss.resteasy.core.ResourceMethodInvoker.internalInvokeOnTarget(ResourceMethodInvoker.java:509)
>                 at org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTargetAfterFilter(ResourceMethodInvoker.java:399)
>                 at org.jboss.resteasy.core.ResourceMethodInvoker.lambda$invokeOnTarget$0(ResourceMethodInvoker.java:363)
>                 at org.jboss.resteasy.core.interception.PreMatchContainerRequestContext.filter(PreMatchContainerRequestContext.java:358)
>                 at org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTarget(ResourceMethodInvoker.java:365)
>                 at org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:337)
>                 at org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(ResourceLocatorInvoker.java:137)
>                 at org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:106)
>                 at org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(ResourceLocatorInvoker.java:132)
>                 at org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:100)
>                 at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:443)
>                 at org.jboss.resteasy.core.SynchronousDispatcher.lambda$invoke$4(SynchronousDispatcher.java:233)
>                 at org.jboss.resteasy.core.SynchronousDispatcher.lambda$preprocess$0(SynchronousDispatcher.java:139)
>                 at org.jboss.resteasy.core.interception.PreMatchContainerRequestContext.filter(PreMatchContainerRequestContext.java:358)
>                 at org.jboss.resteasy.core.SynchronousDispatcher.preprocess(SynchronousDispatcher.java:142)
>                 at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:219)
>                 at org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:227)
>                 at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56)
>                 at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51)
>                 at javax.servlet.http.HttpServlet.service(HttpServlet.java:791)
>                 at io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:74)
>                 at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129)
>                 at org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:90)
>                 at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61)
>                 at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
>                 at io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84)
>                 at io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62)
>                 at io.undertow.servlet.handlers.ServletChain$1.handleRequest(ServletChain.java:68)
>                 at io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
>                 at org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78)
>                 at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>                 at io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:132)
>                 at io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57)
>                 at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>                 at io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)
>                 at io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)
>                 at io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)
>                 at io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77)
>                 at io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50)
>                 at io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)
>                 at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>                 at org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)
>                 at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>                 at org.wildfly.extension.undertow.deployment.GlobalRequestControllerHandler.handleRequest(GlobalRequestControllerHandler.java:68)
>                 at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>                 at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:292)
>                 at io.undertow.servlet.handlers.ServletInitialHandler.access$100(ServletInitialHandler.java:81)
>                 at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:138)
>                 at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:135)
>                 at io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:48)
>                 at io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43)
>                 at org.wildfly.extension.undertow.security.SecurityContextThreadSetupAction.lambda$create$0(SecurityContextThreadSetupAction.java:105)
>                 at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)
>                 at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)
>                 at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)
>                 at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)
>                 at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:272)
>                 at io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81)
>                 at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:104)
>                 at io.undertow.server.Connectors.executeRootHandler(Connectors.java:360)
>                 at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:830)
>                 at org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35)
>                 at org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1985)
>                 at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1487)
>                 at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1378)
>                 ... 1 more
>
> It looks that the KeyCloak instances that is still alive and receiving the call for generation of the JWT is trying to contact the other instances in order to get some data from the distributed cache... In particular, it tries to contact the instance that is no longer here (because killed, shutdown, rolled...), received a Timeout error, and then terminates the incoming request in error.
> As I'm making the same request within a loop, I see the error happening during a couple of seconds (around 10 to 15 secs), i.e. during the time the cluster composition is not stabilized yet. When the re-discovery of the cluster has been performed, the new composition of the cluster is updated, and everything goes back to normal!
>
> I can understand, from KeyCloak documentation on server caches (https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.keycloak.org%2Fdocs%2F4.8%2Fserver_installation%2Findex.html%23_replication&amp;data=02%7C01%7Cpatrice.amiel%40gemalto.com%7Cd1eda3ff5bf74dbc390408d6f8c80987%7C37d0a9db7c464096bfe31add5b495d6d%7C0%7C1%7C636969935378606026&amp;sdata=Y5X0sa3QgXcZv98XQOD38i3%2BvjcowL3rZHDfdGsIELk%3D&amp;reserved=0) that "By default, Keycloak only specifies one owner for data. So if that one node goes down that data is lost. This usually means that users will be logged out and will have to login again. You can change the number of nodes that replicate a piece of data by change the owners attribute in the distributed-cache declaration.", but unfortunately, setting the "owner" field to 2 (or more !) for all distributed caches does not remove the issue.
> I even tried to change the type of cache from "distributed-cache" to "replicated-cache", but then KeyCloak is not starting:
> <replicated-cache name="sessions"/>
> <replicated-cache name="authenticationSessions"/> <replicated-cache
> name="offlineSessions"/> <replicated-cache name="clientSessions"/>
> <replicated-cache name="offlineClientSessions"/> <replicated-cache
> name="loginFailures"/> <replicated-cache name="actionTokens">
>     <object-memory size="-1"/>
>     <expiration interval="300000" max-idle="-1"/> </replicated-cache>
>
> Error during startup:
> 15:07:13,942 ERROR [org.infinispan.topology.LocalTopologyManagerImpl] (transport-thread--p14-t10) ISPN000230: Failed to start rebalance for cache authenticationSessions: java.lang.ClassCastException: org.infinispan.distribution.ch.impl.DefaultConsistentHash cannot be cast to org.infinispan.distribution.ch.impl.ReplicatedConsistentHash
>         at org.infinispan.distribution.ch.impl.SyncReplicatedConsistentHashFactory.union(SyncReplicatedConsistentHashFactory.java:26)
>         at org.infinispan.topology.LocalTopologyManagerImpl.doHandleRebalance(LocalTopologyManagerImpl.java:512)
>         at org.infinispan.topology.LocalTopologyManagerImpl.lambda$handleRebalance$3(LocalTopologyManagerImpl.java:475)
>         at org.infinispan.executors.LimitedExecutor.runTasks(LimitedExecutor.java:175)
>         at org.infinispan.executors.LimitedExecutor.access$100(LimitedExecutor.java:37)
>         at org.infinispan.executors.LimitedExecutor$Runner.run(LimitedExecutor.java:227)
>         at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
>         at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
>         at org.wildfly.clustering.service.concurrent.ClassLoaderThreadFactory.lambda$newThread$0(ClassLoaderThreadFactory.java:47)
>         at java.lang.Thread.run(Thread.java:748)
>
> Did I forgot one thing? How to get a real continuity of service with KeyCloak? Is Standalone Cluster mode the good way, and how?
>
> Thanks a lot for your help.
> Patrice
>
> ________________________________
> This message and any attachments are intended solely for the addressees and may contain confidential information. Any unauthorized use or disclosure, either whole or partial, is prohibited.
> E-mails are susceptible to alteration. Our company shall not be liable for the message if altered, changed or falsified. If you are not the intended recipient of this message, please delete it and notify the sender.
> Although all reasonable efforts have been made to keep this transmission free from viruses, the sender will not be liable for damages caused by a transmitted virus.
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flist
> s.jboss.org%2Fmailman%2Flistinfo%2Fkeycloak-user&amp;data=02%7C01%7Cpa
> trice.amiel%40gemalto.com%7Cd1eda3ff5bf74dbc390408d6f8c80987%7C37d0a9d
> b7c464096bfe31add5b495d6d%7C0%7C1%7C636969935378606026&amp;sdata=l0rOr
> rqLoxwu3rTB0UJ4G6Cdqsf8mzzUt6VQWxx6%2FfU%3D&amp;reserved=0

________________________________
 This message and any attachments are intended solely for the addressees and may contain confidential information. Any unauthorized use or disclosure, either whole or partial, is prohibited.
E-mails are susceptible to alteration. Our company shall not be liable for the message if altered, changed or falsified. If you are not the intended recipient of this message, please delete it and notify the sender.
Although all reasonable efforts have been made to keep this transmission free from viruses, the sender will not be liable for damages caused by a transmitted virus.


From felipe at hopu.eu  Mon Jul  1 10:17:28 2019
From: felipe at hopu.eu (Felipe Roca)
Date: Mon, 1 Jul 2019 16:17:28 +0200
Subject: [keycloak-user] Keycloak demo 6.0.0
Message-ID: <bfd5aba3-6850-e89b-0715-75fc2f409b55@hopu.eu>

Hi,

I am trying to set up the example in Server development - 8.3 
Authenticator SPI Walk Through, the implementation of an authenticator 
that requires that a user enter in the answer to a secret question.

The documentation assures this code is available in 
examples/providers/authenticator but it is not in the github repository 
and I can't find the keycloak-demo-6.0.0.[zip|tar.gz], where I assume 
this code may be.

Could anyone point me to the url to download this version of 
distribution files?

Thank you very much for your time and efforts,
Best regards,

-- 
Felipe Roca Blaya
Software Engineer
-
HOP Ubiquitous S.L.
www.hopu.eu <http://www.hopu.eu>
C/Luis Bu?uel 6
30562, Ceut?, Murcia.
Spain
-
logo_hop <http://www.hopu.eu/>
-
face <https://www.facebook.com/hopubiquitous/> Twitter 
<https://twitter.com/HOPUbiquitous> google 
<https://plus.google.com/+HOPUbiquitousCeut%C3%AD?hl=es> vimeo 
<https://vimeo.com/hopu> linkedin 
<https://www.linkedin.com/company-beta/3810080/>

From bruno at abstractj.org  Mon Jul  1 12:41:54 2019
From: bruno at abstractj.org (Bruno Oliveira)
Date: Mon, 1 Jul 2019 13:41:54 -0300
Subject: [keycloak-user] Keycloak demo 6.0.0
In-Reply-To: <bfd5aba3-6850-e89b-0715-75fc2f409b55@hopu.eu>
References: <bfd5aba3-6850-e89b-0715-75fc2f409b55@hopu.eu>
Message-ID: <20190701164154.GA27949@abstractj.org>

Hi Felipe, I believe this is what you're looking for:
https://github.com/keycloak/keycloak/tree/master/examples/providers/authenticator

This example, will probably be available in the next release.

I hope it helps.

On 2019-07-01, Felipe Roca wrote:
> Hi,
> 
> I am trying to set up the example in Server development - 8.3 
> Authenticator SPI Walk Through, the implementation of an authenticator 
> that requires that a user enter in the answer to a secret question.
> 
> The documentation assures this code is available in 
> examples/providers/authenticator but it is not in the github repository 
> and I can't find the keycloak-demo-6.0.0.[zip|tar.gz], where I assume 
> this code may be.
> 
> Could anyone point me to the url to download this version of 
> distribution files?
> 
> Thank you very much for your time and efforts,
> Best regards,
> 
> -- 
> Felipe Roca Blaya
> Software Engineer
> -
> HOP Ubiquitous S.L.
> www.hopu.eu <http://www.hopu.eu>
> C/Luis Bu?uel 6
> 30562, Ceut?, Murcia.
> Spain
> -
> logo_hop <http://www.hopu.eu/>
> -
> face <https://www.facebook.com/hopubiquitous/> Twitter 
> <https://twitter.com/HOPUbiquitous> google 
> <https://plus.google.com/+HOPUbiquitousCeut%C3%AD?hl=es> vimeo 
> <https://vimeo.com/hopu> linkedin 
> <https://www.linkedin.com/company-beta/3810080/>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

-- 

abstractj

From chris.smith at cmfirstgroup.com  Mon Jul  1 14:53:08 2019
From: chris.smith at cmfirstgroup.com (Chris Smith)
Date: Mon, 1 Jul 2019 18:53:08 +0000
Subject: [keycloak-user] Using Active Directory as LDAP/Kerberos
 provider but all managemet from Keycloak
In-Reply-To: <CY4PR22MB02483C2D160A892FFCAF26A298FC0@CY4PR22MB0248.namprd22.prod.outlook.com>
References: <CY4PR22MB02483C2D160A892FFCAF26A298FC0@CY4PR22MB0248.namprd22.prod.outlook.com>
Message-ID: <A09E55F4-2CD0-4E3A-89FE-199B38FF53B4@cmfirstgroup.com>

Ok, KC is creating AD users.

What I guess is that I need are the set of the Default Active Directory policies that I need to update for a trouble free KC implementation.

Active Directory is to serve as the LDAP/Kerberos federation provider.
How can a green field Active Directory Forest be setup for the best Keycloak experience and Active Directory maintenance be minimized?

?On 6/28/19, 2:33 PM, "keycloak-user-bounces at lists.jboss.org on behalf of Chris Smith" <keycloak-user-bounces at lists.jboss.org on behalf of chris.smith at cmfirstgroup.com> wrote:

    I have a client implementing SSO.  The plan is to setup a standalone Active Directory forest as the LDAP/Kerberos federation provider.  Active directory was chosen because of limited Linux expertise.
    
    User self service and registration is strongly desired.
    
    I followed the setup and for existing  users, authentication works and I can get a Kerberos ticket as a claim.
    
    A new user registration always fails.  Has anyone done this?
    
    LDAP provider is Active Directory
    
    Edit Mode is WRITEABLE.
    
    Sync Registrations is ON
    
    Bind DN is an Active Directory domain administrator
    
    Kerberos integration is ON
    
    The Kerberos Principle and keytab are for the same user as the Bind DN.
    
    11:33:49,799 WARN  [org.keycloak.services] (default task-1) KC-SERVICES0013: Failed authentication: org.keycloak.models.ModelException: Error creating subcontext [cn=\ ,CN=Users,DC=xxx-sso,DC=com]
            at org.keycloak.storage.ldap.idm.store.ldap.LDAPOperationManager.createSubContext(LDAPOperationManager.java:625)
            at org.keycloak.storage.ldap.idm.store.ldap.LDAPIdentityStore.add(LDAPIdentityStore.java:102)
            at org.keycloak.storage.ldap.LDAPUtils.addUserToLDAP(LDAPUtils.java:72)
            at org.keycloak.storage.ldap.LDAPStorageProvider.addUser(LDAPStorageProvider.java:269)
            at org.keycloak.storage.UserStorageManager.addUser(UserStorageManager.java:147)
            at org.keycloak.models.cache.infinispan.UserCacheSession.addUser(UserCacheSession.java:768)
            at org.keycloak.authentication.forms.RegistrationUserCreation.success(RegistrationUserCreation.java:133)
            at org.keycloak.authentication.FormAuthenticationFlow.processAction(FormAuthenticationFlow.java:251)
            at org.keycloak.authentication.DefaultAuthenticationFlow.processAction(DefaultAuthenticationFlow.java:97)
            at org.keycloak.authentication.AuthenticationProcessor.authenticationAction(AuthenticationProcessor.java:873)
            at org.keycloak.services.resources.LoginActionsService.processFlow(LoginActionsService.java:292)
            at org.keycloak.services.resources.LoginActionsService.processRegistration(LoginActionsService.java:627)
            at org.keycloak.services.resources.LoginActionsService.registerRequest(LoginActionsService.java:681)
            at org.keycloak.services.resources.LoginActionsService.processRegister(LoginActionsService.java:661)
            at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
            at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
            at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
            at java.lang.reflect.Method.invoke(Method.java:498)
            at org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java:139)
            at org.jboss.resteasy.core.ResourceMethodInvoker.internalInvokeOnTarget(ResourceMethodInvoker.java:510)
            at org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTargetAfterFilter(ResourceMethodInvoker.java:400)
            at org.jboss.resteasy.core.ResourceMethodInvoker.lambda$invokeOnTarget$0(ResourceMethodInvoker.java:364)
            at org.jboss.resteasy.core.interception.PreMatchContainerRequestContext.filter(PreMatchContainerRequestContext.java:355)
            at org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTarget(ResourceMethodInvoker.java:366)
            at org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:338)
            at org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(ResourceLocatorInvoker.java:137)
            at org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:100)
           at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:439)
            at org.jboss.resteasy.core.SynchronousDispatcher.lambda$invoke$4(SynchronousDispatcher.java:229)
            at org.jboss.resteasy.core.SynchronousDispatcher.lambda$preprocess$0(SynchronousDispatcher.java:135)
            at org.jboss.resteasy.core.interception.PreMatchContainerRequestContext.filter(PreMatchContainerRequestContext.java:355)
            at org.jboss.resteasy.core.SynchronousDispatcher.preprocess(SynchronousDispatcher.java:138)
            at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:215)
            at org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:227)
            at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56)
            at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51)
            at javax.servlet.http.HttpServlet.service(HttpServlet.java:791)
            at io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:74)
            at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129)
            at org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:90)
            at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61)
            at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
            at io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84)
            at io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62)
            at io.undertow.servlet.handlers.ServletChain$1.handleRequest(ServletChain.java:68)
            at io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
            at org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78)
            at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
            at io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:132)
            at io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57)
            at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
            at io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)
            at io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)
            at io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)
            at io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77)
            at io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50)
            at io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)
            at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
            at org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)
            at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
            at org.wildfly.extension.undertow.deployment.GlobalRequestControllerHandler.handleRequest(GlobalRequestControllerHandler.java:68)
            at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
            at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:292)
            at io.undertow.servlet.handlers.ServletInitialHandler.access$100(ServletInitialHandler.java:81)
            at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:138)
            at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:135)
            at io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:48)
            at io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43)
            at org.wildfly.extension.undertow.security.SecurityContextThreadSetupAction.lambda$create$0(SecurityContextThreadSetupAction.java:105)
            at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)
            at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)
            at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)
            at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)
            at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:272)
            at io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81)
            at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:104)
            at io.undertow.server.Connectors.executeRootHandler(Connectors.java:364)
            at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:830)
            at org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35)
            at org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1982)
            at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1486)
            at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1377)
            at java.lang.Thread.run(Thread.java:748)
    Caused by: javax.naming.NameAlreadyBoundException: [LDAP: error code 68 - 00002071: UpdErr: DSID-030503CF, problem 6005 (ENTRY_EXISTS), data 0
    ]; remaining name 'cn=\ ,CN=Users,DC=xxx-sso,DC=com'
            at com.sun.jndi.ldap.LdapCtx.mapErrorCode(LdapCtx.java:3149)
            at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:3100)
            at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2891)
            at com.sun.jndi.ldap.LdapCtx.c_createSubcontext(LdapCtx.java:812)
            at com.sun.jndi.toolkit.ctx.ComponentDirContext.p_createSubcontext(ComponentDirContext.java:341)
            at com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.createSubcontext(PartialCompositeDirContext.java:268)
            at javax.naming.directory.InitialDirContext.createSubcontext(InitialDirContext.java:202)
            at javax.naming.directory.InitialDirContext.createSubcontext(InitialDirContext.java:202)
            at org.keycloak.storage.ldap.idm.store.ldap.LDAPOperationManager$8.execute(LDAPOperationManager.java:607)
            at org.keycloak.storage.ldap.idm.store.ldap.LDAPOperationManager$8.execute(LDAPOperationManager.java:604)
            at org.keycloak.storage.ldap.idm.store.ldap.LDAPOperationManager.execute(LDAPOperationManager.java:759)
            at org.keycloak.storage.ldap.idm.store.ldap.LDAPOperationManager.execute(LDAPOperationManager.java:737)
            at org.keycloak.storage.ldap.idm.store.ldap.LDAPOperationManager.createSubContext(LDAPOperationManager.java:604)
            ... 82 more
    
    11:33:49,946 WARN  [org.keycloak.events] (default task-1) type=REGISTER_ERROR, realmId=XXX-SSO, clientId=xxx-sso, userId=null, ipAddress=127.0.0.1, error=invalid_user_credentials, auth_method=openid-connect, auth_type=code, register_method=form, redirect_uri=http://localhost:9080/xxx-sso/kc, code_id=223fbcfb-4946-43c2-b483-5bd104e4f239, email=newUser at something.com, username=a.new.user
    
    
    _______________________________________________
    keycloak-user mailing list
    keycloak-user at lists.jboss.org
    https://lists.jboss.org/mailman/listinfo/keycloak-user
    



From mdailous at forensiclogic.com  Mon Jul  1 18:09:48 2019
From: mdailous at forensiclogic.com (Michael Dailous)
Date: Mon, 1 Jul 2019 22:09:48 +0000
Subject: [keycloak-user] Keycloak 6.0.1 caching authentication information
	for login form?
Message-ID: <BYAPR09MB2549EAB3385187D1F13A1F5DD6F90@BYAPR09MB2549.namprd09.prod.outlook.com>

We're seeing an issue where the login form is being pre-populated with the last user's login information, including password. Apparently, this is happening on a browser that hasn't previously logged in to the Keycloak server.

Has there been any updates to the latest version that might cause this issue?

Thank you,
Michael


From adityamamid9 at gmail.com  Mon Jul  1 18:18:35 2019
From: adityamamid9 at gmail.com (Aditya mamidala)
Date: Mon, 1 Jul 2019 18:18:35 -0400
Subject: [keycloak-user] Getting this exception Caused by:
 javax.persistence.EntityExistsException: A different object with the same
 identifier value was already associated with the session :
 [org.keycloak.storage.jpa.entity.FederatedUserRoleMappingEntity#org.keycloak.storage.jpa.entity.FederatedUserRoleMappingEntity$Key@e3a03493]
Message-ID: <CADjbqc4Mo0uJKZ6S+mExbw-KJM0+UCxziu=P196ndAFqijBu4w@mail.gmail.com>

We are trying to authenticate an existing user via Keycloak so implemented
a custom SPI and added the custom SPI as User Federation

"Getting a different object with the same identifier value was already
associated with the session exception" when trying to add a user with role
from a custom SPI to Keycloak database

Please find the exception message


*Caused by: javax.persistence.EntityExistsException: A different object
with the same identifier value was already associated with the session :
[org.keycloak.storage.jpa.entity.FederatedUserRoleMappingEntity#org.keycloak.storage.jpa.entity.FederatedUserRoleMappingEntity$Key at e3a03493]*
We are trying to use Keycloak *6.0.1* for authentication and using the
custom provider to authenticate the users the user details are are in
custom provider using Storage  provider SPI

    @Override
    public UserModel getUserByUsername(String username, RealmModel realm) {
        UserModel userModel = new UserAdapter(session, realm, model,
repository.findUserByUsernameOrEmail(username));
        RoleModel roleModel = realm.getRole("user");
       * // Adding the 'user' RoleModel to the UserModel object*
        userModel.grantRole(roleModel);
        return userModel;

    }

The exception is happening when adding the "user" role and the realm this
user is trying to add has role 'user' when i don't add the user role web
application is redirected to keycloak web page for adding the user ....

Realm containing the user role also there are no existing users fin the
realm

[image: Screen Shot 2019-07-01 at 4.46.39 PM.png]




Newbie to Keycloak. Appreciate the community guidance in resolving the
issue please.


Thanks,
Aditya
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Screen Shot 2019-07-01 at 4.46.39 PM.png
Type: image/png
Size: 45716 bytes
Desc: not available
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20190701/c54583f4/attachment-0001.png 

From shivaprasadtp8 at gmail.com  Tue Jul  2 03:18:29 2019
From: shivaprasadtp8 at gmail.com (Shiva Prasad Thagadur Prakash)
Date: Tue, 2 Jul 2019 10:18:29 +0300
Subject: [keycloak-user] [keycloak-users] [jackson-databind] is default
	typing enabled in keycloak
Message-ID: <CAJsjk3aCQa5e4anQnEEGsijygWcFOH1ajmde6syKwdErdw2ZEg@mail.gmail.com>

Hi guys,
I was looking into CVE-2019-12814 and CVE-2019-12086. These are related to
default typing in jackson-databind. *Is default typing enabled in keylock?*
When I searched in code base I didn't see it enabled but I wanted to be
sure and hence mailed you guys!

Thanks,
Shiva

From craig at baseventure.com  Tue Jul  2 08:32:28 2019
From: craig at baseventure.com (Craig Setera)
Date: Tue, 2 Jul 2019 07:32:28 -0500
Subject: [keycloak-user] Reset credentials link without tab_id parameter
Message-ID: <CAPVdwjrsTYYVdva5GmZ7eO8s7SivW6zLkgkbgror_iXxTjnpog@mail.gmail.com>

We have a need to jump into the reset credentials flow from outside the
Keycloak login page.  When initiating from the login page, the URL looks
like the following:

https://keycloak-host/auth/realms/fm/login-actions/reset-credentials?client_id=my-client-id&tab_id=NH3L9bohxcU
<http://keycloak:8080/auth/realms/fm/login-actions/reset-credentials?client_id=bv-fund-mgr&tab_id=NH3L9bohxcU>

However, when initiating the forgotten password flow, we don't have access
to the tab_id, so we have been using:

https://keycloak-host/auth/realms/fm/login-actions/reset-credentials?client_id=my-client-id
<http://keycloak:8080/auth/realms/fm/login-actions/reset-credentials?client_id=bv-fund-mgr&tab_id=NH3L9bohxcU>

While this works to change the password, it ends up resulting with the
account management user interface at the end, and saving from there causes
an internal server error.  The user-facing results are definitely not
ideal.  Is there any way to make this work properly if not launching from
the login page?  I don't see anything in the Javascript adapter
documentation relative to reset credentials flow, so I don't know if there
is any way to form that URL?

Any help appreciated.
Craig

=================================
*Craig Setera*
*Chief Technology Officer*

From kyriakos.stefanidis at fokus.fraunhofer.de  Tue Jul  2 08:32:59 2019
From: kyriakos.stefanidis at fokus.fraunhofer.de (Stefanidis, Kyriakos)
Date: Tue, 2 Jul 2019 12:32:59 +0000
Subject: [keycloak-user] obtaining RTP by resource name
In-Reply-To: <CAJrcDBfHAjPCj5qKPHohEqTdWz2D_BeTN4Qovcno-A33K6eiqw@mail.gmail.com>
References: <2846dd01201f4d3ea6fd9d731cfc9884@fokus.fraunhofer.de>
	<CAJrcDBfHAjPCj5qKPHohEqTdWz2D_BeTN4Qovcno-A33K6eiqw@mail.gmail.com>
Message-ID: <8645abf6a1d14f7395f06c2abe28c6b5@fokus.fraunhofer.de>

So, if I understand right:

Regarding user managed resources
Regarding RTP requests without ticket

Owner of a resource:
- Can get RTP for a resource by ID
- Can get RTP for a resource by Name
- Can get RTP for all resources (including the specific resource)

User with access rights to a resource given by the owner:
- Can get RTP for a resource by ID
- Can get RTP for all resources (including the specific resource)

Why is only the request by name not permitted?

Kyriakos Stefanidis


From: Pedro Igor Silva <psilva at redhat.com>
Sent: 24 June 2019 15:12
To: Stefanidis, Kyriakos <kyriakos.stefanidis at fokus.fraunhofer.de>
Cc: keycloak-user at lists.jboss.org
Subject: Re: [keycloak-user] obtaining RTP by resource name

Hi,

You should be able to obtain a user-owned resource by name if the bearer token is referencing the owner as the subject. Which version of Keycloak are you using?

I did not find any specific test for this but adding one that does exactly what you described (I can be missing something though) it works as expected.

On Fri, Jun 21, 2019 at 10:32 AM Stefanidis, Kyriakos <kyriakos.stefanidis at fokus.fraunhofer.de<mailto:kyriakos.stefanidis at fokus.fraunhofer.de>> wrote:
Hello all,
...more specifically people that use keycloak authorization services.

While dealing with RTPs (without permission tickets) for both user and centrally managed resources we encountered an inconsistent behavior and would like to know if it is considered a bug or works as intended (and why)

The story:

When a resource is owned by the resource provider (a client), you can get a RTP by providing either the resource id (uuid) or the resource name in the "permissions" parameter.

Ex.
"res1" is owned by "client.id<http://client.id>" and given "update" scope permission to user "usr" via policy/permission combo
$TOKEN is the access token for user "usr"
curl -X POST \
  https://something/auth/realms/something/protocol/openid-connect/token \
  -H "Authorization: Bearer $TOKEN" \
  --data "grant_type=urn:ietf:params:oauth:grant-type:uma-ticket" \
  --data "audience=client.id<http://client.id>" \
  --data "permission=res1.id#scope<http://res1.id#scope>" //correct RTP with "update" for "res1"
OR
  --data "permission=res1.name#scope<http://res1.name#scope>" //correct RTP with "update" for "res1"


When a resource is owned by a user, you can only get a RTP by providing the resource id (uuid) in the "permission" parameter. Requesting by name returns an "Resource with id [res2.name<http://res2.name>] does not exist."

Ex.
"res2" is owned by "usr" and has an "update" scope
$TOKEN is the access token for user "usr"

curl -X POST \
  https://something/auth/realms/something/protocol/openid-connect/token \
  -H "Authorization: Bearer $TOKEN" \
  --data "grant_type=urn:ietf:params:oauth:grant-type:uma-ticket" \
  --data "audience=client.id<http://client.id>" \
  --data "permission=res2.id#scope<http://res2.id#scope>" //correct RTP with "update" for "res1"
OR
  --data "permission=res2.name#scope<http://res2.name#scope>" //"Resource with id [res2.name<http://res2.name>] does not exist."

The interesting thing is that If you request a RTP without specific "permission" property, keycloak returns the correct RTP with "update" for both res1 and res2 as it should.

Our tests also shown that this behavior does not rely on the "user managed" property but only the "owner" property

Is this supposed to happen?
If yes, why?
If no, which one of the two is the buggy behavior? The behavior for the user owned or the client owned resource?

The main reason for this email is that the fact that you can obtain RTP based on resource name is immensely helpful for us since the other clients (other than the resource provider) cannot get the resource id from keycloak but they do know what they are looking for (the resource name). Not being able to get RTP based on resource name for user owned resources, forces us to use a generic RTP for all resources every time which could become a burden if a user can access a very large number of resources.

Best regards,
Kyriakos Stefanidis
_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user

From psilva at redhat.com  Tue Jul  2 09:08:03 2019
From: psilva at redhat.com (Pedro Igor Silva)
Date: Tue, 2 Jul 2019 10:08:03 -0300
Subject: [keycloak-user] obtaining RTP by resource name
In-Reply-To: <8645abf6a1d14f7395f06c2abe28c6b5@fokus.fraunhofer.de>
References: <2846dd01201f4d3ea6fd9d731cfc9884@fokus.fraunhofer.de>
	<CAJrcDBfHAjPCj5qKPHohEqTdWz2D_BeTN4Qovcno-A33K6eiqw@mail.gmail.com>
	<8645abf6a1d14f7395f06c2abe28c6b5@fokus.fraunhofer.de>
Message-ID: <CAJrcDBeZar43ZE9fERNOMLK1yPX-HCpoLr42Y-65eaexwW1sbw@mail.gmail.com>

You got it right. And sorry for not understanding that you are talking
about accessing "shared" resources, where the resource was granted by the
owner to a different user and you want to obtain permissions for this
resource as the user.

We changed this behavior as you can see here
https://issues.jboss.org/browse/KEYCLOAK-10020. Could you check if that
JIRA describes your problem? Also, if you can achieve what you want using
the latest version of Keycloak?

Regards.
Pedro Igor

On Tue, Jul 2, 2019 at 9:34 AM Stefanidis, Kyriakos <
kyriakos.stefanidis at fokus.fraunhofer.de> wrote:

> So, if I understand right:
>
>
>
> Regarding user managed resources
>
> Regarding RTP requests without ticket
>
>
>
> Owner of a resource:
>
> - Can get RTP for a resource by ID
>
> - Can get RTP for a resource by Name
>
> - Can get RTP for all resources (including the specific resource)
>

>
> User with access rights to a resource given by the owner:
>
> - Can get RTP for a resource by ID
>
> - Can get RTP for all resources (including the specific resource)
>
>
>
> Why is only the request by name not permitted?
>
>
>
> Kyriakos Stefanidis
>
>
>
>
>
> *From:* Pedro Igor Silva <psilva at redhat.com>
> *Sent:* 24 June 2019 15:12
> *To:* Stefanidis, Kyriakos <kyriakos.stefanidis at fokus.fraunhofer.de>
> *Cc:* keycloak-user at lists.jboss.org
> *Subject:* Re: [keycloak-user] obtaining RTP by resource name
>
>
>
> Hi,
>
>
>
> You should be able to obtain a user-owned resource by name if the bearer
> token is referencing the owner as the subject. Which version of Keycloak
> are you using?
>
>
>
> I did not find any specific test for this but adding one that does exactly
> what you described (I can be missing something though) it works as expected.
>
>
>
> On Fri, Jun 21, 2019 at 10:32 AM Stefanidis, Kyriakos <
> kyriakos.stefanidis at fokus.fraunhofer.de> wrote:
>
> Hello all,
> ...more specifically people that use keycloak authorization services.
>
> While dealing with RTPs (without permission tickets) for both user and
> centrally managed resources we encountered an inconsistent behavior and
> would like to know if it is considered a bug or works as intended (and why)
>
> The story:
>
> When a resource is owned by the resource provider (a client), you can get
> a RTP by providing either the resource id (uuid) or the resource name in
> the "permissions" parameter.
>
> Ex.
> "res1" is owned by "client.id" and given "update" scope permission to
> user "usr" via policy/permission combo
> $TOKEN is the access token for user "usr"
> curl -X POST \
>   https://something/auth/realms/something/protocol/openid-connect/token \
>   -H "Authorization: Bearer $TOKEN" \
>   --data "grant_type=urn:ietf:params:oauth:grant-type:uma-ticket" \
>   --data "audience=client.id" \
>   --data "permission=res1.id#scope" //correct RTP with "update" for "res1"
> OR
>   --data "permission=res1.name#scope" //correct RTP with "update" for
> "res1"
>
>
> When a resource is owned by a user, you can only get a RTP by providing
> the resource id (uuid) in the "permission" parameter. Requesting by name
> returns an "Resource with id [res2.name] does not exist."
>
> Ex.
> "res2" is owned by "usr" and has an "update" scope
> $TOKEN is the access token for user "usr"
>
> curl -X POST \
>   https://something/auth/realms/something/protocol/openid-connect/token \
>   -H "Authorization: Bearer $TOKEN" \
>   --data "grant_type=urn:ietf:params:oauth:grant-type:uma-ticket" \
>   --data "audience=client.id" \
>   --data "permission=res2.id#scope" //correct RTP with "update" for "res1"
> OR
>   --data "permission=res2.name#scope" //"Resource with id [res2.name]
> does not exist."
>
> The interesting thing is that If you request a RTP without specific
> "permission" property, keycloak returns the correct RTP with "update" for
> both res1 and res2 as it should.
>
> Our tests also shown that this behavior does not rely on the "user
> managed" property but only the "owner" property
>
> Is this supposed to happen?
>
> If yes, why?
>
> If no, which one of the two is the buggy behavior? The behavior for the
> user owned or the client owned resource?
>
> The main reason for this email is that the fact that you can obtain RTP
> based on resource name is immensely helpful for us since the other clients
> (other than the resource provider) cannot get the resource id from keycloak
> but they do know what they are looking for (the resource name). Not being
> able to get RTP based on resource name for user owned resources, forces us
> to use a generic RTP for all resources every time which could become a
> burden if a user can access a very large number of resources.
>
> Best regards,
> Kyriakos Stefanidis
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
>

From kyriakos.stefanidis at fokus.fraunhofer.de  Tue Jul  2 09:11:13 2019
From: kyriakos.stefanidis at fokus.fraunhofer.de (Stefanidis, Kyriakos)
Date: Tue, 2 Jul 2019 13:11:13 +0000
Subject: [keycloak-user] obtaining RTP by resource name
In-Reply-To: <CAJrcDBeZar43ZE9fERNOMLK1yPX-HCpoLr42Y-65eaexwW1sbw@mail.gmail.com>
References: <2846dd01201f4d3ea6fd9d731cfc9884@fokus.fraunhofer.de>
	<CAJrcDBfHAjPCj5qKPHohEqTdWz2D_BeTN4Qovcno-A33K6eiqw@mail.gmail.com>
	<8645abf6a1d14f7395f06c2abe28c6b5@fokus.fraunhofer.de>
	<CAJrcDBeZar43ZE9fERNOMLK1yPX-HCpoLr42Y-65eaexwW1sbw@mail.gmail.com>
Message-ID: <5514158e3f49432c8233c72814e02936@fokus.fraunhofer.de>

Aha. It seems fixed in 6.0.0 and we are still using 4.8.3.Final
Time for an upgrade!

Thanks for all the help ?

Kyriakos Stefanidis


From: Pedro Igor Silva <psilva at redhat.com>
Sent: 02 July 2019 15:08
To: Stefanidis, Kyriakos <kyriakos.stefanidis at fokus.fraunhofer.de>
Cc: keycloak-user at lists.jboss.org
Subject: Re: [keycloak-user] obtaining RTP by resource name

You got it right. And sorry for not understanding that you are talking about accessing "shared" resources, where the resource was granted by the owner to a different user and you want to obtain permissions for this resource as the user.

We changed this behavior as you can see here https://issues.jboss.org/browse/KEYCLOAK-10020. Could you check if that JIRA describes your problem? Also, if you can achieve what you want using the latest version of Keycloak?

Regards.
Pedro Igor

On Tue, Jul 2, 2019 at 9:34 AM Stefanidis, Kyriakos <kyriakos.stefanidis at fokus.fraunhofer.de<mailto:kyriakos.stefanidis at fokus.fraunhofer.de>> wrote:
So, if I understand right:

Regarding user managed resources
Regarding RTP requests without ticket

Owner of a resource:
- Can get RTP for a resource by ID
- Can get RTP for a resource by Name
- Can get RTP for all resources (including the specific resource)

User with access rights to a resource given by the owner:
- Can get RTP for a resource by ID
- Can get RTP for all resources (including the specific resource)

Why is only the request by name not permitted?

Kyriakos Stefanidis


From: Pedro Igor Silva <psilva at redhat.com<mailto:psilva at redhat.com>>
Sent: 24 June 2019 15:12
To: Stefanidis, Kyriakos <kyriakos.stefanidis at fokus.fraunhofer.de<mailto:kyriakos.stefanidis at fokus.fraunhofer.de>>
Cc: keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>
Subject: Re: [keycloak-user] obtaining RTP by resource name

Hi,

You should be able to obtain a user-owned resource by name if the bearer token is referencing the owner as the subject. Which version of Keycloak are you using?

I did not find any specific test for this but adding one that does exactly what you described (I can be missing something though) it works as expected.

On Fri, Jun 21, 2019 at 10:32 AM Stefanidis, Kyriakos <kyriakos.stefanidis at fokus.fraunhofer.de<mailto:kyriakos.stefanidis at fokus.fraunhofer.de>> wrote:
Hello all,
...more specifically people that use keycloak authorization services.

While dealing with RTPs (without permission tickets) for both user and centrally managed resources we encountered an inconsistent behavior and would like to know if it is considered a bug or works as intended (and why)

The story:

When a resource is owned by the resource provider (a client), you can get a RTP by providing either the resource id (uuid) or the resource name in the "permissions" parameter.

Ex.
"res1" is owned by "client.id<http://client.id>" and given "update" scope permission to user "usr" via policy/permission combo
$TOKEN is the access token for user "usr"
curl -X POST \
  https://something/auth/realms/something/protocol/openid-connect/token \
  -H "Authorization: Bearer $TOKEN" \
  --data "grant_type=urn:ietf:params:oauth:grant-type:uma-ticket" \
  --data "audience=client.id<http://client.id>" \
  --data "permission=res1.id#scope<http://res1.id#scope>" //correct RTP with "update" for "res1"
OR
  --data "permission=res1.name#scope<http://res1.name#scope>" //correct RTP with "update" for "res1"


When a resource is owned by a user, you can only get a RTP by providing the resource id (uuid) in the "permission" parameter. Requesting by name returns an "Resource with id [res2.name<http://res2.name>] does not exist."

Ex.
"res2" is owned by "usr" and has an "update" scope
$TOKEN is the access token for user "usr"

curl -X POST \
  https://something/auth/realms/something/protocol/openid-connect/token \
  -H "Authorization: Bearer $TOKEN" \
  --data "grant_type=urn:ietf:params:oauth:grant-type:uma-ticket" \
  --data "audience=client.id<http://client.id>" \
  --data "permission=res2.id#scope<http://res2.id#scope>" //correct RTP with "update" for "res1"
OR
  --data "permission=res2.name#scope<http://res2.name#scope>" //"Resource with id [res2.name<http://res2.name>] does not exist."

The interesting thing is that If you request a RTP without specific "permission" property, keycloak returns the correct RTP with "update" for both res1 and res2 as it should.

Our tests also shown that this behavior does not rely on the "user managed" property but only the "owner" property

Is this supposed to happen?
If yes, why?
If no, which one of the two is the buggy behavior? The behavior for the user owned or the client owned resource?

The main reason for this email is that the fact that you can obtain RTP based on resource name is immensely helpful for us since the other clients (other than the resource provider) cannot get the resource id from keycloak but they do know what they are looking for (the resource name). Not being able to get RTP based on resource name for user owned resources, forces us to use a generic RTP for all resources every time which could become a burden if a user can access a very large number of resources.

Best regards,
Kyriakos Stefanidis
_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user

From Ondrej.Scerba at zoomint.com  Tue Jul  2 10:13:15 2019
From: Ondrej.Scerba at zoomint.com (Ondrej Scerba)
Date: Tue, 2 Jul 2019 14:13:15 +0000
Subject: [keycloak-user] Is it possible to invalidate token in Spring
 Security Adapter
In-Reply-To: <CAJrcDBfVGUmMSSF3x1j=HpWXu_z=oJeBP1M0Qaz2ZbO_OVGE1A@mail.gmail.com>
References: <71b6316ae93141b9ae7cde41d8e19f7f@zoomint.com>
	<CAJrcDBfVGUmMSSF3x1j=HpWXu_z=oJeBP1M0Qaz2ZbO_OVGE1A@mail.gmail.com>
Message-ID: <53badc397b8143bb860d9a1c8469ddcc@zoomint.com>

Hi,

Is there any example available, how can be remote introspection implemented with Keycloak Spring Security Adapter?

Thanks,
Ondrej

From: Pedro Igor Silva <psilva at redhat.com>
Sent: Thursday, June 27, 2019 14:43
To: Ondrej Scerba <Ondrej.Scerba at zoomint.com>
Cc: keycloak-user at lists.jboss.org
Subject: Re: [keycloak-user] Is it possible to invalidate token in Spring Security Adapter

Hi,

If you are using bearer tokens, the adapter only performs local validation based on a specific set of claims and signature. If you need to revoke tokens and propagate the revocation to your resource servers, you should consider introspecting the token using the token introspection endpoint.

However, our adapters don't provide the support for choosing between local/remote introspection. Local introspection and validation are enough for most people but depending on your requirements/constraints you may want to use the introspection endpoint.

Regards.
Pedro Igor

On Thu, Jun 27, 2019 at 8:51 AM Ondrej Scerba <Ondrej.Scerba at zoomint.com<mailto:Ondrej.Scerba at zoomint.com>> wrote:
Hi,

Is it possible to invalidate token in "offline validator" in Spring Security Adapater?

Thanks,
Ondrej

_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user

From psilva at redhat.com  Tue Jul  2 10:27:58 2019
From: psilva at redhat.com (Pedro Igor Silva)
Date: Tue, 2 Jul 2019 11:27:58 -0300
Subject: [keycloak-user] Is it possible to invalidate token in Spring
 Security Adapter
In-Reply-To: <53badc397b8143bb860d9a1c8469ddcc@zoomint.com>
References: <71b6316ae93141b9ae7cde41d8e19f7f@zoomint.com>
	<CAJrcDBfVGUmMSSF3x1j=HpWXu_z=oJeBP1M0Qaz2ZbO_OVGE1A@mail.gmail.com>
	<53badc397b8143bb860d9a1c8469ddcc@zoomint.com>
Message-ID: <CAJrcDBeKeDWJGjbOjpuQ62nbb4S-m26Z_PYfDrjxhvkGEzSaaw@mail.gmail.com>

Hi,

More details here
https://www.keycloak.org/docs/latest/securing_apps/index.html#_token_introspection_endpoint
and
here https://tools.ietf.org/html/rfc7662#section-2.1. It is basically an
HTTP request to the introspection endpoint where you pass the token you
want to introspect and some credentials/bearer token so that the client
(your app) making the request can be authenticated.

On Tue, Jul 2, 2019 at 11:22 AM Ondrej Scerba <Ondrej.Scerba at zoomint.com>
wrote:

> Hi,
>
>
>
> Is there any example available, how can be remote introspection
> implemented with Keycloak Spring Security Adapter?
>
> Thanks,
> Ondrej
>
>
>
> *From:* Pedro Igor Silva <psilva at redhat.com>
> *Sent:* Thursday, June 27, 2019 14:43
> *To:* Ondrej Scerba <Ondrej.Scerba at zoomint.com>
> *Cc:* keycloak-user at lists.jboss.org
> *Subject:* Re: [keycloak-user] Is it possible to invalidate token in
> Spring Security Adapter
>
>
>
> Hi,
>
>
>
> If you are using bearer tokens, the adapter only performs local validation
> based on a specific set of claims and signature. If you need to revoke
> tokens and propagate the revocation to your resource servers, you should
> consider introspecting the token using the token introspection endpoint.
>
>
>
> However, our adapters don't provide the support for choosing between
> local/remote introspection. Local introspection and validation are enough
> for most people but depending on your requirements/constraints you may want
> to use the introspection endpoint.
>
>
>
> Regards.
>
> Pedro Igor
>
>
>
> On Thu, Jun 27, 2019 at 8:51 AM Ondrej Scerba <Ondrej.Scerba at zoomint.com>
> wrote:
>
> Hi,
>
> Is it possible to invalidate token in "offline validator" in Spring
> Security Adapater?
>
> Thanks,
> Ondrej
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
>

From Rob.Resendez at cpsi.com  Tue Jul  2 12:52:24 2019
From: Rob.Resendez at cpsi.com (Rob Resendez)
Date: Tue, 2 Jul 2019 16:52:24 +0000
Subject: [keycloak-user] Alternative first broker login for linking only
Message-ID: <3cbacd7bbad74f42937da231ef23b5bf@cpsi.com>

We have a use case that is sort of a hybrid of the typical IDP login (First Broker Login) and "linking only" via the UMA app.  That is to say, we'd like the login form to enumerate IDP buttons, but instead of falling into "Create User If Unique" execution, we would need to fall into some flow similar to the "Handle Existing Account" merge/link process.

Can anyone advise whether there are existing executions I can compose or ought to consult in some way?

Thanks in advance


Rob Resendez

[cid:CPSINew_8e504092-fab6-4ce3-ab1f-37d711ec8192.PNG]<https://www.cpsi.com/>

Electronic Mail Confidentiality Notice:
This electronic mail message and all attachments may contain confidential information belonging to the sender or the intended recipient. This information is intended ONLY for the use of the individual or entity named above. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution (electronic or otherwise), forwarding or taking any action in reliance on the contents of this information is strictly prohibited.  If you have received this electronic transmission in error, please immediately notify the sender by telephone, facsimile, or email to arrange for the return of the electronic mail, attachments, or documents.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: CPSINew_8e504092-fab6-4ce3-ab1f-37d711ec8192.PNG
Type: image/png
Size: 9997 bytes
Desc: CPSINew_8e504092-fab6-4ce3-ab1f-37d711ec8192.PNG
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20190702/ecb59e8a/attachment.png 

From chris.smith at cmfirstgroup.com  Tue Jul  2 15:42:32 2019
From: chris.smith at cmfirstgroup.com (Chris Smith)
Date: Tue, 2 Jul 2019 19:42:32 +0000
Subject: [keycloak-user] SQL Server integrated authorization
Message-ID: <CY4PR22MB024819DCDBCD853E541C99ED98F80@CY4PR22MB0248.namprd22.prod.outlook.com>

My keycloak instance is planned to use SQL Server for its database.
It will be running on a Windows Server in an Active Directory domain
I'd like to not embed the User/Password in the standalone.xml file.
To enable this, the driver requires a windows dll to perform the db connection authentication.

So, I'm looking for the best way to accomplish this.

I'd rather not add -Djava.library.path=<path to folder> as a parameter when invoking standalone.bat

Is there a way to configure it in the module created for the JDBC driver jar?


From sven.voigt at gmail.com  Tue Jul  2 15:55:52 2019
From: sven.voigt at gmail.com (Sven Voigt)
Date: Tue, 02 Jul 2019 19:55:52 +0000
Subject: [keycloak-user] Setup of role model with two layers in keycloak
Message-ID: <em1dc9bbcb-ec86-4a27-90e3-9e178c661e47@photon>

Hello there!

I'm part of a frontend project and I need some help to bring our 
authorization model into keycloak. We're building on node.js and the 
whole project uses stateless micro services - both in our frontend 
middleware and for the whole backend services we use. The frontend uses 
the standard JS adapter for session and token management.

So far we have identified four roles: travel agent, back office, 
configurator and data security officer. That's easy so far. My problem 
is how to model the next authorization layer we need.

For example: For the travel agents we want to be able to grant per 
person whether he can see specific customer data or is able to cancel 
orders. There are about 6-8 options for the travel agents. Thus, for the 
back office there shall be options for stock operations or different 
views on orders and so on.

Like the backend we don't persist any data! That's why I have store all 
the things in keycloak and find a way to easily bring these information 
back to our middleware.

Here's what I tried / thought of so far:
* Use groups for the first layer and roles for the second one. --> 
doesn't work because the groups don't get exposed in the token.
* Use realm roles for the upper and attributes for the lower hierarchy. 
--> attributes are not included in the access token.
* Use realm roles for the upper and client roles on the lower hierarchy. 
--> works, but we have to make sure that roles on the second layer are 
definitely associated with only one role on the first layer. I don't 
know how yet.
* Use roles for the first layer and resources on the second one. --> 
That seems to get very close to what we need. But at the moment I can't 
figure out the correct approach with all these policies and 
permissions...

Thanks for any help and please let me know, if I shall provide some 
further information.

Sven



From hossein.doutaghy at gmail.com  Tue Jul  2 16:22:26 2019
From: hossein.doutaghy at gmail.com (Hossein Doutaghy)
Date: Tue, 2 Jul 2019 16:22:26 -0400
Subject: [keycloak-user] Is communication between keycloak instances and the
 distributed infinispan caches secure ?
Message-ID: <CAMuSSiNPo0jawHUrd09knDQJVoML9P0VDSRQjZ1s1ynEBR77Fg@mail.gmail.com>

Hi,

Does it use TLS to encrypt data sync between Keycloak instances when the
Infinispan caches are synced?

Does those caches contain sensitive data?

There does not seem to be much documentation that indicates the
communication between keycloak and the distributed infinispan caches is
secure.


Moe Doutaghy

From corentin.dupont at gmail.com  Tue Jul  2 16:28:21 2019
From: corentin.dupont at gmail.com (Corentin Dupont)
Date: Tue, 2 Jul 2019 22:28:21 +0200
Subject: [keycloak-user] resource ids
In-Reply-To: <CAJrcDBf=y3XWZUjoFN2VY9bj0Addj20oekWqFjiwJw6FhAbiEg@mail.gmail.com>
References: <CAEyhvmpV0Xj2CgUkwnKACdUQDE0MxxZaPZTsV54i6kkW3fmLuQ@mail.gmail.com>
	<CAJrcDBf=y3XWZUjoFN2VY9bj0Addj20oekWqFjiwJw6FhAbiEg@mail.gmail.com>
Message-ID: <CAEyhvmpFvDAESjZNk9hpD8LOvyziBREbimCn2kk_y5HDzKoE-g@mail.gmail.com>

Hi Pedro,
What I wondered is why the name (beside the ID) should be unique?
Regarding type, my point was that in my app resources with different types
can have the same ID.

On Thu, Jun 27, 2019 at 2:53 PM Pedro Igor Silva <psilva at redhat.com> wrote:

> Hi Corentin,
>
> One of the main reasons to allow setting the ID is to make easier to map
> resources managed by Keycloak to those you are protecting in your app.
>
> The IDs must be unique.
>
> It is not clear to me why the type is not enough?
>
> On Thu, Jun 27, 2019 at 5:28 AM Corentin Dupont <corentin.dupont at gmail.com>
> wrote:
>
>> Hi guys,
>> I discovered that you can provide your own id when creating resources:
>>
>> curl -X POST "
>> http://localhost:8080/auth/realms/waziup/authz/protection/resource_set"
>> -H
>> "Authorization: Bearer $CLIENTTOKEN" -H "Content-Type: application/json"
>> -d
>> '{*"_id": "123-456"*, "type": "test", "name":"test",
>>
>> "scopes":["sensors:create","sensors:view","sensors:update","sensors:delete"],"owner":"cdupont",
>> "ownerManagedAccess": true}'
>>
>> This is very practical for synchronizing the resources with my own
>> database.
>> After some investigation, I found:
>> - the ID should be unique
>> - the name should be unique
>>
>> Is that correct? The resource type is not used in the unicity.
>> In my application database, resources with different types are stored in
>> different collections, so two resources with different types *can* have
>> the
>> same ID.
>> How do you suggest to solve this in Keycloak? Providing a keycloak ID of
>> the form <type>-<ID> for example? e.g. sensor-123 and project-123 would
>> not
>> collide.
>>
>> Cheers
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>

From davidkarlsen at gmail.com  Tue Jul  2 16:37:12 2019
From: davidkarlsen at gmail.com (David Karlsen)
Date: Tue, 2 Jul 2019 22:37:12 +0200
Subject: [keycloak-user] Wrong redirect url from KK
In-Reply-To: <CAGO7Ob3MSnB6ObUWrCmVDAXS8TVtpCM5xMB6Uerse5vFR2-vgw@mail.gmail.com>
References: <CAGO7Ob3MSnB6ObUWrCmVDAXS8TVtpCM5xMB6Uerse5vFR2-vgw@mail.gmail.com>
Message-ID: <CAGO7Ob1mJ67rMLOB4uvvZHPQgca4T6FVEFvt1hCw_A4fi8JYRQ@mail.gmail.com>

No-one experienced this? Should report a bug?

s?n. 30. jun. 2019 kl. 20:25 skrev David Karlsen <davidkarlsen at gmail.com>:

> I do IDP logon with request to redirect to
> https://myhost.mydomain/somecontext/#/login
>
> but the redirect received is:
>
> https://myhost.mydomain/somecontext/?code=somecode&state=somestate#/login
>
> notice how the fragment comes at the end, and the parameters in-between.
> Is this a known issue?  I would guess it is quite common for angular-apps
> to want to be redirected back into a well known route.
>
> --
> --
> David J. M. Karlsen - http://www.linkedin.com/in/davidkarlsen
>


-- 
--
David J. M. Karlsen - http://www.linkedin.com/in/davidkarlsen

From orivat at janua.fr  Wed Jul  3 02:56:11 2019
From: orivat at janua.fr (Rivat Olivier)
Date: Wed, 3 Jul 2019 08:56:11 +0200
Subject: [keycloak-user] Keycloak demo 6.0.0
In-Reply-To: <bfd5aba3-6850-e89b-0715-75fc2f409b55@hopu.eu>
References: <bfd5aba3-6850-e89b-0715-75fc2f409b55@hopu.eu>
Message-ID: <927fd4f8-bcaf-c178-d38b-9cded44203f8@janua.fr>

Hi Felipe,

You may find the authenticator examples in the 4.7? keycloak github
https://github.com/keycloak/keycloak/tree/4.7.0.Final/examples/providers

Regards,

Olivier Rivat



<http://www.janua.fr/images/logo-big-sans.png><http://www.janua.fr/images/LogoSignature.gif>

	<http://www.janua.fr/images/6g_top.gif>
	
Olivier Rivat
CTO
orivat at janua.fr <mailto:dchikhaoui at janua.fr>
Gsm: +33(0)682 801 609
T?l: +33(0)489 829 238
Fax: +33(0)955 260 370
http://www.janua.fr <http://www.janua.fr/>
	<http://www.janua.fr/images/6g_top.gif>

Le 01/07/2019 ? 16:17, Felipe Roca a ?crit?:
> Hi,
>
> I am trying to set up the example in Server development - 8.3
> Authenticator SPI Walk Through, the implementation of an authenticator
> that requires that a user enter in the answer to a secret question.
>
> The documentation assures this code is available in
> examples/providers/authenticator but it is not in the github repository
> and I can't find the keycloak-demo-6.0.0.[zip|tar.gz], where I assume
> this code may be.
>
> Could anyone point me to the url to download this version of
> distribution files?
>
> Thank you very much for your time and efforts,
> Best regards,
>

From orivat at janua.fr  Wed Jul  3 02:56:32 2019
From: orivat at janua.fr (Rivat Olivier)
Date: Wed, 3 Jul 2019 08:56:32 +0200
Subject: [keycloak-user] Keycloak demo 6.0.0
In-Reply-To: <bfd5aba3-6850-e89b-0715-75fc2f409b55@hopu.eu>
References: <bfd5aba3-6850-e89b-0715-75fc2f409b55@hopu.eu>
Message-ID: <e80c5b4f-649f-5dfb-0f96-20ca13e34ccd@janua.fr>

Hi Felipe,

You may find the authenticator examples in the 4.7? keycloak github
https://github.com/keycloak/keycloak/tree/4.7.0.Final/examples/providers

Regards,

Olivier Rivat



<http://www.janua.fr/images/logo-big-sans.png><http://www.janua.fr/images/LogoSignature.gif>

	<http://www.janua.fr/images/6g_top.gif>
	
Olivier Rivat
CTO
orivat at janua.fr <mailto:dchikhaoui at janua.fr>
Gsm: +33(0)682 801 609
T?l: +33(0)489 829 238
Fax: +33(0)955 260 370
http://www.janua.fr <http://www.janua.fr/>
	<http://www.janua.fr/images/6g_top.gif>

Le 01/07/2019 ? 16:17, Felipe Roca a ?crit?:
> Hi,
>
> I am trying to set up the example in Server development - 8.3
> Authenticator SPI Walk Through, the implementation of an authenticator
> that requires that a user enter in the answer to a secret question.
>
> The documentation assures this code is available in
> examples/providers/authenticator but it is not in the github repository
> and I can't find the keycloak-demo-6.0.0.[zip|tar.gz], where I assume
> this code may be.
>
> Could anyone point me to the url to download this version of
> distribution files?
>
> Thank you very much for your time and efforts,
> Best regards,
>

From blazej.adamczyk at gmail.com  Wed Jul  3 03:42:21 2019
From: blazej.adamczyk at gmail.com (=?UTF-8?Q?B=C5=82a=C5=BCej?= Adamczyk)
Date: Wed, 03 Jul 2019 09:42:21 +0200
Subject: [keycloak-user] User Storage SPI/LDAP Provider and groups
Message-ID: <1562139741.5532.0.camel@gmail.com>

Hi all,?

I want to extend user AND GROUP scheme with my own custom attributes
and data model to fit it to the use case.

I see several options here:
1) Extend the existing Keycloak entities with custom attributes (very
simple, but the attribute bag pattern seems to generic here?)?
2) Use the User Storage API to map my own user/group entities to
Keycloak (similarily like the quickstart "user-storage-jpa")
???2.1) Use import strategy - this probably would work well but it
seems it is overcomplicating the architecutre (two schemas,
synchronization etc.)
???2.2) Use non-import strategy - this seems more relevant for my need
but I have a need to override not only users but also groups.


And finally the question: 2.2 seems fine but after looking through the
interfaces and looking through the ldap code I'm not sure how groups
are working in federated example when import is off.?

The code seems to relate everywhere to existing keycloak groups, the
only place which I could find the groups are created is in
GroupLDAPStorageMapper (updateKeycloakGroupTree.., and syncDataFrom..
methods). These are called by specific REST sync URL or by the import
strategy (which in 2.2 is off).?

Are the groups somehow automatically created when a group mapper is on
and import off? If so, how is the groups view in console working - is
it showing all LDAP groups? Or just those which were automatically
imported when user groups were accessed?

Also, can you please generally suggest which of the above options (1,
2.1 or 2.2) is better in my scenario and why?


--?
Best regards, 
Blazej Adamczyk

From lists at merit.unu.edu  Wed Jul  3 04:55:22 2019
From: lists at merit.unu.edu (mj)
Date: Wed, 3 Jul 2019 10:55:22 +0200
Subject: [keycloak-user] ldap federation working | test connection /
 authentication buttons failing
Message-ID: <bf52ffb4-d945-71a1-963e-a21e40d5c8ba@merit.unu.edu>

Hi,

Keycloak 6.0.1, LDAP federation is working, users can logon and are 
updated automatically regularly from ldap:

> 2019-07-02 17:39:49,761 INFO  [org.keycloak.storage.ldap.LDAPStorageProviderFactory] (Timer-2) Sync changed users from LDAP to local store: realm: our_realm, federation provider: our_realm-ad, last sync time: Mon Jul 01 17:39:43 CEST > 2019-07-02 17:39:50,067 INFO  [org.keycloak.storage.ldap.LDAPStorageProviderFactory] (Timer-2) Sync changed users finished: 3 imported users, 22 updated users

In keycloak, the configured ldap uri is ldap://localhost:389, where a 
haproxy instance is listening that talks ldaps to our DCs.

The 'problem': in the keycloak GUI, the buttons 'Test authentication' 
and 'Test connection' do not work:

"Error! Error when trying to connect to LDAP. See server.log for details."

But nothing logged in server.log, and haproxy does not even log a 
connection attempt at all.

Anyone else seeing this..?

MJ

From lilian.benoit at lbenoit.fr  Wed Jul  3 08:49:43 2019
From: lilian.benoit at lbenoit.fr (Lilian BENOIT)
Date: Wed, 03 Jul 2019 14:49:43 +0200
Subject: [keycloak-user] SQL Server integrated authorization
In-Reply-To: <CY4PR22MB024819DCDBCD853E541C99ED98F80@CY4PR22MB0248.namprd22.prod.outlook.com>
References: <CY4PR22MB024819DCDBCD853E541C99ED98F80@CY4PR22MB0248.namprd22.prod.outlook.com>
Message-ID: <b6404f089cf26e28a3453599dcb5ac65@lbenoit.fr>

Hello Chris,

Best way is defined new module.
Documentation for that is : 
https://www.keycloak.org/docs/latest/server_installation/index.html#package-the-jdbc-driver

LB.

Le 02/07/2019 21:42, Chris Smith a ?crit?:
> My keycloak instance is planned to use SQL Server for its database.
> It will be running on a Windows Server in an Active Directory domain
> I'd like to not embed the User/Password in the standalone.xml file.
> To enable this, the driver requires a windows dll to perform the db
> connection authentication.
> 
> So, I'm looking for the best way to accomplish this.
> 
> I'd rather not add -Djava.library.path=<path to folder> as a parameter
> when invoking standalone.bat
> 
> Is there a way to configure it in the module created for the JDBC 
> driver jar?
> 
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From mah124 at mail.aub.edu  Wed Jul  3 10:47:14 2019
From: mah124 at mail.aub.edu (Mohammad Haj Hussein (Student))
Date: Wed, 3 Jul 2019 14:47:14 +0000
Subject: [keycloak-user] add my email to the list
Message-ID: <DB7PR06MB5480DFD75AE54B9BFF417C73A2FB0@DB7PR06MB5480.eurprd06.prod.outlook.com>

Dear Keycloak,

Please add my email to the list.

Regards,
Mohammad Haj Hussein

From l.lech at ringler.ch  Wed Jul  3 11:15:12 2019
From: l.lech at ringler.ch (Lukasz Lech)
Date: Wed, 3 Jul 2019 15:15:12 +0000
Subject: [keycloak-user] Logging in using REST-API to realm with customized
	browser flow
Message-ID: <5E48B917000C984B86B77170F441903A18A163C1@exch.ringler.ch>

Hello,

I've created custom browser flow with additional 2fa step (based on https://github.com/gwallet/keycloak-sms-authenticator).
If I log in using browser, I'm challenged to enter the code sent by SMS.

However, I was able to log in using REST-API, bypassing the extra security.
Is it some misconfiguration or known behavior?
Custom flow is chosen under Authentication->Bindings.

Best regards,
Lukasz Lech


From Lasse.Jahn at student.hpi.uni-potsdam.de  Wed Jul  3 13:27:36 2019
From: Lasse.Jahn at student.hpi.uni-potsdam.de (Jahn, Lasse)
Date: Wed, 3 Jul 2019 17:27:36 +0000
Subject: [keycloak-user] Permission Handling After Keycloak 4.5.0
Message-ID: <06991864-6F77-4F28-9397-5F067C5020E2@student.hpi.uni-potsdam.de>

Hey everyone,

I'm running Keycloak Server Version 4.5.0.Final according to the dockerfile from jboss shown in the dockerhub [1] with only changed keycloak version. (Took the tools from [2])

During developing I noticed that there is an Endpoint missing that I wanted to use (request a group list which have specific client role, for users this enpoint exists

GET /{realm}/clients/{id}/roles/{role-name}/users

In Keycloak 6.0 this also exists for groups.
GET /{realm}/clients/{id}/roles/{role-name}/groups

So I thought why not migrating to 6.0. After successful upgrade I realized that there is no permission tab?!
I wanted to handle the permissions of a user to be a client admin as explained in the documentation [3] but this was not possible.

I thougth that maybe that the docker image does not include everything, so I downloaded all at the keycloak.org available server distributions and run them via standalone.sh (4.8, 5.0, 6.0) all with the same result, there is no permission Tab ?!

Is the documentation not updated and there is a way to enable the permission tab or how can I fullfill the mentioned scenario (client admin which is allowed to map roles) ?


Regards
Lasse

[1] https://hub.docker.com/r/jboss/keycloak/dockerfile
[2] https://github.com/jboss-dockerfiles/keycloak/tree/4.5.0.Final/server
[3] https://www.keycloak.org/docs/latest/server_admin/index.html#managing-one-specific-client



Viele Gr??e
Lasse Jahn


From bruno at abstractj.org  Wed Jul  3 15:28:00 2019
From: bruno at abstractj.org (Bruno Oliveira)
Date: Wed, 3 Jul 2019 16:28:00 -0300
Subject: [keycloak-user] add my email to the list
In-Reply-To: <DB7PR06MB5480DFD75AE54B9BFF417C73A2FB0@DB7PR06MB5480.eurprd06.prod.outlook.com>
References: <DB7PR06MB5480DFD75AE54B9BFF417C73A2FB0@DB7PR06MB5480.eurprd06.prod.outlook.com>
Message-ID: <CAM5SUC4wB6tnZVmiEbeVyzO=ms-avsyOO9+BCEEyJTkg1VHjPw@mail.gmail.com>

You are already subscribed, otherwise you should not be able to send
e-mail to keycloak-user.

On Wed, Jul 3, 2019 at 11:56 AM Mohammad Haj Hussein (Student)
<mah124 at mail.aub.edu> wrote:
>
> Dear Keycloak,
>
> Please add my email to the list.
>
> Regards,
> Mohammad Haj Hussein
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user



-- 
- abstractj

From thomas.darimont at googlemail.com  Wed Jul  3 19:06:29 2019
From: thomas.darimont at googlemail.com (Thomas Darimont)
Date: Thu, 4 Jul 2019 01:06:29 +0200
Subject: [keycloak-user] Identity First authentication flow and trick for
 extension specific theme resources
Message-ID: <CAK-7U1igY6k+eKUVZO4t6vJZMOgiU_AeTSzn-dTr_cSEkx4VDg@mail.gmail.com>

Hello Keycloak-Users,

I made some progress with a Google-like Identity First authentication flow
and found some interesting tricks that I wanted to share.

In my keycloak-extension-playground repository, I added an example
extension which supports a multi-step Identity first authentication
mechanism as Google and others provide.
See:
https://github.com/thomasdarimont/keycloak-extension-playground/tree/master/auth-identity-first-extension

The authentication flow works as follows:
Instead of asking for username AND password on the login screen I only ask
for the username. A password is then asked in a consecutive step.
This enables additional user-specific authentication steps.
You can find a short demo-gif in this tweet:
https://twitter.com/thomasdarimont/status/1146552622943559682

- The example features two authenticators 'SelectUserAuthenticatorForm' and
'PasswordAuthenticatorForm'.
  SelectUserAuthenticatorForm: Shows a form to enter the username (or
email) and provides a mechanism for resolving a user based on the given
username.
  PasswordAuthenticatorForm: Based on the selected user, a password form is
shown
- The forms are sent asynchronously via AJAX without reloading the login
page
- The authentication process can be aborted/restarted via by clicking
'cancel' on the password form

Now comes a nice trick, I learned while I was looking for a way to ship
custom extension specific js/css/img resources with an authenticator
without(!) having to customize a realm login theme.
As you might now, one can have authenticator/extension specific templates
that are shipped in the extension jar within the 'theme-resources/template'
folder.
This works fine if you can do everything in an .ftl template, but falls
short, when you need extension specific css/js/img.
However, if you also ship a CUSTOM extension specific theme within the
extension, then one can access resources provided by this theme!

In my case:
I created a theme folder with a login theme, named like the extension:
  extension: auth-identity-first-extension
  theme-name: auth-identity-first-extension-theme
The resulting folder structure looks like this:

auth-identity-first-extension/src/main/resources/theme/auth-identity-first-extension-theme/login/resources
The 'resources' folder contains sub-folders for 'js' and 'css' resources
combined with a META-INF/keycloak-themes.json descriptor.

See:
https://github.com/thomasdarimont/keycloak-extension-playground/tree/master/auth-identity-first-extension/src/main/resources/theme/auth-identity-first-extension-theme/login/resources

auth-identity-first-extension/src/main/resources/META-INF/keycloak-themes.json:
    { "themes": [
        {
        "name": "auth-identity-first-extension-theme",
        "types": [ "login"]
        }
    ]}


This allows to refer to the extension specific theme resources from within
a template, e.g. in the 'select-user-form.ftl' template this looks like:
        <link rel="stylesheet"
href="${url.resourcesPath}/../auth-identity-first-extension-theme/css/identity-first.css">
        <script
src="${url.resourcesPath}/../auth-identity-first-extension-theme/js/identity-first.js"
defer></script>

We effectively define a custom theme within the extension jar just for the
sake of exposing extension specific resources.
I know that this feels a bit like a hack (because it is), but seems to work
quite well ;-)

Note that the extension specific theme also shows up within the realm theme
selection, but you can ignore this.

I hope that's useful for you too :)

Cheers,
Thomas

From l.lech at ringler.ch  Thu Jul  4 04:45:29 2019
From: l.lech at ringler.ch (Lukasz Lech)
Date: Thu, 4 Jul 2019 08:45:29 +0000
Subject: [keycloak-user] Disable logging in via REST API
Message-ID: <5E48B917000C984B86B77170F441903A18A16479@exch.ringler.ch>

Hello,

How to disable logging into Keycloak via REST API, without affecting logging in via browser?

Which URLs I need to block?

I have problem finding out that information...

Best regards,
Lukasz Lech


From cedric at couralet.eu  Thu Jul  4 05:15:00 2019
From: cedric at couralet.eu (=?utf-8?q?cedric=40couralet=2Eeu?=)
Date: Thu, 04 Jul 2019 11:15:00 +0200
Subject: [keycloak-user]
 =?utf-8?q?Permission_Handling_After_Keycloak_4=2E?= =?utf-8?b?NS4w?=
In-Reply-To: <06991864-6F77-4F28-9397-5F067C5020E2@student.hpi.uni-potsdam.de>
Message-ID: <37e2-5d1dc380-89-31e10500@254995754>

Le Mercredi, Juillet 03, 2019 19:27 CEST, "Jahn, Lasse" <Lasse.Jahn at student.hpi.uni-potsdam.de> a ?crit: 
 
> Hey everyone,
> 
> I'm running Keycloak Server Version 4.5.0.Final according to the dockerfile from jboss shown in the dockerhub [1] with only changed keycloak version. (Took the tools from [2])
> 
[...]
> Is the documentation not updated and there is a way to enable the permission tab or how can I fullfill the mentioned scenario (client admin which is allowed to map roles) ?
> 

You have to explicitly enable the feature : https://www.keycloak.org/docs/latest/server_installation/index.html#profiles

Basically, to just enable this tab, lauching keycloak with -Dkeycloak.profile.feature.admin_fine_grained_authz=enabled should be enough.

Regards,

C?dric Couralet

> 
> Regards
> Lasse
>



From lists at merit.unu.edu  Thu Jul  4 06:52:21 2019
From: lists at merit.unu.edu (mj)
Date: Thu, 4 Jul 2019 12:52:21 +0200
Subject: [keycloak-user] ldap federation working | test connection /
 authentication buttons failing
In-Reply-To: <bf52ffb4-d945-71a1-963e-a21e40d5c8ba@merit.unu.edu>
References: <bf52ffb4-d945-71a1-963e-a21e40d5c8ba@merit.unu.edu>
Message-ID: <19c1d216-e6a1-6065-541e-1728798e3c32@merit.unu.edu>

Hi,

Off list, someone asked me to check if ldap://127.0.0.1:389 would work 
better than ldap://localhost:389, but it doesn't.

But I am now also trying to fill in actual remote ldap servers, and they 
also don't work. Again nothing at all logged in server.log

Do the test buttons work for others here?

MJ

On 7/3/19 10:55 AM, mj wrote:
> Hi,
> 
> Keycloak 6.0.1, LDAP federation is working, users can logon and are
> updated automatically regularly from ldap:
> 
>> 2019-07-02 17:39:49,761 INFO  [org.keycloak.storage.ldap.LDAPStorageProviderFactory] (Timer-2) Sync changed users from LDAP to local store: realm: our_realm, federation provider: our_realm-ad, last sync time: Mon Jul 01 17:39:43 CEST > 2019-07-02 17:39:50,067 INFO  [org.keycloak.storage.ldap.LDAPStorageProviderFactory] (Timer-2) Sync changed users finished: 3 imported users, 22 updated users
> 
> In keycloak, the configured ldap uri is ldap://localhost:389, where a
> haproxy instance is listening that talks ldaps to our DCs.
> 
> The 'problem': in the keycloak GUI, the buttons 'Test authentication'
> and 'Test connection' do not work:
> 
> "Error! Error when trying to connect to LDAP. See server.log for details."
> 
> But nothing logged in server.log, and haproxy does not even log a
> connection attempt at all.
> 
> Anyone else seeing this..?
> 
> MJ
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
> 

From demetrio at carretti.pro  Thu Jul  4 07:28:50 2019
From: demetrio at carretti.pro (Dmitry Telegin)
Date: Thu, 04 Jul 2019 14:28:50 +0300
Subject: [keycloak-user] Disable logging in via REST API
In-Reply-To: <5E48B917000C984B86B77170F441903A18A16479@exch.ringler.ch>
References: <5E48B917000C984B86B77170F441903A18A16479@exch.ringler.ch>
Message-ID: <d5d1bb5caa8d736d2a234f4d22e22fce68a4084d.camel@carretti.pro>

Hi Lucasz,

This is probably related to your yesterday's posting, correct? Could you please elaborate on what you mean by "logging into Keycloak via REST API"?

Cheers,
Dmitry Telegin

Carretti Consulting O? | Keycloak Consulting and Training
Sepapaja 6, Tallinn 15551, Estonia | info at carretti.pro

On Thu, 2019-07-04 at 08:45 +0000, Lukasz Lech wrote:
> Hello,
> 
> How to disable logging into Keycloak via REST API, without affecting logging in via browser?
> 
> Which URLs I need to block?
> 
> I have problem finding out that information...
> 
> Best regards,
> Lukasz Lech
> 
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user


From demetrio at carretti.pro  Thu Jul  4 07:45:55 2019
From: demetrio at carretti.pro (Dmitry Telegin)
Date: Thu, 04 Jul 2019 14:45:55 +0300
Subject: [keycloak-user] Permission Handling After Keycloak 4.5.0
In-Reply-To: <06991864-6F77-4F28-9397-5F067C5020E2@student.hpi.uni-potsdam.de>
References: <06991864-6F77-4F28-9397-5F067C5020E2@student.hpi.uni-potsdam.de>
Message-ID: <73806f03959e46de1813b9ecdce8c2b02010894c.camel@carretti.pro>

Hi Lasse,

In addition to what C?dric suggested, please also mind that beginning with 4.5, Keycloak Docker image uses standalone-ha.xml by default instead of standalone.xml, so if you made any changes there, you will need to update the -ha.xml file.

Cheers,
Dmitry Telegin

Carretti Consulting O? | Keycloak Consulting and Training
Sepapaja 6, Tallinn 15551, Estonia | info at carretti.pro

On Wed, 2019-07-03 at 17:27 +0000, Jahn, Lasse wrote:
> Hey everyone,
> 
> I'm running Keycloak Server Version 4.5.0.Final according to the dockerfile from jboss shown in the dockerhub [1] with only changed keycloak version. (Took the tools from [2])
> 
> During developing I noticed that there is an Endpoint missing that I wanted to use (request a group list which have specific client role, for users this enpoint exists
> 
> GET /{realm}/clients/{id}/roles/{role-name}/users
> 
> In Keycloak 6.0 this also exists for groups.
> GET /{realm}/clients/{id}/roles/{role-name}/groups
> 
> So I thought why not migrating to 6.0. After successful upgrade I realized that there is no permission tab?!
> I wanted to handle the permissions of a user to be a client admin as explained in the documentation [3] but this was not possible.
> 
> I thougth that maybe that the docker image does not include everything, so I downloaded all at the keycloak.org available server distributions and run them via standalone.sh (4.8, 5.0, 6.0) all with the same result, there is no permission Tab ?!
> 
> Is the documentation not updated and there is a way to enable the permission tab or how can I fullfill the mentioned scenario (client admin which is allowed to map roles) ?
> 
> 
> Regards
> Lasse
> 
> [1] https://hub.docker.com/r/jboss/keycloak/dockerfile
> [2] https://github.com/jboss-dockerfiles/keycloak/tree/4.5.0.Final/server
> [3] https://www.keycloak.org/docs/latest/server_admin/index.html#managing-one-specific-client
> 
> 
> 
> Viele Gr??e
> Lasse Jahn
> 
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user


From cedric at couralet.eu  Thu Jul  4 07:50:59 2019
From: cedric at couralet.eu (=?utf-8?q?cedric=40couralet=2Eeu?=)
Date: Thu, 04 Jul 2019 13:50:59 +0200
Subject: [keycloak-user]
 =?utf-8?q?ldap_federation_working_=7C_test_connec?=
 =?utf-8?q?tion_/_authentication_buttons_failing?=
In-Reply-To: <19c1d216-e6a1-6065-541e-1728798e3c32@merit.unu.edu>
Message-ID: <89d-5d1de800-3-1074ad00@21899244>

Le Jeudi, Juillet 04, 2019 12:52 CEST, mj <lists at merit.unu.edu> a ?crit: 
 
> Hi,
> 
> Off list, someone asked me to check if ldap://127.0.0.1:389 would work 
> better than ldap://localhost:389, but it doesn't.
> 
> But I am now also trying to fill in actual remote ldap servers, and they 
> also don't work. Again nothing at all logged in server.log
> 
> Do the test buttons work for others here?

Hello,

It works for me with keycloak 6.0.1.
The button sends a request to https://<keycloak>/auth/admin/realms/<realm>/testLDAPConnection, can you try examining the response you have with this request (in the browser dev tools for instance) ?

Regards,
C?dric Couralet



> MJ



> 
> On 7/3/19 10:55 AM, mj wrote:
> > Hi,
> > 
> > Keycloak 6.0.1, LDAP federation is working, users can logon and are
> > updated automatically regularly from ldap:
> > 
> >> 2019-07-02 17:39:49,761 INFO  [org.keycloak.storage.ldap.LDAPStorageProviderFactory] (Timer-2) Sync changed users from LDAP to local store: realm: our_realm, federation provider: our_realm-ad, last sync time: Mon Jul 01 17:39:43 CEST > 2019-07-02 17:39:50,067 INFO  [org.keycloak.storage.ldap.LDAPStorageProviderFactory] (Timer-2) Sync changed users finished: 3 imported users, 22 updated users
> > 
> > In keycloak, the configured ldap uri is ldap://localhost:389, where a
> > haproxy instance is listening that talks ldaps to our DCs.
> > 
> > The 'problem': in the keycloak GUI, the buttons 'Test authentication'
> > and 'Test connection' do not work:
> > 
> > "Error! Error when trying to connect to LDAP. See server.log for details."
> > 
> > But nothing logged in server.log, and haproxy does not even log a
> > connection attempt at all.
> > 
> > Anyone else seeing this..?
> > 
> > MJ
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
> > 
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user



From l.lech at ringler.ch  Thu Jul  4 08:09:24 2019
From: l.lech at ringler.ch (Lukasz Lech)
Date: Thu, 4 Jul 2019 12:09:24 +0000
Subject: [keycloak-user] Disable logging in via REST API
In-Reply-To: <d5d1bb5caa8d736d2a234f4d22e22fce68a4084d.camel@carretti.pro>
References: <5E48B917000C984B86B77170F441903A18A16479@exch.ringler.ch>
	<d5d1bb5caa8d736d2a234f4d22e22fce68a4084d.camel@carretti.pro>
Message-ID: <5E48B917000C984B86B77170F441903A18A16537@exch.ringler.ch>

Hello,

I'm using keycloak-admin-client library, which AFAIK uses https://www.keycloak.org/docs-api/5.0/rest-api/index.html directly. 

I've found out, that 'Direct Grant' flow is triggered and I could create an org.keycloak.authentication.Authenticator that  would always call context.failure(), effectively blocking login through REST API for the realm... 

This what bothers me is that I have problems finding any documentation how does that Authenticator work and I'm extending the project someone has written and looking what is happening. 

Best regards,
Lukasz Lech


-----Original Message-----
From: Dmitry Telegin [mailto:demetrio at carretti.pro] 
Sent: Donnerstag, 4. Juli 2019 13:29
To: Lukasz Lech <l.lech at ringler.ch>; keycloak-user at lists.jboss.org
Subject: Re: [keycloak-user] Disable logging in via REST API

Hi Lucasz,

This is probably related to your yesterday's posting, correct? Could you please elaborate on what you mean by "logging into Keycloak via REST API"?

Cheers,
Dmitry Telegin

Carretti Consulting O? | Keycloak Consulting and Training Sepapaja 6, Tallinn 15551, Estonia | info at carretti.pro

On Thu, 2019-07-04 at 08:45 +0000, Lukasz Lech wrote:
> Hello,
> 
> How to disable logging into Keycloak via REST API, without affecting logging in via browser?
> 
> Which URLs I need to block?
> 
> I have problem finding out that information...
> 
> Best regards,
> Lukasz Lech
> 
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user



From l.lech at ringler.ch  Thu Jul  4 11:12:33 2019
From: l.lech at ringler.ch (Lukasz Lech)
Date: Thu, 4 Jul 2019 15:12:33 +0000
Subject: [keycloak-user] Support for totp in REST client
	(org.keycloak.admin.client.Keycloak)
Message-ID: <5E48B917000C984B86B77170F441903A18A16588@exch.ringler.ch>

Hello,

I was under impression, that activating TOTP will makes the account unable to use with REST api, but then I've found that people describe how to do that and that is actually supported through 'totp' parameter to the API call.

The parameter would have to be added to org.keycloak.admin.client.token.TokenManager:grantToken() method. Rather through some interface for TOTP generator than the one-time code.

Were there already any plans to extend the library (keycloak-admin-client) to support TOTP?

To my understanding the code like that should work:

    if (PASSWORD.equals(accessTokenGrantType)) {
        form.param("username", config.getUsername())
            .param("password", config.getPassword());
        if (config.getTotpGenerator() != null) {
            form.param("totp", config.getTotpGenerator().getToken());
        }
    }

The caller would have to provide the implementation of TotpGenerator compliant with Keycloak settings and set the secret from otp configuration QR code...

Best regards,
Lukasz Lech


From orivat at janua.fr  Thu Jul  4 13:46:38 2019
From: orivat at janua.fr (Rivat Olivier)
Date: Thu, 4 Jul 2019 19:46:38 +0200
Subject: [keycloak-user] (UMA) How is it possible to approve pending request
 via REST API calls
Message-ID: <ea5561d5-0543-6770-c3cd-21333c1154fc@janua.fr>

Hi,

I am playing with auth_uma_photoz example.

1. I have created some album resources for alice (album a5).
2. Jdoe has made a request to access to alice album

3. Through Rest API calls, I can see that there is a pending request on 
a5 resource owned by alice



access_token_alice=$(curl -d "client_id=photoz-restful-api" -d 
"client_secret=secret"? -d "username=alice" -d "password=alice" -d 
"grant_type=password" 
http://localhost:8180/auth/realms/photoz/protocol/openid-connect/token | 
jq -r .access_token)


 ?curl 
http://localhost:8180/auth/realms/photoz/authz/protection/permission/ticket?owner=alice 
-H 'Authorization: Bearer '$access_token_alice | jq
 ? % Total??? % Received % Xferd? Average Speed?? Time??? Time Time? Current
 ???????????????????????????????? Dload? Upload?? Total?? Spent Left? Speed
100?? 258? 100?? 258??? 0???? 0? 86000????? 0 --:--:-- --:--:-- --:--:-- 
86000
[
 ? {
 ??? "id": "29505d42-da8d-46f5-afe2-f90e35845192",
 ??? "owner": "11f3314e-f1c6-40a9-912b-d6f9d0c5a177",
 ??? "resource": "dee953ef-1df8-4787-9d32-ce4e407da010",
 ??? "scope": "0dc735d5-1ecc-466d-ba9e-e59f8ad563e4",
 ??? "granted": false,
 ??? "requester": "dceb398e-9f68-4077-8073-ca53137cccb3"
 ? }
]


So my question:
What should be the command syntax to approve this request from Jdoe (I.e 
set "granted":true) using teh REST API.
I have made several trials, quite unsuccessful, and haven't found any 
hint in the keycloak doc.

Regards,
Olivier


From orivat at janua.fr  Thu Jul  4 14:18:25 2019
From: orivat at janua.fr (Rivat Olivier)
Date: Thu, 4 Jul 2019 20:18:25 +0200
Subject: [keycloak-user] (UMA) How is it possible to approve pending
 request via REST API calls
In-Reply-To: <ea5561d5-0543-6770-c3cd-21333c1154fc@janua.fr>
References: <ea5561d5-0543-6770-c3cd-21333c1154fc@janua.fr>
Message-ID: <29d23b89-a452-23c9-c2a6-3771e8c288dd@janua.fr>

Hi,

Just found the answer:

To approve a pending request

 ?curl -v -X PUT 
http://localhost:8180/auth/realms/photoz/authz/protection/permission/ticket 
-H 'Authorization: Bearer '$access_token_alice -H 'Content-Type: 
application/json' -d '{
 ??? "id": "5c067c34-129a-4d1e-8911-4591ed29962c",
 ??? "owner": "11f3314e-f1c6-40a9-912b-d6f9d0c5a177",
 ??? "resource": "dee953ef-1df8-4787-9d32-ce4e407da010",
 ??? "scope": "0dc735d5-1ecc-466d-ba9e-e59f8ad563e4",
 ??? "granted": true,
 ??? "requester": "dceb398e-9f68-4077-8073-ca53137cccb3"
 ? }'


TO revoke an approval

 ?curl -v -X PUT 
http://localhost:8180/auth/realms/photoz/authz/protection/permission/ticket 
-H 'Authorization: Bearer '$access_token_alice -H 'Content-Type: 
application/json' -d '{
 ??? "id": "5c067c34-129a-4d1e-8911-4591ed29962c",
 ??? "owner": "11f3314e-f1c6-40a9-912b-d6f9d0c5a177",
 ??? "resource": "dee953ef-1df8-4787-9d32-ce4e407da010",
 ??? "scope": "0dc735d5-1ecc-466d-ba9e-e59f8ad563e4",
 ??? "granted": false,
 ??? "requester": "dceb398e-9f68-4077-8073-ca53137cccb3"
 ? }' -v


It works great now !!!

Regards,

Olivier





Le 04/07/2019 ? 19:46, Rivat Olivier a ?crit?:
> Hi,
>
> I am playing with auth_uma_photoz example.
>
> 1. I have created some album resources for alice (album a5).
> 2. Jdoe has made a request to access to alice album
>
> 3. Through Rest API calls, I can see that there is a pending request 
> on a5 resource owned by alice
>
>
>
> access_token_alice=$(curl -d "client_id=photoz-restful-api" -d 
> "client_secret=secret"? -d "username=alice" -d "password=alice" -d 
> "grant_type=password" 
> http://localhost:8180/auth/realms/photoz/protocol/openid-connect/token 
> | jq -r .access_token)
>
>
> ?curl 
> http://localhost:8180/auth/realms/photoz/authz/protection/permission/ticket?owner=alice 
> -H 'Authorization: Bearer '$access_token_alice | jq
> ? % Total??? % Received % Xferd? Average Speed?? Time??? Time Time? 
> Current
> ???????????????????????????????? Dload? Upload?? Total?? Spent Left? 
> Speed
> 100?? 258? 100?? 258??? 0???? 0? 86000????? 0 --:--:-- --:--:-- 
> --:--:-- 86000
> [
> ? {
> ??? "id": "29505d42-da8d-46f5-afe2-f90e35845192",
> ??? "owner": "11f3314e-f1c6-40a9-912b-d6f9d0c5a177",
> ??? "resource": "dee953ef-1df8-4787-9d32-ce4e407da010",
> ??? "scope": "0dc735d5-1ecc-466d-ba9e-e59f8ad563e4",
> ??? "granted": false,
> ??? "requester": "dceb398e-9f68-4077-8073-ca53137cccb3"
> ? }
> ]
>
>
> So my question:
> What should be the command syntax to approve this request from Jdoe 
> (I.e set "granted":true) using teh REST API.
> I have made several trials, quite unsuccessful, and haven't found any 
> hint in the keycloak doc.
>
> Regards,
> Olivier
>

From andrew.martel at indexexchange.com  Thu Jul  4 16:50:16 2019
From: andrew.martel at indexexchange.com (Andrew Martel)
Date: Thu, 4 Jul 2019 20:50:16 +0000
Subject: [keycloak-user] KEYCLOAK-3205
Message-ID: <YTOPR0101MB13404B66AF95D182C779B62FF6FA0@YTOPR0101MB1340.CANPRD01.PROD.OUTLOOK.COM>

Hello,

   My company is waiting on the functionality to have encrypted client secrets: https://github.com/keycloak/keycloak-community/blob/master/design/secure-credentials-store.md.

Would someone be able to provide me with a timeline on when this will be released?

Thanks,
Andrew Martel


CONFIDENTIALITY NOTICE AND DISCLAIMER : This telecommunication, including any and all attachments, contains confidential information intended only for the person(s) to whom it is addressed. Any dissemination, distribution, copying or disclosure is strictly prohibited and is not a waiver of confidentiality. If you have received this telecommunication in error, please notify the sender immediately by return electronic mail and delete the message from your inbox and deleted items folders. This telecommunication does not constitute an express or implied agreement to conduct transactions by electronic means, nor does it constitute a contract offer, a contract amendment or an acceptance of a contract offer. Contract terms contained in this telecommunication are subject to legal review and the completion of formal documentation and are not binding until same is confirmed in writing and has been signed by an authorized signatory.

From bruno at abstractj.org  Thu Jul  4 18:56:14 2019
From: bruno at abstractj.org (Bruno Oliveira)
Date: Thu, 4 Jul 2019 19:56:14 -0300
Subject: [keycloak-user] KEYCLOAK-3205
In-Reply-To: <YTOPR0101MB13404B66AF95D182C779B62FF6FA0@YTOPR0101MB1340.CANPRD01.PROD.OUTLOOK.COM>
References: <YTOPR0101MB13404B66AF95D182C779B62FF6FA0@YTOPR0101MB1340.CANPRD01.PROD.OUTLOOK.COM>
Message-ID: <20190704225614.GA27142@abstractj.org>

Hi Andrew, the team started to look at this, but we cannot commit with
any dates yet. To keep track of the work just keep an eye on:
https://issues.jboss.org/browse/KEYCLOAK-3205

On 2019-07-04, Andrew Martel wrote:
> Hello,
> 
>    My company is waiting on the functionality to have encrypted client secrets: https://github.com/keycloak/keycloak-community/blob/master/design/secure-credentials-store.md.
> 
> Would someone be able to provide me with a timeline on when this will be released?
> 
> Thanks,
> Andrew Martel
> 
> 
> CONFIDENTIALITY NOTICE AND DISCLAIMER : This telecommunication, including any and all attachments, contains confidential information intended only for the person(s) to whom it is addressed. Any dissemination, distribution, copying or disclosure is strictly prohibited and is not a waiver of confidentiality. If you have received this telecommunication in error, please notify the sender immediately by return electronic mail and delete the message from your inbox and deleted items folders. This telecommunication does not constitute an express or implied agreement to conduct transactions by electronic means, nor does it constitute a contract offer, a contract amendment or an acceptance of a contract offer. Contract terms contained in this telecommunication are subject to legal review and the completion of formal documentation and are not binding until same is confirmed in writing and has been signed by an authorized signatory.
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

-- 

abstractj

From lists at merit.unu.edu  Fri Jul  5 03:52:14 2019
From: lists at merit.unu.edu (mj)
Date: Fri, 5 Jul 2019 09:52:14 +0200
Subject: [keycloak-user] ldap federation working | test connection /
 authentication buttons failing
In-Reply-To: <89d-5d1de800-3-1074ad00@21899244>
References: <89d-5d1de800-3-1074ad00@21899244>
Message-ID: <090c1cb7-f702-704a-7491-ee15616b5cb0@merit.unu.edu>

Hi C?dric,

I edited the request for our installation, and the browser dev tools said:

> Error loading this URI: Could not load the source for https://<keycloak>/auth/admin/realms/OUR_REALM/testLDAPConnection.
> [Exception... "Component returned failure code: 0x80470002 (NS_BASE_STREAM_CLOSED) [nsIInputStream.available]"  nsresult: "0x80470002 (NS_BASE_STREAM_CLOSED)"  location: "JS frame :: resource://devtools/shared/DevToolsUtils.js :: onResponse :: line 555"  data: no]
> Stack: onResponse at resource://devtools/shared/DevToolsUtils.js:555:34
> onStopRequest at resource://gre/modules/NetUtil.jsm:123:17
> Line: 555, column: 0

Does the above mean anything to you..?

We appreciated your response, many thanks!

MJ

On 7/4/19 1:50 PM, cedric at couralet.eu wrote:
> Le Jeudi, Juillet 04, 2019 12:52 CEST, mj <lists at merit.unu.edu> a ?crit:
>   
>> Hi,
>>
>> Off list, someone asked me to check if ldap://127.0.0.1:389 would work
>> better than ldap://localhost:389, but it doesn't.
>>
>> But I am now also trying to fill in actual remote ldap servers, and they
>> also don't work. Again nothing at all logged in server.log
>>
>> Do the test buttons work for others here?
> 
> Hello,
> 
> It works for me with keycloak 6.0.1.
> The button sends a request to https://<keycloak>/auth/admin/realms/<realm>/testLDAPConnection, can you try examining the response you have with this request (in the browser dev tools for instance) ?
> 
> Regards,
> C?dric Couralet
> 
> 
> 
>> MJ
> 
> 
> 
>>
>> On 7/3/19 10:55 AM, mj wrote:
>>> Hi,
>>>
>>> Keycloak 6.0.1, LDAP federation is working, users can logon and are
>>> updated automatically regularly from ldap:
>>>
>>>> 2019-07-02 17:39:49,761 INFO  [org.keycloak.storage.ldap.LDAPStorageProviderFactory] (Timer-2) Sync changed users from LDAP to local store: realm: our_realm, federation provider: our_realm-ad, last sync time: Mon Jul 01 17:39:43 CEST > 2019-07-02 17:39:50,067 INFO  [org.keycloak.storage.ldap.LDAPStorageProviderFactory] (Timer-2) Sync changed users finished: 3 imported users, 22 updated users
>>>
>>> In keycloak, the configured ldap uri is ldap://localhost:389, where a
>>> haproxy instance is listening that talks ldaps to our DCs.
>>>
>>> The 'problem': in the keycloak GUI, the buttons 'Test authentication'
>>> and 'Test connection' do not work:
>>>
>>> "Error! Error when trying to connect to LDAP. See server.log for details."
>>>
>>> But nothing logged in server.log, and haproxy does not even log a
>>> connection attempt at all.
>>>
>>> Anyone else seeing this..?
>>>
>>> MJ
>>> _______________________________________________
>>> keycloak-user mailing list
>>> keycloak-user at lists.jboss.org
>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
> 

From cedric at couralet.eu  Fri Jul  5 03:56:46 2019
From: cedric at couralet.eu (=?utf-8?q?cedric=40couralet=2Eeu?=)
Date: Fri, 05 Jul 2019 09:56:46 +0200
Subject: [keycloak-user]
 =?utf-8?q?ldap_federation_working_=7C_test_connec?=
 =?utf-8?q?tion_/_authentication_buttons_failing?=
In-Reply-To: <090c1cb7-f702-704a-7491-ee15616b5cb0@merit.unu.edu>
Message-ID: <1dfc-5d1f0280-13-65641a00@212219095>

Hi, sorry for the stupid question, but did you change the hostname for the keycloak server (instead of <keycloak>) ?

That log would mean your browser can't connect to you keycloak,  this would be really strange considering you access the admin interface.

Also that request needs some context (auth,...) so it is easier to click on the button with the developpers tools opened and see what is the response.

C?dric

 
Le Vendredi, Juillet 05, 2019 09:52 CEST, mj <lists at merit.unu.edu> a ?crit: 
 
> Hi C?dric,
> 
> I edited the request for our installation, and the browser dev tools said:
> 
> > Error loading this URI: Could not load the source for https://<keycloak>/auth/admin/realms/OUR_REALM/testLDAPConnection.
> > [Exception... "Component returned failure code: 0x80470002 (NS_BASE_STREAM_CLOSED) [nsIInputStream.available]"  nsresult: "0x80470002 (NS_BASE_STREAM_CLOSED)"  location: "JS frame :: resource://devtools/shared/DevToolsUtils.js :: onResponse :: line 555"  data: no]
> > Stack: onResponse at resource://devtools/shared/DevToolsUtils.js:555:34
> > onStopRequest at resource://gre/modules/NetUtil.jsm:123:17
> > Line: 555, column: 0
> 
> Does the above mean anything to you..?
> 
> We appreciated your response, many thanks!
> 
> MJ
> 
> On 7/4/19 1:50 PM, cedric at couralet.eu wrote:
> > Le Jeudi, Juillet 04, 2019 12:52 CEST, mj <lists at merit.unu.edu> a ?crit:
> >   
> >> Hi,
> >>
> >> Off list, someone asked me to check if ldap://127.0.0.1:389 would work
> >> better than ldap://localhost:389, but it doesn't.
> >>
> >> But I am now also trying to fill in actual remote ldap servers, and they
> >> also don't work. Again nothing at all logged in server.log
> >>
> >> Do the test buttons work for others here?
> > 
> > Hello,
> > 
> > It works for me with keycloak 6.0.1.
> > The button sends a request to https://<keycloak>/auth/admin/realms/<realm>/testLDAPConnection, can you try examining the response you have with this request (in the browser dev tools for instance) ?
> > 
> > Regards,
> > C?dric Couralet
> > 
> > 
> > 
> >> MJ
> > 
> > 
> > 
> >>
> >> On 7/3/19 10:55 AM, mj wrote:
> >>> Hi,
> >>>
> >>> Keycloak 6.0.1, LDAP federation is working, users can logon and are
> >>> updated automatically regularly from ldap:
> >>>
> >>>> 2019-07-02 17:39:49,761 INFO  [org.keycloak.storage.ldap.LDAPStorageProviderFactory] (Timer-2) Sync changed users from LDAP to local store: realm: our_realm, federation provider: our_realm-ad, last sync time: Mon Jul 01 17:39:43 CEST > 2019-07-02 17:39:50,067 INFO  [org.keycloak.storage.ldap.LDAPStorageProviderFactory] (Timer-2) Sync changed users finished: 3 imported users, 22 updated users
> >>>
> >>> In keycloak, the configured ldap uri is ldap://localhost:389, where a
> >>> haproxy instance is listening that talks ldaps to our DCs.
> >>>
> >>> The 'problem': in the keycloak GUI, the buttons 'Test authentication'
> >>> and 'Test connection' do not work:
> >>>
> >>> "Error! Error when trying to connect to LDAP. See server.log for details."
> >>>
> >>> But nothing logged in server.log, and haproxy does not even log a
> >>> connection attempt at all.
> >>>
> >>> Anyone else seeing this..?
> >>>
> >>> MJ
> >>> _______________________________________________
> >>> keycloak-user mailing list
> >>> keycloak-user at lists.jboss.org
> >>> https://lists.jboss.org/mailman/listinfo/keycloak-user
> >>>
> >> _______________________________________________
> >> keycloak-user mailing list
> >> keycloak-user at lists.jboss.org
> >> https://lists.jboss.org/mailman/listinfo/keycloak-user
> >



From lists at merit.unu.edu  Fri Jul  5 04:07:32 2019
From: lists at merit.unu.edu (mj)
Date: Fri, 5 Jul 2019 10:07:32 +0200
Subject: [keycloak-user] ldap federation working | test connection /
 authentication buttons failing
In-Reply-To: <1dfc-5d1f0280-13-65641a00@212219095>
References: <1dfc-5d1f0280-13-65641a00@212219095>
Message-ID: <04695f5e-c5cc-8f5f-4b7a-1e68bcab7c1c@merit.unu.edu>

Hi,

On 7/5/19 9:56 AM, cedric at couralet.eu wrote:
> Hi, sorry for the stupid question, but did you change the hostname for the keycloak server (instead of <keycloak>) ?
Haha, yes, I did change it of course :-)

Ok, so, did it straight from the admin console, with dev tools open. 
That gives more info:

> XML Parsing Error: no root element found
> Location: https://<realkeycloakurl>/auth/admin/realms/OUR_REALM/testLDAPConnection?action=testConnection&bindCredential=**********&bindDn=cn%3Dsearch_etc******&componentId=e7159941-88ee-4cd3-9b61-936896ed580c&connectionTimeout=&connectionUrl=ldap:%2F%2Flocalhost:389&useTruststoreSpi=never
> Line Number 1, Column 1:

Obviously also the bindDN is obfuscated, and actually is how we 
configured it.

So, XML parsing error..?

Thanks again!

MJ

From orivat at janua.fr  Fri Jul  5 07:40:18 2019
From: orivat at janua.fr (Rivat Olivier)
Date: Fri, 5 Jul 2019 13:40:18 +0200
Subject: [keycloak-user] RPT tokens can still be used after approval
	revokation
Message-ID: <9e73d11e-ed0b-0f45-855a-465fa44042f4@janua.fr>

Hi,

I have the following use case

1) alice is creating some resouces (a5 for example)
2) jdoe is asking to access a5
3) alice approves request for Jdoe to access a5
4) Jdoe is getting an rpt token and now can access to a5 (so far so good)
5) Alice is revoking Jdoe access right for a5

6) RPT token of Jdoe is still valid (it has no yet expired)
---> Joe can access to alice a5 resource without any problem

For me it sounds like a bug. I was expecting Jdoe no longer being able 
to access alice A5 resource? (after revokation from alice).


Regards,
Olivier










From orivat at janua.fr  Fri Jul  5 07:55:28 2019
From: orivat at janua.fr (Rivat Olivier)
Date: Fri, 5 Jul 2019 13:55:28 +0200
Subject: [keycloak-user] RPT tokens can still be used after approval
	revokation
In-Reply-To: <9e73d11e-ed0b-0f45-855a-465fa44042f4@janua.fr>
References: <9e73d11e-ed0b-0f45-855a-465fa44042f4@janua.fr>
Message-ID: <452ab804-c1ee-4ff7-1e4e-65661a4e7ea0@janua.fr>



Hi,

I have the following use case

1) alice is creating some resouces (a5 for example)
2) jdoe is asking to access a5
3) alice approves request for Jdoe to access a5
4) Jdoe is getting an rpt token and now can access to a5 (so far so good)
5) Alice is revoking Jdoe access right for a5

6) RPT token of Jdoe is still valid (it has no yet expired)
---> Joe can access to alice a5 resource without any problem

For me it sounds like a bug. I was expecting Jdoe no longer being able 
to access alice A5 resource? (after revokation from alice).
Do you conform my understanding, or is this the normal expected behavior ?

Regards,
Olivier










From sblanc at redhat.com  Fri Jul  5 08:12:05 2019
From: sblanc at redhat.com (Sebastien Blanc)
Date: Fri, 5 Jul 2019 14:12:05 +0200
Subject: [keycloak-user] RPT tokens can still be used after approval
	revokation
In-Reply-To: <452ab804-c1ee-4ff7-1e4e-65661a4e7ea0@janua.fr>
References: <9e73d11e-ed0b-0f45-855a-465fa44042f4@janua.fr>
	<452ab804-c1ee-4ff7-1e4e-65661a4e7ea0@janua.fr>
Message-ID: <CAMZCGg-xpzfY0Nb+g8A6sDf9o8UZUSBuZFFR7ZHhXA+MK2dQcQ@mail.gmail.com>

Pedro can confirm but if I'm not wrong an RPT is like any other access
token and will be valid until it expired (5 minutes by default). Especially
with an RPT where the verification can be completely made offline. You can
push a "not before" from the console to invalidate immediatly the token.



On Fri, Jul 5, 2019 at 2:09 PM Rivat Olivier <orivat at janua.fr> wrote:

>
>
> Hi,
>
> I have the following use case
>
> 1) alice is creating some resouces (a5 for example)
> 2) jdoe is asking to access a5
> 3) alice approves request for Jdoe to access a5
> 4) Jdoe is getting an rpt token and now can access to a5 (so far so good)
> 5) Alice is revoking Jdoe access right for a5
>
> 6) RPT token of Jdoe is still valid (it has no yet expired)
> ---> Joe can access to alice a5 resource without any problem
>
> For me it sounds like a bug. I was expecting Jdoe no longer being able
> to access alice A5 resource  (after revokation from alice).
> Do you conform my understanding, or is this the normal expected behavior ?
>
> Regards,
> Olivier
>
>
>
>
>
>
>
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From jonesy at sydow.org  Fri Jul  5 08:39:50 2019
From: jonesy at sydow.org (JTK)
Date: Fri, 5 Jul 2019 07:39:50 -0500
Subject: [keycloak-user] Not being prompted for x509 User Certs on
 KeyCloak version 4.8.3.Final
In-Reply-To: <CAEyJD6OqDhukpWupBR96s5NTEkEkFm5NcKuJNWy1C3FJh1JrHg@mail.gmail.com>
References: <CAEyJD6OjC7CCnB9yEvDor8N3nXdq14yxebXAqRJp7RWrRpD43w@mail.gmail.com>
	<BN6PR07MB3073771E9773FD3731F68774DAFD0@BN6PR07MB3073.namprd07.prod.outlook.com>
	<CAEyJD6N932LKJ_nMzyCZh7+W4Nf55+JV+NvSMR_GQXSO9x3BPA@mail.gmail.com>
	<MWHPR07MB3088D05DBB4E6F7F15597605DAFC0@MWHPR07MB3088.namprd07.prod.outlook.com>
	<CAEyJD6MSvv9N=en4NVj_ZXjcsQ4SGZDMsEevSa8sF6B2RRg8qw@mail.gmail.com>
	<CAEyJD6OayUyEJMOX2s8Be7DiEH_n_pYntEv5s9df-Fs9FU0tSA@mail.gmail.com>
	<MWHPR07MB3088E6EBC8733EF9D9B1BF38DAFC0@MWHPR07MB3088.namprd07.prod.outlook.com>
	<CAEyJD6OqDhukpWupBR96s5NTEkEkFm5NcKuJNWy1C3FJh1JrHg@mail.gmail.com>
Message-ID: <CAEyJD6PjOeBtfYw7u0wpfZ7+jgK-N3siz+o1zGx04jnJfShQgg@mail.gmail.com>

Just now getting back to this due to the holiday week, but I don't believe
we need the chain loaded on the ELB on the smart card, as it's a
pass-through and the certs in question that are on the smart card are
loaded into the KeyCloak keystore, and once a user launches the KeyCloak
interface it should reference the internal KeyCloak keystore to verify the
chain. I would only need the certs on the ELB if we were requiring user
certs prior to the KeyCloak website, which we aren't.
It looks like I'm back to square one. Thoughts?


On Fri, Jun 28, 2019 at 11:41 AM JTK <jonesy at sydow.org> wrote:

> Obviously the certs are not loaded on the ELB as I need them.
> openssl s_client -servername keycloak.domainhere.net -connect
> keycloak.domainhere.net:8443 <http://keycloak.dev.domainhere.net:8443>
> 2>/dev/null | egrep "subject=|issuer=|notAfter="
> subject=CN = keycloak.domainhere.net <http://keycloak.dev.domainhere.net>
> issuer=C = US, O = Amazon, OU = Server CA 1B, CN = Amazon
>
> I'm waiting on feedback from our internal team to find out when they can
> load the Root CA/Intermediate certs on the proxy. It might not be until
> next week, but I will update when I get a chance.
>
> Thanks!
>
> On Fri, Jun 28, 2019 at 10:57 AM Nalyvayko, Peter <pnalyvayko at agi.com>
> wrote:
>
>> Run the command "openssl s_client -connect <host>:<port>" where host and
>> port are the Keycloak's host and the port number (e.g.
>> login.mycompany.com:443) and verify that the list of  certificates
>> listed under "Acceptable CA client certificate names" is not empty and that
>> the CA names match the client cert's issuer
>>
>>
>> ________________________________________
>> From: JTK [jonesy at sydow.org]
>> Sent: Friday, June 28, 2019 11:27 AM
>> To: Nalyvayko, Peter
>> Cc: keycloak-user at lists.jboss.org
>> Subject: Re: [keycloak-user] Not being prompted for x509 User Certs on
>> KeyCloak version 4.8.3.Final
>>
>> Here is the standalone.xml file if anyone can sport or locate any obvious
>> errors associated with it.
>>
>> https://zerobin.net/?740f9250fdc1a6f1#9FqhPJx0iNfQshWY8hA2aYdWPhWUEVHW5peZuGfU8cw=
>>
>> Authentication flow:
>> https://imgur.com/tZYj9N9  (Bindings)
>> https://imgur.com/3v2HYtW (Flows)
>>
>> On Fri, Jun 28, 2019 at 9:13 AM JTK <jonesy at sydow.org<mailto:
>> jonesy at sydow.org>> wrote:
>> I'll look into it. I'm sure it's something simple, but it's just not
>> clicking. As of now I'm only testing my CAC and so there is a Root CA along
>> with an intermediate CA which I have loaded into Keycloak.
>> This is the steps I used:
>>
>> keytool -import -alias ROOT-CA -keystore keystore.jks -file Root-CA.cer
>>
>> keytool -import -alias EMAIL-CA-INTERMEDIATE-1 -keystore keystore.jks
>> -file Email-CA-1.cer
>>
>> ...
>>
>> Just for clarity and sanity check, with our current IdP, we only need to
>> load the public certs (Root/Intermediate) and as long as they are loaded,
>> any user certificate that is presented would be trusted if the chain is
>> loaded for that user certificate. We do not have access to the private keys
>> for the certificates loaded to the keystore.jks - I just want to make sure
>> that's not the issue.
>>
>>
>> At this point in time, I'd love to see ERROR in the server.log file, but
>> I just get INFO.
>>
>> tail -f /opt/keycloak/standalone/log/server.log | grep -E "WARN|ERROR"
>>
>> The output of the above command has no output.
>>
>>
>> This is some of the output:
>>
>> 2019-06-28 13:55:07,507 INFO  [stdout] (default I/O-3) *** Finished
>> 2019-06-28 13:55:07,507 INFO  [stdout] (default I/O-3) verify_data:  {
>> 99, 40, 129, 188, 202, 118, 214, 208, 192, 179, 230, 8 }
>> 2019-06-28 13:55:07,507 INFO  [stdout] (default I/O-3) ***
>> 2019-06-28 13:55:07,507 INFO  [stdout] (default I/O-3) update handshake
>> state: finished[20]
>> 2019-06-28 13:55:07,507 INFO  [stdout] (default I/O-3) [write] MD5 and
>> SHA1 hashes:  len = 16
>> 2019-06-28 13:55:07,508 INFO  [stdout] (default I/O-3) 0000: 14 00 00 0C
>> 63 28 81 BC   CA 76 D6 D0 C0 B3 E6 08  ....c(...v......
>> 2019-06-28 13:55:07,508 INFO  [stdout] (default I/O-3) Padded plaintext
>> before ENCRYPTION:  len = 16
>> 2019-06-28 13:55:07,508 INFO  [stdout] (default I/O-3) 0000: 14 00 00 0C
>> 63 28 81 BC   CA 76 D6 D0 C0 B3 E6 08  ....c(...v......
>> 2019-06-28 13:55:07,509 INFO  [stdout] (default I/O-3) default I/O-3,
>> WRITE: TLSv1.2 Handshake, length = 40
>> 2019-06-28 13:55:07,509 INFO  [stdout] (default I/O-3) %% Cached server
>> session: [Session-15, TLS_RSA_WITH_AES_256_GCM_SHA384]
>> 2019-06-28 13:55:07,509 INFO  [stdout] (default I/O-3) [Raw write]:
>> length = 6
>> 2019-06-28 13:55:07,509 INFO  [stdout] (default I/O-3) 0000: 14 03 03 00
>> 01 01                                  ......
>> 2019-06-28 13:55:07,509 INFO  [stdout] (default I/O-3) [Raw write]:
>> length = 45
>> 2019-06-28 13:55:07,509 INFO  [stdout] (default I/O-3) 0000: 16 03 03 00
>> 28 00 00 00   00 00 00 00 00 73 16 4F  ....(........s.O
>> 2019-06-28 13:55:07,510 INFO  [stdout] (default I/O-3) 0010: C2 AA 1E 08
>> 25 E9 36 15   77 D5 D4 18 E0 F8 BE BE  ....%.6.w.......
>> 2019-06-28 13:55:07,510 INFO  [stdout] (default I/O-3) 0020: 24 8A F4 7F
>> 33 D2 CA D3   C5 FA A5 05 54           $...3.......T
>>
>> etc
>>
>>
>> Here is the output of keystore.jks
>>
>> keytool -list -v -keystore keycloak.jks | grep DoD
>> Enter keystore password:  password
>> Owner: CN=Root CA, OU=PKI, O=Company, C=US
>> Issuer: CN=Root CA, OU=PKI, O=Company, C=US
>> Owner: CN=EMAIL CA-1, OU=PKI, O=Company, C=US
>> Issuer: CN=Root CA, OU=PKI, O=Company, C=US
>>
>>
>> Sows the Root CA and the Intermediate CA (CA-1)
>>
>>
>> On Fri, Jun 28, 2019 at 8:33 AM Nalyvayko, Peter <pnalyvayko at agi.com
>> <mailto:pnalyvayko at agi.com>> wrote:
>> We have successfully tested and deployed the CAC card & X509 auth without
>> any issues. One suggestion is In the SSL debug output search for a list of
>> CA authorities the KC server sends back to the client as a part of mutual
>> SSL handshake. For the mutual SSL to kick in, the  client certificates
>> registered on the client machine must be  signed by one of the CAs from
>> that list.
>>
>> For example, say your trusted store has a CA cert with the Subject:
>> CN=cert_auth
>>
>> Then you should be prompted to select a cert only if your client cert's
>> issuer (the cert used to sign the client cert) matches the subject above.
>>
>> You may also try  troubleshooting using "openssl s_client" to avoid
>> digging through thousands of lines of SSL debug output
>>
>> I hope it makes sense and helps :)
>>
>> Cheers
>>
>> --Peter
>>
>> ________________________________________
>> From: JTK [jonesy at sydow.org<mailto:jonesy at sydow.org>]
>> Sent: Friday, June 28, 2019 9:17 AM
>> To: Nalyvayko, Peter
>> Cc: keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>
>> Subject: Re: [keycloak-user] Not being prompted for x509 User Certs on
>> KeyCloak version 4.8.3.Final
>>
>> Thanks, I enabled the debug option for ssl in
>> ../keycloak/bin/standalone.conf
>> if [ "x$JAVA_OPTS" = "x" ]; then
>>    JAVA_OPTS="-Xms64m -Xmx512m -XX:MetaspaceSize=96M
>> -XX:MaxMetaspaceSize=256m -Djava.net.preferIPv4Stack=true"
>>    JAVA_OPTS="$JAVA_OPTS
>> -Djboss.modules.system.pkgs=$JBOSS_MODULES_SYSTEM_PKGS
>> -Djava.awt.headless=true -Djavax.net.debug=ssl"
>>
>> I am seeing no errors in the logs related to certificates. I do see the
>> root CA I'm trying to use along with the intermediate.
>> I am using a client certificate, but I'm providing it via a card reader
>> on my computer. So I'm presenting a token on a smart card per say and not a
>> soft cert loaded on my system.
>> Would this make a difference? Should I be seeing any sort of error output
>> in the logs if the certs were loaded wrong or any other JAVA related issue?
>> I can post the debug output, but it's quite line.
>> -
>> Note, we currently use a commercial based IdP which accepts our smart
>> card with tokens on them, so I assumed Keycloak by default would see a
>> certificate loaded locally or via the smart card reader.
>>
>>
>> On Thu, Jun 27, 2019 at 6:41 PM Nalyvayko, Peter <pnalyvayko at agi.com
>> <mailto:pnalyvayko at agi.com><mailto:pnalyvayko at agi.com<mailto:
>> pnalyvayko at agi.com>>> wrote:
>> One possible reason you are not getting prompted is that the intermediate
>> or root certs in your trust store do not match the intermediate or root
>> certs used to sign the client certificates registered on your client
>> machine. To troubleshoot the SSL handshake you can use -Djavax.net.debug,
>> see https://access.redhat.com/solutions/973783 for more info.
>>
>> ________________________________________
>> From: keycloak-user-bounces at lists.jboss.org<mailto:
>> keycloak-user-bounces at lists.jboss.org><mailto:
>> keycloak-user-bounces at lists.jboss.org<mailto:
>> keycloak-user-bounces at lists.jboss.org>> [
>> keycloak-user-bounces at lists.jboss.org<mailto:
>> keycloak-user-bounces at lists.jboss.org><mailto:
>> keycloak-user-bounces at lists.jboss.org<mailto:
>> keycloak-user-bounces at lists.jboss.org>>] on behalf of JTK [
>> jonesy at sydow.org<mailto:jonesy at sydow.org><mailto:jonesy at sydow.org<mailto:
>> jonesy at sydow.org>>]
>> Sent: Thursday, June 27, 2019 2:00 PM
>> To: keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org
>> ><mailto:keycloak-user at lists.jboss.org<mailto:
>> keycloak-user at lists.jboss.org>>
>> Subject: [keycloak-user] Not being prompted for x509 User Certs on
>> KeyCloak     version 4.8.3.Final
>>
>>  I've read through all the documentation I can find online both with the
>> official documents and everything else I could find and I believe I have
>> everything setup, with additional logging turned on, but I'm not getting
>> any type of prompt for a x509 certificate when logging in.
>>
>>  Here is the excerpts from the standalone.xml file where ssl-realm was
>> added to the management security-realms and under the subsystem.
>>
>>     <management>
>>         <security-realms>
>>          ......
>>             <security-realm name="ssl-realm">
>>                 <server-identities>
>>                     <ssl>
>>                         <keystore path="keycloak.jks"
>> relative-to="jboss.server.config.dir" keystore-password="mypass"/>
>>                     </ssl>
>>                 </server-identities>
>>                 <authentication>
>>                     <truststore path="truststore.jks"
>> relative-to="jboss.server.config.dir" keystore-password="mypass"/>
>>                 </authentication>
>>             </security-realm>
>>             ......
>>
>>         <subsystem xmlns="urn:jboss:domain:undertow:7.0"
>> default-server="default-server" default-virtual-host="default-host"
>> default-servlet-container="default" default-security-domain="other">
>>             <buffer-cache name="default"/>
>>             <server name="default-server">
>>                 <http-listener name="default1" socket-binding="http"
>> redirect-socket="https" enable-http2="true"/>
>>                 <https-listener name="default" socket-binding="https"
>> security-realm="ssl-realm" verify-client="REQUESTED"/>
>>                 <host name="default-host" alias="localhost">
>>                     <location name="/" handler="welcome-content"/>
>>                     <access-log worker="default"
>> directory="${jboss.server.log.dir}" prefix="access" suffix=".log"/>
>>                     <http-invoker security-realm="ApplicationRealm"/>
>>                 </host>
>>
>>  I've setup the Authentication Flows for the Browser to have x509/Validate
>> Username Form above the new Browser flow and it's required.
>> Everything is setup per the KeyCloak documentation to include the binding
>> settings.
>>
>> The only thing I'm not sure about is if the keycloak.jks and
>> truststore.jks
>> files are the issue.
>> I have enabled extra logging as best I know, but I'm not seeing anything
>> in
>> the logs of any relevance when trying to authenticate into the Keycloak
>> Realm.
>>
>> Can anyone assist? We are looking to most likely purchase this as a
>> product
>> through RedHat SSO if it works well to get the support we need, but I've
>> been hung up on this for a few weeks and I know it shouldn't be this hard.
>>
>> Thanks,
>> J
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org
>> ><mailto:keycloak-user at lists.jboss.org<mailto:
>> keycloak-user at lists.jboss.org>>
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>

From remko at FreeBSD.org  Fri Jul  5 09:25:23 2019
From: remko at FreeBSD.org (Remko Lodder)
Date: Fri, 5 Jul 2019 15:25:23 +0200
Subject: [keycloak-user] Set which user can authenticate at which client
In-Reply-To: <A8AEAA6F-FCED-42BD-BDBA-3C284900854E@FreeBSD.org>
References: <A8AEAA6F-FCED-42BD-BDBA-3C284900854E@FreeBSD.org>
Message-ID: <7BD6C43D-D14B-4B99-A844-58D3C6DC0A3C@FreeBSD.org>

Hello,

> On 23 Jun 2019, at 21:37, Remko Lodder <remko at FreeBSD.org> wrote:
> 
> Signed PGP part
> Hi,
> 
> I am new to Keycloak and first of all I would like to thank you and all contributors for all your hard work.
> I have little experience with Keycloak and it?s usage so please put me on the correct track in case I am off :-)
> 
> So: For a customer and my own environment I am implementing Keycloak. I am consolidating our users in one
> Realm and have added a multitude of clients (both saml as oidc). I would like to be able to place selectors on users
> when importing them or setting it manually, that someone has access to for example gitlab. I found that Okta has
> probably want I am looking for described here:
> 
> https://help.okta.com/en/prod/Content/Topics/Directory/group-assign-app.htm <https://help.okta.com/en/prod/Content/Topics/Directory/group-assign-app.htm>
> 
> Now, is there something like that also in Keycloak? I would like users to be part of a group, or role, or whatever
> and that way control who has access where, without needing to fiddle with the application on the back (I can do
> that for targetting specific roles, like admin, manager, read-write, read-only, etc).
> 
> I was not able to find something similar .. so probably I overlooked it or didn?t understand the documentation :-)
> 
> Any pointers/suggestions/this is not an option right now?
> 
> Thanks & Again, thank you all,
> Remko
> 
> 


Is someone able help me with this? I know I can check the role on the client (like in NGINX) but I would like to set
which users can authenticate at which client, without the client even knowing who the users actually are. That way
I can create one big realm and provision my users that aren feed them through LDAP.

Cheers
Remko
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: Message signed with OpenPGP
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20190705/09192d29/attachment.bin 

From juan.vanegas at netuxtecnologia.com  Fri Jul  5 15:15:13 2019
From: juan.vanegas at netuxtecnologia.com (Juan Camilo Vanegas)
Date: Fri, 5 Jul 2019 14:15:13 -0500
Subject: [keycloak-user] Keycloak policy enforcer for bearer-only client
Message-ID: <CAKY2RVe-Qbxri12F_fhXsDb-eRSp9_vPmT45dbq8vGoasmK2iA@mail.gmail.com>

Hi.

I am developing a Node.js web app that uses Keycloak as authentication
service. I already have two clients: public client for the web app
(app-web) and bearer-only for the API (app-api). On the app-api I use
resources, scopes, policies, and permissions to control the access.

To check the permissions, I am using the keycloak.enforcer(...) from the
keycloak-connectmodule (npm keycloak-connect
<https://www.npmjs.com/package/keycloak-connect>). When I try to check
permission, the server always returns 403 Access denied response. But if I
change app-api from bearer-only to confidential (keeping the same
keycloak.json configuration file), the client works fine and is capable to
check permissions.

This problem seems to be because a bearer-only client cannot obtain tokens
from the server (keycloak similar question
<http://keycloak-user.88327.x6.nabble.com/keycloak-user-can-we-use-authorization-with-bearer-only-td2123.html>
).

My question is: Is this a normal behavior of Keycloak? Why allow the
Authorization tab in bearer-only clients if you cannot use the
keycloak.enforcer? Am I missing some configuration?

Thanks for your help.


Stackoverflow question:
https://stackoverflow.com/questions/56906984/keycloak-policy-enforcer-bearer-only-client

From almeidaraf at gmail.com  Fri Jul  5 16:39:53 2019
From: almeidaraf at gmail.com (Rafael Almeida)
Date: Fri, 5 Jul 2019 21:39:53 +0100
Subject: [keycloak-user] Serving SPA + API with keycloak-gatekeeper
Message-ID: <CAKCnWV=wTYE15LWU8x39r8Qw80LWKc9wePOf55UzyCr_gnrwow@mail.gmail.com>

Hello,

I think I must be missing something. I have a SPA and a backend. Currently,
for simplicity, they are being served together from the same hostname (and
server). I was able to configure keycloak-gatekeeper in front of it and
everything seemed to work well at first. The / (root), which serves my SPA,
redirects the user and, after they login, all endpoints become available.

However, if the user logs out and still have the SPA loaded, the javascript
will attempt to make requests to the API, but it will be unauthorized at
this time. The API, however, instead of giving out a helpful 401, will
respond with a 307. Understandable.

I looked into the gatekeeper's docs and there is a no-redirects option.
However, it's a global one, rather than per endpoint. That means that the
only option to get the behaviour I want is to have two gatekeepers, one for
the API and the other for the SPA, both sharing the same encryption key (so
that they use the same session). They also need to be behind the same load
balancer so they share hostnames. I think that'd work but it seems rather
cumbersome. What am I missing? Am I doing things in a very unusual way? How
else could I set this up?

Thanks,
Rafael

From srinivas.nangunoori at microfocus.com  Sun Jul  7 12:36:57 2019
From: srinivas.nangunoori at microfocus.com (Srinivas Nangunoori)
Date: Sun, 7 Jul 2019 16:36:57 +0000
Subject: [keycloak-user] keycloak 2.5.5-final with bc-fips-1.0.1.jar
Message-ID: <MN2PR18MB25594E6853391D1FA3B292D780F70@MN2PR18MB2559.namprd18.prod.outlook.com>

Hi Experts,

We want to integrate bc-fips in our application. We have changed our standalone.xml (Wildfly) to use BCKFS keystore and changed java.security to use
security.provider.1=org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider
and
keystore.type=bcfks

Copied bc-fips-1.0.1.jar to
jre/lib/ext
/modules/system/layers/base/org/bouncycastle/fips


But when I start my application, I see following error,
Caused by: java.lang.NoClassDefFoundError: org/bouncycastle/jce/provider/BouncyCastleProvider
               at org.keycloak.common.util.PemUtils.<clinit>(PemUtils.java:41)
               at org.keycloak.adapters.KeycloakDeploymentBuilder.internalBuild(KeycloakDeploymentBuilder.java:63)
               at org.keycloak.adapters.KeycloakDeploymentBuilder.build(KeycloakDeploymentBuilder.java:137)
               at org.keycloak.adapters.undertow.KeycloakServletExtension.handleDeployment(KeycloakServletExtension.java:135)
               at io.undertow.servlet.core.DeploymentManagerImpl.handleExtensions(DeploymentManagerImpl.java:252)
               at io.undertow.servlet.core.DeploymentManagerImpl.deploy(DeploymentManagerImpl.java:152)
               at org.wildfly.extension.undertow.deployment.UndertowDeploymentService.startContext(UndertowDeploymentService.java:100)
               at org.wildfly.extension.undertow.deployment.UndertowDeploymentService$1.run(UndertowDeploymentService.java:82)
Not sure what I am missing. Could any one help me here.

-Srini



From sylvain.malnuit at lyra-network.com  Mon Jul  8 04:12:20 2019
From: sylvain.malnuit at lyra-network.com (Sylvain Malnuit)
Date: Mon, 8 Jul 2019 10:12:20 +0200 (CEST)
Subject: [keycloak-user] Contributions
Message-ID: <2037353038.3420649.1562573540124.JavaMail.zimbra@lyra-network.com>

Hi,
I want to share with you my contributions to Keycloak:
* https://github.com/malys/rh-sso-email-with-attachment: extension to attach files located in theme repository to email
* https://github.com/malys/keycloak-groovy-helpers: high level groovy script using Java Admin API to script configuration and actions. I use it to automate deployment
* https://github.com/malys/rh-sso-rest_federation: a generic REST federation supporting role, attributes and many options (I will probably include it in Ansible plugin)
* https://github.com/malys/rh-sso-listener-log: Generate detailed logs for audit

Feel free to use it, fork it or improve it.

Bye

Sylvain


From stelios.kyprou at hellasdirect.gr  Mon Jul  8 05:01:30 2019
From: stelios.kyprou at hellasdirect.gr (Stelios Kyprou)
Date: Mon, 8 Jul 2019 12:01:30 +0300
Subject: [keycloak-user] Public and Bearer-only role propagation
Message-ID: <CAMtC3YpvnKQSmM4HcFieCtKZbu1bv5rdimdqK0C8hhmmORbSHQ@mail.gmail.com>

Hello guys,

I am trying to work with the following setup, with the goal of eventually
propagating Keycloak roles from the public client (front-end) to Spring
Security Roles of a bearer-only client (back-end):

Client Name Client Type Client Role Full Scope Allowed
portals-frontend public TEST_ROLE FALSE
portals-backend bearer-only
VERSIONS:
*Spring Boot:*
org.keycloak:keycloak-spring-boot-2-starter:4.0.0.Final
org.springframework.boot:spring-boot-starter-security:2.1.4.RELEASE
*Angular:*
angular: 7
"keycloak-angular": "6.1.0"
*Keycloak Server:*
4.0.0.Final

My Angular app is using *portals-frontend *client
My Spring-Boot-2 app is using *portals-backend *client

When running this setup, the back-end verifies the token, but it does not
map the *portals-frontend* client Roles into *spring security
principal.deatils.roles*. The only way I managed to do this is two ways;

   1. Set *Full Scope allowed* to *true. (*I don't like this since we can't
   restrict the roles in each client token*)*
   2. Use the same KC client in the back-end as the one used in the
   front-end app. (This means that new front-end apps that will need different
   rights, therefore a new client, will not be able to use the same back-end
   service)

*QUESTION:*
Is there a 3rd way, where I keep my configuration as is, and manage to map
KC Roles into spring security's *principal.details.roles *list in the
back-end and include the front-end client roles?

Thanks in advance!

P.S:
*Additional context:*
The Spring-Boot-2 configurations is:
keycloak:
  realm: internal-portals
  bearer-only: true
  auth-server-url: <VALID URL>
  ssl-required: external
  resource: portals-backend
  confidential-port: 0
  principal-attribute: preferred_username
  use-resource-role-mappings: true

With the following security config:

@KeycloakConfiguration
class SecurityConfig(private val securityProperties: SecurityProperties) :
KeycloakWebSecurityConfigurerAdapter() {
    @Bean
    fun keycloakConfigResolver(): KeycloakConfigResolver {
        return KeycloakSpringBootConfigResolver()
    }

    @Autowired
    @Throws(Exception::class)
    fun configureGlobal(auth: AuthenticationManagerBuilder) {
        val keycloakAuthenticationProvider =
keycloakAuthenticationProvider()

keycloakAuthenticationProvider.setGrantedAuthoritiesMapper(SimpleAuthorityMapper())

        auth.authenticationProvider(keycloakAuthenticationProvider)
    }

    @Bean
    override fun sessionAuthenticationStrategy():
SessionAuthenticationStrategy {
        return NullAuthenticatedSessionStrategy()
    }
...
}

From andrew.martel at indexexchange.com  Mon Jul  8 10:45:48 2019
From: andrew.martel at indexexchange.com (Andrew Martel)
Date: Mon, 8 Jul 2019 14:45:48 +0000
Subject: [keycloak-user] KEYCLOAK-3205
In-Reply-To: <20190704225614.GA27142@abstractj.org>
References: <YTOPR0101MB13404B66AF95D182C779B62FF6FA0@YTOPR0101MB1340.CANPRD01.PROD.OUTLOOK.COM>
	<20190704225614.GA27142@abstractj.org>
Message-ID: <YTOPR0101MB134094148B41CBC5A1FF58C0F6F60@YTOPR0101MB1340.CANPRD01.PROD.OUTLOOK.COM>

Ok, thank you for the response.  I'll watch the ticket as suggested.  I'm looking forward to seeing this released.

Regards,
Andrew

-----Original Message-----
From: Bruno Oliveira <bruno at abstractj.org> 
Sent: Thursday, July 4, 2019 6:56 PM
To: Andrew Martel <andrew.martel at indexexchange.com>
Cc: keycloak-user at lists.jboss.org; Hynek Mlnarik <hmlnarik at redhat.com>
Subject: Re: [keycloak-user] KEYCLOAK-3205

Hi Andrew, the team started to look at this, but we cannot commit with any dates yet. To keep track of the work just keep an eye on:
https://issues.jboss.org/browse/KEYCLOAK-3205

On 2019-07-04, Andrew Martel wrote:
> Hello,
> 
>    My company is waiting on the functionality to have encrypted client secrets: https://github.com/keycloak/keycloak-community/blob/master/design/secure-credentials-store.md.
> 
> Would someone be able to provide me with a timeline on when this will be released?
> 
> Thanks,
> Andrew Martel
> 
> 
> CONFIDENTIALITY NOTICE AND DISCLAIMER : This telecommunication, including any and all attachments, contains confidential information intended only for the person(s) to whom it is addressed. Any dissemination, distribution, copying or disclosure is strictly prohibited and is not a waiver of confidentiality. If you have received this telecommunication in error, please notify the sender immediately by return electronic mail and delete the message from your inbox and deleted items folders. This telecommunication does not constitute an express or implied agreement to conduct transactions by electronic means, nor does it constitute a contract offer, a contract amendment or an acceptance of a contract offer. Contract terms contained in this telecommunication are subject to legal review and the completion of formal documentation and are not binding until same is confirmed in writing and has been signed by an authorized signatory.
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

-- 

abstractj


From M.Notarnicola at klopotek.it  Mon Jul  8 12:02:03 2019
From: M.Notarnicola at klopotek.it (Notarnicola, Mara)
Date: Mon, 8 Jul 2019 16:02:03 +0000
Subject: [keycloak-user] FW: Override "native" Keycloak providers
In-Reply-To: <7D37129B-790A-41F1-9616-BF35B5D22EAA@contoso.com>
References: <7D37129B-790A-41F1-9616-BF35B5D22EAA@contoso.com>
Message-ID: <d2d7b5aa1bee499dbec5ef4b00a68e4a@Taylor.core.klopotek.local>

Hi all,
I'm using keycloak 6.0.1 and I'm facing the same issue, are there some update about this request?

----
Notarnicola, Mara
Software Engineer
Klopotek Software & Technology Services Italia srl
Via Federico II di Svevia, 4481
70023 ? Gioia del Colle (BA)
https://www.klopotek.com

-----Original Message-----
From: keycloak-user-bounces at lists.jboss.org [mailto:keycloak-user-bounces at lists.jboss.org] On Behalf Of Jerry Saravia
Sent: Tuesday, March 26, 2019 9:19 PM
To: keycloak-user at lists.jboss.org
Subject: [keycloak-user] Override "native" Keycloak providers

Hello,

Disclaimer: This might be a keycloak dev mailing list question.

We?ve been using version 3.4.3 for a while now and are attempting to upgrade to 4.8 and we?ve run into some issues.

Summary: We have created our own providers with the same PROVIDER_ID as some of the built in providers. For example, PasswordCredentialProvider has a provider id of ?keycloak-password? and we created our own with the same id that gets loaded after the native one. This worked because in 3.4.3 providers that were using the same id would still have their factories added to the factory map.

See this link here for 3.4.3 changes:
https://github.com/keycloak/keycloak/blob/3.4.3.Final/services/src/main/java/org/keycloak/provider/ProviderManager.java#L96-L100

These are the 4.8 changes
https://github.com/keycloak/keycloak/blob/4.8.3.Final/services/src/main/java/org/keycloak/provider/ProviderManager.java#L96-L99

In 4.8, the fully qualified class name (FQCN) is not longer used. Instead it uses the provider id and the spi name. I can no longer use the same PROVIDER_ID as the native providers to ?override? them, but sometimes there is code that gets the provider specifically by id. For example, in the UpdatePassword required action we have this:

PasswordCredentialProvider passwordProvider = (PasswordCredentialProvider)context.getSession().getProvider(CredentialProvider.class, PasswordCredentialProviderFactory.PROVIDER_ID);

In 3.4.3 because our provider was loaded we were able to inject into code that normally isn?t overridable. We did the same for the OIDCLoginProtocolFactory to alter some token endpoint behavior even the UpdatePassword required action itself rather than making a brand new required action that is a ?second rate? because it isn?t native to Keycloak.

Is there a solution for this in 4.8.3? I see this change was made in 4.0.0.Beta1 according to some of the history.

J



Jerry Saravia
Software Engineer
T(516) 603-6914
M516-603-6914
virginpulse.com
|virginpulse.com/global-challenge
492 Old Connecticut Path, Framingham, MA 01701, USA Australia | Bosnia and Herzegovina | Brazil | Canada | Singapore | Switzerland | United Kingdom | USA Confidentiality Notice: The information contained in this e-mail, including any attachment(s), is intended solely for use by the designated recipient(s). Unauthorized use, dissemination, distribution, or reproduction of this message by anyone other than the intended recipient(s), or a person designated as responsible for delivering such messages to the intended recipient, is strictly prohibited and may be unlawful. This e-mail may contain proprietary, confidential or privileged information. Any views or opinions expressed are solely those of the author and do not necessarily represent those of Virgin Pulse, Inc. If you have received this message in error, or are not the named recipient(s), please immediately notify the sender and delete this e-mail message.
v2.48


From pnalyvayko at agi.com  Mon Jul  8 12:02:20 2019
From: pnalyvayko at agi.com (Nalyvayko, Peter)
Date: Mon, 8 Jul 2019 16:02:20 +0000
Subject: [keycloak-user] Not being prompted for x509 User Certs on
 KeyCloak version 4.8.3.Final
In-Reply-To: <CAEyJD6PjOeBtfYw7u0wpfZ7+jgK-N3siz+o1zGx04jnJfShQgg@mail.gmail.com>
References: <CAEyJD6OjC7CCnB9yEvDor8N3nXdq14yxebXAqRJp7RWrRpD43w@mail.gmail.com>
	<BN6PR07MB3073771E9773FD3731F68774DAFD0@BN6PR07MB3073.namprd07.prod.outlook.com>
	<CAEyJD6N932LKJ_nMzyCZh7+W4Nf55+JV+NvSMR_GQXSO9x3BPA@mail.gmail.com>
	<MWHPR07MB3088D05DBB4E6F7F15597605DAFC0@MWHPR07MB3088.namprd07.prod.outlook.com>
	<CAEyJD6MSvv9N=en4NVj_ZXjcsQ4SGZDMsEevSa8sF6B2RRg8qw@mail.gmail.com>
	<CAEyJD6OayUyEJMOX2s8Be7DiEH_n_pYntEv5s9df-Fs9FU0tSA@mail.gmail.com>
	<MWHPR07MB3088E6EBC8733EF9D9B1BF38DAFC0@MWHPR07MB3088.namprd07.prod.outlook.com>
	<CAEyJD6OqDhukpWupBR96s5NTEkEkFm5NcKuJNWy1C3FJh1JrHg@mail.gmail.com>
	<CAEyJD6PjOeBtfYw7u0wpfZ7+jgK-N3siz+o1zGx04jnJfShQgg@mail.gmail.com>
Message-ID: <BN6PR07MB30734CA0AC96FE5C3D15E23EDAF60@BN6PR07MB3073.namprd07.prod.outlook.com>

Can you confirm that the SSL termination is handled by individual Keycloak instances?

From: JTK <jonesy at sydow.org>
Sent: Friday, July 5, 2019 8:40 AM
To: Nalyvayko, Peter <pnalyvayko at agi.com>
Cc: keycloak-user at lists.jboss.org
Subject: Re: [keycloak-user] Not being prompted for x509 User Certs on KeyCloak version 4.8.3.Final

Just now getting back to this due to the holiday week, but I don't believe we need the chain loaded on the ELB on the smart card, as it's a pass-through and the certs in question that are on the smart card are loaded into the KeyCloak keystore, and once a user launches the KeyCloak interface it should reference the internal KeyCloak keystore to verify the chain. I would only need the certs on the ELB if we were requiring user certs prior to the KeyCloak website, which we aren't.
It looks like I'm back to square one. Thoughts?


On Fri, Jun 28, 2019 at 11:41 AM JTK <jonesy at sydow.org<mailto:jonesy at sydow.org>> wrote:
Obviously the certs are not loaded on the ELB as I need them.
openssl s_client -servername keycloak.domainhere.net<http://keycloak.domainhere.net> -connect keycloak.domainhere.net:8443<http://keycloak.dev.domainhere.net:8443> 2>/dev/null | egrep "subject=|issuer=|notAfter="
subject=CN = keycloak.domainhere.net<http://keycloak.dev.domainhere.net>
issuer=C = US, O = Amazon, OU = Server CA 1B, CN = Amazon

I'm waiting on feedback from our internal team to find out when they can load the Root CA/Intermediate certs on the proxy. It might not be until next week, but I will update when I get a chance.

Thanks!

On Fri, Jun 28, 2019 at 10:57 AM Nalyvayko, Peter <pnalyvayko at agi.com<mailto:pnalyvayko at agi.com>> wrote:
Run the command "openssl s_client -connect <host>:<port>" where host and port are the Keycloak's host and the port number (e.g. login.mycompany.com:443<http://login.mycompany.com:443>) and verify that the list of  certificates listed under "Acceptable CA client certificate names" is not empty and that the CA names match the client cert's issuer


________________________________________
From: JTK [jonesy at sydow.org<mailto:jonesy at sydow.org>]
Sent: Friday, June 28, 2019 11:27 AM
To: Nalyvayko, Peter
Cc: keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>
Subject: Re: [keycloak-user] Not being prompted for x509 User Certs on KeyCloak version 4.8.3.Final

Here is the standalone.xml file if anyone can sport or locate any obvious errors associated with it.
https://zerobin.net/?740f9250fdc1a6f1#9FqhPJx0iNfQshWY8hA2aYdWPhWUEVHW5peZuGfU8cw=

Authentication flow:
https://imgur.com/tZYj9N9  (Bindings)
https://imgur.com/3v2HYtW (Flows)

On Fri, Jun 28, 2019 at 9:13 AM JTK <jonesy at sydow.org<mailto:jonesy at sydow.org><mailto:jonesy at sydow.org<mailto:jonesy at sydow.org>>> wrote:
I'll look into it. I'm sure it's something simple, but it's just not clicking. As of now I'm only testing my CAC and so there is a Root CA along with an intermediate CA which I have loaded into Keycloak.
This is the steps I used:

keytool -import -alias ROOT-CA -keystore keystore.jks -file Root-CA.cer

keytool -import -alias EMAIL-CA-INTERMEDIATE-1 -keystore keystore.jks -file Email-CA-1.cer

...

Just for clarity and sanity check, with our current IdP, we only need to load the public certs (Root/Intermediate) and as long as they are loaded, any user certificate that is presented would be trusted if the chain is loaded for that user certificate. We do not have access to the private keys for the certificates loaded to the keystore.jks - I just want to make sure that's not the issue.


At this point in time, I'd love to see ERROR in the server.log file, but I just get INFO.

tail -f /opt/keycloak/standalone/log/server.log | grep -E "WARN|ERROR"

The output of the above command has no output.


This is some of the output:

2019-06-28 13:55:07,507 INFO  [stdout] (default I/O-3) *** Finished
2019-06-28 13:55:07,507 INFO  [stdout] (default I/O-3) verify_data:  { 99, 40, 129, 188, 202, 118, 214, 208, 192, 179, 230, 8 }
2019-06-28 13:55:07,507 INFO  [stdout] (default I/O-3) ***
2019-06-28 13:55:07,507 INFO  [stdout] (default I/O-3) update handshake state: finished[20]
2019-06-28 13:55:07,507 INFO  [stdout] (default I/O-3) [write] MD5 and SHA1 hashes:  len = 16
2019-06-28 13:55:07,508 INFO  [stdout] (default I/O-3) 0000: 14 00 00 0C 63 28 81 BC   CA 76 D6 D0 C0 B3 E6 08  ....c(...v......
2019-06-28 13:55:07,508 INFO  [stdout] (default I/O-3) Padded plaintext before ENCRYPTION:  len = 16
2019-06-28 13:55:07,508 INFO  [stdout] (default I/O-3) 0000: 14 00 00 0C 63 28 81 BC   CA 76 D6 D0 C0 B3 E6 08  ....c(...v......
2019-06-28 13:55:07,509 INFO  [stdout] (default I/O-3) default I/O-3, WRITE: TLSv1.2 Handshake, length = 40
2019-06-28 13:55:07,509 INFO  [stdout] (default I/O-3) %% Cached server session: [Session-15, TLS_RSA_WITH_AES_256_GCM_SHA384]
2019-06-28 13:55:07,509 INFO  [stdout] (default I/O-3) [Raw write]: length = 6
2019-06-28 13:55:07,509 INFO  [stdout] (default I/O-3) 0000: 14 03 03 00 01 01                                  ......
2019-06-28 13:55:07,509 INFO  [stdout] (default I/O-3) [Raw write]: length = 45
2019-06-28 13:55:07,509 INFO  [stdout] (default I/O-3) 0000: 16 03 03 00 28 00 00 00   00 00 00 00 00 73 16 4F  ....(........s.O
2019-06-28 13:55:07,510 INFO  [stdout] (default I/O-3) 0010: C2 AA 1E 08 25 E9 36 15   77 D5 D4 18 E0 F8 BE BE  ....%.6.w.......
2019-06-28 13:55:07,510 INFO  [stdout] (default I/O-3) 0020: 24 8A F4 7F 33 D2 CA D3   C5 FA A5 05 54           $...3.......T

etc


Here is the output of keystore.jks

keytool -list -v -keystore keycloak.jks | grep DoD
Enter keystore password:  password
Owner: CN=Root CA, OU=PKI, O=Company, C=US
Issuer: CN=Root CA, OU=PKI, O=Company, C=US
Owner: CN=EMAIL CA-1, OU=PKI, O=Company, C=US
Issuer: CN=Root CA, OU=PKI, O=Company, C=US


Sows the Root CA and the Intermediate CA (CA-1)


On Fri, Jun 28, 2019 at 8:33 AM Nalyvayko, Peter <pnalyvayko at agi.com<mailto:pnalyvayko at agi.com><mailto:pnalyvayko at agi.com<mailto:pnalyvayko at agi.com>>> wrote:
We have successfully tested and deployed the CAC card & X509 auth without any issues. One suggestion is In the SSL debug output search for a list of CA authorities the KC server sends back to the client as a part of mutual SSL handshake. For the mutual SSL to kick in, the  client certificates registered on the client machine must be  signed by one of the CAs from that list.

For example, say your trusted store has a CA cert with the Subject: CN=cert_auth

Then you should be prompted to select a cert only if your client cert's issuer (the cert used to sign the client cert) matches the subject above.

You may also try  troubleshooting using "openssl s_client" to avoid digging through thousands of lines of SSL debug output

I hope it makes sense and helps :)

Cheers

--Peter

________________________________________
From: JTK [jonesy at sydow.org<mailto:jonesy at sydow.org><mailto:jonesy at sydow.org<mailto:jonesy at sydow.org>>]
Sent: Friday, June 28, 2019 9:17 AM
To: Nalyvayko, Peter
Cc: keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org><mailto:keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>>
Subject: Re: [keycloak-user] Not being prompted for x509 User Certs on KeyCloak version 4.8.3.Final

Thanks, I enabled the debug option for ssl in ../keycloak/bin/standalone.conf
if [ "x$JAVA_OPTS" = "x" ]; then
   JAVA_OPTS="-Xms64m -Xmx512m -XX:MetaspaceSize=96M -XX:MaxMetaspaceSize=256m -Djava.net.preferIPv4Stack=true"
   JAVA_OPTS="$JAVA_OPTS -Djboss.modules.system.pkgs=$JBOSS_MODULES_SYSTEM_PKGS -Djava.awt.headless=true -Djavax.net.debug=ssl"

I am seeing no errors in the logs related to certificates. I do see the root CA I'm trying to use along with the intermediate.
I am using a client certificate, but I'm providing it via a card reader on my computer. So I'm presenting a token on a smart card per say and not a soft cert loaded on my system.
Would this make a difference? Should I be seeing any sort of error output in the logs if the certs were loaded wrong or any other JAVA related issue?
I can post the debug output, but it's quite line.
-
Note, we currently use a commercial based IdP which accepts our smart card with tokens on them, so I assumed Keycloak by default would see a certificate loaded locally or via the smart card reader.


On Thu, Jun 27, 2019 at 6:41 PM Nalyvayko, Peter <pnalyvayko at agi.com<mailto:pnalyvayko at agi.com><mailto:pnalyvayko at agi.com<mailto:pnalyvayko at agi.com>><mailto:pnalyvayko at agi.com<mailto:pnalyvayko at agi.com><mailto:pnalyvayko at agi.com<mailto:pnalyvayko at agi.com>>>> wrote:
One possible reason you are not getting prompted is that the intermediate or root certs in your trust store do not match the intermediate or root certs used to sign the client certificates registered on your client machine. To troubleshoot the SSL handshake you can use -Djavax.net.debug, see https://access.redhat.com/solutions/973783 for more info.

________________________________________
From: keycloak-user-bounces at lists.jboss.org<mailto:keycloak-user-bounces at lists.jboss.org><mailto:keycloak-user-bounces at lists.jboss.org<mailto:keycloak-user-bounces at lists.jboss.org>><mailto:keycloak-user-bounces at lists.jboss.org<mailto:keycloak-user-bounces at lists.jboss.org><mailto:keycloak-user-bounces at lists.jboss.org<mailto:keycloak-user-bounces at lists.jboss.org>>> [keycloak-user-bounces at lists.jboss.org<mailto:keycloak-user-bounces at lists.jboss.org><mailto:keycloak-user-bounces at lists.jboss.org<mailto:keycloak-user-bounces at lists.jboss.org>><mailto:keycloak-user-bounces at lists.jboss.org<mailto:keycloak-user-bounces at lists.jboss.org><mailto:keycloak-user-bounces at lists.jboss.org<mailto:keycloak-user-bounces at lists.jboss.org>>>] on behalf of JTK [jonesy at sydow.org<mailto:jonesy at sydow.org><mailto:jonesy at sydow.org<mailto:jonesy at sydow.org>><mailto:jonesy at sydow.org<mailto:jonesy at sydow.org><mailto:jonesy at sydow.org<mailto:jonesy at sydow.org>>>]
Sent: Thursday, June 27, 2019 2:00 PM
To: keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org><mailto:keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>><mailto:keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org><mailto:keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>>>
Subject: [keycloak-user] Not being prompted for x509 User Certs on KeyCloak     version 4.8.3.Final

 I've read through all the documentation I can find online both with the
official documents and everything else I could find and I believe I have
everything setup, with additional logging turned on, but I'm not getting
any type of prompt for a x509 certificate when logging in.

 Here is the excerpts from the standalone.xml file where ssl-realm was
added to the management security-realms and under the subsystem.

    <management>
        <security-realms>
         ......
            <security-realm name="ssl-realm">
                <server-identities>
                    <ssl>
                        <keystore path="keycloak.jks"
relative-to="jboss.server.config.dir" keystore-password="mypass"/>
                    </ssl>
                </server-identities>
                <authentication>
                    <truststore path="truststore.jks"
relative-to="jboss.server.config.dir" keystore-password="mypass"/>
                </authentication>
            </security-realm>
            ......

        <subsystem xmlns="urn:jboss:domain:undertow:7.0"
default-server="default-server" default-virtual-host="default-host"
default-servlet-container="default" default-security-domain="other">
            <buffer-cache name="default"/>
            <server name="default-server">
                <http-listener name="default1" socket-binding="http"
redirect-socket="https" enable-http2="true"/>
                <https-listener name="default" socket-binding="https"
security-realm="ssl-realm" verify-client="REQUESTED"/>
                <host name="default-host" alias="localhost">
                    <location name="/" handler="welcome-content"/>
                    <access-log worker="default"
directory="${jboss.server.log.dir}" prefix="access" suffix=".log"/>
                    <http-invoker security-realm="ApplicationRealm"/>
                </host>

 I've setup the Authentication Flows for the Browser to have x509/Validate
Username Form above the new Browser flow and it's required.
Everything is setup per the KeyCloak documentation to include the binding
settings.

The only thing I'm not sure about is if the keycloak.jks and truststore.jks
files are the issue.
I have enabled extra logging as best I know, but I'm not seeing anything in
the logs of any relevance when trying to authenticate into the Keycloak
Realm.

Can anyone assist? We are looking to most likely purchase this as a product
through RedHat SSO if it works well to get the support we need, but I've
been hung up on this for a few weeks and I know it shouldn't be this hard.

Thanks,
J
_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org><mailto:keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>><mailto:keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org><mailto:keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>>>
https://lists.jboss.org/mailman/listinfo/keycloak-user

From jonesy at sydow.org  Mon Jul  8 12:05:31 2019
From: jonesy at sydow.org (JTK)
Date: Mon, 8 Jul 2019 11:05:31 -0500
Subject: [keycloak-user] Not being prompted for x509 User Certs on
 KeyCloak version 4.8.3.Final
In-Reply-To: <BN6PR07MB30734CA0AC96FE5C3D15E23EDAF60@BN6PR07MB3073.namprd07.prod.outlook.com>
References: <CAEyJD6OjC7CCnB9yEvDor8N3nXdq14yxebXAqRJp7RWrRpD43w@mail.gmail.com>
	<BN6PR07MB3073771E9773FD3731F68774DAFD0@BN6PR07MB3073.namprd07.prod.outlook.com>
	<CAEyJD6N932LKJ_nMzyCZh7+W4Nf55+JV+NvSMR_GQXSO9x3BPA@mail.gmail.com>
	<MWHPR07MB3088D05DBB4E6F7F15597605DAFC0@MWHPR07MB3088.namprd07.prod.outlook.com>
	<CAEyJD6MSvv9N=en4NVj_ZXjcsQ4SGZDMsEevSa8sF6B2RRg8qw@mail.gmail.com>
	<CAEyJD6OayUyEJMOX2s8Be7DiEH_n_pYntEv5s9df-Fs9FU0tSA@mail.gmail.com>
	<MWHPR07MB3088E6EBC8733EF9D9B1BF38DAFC0@MWHPR07MB3088.namprd07.prod.outlook.com>
	<CAEyJD6OqDhukpWupBR96s5NTEkEkFm5NcKuJNWy1C3FJh1JrHg@mail.gmail.com>
	<CAEyJD6PjOeBtfYw7u0wpfZ7+jgK-N3siz+o1zGx04jnJfShQgg@mail.gmail.com>
	<BN6PR07MB30734CA0AC96FE5C3D15E23EDAF60@BN6PR07MB3073.namprd07.prod.outlook.com>
Message-ID: <CAEyJD6NqVqb1BEGEaesmz7NXiyokCRvHc4XLMvPSx4647bSFag@mail.gmail.com>

Yes, there is no proxy, just a ELB with pass-through. I'm wondering if I
have something misconfigured in the config file.

On Mon, Jul 8, 2019, 11:02 AM Nalyvayko, Peter <pnalyvayko at agi.com> wrote:

> Can you confirm that the SSL termination is handled by individual Keycloak
> instances?
>
>
>
> *From:* JTK <jonesy at sydow.org>
> *Sent:* Friday, July 5, 2019 8:40 AM
> *To:* Nalyvayko, Peter <pnalyvayko at agi.com>
> *Cc:* keycloak-user at lists.jboss.org
> *Subject:* Re: [keycloak-user] Not being prompted for x509 User Certs on
> KeyCloak version 4.8.3.Final
>
>
>
> Just now getting back to this due to the holiday week, but I don't believe
> we need the chain loaded on the ELB on the smart card, as it's a
> pass-through and the certs in question that are on the smart card are
> loaded into the KeyCloak keystore, and once a user launches the KeyCloak
> interface it should reference the internal KeyCloak keystore to verify the
> chain. I would only need the certs on the ELB if we were requiring user
> certs prior to the KeyCloak website, which we aren't.
>
> It looks like I'm back to square one. Thoughts?
>
>
>
>
>
> On Fri, Jun 28, 2019 at 11:41 AM JTK <jonesy at sydow.org> wrote:
>
> Obviously the certs are not loaded on the ELB as I need them.
> openssl s_client -servername keycloak.domainhere.net -connect
> keycloak.domainhere.net:8443 <http://keycloak.dev.domainhere.net:8443>
> 2>/dev/null | egrep "subject=|issuer=|notAfter="
> subject=CN = keycloak.domainhere.net <http://keycloak.dev.domainhere.net>
> issuer=C = US, O = Amazon, OU = Server CA 1B, CN = Amazon
>
>
>
> I'm waiting on feedback from our internal team to find out when they can
> load the Root CA/Intermediate certs on the proxy. It might not be until
> next week, but I will update when I get a chance.
>
>
>
> Thanks!
>
>
>
> On Fri, Jun 28, 2019 at 10:57 AM Nalyvayko, Peter <pnalyvayko at agi.com>
> wrote:
>
> Run the command "openssl s_client -connect <host>:<port>" where host and
> port are the Keycloak's host and the port number (e.g.
> login.mycompany.com:443) and verify that the list of  certificates listed
> under "Acceptable CA client certificate names" is not empty and that the CA
> names match the client cert's issuer
>
>
> ________________________________________
> From: JTK [jonesy at sydow.org]
> Sent: Friday, June 28, 2019 11:27 AM
> To: Nalyvayko, Peter
> Cc: keycloak-user at lists.jboss.org
> Subject: Re: [keycloak-user] Not being prompted for x509 User Certs on
> KeyCloak version 4.8.3.Final
>
> Here is the standalone.xml file if anyone can sport or locate any obvious
> errors associated with it.
>
> https://zerobin.net/?740f9250fdc1a6f1#9FqhPJx0iNfQshWY8hA2aYdWPhWUEVHW5peZuGfU8cw=
>
> Authentication flow:
> https://imgur.com/tZYj9N9  (Bindings)
> https://imgur.com/3v2HYtW (Flows)
>
> On Fri, Jun 28, 2019 at 9:13 AM JTK <jonesy at sydow.org<mailto:
> jonesy at sydow.org>> wrote:
> I'll look into it. I'm sure it's something simple, but it's just not
> clicking. As of now I'm only testing my CAC and so there is a Root CA along
> with an intermediate CA which I have loaded into Keycloak.
> This is the steps I used:
>
> keytool -import -alias ROOT-CA -keystore keystore.jks -file Root-CA.cer
>
> keytool -import -alias EMAIL-CA-INTERMEDIATE-1 -keystore keystore.jks
> -file Email-CA-1.cer
>
> ...
>
> Just for clarity and sanity check, with our current IdP, we only need to
> load the public certs (Root/Intermediate) and as long as they are loaded,
> any user certificate that is presented would be trusted if the chain is
> loaded for that user certificate. We do not have access to the private keys
> for the certificates loaded to the keystore.jks - I just want to make sure
> that's not the issue.
>
>
> At this point in time, I'd love to see ERROR in the server.log file, but I
> just get INFO.
>
> tail -f /opt/keycloak/standalone/log/server.log | grep -E "WARN|ERROR"
>
> The output of the above command has no output.
>
>
> This is some of the output:
>
> 2019-06-28 13:55:07,507 INFO  [stdout] (default I/O-3) *** Finished
> 2019-06-28 13:55:07,507 INFO  [stdout] (default I/O-3) verify_data:  { 99,
> 40, 129, 188, 202, 118, 214, 208, 192, 179, 230, 8 }
> 2019-06-28 13:55:07,507 INFO  [stdout] (default I/O-3) ***
> 2019-06-28 13:55:07,507 INFO  [stdout] (default I/O-3) update handshake
> state: finished[20]
> 2019-06-28 13:55:07,507 INFO  [stdout] (default I/O-3) [write] MD5 and
> SHA1 hashes:  len = 16
> 2019-06-28 13:55:07,508 INFO  [stdout] (default I/O-3) 0000: 14 00 00 0C
> 63 28 81 BC   CA 76 D6 D0 C0 B3 E6 08  ....c(...v......
> 2019-06-28 13:55:07,508 INFO  [stdout] (default I/O-3) Padded plaintext
> before ENCRYPTION:  len = 16
> 2019-06-28 13:55:07,508 INFO  [stdout] (default I/O-3) 0000: 14 00 00 0C
> 63 28 81 BC   CA 76 D6 D0 C0 B3 E6 08  ....c(...v......
> 2019-06-28 13:55:07,509 INFO  [stdout] (default I/O-3) default I/O-3,
> WRITE: TLSv1.2 Handshake, length = 40
> 2019-06-28 13:55:07,509 INFO  [stdout] (default I/O-3) %% Cached server
> session: [Session-15, TLS_RSA_WITH_AES_256_GCM_SHA384]
> 2019-06-28 13:55:07,509 INFO  [stdout] (default I/O-3) [Raw write]: length
> = 6
> 2019-06-28 13:55:07,509 INFO  [stdout] (default I/O-3) 0000: 14 03 03 00
> 01 01                                  ......
> 2019-06-28 13:55:07,509 INFO  [stdout] (default I/O-3) [Raw write]: length
> = 45
> 2019-06-28 13:55:07,509 INFO  [stdout] (default I/O-3) 0000: 16 03 03 00
> 28 00 00 00   00 00 00 00 00 73 16 4F  ....(........s.O
> 2019-06-28 13:55:07,510 INFO  [stdout] (default I/O-3) 0010: C2 AA 1E 08
> 25 E9 36 15   77 D5 D4 18 E0 F8 BE BE  ....%.6.w.......
> 2019-06-28 13:55:07,510 INFO  [stdout] (default I/O-3) 0020: 24 8A F4 7F
> 33 D2 CA D3   C5 FA A5 05 54           $...3.......T
>
> etc
>
>
> Here is the output of keystore.jks
>
> keytool -list -v -keystore keycloak.jks | grep DoD
> Enter keystore password:  password
> Owner: CN=Root CA, OU=PKI, O=Company, C=US
> Issuer: CN=Root CA, OU=PKI, O=Company, C=US
> Owner: CN=EMAIL CA-1, OU=PKI, O=Company, C=US
> Issuer: CN=Root CA, OU=PKI, O=Company, C=US
>
>
> Sows the Root CA and the Intermediate CA (CA-1)
>
>
> On Fri, Jun 28, 2019 at 8:33 AM Nalyvayko, Peter <pnalyvayko at agi.com
> <mailto:pnalyvayko at agi.com>> wrote:
> We have successfully tested and deployed the CAC card & X509 auth without
> any issues. One suggestion is In the SSL debug output search for a list of
> CA authorities the KC server sends back to the client as a part of mutual
> SSL handshake. For the mutual SSL to kick in, the  client certificates
> registered on the client machine must be  signed by one of the CAs from
> that list.
>
> For example, say your trusted store has a CA cert with the Subject:
> CN=cert_auth
>
> Then you should be prompted to select a cert only if your client cert's
> issuer (the cert used to sign the client cert) matches the subject above.
>
> You may also try  troubleshooting using "openssl s_client" to avoid
> digging through thousands of lines of SSL debug output
>
> I hope it makes sense and helps :)
>
> Cheers
>
> --Peter
>
> ________________________________________
> From: JTK [jonesy at sydow.org<mailto:jonesy at sydow.org>]
> Sent: Friday, June 28, 2019 9:17 AM
> To: Nalyvayko, Peter
> Cc: keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>
> Subject: Re: [keycloak-user] Not being prompted for x509 User Certs on
> KeyCloak version 4.8.3.Final
>
> Thanks, I enabled the debug option for ssl in
> ../keycloak/bin/standalone.conf
> if [ "x$JAVA_OPTS" = "x" ]; then
>    JAVA_OPTS="-Xms64m -Xmx512m -XX:MetaspaceSize=96M
> -XX:MaxMetaspaceSize=256m -Djava.net.preferIPv4Stack=true"
>    JAVA_OPTS="$JAVA_OPTS
> -Djboss.modules.system.pkgs=$JBOSS_MODULES_SYSTEM_PKGS
> -Djava.awt.headless=true -Djavax.net.debug=ssl"
>
> I am seeing no errors in the logs related to certificates. I do see the
> root CA I'm trying to use along with the intermediate.
> I am using a client certificate, but I'm providing it via a card reader on
> my computer. So I'm presenting a token on a smart card per say and not a
> soft cert loaded on my system.
> Would this make a difference? Should I be seeing any sort of error output
> in the logs if the certs were loaded wrong or any other JAVA related issue?
> I can post the debug output, but it's quite line.
> -
> Note, we currently use a commercial based IdP which accepts our smart card
> with tokens on them, so I assumed Keycloak by default would see a
> certificate loaded locally or via the smart card reader.
>
>
> On Thu, Jun 27, 2019 at 6:41 PM Nalyvayko, Peter <pnalyvayko at agi.com
> <mailto:pnalyvayko at agi.com><mailto:pnalyvayko at agi.com<mailto:
> pnalyvayko at agi.com>>> wrote:
> One possible reason you are not getting prompted is that the intermediate
> or root certs in your trust store do not match the intermediate or root
> certs used to sign the client certificates registered on your client
> machine. To troubleshoot the SSL handshake you can use -Djavax.net.debug,
> see https://access.redhat.com/solutions/973783 for more info.
>
> ________________________________________
> From: keycloak-user-bounces at lists.jboss.org<mailto:
> keycloak-user-bounces at lists.jboss.org><mailto:
> keycloak-user-bounces at lists.jboss.org<mailto:
> keycloak-user-bounces at lists.jboss.org>> [
> keycloak-user-bounces at lists.jboss.org<mailto:
> keycloak-user-bounces at lists.jboss.org><mailto:
> keycloak-user-bounces at lists.jboss.org<mailto:
> keycloak-user-bounces at lists.jboss.org>>] on behalf of JTK [
> jonesy at sydow.org<mailto:jonesy at sydow.org><mailto:jonesy at sydow.org<mailto:
> jonesy at sydow.org>>]
> Sent: Thursday, June 27, 2019 2:00 PM
> To: keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org
> ><mailto:keycloak-user at lists.jboss.org<mailto:
> keycloak-user at lists.jboss.org>>
> Subject: [keycloak-user] Not being prompted for x509 User Certs on
> KeyCloak     version 4.8.3.Final
>
>  I've read through all the documentation I can find online both with the
> official documents and everything else I could find and I believe I have
> everything setup, with additional logging turned on, but I'm not getting
> any type of prompt for a x509 certificate when logging in.
>
>  Here is the excerpts from the standalone.xml file where ssl-realm was
> added to the management security-realms and under the subsystem.
>
>     <management>
>         <security-realms>
>          ......
>             <security-realm name="ssl-realm">
>                 <server-identities>
>                     <ssl>
>                         <keystore path="keycloak.jks"
> relative-to="jboss.server.config.dir" keystore-password="mypass"/>
>                     </ssl>
>                 </server-identities>
>                 <authentication>
>                     <truststore path="truststore.jks"
> relative-to="jboss.server.config.dir" keystore-password="mypass"/>
>                 </authentication>
>             </security-realm>
>             ......
>
>         <subsystem xmlns="urn:jboss:domain:undertow:7.0"
> default-server="default-server" default-virtual-host="default-host"
> default-servlet-container="default" default-security-domain="other">
>             <buffer-cache name="default"/>
>             <server name="default-server">
>                 <http-listener name="default1" socket-binding="http"
> redirect-socket="https" enable-http2="true"/>
>                 <https-listener name="default" socket-binding="https"
> security-realm="ssl-realm" verify-client="REQUESTED"/>
>                 <host name="default-host" alias="localhost">
>                     <location name="/" handler="welcome-content"/>
>                     <access-log worker="default"
> directory="${jboss.server.log.dir}" prefix="access" suffix=".log"/>
>                     <http-invoker security-realm="ApplicationRealm"/>
>                 </host>
>
>  I've setup the Authentication Flows for the Browser to have x509/Validate
> Username Form above the new Browser flow and it's required.
> Everything is setup per the KeyCloak documentation to include the binding
> settings.
>
> The only thing I'm not sure about is if the keycloak.jks and truststore.jks
> files are the issue.
> I have enabled extra logging as best I know, but I'm not seeing anything in
> the logs of any relevance when trying to authenticate into the Keycloak
> Realm.
>
> Can anyone assist? We are looking to most likely purchase this as a product
> through RedHat SSO if it works well to get the support we need, but I've
> been hung up on this for a few weeks and I know it shouldn't be this hard.
>
> Thanks,
> J
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org
> ><mailto:keycloak-user at lists.jboss.org<mailto:
> keycloak-user at lists.jboss.org>>
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
>

From craig at baseventure.com  Mon Jul  8 12:34:47 2019
From: craig at baseventure.com (Craig Setera)
Date: Mon, 8 Jul 2019 11:34:47 -0500
Subject: [keycloak-user] Allowed SAML audiences?
Message-ID: <CAPVdwjq-LDOAqyJRRi31nPG4pVPdhbAWPSX7CjuUs+iE-vs-0w@mail.gmail.com>

If I have a SAML identity provider setup, what would the allowed audience
values look like by default?  Is there any place in the UI that I can see
the allowed audience values?

Thanks,
Craig

=================================
*Craig Setera*

*Chief Technology Officer*

From lrozenblyum at gmail.com  Tue Jul  9 03:56:04 2019
From: lrozenblyum at gmail.com (Leonid Rozenblyum)
Date: Tue, 9 Jul 2019 10:56:04 +0300
Subject: [keycloak-user] Single Logout in Identity brokering mode
In-Reply-To: <CANZPfwS15M7bp-rB93w+NV+y9gUOX2nZE5+DbRDjsNN-F7L+Jw@mail.gmail.com>
References: <CANZPfwS15M7bp-rB93w+NV+y9gUOX2nZE5+DbRDjsNN-F7L+Jw@mail.gmail.com>
Message-ID: <CANZPfwQm_F7m7MH0022aoBQ==nrj6=JhKbWLbvdpWm1eECWEkQ@mail.gmail.com>

1) Most likely keycloak cannot execute 3'd party log-out without browser
interaction when the 3'd party Idp is not supporting backchannel logout,
right?
so HttpServletRequest.logout() documentation should be extended to mention
this limitation
That's why redirect solution works
3) why is Spring Security adapter exposing '/sso/logout' endpoint as a
logout handler? is it a third 'unofficial' way to log-out?
it looks like it does a little bit less than HttpServletRequest.logout()
because HttpServletRequest.logout() also
invokes SecurityContextLogoutHandler after KeycloakLogoutHandler
(while /sso/logout directly invokes KeycloakLogoutHandler)

On Fri, May 17, 2019 at 10:46 AM Leonid Rozenblyum <lrozenblyum at gmail.com>
wrote:

> Hello!
>
> I'm working on Single Logout in Identity broker mode.
>
> App -> Keycloak (OpenIdConnect)
> Keycloak -> 3'd party (SAML)
>
> Documentation to keycloak states that there are 2 ways to execute logout.
> 1) HttpServletRequest.logout().
> 2) redirect the browser to
> http://auth-server/auth/realms/{realm-name}/protocol/openid-connect/logout?redirect_uri=encodedRedirectUri
>
> If I execute 2) it indeed causes Keycloak send SAML Logout request to the
> 3'd party Idp.
> However if I execute 1) SAML logout request is not sent thus 3'd party
> session is still valid.
>
> (I see that by enabling trace logging in keycloak and by fact that user is
> still logged in)
>
> Is it something by design/misconfiguration at my side or a bug?
>
>
>

From lrozenblyum at gmail.com  Tue Jul  9 04:39:36 2019
From: lrozenblyum at gmail.com (Leonid Rozenblyum)
Date: Tue, 9 Jul 2019 11:39:36 +0300
Subject: [keycloak-user] Persistent sessions
Message-ID: <CANZPfwQRnATpmd2Cn17crsuK9s0Msp97quKoWByREE1hmd4ciw@mail.gmail.com>

Hello!
I saw these questions in the mailing list 2017 and earlier but would like
to double check.

We'd like to enable persistent session feature of WildFly in Keycloak (in
non-HA environment)

By doing this in standalone.xml
<persistent-sessions path="sessionsStorage"/>

It looks like the feature is not working correctly with keycloak: after
keycloak reboot the sessions look lossed.

Is it a misconfiguration at my side or a totally not supported feature by
keycloak?
Thanks in advance for explanation

From manuel.waltschek at prisma-solutions.at  Tue Jul  9 07:27:39 2019
From: manuel.waltschek at prisma-solutions.at (Manuel Waltschek)
Date: Tue, 9 Jul 2019 11:27:39 +0000
Subject: [keycloak-user] SAML Logout Response 403 Forbidden
Message-ID: <30a0462454694938bfe0d03e51093eef@prisma-solutions.at>

Hello,

I am still trying to logout from my wildfly10 keycloak saml client application.

I already described my issues in https://lists.jboss.org/pipermail/keycloak-user/2019-June/018550.html

Quick summary:

I am trying to logout by calling

  private void requestGlobalLogout(HttpServletRequest req, HttpServletResponse resp)
      throws ServletException, IOException {
    String contextPath = req.getContextPath();
    resp.sendRedirect(contextPath + "?GLO=true");

  }

from a servlet. I am getting a LogoutResponse from my keycloak IdP with the following status code:

<samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>

It seems, that the client cannot handle this response and therefore redirects to a page with content


<html><head><title>Error</title></head><body>Forbidden</body></html>

with status code 403 Forbidden.

I would appreciate any further help, thank you in advance,

regards

[Logo]

Manuel Waltschek BSc.

+43 660 86655 47<tel:+436608665547>
manuel.waltschek at prisma-solutions.at<mailto:manuel.waltschek at prisma-solutions.at>
https://www.prisma-solutions.com

PRISMA solutions EDV-Dienstleistungen GmbH
Klostergasse 18, 2340 M?dling, Austria
Firmenbuch: FN 239449 g, Landesgericht Wiener Neustadt
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.png
Type: image/png
Size: 6418 bytes
Desc: image001.png
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20190709/a5f57d5d/attachment.png 

From yurexus at gmail.com  Tue Jul  9 08:21:39 2019
From: yurexus at gmail.com (Iurii)
Date: Tue, 9 Jul 2019 15:21:39 +0300
Subject: [keycloak-user] How to allow only tokens with a specific claim at
 identity brokering in KeyCloak?
Message-ID: <CAG-w2-7YDxZuTS4Wi-=n8UD8VgJEYoFa3QD3d2VrMHTm=s0bSg@mail.gmail.com>

Hello,

I am using KeyCloak with two external identity providers configured for
identity brokering. There is a requirement to not allow accessing the
application protected with KeyCloak if the token issued by one of the
external identity providers doesn't contain a specific claim.

In other words - if external IdP "A" issues a token without claim "xxx"
equal to "yyy", KeyCloak must not allow logging in.

Is it possible to configure this in KeyCloak, or I will have to modify the
application protected with KeyCloak to check this condition?

Thanks!

From psilva at redhat.com  Tue Jul  9 08:33:29 2019
From: psilva at redhat.com (Pedro Igor Silva)
Date: Tue, 9 Jul 2019 09:33:29 -0300
Subject: [keycloak-user] Keycloak policy enforcer for bearer-only client
In-Reply-To: <CAKY2RVe-Qbxri12F_fhXsDb-eRSp9_vPmT45dbq8vGoasmK2iA@mail.gmail.com>
References: <CAKY2RVe-Qbxri12F_fhXsDb-eRSp9_vPmT45dbq8vGoasmK2iA@mail.gmail.com>
Message-ID: <CAJrcDBf51x6taQ8Ptu7jWWNuZmWsn-DQBaVVeg2uH8DDMSfMig@mail.gmail.com>

Hi Juan,

It is the expected behavior but also a UI issue. You should not have access
to that tab when the client is bearer-only. I've created
https://issues.jboss.org/browse/KEYCLOAK-10808.

On Fri, Jul 5, 2019 at 4:42 PM Juan Camilo Vanegas <
juan.vanegas at netuxtecnologia.com> wrote:

> Hi.
>
> I am developing a Node.js web app that uses Keycloak as authentication
> service. I already have two clients: public client for the web app
> (app-web) and bearer-only for the API (app-api). On the app-api I use
> resources, scopes, policies, and permissions to control the access.
>
> To check the permissions, I am using the keycloak.enforcer(...) from the
> keycloak-connectmodule (npm keycloak-connect
> <https://www.npmjs.com/package/keycloak-connect>). When I try to check
> permission, the server always returns 403 Access denied response. But if I
> change app-api from bearer-only to confidential (keeping the same
> keycloak.json configuration file), the client works fine and is capable to
> check permissions.
>
> This problem seems to be because a bearer-only client cannot obtain tokens
> from the server (keycloak similar question
> <
> http://keycloak-user.88327.x6.nabble.com/keycloak-user-can-we-use-authorization-with-bearer-only-td2123.html
> >
> ).
>
> My question is: Is this a normal behavior of Keycloak? Why allow the
> Authorization tab in bearer-only clients if you cannot use the
> keycloak.enforcer? Am I missing some configuration?
>
> Thanks for your help.
>
>
> Stackoverflow question:
>
> https://stackoverflow.com/questions/56906984/keycloak-policy-enforcer-bearer-only-client
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

From juan.vanegas at netuxtecnologia.com  Tue Jul  9 08:58:15 2019
From: juan.vanegas at netuxtecnologia.com (Juan Camilo Vanegas)
Date: Tue, 9 Jul 2019 07:58:15 -0500
Subject: [keycloak-user] Keycloak policy enforcer for bearer-only client
In-Reply-To: <CAJrcDBf51x6taQ8Ptu7jWWNuZmWsn-DQBaVVeg2uH8DDMSfMig@mail.gmail.com>
References: <CAKY2RVe-Qbxri12F_fhXsDb-eRSp9_vPmT45dbq8vGoasmK2iA@mail.gmail.com>
	<CAJrcDBf51x6taQ8Ptu7jWWNuZmWsn-DQBaVVeg2uH8DDMSfMig@mail.gmail.com>
Message-ID: <CAKY2RVd1RajOa-F+k4z0Fu7tNE_LLS_vVgaz20B7QOSbO1XKCw@mail.gmail.com>

Hi Pedro.

Thanks for your help. So basically, if you need to protect your resources
on the back-end, you should use a confidential client, but the
keycloak.json configuration file should have the bearer-only key set to
true, to you avoid redirecting the user to the login page and instead send
a 403  Access denied response. Is this correct?

Best regards,

El mar., 9 jul. 2019 a las 7:33, Pedro Igor Silva (<psilva at redhat.com>)
escribi?:

> Hi Juan,
>
> It is the expected behavior but also a UI issue. You should not have
> access to that tab when the client is bearer-only. I've created
> https://issues.jboss.org/browse/KEYCLOAK-10808.
>
> On Fri, Jul 5, 2019 at 4:42 PM Juan Camilo Vanegas <
> juan.vanegas at netuxtecnologia.com> wrote:
>
>> Hi.
>>
>> I am developing a Node.js web app that uses Keycloak as authentication
>> service. I already have two clients: public client for the web app
>> (app-web) and bearer-only for the API (app-api). On the app-api I use
>> resources, scopes, policies, and permissions to control the access.
>>
>> To check the permissions, I am using the keycloak.enforcer(...) from the
>> keycloak-connectmodule (npm keycloak-connect
>> <https://www.npmjs.com/package/keycloak-connect>). When I try to check
>> permission, the server always returns 403 Access denied response. But if I
>> change app-api from bearer-only to confidential (keeping the same
>> keycloak.json configuration file), the client works fine and is capable to
>> check permissions.
>>
>> This problem seems to be because a bearer-only client cannot obtain tokens
>> from the server (keycloak similar question
>> <
>> http://keycloak-user.88327.x6.nabble.com/keycloak-user-can-we-use-authorization-with-bearer-only-td2123.html
>> >
>> ).
>>
>> My question is: Is this a normal behavior of Keycloak? Why allow the
>> Authorization tab in bearer-only clients if you cannot use the
>> keycloak.enforcer? Am I missing some configuration?
>>
>> Thanks for your help.
>>
>>
>> Stackoverflow question:
>>
>> https://stackoverflow.com/questions/56906984/keycloak-policy-enforcer-bearer-only-client
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>

From psilva at redhat.com  Tue Jul  9 09:06:04 2019
From: psilva at redhat.com (Pedro Igor Silva)
Date: Tue, 9 Jul 2019 10:06:04 -0300
Subject: [keycloak-user] Keycloak policy enforcer for bearer-only client
In-Reply-To: <CAKY2RVd1RajOa-F+k4z0Fu7tNE_LLS_vVgaz20B7QOSbO1XKCw@mail.gmail.com>
References: <CAKY2RVe-Qbxri12F_fhXsDb-eRSp9_vPmT45dbq8vGoasmK2iA@mail.gmail.com>
	<CAJrcDBf51x6taQ8Ptu7jWWNuZmWsn-DQBaVVeg2uH8DDMSfMig@mail.gmail.com>
	<CAKY2RVd1RajOa-F+k4z0Fu7tNE_LLS_vVgaz20B7QOSbO1XKCw@mail.gmail.com>
Message-ID: <CAJrcDBdC7PxBs28y26oNckPgjFo0+krfkSO0j__1Eh6buLTzvw@mail.gmail.com>

+1

On Tue, Jul 9, 2019 at 9:58 AM Juan Camilo Vanegas <
juan.vanegas at netuxtecnologia.com> wrote:

> Hi Pedro.
>
> Thanks for your help. So basically, if you need to protect your resources
> on the back-end, you should use a confidential client, but the
> keycloak.json configuration file should have the bearer-only key set to
> true, to you avoid redirecting the user to the login page and instead send
> a 403  Access denied response. Is this correct?
>
> Best regards,
>
> El mar., 9 jul. 2019 a las 7:33, Pedro Igor Silva (<psilva at redhat.com>)
> escribi?:
>
>> Hi Juan,
>>
>> It is the expected behavior but also a UI issue. You should not have
>> access to that tab when the client is bearer-only. I've created
>> https://issues.jboss.org/browse/KEYCLOAK-10808.
>>
>> On Fri, Jul 5, 2019 at 4:42 PM Juan Camilo Vanegas <
>> juan.vanegas at netuxtecnologia.com> wrote:
>>
>>> Hi.
>>>
>>> I am developing a Node.js web app that uses Keycloak as authentication
>>> service. I already have two clients: public client for the web app
>>> (app-web) and bearer-only for the API (app-api). On the app-api I use
>>> resources, scopes, policies, and permissions to control the access.
>>>
>>> To check the permissions, I am using the keycloak.enforcer(...) from the
>>> keycloak-connectmodule (npm keycloak-connect
>>> <https://www.npmjs.com/package/keycloak-connect>). When I try to check
>>> permission, the server always returns 403 Access denied response. But if
>>> I
>>> change app-api from bearer-only to confidential (keeping the same
>>> keycloak.json configuration file), the client works fine and is capable
>>> to
>>> check permissions.
>>>
>>> This problem seems to be because a bearer-only client cannot obtain
>>> tokens
>>> from the server (keycloak similar question
>>> <
>>> http://keycloak-user.88327.x6.nabble.com/keycloak-user-can-we-use-authorization-with-bearer-only-td2123.html
>>> >
>>> ).
>>>
>>> My question is: Is this a normal behavior of Keycloak? Why allow the
>>> Authorization tab in bearer-only clients if you cannot use the
>>> keycloak.enforcer? Am I missing some configuration?
>>>
>>> Thanks for your help.
>>>
>>>
>>> Stackoverflow question:
>>>
>>> https://stackoverflow.com/questions/56906984/keycloak-policy-enforcer-bearer-only-client
>>> _______________________________________________
>>> keycloak-user mailing list
>>> keycloak-user at lists.jboss.org
>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>
>>
>

From lists at merit.unu.edu  Tue Jul  9 09:56:00 2019
From: lists at merit.unu.edu (lists)
Date: Tue, 9 Jul 2019 15:56:00 +0200
Subject: [keycloak-user] [solved] Re: ldap federation working | test
 connection / authentication buttons failing
In-Reply-To: <89d-5d1de800-3-1074ad00@21899244>
References: <89d-5d1de800-3-1074ad00@21899244>
Message-ID: <49cfa5ee-911c-99ec-852e-1f9f61dc597f@merit.unu.edu>

Hi all,

Just wanted to let you know the solution for my issue:

I used custom themes. Appearantly themes do a bit more than 'just some 
formatting' because with the default 6.0.1 themes, the buttons started 
working again.

So, now I recreated my themes, based on the default 6.0.1 themes, and 
everything works again now.

I hope posting this here will help someone with a similar issue in the 
future. :-)

Thanks for making keycloak as great as it it is! :-)

MJ

From prasus at gmail.com  Tue Jul  9 10:12:59 2019
From: prasus at gmail.com (Prasad Kris)
Date: Tue, 9 Jul 2019 19:42:59 +0530
Subject: [keycloak-user] Question regarding Token lifecycle in Keycloak
Message-ID: <CANRfWOpWx+N1UDv06GEzeKcpgrS-BdcuicEc9w51jU8-x_rsow@mail.gmail.com>

Greetings,

We are using Keycloak as our OIDC IdP for the internal applications and
also for our kubernetes infrastructure, this setup is working great so far.

We have the Session Idle Timeout set to 7 days currently and the Session
Max Duration is set to 14 days and it works as expected for most of the
user's but few users are having issues and have reported that their session
is getting expired so fast. when checked in the admin UI, I see that
multiple active sessions from those user accounts, but they have been
presented with the login screen.

I checked the logs and other configurations but couldn't notice any issues,
so I believe that this has to do something in the user end as the settings
are working fine for the majority of the user accounts.. but would like to
know the root cause/more details first before coming to a conclusion.

I would appreciate if someone could guide me to grab more details which
will help to figure out the root cause of this issue,

Cheers

From clehingue at gmail.com  Tue Jul  9 11:01:31 2019
From: clehingue at gmail.com (Christophe Lehingue)
Date: Tue, 9 Jul 2019 17:01:31 +0200
Subject: [keycloak-user] How to do ?
Message-ID: <CADf9yZP8Rc_L79LCKoJb1ZjaTSAHHYBGiQ47vm7VQs5om07E4w@mail.gmail.com>

Hello,

When registering a user, and that the latter declines the "terms &
conditions": I would like to delete his data (when he clicked the
button labeled "decline").

Do you have any idea how I could do without modifying JAVA KEYCLOAK?

I was thinking of a SQL triger, but is there a simplest way to do that?

Regards,
Christophe


======= IN FRENCH ======

Bonjour,

Lors de l'inscription d'un utilisateur, et que ce dernier d?cline les
"terms & conditions" : je souhaiterais supprimer ses donn?es (quand il a
cliqu? sur le bouton intitul? "d?cline").

Avez-vous une id?e de comment je pourrais faire sans modifier les souces
JAVA KEYCLOAK ?

J'avais penser ? un triger SQL, mais y a t'il un moyen plus simple pour
faire cela ?

Cordialement,
Christophe

From srinivas.nangunoori at microfocus.com  Tue Jul  9 12:38:14 2019
From: srinivas.nangunoori at microfocus.com (Srinivas Nangunoori)
Date: Tue, 9 Jul 2019 16:38:14 +0000
Subject: [keycloak-user] Keycloak bc-fips compliant
Message-ID: <MN2PR18MB255989877461EEB9BC1448E080F10@MN2PR18MB2559.namprd18.prod.outlook.com>

Hi Experts,

Is keycloak bc-fips compliant? If yes, which version? Please help/guide us...


Thanks in advance.

-Srini

From chris.smith at cmfirstgroup.com  Tue Jul  9 19:38:25 2019
From: chris.smith at cmfirstgroup.com (Chris Smith)
Date: Tue, 9 Jul 2019 23:38:25 +0000
Subject: [keycloak-user] SQL Server integrated authorization
In-Reply-To: <CY4PR22MB024819DCDBCD853E541C99ED98F80@CY4PR22MB0248.namprd22.prod.outlook.com>
References: <CY4PR22MB024819DCDBCD853E541C99ED98F80@CY4PR22MB0248.namprd22.prod.outlook.com>
Message-ID: <CY4PR22MB02486C049332359CCB86304498F10@CY4PR22MB0248.namprd22.prod.outlook.com>

I carefully read the latest SQL Server JDBC docs and putting the auth dll in the System path is sufficient.
The SQL server module now works with integrate security

-----Original Message-----
From: keycloak-user-bounces at lists.jboss.org <keycloak-user-bounces at lists.jboss.org> On Behalf Of Chris Smith
Sent: Tuesday, July 2, 2019 2:43 PM
To: keycloak-user at lists.jboss.org
Subject: [keycloak-user] SQL Server integrated authorization

My keycloak instance is planned to use SQL Server for its database.
It will be running on a Windows Server in an Active Directory domain I'd like to not embed the User/Password in the standalone.xml file.
To enable this, the driver requires a windows dll to perform the db connection authentication.

So, I'm looking for the best way to accomplish this.

I'd rather not add -Djava.library.path=<path to folder> as a parameter when invoking standalone.bat

Is there a way to configure it in the module created for the JDBC driver jar?

_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user


From ysun at applause.com  Tue Jul  9 21:30:15 2019
From: ysun at applause.com (Yifei Sun)
Date: Tue, 9 Jul 2019 21:30:15 -0400
Subject: [keycloak-user] User Redis as distributed caching store
Message-ID: <CAA=NLS47aTkizadEYYcewq9s4EhpyixN_Lj5CUWhpCo4UePsCg@mail.gmail.com>

Hi guys, I am trying to setup Redis as cache store for Keycloak 6.0.1. It
seems Wildfly doesn't support Redis in its Infinispan subsystem, and a
workaround might be using a custom caching store. Has anyone done that yet?
Any help/information will be greatly appreciated. Thanks!

From abychkova_box at mail.ru  Wed Jul 10 02:33:26 2019
From: abychkova_box at mail.ru (=?UTF-8?B?0JDQu9C40L3QsCDQkNC70LXQutGB0LDQvdC00YDQvtCy0L3QsCDQk9GA0L4=?= =?UTF-8?B?0LzQvtCy0LA=?=)
Date: Wed, 10 Jul 2019 09:33:26 +0300
Subject: [keycloak-user] =?utf-8?q?Keycloak_6=2E0=2E1_=22UUID_LDAP_attribu?=
 =?utf-8?q?te=22_property_processed_correctly_only_with_=22ObjectGUID=22_v?=
 =?utf-8?q?alue=2E?=
Message-ID: <1562740406.804609987@f475.i.mail.ru>


Hi,
I have User Federation to connect with?our Azure AD through LDAP. When?I have the default value ?objectGUID? for  UUID LDAP attribute ?property it processed correctly and in  LDAP_ID user?attribute?I can see correct UUID formate.
Though, if?user UUID provided not in ?objectGUID? but?in ?msDS-AzureADObjectId? LDAP-attribute it doesn?t work. In this case, when I set??msDS-AzureADObjectId??value into?  UUID LDAP attribute ?property?I get incorrect string value?in?LDAP_ID.
It looks like KC can correctly process UUID only if it comes in??objectGUID? attribute. In other cases, we get an incorrect result.
?
So, the?problem in?org/keycloak/storage/ldap/idm/store/ldap/LDAPOperationManager.java:675 where?KC has hardcode action for ?objectGUID? value and other fields processed as a plain?string. Also,??objectGUID? always gets from LDAP as a binary field but??msDS-AzureADObjectId? doesn't?and I need to create user-attribute-ldap-mapper to mark this attribute as binary.
?
The way I fixed it locally:?
*  create user-attribute-ldap-mapper for ?msDS-AzureADObjectId??LDAP-attribute +?mark this attribute as binary.
*  set? UUID LDAP attribute ?property to??msDS-AzureADObjectId?
*  fix condition from?org/keycloak/storage/ldap/idm/store/ldap/LDAPOperationManager.java:675 to?
	
if (this.config.isActiveDirectory() && entryUUID instanceof byte[])
?
Is it a bug and can we expect?a?fix in future versions of KC?
-------
Regards
Alina Gromova

From bruno at abstractj.org  Wed Jul 10 14:52:19 2019
From: bruno at abstractj.org (Bruno Oliveira)
Date: Wed, 10 Jul 2019 15:52:19 -0300
Subject: [keycloak-user] Contributions
In-Reply-To: <2037353038.3420649.1562573540124.JavaMail.zimbra@lyra-network.com>
References: <2037353038.3420649.1562573540124.JavaMail.zimbra@lyra-network.com>
Message-ID: <20190710185219.GC10813@abstractj.org>

Thanks for sharing Sylvain.

On 2019-07-08, Sylvain Malnuit wrote:
> Hi,
> I want to share with you my contributions to Keycloak:
> * https://github.com/malys/rh-sso-email-with-attachment: extension to attach files located in theme repository to email
> * https://github.com/malys/keycloak-groovy-helpers: high level groovy script using Java Admin API to script configuration and actions. I use it to automate deployment
> * https://github.com/malys/rh-sso-rest_federation: a generic REST federation supporting role, attributes and many options (I will probably include it in Ansible plugin)
> * https://github.com/malys/rh-sso-listener-log: Generate detailed logs for audit
> 
> Feel free to use it, fork it or improve it.
> 
> Bye
> 
> Sylvain
> 
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

-- 

abstractj

From rakhshan at gmail.com  Wed Jul 10 18:16:10 2019
From: rakhshan at gmail.com (Arash Rakhshan)
Date: Wed, 10 Jul 2019 15:16:10 -0700
Subject: [keycloak-user] Attaching Role to an Entity
Message-ID: <CAM0rowDh1N_UfzbQdd-Op=EYTE0OEwnnsMqK3Q3Bm2kcE8eq_A@mail.gmail.com>

Hello team,

I am a new fan and after writing my own solution painfully we are hoping to
convert to KeyCloak.  First, thank you all for your efforts and supporting
this project.
I have gone through the tutorials and terminology, however, I can not seem
to mold a suitable model for my authorization use case through Keycloak
concepts. Please consider this use scenario:

   - You provide a SaaS solution for Car Dealerships.
   - Every dealership inherits a set of default roles upon creation e.g.
   admin, manager, sales, accountant,..)
   - Dealership could add/remove permissions to the default roles.
   - Dealership can define their own custom roles.
   - A dealership has multiple vendors and each vendor has a couple of
   roles (admin, accountant, vendor)
   - A dealership has numerous departments and each department may have
   their own roles for that department

In my built-in model, I have a table that connects a Role to a Principal
(an entity) and the ACLs (or permissions) are assigned to the roles. The
Principal could be "DealershipA", "DealershipB", "Vendor1" and
"Department0".

Now my questions is: What is the best practice to implement this scenario
in Keycloak.

   - How would you connect/assign a role to an entity?
   - Would you consider a Dealership, Vendor or a Department a Resource or
   a Client or what?


Thank you in advance for all your help,

From leandronunes85 at gmail.com  Thu Jul 11 06:53:39 2019
From: leandronunes85 at gmail.com (Leandro Nunes)
Date: Thu, 11 Jul 2019 11:53:39 +0100
Subject: [keycloak-user] Kubernetes deployments
Message-ID: <CAJnpR18YCLtBwzVQek+25+JMQ+madm2gb-NXQ0oeC74X=jJXow@mail.gmail.com>

Hi fellow Keycloak users!

My team is now looking at deploying a KC cluster to GCP. We wanted to
leverage the infrastructure as much as possible but we?re struggling to
come up with a good strategy to deploy different SPIs to a KC cluster when
it is running in k8s. If we understand it correctly in such environments
one does not simply take a single SPI and deploy it to the cluster; instead
every time we want to install an SPI we?ll need to build a new (docker?)
image that contains KC itself, the new (version of the) SPI and all other
pre-existing SPIs. Is this understanding correct? Did you come up with
better/leaner approaches to solving this? What is your experience around
these issues?

As always, any help is much appreciated!
Leandro Nunes

From chris.smith at cmfirstgroup.com  Thu Jul 11 13:56:19 2019
From: chris.smith at cmfirstgroup.com (Chris Smith)
Date: Thu, 11 Jul 2019 17:56:19 +0000
Subject: [keycloak-user] Keycloak self registration and Active Directory
	issues
Message-ID: <CY4PR22MB02480FEF5C991F9C1974CD4398F30@CY4PR22MB0248.namprd22.prod.outlook.com>

My requirements are
  1. Active Directory federation (really only as a Kerberos Server...  I have a Windoze Only requirement imposed on me)
  2. Keycloak self-regestration for users
  3. Application and user maintenance done in as much Out Of Box Keycloak as possible
  4. Application Admins should never have access to AD management.

I've set as many AD password policies as I can easily find or google to be as permissive as possible
  Policy
  Enforce password history, 0 
  passwords remembered, 0
  Maximum password age, 0
  Minimum password age, 0 days
  Minimum password length, 1 characters
  Password must meet complexity requirements, Disabled
  Store passwords using reversible encryption, Not Defined

I've set KC password policies 
  Minimum Length          8
  Uppercase Characters  1
  Lowercase Characters  1
  Expire Password         30
  Special Characters       1
  Not Username	
  Not Recently Used    25
  Digits                             1

KC Authentication 
  Required Action  
    Update Password disabled

So when a new user users self-registration, in AD, the user account is set to require password Change
  Any advice on how to Change that

In Active Directory I remove the "Require password Change" on the user account 
  The KC user login fails with "invalid User or Password" error

If I try to Change the new Users Password in the KC Console, 
  Error! Could not modify attribute for DN [CN=xxx.yyyy,CN=Users,DC=xxx-sso,DC=com]
  Any Advice on what is going on?


From ryans at jlab.org  Thu Jul 11 16:44:25 2019
From: ryans at jlab.org (Ryan Slominski)
Date: Thu, 11 Jul 2019 20:44:25 +0000
Subject: [keycloak-user] Reverse Proxy Keycloak - Kerberos SPNEGO breaks
Message-ID: <BL0PR0901MB30595E122340DBFFD0509163DCF30@BL0PR0901MB3059.namprd09.prod.outlook.com>

Hi all,
   Any tips setting up Kerberos SPNEGO with Keycloak if Keycloak is reverse proxied?   I have everything working if I access the Keycloak host directly, but if I access via a reverse proxy the SPENGO doesn't work.   I assume this has to do with Kerberos SPNEGO strict hostname and principal naming.  I have even tried setting the password/key (and kvno) the same for both HTTP/proxy.example.com and HTTP/keycloak.example.com principals.   I've also updated the /etc/krb5.conf libdefaults ignore_acceptor_hostname = true, but that seems to be ignored by Keycloak.  In fact, Keycloak appears to require a hard-coded principal name, which isn't going to match the requested service principal name when requests go through the reverse proxy.  Has anyone dealt with this before?

Oddly, this isn't a problem for Windows Active Directory principals / SPNs (Micrsoft implementation) - if setspn.exe configures same principal to both hostnames.  Just MIT Kerberos KDC and principals seem to have a problem with reverse proxies (Red Hat Identity Manager / FreeIPA wrapper around MIT Kerberos).

Ryan

From ysun at applause.com  Fri Jul 12 10:38:49 2019
From: ysun at applause.com (Yifei Sun)
Date: Fri, 12 Jul 2019 10:38:49 -0400
Subject: [keycloak-user] Cannot add custom Key2StringMapper for JDBC cache
	store
Message-ID: <CAA=NLS7Y0XHqPgk1EsGTN8KZH6x4H3Pnk+2zX5gTXyeXO_DQFg@mail.gmail.com>

Hi Guys,

I am trying to add JDBC cache store via standalone-ha.xml in Keycloak
6.0.1, which has WildFly 16 and Infinispan 9.4.x subsystem. I managed to
add the configuration to bind tables in Mysql db, but got the
"org.infinispan.persistence.keymappers.UnsupportedKeyTypeException:
Unsupported key type" when it tried to save the session. I checked out
Infinispan and WF documentations, but the solution they gave, e.g. add
"<property
name="key2StringMapperClass">...</property>" , does not work. Any help
would be appreciated.

Thanks!!

From ysun at applause.com  Fri Jul 12 10:41:19 2019
From: ysun at applause.com (Yifei Sun)
Date: Fri, 12 Jul 2019 10:41:19 -0400
Subject: [keycloak-user] Cannot add custom Key2StringMapper for JDBC cache
	store
In-Reply-To: <CAA=NLS7Y0XHqPgk1EsGTN8KZH6x4H3Pnk+2zX5gTXyeXO_DQFg@mail.gmail.com>
References: <CAA=NLS7Y0XHqPgk1EsGTN8KZH6x4H3Pnk+2zX5gTXyeXO_DQFg@mail.gmail.com>
Message-ID: <CAA=NLS5Zf2hxgxJESfk2KUu+yfEHuqepq3MDwjwavpdXSNwcOw@mail.gmail.com>

Resend my previous email...

Hi Guys,

I am trying to add JDBC cache store via standalone-ha.xml in Keycloak
6.0.1, which has WildFly 16 and Infinispan 9.4.x subsystem. I managed to
add the configuration to bind tables in Mysql db, but got the
"org.infinispan.persistence.keymappers.UnsupportedKeyTypeException:
Unsupported key type" when it tried to save the session. I checked out
Infinispan and WF documentations, but the solution they gave, e.g. add
"<property
name="key2StringMapperClass">...</property>" , does not work. Any help
would be appreciated.

Thanks!!

From enzo.veltri at gmail.com  Fri Jul 12 12:12:35 2019
From: enzo.veltri at gmail.com (Enzo Veltri)
Date: Fri, 12 Jul 2019 18:12:35 +0200
Subject: [keycloak-user] CORS issue with Angular Keycloak and Kong
Message-ID: <CAFyMs=92F6=F8VNa0NK1agzLDdPNUsUTbv-c=vbYG_ie2nR1-w@mail.gmail.com>

Hello,
I'm stuck in some CORS problems with a Angular APP. First of all this is my
error:

"Access to XMLHttpRequest at
'KEYCLOAK_ADDRESS/auth/realms/kong-integration/protocol/openid-connect/auth?response_type=code&client_id=kong&state=51afb0a302eaade545d648ee234ac9c0&redirect_uri=http//KONG_ADDRESS/projects%2F&nonce=5828968bed9a3d5427bed214c482b7a1&scope=openid'
(redirected from 'http://KONG_ADDRESS/projects?username=c') from origin
'null' has been blocked by CORS policy: Response to preflight request
doesn't pass access control check: No 'Access-Control-Allow-Origin' header
is present on the requested resource."

Here is my architecture

I have as gateway KONG + OIDC Plugin (https://github.com/nokia/kong-oidc)
in a docker-machine located ad KONG_ADDRESS
An Identity Management as Keycloak that is located at KEYCLOAK_ADDRESS;
An Angular APP that uses the keycloak-angular library (
https://www.npmjs.com/package/keycloak-angular) located at localhost:4200
A Rest API, developed with Restlet, deployed on a tomcat on
TOMCAT_ADDRESS/projects

I've configured Kong to work with Keycloak using this tutorial (
https://www.jerney.io/secure-apis-kong-keycloak-1/) and everything works
fine till I'm interacting with the secured API using the browser or
Postman.
When I call the secured endpoint KONG/projects, I'm redirected to the login
page of Keycloak and then, after submitting the right credentials, I
receive the correct response.

Problems come when I'm trying to do everything using an Angular APP.

It looks like that everything is fine with the /auth and /authenticate
calls to KEYCLOAK_ADDRESS made by the initialization of the plugin (
https://www.npmjs.com/package/keycloak-angular#setup), and the /token and
the /account calls made by HttpClientInterceptor (
https://www.npmjs.com/package/keycloak-angular#httpclient-interceptor) and
the AuthGuard (https://www.npmjs.com/package/keycloak-angular#authguard).
Problems come when the APP try to access to the resource at KONG/projects.
It looks like there are a lot of jumps in the request: KONG redirects to
KEYCLOAK and KEYCLOAK send a 204 No Content.

I've added to the Keycloak client the web origins for KONG_ADDRESS and
http://localhost:4200 that is my Angular APP.

Do you have any idea about the problem? I think is something related to the
origin 'null' in the console log, or is something related to my setup.
Maybe I'm missing some details about the process.

-- 
Enzo

From chamila.sujeewa at gmail.com  Sun Jul 14 22:21:25 2019
From: chamila.sujeewa at gmail.com (Chamila de Alwis)
Date: Mon, 15 Jul 2019 14:21:25 +1200
Subject: [keycloak-user] Realm based multi-tenancy
Message-ID: <CAB2A5_kBSaKk4xXQ4HkqG=sC_hUqnSWN2HpYKPvzVMaa3AKOgQ@mail.gmail.com>

Hi,

I have a KeyCloak deployment where KeyCloak Realms are used as a way to
differentiate users among different tenants. The components that currently
interact with KeyCloak does so through intermediate router that selects the
IdP configuration based on a request path segment (request credentials from
the realm using a pre-decided segment in the received path as the realm
name). This story works fine with OIDC clients created in each Realm.

There is a 3rd party service access that needs to be done through KeyCloak
as well. However this 3rd party service doesn't support any kind of realm
discovery method (path, header etc). It only works with a single IdP
configuration at a time. This doesn't match with the per-realm client
configuration model that is there at the moment, because multiple client
configurations cannot be dynamically mapped to different host names or path
segments.

As a workaround, I'm in the process of trying the following approach.

I've created a "federator" realm that has the clients in other realms as
Identity Providers. The client in the federator realm will act as an
identity broker on behalf of the other realms. However, the approach shows
all the organizations available at the login screen. This is something
sub-optimal for my use case since the list of organizations is made public
to any user redirected to the login page. At the moment I'm looking into
the customization of the login page, however that also would make upgrades
harder.

Is there a way to workaround this limitation that the 3rd party service
has? Are there any known patterns that you may have employed in similar
situations? (The other mail threads that I could find deal in situations
where the client code is also changeable, like the use of the
KeyCloakConfigResolver extension point [1]. This is not usable in my case,
as the 3rd party code is out of my control)

Furthermore, is there a way to authenticate users across Realms using only
one client configuration? Appreciate your help in this.

[1] -
https://www.keycloak.org/docs/latest/securing_apps/index.html#_multi_tenancy

Thanks!

Regards,
Chamila
Blog: medium.com/@chamilad

From mnuttallsmith at flowtraders.com  Mon Jul 15 03:34:23 2019
From: mnuttallsmith at flowtraders.com (Mark Nuttall-Smith)
Date: Mon, 15 Jul 2019 07:34:23 +0000
Subject: [keycloak-user] transient SSL certificate errors to AD/LDAPS
Message-ID: <e5bf775127e943659219f8ee29fa1516@NL-EXMB13-02.nl.flowtraders.local>

Hi,

I've configured Keycloak to talk to an AD server using LDAPS. Everything works perfectly most of the time, but there are rare, transient errors caused by the following exception:

Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
        at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:397)
        at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:302)
        at sun.security.validator.Validator.validate(Validator.java:262)
        at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:324)
        at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:229)
        at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:124)
        at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1621)
        ... 12 more
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
        at sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:141)
        at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:126)
        at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:280)
        at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:392)
        ... 18 more

Normally retrying the same query allows a user to log in again successfully (browser caches complicate things though).

We add the certificates to the keystore using the following approach in our kubernetes helm chart:

--------------------
    extraArgs: "-Djavax.net.ssl.trustStore=/opt/cacerts/cacerts -Djavax.net.ssl.trustStorePassword=changeit -Dkeycloak.import=/opt/import/realm.json"

    # This init container adds the certificates for the AD domain controllers to a keystore using a mounted ad-cacerts volume.
    # The same volume with the keystore is then mounted and used by the main keycloak container
    extraInitContainers: |
      - name: cacerts-init
        image: openjdk:8-jre
        command:
          - bash
        args:
          - -c
          - |
            cat $JAVA_HOME/lib/security/cacerts > /opt/cacerts/cacerts;
            for host in `getent ahosts mycompany.local | awk '{print $1}' | uniq`; do
              echo | openssl s_client -connect ${host}:3269 2>&1 | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > ${host}.cer ;
              keytool -keystore /opt/cacerts/cacerts -storepass changeit -noprompt -trustcacerts -importcert -alias ${host} -file ${host}.cer
            done
        volumeMounts:
          - name: ad-cacerts
            mountPath: /opt/cacerts

    extraVolumes: |
      - name: ad-cacerts
        emptyDir: {}

    extraVolumeMounts: |
      - name: ad-cacerts
        mountPath: /opt/cacerts
-----------------------

Does anyone have an idea what could be the cause of these transient errors?

Thanks, Mark

Mark Nuttall-Smith
Software Engineer

[http://www.flowtraders.com/img/FlowTraders.png]

Flow Traders

T: +31 20 799 8753
F: +31 20 799 6780

Jacob Bontiusplaats 9
1018 LL Amsterdam
Netherlands
www.flowtraders.com<http://www.flowtraders.com>

Flow Traders has its seat in Amsterdam, Netherlands, its registered office at Jacob Bontiusplaats 9, 1018 LL, Amsterdam, Netherlands and is registered with the Trade Registry of the Chamber of Commerce under number . This message may contain information that is not intended for you. If you are not the addressee or if this message was sent to you by mistake, you are requested to inform the sender and delete the message. This message may not be forwarded or published to any other person than its addressees without Flow Traders's prior consent. Flow Traders accepts no liability for damage of any kind resulting from the risks inherent in the electronic transmission of messages.

From mnuttallsmith at flowtraders.com  Mon Jul 15 05:11:00 2019
From: mnuttallsmith at flowtraders.com (Mark Nuttall-Smith)
Date: Mon, 15 Jul 2019 09:11:00 +0000
Subject: [keycloak-user] transient SSL certificate errors to AD/LDAPS
In-Reply-To: <7F214C6E-BE11-49F5-A40E-38283358328B@m800.com>
References: <e5bf775127e943659219f8ee29fa1516@NL-EXMB13-02.nl.flowtraders.local>
	<7F214C6E-BE11-49F5-A40E-38283358328B@m800.com>
Message-ID: <1f0a852c4920492bb3b3d27522f43f51@NL-EXMB13-02.nl.flowtraders.local>

Hi,
Thanks for the suggestion, but only server side certificates are required for our AD set up.



Mark Nuttall-Smith
Software Engineer

Flow Traders

T: +31 20 799 8753
F: +31 20 799 6780

Jacob Bontiusplaats 9
1018 LL Amsterdam
Netherlands
www.flowtraders.com
-----Original Message-----
From: Nick Su [mailto:nicksu at m800.com]
Sent: Monday, July 15, 2019 9:40 AM
To: Mark Nuttall-Smith
Subject: Re: [keycloak-user] transient SSL certificate errors to AD/LDAPS

Hi

Does your LDAPS server require client verification as well?  I came across a similar issue months before, and fixed by providing a trust store and keystore respectively to java

> On 15 Jul 2019, at 3:34 PM, Mark Nuttall-Smith <mnuttallsmith at flowtraders.com> wrote:
>
> Hi,
>
> I've configured Keycloak to talk to an AD server using LDAPS. Everything works perfectly most of the time, but there are rare, transient errors caused by the following exception:
>
> Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
>        at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:397)
>        at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:302)
>        at sun.security.validator.Validator.validate(Validator.java:262)
>        at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:324)
>        at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:229)
>        at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:124)
>        at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1621)
>        ... 12 more
> Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
>        at sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:141)
>        at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:126)
>        at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:280)
>        at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:392)
>        ... 18 more
>
> Normally retrying the same query allows a user to log in again successfully (browser caches complicate things though).
>
> We add the certificates to the keystore using the following approach in our kubernetes helm chart:
>
> --------------------
>    extraArgs: "-Djavax.net.ssl.trustStore=/opt/cacerts/cacerts -Djavax.net.ssl.trustStorePassword=changeit -Dkeycloak.import=/opt/import/realm.json"
>
>    # This init container adds the certificates for the AD domain controllers to a keystore using a mounted ad-cacerts volume.
>    # The same volume with the keystore is then mounted and used by the main keycloak container
>    extraInitContainers: |
>      - name: cacerts-init
>        image: openjdk:8-jre
>        command:
>          - bash
>        args:
>          - -c
>          - |
>            cat $JAVA_HOME/lib/security/cacerts > /opt/cacerts/cacerts;
>            for host in `getent ahosts mycompany.local | awk '{print $1}' | uniq`; do
>              echo | openssl s_client -connect ${host}:3269 2>&1 | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > ${host}.cer ;
>              keytool -keystore /opt/cacerts/cacerts -storepass changeit -noprompt -trustcacerts -importcert -alias ${host} -file ${host}.cer
>            done
>        volumeMounts:
>          - name: ad-cacerts
>            mountPath: /opt/cacerts
>
>    extraVolumes: |
>      - name: ad-cacerts
>        emptyDir: {}
>
>    extraVolumeMounts: |
>      - name: ad-cacerts
>        mountPath: /opt/cacerts
> -----------------------
>
> Does anyone have an idea what could be the cause of these transient errors?
>
> Thanks, Mark
>
> Mark Nuttall-Smith
> Software Engineer
>
> [http://www.flowtraders.com/img/FlowTraders.png]
>
> Flow Traders
>
> T: +31 20 799 8753
> F: +31 20 799 6780
>
> Jacob Bontiusplaats 9
> 1018 LL Amsterdam
> Netherlands
> www.flowtraders.com<http://www.flowtraders.com>
>
> Flow Traders has its seat in Amsterdam, Netherlands, its registered office at Jacob Bontiusplaats 9, 1018 LL, Amsterdam, Netherlands and is registered with the Trade Registry of the Chamber of Commerce under number . This message may contain information that is not intended for you. If you are not the addressee or if this message was sent to you by mistake, you are requested to inform the sender and delete the message. This message may not be forwarded or published to any other person than its addressees without Flow Traders's prior consent. Flow Traders accepts no liability for damage of any kind resulting from the risks inherent in the electronic transmission of messages.
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user


Flow Traders has its seat in Amsterdam, Netherlands, its registered office at Jacob Bontiusplaats 9, 1018 LL, Amsterdam, Netherlands and is registered with the Trade Registry of the Chamber of Commerce under number . This message may contain information that is not intended for you. If you are not the addressee or if this message was sent to you by mistake, you are requested to inform the sender and delete the message. This message may not be forwarded or published to any other person than its addressees without Flow Traders?s prior consent. Flow Traders accepts no liability for damage of any kind resulting from the risks inherent in the electronic transmission of messages.


From yy8402 at icloud.com  Mon Jul 15 11:03:22 2019
From: yy8402 at icloud.com (Yang Yang)
Date: Mon, 15 Jul 2019 23:03:22 +0800
Subject: [keycloak-user] Redirect issue with HTTPS and Proxy
Message-ID: <0C6736D5-3F64-4B6D-8CDA-9C5501CBAAD8@icloud.com>

Hello,

I am trying to make keycloak work behind a Nginx proxy with HTTPS, but got an redirect issue. Could you help to shed some light?

1. keycloak in standalone mode is installed on local_ip_a and public_ip_a, while Nginx is on local_ip_b and public_ip_b. local_ip_a and local_ip_b are in the same subnet.
2. keycloak works fine with https when I reach it with local_ip_a or public_ip_a, following guide here <https://www.keycloak.org/docs/6.0/server_installation/index.html#enabling-ssl-https-for-the-keycloak-server> 
...
            <security-realm name="UndertowRealm">
                <server-identities>
                    <ssl>
                        <keystore path="keycloak.jks" relative-to="jboss.server.config.dir" keystore-password="secret" />
                    </ssl>
                </server-identities>
            </security-realm>
?
<server name="default-server">
                <http-listener name="default" socket-binding="http" redirect-socket="https" enable-http2="true"/>
                <https-listener name="https" socket-binding="https" security-realm="UndertowRealm" enable-http2="true"/>
                <host name="default-host" alias="localhost">
                    <location name="/" handler="welcome-content"/>
                    <http-invoker security-realm="ApplicationRealm"/>
                </host>
            </server>
...
3. my nginx configuration for keycloak is as below:
?
    server {
        listen       8443 ssl;
...
location /auth/ {
            proxy_pass https://local_ip_a:8443/auth/;
            proxy_set_header   X-Forwarded-For  $proxy_add_x_forwarded_for;
            proxy_set_header   X-Forwarded-Proto $scheme;
        }
?
4. I set the fixed provide following this <https://github.com/keycloak/keycloak-documentation/blob/6.0.1/server_admin/topics/threat/host.adoc>:
            <spi name="hostname">
                <default-provider>request</default-provider>
                <provider name="fixed" enabled="true">
                    <properties>
                        <property name="hostname" value="public_ip_b"/>
                        <property name="httpPort" value="-1"/>
                        <property name="httpsPort" value="-1"/>
                    </properties>
                </provider>
            </spi>
5. I was able to get the keycloak welcome page at https://public_ip_b:8443/auth/, but when accessing https://public_ip_b:8443/auth/admin, I was redirected to https://public_ip_b:8443/auth/admin/master/console/ and then to the following address:
https://local_ip_a:8443/auth/realms/master/protocol/openid-connect/auth?client_id=security-admin-console&redirect_uri=https%3A%2F%2Fpublic_ip_b%3A8443%2Fauth%2Fadmin%2Fmaster%2Fconsole%2F&state=c0047434-9a34-4fee-8b18-ae9f2c696683&response_mode=fragment&response_type=code&scope=openid&nonce=c5fb0f27-2a0a-4248-9833-6655f9c29f7e
6. The keycloak message tells:
22:19:44,848 WARN  [org.keycloak.events] (default task-16) type=LOGIN_ERROR, realmId=master, clientId=security-admin-console, userId=null, ipAddress= local_ip_b, error=invalid_redirect_uri, redirect_uri=https://public_ip_b:8443/auth/admin/master/console/
7. I tried to add https://public_ip_b:8443/auth/* to security-admin-console setting, but got no luck?



From Aditya.Bhole at veritas.com  Mon Jul 15 13:23:06 2019
From: Aditya.Bhole at veritas.com (Aditya Bhole)
Date: Mon, 15 Jul 2019 17:23:06 +0000
Subject: [keycloak-user] Trust between two standalone Keycloak Instances
Message-ID: <D55B0359-78C8-4431-B7D7-C4DE13A2D8D0@contoso.com>

Hello,

I?m new to Keycloak and building a prototype SSO framework for my company. The use case is that my company has 3 clients; A, B and C. Now each client is going to have its own Keycloak instance; KA, KB and KC. Now what I want is when I login through client A I should be logged into client B and C as well. And same goes for all the clients. So for this to happen, is there a way of establishing trust between these three Keycloak instances KA, KB and KC?
I?ve successfully established an SSO by using KA as a broker and KB as an IDP. But this is only a master slave kind-of an architecture. When I log in to A, I?m automatically logged into B. But if I log into B, I won?t be automatically logged into A. Is it possible for KA to be a broker for KB and KB to be a broker for KA at the same time?
TL;DR :
Is there a way where Keycloak only acts as a broker and trust is established between multiple such Keycloak instances?

I hope my question makes sense. Please point me in the right direction if I?m looking at this in the wrong way.

Thanks,
Aditya


From ssilvert at redhat.com  Mon Jul 15 14:31:26 2019
From: ssilvert at redhat.com (Stan Silvert)
Date: Mon, 15 Jul 2019 14:31:26 -0400
Subject: [keycloak-user] Trust between two standalone Keycloak Instances
In-Reply-To: <D55B0359-78C8-4431-B7D7-C4DE13A2D8D0@contoso.com>
References: <D55B0359-78C8-4431-B7D7-C4DE13A2D8D0@contoso.com>
Message-ID: <b26f4842-29be-4f7f-5421-7a7f59825bb6@redhat.com>

Why do you need each to have its own Keycloak instance?? A usual setup 
would define all three clients in the same realm under the same Keycloak 
instance.

On 7/15/2019 1:23 PM, Aditya Bhole wrote:
> Hello,
>
> I?m new to Keycloak and building a prototype SSO framework for my company. The use case is that my company has 3 clients; A, B and C. Now each client is going to have its own Keycloak instance; KA, KB and KC. Now what I want is when I login through client A I should be logged into client B and C as well. And same goes for all the clients. So for this to happen, is there a way of establishing trust between these three Keycloak instances KA, KB and KC?
> I?ve successfully established an SSO by using KA as a broker and KB as an IDP. But this is only a master slave kind-of an architecture. When I log in to A, I?m automatically logged into B. But if I log into B, I won?t be automatically logged into A. Is it possible for KA to be a broker for KB and KB to be a broker for KA at the same time?
> TL;DR :
> Is there a way where Keycloak only acts as a broker and trust is established between multiple such Keycloak instances?
>
> I hope my question makes sense. Please point me in the right direction if I?m looking at this in the wrong way.
>
> Thanks,
> Aditya
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user



From jonesy at sydow.org  Mon Jul 15 17:47:53 2019
From: jonesy at sydow.org (JTK)
Date: Mon, 15 Jul 2019 16:47:53 -0500
Subject: [keycloak-user] Not being prompted for x509 User Certs
In-Reply-To: <CAEyJD6Mo8PxHaBaR8q-60x73j19yMBy6sice-RpL2qUYLD25XQ@mail.gmail.com>
References: <CAEyJD6Mo8PxHaBaR8q-60x73j19yMBy6sice-RpL2qUYLD25XQ@mail.gmail.com>
Message-ID: <CAEyJD6OOJ5B9D9gSytgeTdv6EXP0Thuz9en5cjBpABqomuMaSQ@mail.gmail.com>

I wanted to give an update which might help other users.

The first issue we had was related to the load balancer and to be specific
Amazon ELB.
I was under the impression it was set to be pass-thru, but instead it was
setup to do SSL termination.

After that was fixed, then I was getting prompted for certificates and I
was seeing logs, which I was happy with, even error logs, even better.
The next issue was related to when our PFX chain was imported into the
keystore. The issue was that PFX file had a different password than the
keystore in the standalone.xml configuration file.
After changing the password and re-importing it back it, that error logs
related to padding for the keystore were resolved. Basically error in
padding in our case = wrong password in the keystore.

The last issue was locating the correct RegEx for our instance. For us,
this worked:
User Identity Source: Subject Alternative Name
A regular expression to extract user identity :  RFC822Name=(.*?)(?:,|$)

A big shout out to Peter! Thanks for your assistance.

On Thu, Jun 27, 2019 at 12:37 PM JTK <jonesy at sydow.org> wrote:

> Hello,
>
>  I've read through all the documentation I can find online both with the
> official documents and everything else I could find and I believe I have
> everything setup, with additional logging turned on, but I'm not getting
> any type of prompt for a x509 certificate when logging in.
>
>  Here is the excerpt from the standalone.xml file
>
>     <management>
>         <security-realms>
>          ......
>             <security-realm name="ssl-realm">
>                 <server-identities>
>                     <ssl>
>                         <keystore path="keycloak.jks"
> relative-to="jboss.server.config.dir" keystore-password="mypass"/>
>                     </ssl>
>                 </server-identities>
>                 <authentication>
>                     <truststore path="truststore.jks"
> relative-to="jboss.server.config.dir" keystore-password="mypass"/>
>                 </authentication>
>             </security-realm>
>             ......
>
>         <subsystem xmlns="urn:jboss:domain:undertow:7.0"
> default-server="default-server" default-virtual-host="default-host"
> default-servlet-container="default" default-security-domain="other">
>             <buffer-cache name="default"/>
>             <server name="default-server">
>                 <http-listener name="default1" socket-binding="http"
> redirect-socket="https" enable-http2="true"/>
>                 <https-listener name="default" socket-binding="https"
> security-realm="ssl-realm" verify-client="REQUESTED"/>
>                 <host name="default-host" alias="localhost">
>                     <location name="/" handler="welcome-content"/>
>                     <access-log worker="default"
> directory="${jboss.server.log.dir}" prefix="access" suffix=".log"/>
>                     <http-invoker security-realm="ApplicationRealm"/>
>                 </host>
>
>  I've setup the Authentication Flows for the Browser to have x509/Validate
> Username Form above the new Browser flow and it's required.
> Everything is setup per the KeyCloak documentation to include the binding
> settings.
>
> The only thing I'm not sure about is if the keycloak.jks and
> truststore.jks files are the issue.
> I have enabled extra logging as best I know, but I'm not seeing anything
> in the logs of any relevance when trying to authenticate into the Keycloak
> Realm.
>
> Can anyone assist? We are looking to most likely purchase this as a
> product through RedHat SSO if it works well to get the support we need, but
> I've been hung up on this for a few weeks and I know it shouldn't be this
> hard.
>
> Thanks,
> J
>
>

From Josh.Harness at jtv.com  Mon Jul 15 18:05:22 2019
From: Josh.Harness at jtv.com (Harness, Josh)
Date: Mon, 15 Jul 2019 22:05:22 +0000
Subject: [keycloak-user] Offline Token Unique Constraint Violation Errors in
	6.0.0
Message-ID: <EB771636-5260-476B-A787-E022152CE942@JTV.com>

Hello -

I'm using keycloak version 6.0.0. Recently, we started seeing unique constraint violations when creating a new offline session for a user. In particular, this constraint is violated:

     CONSTRAINT_OFFL_CL_SES_PK3

I looked this constraint up and it appears to be the combination of the following columns on the following columns of the "offline_client_session" table:

     USER_SESSION_ID, CLIENT_ID, CLIENT_STORAGE_PROVIDER, EXTERNAL_CLIENT_ID, OFFLINE_FLAG

I enabled trace logging for the UserSession class and can tell that the application believes that it needs to create the row in the offline_client_session table even though the row already exists in the table. As a result, the unique constraint violation occurs and the call fails. This makes me believe it exclusively expects its cache to be a copy of the database and somehow it has gotten out of sync with the database and isn't querying the database when it has a cache "miss".

A couple of notes that may be important:

* I'm creating the offline token as part of a token exchange
* We have configured the offline sessions cache to use passivation (with preloading enabled and purging disabled)

Any advice that can be offered as far as how to debug this would be appreciated. I've been unable to make it happen in non-prod but it happens often in prod. 

Thanks!

Josh


From sshscp at gmail.com  Mon Jul 15 18:34:54 2019
From: sshscp at gmail.com (Nick Powers)
Date: Mon, 15 Jul 2019 16:34:54 -0600
Subject: [keycloak-user] Keycloak/Gatekeeper "You don't have authorization
 to view this page" after login
Message-ID: <CAKeq-mnLjsaFTA-oRX6Z35a4JHxEZkSsm=bbGDfP_e-Q_zxOfA@mail.gmail.com>

Hello,

I have installed Keycloak and Gatekeeper with hopes that i can use it to
authenticate for my web application, which is written in PHP.  I am getting
redirected to Keycloak by Gatekeeper and I am able to register for an
account once there. But, as soon as I finish creating the account, or now
when I return to my domain I get a 403 error message "You don't have
authorization to view this page."

The URL that I am landing on is
https://commentcontext.com/oauth/callback?state=3e810acf-ff2d-448c-9165-075a96d43e79&session_state=b9e34566-65f1-4ee5-a280-5c23531975ea&code=aa539a0b-8b57-4fd5-8c1d-5a8ea19b8242.b9e34566-65f1-4ee5-a280-5c23531975ea.52b73740-2225-4a63-9d32-a1618331b24f

Does anyone have any idea why I am getting the 403 error message? I added a
new realm and a client in that realm but I didn't add any roles or anything
else to it.  Also, I have yet to write any code for my webapp yet.  I just
have an index.php in / that dumps the headers and phpinfo().

Any help would be greatly appreciated!  I am happy to provide any
additional info that might help you determine the problem.  Just let me
know what you need.

Thanks,

Nick

From yy8402 at icloud.com  Mon Jul 15 23:23:23 2019
From: yy8402 at icloud.com (Yang Yang)
Date: Tue, 16 Jul 2019 11:23:23 +0800
Subject: [keycloak-user] Redirect issue with HTTPS and Proxy
In-Reply-To: <0C6736D5-3F64-4B6D-8CDA-9C5501CBAAD8@icloud.com>
References: <0C6736D5-3F64-4B6D-8CDA-9C5501CBAAD8@icloud.com>
Message-ID: <E69C70FA-187D-4AFA-9828-EDF5CEC8283A@icloud.com>

Hello,

I found a mistake in my configuration below and have solved it.

In #4, the default-provider should be ?fixed".


Thanks for your time.

Thanks,
Yang

> On Jul 15, 2019, at 23:03, Yang Yang <yy8402 at icloud.com> wrote:
> 
> Hello,
> 
> I am trying to make keycloak work behind a Nginx proxy with HTTPS, but got an redirect issue. Could you help to shed some light?
> 
> 1. keycloak in standalone mode is installed on local_ip_a and public_ip_a, while Nginx is on local_ip_b and public_ip_b. local_ip_a and local_ip_b are in the same subnet.
> 2. keycloak works fine with https when I reach it with local_ip_a or public_ip_a, following guide here <https://www.keycloak.org/docs/6.0/server_installation/index.html#enabling-ssl-https-for-the-keycloak-server> 
> ...
>             <security-realm name="UndertowRealm">
>                 <server-identities>
>                     <ssl>
>                         <keystore path="keycloak.jks" relative-to="jboss.server.config.dir" keystore-password="secret" />
>                     </ssl>
>                 </server-identities>
>             </security-realm>
> ?
> <server name="default-server">
>                 <http-listener name="default" socket-binding="http" redirect-socket="https" enable-http2="true"/>
>                 <https-listener name="https" socket-binding="https" security-realm="UndertowRealm" enable-http2="true"/>
>                 <host name="default-host" alias="localhost">
>                     <location name="/" handler="welcome-content"/>
>                     <http-invoker security-realm="ApplicationRealm"/>
>                 </host>
>             </server>
> ...
> 3. my nginx configuration for keycloak is as below:
> ?
>     server {
>         listen       8443 ssl;
> ...
> location /auth/ {
>             proxy_pass https://local_ip_a:8443/auth/ <https://local_ip_a:8443/auth/>;
>             proxy_set_header   X-Forwarded-For  $proxy_add_x_forwarded_for;
>             proxy_set_header   X-Forwarded-Proto $scheme;
>         }
> ?
> 4. I set the fixed provide following this <https://github.com/keycloak/keycloak-documentation/blob/6.0.1/server_admin/topics/threat/host.adoc>:
>             <spi name="hostname">
>                 <default-provider>request</default-provider>
>                 <provider name="fixed" enabled="true">
>                     <properties>
>                         <property name="hostname" value="public_ip_b"/>
>                         <property name="httpPort" value="-1"/>
>                         <property name="httpsPort" value="-1"/>
>                     </properties>
>                 </provider>
>             </spi>
> 5. I was able to get the keycloak welcome page at https://public_ip_b:8443/auth/ <https://public_ip_b:8443/auth/>, but when accessing https://public_ip_b:8443/auth/admin <https://public_ip_b:8443/auth/admin>, I was redirected to https://public_ip_b:8443/auth/admin/master/console/ <https://public_ip_b:8443/auth/admin/master/console/> and then to the following address:
> https://local_ip_a:8443/auth/realms/master/protocol/openid-connect/auth?client_id=security-admin-console&redirect_uri=https%3A%2F%2Fpublic_ip_b%3A8443%2Fauth%2Fadmin%2Fmaster%2Fconsole%2F&state=c0047434-9a34-4fee-8b18-ae9f2c696683&response_mode=fragment&response_type=code&scope=openid&nonce=c5fb0f27-2a0a-4248-9833-6655f9c29f7e <https://local_ip_a:8443/auth/realms/master/protocol/openid-connect/auth?client_id=security-admin-console&redirect_uri=https%3A%2F%2Fpublic_ip_b%3A8443%2Fauth%2Fadmin%2Fmaster%2Fconsole%2F&state=c0047434-9a34-4fee-8b18-ae9f2c696683&response_mode=fragment&response_type=code&scope=openid&nonce=c5fb0f27-2a0a-4248-9833-6655f9c29f7e>
> 6. The keycloak message tells:
> 22:19:44,848 WARN  [org.keycloak.events] (default task-16) type=LOGIN_ERROR, realmId=master, clientId=security-admin-console, userId=null, ipAddress= local_ip_b, error=invalid_redirect_uri, redirect_uri=https://public_ip_b:8443/auth/admin/master/console/ <https://public_ip_b:8443/auth/admin/master/console/>
> 7. I tried to add https://public_ip_b:8443/auth/* <https://public_ip_b:8443/auth/*> to security-admin-console setting, but got no luck?
> <Screen Shot 2019-07-15 at 22.54.58.png>
> 


From bob.skd at googlemail.com  Tue Jul 16 08:39:06 2019
From: bob.skd at googlemail.com (bob sheknowdas)
Date: Tue, 16 Jul 2019 14:39:06 +0200
Subject: [keycloak-user] Keycloak Gatekeeper (forwarding proxy) does nothing
Message-ID: <CAJombDeOJZQ0n7ZcTnuWBOCJ=_adk-CdN+mrLzeWVY7zmFmNyg@mail.gmail.com>

Hi,


I have a docker-compose setup with service 1 (grafana) sending requests to
service 2 (prometheus). I've put a Keycloak Gatekeeper in front of service
2, asking for authentication. That works perfectly fine.

Now my idea was to also place a second Keycloak Gatekeeper in front of
service 1, injecting said authentication.

Unfortunately, that doesnt work. Observing my traffic via wireshark, it
seems my second Keycloak Gatekeeper is not even involved in any
communication.

My docker compose file for service 1 and the forwarding proxy looks roughly
like this:

  keycloak-forwarder:
      image: quay.io/keycloak/keycloak-gatekeeper
      command:
        - --enable-forwarding=true
        - --forwarding-username=<my_username>
        - --forwarding-password=<my_password>
        - --forwarding-domains=${BASE_DOMAIN}/grafana
        - --listen=:3001
        - --client-id=<my_keycloak_client_id>
        - --client-secret=<my_keycloak_client_secret>
        - --discovery-url=${DOMAIN_PROTOCOL}://${KEYCLOAK_DOMAIN}/auth/realms/<my_keycloak_realm>
      networks:
        - webgateway

  grafana:
      image: grafana/grafana
      networks:
        - webgateway
      labels:
        traefik.enable: true
        traefik.backend: grafana
        traefik.frontend.rule:
Host:${BASE_DOMAIN};PathPrefix:/grafana;PathPrefixStrip:/grafana
        traefik.port: 3000
        traefik.docker.network: webgateway

Do you have any idea how to fix this?

Best
Bob

From Aditya.Bhole at veritas.com  Tue Jul 16 13:26:24 2019
From: Aditya.Bhole at veritas.com (Aditya Bhole)
Date: Tue, 16 Jul 2019 17:26:24 +0000
Subject: [keycloak-user] [EXTERNAL] Re: Trust between two standalone
 Keycloak Instances
In-Reply-To: <b26f4842-29be-4f7f-5421-7a7f59825bb6@redhat.com>
References: <D55B0359-78C8-4431-B7D7-C4DE13A2D8D0@contoso.com>
	<b26f4842-29be-4f7f-5421-7a7f59825bb6@redhat.com>
Message-ID: <C30F34E8-4658-47BE-9F05-CB9BCAA5B9EE@veritas.com>

I understand that deploying 3 clients under one realm will easily enable SSO. Even if we keep the clients in different realms, cross-realm trust can be established. But the use case of our prototype wants the clients to be on different servers. I?ll try to explain as best as I can.

Our company has 3 products deployed independently and these are managed by different administrators. Sometimes these have to be integrated with each other for seamless cross product experience at which time we would want SSO between the individual product UIs. We intend to use Keycloak as a broker for authentication and to achieve SSO. So that?s why I wanted to know if trust between two standalone Keycloak instances can be established.

Also, if we deploy the domain controller, can there still be local settings on the different Keycloak instances?

Thanks,
Aditya

?On 7/15/19, 12:25 PM, "keycloak-user-bounces at lists.jboss.org on behalf of Stan Silvert" <keycloak-user-bounces at lists.jboss.org on behalf of ssilvert at redhat.com> wrote:

    Why do you need each to have its own Keycloak instance?  A usual setup 
    would define all three clients in the same realm under the same Keycloak 
    instance.
    
    On 7/15/2019 1:23 PM, Aditya Bhole wrote:
    > Hello,
    >
    > I?m new to Keycloak and building a prototype SSO framework for my company. The use case is that my company has 3 clients; A, B and C. Now each client is going to have its own Keycloak instance; KA, KB and KC. Now what I want is when I login through client A I should be logged into client B and C as well. And same goes for all the clients. So for this to happen, is there a way of establishing trust between these three Keycloak instances KA, KB and KC?
    > I?ve successfully established an SSO by using KA as a broker and KB as an IDP. But this is only a master slave kind-of an architecture. When I log in to A, I?m automatically logged into B. But if I log into B, I won?t be automatically logged into A. Is it possible for KA to be a broker for KB and KB to be a broker for KA at the same time?
    > TL;DR :
    > Is there a way where Keycloak only acts as a broker and trust is established between multiple such Keycloak instances?
    >
    > I hope my question makes sense. Please point me in the right direction if I?m looking at this in the wrong way.
    >
    > Thanks,
    > Aditya
    >
    > _______________________________________________
    > keycloak-user mailing list
    > keycloak-user at lists.jboss.org
    > https://lists.jboss.org/mailman/listinfo/keycloak-user
    
    
    _______________________________________________
    keycloak-user mailing list
    keycloak-user at lists.jboss.org
    https://lists.jboss.org/mailman/listinfo/keycloak-user



From justinwilliams42 at gmail.com  Tue Jul 16 15:34:20 2019
From: justinwilliams42 at gmail.com (Justin Williams)
Date: Tue, 16 Jul 2019 12:34:20 -0700
Subject: [keycloak-user] CLI scripts
Message-ID: <CAPj_fOv3SXan4Kd0ZYdRh7rud5Kh-d=mKvRWKqNhXUte1WG6yw@mail.gmail.com>

Hello,

I'm mounting a volume containing CLI scripts to my Keycloak Docker
container "startup-scripts" directory, and the scripts execute, however
they do not take effect if a reload is required. I'm not seeing how I can
get the server to reload after executing all of the scripts.
Any suggestions?

Example (request-logging.cli):

embed-server --server-config=standalone.xml --std-out=echo

echo SETUP: Enabling detailed request logging

/subsystem=undertow/configuration=filter/custom-filter=request-logging-filter:add(class-name=io.undertow.server.handlers.RequestDumpingHandler,
module=io.undertow.core)
/subsystem=undertow/server=default-server/host=default-host/filter-ref=request-logging-filter:add

stop-embedded-server

From sinykk.skizm at gmail.com  Tue Jul 16 19:53:26 2019
From: sinykk.skizm at gmail.com (Sinykk Skizm)
Date: Tue, 16 Jul 2019 19:53:26 -0400
Subject: [keycloak-user] Can only seem to use docker image 3.4.0.final
Message-ID: <874046A5-64C3-4710-B156-E3E4CE4CB237@getmailspring.com>

I'm trying to run keycloak in docker and for whatever reason, it just won't. Except if I use the 3.4.0.Final tag, then keycloak spins up without any issues.

This is my docker compose for jboss/keycloak
# KeyCloak - Open Source Identity and Access Management
keycloak:
image: jboss/keycloak
container_name: keycloak
restart: always
hostname: keycloak
ports:
- "8282:8080"
environment:
- DB_VENDOR=POSTGRES
- DB_ADDR=postgresdb
- DB_DATABASE=keycloak
- DB_PORT=54320
- DB_USER=myuser
- DB_SCHEMA=public
- DB_PASSWORD=##mypassword$$
- PROXY_ADDRESS_FORWARDING=true
- KEYCLOAK_LOGLEVEL=INFO
- KEYCLOAK_USER=admin
- KEYCLOAK_PASSWORD=##mypassword##
depends_on:
- postgresdb
command:
- "-b 0.0.0.0"
- "-Dkeycloak.profile.feature.docker=enabled"
This is is what's produced in the docker-compose logs.

keycloak | =========================================================================
keycloak |
keycloak | JBoss Bootstrap Environment
keycloak |
keycloak | JBOSS_HOME: /opt/jboss/keycloak
keycloak |
keycloak | JAVA: /usr/lib/jvm/java/bin/java
keycloak |
keycloak | JAVA_OPTS: -server -Xms64m -Xmx512m -XX:MetaspaceSize=96M -XX:MaxMetaspaceSize=256m -Djava.net.preferIPv4Stack=true -Djboss.modules.system.pkgs=org.jboss.byteman -Djava.awt.headless=true
keycloak |
keycloak | =========================================================================
keycloak |
keycloak | 23:42:03,387 INFO [org.jboss.modules] (main) JBoss Modules version 1.9.0.Final
keycloak | 23:42:03,769 INFO [org.jboss.msc] (main) JBoss MSC version 1.4.5.Final
keycloak | 23:42:03,782 INFO [org.jboss.threads] (main) JBoss Threads version 2.3.3.Final
keycloak | 23:42:03,918 INFO [org.jboss.as] (MSC service thread 1-1) WFLYSRV0049: Keycloak 6.0.1 (WildFly Core 8.0.0.Final) starting
keycloak | 23:42:03,988 INFO [org.jboss.vfs] (MSC service thread 1-7) VFS000002: Failed to clean existing content for temp file provider of type temp. Enable DEBUG level log to find what caused this
keycloak | 23:42:04,586 INFO [org.wildfly.security] (ServerService Thread Pool -- 19) ELY00001: WildFly Elytron version 1.8.0.Final
keycloak | 23:42:05,261 INFO [org.jboss.as.controller.management-deprecated] (Controller Boot Thread) WFLYCTL0028: Attribute 'security-realm' in the resource at address '/core-service=management/management-interface=http-interface' is deprecated, and may be removed in a future version. See the attribute description in the output of the read-resource-description operation to learn more about the deprecation.
keycloak | 23:42:05,293 INFO [org.jboss.as.controller.management-deprecated] (ServerService Thread Pool -- 29) WFLYCTL0028: Attribute 'security-realm' in the resource at address '/subsystem=undertow/server=default-server/https-listener=https' is deprecated, and may be removed in a future version. See the attribute description in the output of the read-resource-description operation to learn more about the deprecation.
keycloak | 23:42:05,435 INFO [org.jboss.as.server] (Controller Boot Thread) WFLYSRV0039: Creating http management service using socket-binding (management-http)
keycloak | 23:42:05,450 INFO [org.xnio] (MSC service thread 1-4) XNIO version 3.6.5.Final
keycloak | 23:42:05,456 INFO [org.xnio.nio] (MSC service thread 1-4) XNIO NIO Implementation Version 3.6.5.Final
keycloak | 23:42:05,498 INFO [org.wildfly.extension.io] (ServerService Thread Pool -- 39) WFLYIO001: Worker 'default' has auto-configured to 16 core threads with 128 task threads based on your 8 available processors
keycloak | 23:42:05,501 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 38) WFLYCLINF0001: Activating Infinispan subsystem.
keycloak | 23:42:05,507 INFO [org.jboss.as.clustering.jgroups] (ServerService Thread Pool -- 42) WFLYCLJG0001: Activating JGroups subsystem. JGroups version 4.0.18
keycloak | 23:42:05,501 INFO [org.jboss.as.connector.subsystems.datasources] (ServerService Thread Pool -- 33) WFLYJCA0004: Deploying JDBC-compliant driver class org.h2.Driver (version 1.4)
keycloak | 23:42:05,512 INFO [org.jboss.as.connector] (MSC service thread 1-3) WFLYJCA0009: Starting JCA Subsystem (WildFly/IronJacamar 1.4.12.Final)
keycloak | 23:42:05,518 INFO [org.jboss.as.connector.deployers.jdbc] (MSC service thread 1-1) WFLYJCA0018: Started Driver service with driver-name = h2
keycloak | 23:42:05,519 INFO [org.jboss.as.jaxrs] (ServerService Thread Pool -- 40) WFLYRS0016: RESTEasy version 3.6.3.Final
keycloak | 23:42:05,536 INFO [org.jboss.as.connector.subsystems.datasources] (ServerService Thread Pool -- 33) WFLYJCA0005: Deploying non-JDBC-compliant driver class org.postgresql.Driver (version 42.2)
keycloak | 23:42:05,550 INFO [org.jboss.as.connector.deployers.jdbc] (MSC service thread 1-6) WFLYJCA0018: Started Driver service with driver-name = postgresql
keycloak | 23:42:05,565 INFO [org.jboss.remoting] (MSC service thread 1-4) JBoss Remoting version 5.0.8.Final
keycloak | 23:42:05,588 INFO [org.wildfly.extension.microprofile.config.smallrye._private] (ServerService Thread Pool -- 47) WFLYCONF0001: Activating WildFly MicroProfile Config Subsystem
keycloak | 23:42:05,607 WARN [org.jboss.as.txn] (ServerService Thread Pool -- 56) WFLYTX0013: The node-identifier attribute on the /subsystem=transactions is set to the default value. This is a danger for environments running multiple servers. Please make sure the attribute value is unique.
keycloak | 23:42:05,615 INFO [org.wildfly.extension.microprofile.metrics.smallrye] (ServerService Thread Pool -- 49) WFLYMETRICS0001: Activating Eclipse MicroProfile Metrics Subsystem
keycloak | 23:42:05,615 INFO [org.jboss.as.mail.extension] (MSC service thread 1-2) WFLYMAIL0002: Unbound mail session [java:jboss/mail/Default]
keycloak | 23:42:05,618 INFO [org.wildfly.extension.microprofile.health.smallrye] (ServerService Thread Pool -- 48) WFLYHEALTH0001: Activating Eclipse MicroProfile Health Subsystem
keycloak | 23:42:05,619 INFO [org.jboss.as.naming] (ServerService Thread Pool -- 51) WFLYNAM0001: Activating Naming Subsystem
keycloak | 23:42:05,747 INFO [org.jboss.as.security] (ServerService Thread Pool -- 54) WFLYSEC0002: Activating Security Subsystem
keycloak | 23:42:05,766 INFO [org.wildfly.extension.undertow] (MSC service thread 1-4) WFLYUT0003: Undertow 2.0.19.Final starting
keycloak | 23:42:05,767 INFO [org.jboss.as.connector.subsystems.datasources] (MSC service thread 1-5) WFLYJCA0010: Unbound data source [java:jboss/datasources/ExampleDS]
keycloak | 23:42:05,774 INFO [org.jboss.as.connector.subsystems.datasources] (MSC service thread 1-2) WFLYJCA0010: Unbound data source [java:jboss/datasources/KeycloakDS]
keycloak | 23:42:05,789 INFO [org.jboss.as.security] (MSC service thread 1-4) WFLYSEC0001: Current PicketBox version=5.0.3.Final
keycloak | 23:42:05,803 INFO [io.smallrye.metrics] (MSC service thread 1-6) Converted [2] config entries and added [4] replacements
keycloak | 23:42:05,810 INFO [io.smallrye.metrics] (MSC service thread 1-6) Converted [3] config entries and added [14] replacements
keycloak | 23:42:05,832 INFO [org.jboss.as.naming] (MSC service thread 1-2) WFLYNAM0003: Starting Naming Service
keycloak | 23:42:05,841 INFO [org.jboss.as.mail.extension] (MSC service thread 1-4) WFLYMAIL0001: Bound mail session [java:jboss/mail/Default]
keycloak | 23:42:05,858 INFO [org.jboss.as.ejb3] (MSC service thread 1-8) WFLYEJB0481: Strict pool slsb-strict-max-pool is using a max instance size of 128 (per class), which is derived from thread worker pool sizing.
keycloak | 23:42:05,860 INFO [org.jboss.as.ejb3] (MSC service thread 1-7) WFLYEJB0482: Strict pool mdb-strict-max-pool is using a max instance size of 32 (per class), which is derived from the number of CPUs on this host.
keycloak | 23:42:05,924 INFO [org.wildfly.extension.undertow] (ServerService Thread Pool -- 57) WFLYUT0014: Creating file handler for path '/opt/jboss/keycloak/welcome-content' with options [directory-listing: 'false', follow-symlink: 'false', case-sensitive: 'true', safe-symlink-paths: '[]']
keycloak | 23:42:05,934 INFO [org.wildfly.extension.undertow] (MSC service thread 1-6) WFLYUT0012: Started server default-server.
keycloak | 23:42:05,953 INFO [org.wildfly.extension.undertow] (MSC service thread 1-1) WFLYUT0018: Host default-host starting
keycloak | 23:42:05,987 INFO [org.wildfly.extension.undertow] (MSC service thread 1-2) WFLYUT0006: Undertow HTTP listener default listening on 0.0.0.0:8080
keycloak | 23:42:05,987 INFO [org.wildfly.extension.undertow] (MSC service thread 1-7) WFLYUT0006: Undertow AJP listener ajp listening on 0.0.0.0:8009
keycloak | 23:42:06,002 INFO [org.jboss.modcluster] (ServerService Thread Pool -- 58) MODCLUSTER000001: Initializing mod_cluster version 1.4.0.Final
keycloak | 23:42:06,018 INFO [org.jboss.modcluster] (ServerService Thread Pool -- 58) MODCLUSTER000032: Listening to proxy advertisements on /224.0.1.105:23364
keycloak | 23:42:06,078 INFO [org.jboss.as.patching] (MSC service thread 1-5) WFLYPAT0050: Keycloak cumulative patch ID is: base, one-off patches include: none
keycloak | 23:42:06,091 INFO [org.jboss.as.ejb3] (MSC service thread 1-3) WFLYEJB0493: EJB subsystem suspension complete
keycloak | 23:42:06,096 WARN [org.jboss.as.domain.management.security] (MSC service thread 1-8) WFLYDM0111: Keystore /opt/jboss/keycloak/standalone/configuration/application.keystore not found, it will be auto generated on first use with a self signed certificate for host localhost
keycloak | 23:42:06,108 INFO [org.jboss.as.server.deployment.scanner] (MSC service thread 1-4) WFLYDS0013: Started FileSystemDeploymentService for directory /opt/jboss/keycloak/standalone/deployments
keycloak | 23:42:06,119 INFO [org.jboss.as.server.deployment] (MSC service thread 1-7) WFLYSRV0027: Starting deployment of "keycloak-server.war" (runtime-name: "keycloak-server.war")
keycloak | 23:42:06,171 INFO [org.wildfly.extension.undertow] (MSC service thread 1-8) WFLYUT0006: Undertow HTTPS listener https listening on 0.0.0.0:8443
keycloak | 23:42:06,177 INFO [org.jboss.as.connector.subsystems.datasources] (MSC service thread 1-2) WFLYJCA0001: Bound data source [java:jboss/datasources/ExampleDS]
keycloak | 23:42:06,178 INFO [org.jboss.as.connector.subsystems.datasources] (MSC service thread 1-7) WFLYJCA0001: Bound data source [java:jboss/datasources/KeycloakDS]
keycloak | 23:42:06,344 WARN [org.jboss.as.dependency.private] (MSC service thread 1-1) WFLYSRV0018: Deployment "deployment.keycloak-server.war" is using a private module ("org.kie") which may be changed or removed in future versions without notice.
keycloak | 23:42:06,631 WARN [org.jgroups.protocols.UDP] (ServerService Thread Pool -- 58) JGRP000015: the send buffer of socket ManagedMulticastSocketBinding was set to 1.00MB, but the OS only allocated 212.99KB. This might lead to performance problems. Please set your max send buffer in the OS correctly (e.g. net.core.wmem_max on Linux)
keycloak | 23:42:06,632 WARN [org.jgroups.protocols.UDP] (ServerService Thread Pool -- 58) JGRP000015: the receive buffer of socket ManagedMulticastSocketBinding was set to 20.00MB, but the OS only allocated 212.99KB. This might lead to performance problems. Please set your max receive buffer in the OS correctly (e.g. net.core.rmem_max on Linux)
keycloak | 23:42:06,632 WARN [org.jgroups.protocols.UDP] (ServerService Thread Pool -- 58) JGRP000015: the send buffer of socket ManagedMulticastSocketBinding was set to 1.00MB, but the OS only allocated 212.99KB. This might lead to performance problems. Please set your max send buffer in the OS correctly (e.g. net.core.wmem_max on Linux)
keycloak | 23:42:06,632 WARN [org.jgroups.protocols.UDP] (ServerService Thread Pool -- 58) JGRP000015: the receive buffer of socket ManagedMulticastSocketBinding was set to 25.00MB, but the OS only allocated 212.99KB. This might lead to performance problems. Please set your max receive buffer in the OS correctly (e.g. net.core.rmem_max on Linux)
keycloak | 23:42:09,641 INFO [org.jgroups.protocols.pbcast.GMS] (ServerService Thread Pool -- 58) keycloak: no members discovered after 3003 ms: creating cluster as first member
keycloak | 23:42:09,939 INFO [org.infinispan.factories.GlobalComponentRegistry] (MSC service thread 1-7) ISPN000128: Infinispan version: Infinispan 'Infinity Minus ONE +2' 9.4.8.Final
keycloak | 23:42:10,118 INFO [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-4) ISPN000078: Starting JGroups channel ejb
keycloak | 23:42:10,118 INFO [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-1) ISPN000078: Starting JGroups channel ejb
keycloak | 23:42:10,118 INFO [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-5) ISPN000078: Starting JGroups channel ejb
keycloak | 23:42:10,118 INFO [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-6) ISPN000078: Starting JGroups channel ejb
keycloak | 23:42:10,118 INFO [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-7) ISPN000078: Starting JGroups channel ejb
keycloak | 23:42:10,124 INFO [org.infinispan.CLUSTER] (MSC service thread 1-4) ISPN000094: Received new cluster view for channel ejb: [keycloak|0] (1) [keycloak]
keycloak | 23:42:10,124 INFO [org.infinispan.CLUSTER] (MSC service thread 1-6) ISPN000094: Received new cluster view for channel ejb: [keycloak|0] (1) [keycloak]
keycloak | 23:42:10,124 INFO [org.infinispan.CLUSTER] (MSC service thread 1-5) ISPN000094: Received new cluster view for channel ejb: [keycloak|0] (1) [keycloak]
keycloak | 23:42:10,124 INFO [org.infinispan.CLUSTER] (MSC service thread 1-7) ISPN000094: Received new cluster view for channel ejb: [keycloak|0] (1) [keycloak]
keycloak | 23:42:10,124 INFO [org.infinispan.CLUSTER] (MSC service thread 1-1) ISPN000094: Received new cluster view for channel ejb: [keycloak|0] (1) [keycloak]
keycloak | 23:42:10,132 INFO [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-1) ISPN000079: Channel ejb local address is keycloak, physical addresses are [172.19.0.6:55200]
keycloak | 23:42:10,132 INFO [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-6) ISPN000079: Channel ejb local address is keycloak, physical addresses are [172.19.0.6:55200]
keycloak | 23:42:10,133 INFO [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-4) ISPN000079: Channel ejb local address is keycloak, physical addresses are [172.19.0.6:55200]
keycloak | 23:42:10,132 INFO [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-7) ISPN000079: Channel ejb local address is keycloak, physical addresses are [172.19.0.6:55200]
keycloak | 23:42:10,134 INFO [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-5) ISPN000079: Channel ejb local address is keycloak, physical addresses are [172.19.0.6:55200]
keycloak | 23:42:10,311 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 58) WFLYCLINF0002: Started users cache from keycloak container
keycloak | 23:42:10,311 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 61) WFLYCLINF0002: Started realms cache from keycloak container
keycloak | 23:42:10,311 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 65) WFLYCLINF0002: Started authorization cache from keycloak container
keycloak | 23:42:10,311 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 68) WFLYCLINF0002: Started keys cache from keycloak container
keycloak | 23:42:10,666 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 69) WFLYCLINF0002: Started offlineSessions cache from keycloak container
keycloak | 23:42:10,666 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 64) WFLYCLINF0002: Started authenticationSessions cache from keycloak container
keycloak | 23:42:10,668 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 63) WFLYCLINF0002: Started clientSessions cache from keycloak container
keycloak | 23:42:10,668 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 67) WFLYCLINF0002: Started actionTokens cache from keycloak container
keycloak | 23:42:10,668 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 62) WFLYCLINF0002: Started offlineClientSessions cache from keycloak container
keycloak | 23:42:10,668 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 59) WFLYCLINF0002: Started sessions cache from keycloak container
keycloak | 23:42:10,669 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 70) WFLYCLINF0002: Started client-mappings cache from ejb container
keycloak | 23:42:10,669 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 66) WFLYCLINF0002: Started work cache from keycloak container
keycloak | 23:42:10,670 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 60) WFLYCLINF0002: Started loginFailures cache from keycloak container
keycloak | 23:42:10,798 WARN [org.jboss.as.server.deployment] (MSC service thread 1-6) WFLYSRV0273: Excluded subsystem weld via jboss-deployment-structure.xml does not exist.
keycloak | 23:42:10,798 WARN [org.jboss.as.server.deployment] (MSC service thread 1-6) WFLYSRV0273: Excluded subsystem webservices via jboss-deployment-structure.xml does not exist.
keycloak | 23:42:11,300 INFO [org.keycloak.services] (ServerService Thread Pool -- 60) KC-SERVICES0001: Loading config from standalone.xml or domain.xml
keycloak | 23:42:11,612 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 60) WFLYCLINF0002: Started realmRevisions cache from keycloak container
keycloak | 23:42:11,617 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 60) WFLYCLINF0002: Started userRevisions cache from keycloak container
keycloak | 23:42:11,622 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 60) WFLYCLINF0002: Started authorizationRevisions cache from keycloak container
keycloak | 23:42:11,623 INFO [org.keycloak.connections.infinispan.DefaultInfinispanConnectionProviderFactory] (ServerService Thread Pool -- 60) Node name: keycloak, Site name: null
keycloak | 23:42:11,952 WARN [org.jboss.jca.core.connectionmanager.pool.strategy.OnePool] (ServerService Thread Pool -- 60) IJ000604: Throwable while attempting to get a new connection: null: javax.resource.ResourceException: IJ031084: Unable to create connection
keycloak | at org.jboss.jca.adapters.jdbc.local.LocalManagedConnectionFactory.createLocalManagedConnection(LocalManagedConnectionFactory.java:345)
keycloak | at org.jboss.jca.adapters.jdbc.local.LocalManagedConnectionFactory.getLocalManagedConnection(LocalManagedConnectionFactory.java:352)
keycloak | at org.jboss.jca.adapters.jdbc.local.LocalManagedConnectionFactory.createManagedConnection(LocalManagedConnectionFactory.java:287)
keycloak | at org.jboss.jca.core.connectionmanager.pool.mcp.SemaphoreConcurrentLinkedDequeManagedConnectionPool.createConnectionEventListener(SemaphoreConcurrentLinkedDequeManagedConnectionPool.java:1325)
keycloak | at org.jboss.jca.core.connectionmanager.pool.mcp.SemaphoreConcurrentLinkedDequeManagedConnectionPool.getConnection(SemaphoreConcurrentLinkedDequeManagedConnectionPool.java:499)
keycloak | at org.jboss.jca.core.connectionmanager.pool.AbstractPool.getSimpleConnection(AbstractPool.java:632)
keycloak | at org.jboss.jca.core.connectionmanager.pool.AbstractPool.getConnection(AbstractPool.java:604)
keycloak | at org.jboss.jca.core.connectionmanager.AbstractConnectionManager.getManagedConnection(AbstractConnectionManager.java:624)
keycloak | at org.jboss.jca.core.connectionmanager.tx.TxConnectionManagerImpl.getManagedConnection(TxConnectionManagerImpl.java:440)
keycloak | at org.jboss.jca.core.connectionmanager.AbstractConnectionManager.allocateConnection(AbstractConnectionManager.java:789)
keycloak | at org.jboss.jca.adapters.jdbc.WrapperDataSource.getConnection(WrapperDataSource.java:138)
keycloak | at org.jboss.as.connector.subsystems.datasources.WildFlyDataSource.getConnection(WildFlyDataSource.java:64)
keycloak | at org.keycloak.connections.jpa.DefaultJpaConnectionProviderFactory.getConnection(DefaultJpaConnectionProviderFactory.java:376)
keycloak | at org.keycloak.connections.jpa.updater.liquibase.lock.LiquibaseDBLockProvider.lazyInit(LiquibaseDBLockProvider.java:65)
keycloak | at org.keycloak.connections.jpa.updater.liquibase.lock.LiquibaseDBLockProvider.lambda$waitForLock$0(LiquibaseDBLockProvider.java:97)
keycloak | at org.keycloak.models.utils.KeycloakModelUtils.suspendJtaTransaction(KeycloakModelUtils.java:678)
keycloak | at org.keycloak.connections.jpa.updater.liquibase.lock.LiquibaseDBLockProvider.waitForLock(LiquibaseDBLockProvider.java:95)
keycloak | at org.keycloak.services.resources.KeycloakApplication$1.run(KeycloakApplication.java:144)
keycloak | at org.keycloak.models.utils.KeycloakModelUtils.runJobInTransaction(KeycloakModelUtils.java:227)
keycloak | at org.keycloak.services.resources.KeycloakApplication.<init>(KeycloakApplication.java:137)
keycloak | at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
keycloak | at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
keycloak | at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
keycloak | at java.lang.reflect.Constructor.newInstance(Constructor.java:423)
keycloak | at org.jboss.resteasy.core.ConstructorInjectorImpl.construct(ConstructorInjectorImpl.java:152)
keycloak | at org.jboss.resteasy.spi.ResteasyProviderFactory.createProviderInstance(ResteasyProviderFactory.java:2750)
keycloak | at org.jboss.resteasy.spi.ResteasyDeployment.createApplication(ResteasyDeployment.java:364)
keycloak | at org.jboss.resteasy.spi.ResteasyDeployment.startInternal(ResteasyDeployment.java:277)
keycloak | at org.jboss.resteasy.spi.ResteasyDeployment.start(ResteasyDeployment.java:89)
keycloak | at org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.init(ServletContainerDispatcher.java:119)
keycloak | at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.init(HttpServletDispatcher.java:36)
keycloak | at io.undertow.servlet.core.LifecyleInterceptorInvocation.proceed(LifecyleInterceptorInvocation.java:117)
keycloak | at org.wildfly.extension.undertow.security.RunAsLifecycleInterceptor.init(RunAsLifecycleInterceptor.java:78)
keycloak | at io.undertow.servlet.core.LifecyleInterceptorInvocation.proceed(LifecyleInterceptorInvocation.java:103)
keycloak | at io.undertow.servlet.core.ManagedServlet$DefaultInstanceStrategy.start(ManagedServlet.java:303)
keycloak | at io.undertow.servlet.core.ManagedServlet.createServlet(ManagedServlet.java:143)
keycloak | at io.undertow.servlet.core.DeploymentManagerImpl$2.call(DeploymentManagerImpl.java:583)
keycloak | at io.undertow.servlet.core.DeploymentManagerImpl$2.call(DeploymentManagerImpl.java:554)
keycloak | at io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:42)
keycloak | at io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43)
keycloak | at org.wildfly.extension.undertow.security.SecurityContextThreadSetupAction.lambda$create$0(SecurityContextThreadSetupAction.java:105)
keycloak | at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)
keycloak | at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)
keycloak | at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)
keycloak | at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)
keycloak | at io.undertow.servlet.core.DeploymentManagerImpl.start(DeploymentManagerImpl.java:596)
keycloak | at org.wildfly.extension.undertow.deployment.UndertowDeploymentService.startContext(UndertowDeploymentService.java:97)
keycloak | at org.wildfly.extension.undertow.deployment.UndertowDeploymentService$1.run(UndertowDeploymentService.java:78)
keycloak | at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
keycloak | at java.util.concurrent.FutureTask.run(FutureTask.java:266)
keycloak | at org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35)
keycloak | at org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1982)
keycloak | at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1486)
keycloak | at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1377)
keycloak | at java.lang.Thread.run(Thread.java:748)
keycloak | at org.jboss.threads.JBossThread.run(JBossThread.java:485)
keycloak | Caused by: org.postgresql.util.PSQLException: The connection attempt failed.
keycloak | at org.postgresql.core.v3.ConnectionFactoryImpl.openConnectionImpl(ConnectionFactoryImpl.java:292)
keycloak | at org.postgresql.core.ConnectionFactory.openConnection(ConnectionFactory.java:49)
keycloak | at org.postgresql.jdbc.PgConnection.<init>(PgConnection.java:195)
keycloak | at org.postgresql.Driver.makeConnection(Driver.java:454)
keycloak | at org.postgresql.Driver.connect(Driver.java:256)
keycloak | at org.jboss.jca.adapters.jdbc.local.LocalManagedConnectionFactory.createLocalManagedConnection(LocalManagedConnectionFactory.java:321)
keycloak | ... 55 more
keycloak | Caused by: java.net.UnknownHostException: postgresdb
keycloak | at java.net.AbstractPlainSocketImpl.connect(AbstractPlainSocketImpl.java:184)
keycloak | at java.net.SocksSocketImpl.connect(SocksSocketImpl.java:392)
keycloak | at java.net.Socket.connect(Socket.java:589)
keycloak | at org.postgresql.core.PGStream.<init>(PGStream.java:70)
keycloak | at org.postgresql.core.v3.ConnectionFactoryImpl.tryConnect(ConnectionFactoryImpl.java:91)
keycloak | at org.postgresql.core.v3.ConnectionFactoryImpl.openConnectionImpl(ConnectionFactoryImpl.java:192)
keycloak | ... 60 more
keycloak |
keycloak | 23:42:11,960 INFO [org.jboss.as.server] (Thread-2) WFLYSRV0220: Server shutdown has been requested via an OS signal
keycloak | 23:42:11,971 ERROR [org.jboss.msc.service.fail] (ServerService Thread Pool -- 60) MSC000001: Failed to start service jboss.deployment.unit."keycloak-server.war".undertow-deployment: org.jboss.msc.service.StartException in service jboss.deployment.unit."keycloak-server.war".undertow-deployment: java.lang.RuntimeException: RESTEASY003325: Failed to construct public org.keycloak.services.resources.KeycloakApplication(javax.servlet.ServletContext,org.jboss.resteasy.core.Dispatcher)
keycloak | at org.wildfly.extension.undertow.deployment.UndertowDeploymentService$1.run(UndertowDeploymentService.java:81)
keycloak | at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
keycloak | at java.util.concurrent.FutureTask.run(FutureTask.java:266)
keycloak | at org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35)
keycloak | at org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1982)
keycloak | at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1486)
keycloak | at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1377)
keycloak | at java.lang.Thread.run(Thread.java:748)
keycloak | at org.jboss.threads.JBossThread.run(JBossThread.java:485)
keycloak | Caused by: java.lang.RuntimeException: RESTEASY003325: Failed to construct public org.keycloak.services.resources.KeycloakApplication(javax.servlet.ServletContext,org.jboss.resteasy.core.Dispatcher)
keycloak | at org.jboss.resteasy.core.ConstructorInjectorImpl.construct(ConstructorInjectorImpl.java:164)
keycloak | at org.jboss.resteasy.spi.ResteasyProviderFactory.createProviderInstance(ResteasyProviderFactory.java:2750)
keycloak | at org.jboss.resteasy.spi.ResteasyDeployment.createApplication(ResteasyDeployment.java:364)
keycloak | at org.jboss.resteasy.spi.ResteasyDeployment.startInternal(ResteasyDeployment.java:277)
keycloak | at org.jboss.resteasy.spi.ResteasyDeployment.start(ResteasyDeployment.java:89)
keycloak | at org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.init(ServletContainerDispatcher.java:119)
keycloak | at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.init(HttpServletDispatcher.java:36)
keycloak | at io.undertow.servlet.core.LifecyleInterceptorInvocation.proceed(LifecyleInterceptorInvocation.java:117)
keycloak | at org.wildfly.extension.undertow.security.RunAsLifecycleInterceptor.init(RunAsLifecycleInterceptor.java:78)
keycloak | at io.undertow.servlet.core.LifecyleInterceptorInvocation.proceed(LifecyleInterceptorInvocation.java:103)
keycloak | at io.undertow.servlet.core.ManagedServlet$DefaultInstanceStrategy.start(ManagedServlet.java:303)
keycloak | at io.undertow.servlet.core.ManagedServlet.createServlet(ManagedServlet.java:143)
keycloak | at io.undertow.servlet.core.DeploymentManagerImpl$2.call(DeploymentManagerImpl.java:583)
keycloak | at io.undertow.servlet.core.DeploymentManagerImpl$2.call(DeploymentManagerImpl.java:554)
keycloak | at io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:42)
keycloak | at io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43)
keycloak | at org.wildfly.extension.undertow.security.SecurityContextThreadSetupAction.lambda$create$0(SecurityContextThreadSetupAction.java:105)
keycloak | at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)
keycloak | at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)
keycloak | at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)
keycloak | at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)
keycloak | at io.undertow.servlet.core.DeploymentManagerImpl.start(DeploymentManagerImpl.java:596)
keycloak | at org.wildfly.extension.undertow.deployment.UndertowDeploymentService.startContext(UndertowDeploymentService.java:97)
keycloak | at org.wildfly.extension.undertow.deployment.UndertowDeploymentService$1.run(UndertowDeploymentService.java:78)
keycloak | ... 8 more
keycloak | Caused by: java.lang.RuntimeException: Failed to connect to database
keycloak | at org.keycloak.connections.jpa.DefaultJpaConnectionProviderFactory.getConnection(DefaultJpaConnectionProviderFactory.java:382)
keycloak | at org.keycloak.connections.jpa.updater.liquibase.lock.LiquibaseDBLockProvider.lazyInit(LiquibaseDBLockProvider.java:65)
keycloak | at org.keycloak.connections.jpa.updater.liquibase.lock.LiquibaseDBLockProvider.lambda$waitForLock$0(LiquibaseDBLockProvider.java:97)
keycloak | at org.keycloak.models.utils.KeycloakModelUtils.suspendJtaTransaction(KeycloakModelUtils.java:678)
keycloak | at org.keycloak.connections.jpa.updater.liquibase.lock.LiquibaseDBLockProvider.waitForLock(LiquibaseDBLockProvider.java:95)
keycloak | at org.keycloak.services.resources.KeycloakApplication$1.run(KeycloakApplication.java:144)
keycloak | at org.keycloak.models.utils.KeycloakModelUtils.runJobInTransaction(KeycloakModelUtils.java:227)
keycloak | at org.keycloak.services.resources.KeycloakApplication.<init>(KeycloakApplication.java:137)
keycloak | at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
keycloak | at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
keycloak | at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
keycloak | at java.lang.reflect.Constructor.newInstance(Constructor.java:423)
keycloak | at org.jboss.resteasy.core.ConstructorInjectorImpl.construct(ConstructorInjectorImpl.java:152)
keycloak | ... 31 more
keycloak | Caused by: java.sql.SQLException: javax.resource.ResourceException: IJ000453: Unable to get managed connection for java:jboss/datasources/KeycloakDS
keycloak | at org.jboss.jca.adapters.jdbc.WrapperDataSource.getConnection(WrapperDataSource.java:146)
keycloak | at org.jboss.as.connector.subsystems.datasources.WildFlyDataSource.getConnection(WildFlyDataSource.java:64)
keycloak | at org.keycloak.connections.jpa.DefaultJpaConnectionProviderFactory.getConnection(DefaultJpaConnectionProviderFactory.java:376)
keycloak | ... 43 more
keycloak | Caused by: javax.resource.ResourceException: IJ000453: Unable to get managed connection for java:jboss/datasources/KeycloakDS
keycloak | at org.jboss.jca.core.connectionmanager.AbstractConnectionManager.getManagedConnection(AbstractConnectionManager.java:690)
keycloak | at org.jboss.jca.core.connectionmanager.tx.TxConnectionManagerImpl.getManagedConnection(TxConnectionManagerImpl.java:440)
keycloak | at org.jboss.jca.core.connectionmanager.AbstractConnectionManager.allocateConnection(AbstractConnectionManager.java:789)
keycloak | at org.jboss.jca.adapters.jdbc.WrapperDataSource.getConnection(WrapperDataSource.java:138)
keycloak | ... 45 more
keycloak | Caused by: javax.resource.ResourceException: IJ031084: Unable to create connection
keycloak | at org.jboss.jca.adapters.jdbc.local.LocalManagedConnectionFactory.createLocalManagedConnection(LocalManagedConnectionFactory.java:345)
keycloak | at org.jboss.jca.adapters.jdbc.local.LocalManagedConnectionFactory.getLocalManagedConnection(LocalManagedConnectionFactory.java:352)
keycloak | at org.jboss.jca.adapters.jdbc.local.LocalManagedConnectionFactory.createManagedConnection(LocalManagedConnectionFactory.java:287)
keycloak | at org.jboss.jca.core.connectionmanager.pool.mcp.SemaphoreConcurrentLinkedDequeManagedConnectionPool.createConnectionEventListener(SemaphoreConcurrentLinkedDequeManagedConnectionPool.java:1325)
keycloak | at org.jboss.jca.core.connectionmanager.pool.mcp.SemaphoreConcurrentLinkedDequeManagedConnectionPool.getConnection(SemaphoreConcurrentLinkedDequeManagedConnectionPool.java:499)
keycloak | at org.jboss.jca.core.connectionmanager.pool.AbstractPool.getSimpleConnection(AbstractPool.java:632)
keycloak | at org.jboss.jca.core.connectionmanager.pool.AbstractPool.getConnection(AbstractPool.java:604)
keycloak | at org.jboss.jca.core.connectionmanager.AbstractConnectionManager.getManagedConnection(AbstractConnectionManager.java:624)
keycloak | ... 48 more
keycloak | Caused by: org.postgresql.util.PSQLException: The connection attempt failed.
keycloak | at org.postgresql.core.v3.ConnectionFactoryImpl.openConnectionImpl(ConnectionFactoryImpl.java:292)
keycloak | at org.postgresql.core.ConnectionFactory.openConnection(ConnectionFactory.java:49)
keycloak | at org.postgresql.jdbc.PgConnection.<init>(PgConnection.java:195)
keycloak | at org.postgresql.Driver.makeConnection(Driver.java:454)
keycloak | at org.postgresql.Driver.connect(Driver.java:256)
keycloak | at org.jboss.jca.adapters.jdbc.local.LocalManagedConnectionFactory.createLocalManagedConnection(LocalManagedConnectionFactory.java:321)
keycloak | ... 55 more
keycloak | Caused by: java.net.UnknownHostException: postgresdb
keycloak | at java.net.AbstractPlainSocketImpl.connect(AbstractPlainSocketImpl.java:184)
keycloak | at java.net.SocksSocketImpl.connect(SocksSocketImpl.java:392)
keycloak | at java.net.Socket.connect(Socket.java:589)
keycloak | at org.postgresql.core.PGStream.<init>(PGStream.java:70)
keycloak | at org.postgresql.core.v3.ConnectionFactoryImpl.tryConnect(ConnectionFactoryImpl.java:91)
keycloak | at org.postgresql.core.v3.ConnectionFactoryImpl.openConnectionImpl(ConnectionFactoryImpl.java:192)
keycloak | ... 60 more
keycloak |
keycloak | 23:42:11,996 INFO [org.jboss.as.connector.subsystems.datasources] (MSC service thread 1-8) WFLYJCA0010: Unbound data source [java:jboss/datasources/KeycloakDS]
keycloak | 23:42:11,998 INFO [org.jboss.as.mail.extension] (MSC service thread 1-7) WFLYMAIL0002: Unbound mail session [java:jboss/mail/Default]
keycloak | 23:42:11,998 INFO [org.wildfly.extension.undertow] (MSC service thread 1-7) WFLYUT0008: Undertow HTTPS listener https suspending
keycloak | 23:42:12,002 INFO [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-3) ISPN000080: Disconnecting JGroups channel ejb
keycloak | 23:42:12,003 INFO [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-1) ISPN000080: Disconnecting JGroups channel ejb
keycloak | 23:42:12,005 INFO [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-4) ISPN000080: Disconnecting JGroups channel ejb
keycloak | 23:42:12,009 INFO [org.jboss.as.connector.subsystems.datasources] (MSC service thread 1-1) WFLYJCA0010: Unbound data source [java:jboss/datasources/ExampleDS]
keycloak | 23:42:12,010 INFO [org.jboss.modcluster] (ServerService Thread Pool -- 70) MODCLUSTER000002: Initiating mod_cluster shutdown
keycloak | 23:42:12,010 INFO [org.wildfly.extension.undertow] (MSC service thread 1-5) WFLYUT0008: Undertow AJP listener ajp suspending
keycloak | 23:42:12,012 INFO [org.jboss.as.connector.deployers.jdbc] (MSC service thread 1-3) WFLYJCA0019: Stopped Driver service with driver-name = postgresql
keycloak | 23:42:12,012 INFO [org.jboss.as.connector.deployers.jdbc] (MSC service thread 1-1) WFLYJCA0019: Stopped Driver service with driver-name = h2
keycloak | 23:42:12,016 INFO [org.wildfly.extension.undertow] (MSC service thread 1-7) WFLYUT0007: Undertow HTTPS listener https stopped, was bound to 0.0.0.0:8443
keycloak | 23:42:12,016 INFO [org.wildfly.extension.undertow] (MSC service thread 1-5) WFLYUT0007: Undertow AJP listener ajp stopped, was bound to 0.0.0.0:8009
keycloak | 23:42:12,022 INFO [org.wildfly.extension.undertow] (MSC service thread 1-5) WFLYUT0008: Undertow HTTP listener default suspending
keycloak | 23:42:12,025 INFO [org.wildfly.extension.undertow] (MSC service thread 1-5) WFLYUT0007: Undertow HTTP listener default stopped, was bound to 0.0.0.0:8080
keycloak | 23:42:12,029 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 66) WFLYCLINF0003: Stopped client-mappings cache from ejb container
keycloak | 23:42:12,031 INFO [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-1) ISPN000080: Disconnecting JGroups channel ejb
keycloak | 23:42:12,034 INFO [org.wildfly.extension.undertow] (MSC service thread 1-4) WFLYUT0019: Host default-host stopping
keycloak | 23:42:12,035 INFO [org.wildfly.extension.undertow] (MSC service thread 1-3) WFLYUT0004: Undertow 2.0.19.Final stopping
keycloak | 23:42:12,040 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 60) WFLYCLINF0003: Stopped keys cache from keycloak container
keycloak | 23:42:12,040 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 64) WFLYCLINF0003: Stopped authorization cache from keycloak container
keycloak | 23:42:12,043 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 64) WFLYCLINF0003: Stopped users cache from keycloak container
keycloak | 23:42:12,046 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 61) WFLYCLINF0003: Stopped realms cache from keycloak container
keycloak | 23:42:12,046 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 59) WFLYCLINF0003: Stopped work cache from keycloak container
keycloak | 23:42:12,049 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 60) WFLYCLINF0003: Stopped offlineSessions cache from keycloak container
keycloak | 23:42:12,051 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 70) WFLYCLINF0003: Stopped authenticationSessions cache from keycloak container
keycloak | 23:42:12,051 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 66) WFLYCLINF0003: Stopped clientSessions cache from keycloak container
keycloak | 23:42:12,053 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 62) WFLYCLINF0003: Stopped offlineClientSessions cache from keycloak container
keycloak | 23:42:12,054 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 63) WFLYCLINF0003: Stopped loginFailures cache from keycloak container
keycloak | 23:42:12,055 INFO [org.jboss.as.server.deployment] (MSC service thread 1-5) WFLYSRV0028: Stopped deployment keycloak-server.war (runtime-name: keycloak-server.war) in 90ms
keycloak | 23:42:12,055 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 69) WFLYCLINF0003: Stopped actionTokens cache from keycloak container
keycloak | 23:42:12,055 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 67) WFLYCLINF0003: Stopped sessions cache from keycloak container
keycloak | 23:42:12,067 INFO [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-3) ISPN000080: Disconnecting JGroups channel ejb
keycloak | 23:42:12,078 ERROR [org.jboss.as.controller.management-operation] (Controller Boot Thread) WFLYCTL0013: Operation ("add") failed - address: ([("subsystem" => "microprofile-metrics-smallrye")]): java.lang.NullPointerException
keycloak | at org.wildfly.extension.microprofile.metrics.MicroProfileMetricsSubsystemAdd$2.execute(MicroProfileMetricsSubsystemAdd.java:86)
keycloak | at org.jboss.as.controller.AbstractOperationContext.executeStep(AbstractOperationContext.java:999)
keycloak | at org.jboss.as.controller.AbstractOperationContext.processStages(AbstractOperationContext.java:743)
keycloak | at org.jboss.as.controller.AbstractOperationContext.executeOperation(AbstractOperationContext.java:467)
keycloak | at org.jboss.as.controller.OperationContextImpl.executeOperation(OperationContextImpl.java:1412)
keycloak | at org.jboss.as.controller.ModelControllerImpl.boot(ModelControllerImpl.java:521)
keycloak | at org.jboss.as.controller.AbstractControllerService.boot(AbstractControllerService.java:472)
keycloak | at org.jboss.as.controller.AbstractControllerService.boot(AbstractControllerService.java:434)
keycloak | at org.jboss.as.server.ServerService.boot(ServerService.java:435)
keycloak | at org.jboss.as.server.ServerService.boot(ServerService.java:394)
keycloak | at org.jboss.as.controller.AbstractControllerService$1.run(AbstractControllerService.java:374)
keycloak | at java.lang.Thread.run(Thread.java:748)
keycloak |
keycloak | 23:42:12,080 ERROR [org.jboss.as.controller.management-operation] (Controller Boot Thread) WFLYCTL0190: Step handler org.jboss.as.server.DeployerChainAddHandler$FinalRuntimeStepHandler at 219052d3 for operation add-deployer-chains at address [] failed handling operation rollback -- java.util.concurrent.RejectedExecutionException: java.util.concurrent.RejectedExecutionException
keycloak | at org.jboss.threads.RejectingExecutor.execute(RejectingExecutor.java:37)
keycloak | at org.jboss.threads.EnhancedQueueExecutor.rejectShutdown(EnhancedQueueExecutor.java:2026)
keycloak | at org.jboss.threads.EnhancedQueueExecutor.execute(EnhancedQueueExecutor.java:757)
keycloak | at org.jboss.as.controller.notification.NotificationSupports$NonBlockingNotificationSupport.emit(NotificationSupports.java:95)
keycloak | at org.jboss.as.controller.OperationContextImpl.notifyModificationBegun(OperationContextImpl.java:876)
keycloak | at org.jboss.as.controller.OperationContextImpl.ensureWriteLockForRuntime(OperationContextImpl.java:865)
keycloak | at org.jboss.as.controller.OperationContextImpl.removeService(OperationContextImpl.java:638)
keycloak | at org.jboss.as.server.DeployerChainAddHandler$FinalRuntimeStepHandler$1.handleRollback(DeployerChainAddHandler.java:135)
keycloak | at org.jboss.as.controller.AbstractOperationContext$RollbackDelegatingResultHandler.handleResult(AbstractOperationContext.java:1561)
keycloak | at org.jboss.as.controller.AbstractOperationContext$Step.invokeResultHandler(AbstractOperationContext.java:1533)
keycloak | at org.jboss.as.controller.AbstractOperationContext$Step.handleResult(AbstractOperationContext.java:1515)
keycloak | at org.jboss.as.controller.AbstractOperationContext$Step.finalizeInternal(AbstractOperationContext.java:1472)
keycloak | at org.jboss.as.controller.AbstractOperationContext$Step.finalizeStep(AbstractOperationContext.java:1455)
keycloak | at org.jboss.as.controller.AbstractOperationContext$Step.access$400(AbstractOperationContext.java:1319)
keycloak | at org.jboss.as.controller.AbstractOperationContext.executeResultHandlerPhase(AbstractOperationContext.java:876)
keycloak | at org.jboss.as.controller.AbstractOperationContext.processStages(AbstractOperationContext.java:756)
keycloak | at org.jboss.as.controller.AbstractOperationContext.executeOperation(AbstractOperationContext.java:467)
keycloak | at org.jboss.as.controller.OperationContextImpl.executeOperation(OperationContextImpl.java:1412)
keycloak | at org.jboss.as.controller.ModelControllerImpl.boot(ModelControllerImpl.java:521)
keycloak | at org.jboss.as.controller.AbstractControllerService.boot(AbstractControllerService.java:472)
keycloak | at org.jboss.as.controller.AbstractControllerService.boot(AbstractControllerService.java:434)
keycloak | at org.jboss.as.server.ServerService.boot(ServerService.java:435)
keycloak | at org.jboss.as.server.ServerService.boot(ServerService.java:394)
keycloak | at org.jboss.as.controller.AbstractControllerService$1.run(AbstractControllerService.java:374)
keycloak | at java.lang.Thread.run(Thread.java:748)
keycloak | Suppressed: java.util.concurrent.RejectedExecutionException: Executor is being shut down
keycloak | at org.jboss.threads.EnhancedQueueExecutor.rejectShutdown(EnhancedQueueExecutor.java:2028)
keycloak | ... 23 more
keycloak |
keycloak | 23:42:12,080 ERROR [org.jboss.as.controller.client] (Controller Boot Thread) WFLYCTL0190: Step handler org.jboss.as.server.DeployerChainAddHandler$FinalRuntimeStepHandler at 219052d3 for operation add-deployer-chains at address [] failed handling operation rollback -- java.util.concurrent.RejectedExecutionException
keycloak | keycloak exited with code 1


From sshscp at gmail.com  Tue Jul 16 19:55:57 2019
From: sshscp at gmail.com (Nick Powers)
Date: Tue, 16 Jul 2019 17:55:57 -0600
Subject: [keycloak-user] Gatekeeper container automatically adds /* uri
	resource?
Message-ID: <CAKeq-mmcf0zk3s_MfDrh8y76pQdBQf071CF1wWrtQE17xX-gfQ@mail.gmail.com>

Hello,

Below is a snip from my Gatekeeper configuration, related to resources.  I
only have /protected/* listed as a uri resource but loading the index at /
still initiates a login.  I see from the logs (see below) that both
/protected/* and /* are being protected.  How do I make it so only
/protected/* is a protected resource and the main /* of my site doesn't
require authentication?

I was able to HACK (see below) it so that /* was only authenticated for a
single method (DELETE) by defining /* as a uri resource with just DELETE
listed under methods: but I would rather have a solution that works for all
methods.  Is anyone aware of a way to tell gatekeeper not to authenticate
for /* and only do so for /protected/*?

Thanks in advance! :)   - Nick

SNIP from my gatekeeper configuration:

resources:
- uri: /protected/*

LOGS showing both /protected:

gatekeeper     | {"level":"info","ts":1563319972.1478412,"msg":"protecting
resource","resource":"uri: /protected/*, methods:
DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT,TRACE, required: authentication
only"}
gatekeeper     | {"level":"info","ts":1563319972.1482553,"msg":"protecting
resource","resource":"uri: /*, methods:
DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT,TRACE, required: authentication
only"}

My HACK config:

resources:
- uri: /protected/*
- uri: /*
  methods:
    - DELETE

From bob.skd at googlemail.com  Wed Jul 17 02:08:40 2019
From: bob.skd at googlemail.com (bob sheknowdas)
Date: Wed, 17 Jul 2019 08:08:40 +0200
Subject: [keycloak-user] Gatekeeper container automatically adds /* uri
	resource?
Message-ID: <CAJombDe89uRvifBqwShk=cWyNRrzz5hs=Zx56+kRpVhhwTa79w@mail.gmail.com>

Hi,

try using White-listed URL's

resources:
  - uri: /some_white_listed_url
    white-listed: true
  - uri: /*
    methods:
      - GET
    roles:
      - <CLIENT_APP_NAME>:<ROLE_NAME>
      - <CLIENT_APP_NAME>:<ROLE_NAME>

My Source:
https://github.com/jangaraj/keycloak-proxy/blob/master/README.md

Best
Bob

-----Original Message-----
From: keycloak-user-bounces at lists.jboss.org
<https://lists.jboss.org/mailman/listinfo/keycloak-user>
[mailto:keycloak-user-bounces at lists.jboss.org
<https://lists.jboss.org/mailman/listinfo/keycloak-user>] On Behalf Of
Nick Powersia
Sent: Tuesday, July 16, 2019 7:55 PM
To: keycloak-user at lists.jboss.org
<https://lists.jboss.org/mailman/listinfo/keycloak-user>
Subject: [keycloak-user] Gatekeeper container automatically adds /*
uri resource?

> Hello,
>
> Below is a snip from my Gatekeeper configuration, related to resources.  I
> only have /protected/* listed as a uri resource but loading the index at /
> still initiates a login.  I see from the logs (see below) that both
> /protected/* and /* are being protected.  How do I make it so only
> /protected/* is a protected resource and the main /* of my site doesn't
> require authentication?
>
> I was able to HACK (see below) it so that /* was only authenticated for a
> single method (DELETE) by defining /* as a uri resource with just DELETE
> listed under methods: but I would rather have a solution that works for all
> methods.  Is anyone aware of a way to tell gatekeeper not to authenticate
> for /* and only do so for /protected/*?
>
> Thanks in advance! :)   - Nick
>
> SNIP from my gatekeeper configuration:
>
> resources:
> - uri: /protected/*
>
> LOGS showing both /protected:
>
> gatekeeper     | {"level":"info","ts":1563319972.1478412,"msg":"protecting
> resource","resource":"uri: /protected/*, methods:
> DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT,TRACE, required: authentication
> only"}
> gatekeeper     | {"level":"info","ts":1563319972.1482553,"msg":"protecting
> resource","resource":"uri: /*, methods:
> DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT,TRACE, required: authentication
> only"}
>
> My HACK config:
>
> resources:
> - uri: /protected/*
> - uri: /*
>  methods:
>   - DELETE

From kevin.kaminski at movingimage.com  Wed Jul 17 08:00:29 2019
From: kevin.kaminski at movingimage.com (Kevin Kaminski)
Date: Wed, 17 Jul 2019 12:00:29 +0000
Subject: [keycloak-user] SAML Attributes using a general Attribute Importer
 doesn't work with specific IDP
Message-ID: <0C2FA17C-9278-4CA0-8C85-6E067B082584@movingimage.com>

Hello ?

I am writing the first time to this list so I hope I am doing everything correctly.

But here?s what I need help with:

Fits of all, we are using Keycloak version 5.0.0. in our company.
I am trying a little bit around with the ?Attribute Importer? in Keycloak, because I want to receive all SAML Attributes that get delivered via the Identity Providers SAML response,  listed in one and the same attribute. And that works actually after I configured the Mapper Type ?Attribute Importer?. I can see in Keycloak in my user account  > Attributes that all of the Attributes are imported (such as groups, name, first name, mail address) and the will be listed in one grouped attribute (not sure if there is another official name for it)

The way I configured the mapper is:

  *   Name: saml_attributes
  *   Mapper Typ: Attribute Importer
  *   Attribute Name: empty
  *   Friendly Name: empty
  *   User Attribute Name: saml_attributes


Now I configured a customer IDP (it?s called JOSSO) and I did the exact same configuration of the Attribute Importer. However, Keycloak could not import all SAML attributes.
After investigation I could see the structure of the SAML response is different between both IDPs:

The one that works (ADFS) looks like this:

<AttributeStatement>
<Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress">
<AttributeValue>kevin.kaminski at movingimage.com</AttributeValue<mailto:kevin.kaminski at movingimage.com%3c/AttributeValue>>



The one the importer doesn?t work:

<saml:Attribute FriendlyName="MA_EMAIL" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" Name="MA_EMAIL">
<saml:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"


Is it possible that ?saml:? is the reason Keycloak can?t properly import it?

Note: In general the ?Attribute Importer? works if I configure dedicated mapper for mail, name, etc. I specify these mappers with a Friendly Name.
But this ?grouped? import, doesn?t work.

I hope I could make clear what my problem is and I hope that someone is able to help.


Many thanks in advance,
Kevin

Kevin Kaminski
IT- Projektmanager

movingimage EVP GmbH
Stralauer Allee 7 | 10245 Berlin ? Germany
Tel: +49 (0)30.330 9660.330
Fax: +49 (0)30.330 9660.99
www.movingimage.com<http://www.movingimage.com/>
Berlin | Tokyo | San Francisco | New York

Limited liability company based in Berlin
District court Berlin-Charlottenburg | HRB 94436 B
Managing directors: Dr. Rainer Zugeh?r, Erdal Ahlatci
Board of directors: Daniel Wild, Felix Artmann, J?rg Binnenbr?cker, Tim Kindt,
Dr. Dirk Schm?cking, Russell Zack

[http://www.movingimage.com/wp-content/uploads/sites/2/2019/06/mi_email-banner2019-06_watch-webinar.png]<https://www.movingimage.com/lp/advancedsubtitles/>

From jdennis at redhat.com  Wed Jul 17 08:43:54 2019
From: jdennis at redhat.com (John Dennis)
Date: Wed, 17 Jul 2019 08:43:54 -0400
Subject: [keycloak-user] SAML Attributes using a general Attribute
 Importer doesn't work with specific IDP
In-Reply-To: <0C2FA17C-9278-4CA0-8C85-6E067B082584@movingimage.com>
References: <0C2FA17C-9278-4CA0-8C85-6E067B082584@movingimage.com>
Message-ID: <5929a7a7-7927-b62e-9d02-8ad4aeb48db4@redhat.com>

On 7/17/19 8:00 AM, Kevin Kaminski wrote:
> Hello ?
> 
> I am writing the first time to this list so I hope I am doing everything correctly.
> 
> But here?s what I need help with:
> 
> Fits of all, we are using Keycloak version 5.0.0. in our company.
> I am trying a little bit around with the ?Attribute Importer? in Keycloak, because I want to receive all SAML Attributes that get delivered via the Identity Providers SAML response,  listed in one and the same attribute. And that works actually after I configured the Mapper Type ?Attribute Importer?. I can see in Keycloak in my user account  > Attributes that all of the Attributes are imported (such as groups, name, first name, mail address) and the will be listed in one grouped attribute (not sure if there is another official name for it)
> 
> The way I configured the mapper is:
> 
>    *   Name: saml_attributes
>    *   Mapper Typ: Attribute Importer
>    *   Attribute Name: empty
>    *   Friendly Name: empty
>    *   User Attribute Name: saml_attributes
> 
> 
> Now I configured a customer IDP (it?s called JOSSO) and I did the exact same configuration of the Attribute Importer. However, Keycloak could not import all SAML attributes.
> After investigation I could see the structure of the SAML response is different between both IDPs:
> 
> The one that works (ADFS) looks like this:
> 
> <AttributeStatement>
> <Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress">
> <AttributeValue>kevin.kaminski at movingimage.com</AttributeValue<mailto:kevin.kaminski at movingimage.com%3c/AttributeValue>>
> 
> 
> 
> The one the importer doesn?t work:
> 
> <saml:Attribute FriendlyName="MA_EMAIL" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" Name="MA_EMAIL">
> <saml:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

Did you forget to paste the entire xml element into the email because 
this is a not a complete AttributeValue element?

> Is it possible that ?saml:? is the reason Keycloak can?t properly import it?

Only if the "saml" namespace tag was not declared earlier via 
xmlns:saml= but then you should have gotten an xml parsing error logged.

My suggestion would be to check the server log for errors and/or paste 
more complete xml from the assertion.

> 
> Note: In general the ?Attribute Importer? works if I configure dedicated mapper for mail, name, etc. I specify these mappers with a Friendly Name.
> But this ?grouped? import, doesn?t work.
> 
> I hope I could make clear what my problem is and I hope that someone is able to help.


-- 
John Dennis

From ssilvert at redhat.com  Wed Jul 17 10:05:44 2019
From: ssilvert at redhat.com (Stan Silvert)
Date: Wed, 17 Jul 2019 10:05:44 -0400
Subject: [keycloak-user] CLI scripts
In-Reply-To: <CAPj_fOv3SXan4Kd0ZYdRh7rud5Kh-d=mKvRWKqNhXUte1WG6yw@mail.gmail.com>
References: <CAPj_fOv3SXan4Kd0ZYdRh7rud5Kh-d=mKvRWKqNhXUte1WG6yw@mail.gmail.com>
Message-ID: <70ae314e-1038-45b9-2486-467fdffd17a8@redhat.com>

There is a CLI command to restart the server.? It does this without 
restarting the JVM.

/:reload(start-mode=normal)

On 7/16/2019 3:34 PM, Justin Williams wrote:
> Hello,
>
> I'm mounting a volume containing CLI scripts to my Keycloak Docker
> container "startup-scripts" directory, and the scripts execute, however
> they do not take effect if a reload is required. I'm not seeing how I can
> get the server to reload after executing all of the scripts.
> Any suggestions?
>
> Example (request-logging.cli):
>
> embed-server --server-config=standalone.xml --std-out=echo
>
> echo SETUP: Enabling detailed request logging
>
> /subsystem=undertow/configuration=filter/custom-filter=request-logging-filter:add(class-name=io.undertow.server.handlers.RequestDumpingHandler,
> module=io.undertow.core)
> /subsystem=undertow/server=default-server/host=default-host/filter-ref=request-logging-filter:add
>
> stop-embedded-server
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user



From ssilvert at redhat.com  Wed Jul 17 10:14:54 2019
From: ssilvert at redhat.com (Stan Silvert)
Date: Wed, 17 Jul 2019 10:14:54 -0400
Subject: [keycloak-user] [EXTERNAL] Re: Trust between two standalone
 Keycloak Instances
In-Reply-To: <C30F34E8-4658-47BE-9F05-CB9BCAA5B9EE@veritas.com>
References: <D55B0359-78C8-4431-B7D7-C4DE13A2D8D0@contoso.com>
	<b26f4842-29be-4f7f-5421-7a7f59825bb6@redhat.com>
	<C30F34E8-4658-47BE-9F05-CB9BCAA5B9EE@veritas.com>
Message-ID: <aade7cf1-a3a2-3a79-d190-19bc2668b04f@redhat.com>

On 7/16/2019 1:26 PM, Aditya Bhole wrote:
> I understand that deploying 3 clients under one realm will easily enable SSO. Even if we keep the clients in different realms, cross-realm trust can be established. But the use case of our prototype wants the clients to be on different servers. I?ll try to explain as best as I can.
>
> Our company has 3 products deployed independently and these are managed by different administrators. Sometimes these have to be integrated with each other for seamless cross product experience at which time we would want SSO between the individual product UIs. We intend to use Keycloak as a broker for authentication and to achieve SSO. So that?s why I wanted to know if trust between two standalone Keycloak instances can be established.
>
> Also, if we deploy the domain controller, can there still be local settings on the different Keycloak instances?
>
> Thanks,
> Aditya
Yes, it can be done, but I still don't understand why you would want to 
do it this way.? You can also establish trust between two realms on the 
same server.? That way, you don't need multiple instances of Keycloak to 
have the apps be fully walled off from each other.

That being said, I still don't understand why you wouldn't just do it 
the easy way.? Are you saying that sometimes you want SSO and sometimes 
you don't?? I must be missing something from your use case.

Lastly, the domain features of WildFly are just used to centrally manage 
instances of the server.? These servers can be configured any way you 
want.? I guess this depends on what you mean by "local settings".
>
> ?On 7/15/19, 12:25 PM, "keycloak-user-bounces at lists.jboss.org on behalf of Stan Silvert" <keycloak-user-bounces at lists.jboss.org on behalf of ssilvert at redhat.com> wrote:
>
>      Why do you need each to have its own Keycloak instance?  A usual setup
>      would define all three clients in the same realm under the same Keycloak
>      instance.
>      
>      On 7/15/2019 1:23 PM, Aditya Bhole wrote:
>      > Hello,
>      >
>      > I?m new to Keycloak and building a prototype SSO framework for my company. The use case is that my company has 3 clients; A, B and C. Now each client is going to have its own Keycloak instance; KA, KB and KC. Now what I want is when I login through client A I should be logged into client B and C as well. And same goes for all the clients. So for this to happen, is there a way of establishing trust between these three Keycloak instances KA, KB and KC?
>      > I?ve successfully established an SSO by using KA as a broker and KB as an IDP. But this is only a master slave kind-of an architecture. When I log in to A, I?m automatically logged into B. But if I log into B, I won?t be automatically logged into A. Is it possible for KA to be a broker for KB and KB to be a broker for KA at the same time?
>      > TL;DR :
>      > Is there a way where Keycloak only acts as a broker and trust is established between multiple such Keycloak instances?
>      >
>      > I hope my question makes sense. Please point me in the right direction if I?m looking at this in the wrong way.
>      >
>      > Thanks,
>      > Aditya
>      >
>      > _______________________________________________
>      > keycloak-user mailing list
>      > keycloak-user at lists.jboss.org
>      > https://lists.jboss.org/mailman/listinfo/keycloak-user
>      
>      
>      _______________________________________________
>      keycloak-user mailing list
>      keycloak-user at lists.jboss.org
>      https://lists.jboss.org/mailman/listinfo/keycloak-user
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user



From sshscp at gmail.com  Wed Jul 17 10:36:12 2019
From: sshscp at gmail.com (Nick Powers)
Date: Wed, 17 Jul 2019 08:36:12 -0600
Subject: [keycloak-user] Gatekeeper container automatically adds /* uri
	resource?
Message-ID: <CAKeq-m=pQ-aVSUM50ML4EyKJAqNbPRvqSfvH76MK09aToX1nfA@mail.gmail.com>

Bob,

Thanks for your quick response.  I tried the following but it still doesn't work

resources:
- uri: /protected/*
- uri: /*
  white-listed: true

Now I get the following error message:

[error] you've asked for a default denial but whitelisted everything

Apparently it doesn't like me marking /*  as white-listed.  I tried
reversing it and marking /protected/* as white-listed and that worked
but I am trying to do the reverse of that.  I want /* to not require
auth, so I can tell people about the site, etc, and provide a link to
the authenticated (login) area in /protected/*

Thanks - Nick

-----Original Message-----
From: keycloak-user-bounces at lists.jboss.org
<https://lists.jboss.org/mailman/listinfo/keycloak-user>
[mailto:keycloak-user-bounces at lists.jboss.org
<https://lists.jboss.org/mailman/listinfo/keycloak-user>] On Behalf Of
Bob Sheknowdas

Sent: Wednesday, Jul 17, 2019 2:08 AM
To: keycloak-user at lists.jboss.org
<https://lists.jboss.org/mailman/listinfo/keycloak-user>
Subject: [keycloak-user] Gatekeeper container automatically adds /*
uri resource?

> Hi,
>
> try using White-listed URL's
>
> resources:
>   - uri: /some_white_listed_url
>     white-listed: true
>   - uri: /*
>     methods:
>       - GET
>     roles:
>       - <CLIENT_APP_NAME>:<ROLE_NAME>
>       - <CLIENT_APP_NAME>:<ROLE_NAME>
>
> My Source:
> https://github.com/jangaraj/keycloak-proxy/blob/master/README.md
>
> Best
> Bob

-----Original Message-----
From: keycloak-user-bounces at lists.jboss.org
<https://lists.jboss.org/mailman/listinfo/keycloak-user>
[mailto:keycloak-user-bounces at lists.jboss.org
<https://lists.jboss.org/mailman/listinfo/keycloak-user>] On Behalf Of
Nick Powersia
Sent: Tuesday, July 16, 2019 7:55 PM
To: keycloak-user at lists.jboss.org
<https://lists.jboss.org/mailman/listinfo/keycloak-user>
Subject: [keycloak-user] Gatekeeper container automatically adds /*
uri resource?

>* Hello,
*>>* Below is a snip from my Gatekeeper configuration, related to resources.  I
*>* only have /protected/* listed as a uri resource but loading the index at /
*>* still initiates a login.  I see from the logs (see below) that both
*>* /protected/* and /* are being protected.  How do I make it so only
*>* /protected/* is a protected resource and the main /* of my site doesn't
*>* require authentication?
*>>* I was able to HACK (see below) it so that /* was only authenticated for a
*>* single method (DELETE) by defining /* as a uri resource with just DELETE
*>* listed under methods: but I would rather have a solution that works for all
*>* methods.  Is anyone aware of a way to tell gatekeeper not to authenticate
*>* for /* and only do so for /protected/*?
*>>* Thanks in advance! :)   - Nick
*>>* SNIP from my gatekeeper configuration:
*>>* resources:
*>* - uri: /protected/*
*>>* LOGS showing both /protected:
*>>* gatekeeper     | {"level":"info","ts":1563319972.1478412,"msg":"protecting
*>* resource","resource":"uri: /protected/*, methods:
*>* DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT,TRACE, required: authentication
*>* only"}
*>* gatekeeper     | {"level":"info","ts":1563319972.1482553,"msg":"protecting
*>* resource","resource":"uri: /*, methods:
*>* DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT,TRACE, required: authentication
*>* only"}
*>>* My HACK config:
*>>* resources:
*>* - uri: /protected/*
*>* - uri: /*
*>*  methods:
*>*   - DELETE*

From external.Benjamin.Weimer at bosch-si.com  Wed Jul 17 10:39:29 2019
From: external.Benjamin.Weimer at bosch-si.com (EXTERNAL Weimer Benjamin (TNG, INST-CSS/BSV-OS2))
Date: Wed, 17 Jul 2019 14:39:29 +0000
Subject: [keycloak-user] realm-management client role "view-realm" needed to
	view/edit a user?
Message-ID: <b9cdb7129b034640a55ab5d90678c2c6@bosch-si.com>

Hi all,

we are using fine grain permissions in Keycloak to set the rights to edit certain users and have noticed that the roles "manage-users" and "query-realm" of the "realm-management" client are not sufficient to view and edit single users. The "view-realm" role seems to be needed for that. Can you explain me why this role is needed for this action?

Best regards and thanks in advance
Benjamin Weimer


From kevin.kaminski at movingimage.com  Wed Jul 17 10:40:27 2019
From: kevin.kaminski at movingimage.com (Kevin Kaminski)
Date: Wed, 17 Jul 2019 14:40:27 +0000
Subject: [keycloak-user] SAML Attributes using a general Attribute
 Importer doesn't work with specific IDP
In-Reply-To: <5929a7a7-7927-b62e-9d02-8ad4aeb48db4@redhat.com>
References: <0C2FA17C-9278-4CA0-8C85-6E067B082584@movingimage.com>
	<5929a7a7-7927-b62e-9d02-8ad4aeb48db4@redhat.com>
Message-ID: <858FEB35-75AC-471D-BFE4-9B342B430881@movingimage.com>

Hi John,

I didn't paste everything on purpose, just wanted to show the difference in the namespace. However, as I 

Kevin Kaminski
IT- Projektmanager

movingimage EVP GmbH
Stralauer Allee 7 | 10245 Berlin ? Germany
Tel: +49 (0)30.330 9660.330
Fax: +49 (0)30.330 9660.99
www.movingimage.com

Berlin | Tokyo | San Francisco | New York

Limited liability company based in Berlin
District court Berlin-Charlottenburg | HRB 94436 B
Managing directors: Dr. Rainer Zugeh?r, Erdal Ahlatci
Board of directors: Daniel Wild, Felix Artmann, J?rg Binnenbr?cker, Tim Kindt, Dr. Dirk Schm?cking, Russell Zack

am not able to easily check the logs now, I pasted the complete XML below:

Many thanks in advance,
Kevin

-------

<?xml version="1.0" encoding="UTF-8"?>
<samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:enc="http://www.w3.org/2001/04/xmlenc#" xmlns:ns4="urn:oasis:names:tc:SAML:2.0:idbus" xmlns:ns6="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:ns7="urn:org:atricore:idbus:common:sso:1.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsd="http://www.w3.org/2001/XMLSchema" Consent="urn:oasis:names:tc:SAML:2.0:consent:obtained" Destination="https://auth-evp.movingimage.de/auth/realms/master/broker/uit/endpoint" IssueInstant="2019-07-17T11:42:32.920Z" Version="2.0" InResponseTo="ID_727b483a-4aef-4292-8cc1-d84ad6e11085" ID="idE205227EDA4460">
   <saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">https://sso-abnahme.movingimage.de/IDBUS/SSO-ABN/VP01-IDP-PROXY/SAML2/MD</saml:Issuer>
   <ds:Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
      <SignedInfo>
         <CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
         <SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" />
         <Reference URI="#idE205227EDA4460">
            <Transforms>
               <Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" />
               <Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
            </Transforms>
            <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
            <DigestValue>wlATRJxJb8aDoReCV4/c1qJVKtA=</DigestValue>
         </Reference>
      </SignedInfo>
      <SignatureValue>AWe0qApZ05BFIj4O3QHS8QznNlX34sIUexmJ8x/83ioRFtPEla6wrcEQLLAueED5XOyeSMx9BRzAthFaqFI1YLkrIDkx+sUSIALuUrgMjYHwldkGy4PaTWwmBPCwY2QdM0rKohFPh9G5V3UR+7wZ3TXRtHU6LXiyKLBjU19IhJJ37YDlCHZXLR2tMtcJklw0q/VCOIFGfzViN9cxvdiZOnWxzonN/Nw0FZMgY0nCkQZTb96RikK2ZBr2wNGu4Nw020Slgrfj8IO9gnLW8Yp3bvHQLyWimNfL2eKg9VTj8TBETf5XC99oH+k8ZHK+duFYEhfLL/24Lx8GQpbrQxyRkGUD9zFoRtaJ9EtagTlCQz4uHbTtFynyIDcD2WbNTey3mCePxcTwfluJ+J2k2JL8L89FLdLKTP6m/XZQAUPS4vixVNxM+qjntyXSxT39NV2qEdRJU3oq7ej6tecDXXmp2ETowNwS8+tBGfcwHVkpAwDiIEGWl/QrdihfManvKHNI45Brqyl/0N+HbbiCMuIbuEG+qaOmmZOoKDi/g0wVGqIW7XVUd+EVsFHXbgQXrRt10bt4w4vF6NW+DDL20PU122kwUGKI80Ttms8tlkB/5dJFC2ssKx66BGRHDc13ODWUu0vcJkdj+Z6qGkfJaTuSeqhmFVW4Jf0k7yvIIl+FV4E=</SignatureValue>
      <KeyInfo>
         <X509Data>
            <X509Certificate>MIIFrTCCA5WgAwIBAgIEUcavTzANBgkqhkiG9w0BAQsFADCBhjELMAkGA1UEBhMCREUxEDAOBgNVBAgTB1Vua25vd24xEjAQBgNVBAcTCUZyYW5rZnVydDEZMBcGA1UEChMQVW5pb24gSW52ZXN0bWVudDEMMAoGA1UECxMDVUlUMSgwJgYDVQQDEx9zc28tYWJuYWhtZS51bmlvbi1pbnZlc3RtZW50LmRlMB4XDTE5MDUxNTE1MTMyMFoXDTI5MDUyNzE1MTMyMFowgYYxCzAJBgNVBAYTAkRFMRAwDgYDVQQIEwdVbmtub3duMRIwEAYDVQQHEwlGcmFua2Z1cnQxGTAXBgNVBAoTEFVuaW9uIEludmVzdG1lbnQxDDAKBgNVBAsTA1VJVDEoMCYGA1UEAxMfc3NvLWFibmFobWUudW5pb24taW52ZXN0bWVudC5kZTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAI7DJ7C9LKbKpyV2nmt6oTSvutW6b7i7M5KQK+lIu7tdllMkX/kx7X8CgzK1fqByZvFKnuvwJo+zPyOZBFvrgcBhbZkGbt+o6V0NMhmYveQ2VBu1UEEEBIG+2E0nW1P0TBgucBbvOwtNT1r+180DZ9efXbN0FIywJQzgrrvHAUXVYAO60jcC6WtyiFgyIKDztSawgS4K9tAWNgCJ+wjiGc3tnLsEvnHHDg4fNnFrRf2KGQevWyxJ1NZLnMbe5f0UnBCtv/d1siruje9zsXsBfO9RTdlYPXkrKB6woYSiZelKtHojMdOSv8EVDd+8YmXUulZO/dpfnndZ/gJyhX49TDQl8URVEcuNd8FmGRAL+t+cXx3qWIDz7AnkE+ZR8Ujy/084M23BdTPffb9nsn8FaH14UnHoywshSsg+EUyFfRD+XICQ5eu48WG4YDNpqFtCU60OFDQm5nx6cyxk74bhcYauQIMghBwMH1yiZa2zBEsFVPhY0lU6X/0kCw3aYQ5pSY+tEZE2VLE5+7YLkpgvuVx+wYQemoRPM6xFRPgB95ZdZfLzM76GFf2xtvt9Obc1Cct2/r/xpY01ZcfVC10CNFMlkJgCfhlVzzGpgiQJ7vt6ft6tUBlM54wNAvd640J7NSSowrO5aSKBnTPSFA1YkBAWA0yv1Z3gisb1KIG0zmiNAgMBAAGjITAfMB0GA1UdDgQWBBSgVT75p1EqrRQWA/fabZS0SATz0jANBgkqhkiG9w0BAQsFAAOCAgEAf/McvAhgdgtgPEL//OdB0sGUdXfIaxxjPrU0mGBUomiUib0icXJbwbwUiI5SbYtbwddYGqG5jovmJP49kZ90r334C53EOM74jg3KVKtrzBRe39pPHxMIHyWJfLyZWOO22Q9XLpIBtEb7D7D7s7q0kxaxcgXhBT5K9CEVjML3d0Y34kc910o3/9JHc48qWrMJaLsTWoap42pz67dDjU+9ghAcUMmaPGVIk1VqBxW9H04dLzTuLFtQb8MSv0LDxm23KM+CTGnDzygQ8Y02cl2Up58d6ZomPIbUCtxkz0+1dvANN5iDl2k5fCpsAyrNbdxdRoDL27kyo8iokoMOtymQAm2LQiAw5em9Bu8UfxiZ7JnvZH2QDjsRuMPB8nj1/CZsteGXm41ECFVdfLUDSNNHtosoFLVkII7MAvTebbFOUIBv16Rw06KxsrBGnLSH/2rKJx/AK/00aD/BOjt0o0SbrlugykmHXJvKDLt+Ywa18Ea3ixP8A8uM5LDCC0plkd659Nvv/eEhr3KbZUjZ5xIKbIhXiiUEHr6s+TSKSSmmnUp24eoltawmyebUMSasCDsBER/VArIFfnhC2ulUXqrtFmi4qw1qQTSLnyd7UkWNgFPUd4lW/ZI3v2sUQ68AgBjKObtdSX3I4HegHznbEkZk4htq/HIVPNjeIgY9+jfS3Do=</X509Certificate>
         </X509Data>
      </KeyInfo>
   </ds:Signature>
   <samlp:Status>
      <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" />
   </samlp:Status>
   <saml:Assertion IssueInstant="2019-07-17T11:42:32.398Z" ID="id0585E4B155E46D" Version="2.0">
      <saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">https://sso-abnahme.movingimage.de/IDBUS/SSO-ABN/VP01-IDP-PROXY/SAML2/MD</saml:Issuer>
      <ds:Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
         <SignedInfo>
            <CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
            <SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" />
            <Reference URI="#id0585E4B155E46D">
               <Transforms>
                  <Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" />
                  <Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
               </Transforms>
               <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
               <DigestValue>ZTBe1/VGMBBtRFNnbzKoihwsiPo=</DigestValue>
            </Reference>
         </SignedInfo>
         <SignatureValue>f/fkkv1I/244MV/FUDyajpn4u+GNztlACS6pM1uYvtfRDNTGRYf2VOzQOQ5T7Dso1LlX91iwGzZHxow1RsEj5dxVCJc2g9So16kguJD4VcjtNpZQzE2axdUe7THMPYsrPEfh50xCBccRsGmK6ymVUh14TgKL7+0wcIsd4TqO3BP0REhZuhW0ylTM9/Olj8Si2l2hiyIBcdsqVIaUu3cVhqIVCiVehYfeFJltG+rZ+ZawL7Z+CK9ei6QYyy76UTEoOGTnpaIivQulDtRHV9XeeccKpBW+CSjWLeC9m7k9UTNggpBbN1EE3eaRk0iUqUbDZG03gxl2JrRjKwIkf1piOtD0vzLRirjXEEVR/N69NoJbMrdFkcV5HIbuiPURpZFRZaaa3nmy1uxd9v965/afE4uy/L+sPguIVIa15O/R8H2z74jnPGgIcuxedbSx7G+Q5263UL4lzqzVaSz471Gg3dtdgKOQRktevACelJDqkPT/QCBOmVAnAn98zHX+CklATrI6BDOhL75hSi2DMuaSLUN4q4ejUM595n8oOt2/rPrNvIi5CJjrTnGpjDQN8x51eYBe2hRUR5h6nt5i/iu3aLTuUUhfh1K+gxlVg8ZFJCbOmlbidBip2IremAioOiwiXsO/C5jqEsguUS8BecqGmHZFIgjkblyiRbnvRjYXIBQ=</SignatureValue>
         <KeyInfo>
            <X509Data>
               <X509Certificate>MIIFrTCCA5WgAwIBAgIEUcavTzANBgkqhkiG9w0BAQsFADCBhjELMAkGA1UEBhMCREUxEDAOBgNVBAgTB1Vua25vd24xEjAQBgNVBAcTCUZyYW5rZnVydDEZMBcGA1UEChMQVW5pb24gSW52ZXN0bWVudDEMMAoGA1UECxMDVUlUMSgwJgYDVQQDEx9zc28tYWJuYWhtZS51bmlvbi1pbnZlc3RtZW50LmRlMB4XDTE5MDUxNTE1MTMyMFoXDTI5MDUyNzE1MTMyMFowgYYxCzAJBgNVBAYTAkRFMRAwDgYDVQQIEwdVbmtub3duMRIwEAYDVQQHEwlGcmFua2Z1cnQxGTAXBgNVBAoTEFVuaW9uIEludmVzdG1lbnQxDDAKBgNVBAsTA1VJVDEoMCYGA1UEAxMfc3NvLWFibmFobWUudW5pb24taW52ZXN0bWVudC5kZTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAI7DJ7C9LKbKpyV2nmt6oTSvutW6b7i7M5KQK+lIu7tdllMkX/kx7X8CgzK1fqByZvFKnuvwJo+zPyOZBFvrgcBhbZkGbt+o6V0NMhmYveQ2VBu1UEEEBIG+2E0nW1P0TBgucBbvOwtNT1r+180DZ9efXbN0FIywJQzgrrvHAUXVYAO60jcC6WtyiFgyIKDztSawgS4K9tAWNgCJ+wjiGc3tnLsEvnHHDg4fNnFrRf2KGQevWyxJ1NZLnMbe5f0UnBCtv/d1siruje9zsXsBfO9RTdlYPXkrKB6woYSiZelKtHojMdOSv8EVDd+8YmXUulZO/dpfnndZ/gJyhX49TDQl8URVEcuNd8FmGRAL+t+cXx3qWIDz7AnkE+ZR8Ujy/084M23BdTPffb9nsn8FaH14UnHoywshSsg+EUyFfRD+XICQ5eu48WG4YDNpqFtCU60OFDQm5nx6cyxk74bhcYauQIMghBwMH1yiZa2zBEsFVPhY0lU6X/0kCw3aYQ5pSY+tEZE2VLE5+7YLkpgvuVx+wYQemoRPM6xFRPgB95ZdZfLzM76GFf2xtvt9Obc1Cct2/r/xpY01ZcfVC10CNFMlkJgCfhlVzzGpgiQJ7vt6ft6tUBlM54wNAvd640J7NSSowrO5aSKBnTPSFA1YkBAWA0yv1Z3gisb1KIG0zmiNAgMBAAGjITAfMB0GA1UdDgQWBBSgVT75p1EqrRQWA/fabZS0SATz0jANBgkqhkiG9w0BAQsFAAOCAgEAf/McvAhgdgtgPEL//OdB0sGUdXfIaxxjPrU0mGBUomiUib0icXJbwbwUiI5SbYtbwddYGqG5jovmJP49kZ90r334C53EOM74jg3KVKtrzBRe39pPHxMIHyWJfLyZWOO22Q9XLpIBtEb7D7D7s7q0kxaxcgXhBT5K9CEVjML3d0Y34kc910o3/9JHc48qWrMJaLsTWoap42pz67dDjU+9ghAcUMmaPGVIk1VqBxW9H04dLzTuLFtQb8MSv0LDxm23KM+CTGnDzygQ8Y02cl2Up58d6ZomPIbUCtxkz0+1dvANN5iDl2k5fCpsAyrNbdxdRoDL27kyo8iokoMOtymQAm2LQiAw5em9Bu8UfxiZ7JnvZH2QDjsRuMPB8nj1/CZsteGXm41ECFVdfLUDSNNHtosoFLVkII7MAvTebbFOUIBv16Rw06KxsrBGnLSH/2rKJx/AK/00aD/BOjt0o0SbrlugykmHXJvKDLt+Ywa18Ea3ixP8A8uM5LDCC0plkd659Nvv/eEhr3KbZUjZ5xIKbIhXiiUEHr6s+TSKSSmmnUp24eoltawmyebUMSasCDsBER/VArIFfnhC2ulUXqrtFmi4qw1qQTSLnyd7UkWNgFPUd4lW/ZI3v2sUQ68AgBjKObtdSX3I4HegHznbEkZk4htq/HIVPNjeIgY9+jfS3Do=</X509Certificate>
            </X509Data>
         </KeyInfo>
      </ds:Signature>
      <saml:Subject>
         <saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">44444-kki</saml:NameID>
         <saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
            <saml:SubjectConfirmationData InResponseTo="ID_727b483a-4aef-4292-8cc1-d84ad6e11085" Recipient="https://auth-evp.movingimage.de/auth/realms/master/broker/uit/endpoint" NotOnOrAfter="2019-07-17T11:47:32.398Z" />
         </saml:SubjectConfirmation>
      </saml:Subject>
      <saml:Conditions NotOnOrAfter="2019-07-17T11:47:32.398Z" NotBefore="2019-07-17T11:37:32.398Z">
         <saml:AudienceRestriction>
            <saml:Audience>https://auth-evp.movingimage.de/auth/realms/master</saml:Audience>
         </saml:AudienceRestriction>
      </saml:Conditions>
      <saml:AuthnStatement SessionNotOnOrAfter="2019-07-17T17:42:32.398Z" SessionIndex="id-253c748e-f363-43ae-84c8-e68a3aef9436" AuthnInstant="2019-07-17T11:42:32.398Z">
         <saml:AuthnContext>
            <saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:Password</saml:AuthnContextClassRef>
         </saml:AuthnContext>
      </saml:AuthnStatement>
      <saml:AttributeStatement>
         <saml:Attribute FriendlyName="OI_LOGIN_FAILED" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" Name="OI_LOGIN_FAILED">
            <saml:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xsd:string">0</saml:AttributeValue>
         </saml:Attribute>
         <saml:Attribute FriendlyName="MA_UUKEY" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" Name="MA_UUKEY">
            <saml:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xsd:string">7F7C1A25638B519AE05402082055A8B5</saml:AttributeValue>
         </saml:Attribute>
         <saml:Attribute FriendlyName="OI_PASSWORT_STATUS" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" Name="OI_PASSWORT_STATUS">
            <saml:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:nil="true" />
         </saml:Attribute>
         <saml:Attribute FriendlyName="BA_BLZ" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" Name="BA_BLZ">
            <saml:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xsd:string">22222222</saml:AttributeValue>
         </saml:Attribute>
         <saml:Attribute FriendlyName="org:atricore:idbus:sso:sp:idpName_proxied" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" Name="org:atricore:idbus:sso:sp:idpName_proxied">
            <saml:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xsd:string">uitidp01</saml:AttributeValue>
         </saml:Attribute>
         <saml:Attribute FriendlyName="groups" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" Name="groups">
            <saml:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xsd:string">Mitarbeiter</saml:AttributeValue>
         </saml:Attribute>
         <saml:Attribute FriendlyName="org:atricore:idbus:sso:sp:authnCtxClass_proxied" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" Name="org:atricore:idbus:sso:sp:authnCtxClass_proxied">
            <saml:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xsd:string">urn:oasis:names:tc:SAML:2.0:ac:classes:Password</saml:AttributeValue>
         </saml:Attribute>
         <saml:Attribute FriendlyName="org:atricore:idbus:sso:sp:idpAlias_proxied" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" Name="org:atricore:idbus:sso:sp:idpAlias_proxied">
            <saml:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xsd:string">https://sso-abnahme.movingimage.com.de/IDBUS/SSO-ABN/UITIDP01/SAML2/MD</saml:AttributeValue>
         </saml:Attribute>
         <saml:Attribute FriendlyName="MA_EMAIL" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" Name="MA_EMAIL">
            <saml:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xsd:string">kevin.kaminski at movingimage.com</saml:AttributeValue>
         </saml:Attribute>
         <saml:Attribute FriendlyName="OI_ONLINEMITARBEITERID" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" Name="OI_ONLINEMITARBEITERID">
            <saml:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xsd:string">44444-kki</saml:AttributeValue>
         </saml:Attribute>
         <saml:Attribute FriendlyName="groups" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" Name="groups">
            <saml:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xsd:string">iwpilot</saml:AttributeValue>
            <saml:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xsd:string">Basiszugriff UnionOnline</saml:AttributeValue>
            <saml:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xsd:string">Mitarbeiter</saml:AttributeValue>
         </saml:Attribute>
         <saml:Attribute FriendlyName="MA_GENOUSERID" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" Name="MA_GENOUSERID">
            <saml:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:nil="true" />
         </saml:Attribute>
         <saml:Attribute FriendlyName="MA_NAME" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" Name="MA_NAME">
            <saml:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xsd:string">Kaminski</saml:AttributeValue>
         </saml:Attribute>
         <saml:Attribute FriendlyName="MA_VORNAME" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" Name="MA_VORNAME">
            <saml:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xsd:string">Kevin</saml:AttributeValue>
         </saml:Attribute>
      </saml:AttributeStatement>
   </saml:Assertion>
</samlp:Response>



?Am 17.07.19, 14:44 schrieb "John Dennis" <jdennis at redhat.com>:

    On 7/17/19 8:00 AM, Kevin Kaminski wrote:
    > Hello ?
    > 
    > I am writing the first time to this list so I hope I am doing everything correctly.
    > 
    > But here?s what I need help with:
    > 
    > Fits of all, we are using Keycloak version 5.0.0. in our company.
    > I am trying a little bit around with the ?Attribute Importer? in Keycloak, because I want to receive all SAML Attributes that get delivered via the Identity Providers SAML response,  listed in one and the same attribute. And that works actually after I configured the Mapper Type ?Attribute Importer?. I can see in Keycloak in my user account  > Attributes that all of the Attributes are imported (such as groups, name, first name, mail address) and the will be listed in one grouped attribute (not sure if there is another official name for it)
    > 
    > The way I configured the mapper is:
    > 
    >    *   Name: saml_attributes
    >    *   Mapper Typ: Attribute Importer
    >    *   Attribute Name: empty
    >    *   Friendly Name: empty
    >    *   User Attribute Name: saml_attributes
    > 
    > 
    > Now I configured a customer IDP (it?s called JOSSO) and I did the exact same configuration of the Attribute Importer. However, Keycloak could not import all SAML attributes.
    > After investigation I could see the structure of the SAML response is different between both IDPs:
    > 
    > The one that works (ADFS) looks like this:
    > 
    > <AttributeStatement>
    > <Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress">
    > <AttributeValue>kevin.kaminski at movingimage.com</AttributeValue<mailto:kevin.kaminski at movingimage.com%3c/AttributeValue>>
    > 
    > 
    > 
    > The one the importer doesn?t work:
    > 
    > <saml:Attribute FriendlyName="MA_EMAIL" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" Name="MA_EMAIL">
    > <saml:AttributeValue xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    
    Did you forget to paste the entire xml element into the email because 
    this is a not a complete AttributeValue element?
    
    > Is it possible that ?saml:? is the reason Keycloak can?t properly import it?
    
    Only if the "saml" namespace tag was not declared earlier via 
    xmlns:saml= but then you should have gotten an xml parsing error logged.
    
    My suggestion would be to check the server log for errors and/or paste 
    more complete xml from the assertion.
    
    > 
    > Note: In general the ?Attribute Importer? works if I configure dedicated mapper for mail, name, etc. I specify these mappers with a Friendly Name.
    > But this ?grouped? import, doesn?t work.
    > 
    > I hope I could make clear what my problem is and I hope that someone is able to help.
    
    
    -- 
    John Dennis
    



From jdennis at redhat.com  Wed Jul 17 11:00:40 2019
From: jdennis at redhat.com (John Dennis)
Date: Wed, 17 Jul 2019 11:00:40 -0400
Subject: [keycloak-user] SAML Attributes using a general Attribute
 Importer doesn't work with specific IDP
In-Reply-To: <858FEB35-75AC-471D-BFE4-9B342B430881@movingimage.com>
References: <0C2FA17C-9278-4CA0-8C85-6E067B082584@movingimage.com>
	<5929a7a7-7927-b62e-9d02-8ad4aeb48db4@redhat.com>
	<858FEB35-75AC-471D-BFE4-9B342B430881@movingimage.com>
Message-ID: <de3dd625-2c94-5da1-5b9e-ae41c1f25bde@redhat.com>

On 7/17/19 10:40 AM, Kevin Kaminski wrote:
> Hi John,
> 
> I didn't paste everything on purpose, just wanted to show the difference in the namespace. However, as I

I don't see any problems with the XML. The difference in namespace name 
between any two XML documents is irrelevant as long as namespace is 
properly defined in the XML document, in this case you can see the 
"saml" namespace is defined in the top Response element:

xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"

The only difference I see between the two examples you cited is in the 
failing case the <Attribute> element includes a NameFormat attribute and 
the <AttributeValue> elment contains a type attribute. Both are legal. 
Perhaps keycloak doesn't know to deal with these attributes, but if so I 
would expect an error to be logged in the server log. Did you check the 
log? That's as much help as I can offer, perhaps someone with a better 
knowledge of how the Assertion is parsed internally by Keycloak can shed 
more light.


-- 
John Dennis

From huwmcnamara at msn.com  Wed Jul 17 11:32:26 2019
From: huwmcnamara at msn.com (Huw McNamara)
Date: Wed, 17 Jul 2019 15:32:26 +0000
Subject: [keycloak-user] realm-management client role "view-realm"
 needed to	view/edit a user?
In-Reply-To: <b9cdb7129b034640a55ab5d90678c2c6@bosch-si.com>
References: <b9cdb7129b034640a55ab5d90678c2c6@bosch-si.com>
Message-ID: <VI1P192MB0239576ED1745C3E9248B716B1C90@VI1P192MB0239.EURP192.PROD.OUTLOOK.COM>

Hi Benjamin,

There's an open bug for view-realm being needed to access the credentials tab for clients https://issues.jboss.org/browse/KEYCLOAK-10782.
Maybe they are related and you could add the info to the JIRA ticket? Although fine grain permissions are tech preview.

Thanks,
Huw

________________________________
From: keycloak-user-bounces at lists.jboss.org <keycloak-user-bounces at lists.jboss.org> on behalf of EXTERNAL Weimer Benjamin (TNG, INST-CSS/BSV-OS2) <external.Benjamin.Weimer at bosch-si.com>
Sent: 17 July 2019 15:39
To: keycloak-user at lists.jboss.org
Subject: [keycloak-user] realm-management client role "view-realm" needed to view/edit a user?

Hi all,

we are using fine grain permissions in Keycloak to set the rights to edit certain users and have noticed that the roles "manage-users" and "query-realm" of the "realm-management" client are not sufficient to view and edit single users. The "view-realm" role seems to be needed for that. Can you explain me why this role is needed for this action?

Best regards and thanks in advance
Benjamin Weimer

_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user

From external.Benjamin.Weimer at bosch-si.com  Wed Jul 17 11:43:10 2019
From: external.Benjamin.Weimer at bosch-si.com (EXTERNAL Weimer Benjamin (TNG, INST-CSS/BSV-OS2))
Date: Wed, 17 Jul 2019 15:43:10 +0000
Subject: [keycloak-user] realm-management client role "view-realm"
 needed to	view/edit a user?
In-Reply-To: <VI1P192MB0239576ED1745C3E9248B716B1C90@VI1P192MB0239.EURP192.PROD.OUTLOOK.COM>
References: <b9cdb7129b034640a55ab5d90678c2c6@bosch-si.com>
	<VI1P192MB0239576ED1745C3E9248B716B1C90@VI1P192MB0239.EURP192.PROD.OUTLOOK.COM>
Message-ID: <016be823832845ebb230b6e6598008f6@bosch-si.com>

Hi Huw,

Thanks for your reply! I added the info to the JIRA ticket.

Best regards
Benjamin

Von: Huw McNamara <huwmcnamara at msn.com>
Gesendet: Mittwoch, 17. Juli 2019 17:32
An: EXTERNAL Weimer Benjamin (TNG, INST-CSS/BSV-OS2) <external.Benjamin.Weimer at bosch-si.com>; keycloak-user at lists.jboss.org
Betreff: Re: [keycloak-user] realm-management client role "view-realm" needed to view/edit a user?

Hi Benjamin,

There's an open bug for view-realm being needed to access the credentials tab for clients https://issues.jboss.org/browse/KEYCLOAK-10782.
Maybe they are related and you could add the info to the JIRA ticket? Although fine grain permissions are tech preview.

Thanks,
Huw

________________________________
From: keycloak-user-bounces at lists.jboss.org<mailto:keycloak-user-bounces at lists.jboss.org> <keycloak-user-bounces at lists.jboss.org<mailto:keycloak-user-bounces at lists.jboss.org>> on behalf of EXTERNAL Weimer Benjamin (TNG, INST-CSS/BSV-OS2) <external.Benjamin.Weimer at bosch-si.com<mailto:external.Benjamin.Weimer at bosch-si.com>>
Sent: 17 July 2019 15:39
To: keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>
Subject: [keycloak-user] realm-management client role "view-realm" needed to view/edit a user?

Hi all,

we are using fine grain permissions in Keycloak to set the rights to edit certain users and have noticed that the roles "manage-users" and "query-realm" of the "realm-management" client are not sufficient to view and edit single users. The "view-realm" role seems to be needed for that. Can you explain me why this role is needed for this action?

Best regards and thanks in advance
Benjamin Weimer

_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user

From sshscp at gmail.com  Wed Jul 17 11:51:52 2019
From: sshscp at gmail.com (Nick Powers)
Date: Wed, 17 Jul 2019 09:51:52 -0600
Subject: [keycloak-user]  Can only seem to use docker image 3.4.0.final
Message-ID: <CAKeq-m=gTfOPtn=awUuh3v1UEK91YQo9uGi1xX2piciGZ=a2AA@mail.gmail.com>

Sinykk,

I think the main thing to focus on from your logs is this line:

"keycloak | Caused by: java.lang.RuntimeException: Failed to connect to
database"

It looks like you are trying to setup Keycloak to use an external DB.  I
have not attempted that configuration.  I built out a Postgres container in
my docker-compose.yml.
Below are the 2 files needed for that type of deployment,
docker-compose.yml and .env, the docker-compose.yml includes a Nginx proxy
container with a LetsEncrypt sidecar
container and the Postgres DB container.  This way, all I have to do is run
docker-compose up -d to run all 3.  The only thing that requires editing to
get this to work is
the .env file (which contains all the configuration items).  The only
things you should need to change in the .env file
is DB_PASSWORD (since this will setup a new DB you can use whatever PW you
want), KEYCLOAK_HOSTNAME (change to whatever domain is being protected by
Keycloak),
KEYCLOAK_HOSTNAME and LETSENCRYPT_HOST should both be set to the same value
you set KEYCLOAK_HOSTNAME to.  LETSENCRYPT_EMAIL should be set to an
email address.  I don't think letsencrypt checks the email just has to have
an email there.  I generally use certs at yourdomain.com where yourdomain is
the same as KEYCLOAK_HOSTNAME.

This configuration will setup a Nginx proxy container with a LetsEncrypt
sidecar that automatically retrieves HTTPS certificates from LetsEncrypt
and proxies HTTPS to the Keycloak container.
The Keycloak container will use the Postgress DB container for all of it's
DB needs.

Below is my configuration, it may not be exactly what you want but
hopefully will get you closer to your goal.  Thanks - Nick

docker-compose.yml FILE (below):

version: '3'

services:

  keycloak:
    container_name: keycloak
    image: jboss/keycloak
    container_name: keycloak
    restart: always
    ports:
      - 0.0.0.0:8080:8080
    environment:
      DB_DATABASE: ${DB_DATABASE}
      DB_USER: ${DB_USER}
      DB_PASSWORD: ${DB_PASSWORD}
      JDBC_PARAMS: ${JDBC_PARAMS}
      KEYCLOAK_HOSTNAME: ${KEYCLOAK_HOSTNAME}
      KEYCLOAK_HTTP_PORT: ${KEYCLOAK_HTTP_PORT}
      KEYCLOAK_USER: ${KEYCLOAK_USER}
      KEYCLOAK_PASSWORD: ${KEYCLOAK_PASSWORD}
      VIRTUAL_HOST: ${VIRTUAL_HOST}
      VIRTUAL_PORT: ${VIRTUAL_PORT}
      PROXY_ADDRESS_FORWARDING: ${PROXY_ADDRESS_FORWARDING}
      LETSENCRYPT_HOST: ${LETSENCRYPT_HOST}
      LETSENCRYPT_EMAIL: ${LETSENCRYPT_EMAIL}
    depends_on:
      - postgres

  postgres:
    container_name: postgres
    image: postgres
    restart: always
    environment:
      POSTGRES_DB: ${DB_DATABASE}
      POSTGRES_USER: ${DB_USER}
      POSTGRES_PASSWORD: ${DB_PASSWORD}
    volumes:
      - data:/var/lib/postgresql/data

  nginx-proxy:
    image: jwilder/nginx-proxy:alpine
    container_name: nginx-proxy
    restart: always
    labels:
      com.github.jrcs.letsencrypt_nginx_proxy_companion.nginx_proxy: 'true'
    ports:
      - 80:80
      - 443:443
    volumes:
      - ./nginx/data/certs:/etc/nginx/certs:ro
      - ./nginx/data/conf.d:/etc/nginx/conf.d
      - ./nginx/data/vhost.d:/etc/nginx/vhost.d
      - ./nginx/data/html:/usr/share/nginx/html
      - /var/run/docker.sock:/tmp/docker.sock:ro

  letsencrypt:
    image: jrcs/letsencrypt-nginx-proxy-companion
    container_name: letsencrypt
    restart: always
    volumes:
      - ./nginx/data/vhost.d:/etc/nginx/vhost.d
      - ./nginx/data/certs:/etc/nginx/certs:rw
      - ./nginx/data/html:/usr/share/nginx/html
      - /var/run/docker.sock:/var/run/docker.sock:ro
    depends_on:
      - nginx-proxy

volumes:
  data:

DB_DATABASE=keycloak_db
DB_USER=keycloak_db_user
DB_PASSWORD="dF3d<Kv4(n'o%}C>"
KEYCLOAK_HOSTNAME=auth.clearauth.com
KEYCLOAK_HTTP_PORT=8080
KEYCLOAK_USER=admin
KEYCLOAK_PASSWORD="*t3{$TnN&,Jfg at z"
JDBC_PARAMS="ssl=false"
PROXY_ADDRESS_FORWARDING=true
VIRTUAL_HOST=auth.clearauth.com
VIRTUAL_PORT=8080
LETSENCRYPT_HOST=auth.clearauth.com
LETSENCRYPT_EMAIL=certs at clearauth.com

.env FILE (below):

DB_DATABASE=keycloak_db
DB_USER=keycloak_db_user
DB_PASSWORD="tops3cr3t"
KEYCLOAK_HOSTNAME=yourdomain.com
KEYCLOAK_HTTP_PORT=8080
KEYCLOAK_USER=admin
KEYCLOAK_PASSWORD="*tops3cr3t"
JDBC_PARAMS="ssl=false"
PROXY_ADDRESS_FORWARDING=true
VIRTUAL_HOST=auth.clearauth.com
VIRTUAL_PORT=8080
LETSENCRYPT_HOST=yourdomain.com
LETSENCRYPT_EMAIL=certs at yourdomain.com

-----Original Message-----
From: keycloak-user-bounces at lists.jboss.org
<https://lists.jboss.org/mailman/listinfo/keycloak-user>
[mailto:keycloak-user-bounces at lists.jboss.org
<https://lists.jboss.org/mailman/listinfo/keycloak-user>] On Behalf Of
Sinykk Skizm

Sent: Wednesday, Jul 16, 2019 7:53 PM
To: keycloak-user at lists.jboss.org
<https://lists.jboss.org/mailman/listinfo/keycloak-user>
Subject: [keycloak-user] Can only seem to use docker image 3.4.0.final

> /I'm trying to run keycloak in docker and for whatever reason, it just won't. Except if I use the 3.4.0.Final tag, then keycloak spins up without any issues.
>
> This is my docker compose for jboss/keycloak
> # KeyCloak - Open Source Identity and Access Management
> keycloak:
> image: jboss/keycloak
> container_name: keycloak
> restart: always
> hostname: keycloak
> ports:
> - "8282:8080"
> environment:
> - DB_VENDOR=POSTGRES
> - DB_ADDR=postgresdb
> - DB_DATABASE=keycloak
> - DB_PORT=54320
> - DB_USER=myuser
> - DB_SCHEMA=public
> - DB_PASSWORD=##mypassword$$
> - PROXY_ADDRESS_FORWARDING=true
> - KEYCLOAK_LOGLEVEL=INFO
> - KEYCLOAK_USER=admin
> - KEYCLOAK_PASSWORD=##mypassword##
> depends_on:
> - postgresdb
> command:
> - "-b 0.0.0.0"
> - "-Dkeycloak.profile.feature.docker=enabled"
> This is is what's produced in the docker-compose logs.
>
> keycloak | =========================================================================
> keycloak |
> keycloak | JBoss Bootstrap Environment
> keycloak |
> keycloak | JBOSS_HOME: /opt/jboss/keycloak
> keycloak |
> keycloak | JAVA: /usr/lib/jvm/java/bin/java
> keycloak |
> keycloak | JAVA_OPTS: -server -Xms64m -Xmx512m -XX:MetaspaceSize=96M -XX:MaxMetaspaceSize=256m -Djava.net.preferIPv4Stack=true -Djboss.modules.system.pkgs=org.jboss.byteman -Djava.awt.headless=true
> keycloak |
> keycloak | =========================================================================
> keycloak |
> keycloak | 23:42:03,387 INFO [org.jboss.modules] (main) JBoss Modules version 1.9.0.Final
> keycloak | 23:42:03,769 INFO [org.jboss.msc] (main) JBoss MSC version 1.4.5.Final
> keycloak | 23:42:03,782 INFO [org.jboss.threads] (main) JBoss Threads version 2.3.3.Final
> keycloak | 23:42:03,918 INFO [org.jboss.as] (MSC service thread 1-1) WFLYSRV0049: Keycloak 6.0.1 (WildFly Core 8.0.0.Final) starting
> keycloak | 23:42:03,988 INFO [org.jboss.vfs] (MSC service thread 1-7) VFS000002: Failed to clean existing content for temp file provider of type temp. Enable DEBUG level log to find what caused this
> keycloak | 23:42:04,586 INFO [org.wildfly.security] (ServerService Thread Pool -- 19) ELY00001: WildFly Elytron version 1.8.0.Final
> keycloak | 23:42:05,261 INFO [org.jboss.as.controller.management-deprecated] (Controller Boot Thread) WFLYCTL0028: Attribute 'security-realm' in the resource at address '/core-service=management/management-interface=http-interface' is deprecated, and may be removed in a future version. See the attribute description in the output of the read-resource-description operation to learn more about the deprecation.
> keycloak | 23:42:05,293 INFO [org.jboss.as.controller.management-deprecated] (ServerService Thread Pool -- 29) WFLYCTL0028: Attribute 'security-realm' in the resource at address '/subsystem=undertow/server=default-server/https-listener=https' is deprecated, and may be removed in a future version. See the attribute description in the output of the read-resource-description operation to learn more about the deprecation.
> keycloak | 23:42:05,435 INFO [org.jboss.as.server] (Controller Boot Thread) WFLYSRV0039: Creating http management service using socket-binding (management-http)
> keycloak | 23:42:05,450 INFO [org.xnio] (MSC service thread 1-4) XNIO version 3.6.5.Final
> keycloak | 23:42:05,456 INFO [org.xnio.nio] (MSC service thread 1-4) XNIO NIO Implementation Version 3.6.5.Final
> keycloak | 23:42:05,498 INFO [org.wildfly.extension.io] (ServerService Thread Pool -- 39) WFLYIO001: Worker 'default' has auto-configured to 16 core threads with 128 task threads based on your 8 available processors
> keycloak | 23:42:05,501 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 38) WFLYCLINF0001: Activating Infinispan subsystem.
> keycloak | 23:42:05,507 INFO [org.jboss.as.clustering.jgroups] (ServerService Thread Pool -- 42) WFLYCLJG0001: Activating JGroups subsystem. JGroups version 4.0.18
> keycloak | 23:42:05,501 INFO [org.jboss.as.connector.subsystems.datasources] (ServerService Thread Pool -- 33) WFLYJCA0004: Deploying JDBC-compliant driver class org.h2.Driver (version 1.4)
> keycloak | 23:42:05,512 INFO [org.jboss.as.connector] (MSC service thread 1-3) WFLYJCA0009: Starting JCA Subsystem (WildFly/IronJacamar 1.4.12.Final)
> keycloak | 23:42:05,518 INFO [org.jboss.as.connector.deployers.jdbc] (MSC service thread 1-1) WFLYJCA0018: Started Driver service with driver-name = h2
> keycloak | 23:42:05,519 INFO [org.jboss.as.jaxrs] (ServerService Thread Pool -- 40) WFLYRS0016: RESTEasy version 3.6.3.Final
> keycloak | 23:42:05,536 INFO [org.jboss.as.connector.subsystems.datasources] (ServerService Thread Pool -- 33) WFLYJCA0005: Deploying non-JDBC-compliant driver class org.postgresql.Driver (version 42.2)
> keycloak | 23:42:05,550 INFO [org.jboss.as.connector.deployers.jdbc] (MSC service thread 1-6) WFLYJCA0018: Started Driver service with driver-name = postgresql
> keycloak | 23:42:05,565 INFO [org.jboss.remoting] (MSC service thread 1-4) JBoss Remoting version 5.0.8.Final
> keycloak | 23:42:05,588 INFO [org.wildfly.extension.microprofile.config.smallrye._private] (ServerService Thread Pool -- 47) WFLYCONF0001: Activating WildFly MicroProfile Config Subsystem
> keycloak | 23:42:05,607 WARN [org.jboss.as.txn] (ServerService Thread Pool -- 56) WFLYTX0013: The node-identifier attribute on the /subsystem=transactions is set to the default value. This is a danger for environments running multiple servers. Please make sure the attribute value is unique.
> keycloak | 23:42:05,615 INFO [org.wildfly.extension.microprofile.metrics.smallrye] (ServerService Thread Pool -- 49) WFLYMETRICS0001: Activating Eclipse MicroProfile Metrics Subsystem
> keycloak | 23:42:05,615 INFO [org.jboss.as.mail.extension] (MSC service thread 1-2) WFLYMAIL0002: Unbound mail session [java:jboss/mail/Default]
> keycloak | 23:42:05,618 INFO [org.wildfly.extension.microprofile.health.smallrye] (ServerService Thread Pool -- 48) WFLYHEALTH0001: Activating Eclipse MicroProfile Health Subsystem
> keycloak | 23:42:05,619 INFO [org.jboss.as.naming] (ServerService Thread Pool -- 51) WFLYNAM0001: Activating Naming Subsystem
> keycloak | 23:42:05,747 INFO [org.jboss.as.security] (ServerService Thread Pool -- 54) WFLYSEC0002: Activating Security Subsystem
> keycloak | 23:42:05,766 INFO [org.wildfly.extension.undertow] (MSC service thread 1-4) WFLYUT0003: Undertow 2.0.19.Final starting
> keycloak | 23:42:05,767 INFO [org.jboss.as.connector.subsystems.datasources] (MSC service thread 1-5) WFLYJCA0010: Unbound data source [java:jboss/datasources/ExampleDS]
> keycloak | 23:42:05,774 INFO [org.jboss.as.connector.subsystems.datasources] (MSC service thread 1-2) WFLYJCA0010: Unbound data source [java:jboss/datasources/KeycloakDS]
> keycloak | 23:42:05,789 INFO [org.jboss.as.security] (MSC service thread 1-4) WFLYSEC0001: Current PicketBox version=5.0.3.Final
> keycloak | 23:42:05,803 INFO [io.smallrye.metrics] (MSC service thread 1-6) Converted [2] config entries and added [4] replacements
> keycloak | 23:42:05,810 INFO [io.smallrye.metrics] (MSC service thread 1-6) Converted [3] config entries and added [14] replacements
> keycloak | 23:42:05,832 INFO [org.jboss.as.naming] (MSC service thread 1-2) WFLYNAM0003: Starting Naming Service
> keycloak | 23:42:05,841 INFO [org.jboss.as.mail.extension] (MSC service thread 1-4) WFLYMAIL0001: Bound mail session [java:jboss/mail/Default]
> keycloak | 23:42:05,858 INFO [org.jboss.as.ejb3] (MSC service thread 1-8) WFLYEJB0481: Strict pool slsb-strict-max-pool is using a max instance size of 128 (per class), which is derived from thread worker pool sizing.
> keycloak | 23:42:05,860 INFO [org.jboss.as.ejb3] (MSC service thread 1-7) WFLYEJB0482: Strict pool mdb-strict-max-pool is using a max instance size of 32 (per class), which is derived from the number of CPUs on this host.
> keycloak | 23:42:05,924 INFO [org.wildfly.extension.undertow] (ServerService Thread Pool -- 57) WFLYUT0014: Creating file handler for path '/opt/jboss/keycloak/welcome-content' with options [directory-listing: 'false', follow-symlink: 'false', case-sensitive: 'true', safe-symlink-paths: '[]']
> keycloak | 23:42:05,934 INFO [org.wildfly.extension.undertow] (MSC service thread 1-6) WFLYUT0012: Started server default-server.
> keycloak | 23:42:05,953 INFO [org.wildfly.extension.undertow] (MSC service thread 1-1) WFLYUT0018: Host default-host starting
> keycloak | 23:42:05,987 INFO [org.wildfly.extension.undertow] (MSC service thread 1-2) WFLYUT0006: Undertow HTTP listener default listening on 0.0.0.0:8080
> keycloak | 23:42:05,987 INFO [org.wildfly.extension.undertow] (MSC service thread 1-7) WFLYUT0006: Undertow AJP listener ajp listening on 0.0.0.0:8009
> keycloak | 23:42:06,002 INFO [org.jboss.modcluster] (ServerService Thread Pool -- 58) MODCLUSTER000001: Initializing mod_cluster version 1.4.0.Final
> keycloak | 23:42:06,018 INFO [org.jboss.modcluster] (ServerService Thread Pool -- 58) MODCLUSTER000032: Listening to proxy advertisements on /224.0.1.105:23364
> keycloak | 23:42:06,078 INFO [org.jboss.as.patching] (MSC service thread 1-5) WFLYPAT0050: Keycloak cumulative patch ID is: base, one-off patches include: none
> keycloak | 23:42:06,091 INFO [org.jboss.as.ejb3] (MSC service thread 1-3) WFLYEJB0493: EJB subsystem suspension complete
> keycloak | 23:42:06,096 WARN [org.jboss.as.domain.management.security] (MSC service thread 1-8) WFLYDM0111: Keystore /opt/jboss/keycloak/standalone/configuration/application.keystore not found, it will be auto generated on first use with a self signed certificate for host localhost
> keycloak | 23:42:06,108 INFO [org.jboss.as.server.deployment.scanner] (MSC service thread 1-4) WFLYDS0013: Started FileSystemDeploymentService for directory /opt/jboss/keycloak/standalone/deployments
> keycloak | 23:42:06,119 INFO [org.jboss.as.server.deployment] (MSC service thread 1-7) WFLYSRV0027: Starting deployment of "keycloak-server.war" (runtime-name: "keycloak-server.war")
> keycloak | 23:42:06,171 INFO [org.wildfly.extension.undertow] (MSC service thread 1-8) WFLYUT0006: Undertow HTTPS listener https listening on 0.0.0.0:8443
> keycloak | 23:42:06,177 INFO [org.jboss.as.connector.subsystems.datasources] (MSC service thread 1-2) WFLYJCA0001: Bound data source [java:jboss/datasources/ExampleDS]
> keycloak | 23:42:06,178 INFO [org.jboss.as.connector.subsystems.datasources] (MSC service thread 1-7) WFLYJCA0001: Bound data source [java:jboss/datasources/KeycloakDS]
> keycloak | 23:42:06,344 WARN [org.jboss.as.dependency.private] (MSC service thread 1-1) WFLYSRV0018: Deployment "deployment.keycloak-server.war" is using a private module ("org.kie") which may be changed or removed in future versions without notice.
> keycloak | 23:42:06,631 WARN [org.jgroups.protocols.UDP] (ServerService Thread Pool -- 58) JGRP000015: the send buffer of socket ManagedMulticastSocketBinding was set to 1.00MB, but the OS only allocated 212.99KB. This might lead to performance problems. Please set your max send buffer in the OS correctly (e.g. net.core.wmem_max on Linux)
> keycloak | 23:42:06,632 WARN [org.jgroups.protocols.UDP] (ServerService Thread Pool -- 58) JGRP000015: the receive buffer of socket ManagedMulticastSocketBinding was set to 20.00MB, but the OS only allocated 212.99KB. This might lead to performance problems. Please set your max receive buffer in the OS correctly (e.g. net.core.rmem_max on Linux)
> keycloak | 23:42:06,632 WARN [org.jgroups.protocols.UDP] (ServerService Thread Pool -- 58) JGRP000015: the send buffer of socket ManagedMulticastSocketBinding was set to 1.00MB, but the OS only allocated 212.99KB. This might lead to performance problems. Please set your max send buffer in the OS correctly (e.g. net.core.wmem_max on Linux)
> keycloak | 23:42:06,632 WARN [org.jgroups.protocols.UDP] (ServerService Thread Pool -- 58) JGRP000015: the receive buffer of socket ManagedMulticastSocketBinding was set to 25.00MB, but the OS only allocated 212.99KB. This might lead to performance problems. Please set your max receive buffer in the OS correctly (e.g. net.core.rmem_max on Linux)
> keycloak | 23:42:09,641 INFO [org.jgroups.protocols.pbcast.GMS] (ServerService Thread Pool -- 58) keycloak: no members discovered after 3003 ms: creating cluster as first member
> keycloak | 23:42:09,939 INFO [org.infinispan.factories.GlobalComponentRegistry] (MSC service thread 1-7) ISPN000128: Infinispan version: Infinispan 'Infinity Minus ONE +2' 9.4.8.Final
> keycloak | 23:42:10,118 INFO [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-4) ISPN000078: Starting JGroups channel ejb
> keycloak | 23:42:10,118 INFO [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-1) ISPN000078: Starting JGroups channel ejb
> keycloak | 23:42:10,118 INFO [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-5) ISPN000078: Starting JGroups channel ejb
> keycloak | 23:42:10,118 INFO [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-6) ISPN000078: Starting JGroups channel ejb
> keycloak | 23:42:10,118 INFO [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-7) ISPN000078: Starting JGroups channel ejb
> keycloak | 23:42:10,124 INFO [org.infinispan.CLUSTER] (MSC service thread 1-4) ISPN000094: Received new cluster view for channel ejb: [keycloak|0] (1) [keycloak]
> keycloak | 23:42:10,124 INFO [org.infinispan.CLUSTER] (MSC service thread 1-6) ISPN000094: Received new cluster view for channel ejb: [keycloak|0] (1) [keycloak]
> keycloak | 23:42:10,124 INFO [org.infinispan.CLUSTER] (MSC service thread 1-5) ISPN000094: Received new cluster view for channel ejb: [keycloak|0] (1) [keycloak]
> keycloak | 23:42:10,124 INFO [org.infinispan.CLUSTER] (MSC service thread 1-7) ISPN000094: Received new cluster view for channel ejb: [keycloak|0] (1) [keycloak]
> keycloak | 23:42:10,124 INFO [org.infinispan.CLUSTER] (MSC service thread 1-1) ISPN000094: Received new cluster view for channel ejb: [keycloak|0] (1) [keycloak]
> keycloak | 23:42:10,132 INFO [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-1) ISPN000079: Channel ejb local address is keycloak, physical addresses are [172.19.0.6:55200]
> keycloak | 23:42:10,132 INFO [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-6) ISPN000079: Channel ejb local address is keycloak, physical addresses are [172.19.0.6:55200]
> keycloak | 23:42:10,133 INFO [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-4) ISPN000079: Channel ejb local address is keycloak, physical addresses are [172.19.0.6:55200]
> keycloak | 23:42:10,132 INFO [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-7) ISPN000079: Channel ejb local address is keycloak, physical addresses are [172.19.0.6:55200]
> keycloak | 23:42:10,134 INFO [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-5) ISPN000079: Channel ejb local address is keycloak, physical addresses are [172.19.0.6:55200]
> keycloak | 23:42:10,311 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 58) WFLYCLINF0002: Started users cache from keycloak container
> keycloak | 23:42:10,311 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 61) WFLYCLINF0002: Started realms cache from keycloak container
> keycloak | 23:42:10,311 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 65) WFLYCLINF0002: Started authorization cache from keycloak container
> keycloak | 23:42:10,311 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 68) WFLYCLINF0002: Started keys cache from keycloak container
> keycloak | 23:42:10,666 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 69) WFLYCLINF0002: Started offlineSessions cache from keycloak container
> keycloak | 23:42:10,666 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 64) WFLYCLINF0002: Started authenticationSessions cache from keycloak container
> keycloak | 23:42:10,668 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 63) WFLYCLINF0002: Started clientSessions cache from keycloak container
> keycloak | 23:42:10,668 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 67) WFLYCLINF0002: Started actionTokens cache from keycloak container
> keycloak | 23:42:10,668 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 62) WFLYCLINF0002: Started offlineClientSessions cache from keycloak container
> keycloak | 23:42:10,668 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 59) WFLYCLINF0002: Started sessions cache from keycloak container
> keycloak | 23:42:10,669 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 70) WFLYCLINF0002: Started client-mappings cache from ejb container
> keycloak | 23:42:10,669 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 66) WFLYCLINF0002: Started work cache from keycloak container
> keycloak | 23:42:10,670 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 60) WFLYCLINF0002: Started loginFailures cache from keycloak container
> keycloak | 23:42:10,798 WARN [org.jboss.as.server.deployment] (MSC service thread 1-6) WFLYSRV0273: Excluded subsystem weld via jboss-deployment-structure.xml does not exist.
> keycloak | 23:42:10,798 WARN [org.jboss.as.server.deployment] (MSC service thread 1-6) WFLYSRV0273: Excluded subsystem webservices via jboss-deployment-structure.xml does not exist.
> keycloak | 23:42:11,300 INFO [org.keycloak.services] (ServerService Thread Pool -- 60) KC-SERVICES0001: Loading config from standalone.xml or domain.xml
> keycloak | 23:42:11,612 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 60) WFLYCLINF0002: Started realmRevisions cache from keycloak container
> keycloak | 23:42:11,617 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 60) WFLYCLINF0002: Started userRevisions cache from keycloak container
> keycloak | 23:42:11,622 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 60) WFLYCLINF0002: Started authorizationRevisions cache from keycloak container
> keycloak | 23:42:11,623 INFO [org.keycloak.connections.infinispan.DefaultInfinispanConnectionProviderFactory] (ServerService Thread Pool -- 60) Node name: keycloak, Site name: null
> keycloak | 23:42:11,952 WARN [org.jboss.jca.core.connectionmanager.pool.strategy.OnePool] (ServerService Thread Pool -- 60) IJ000604: Throwable while attempting to get a new connection: null: javax.resource.ResourceException: IJ031084: Unable to create connection
> keycloak | at org.jboss.jca.adapters.jdbc.local.LocalManagedConnectionFactory.createLocalManagedConnection(LocalManagedConnectionFactory.java:345)
> keycloak | at org.jboss.jca.adapters.jdbc.local.LocalManagedConnectionFactory.getLocalManagedConnection(LocalManagedConnectionFactory.java:352)
> keycloak | at org.jboss.jca.adapters.jdbc.local.LocalManagedConnectionFactory.createManagedConnection(LocalManagedConnectionFactory.java:287)
> keycloak | at org.jboss.jca.core.connectionmanager.pool.mcp.SemaphoreConcurrentLinkedDequeManagedConnectionPool.createConnectionEventListener(SemaphoreConcurrentLinkedDequeManagedConnectionPool.java:1325)
> keycloak | at org.jboss.jca.core.connectionmanager.pool.mcp.SemaphoreConcurrentLinkedDequeManagedConnectionPool.getConnection(SemaphoreConcurrentLinkedDequeManagedConnectionPool.java:499)
> keycloak | at org.jboss.jca.core.connectionmanager.pool.AbstractPool.getSimpleConnection(AbstractPool.java:632)
> keycloak | at org.jboss.jca.core.connectionmanager.pool.AbstractPool.getConnection(AbstractPool.java:604)
> keycloak | at org.jboss.jca.core.connectionmanager.AbstractConnectionManager.getManagedConnection(AbstractConnectionManager.java:624)
> keycloak | at org.jboss.jca.core.connectionmanager.tx.TxConnectionManagerImpl.getManagedConnection(TxConnectionManagerImpl.java:440)
> keycloak | at org.jboss.jca.core.connectionmanager.AbstractConnectionManager.allocateConnection(AbstractConnectionManager.java:789)
> keycloak | at org.jboss.jca.adapters.jdbc.WrapperDataSource.getConnection(WrapperDataSource.java:138)
> keycloak | at org.jboss.as.connector.subsystems.datasources.WildFlyDataSource.getConnection(WildFlyDataSource.java:64)
> keycloak | at org.keycloak.connections.jpa.DefaultJpaConnectionProviderFactory.getConnection(DefaultJpaConnectionProviderFactory.java:376)
> keycloak | at org.keycloak.connections.jpa.updater.liquibase.lock.LiquibaseDBLockProvider.lazyInit(LiquibaseDBLockProvider.java:65)
> keycloak | at org.keycloak.connections.jpa.updater.liquibase.lock.LiquibaseDBLockProvider.lambda$waitForLock$0(LiquibaseDBLockProvider.java:97)
> keycloak | at org.keycloak.models.utils.KeycloakModelUtils.suspendJtaTransaction(KeycloakModelUtils.java:678)
> keycloak | at org.keycloak.connections.jpa.updater.liquibase.lock.LiquibaseDBLockProvider.waitForLock(LiquibaseDBLockProvider.java:95)
> keycloak | at org.keycloak.services.resources.KeycloakApplication$1.run(KeycloakApplication.java:144)
> keycloak | at org.keycloak.models.utils.KeycloakModelUtils.runJobInTransaction(KeycloakModelUtils.java:227)
> keycloak | at org.keycloak.services.resources.KeycloakApplication.<init>(KeycloakApplication.java:137)
> keycloak | at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
> keycloak | at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
> keycloak | at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
> keycloak | at java.lang.reflect.Constructor.newInstance(Constructor.java:423)
> keycloak | at org.jboss.resteasy.core.ConstructorInjectorImpl.construct(ConstructorInjectorImpl.java:152)
> keycloak | at org.jboss.resteasy.spi.ResteasyProviderFactory.createProviderInstance(ResteasyProviderFactory.java:2750)
> keycloak | at org.jboss.resteasy.spi.ResteasyDeployment.createApplication(ResteasyDeployment.java:364)
> keycloak | at org.jboss.resteasy.spi.ResteasyDeployment.startInternal(ResteasyDeployment.java:277)
> keycloak | at org.jboss.resteasy.spi.ResteasyDeployment.start(ResteasyDeployment.java:89)
> keycloak | at org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.init(ServletContainerDispatcher.java:119)
> keycloak | at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.init(HttpServletDispatcher.java:36)
> keycloak | at io.undertow.servlet.core.LifecyleInterceptorInvocation.proceed(LifecyleInterceptorInvocation.java:117)
> keycloak | at org.wildfly.extension.undertow.security.RunAsLifecycleInterceptor.init(RunAsLifecycleInterceptor.java:78)
> keycloak | at io.undertow.servlet.core.LifecyleInterceptorInvocation.proceed(LifecyleInterceptorInvocation.java:103)
> keycloak | at io.undertow.servlet.core.ManagedServlet$DefaultInstanceStrategy.start(ManagedServlet.java:303)
> keycloak | at io.undertow.servlet.core.ManagedServlet.createServlet(ManagedServlet.java:143)
> keycloak | at io.undertow.servlet.core.DeploymentManagerImpl$2.call(DeploymentManagerImpl.java:583)
> keycloak | at io.undertow.servlet.core.DeploymentManagerImpl$2.call(DeploymentManagerImpl.java:554)
> keycloak | at io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:42)
> keycloak | at io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43)
> keycloak | at org.wildfly.extension.undertow.security.SecurityContextThreadSetupAction.lambda$create$0(SecurityContextThreadSetupAction.java:105)
> keycloak | at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)
> keycloak | at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)
> keycloak | at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)
> keycloak | at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)
> keycloak | at io.undertow.servlet.core.DeploymentManagerImpl.start(DeploymentManagerImpl.java:596)
> keycloak | at org.wildfly.extension.undertow.deployment.UndertowDeploymentService.startContext(UndertowDeploymentService.java:97)
> keycloak | at org.wildfly.extension.undertow.deployment.UndertowDeploymentService$1.run(UndertowDeploymentService.java:78)
> keycloak | at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
> keycloak | at java.util.concurrent.FutureTask.run(FutureTask.java:266)
> keycloak | at org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35)
> keycloak | at org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1982)
> keycloak | at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1486)
> keycloak | at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1377)
> keycloak | at java.lang.Thread.run(Thread.java:748)
> keycloak | at org.jboss.threads.JBossThread.run(JBossThread.java:485)
> keycloak | Caused by: org.postgresql.util.PSQLException: The connection attempt failed.
> keycloak | at org.postgresql.core.v3.ConnectionFactoryImpl.openConnectionImpl(ConnectionFactoryImpl.java:292)
> keycloak | at org.postgresql.core.ConnectionFactory.openConnection(ConnectionFactory.java:49)
> keycloak | at org.postgresql.jdbc.PgConnection.<init>(PgConnection.java:195)
> keycloak | at org.postgresql.Driver.makeConnection(Driver.java:454)
> keycloak | at org.postgresql.Driver.connect(Driver.java:256)
> keycloak | at org.jboss.jca.adapters.jdbc.local.LocalManagedConnectionFactory.createLocalManagedConnection(LocalManagedConnectionFactory.java:321)
> keycloak | ... 55 more
> keycloak | Caused by: java.net.UnknownHostException: postgresdb
> keycloak | at java.net.AbstractPlainSocketImpl.connect(AbstractPlainSocketImpl.java:184)
> keycloak | at java.net.SocksSocketImpl.connect(SocksSocketImpl.java:392)
> keycloak | at java.net.Socket.connect(Socket.java:589)
> keycloak | at org.postgresql.core.PGStream.<init>(PGStream.java:70)
> keycloak | at org.postgresql.core.v3.ConnectionFactoryImpl.tryConnect(ConnectionFactoryImpl.java:91)
> keycloak | at org.postgresql.core.v3.ConnectionFactoryImpl.openConnectionImpl(ConnectionFactoryImpl.java:192)
> keycloak | ... 60 more
> keycloak |
> keycloak | 23:42:11,960 INFO [org.jboss.as.server] (Thread-2) WFLYSRV0220: Server shutdown has been requested via an OS signal
> keycloak | 23:42:11,971 ERROR [org.jboss.msc.service.fail] (ServerService Thread Pool -- 60) MSC000001: Failed to start service jboss.deployment.unit."keycloak-server.war".undertow-deployment: org.jboss.msc.service.StartException in service jboss.deployment.unit."keycloak-server.war".undertow-deployment: java.lang.RuntimeException: RESTEASY003325: Failed to construct public org.keycloak.services.resources.KeycloakApplication(javax.servlet.ServletContext,org.jboss.resteasy.core.Dispatcher)
> keycloak | at org.wildfly.extension.undertow.deployment.UndertowDeploymentService$1.run(UndertowDeploymentService.java:81)
> keycloak | at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
> keycloak | at java.util.concurrent.FutureTask.run(FutureTask.java:266)
> keycloak | at org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35)
> keycloak | at org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1982)
> keycloak | at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1486)
> keycloak | at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1377)
> keycloak | at java.lang.Thread.run(Thread.java:748)
> keycloak | at org.jboss.threads.JBossThread.run(JBossThread.java:485)
> keycloak | Caused by: java.lang.RuntimeException: RESTEASY003325: Failed to construct public org.keycloak.services.resources.KeycloakApplication(javax.servlet.ServletContext,org.jboss.resteasy.core.Dispatcher)
> keycloak | at org.jboss.resteasy.core.ConstructorInjectorImpl.construct(ConstructorInjectorImpl.java:164)
> keycloak | at org.jboss.resteasy.spi.ResteasyProviderFactory.createProviderInstance(ResteasyProviderFactory.java:2750)
> keycloak | at org.jboss.resteasy.spi.ResteasyDeployment.createApplication(ResteasyDeployment.java:364)
> keycloak | at org.jboss.resteasy.spi.ResteasyDeployment.startInternal(ResteasyDeployment.java:277)
> keycloak | at org.jboss.resteasy.spi.ResteasyDeployment.start(ResteasyDeployment.java:89)
> keycloak | at org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.init(ServletContainerDispatcher.java:119)
> keycloak | at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.init(HttpServletDispatcher.java:36)
> keycloak | at io.undertow.servlet.core.LifecyleInterceptorInvocation.proceed(LifecyleInterceptorInvocation.java:117)
> keycloak | at org.wildfly.extension.undertow.security.RunAsLifecycleInterceptor.init(RunAsLifecycleInterceptor.java:78)
> keycloak | at io.undertow.servlet.core.LifecyleInterceptorInvocation.proceed(LifecyleInterceptorInvocation.java:103)
> keycloak | at io.undertow.servlet.core.ManagedServlet$DefaultInstanceStrategy.start(ManagedServlet.java:303)
> keycloak | at io.undertow.servlet.core.ManagedServlet.createServlet(ManagedServlet.java:143)
> keycloak | at io.undertow.servlet.core.DeploymentManagerImpl$2.call(DeploymentManagerImpl.java:583)
> keycloak | at io.undertow.servlet.core.DeploymentManagerImpl$2.call(DeploymentManagerImpl.java:554)
> keycloak | at io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:42)
> keycloak | at io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43)
> keycloak | at org.wildfly.extension.undertow.security.SecurityContextThreadSetupAction.lambda$create$0(SecurityContextThreadSetupAction.java:105)
> keycloak | at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)
> keycloak | at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)
> keycloak | at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)
> keycloak | at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)
> keycloak | at io.undertow.servlet.core.DeploymentManagerImpl.start(DeploymentManagerImpl.java:596)
> keycloak | at org.wildfly.extension.undertow.deployment.UndertowDeploymentService.startContext(UndertowDeploymentService.java:97)
> keycloak | at org.wildfly.extension.undertow.deployment.UndertowDeploymentService$1.run(UndertowDeploymentService.java:78)
> keycloak | ... 8 more
> keycloak | Caused by: java.lang.RuntimeException: Failed to connect to database
> keycloak | at org.keycloak.connections.jpa.DefaultJpaConnectionProviderFactory.getConnection(DefaultJpaConnectionProviderFactory.java:382)
> keycloak | at org.keycloak.connections.jpa.updater.liquibase.lock.LiquibaseDBLockProvider.lazyInit(LiquibaseDBLockProvider.java:65)
> keycloak | at org.keycloak.connections.jpa.updater.liquibase.lock.LiquibaseDBLockProvider.lambda$waitForLock$0(LiquibaseDBLockProvider.java:97)
> keycloak | at org.keycloak.models.utils.KeycloakModelUtils.suspendJtaTransaction(KeycloakModelUtils.java:678)
> keycloak | at org.keycloak.connections.jpa.updater.liquibase.lock.LiquibaseDBLockProvider.waitForLock(LiquibaseDBLockProvider.java:95)
> keycloak | at org.keycloak.services.resources.KeycloakApplication$1.run(KeycloakApplication.java:144)
> keycloak | at org.keycloak.models.utils.KeycloakModelUtils.runJobInTransaction(KeycloakModelUtils.java:227)
> keycloak | at org.keycloak.services.resources.KeycloakApplication.<init>(KeycloakApplication.java:137)
> keycloak | at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
> keycloak | at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
> keycloak | at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
> keycloak | at java.lang.reflect.Constructor.newInstance(Constructor.java:423)
> keycloak | at org.jboss.resteasy.core.ConstructorInjectorImpl.construct(ConstructorInjectorImpl.java:152)
> keycloak | ... 31 more
> keycloak | Caused by: java.sql.SQLException: javax.resource.ResourceException: IJ000453: Unable to get managed connection for java:jboss/datasources/KeycloakDS
> keycloak | at org.jboss.jca.adapters.jdbc.WrapperDataSource.getConnection(WrapperDataSource.java:146)
> keycloak | at org.jboss.as.connector.subsystems.datasources.WildFlyDataSource.getConnection(WildFlyDataSource.java:64)
> keycloak | at org.keycloak.connections.jpa.DefaultJpaConnectionProviderFactory.getConnection(DefaultJpaConnectionProviderFactory.java:376)
> keycloak | ... 43 more
> keycloak | Caused by: javax.resource.ResourceException: IJ000453: Unable to get managed connection for java:jboss/datasources/KeycloakDS
> keycloak | at org.jboss.jca.core.connectionmanager.AbstractConnectionManager.getManagedConnection(AbstractConnectionManager.java:690)
> keycloak | at org.jboss.jca.core.connectionmanager.tx.TxConnectionManagerImpl.getManagedConnection(TxConnectionManagerImpl.java:440)
> keycloak | at org.jboss.jca.core.connectionmanager.AbstractConnectionManager.allocateConnection(AbstractConnectionManager.java:789)
> keycloak | at org.jboss.jca.adapters.jdbc.WrapperDataSource.getConnection(WrapperDataSource.java:138)
> keycloak | ... 45 more
> keycloak | Caused by: javax.resource.ResourceException: IJ031084: Unable to create connection
> keycloak | at org.jboss.jca.adapters.jdbc.local.LocalManagedConnectionFactory.createLocalManagedConnection(LocalManagedConnectionFactory.java:345)
> keycloak | at org.jboss.jca.adapters.jdbc.local.LocalManagedConnectionFactory.getLocalManagedConnection(LocalManagedConnectionFactory.java:352)
> keycloak | at org.jboss.jca.adapters.jdbc.local.LocalManagedConnectionFactory.createManagedConnection(LocalManagedConnectionFactory.java:287)
> keycloak | at org.jboss.jca.core.connectionmanager.pool.mcp.SemaphoreConcurrentLinkedDequeManagedConnectionPool.createConnectionEventListener(SemaphoreConcurrentLinkedDequeManagedConnectionPool.java:1325)
> keycloak | at org.jboss.jca.core.connectionmanager.pool.mcp.SemaphoreConcurrentLinkedDequeManagedConnectionPool.getConnection(SemaphoreConcurrentLinkedDequeManagedConnectionPool.java:499)
> keycloak | at org.jboss.jca.core.connectionmanager.pool.AbstractPool.getSimpleConnection(AbstractPool.java:632)
> keycloak | at org.jboss.jca.core.connectionmanager.pool.AbstractPool.getConnection(AbstractPool.java:604)
> keycloak | at org.jboss.jca.core.connectionmanager.AbstractConnectionManager.getManagedConnection(AbstractConnectionManager.java:624)
> keycloak | ... 48 more
> keycloak | Caused by: org.postgresql.util.PSQLException: The connection attempt failed.
> keycloak | at org.postgresql.core.v3.ConnectionFactoryImpl.openConnectionImpl(ConnectionFactoryImpl.java:292)
> keycloak | at org.postgresql.core.ConnectionFactory.openConnection(ConnectionFactory.java:49)
> keycloak | at org.postgresql.jdbc.PgConnection.<init>(PgConnection.java:195)
> keycloak | at org.postgresql.Driver.makeConnection(Driver.java:454)
> keycloak | at org.postgresql.Driver.connect(Driver.java:256)
> keycloak | at org.jboss.jca.adapters.jdbc.local.LocalManagedConnectionFactory.createLocalManagedConnection(LocalManagedConnectionFactory.java:321)
> keycloak | ... 55 more
> keycloak | Caused by: java.net.UnknownHostException: postgresdb
> keycloak | at java.net.AbstractPlainSocketImpl.connect(AbstractPlainSocketImpl.java:184)
> keycloak | at java.net.SocksSocketImpl.connect(SocksSocketImpl.java:392)
> keycloak | at java.net.Socket.connect(Socket.java:589)
> keycloak | at org.postgresql.core.PGStream.<init>(PGStream.java:70)
> keycloak | at org.postgresql.core.v3.ConnectionFactoryImpl.tryConnect(ConnectionFactoryImpl.java:91)
> keycloak | at org.postgresql.core.v3.ConnectionFactoryImpl.openConnectionImpl(ConnectionFactoryImpl.java:192)
> keycloak | ... 60 more
> keycloak |
> keycloak | 23:42:11,996 INFO [org.jboss.as.connector.subsystems.datasources] (MSC service thread 1-8) WFLYJCA0010: Unbound data source [java:jboss/datasources/KeycloakDS]
> keycloak | 23:42:11,998 INFO [org.jboss.as.mail.extension] (MSC service thread 1-7) WFLYMAIL0002: Unbound mail session [java:jboss/mail/Default]
> keycloak | 23:42:11,998 INFO [org.wildfly.extension.undertow] (MSC service thread 1-7) WFLYUT0008: Undertow HTTPS listener https suspending
> keycloak | 23:42:12,002 INFO [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-3) ISPN000080: Disconnecting JGroups channel ejb
> keycloak | 23:42:12,003 INFO [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-1) ISPN000080: Disconnecting JGroups channel ejb
> keycloak | 23:42:12,005 INFO [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-4) ISPN000080: Disconnecting JGroups channel ejb
> keycloak | 23:42:12,009 INFO [org.jboss.as.connector.subsystems.datasources] (MSC service thread 1-1) WFLYJCA0010: Unbound data source [java:jboss/datasources/ExampleDS]
> keycloak | 23:42:12,010 INFO [org.jboss.modcluster] (ServerService Thread Pool -- 70) MODCLUSTER000002: Initiating mod_cluster shutdown
> keycloak | 23:42:12,010 INFO [org.wildfly.extension.undertow] (MSC service thread 1-5) WFLYUT0008: Undertow AJP listener ajp suspending
> keycloak | 23:42:12,012 INFO [org.jboss.as.connector.deployers.jdbc] (MSC service thread 1-3) WFLYJCA0019: Stopped Driver service with driver-name = postgresql
> keycloak | 23:42:12,012 INFO [org.jboss.as.connector.deployers.jdbc] (MSC service thread 1-1) WFLYJCA0019: Stopped Driver service with driver-name = h2
> keycloak | 23:42:12,016 INFO [org.wildfly.extension.undertow] (MSC service thread 1-7) WFLYUT0007: Undertow HTTPS listener https stopped, was bound to 0.0.0.0:8443
> keycloak | 23:42:12,016 INFO [org.wildfly.extension.undertow] (MSC service thread 1-5) WFLYUT0007: Undertow AJP listener ajp stopped, was bound to 0.0.0.0:8009
> keycloak | 23:42:12,022 INFO [org.wildfly.extension.undertow] (MSC service thread 1-5) WFLYUT0008: Undertow HTTP listener default suspending
> keycloak | 23:42:12,025 INFO [org.wildfly.extension.undertow] (MSC service thread 1-5) WFLYUT0007: Undertow HTTP listener default stopped, was bound to 0.0.0.0:8080
> keycloak | 23:42:12,029 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 66) WFLYCLINF0003: Stopped client-mappings cache from ejb container
> keycloak | 23:42:12,031 INFO [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-1) ISPN000080: Disconnecting JGroups channel ejb
> keycloak | 23:42:12,034 INFO [org.wildfly.extension.undertow] (MSC service thread 1-4) WFLYUT0019: Host default-host stopping
> keycloak | 23:42:12,035 INFO [org.wildfly.extension.undertow] (MSC service thread 1-3) WFLYUT0004: Undertow 2.0.19.Final stopping
> keycloak | 23:42:12,040 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 60) WFLYCLINF0003: Stopped keys cache from keycloak container
> keycloak | 23:42:12,040 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 64) WFLYCLINF0003: Stopped authorization cache from keycloak container
> keycloak | 23:42:12,043 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 64) WFLYCLINF0003: Stopped users cache from keycloak container
> keycloak | 23:42:12,046 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 61) WFLYCLINF0003: Stopped realms cache from keycloak container
> keycloak | 23:42:12,046 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 59) WFLYCLINF0003: Stopped work cache from keycloak container
> keycloak | 23:42:12,049 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 60) WFLYCLINF0003: Stopped offlineSessions cache from keycloak container
> keycloak | 23:42:12,051 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 70) WFLYCLINF0003: Stopped authenticationSessions cache from keycloak container
> keycloak | 23:42:12,051 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 66) WFLYCLINF0003: Stopped clientSessions cache from keycloak container
> keycloak | 23:42:12,053 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 62) WFLYCLINF0003: Stopped offlineClientSessions cache from keycloak container
> keycloak | 23:42:12,054 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 63) WFLYCLINF0003: Stopped loginFailures cache from keycloak container
> keycloak | 23:42:12,055 INFO [org.jboss.as.server.deployment] (MSC service thread 1-5) WFLYSRV0028: Stopped deployment keycloak-server.war (runtime-name: keycloak-server.war) in 90ms
> keycloak | 23:42:12,055 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 69) WFLYCLINF0003: Stopped actionTokens cache from keycloak container
> keycloak | 23:42:12,055 INFO [org.jboss.as.clustering.infinispan] (ServerService Thread Pool -- 67) WFLYCLINF0003: Stopped sessions cache from keycloak container
> keycloak | 23:42:12,067 INFO [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service thread 1-3) ISPN000080: Disconnecting JGroups channel ejb
> keycloak | 23:42:12,078 ERROR [org.jboss.as.controller.management-operation] (Controller Boot Thread) WFLYCTL0013: Operation ("add") failed - address: ([("subsystem" => "microprofile-metrics-smallrye")]): java.lang.NullPointerException
> keycloak | at org.wildfly.extension.microprofile.metrics.MicroProfileMetricsSubsystemAdd$2.execute(MicroProfileMetricsSubsystemAdd.java:86)
> keycloak | at org.jboss.as.controller.AbstractOperationContext.executeStep(AbstractOperationContext.java:999)
> keycloak | at org.jboss.as.controller.AbstractOperationContext.processStages(AbstractOperationContext.java:743)
> keycloak | at org.jboss.as.controller.AbstractOperationContext.executeOperation(AbstractOperationContext.java:467)
> keycloak | at org.jboss.as.controller.OperationContextImpl.executeOperation(OperationContextImpl.java:1412)
> keycloak | at org.jboss.as.controller.ModelControllerImpl.boot(ModelControllerImpl.java:521)
> keycloak | at org.jboss.as.controller.AbstractControllerService.boot(AbstractControllerService.java:472)
> keycloak | at org.jboss.as.controller.AbstractControllerService.boot(AbstractControllerService.java:434)
> keycloak | at org.jboss.as.server.ServerService.boot(ServerService.java:435)
> keycloak | at org.jboss.as.server.ServerService.boot(ServerService.java:394)
> keycloak | at org.jboss.as.controller.AbstractControllerService$1.run(AbstractControllerService.java:374)
> keycloak | at java.lang.Thread.run(Thread.java:748)
> keycloak |
> keycloak | 23:42:12,080 ERROR [org.jboss.as.controller.management-operation] (Controller Boot Thread) WFLYCTL0190: Step handler org.jboss.as.server.DeployerChainAddHandler$FinalRuntimeStepHandler at 219052d3 for operation add-deployer-chains at address [] failed handling operation rollback -- java.util.concurrent.RejectedExecutionException: java.util.concurrent.RejectedExecutionException
> keycloak | at org.jboss.threads.RejectingExecutor.execute(RejectingExecutor.java:37)
> keycloak | at org.jboss.threads.EnhancedQueueExecutor.rejectShutdown(EnhancedQueueExecutor.java:2026)
> keycloak | at org.jboss.threads.EnhancedQueueExecutor.execute(EnhancedQueueExecutor.java:757)
> keycloak | at org.jboss.as.controller.notification.NotificationSupports$NonBlockingNotificationSupport.emit(NotificationSupports.java:95)
> keycloak | at org.jboss.as.controller.OperationContextImpl.notifyModificationBegun(OperationContextImpl.java:876)
> keycloak | at org.jboss.as.controller.OperationContextImpl.ensureWriteLockForRuntime(OperationContextImpl.java:865)
> keycloak | at org.jboss.as.controller.OperationContextImpl.removeService(OperationContextImpl.java:638)
> keycloak | at org.jboss.as.server.DeployerChainAddHandler$FinalRuntimeStepHandler$1.handleRollback(DeployerChainAddHandler.java:135)
> keycloak | at org.jboss.as.controller.AbstractOperationContext$RollbackDelegatingResultHandler.handleResult(AbstractOperationContext.java:1561)
> keycloak | at org.jboss.as.controller.AbstractOperationContext$Step.invokeResultHandler(AbstractOperationContext.java:1533)
> keycloak | at org.jboss.as.controller.AbstractOperationContext$Step.handleResult(AbstractOperationContext.java:1515)
> keycloak | at org.jboss.as.controller.AbstractOperationContext$Step.finalizeInternal(AbstractOperationContext.java:1472)
> keycloak | at org.jboss.as.controller.AbstractOperationContext$Step.finalizeStep(AbstractOperationContext.java:1455)
> keycloak | at org.jboss.as.controller.AbstractOperationContext$Step.access$400(AbstractOperationContext.java:1319)
> keycloak | at org.jboss.as.controller.AbstractOperationContext.executeResultHandlerPhase(AbstractOperationContext.java:876)
> keycloak | at org.jboss.as.controller.AbstractOperationContext.processStages(AbstractOperationContext.java:756)
> keycloak | at org.jboss.as.controller.AbstractOperationContext.executeOperation(AbstractOperationContext.java:467)
> keycloak | at org.jboss.as.controller.OperationContextImpl.executeOperation(OperationContextImpl.java:1412)
> keycloak | at org.jboss.as.controller.ModelControllerImpl.boot(ModelControllerImpl.java:521)
> keycloak | at org.jboss.as.controller.AbstractControllerService.boot(AbstractControllerService.java:472)
> keycloak | at org.jboss.as.controller.AbstractControllerService.boot(AbstractControllerService.java:434)
> keycloak | at org.jboss.as.server.ServerService.boot(ServerService.java:435)
> keycloak | at org.jboss.as.server.ServerService.boot(ServerService.java:394)
> keycloak | at org.jboss.as.controller.AbstractControllerService$1.run(AbstractControllerService.java:374)
> keycloak | at java.lang.Thread.run(Thread.java:748)
> keycloak | Suppressed: java.util.concurrent.RejectedExecutionException: Executor is being shut down
> keycloak | at org.jboss.threads.EnhancedQueueExecutor.rejectShutdown(EnhancedQueueExecutor.java:2028)
> keycloak | ... 23 more
> keycloak |
> keycloak | 23:42:12,080 ERROR [org.jboss.as.controller.client] (Controller Boot Thread) WFLYCTL0190: Step handler org.jboss.as.server.DeployerChainAddHandler$FinalRuntimeStepHandler at 219052d3 for operation add-deployer-chains at address [] failed handling operation rollback -- java.util.concurrent.RejectedExecutionException
> keycloak | keycloak exited with code 1

From justinwilliams42 at gmail.com  Wed Jul 17 11:59:01 2019
From: justinwilliams42 at gmail.com (Justin Williams)
Date: Wed, 17 Jul 2019 08:59:01 -0700
Subject: [keycloak-user] CLI scripts
In-Reply-To: <CAPj_fOv3SXan4Kd0ZYdRh7rud5Kh-d=mKvRWKqNhXUte1WG6yw@mail.gmail.com>
References: <CAPj_fOv3SXan4Kd0ZYdRh7rud5Kh-d=mKvRWKqNhXUte1WG6yw@mail.gmail.com>
Message-ID: <CAPj_fOvO3yY6Mp2A9XvTa8Kv04SzKSBDAk9Ce3bVjy7edE-yuA@mail.gmail.com>

I figured it out--

I was applying the CLI scripts to standalone.xml, but Keycloak was starting
with "standalone-ha.xml" by default. Doh.

Added `command: ["-c", "standalone.xml"]` to my docker-compose file and
it's working as expected.

On Tue, Jul 16, 2019 at 12:34 PM Justin Williams <justinwilliams42 at gmail.com>
wrote:

> Hello,
>
> I'm mounting a volume containing CLI scripts to my Keycloak Docker
> container "startup-scripts" directory, and the scripts execute, however
> they do not take effect if a reload is required. I'm not seeing how I can
> get the server to reload after executing all of the scripts.
> Any suggestions?
>
> Example (request-logging.cli):
>
> embed-server --server-config=standalone.xml --std-out=echo
>
> echo SETUP: Enabling detailed request logging
>
> /subsystem=undertow/configuration=filter/custom-filter=request-logging-filter:add(class-name=io.undertow.server.handlers.RequestDumpingHandler,
> module=io.undertow.core)
>
> /subsystem=undertow/server=default-server/host=default-host/filter-ref=request-logging-filter:add
>
> stop-embedded-server
>
>

From Sebastian.Schuster at bosch-si.com  Wed Jul 17 12:52:28 2019
From: Sebastian.Schuster at bosch-si.com (Schuster Sebastian (INST-CSS/BSV-OS2))
Date: Wed, 17 Jul 2019 16:52:28 +0000
Subject: [keycloak-user] realm-management client role "view-realm"
 needed to	view/edit a user?
In-Reply-To: <016be823832845ebb230b6e6598008f6@bosch-si.com>
References: <b9cdb7129b034640a55ab5d90678c2c6@bosch-si.com>
	<VI1P192MB0239576ED1745C3E9248B716B1C90@VI1P192MB0239.EURP192.PROD.OUTLOOK.COM>
	<016be823832845ebb230b6e6598008f6@bosch-si.com>
Message-ID: <e106d6c36a1a42b3bd7d83f84ee8ed97@bosch-si.com>

I assume this issue is fixed in 6.0.1 with this PR: https://github.com/keycloak/keycloak/pull/5893/files

Best regards,
Sebastian

Mit freundlichen Gr??en / Best regards

Dr.-Ing. Sebastian Schuster

Open Source Services (INST-CSS/BSV-OS2) 
Bosch?Software Innovations?GmbH | Ullsteinstr. 128 | 12109 Berlin | GERMANY | www.bosch-si.com
Tel. +49 30 726112-485 | Mobil +49 152 02177668 | Fax +49 30 726112-100 | Sebastian.Schuster at bosch-si.com

Sitz: Berlin, Registergericht: Amtsgericht Charlottenburg; HRB 148411 B 
Aufsichtsratsvorsitzender: Dr.-Ing. Thorsten L?cke; Gesch?ftsf?hrung: Dr. Stefan Ferber, Michael Hahn, Dr. Aleksandar Mitrovic 




-----Urspr?ngliche Nachricht-----
Von: keycloak-user-bounces at lists.jboss.org <keycloak-user-bounces at lists.jboss.org> Im Auftrag von EXTERNAL Weimer Benjamin (TNG, INST-CSS/BSV-OS2)
Gesendet: Mittwoch, 17. Juli 2019 17:43
An: Huw McNamara <huwmcnamara at msn.com>; keycloak-user at lists.jboss.org
Betreff: Re: [keycloak-user] realm-management client role "view-realm" needed to view/edit a user?

Hi Huw,

Thanks for your reply! I added the info to the JIRA ticket.

Best regards
Benjamin

Von: Huw McNamara <huwmcnamara at msn.com>
Gesendet: Mittwoch, 17. Juli 2019 17:32
An: EXTERNAL Weimer Benjamin (TNG, INST-CSS/BSV-OS2) <external.Benjamin.Weimer at bosch-si.com>; keycloak-user at lists.jboss.org
Betreff: Re: [keycloak-user] realm-management client role "view-realm" needed to view/edit a user?

Hi Benjamin,

There's an open bug for view-realm being needed to access the credentials tab for clients https://issues.jboss.org/browse/KEYCLOAK-10782.
Maybe they are related and you could add the info to the JIRA ticket? Although fine grain permissions are tech preview.

Thanks,
Huw

________________________________
From: keycloak-user-bounces at lists.jboss.org<mailto:keycloak-user-bounces at lists.jboss.org> <keycloak-user-bounces at lists.jboss.org<mailto:keycloak-user-bounces at lists.jboss.org>> on behalf of EXTERNAL Weimer Benjamin (TNG, INST-CSS/BSV-OS2) <external.Benjamin.Weimer at bosch-si.com<mailto:external.Benjamin.Weimer at bosch-si.com>>
Sent: 17 July 2019 15:39
To: keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>
Subject: [keycloak-user] realm-management client role "view-realm" needed to view/edit a user?

Hi all,

we are using fine grain permissions in Keycloak to set the rights to edit certain users and have noticed that the roles "manage-users" and "query-realm" of the "realm-management" client are not sufficient to view and edit single users. The "view-realm" role seems to be needed for that. Can you explain me why this role is needed for this action?

Best regards and thanks in advance
Benjamin Weimer

_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user
_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user


From Aditya.Bhole at veritas.com  Wed Jul 17 13:28:18 2019
From: Aditya.Bhole at veritas.com (Aditya Bhole)
Date: Wed, 17 Jul 2019 17:28:18 +0000
Subject: [keycloak-user] Core Services Without UI & Local Unix Users
Message-ID: <3FB13325-6839-439E-ADF5-008E82E1A13A@veritas.com>

Hi,

We are building an SSO framework for our company products using Keycloak and want to use our existing UI and flow for login.
Is there a way to deploy Keycloak without using any of its UI components (Login Screen and Admin Console) and still use all the core services such as authentication, authorization, managing user storage etc.

Also, we want to authenticate the Unix local users via Keycloak. Is there any way to do this? Or is there any workaround that you can suggest for the same?

Regards,
Aditya Bhole

From rmartinc at redhat.com  Wed Jul 17 15:29:52 2019
From: rmartinc at redhat.com (Ricardo Martin Camarero)
Date: Wed, 17 Jul 2019 21:29:52 +0200
Subject: [keycloak-user] realm-management client role "view-realm"
 needed to view/edit a user?
In-Reply-To: <e106d6c36a1a42b3bd7d83f84ee8ed97@bosch-si.com>
References: <b9cdb7129b034640a55ab5d90678c2c6@bosch-si.com>
	<VI1P192MB0239576ED1745C3E9248B716B1C90@VI1P192MB0239.EURP192.PROD.OUTLOOK.COM>
	<016be823832845ebb230b6e6598008f6@bosch-si.com>
	<e106d6c36a1a42b3bd7d83f84ee8ed97@bosch-si.com>
Message-ID: <b8c3e421-2897-825e-7a33-5a83ac71927a@redhat.com>

Hi,

I think that in order to edit users you need "manage-users" and
"query-users". Try adding "query-users" permission to the administrator
(and removing the "view-realm").

Best regards!

On 7/17/19 6:52 PM, Schuster Sebastian (INST-CSS/BSV-OS2) wrote:
> I assume this issue is fixed in 6.0.1 with this PR: https://github.com/keycloak/keycloak/pull/5893/files
>
> Best regards,
> Sebastian
>
> Mit freundlichen Gr??en / Best regards
>
> Dr.-Ing. Sebastian Schuster
>
> Open Source Services (INST-CSS/BSV-OS2) 
> Bosch?Software Innovations?GmbH | Ullsteinstr. 128 | 12109 Berlin | GERMANY | www.bosch-si.com
> Tel. +49 30 726112-485 | Mobil +49 152 02177668 | Fax +49 30 726112-100 | Sebastian.Schuster at bosch-si.com
>
> Sitz: Berlin, Registergericht: Amtsgericht Charlottenburg; HRB 148411 B 
> Aufsichtsratsvorsitzender: Dr.-Ing. Thorsten L?cke; Gesch?ftsf?hrung: Dr. Stefan Ferber, Michael Hahn, Dr. Aleksandar Mitrovic 
>
>
>
>
> -----Urspr?ngliche Nachricht-----
> Von: keycloak-user-bounces at lists.jboss.org <keycloak-user-bounces at lists.jboss.org> Im Auftrag von EXTERNAL Weimer Benjamin (TNG, INST-CSS/BSV-OS2)
> Gesendet: Mittwoch, 17. Juli 2019 17:43
> An: Huw McNamara <huwmcnamara at msn.com>; keycloak-user at lists.jboss.org
> Betreff: Re: [keycloak-user] realm-management client role "view-realm" needed to view/edit a user?
>
> Hi Huw,
>
> Thanks for your reply! I added the info to the JIRA ticket.
>
> Best regards
> Benjamin
>
> Von: Huw McNamara <huwmcnamara at msn.com>
> Gesendet: Mittwoch, 17. Juli 2019 17:32
> An: EXTERNAL Weimer Benjamin (TNG, INST-CSS/BSV-OS2) <external.Benjamin.Weimer at bosch-si.com>; keycloak-user at lists.jboss.org
> Betreff: Re: [keycloak-user] realm-management client role "view-realm" needed to view/edit a user?
>
> Hi Benjamin,
>
> There's an open bug for view-realm being needed to access the credentials tab for clients https://issues.jboss.org/browse/KEYCLOAK-10782.
> Maybe they are related and you could add the info to the JIRA ticket? Although fine grain permissions are tech preview.
>
> Thanks,
> Huw
>
> ________________________________
> From: keycloak-user-bounces at lists.jboss.org<mailto:keycloak-user-bounces at lists.jboss.org> <keycloak-user-bounces at lists.jboss.org<mailto:keycloak-user-bounces at lists.jboss.org>> on behalf of EXTERNAL Weimer Benjamin (TNG, INST-CSS/BSV-OS2) <external.Benjamin.Weimer at bosch-si.com<mailto:external.Benjamin.Weimer at bosch-si.com>>
> Sent: 17 July 2019 15:39
> To: keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>
> Subject: [keycloak-user] realm-management client role "view-realm" needed to view/edit a user?
>
> Hi all,
>
> we are using fine grain permissions in Keycloak to set the rights to edit certain users and have noticed that the roles "manage-users" and "query-realm" of the "realm-management" client are not sufficient to view and edit single users. The "view-realm" role seems to be needed for that. Can you explain me why this role is needed for this action?
>
> Best regards and thanks in advance
> Benjamin Weimer
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>
> https://lists.jboss.org/mailman/listinfo/keycloak-user
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user



From sshscp at gmail.com  Wed Jul 17 15:32:04 2019
From: sshscp at gmail.com (Nick Powers)
Date: Wed, 17 Jul 2019 13:32:04 -0600
Subject: [keycloak-user] Core Services Without UI & Local Unix Users
In-Reply-To: <3FB13325-6839-439E-ADF5-008E82E1A13A@veritas.com>
References: <3FB13325-6839-439E-ADF5-008E82E1A13A@veritas.com>
Message-ID: <CAKeq-mmN0p0G_=kyZSqQN7_jWe8JKxViv=tL++LbfGcrDC1ShA@mail.gmail.com>

Aditya,

I am not sure about the Unix local users, although it sounds like a cool
idea.  As for the GUI elements an option, rather than abandoning the
keycloak pages is you could theme the login and admin screens to look like
your site.  Below is a link that might help you get started with theming
keycloak:

https://github.com/keycloak/keycloak/tree/master/examples/themes

Thanks - Nick

On Wed, Jul 17, 2019 at 1:11 PM Aditya Bhole <Aditya.Bhole at veritas.com>
wrote:

> Hi,
>
> We are building an SSO framework for our company products using Keycloak
> and want to use our existing UI and flow for login.
> Is there a way to deploy Keycloak without using any of its UI components
> (Login Screen and Admin Console) and still use all the core services such
> as authentication, authorization, managing user storage etc.
>
> Also, we want to authenticate the Unix local users via Keycloak. Is there
> any way to do this? Or is there any workaround that you can suggest for the
> same?
>
> Regards,
> Aditya Bhole
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

From mhatanak at redhat.com  Wed Jul 17 20:37:49 2019
From: mhatanak at redhat.com (Masanobu Hatanaka)
Date: Thu, 18 Jul 2019 09:37:49 +0900
Subject: [keycloak-user] any vendor to provide a keycloak training?
Message-ID: <f935b802-268c-ac74-f762-8ff570cba3d4@redhat.com>

Hi,

Does anyone knows any vendor to provide a keycloak training class
through online/classes?

I'm looking for a class training for Keycloak.

Kind regards,
Masanobu.

From sshscp at gmail.com  Wed Jul 17 20:58:47 2019
From: sshscp at gmail.com (Nick Powers)
Date: Wed, 17 Jul 2019 18:58:47 -0600
Subject: [keycloak-user] Identity Providers (Google) where are the tokens?
Message-ID: <CAKeq-mn=fsoGCjx=NxaSq2EPna69=bqGGwrwwuhHyxB3Tuk1dQ@mail.gmail.com>

Hello,

I have configured Keycloak to authenticate users using Google as an
identity provider and it works for basic authentication.  I have set
Default Scopes to https://www.googleapis.com/auth/youtube.force-ssl, a
Google scope for accessing the YouTube API.  This is obviously getting
communicated to Google because when I do authenticate Google prompts me for
the YouTube permissions.  But, I am not seeing the Google access/refresh
tokens in the logs (I have configured logging for
org.keycloak.social.user_profile_dump
to DEBUG).  Logs pasted below.  My original plan was to examine the DEBUG
logs to learn the structure of the data and then use a Mapper to gain
access to that data but now I am at a loss because Google's access/refresh
tokens are not in the log.  I think I must be missing something.  HELP! :)

Below is what I am seeing in the logs.  I get the user info but not the
tokens. :(

23:19:50,259 DEBUG [org.keycloak.social.user_profile_dump] (default
task-95) User Profile JSON Data for provider google:
{"sub":"116437238580102652286","name":"Nick
Powers","given_name":"Nick","family_name":"Powers","picture":"
https://lh3.googleusercontent.com/-zeavnWWwmto/AAAAAAAAAAI/AAAAAAAAANE/BOnJMZ_xqp8/photo.jpg
"}

Thanks - Nick

From external.Benjamin.Weimer at bosch-si.com  Thu Jul 18 02:49:44 2019
From: external.Benjamin.Weimer at bosch-si.com (EXTERNAL Weimer Benjamin (TNG, INST-CSS/BSV-OS2))
Date: Thu, 18 Jul 2019 06:49:44 +0000
Subject: [keycloak-user] realm-management client role "view-realm"
 needed to view/edit a user?
In-Reply-To: <b8c3e421-2897-825e-7a33-5a83ac71927a@redhat.com>
References: <b9cdb7129b034640a55ab5d90678c2c6@bosch-si.com>
	<VI1P192MB0239576ED1745C3E9248B716B1C90@VI1P192MB0239.EURP192.PROD.OUTLOOK.COM>
	<016be823832845ebb230b6e6598008f6@bosch-si.com>
	<e106d6c36a1a42b3bd7d83f84ee8ed97@bosch-si.com>
	<b8c3e421-2897-825e-7a33-5a83ac71927a@redhat.com>
Message-ID: <0f96128a11504af99dec76b78fe9b6e1@bosch-si.com>

Hi,

No "manage-users" and "query-users" is not enough, I get a "Forbidden" in this case. When I click on a user on the admin ui a request on "auth/admin/realms/{realm}/authentication/required-actions" is fired up and returns a 403 Forbidden. Before this request there is actually a GET request on the users which returns the user data. Anyways on the UI a "Forbidden" is shown. This seems inconvenient.

Best regards
Benjamin Weimer


-----Urspr?ngliche Nachricht-----
Von: Ricardo Martin Camarero <rmartinc at redhat.com> 
Gesendet: Mittwoch, 17. Juli 2019 21:30
An: Schuster Sebastian (INST-CSS/BSV-OS2) <Sebastian.Schuster at bosch-si.com>; EXTERNAL Weimer Benjamin (TNG, INST-CSS/BSV-OS2) <external.Benjamin.Weimer at bosch-si.com>; Huw McNamara <huwmcnamara at msn.com>; keycloak-user at lists.jboss.org
Betreff: Re: [keycloak-user] realm-management client role "view-realm" needed to view/edit a user?

Hi,

I think that in order to edit users you need "manage-users" and "query-users". Try adding "query-users" permission to the administrator (and removing the "view-realm").

Best regards!

On 7/17/19 6:52 PM, Schuster Sebastian (INST-CSS/BSV-OS2) wrote:
> I assume this issue is fixed in 6.0.1 with this PR: 
> https://github.com/keycloak/keycloak/pull/5893/files
>
> Best regards,
> Sebastian
>
> Mit freundlichen Gr??en / Best regards
>
> Dr.-Ing. Sebastian Schuster
>
> Open Source Services (INST-CSS/BSV-OS2) Bosch?Software Innovations?
> GmbH | Ullsteinstr. 128 | 12109 Berlin | GERMANY | www.bosch-si.com 
> Tel. +49 30 726112-485 | Mobil +49 152 02177668 | Fax +49 30 
> 726112-100 | Sebastian.Schuster at bosch-si.com
>
> Sitz: Berlin, Registergericht: Amtsgericht Charlottenburg; HRB 148411 
> B
> Aufsichtsratsvorsitzender: Dr.-Ing. Thorsten L?cke; Gesch?ftsf?hrung: 
> Dr. Stefan Ferber, Michael Hahn, Dr. Aleksandar Mitrovic
>
>
>
>
> -----Urspr?ngliche Nachricht-----
> Von: keycloak-user-bounces at lists.jboss.org 
> <keycloak-user-bounces at lists.jboss.org> Im Auftrag von EXTERNAL Weimer 
> Benjamin (TNG, INST-CSS/BSV-OS2)
> Gesendet: Mittwoch, 17. Juli 2019 17:43
> An: Huw McNamara <huwmcnamara at msn.com>; keycloak-user at lists.jboss.org
> Betreff: Re: [keycloak-user] realm-management client role "view-realm" needed to view/edit a user?
>
> Hi Huw,
>
> Thanks for your reply! I added the info to the JIRA ticket.
>
> Best regards
> Benjamin
>
> Von: Huw McNamara <huwmcnamara at msn.com>
> Gesendet: Mittwoch, 17. Juli 2019 17:32
> An: EXTERNAL Weimer Benjamin (TNG, INST-CSS/BSV-OS2) 
> <external.Benjamin.Weimer at bosch-si.com>; keycloak-user at lists.jboss.org
> Betreff: Re: [keycloak-user] realm-management client role "view-realm" needed to view/edit a user?
>
> Hi Benjamin,
>
> There's an open bug for view-realm being needed to access the credentials tab for clients https://issues.jboss.org/browse/KEYCLOAK-10782.
> Maybe they are related and you could add the info to the JIRA ticket? Although fine grain permissions are tech preview.
>
> Thanks,
> Huw
>
> ________________________________
> From: 
> keycloak-user-bounces at lists.jboss.org<mailto:keycloak-user-bounces at lis
> ts.jboss.org> 
> <keycloak-user-bounces at lists.jboss.org<mailto:keycloak-user-bounces at li
> sts.jboss.org>> on behalf of EXTERNAL Weimer Benjamin (TNG, 
> INST-CSS/BSV-OS2) 
> <external.Benjamin.Weimer at bosch-si.com<mailto:external.Benjamin.Weimer
> @bosch-si.com>>
> Sent: 17 July 2019 15:39
> To: 
> keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>
> Subject: [keycloak-user] realm-management client role "view-realm" needed to view/edit a user?
>
> Hi all,
>
> we are using fine grain permissions in Keycloak to set the rights to edit certain users and have noticed that the roles "manage-users" and "query-realm" of the "realm-management" client are not sufficient to view and edit single users. The "view-realm" role seems to be needed for that. Can you explain me why this role is needed for this action?
>
> Best regards and thanks in advance
> Benjamin Weimer
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>
> https://lists.jboss.org/mailman/listinfo/keycloak-user
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user




From prasus at gmail.com  Thu Jul 18 03:00:34 2019
From: prasus at gmail.com (Prasad Kris)
Date: Thu, 18 Jul 2019 12:30:34 +0530
Subject: [keycloak-user] Reg: Multiple Login Behaviour.
Message-ID: <CANRfWOqK5OmPYM+8=q-bw_=DnaZ_uH3hGBLYoNvTy78xsMWDHw@mail.gmail.com>

Greetings,

How does KeyCloak oidc sessions behave if we sign in from more than one
device on the same account? for example, I am logging in from my Laptop and
Desktop using the same account, but I am getting logged out from the old
device (it redirects to the login screen) soon after I sign-in from the
second device, Is this an expected behaviour? If yes, Is there a way by
which we can keep both sessions active so that we don't have to re-login
frequently.

Cheers,
Prasad

From Bo.Y at dell.com  Thu Jul 18 06:59:12 2019
From: Bo.Y at dell.com (Bo.Y at dell.com)
Date: Thu, 18 Jul 2019 10:59:12 +0000
Subject: [keycloak-user] Uncaught server error:
 java.lang.NoClassDefFoundError: org/keycloak/services/validation/Validation
Message-ID: <5cf0cf066cad47bf808b41977bee0c33@KULX13MDC123.APAC.DELL.COM>

Hi Experts,

When I follow https://www.keycloak.org/docs/latest/server_development/index.html#packaging-the-action step by step to do customize the validation in keycloak. After I throw my jar into standalone/deployment, it creates a deployed file and the log shows the jar is deployed.  I can found my execution in keycloak admin console which shows in the screen shot below. But when it comes to register page, after I click register button with my filled content I got exception in keycloak log file. I also checked `standalone.xml` and `jboss-deployment-structure.xml` which seems fine too which means it include "keycloak-services-4.7.0.Final.jar". I don't find any useful information in the search. So could anyone help to have a look please?

Keycloak  version:
    compile group: 'org.keycloak', name: 'keycloak-core', version: '4.7.0.Final'
    compile group: 'org.keycloak', name: 'keycloak-server-spi', version: '4.7.0.Final'
    compile group: 'org.keycloak', name: 'keycloak-server-spi-private', version: '4.7.0.Final'
    compile group: 'org.keycloak', name: 'keycloak-services', version: '4.7.0.Final'

[Screen Shot]
[cid:image003.jpg at 01D53D9A.DBB94DF0]

[Exception]
09:04:01,128 ERROR [org.keycloak.services.error.KeycloakErrorHandler] (default task-35) Uncaught server error: java.lang.NoClassDefFoundError: org/keycloak/services/validation/Validation
               at com.xxxxxx.registerformcustom.validate(registerformcustom.java:51)
               at org.keycloak.authentication.FormAuthenticationFlow.processAction(FormAuthenticationFlow.java:214)
               at org.keycloak.authentication.DefaultAuthenticationFlow.processAction(DefaultAuthenticationFlow.java:97)
               at org.keycloak.authentication.AuthenticationProcessor.authenticationAction(AuthenticationProcessor.java:873)
               at org.keycloak.services.resources.LoginActionsService.processFlow(LoginActionsService.java:292)
               at org.keycloak.services.resources.LoginActionsService.processRegistration(LoginActionsService.java:627)
               at org.keycloak.services.resources.LoginActionsService.registerRequest(LoginActionsService.java:681)
               at org.keycloak.services.resources.LoginActionsService.processRegister(LoginActionsService.java:661)
               at sun.reflect.GeneratedMethodAccessor1030.invoke(Unknown Source)
               at sun.reflect.DelegatingMethodAccessorImpl.invoke(Delegati



-------------- next part --------------
A non-text attachment was scrubbed...
Name: image003.jpg
Type: image/jpeg
Size: 36609 bytes
Desc: image003.jpg
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20190718/bbbe2e14/attachment-0001.jpg 

From vramik at redhat.com  Thu Jul 18 07:27:53 2019
From: vramik at redhat.com (Vlasta Ramik)
Date: Thu, 18 Jul 2019 13:27:53 +0200
Subject: [keycloak-user] Uncaught server error:
 java.lang.NoClassDefFoundError: org/keycloak/services/validation/Validation
In-Reply-To: <5cf0cf066cad47bf808b41977bee0c33@KULX13MDC123.APAC.DELL.COM>
References: <5cf0cf066cad47bf808b41977bee0c33@KULX13MDC123.APAC.DELL.COM>
Message-ID: <6c806c18-bd1d-e84b-3db3-3cf06f71cf01@redhat.com>

Hey,

I think you could try to add dependency to the keycloak-services, see 
https://docs.jboss.org/author/display/WFLY/Class+Loading+in+WildFly 
section JBoss Deployment Structure File.

V.

On 7/18/19 12:59 PM, Bo.Y at dell.com wrote:
> Hi Experts,
>
> When I follow https://www.keycloak.org/docs/latest/server_development/index.html#packaging-the-action step by step to do customize the validation in keycloak. After I throw my jar into standalone/deployment, it creates a deployed file and the log shows the jar is deployed.  I can found my execution in keycloak admin console which shows in the screen shot below. But when it comes to register page, after I click register button with my filled content I got exception in keycloak log file. I also checked `standalone.xml` and `jboss-deployment-structure.xml` which seems fine too which means it include "keycloak-services-4.7.0.Final.jar". I don't find any useful information in the search. So could anyone help to have a look please?
>
> Keycloak  version:
>      compile group: 'org.keycloak', name: 'keycloak-core', version: '4.7.0.Final'
>      compile group: 'org.keycloak', name: 'keycloak-server-spi', version: '4.7.0.Final'
>      compile group: 'org.keycloak', name: 'keycloak-server-spi-private', version: '4.7.0.Final'
>      compile group: 'org.keycloak', name: 'keycloak-services', version: '4.7.0.Final'
>
> [Screen Shot]
> [cid:image003.jpg at 01D53D9A.DBB94DF0]
>
> [Exception]
> 09:04:01,128 ERROR [org.keycloak.services.error.KeycloakErrorHandler] (default task-35) Uncaught server error: java.lang.NoClassDefFoundError: org/keycloak/services/validation/Validation
>                 at com.xxxxxx.registerformcustom.validate(registerformcustom.java:51)
>                 at org.keycloak.authentication.FormAuthenticationFlow.processAction(FormAuthenticationFlow.java:214)
>                 at org.keycloak.authentication.DefaultAuthenticationFlow.processAction(DefaultAuthenticationFlow.java:97)
>                 at org.keycloak.authentication.AuthenticationProcessor.authenticationAction(AuthenticationProcessor.java:873)
>                 at org.keycloak.services.resources.LoginActionsService.processFlow(LoginActionsService.java:292)
>                 at org.keycloak.services.resources.LoginActionsService.processRegistration(LoginActionsService.java:627)
>                 at org.keycloak.services.resources.LoginActionsService.registerRequest(LoginActionsService.java:681)
>                 at org.keycloak.services.resources.LoginActionsService.processRegister(LoginActionsService.java:661)
>                 at sun.reflect.GeneratedMethodAccessor1030.invoke(Unknown Source)
>                 at sun.reflect.DelegatingMethodAccessorImpl.invoke(Delegati
>
>
>
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From sshscp at gmail.com  Thu Jul 18 14:35:07 2019
From: sshscp at gmail.com (Nick Powers)
Date: Thu, 18 Jul 2019 12:35:07 -0600
Subject: [keycloak-user] Can I get a google offline refresh tokens or not?
	PLEASE
Message-ID: <CAKeq-mn9D+Xj0L+qzjREe_AYT2QjjwQU6wDHWVL4A2vJ-K4xAg@mail.gmail.com>

Hello,

I am setup with Keycloak & Gatekeeper and my users are able to authenticate
with Google and I can retrieve the access token from Google but I cannot
receive a refresh token, apparently because Keycloak is not adding
?access_type=offline to the Google authentication URL.  Is it even possible
to get a refresh token from Google while using Keycloak?

It's is very difficult to search for Keycloak related items on Google
because the results are littered with 404 pages from previous versions of
Keycloak that I guess have since been deleted.  But, most of what I have
found related to getting refresh tokens from Google end up being frustrated
people not getting an answer or people discussing how "someday" it "might"
be implemented.  These go back years.

>From what little I have been able to find, It seems offline access to
Google Identify Provider has never worked for Keycloak.  I hope that is not
true, it seems like a simple thing to add the option of appending
?access_type=offline to the Google authentication URL.

I know it may sound like nothing to someone not needing this feature but
for me if I cannot get the Google refresh tokens from Google with Keycloak
then I cannot use Keycloak.  I am not alone in wanting this, the archives
of this mailing list and Google search results have LOTS of people looking
to do the same thing.

PLEASE PLEASE PLEASE can someone PLEASE tell me what I need to do to get a
refresh token from Google????  I don't want to have to hard code
?access_type=offline into the URL in the source code if I don't have to.

Do any RedHat people monitor this mailing list?  Can I purchase a support
ticket from RedHat to get support on KeyCloak?  I really need to get this
working.

Thanks,

Nick

From Aditya.Bhole at veritas.com  Thu Jul 18 14:38:40 2019
From: Aditya.Bhole at veritas.com (Aditya Bhole)
Date: Thu, 18 Jul 2019 18:38:40 +0000
Subject: [keycloak-user] [EXTERNAL] Re: Trust between two standalone
 Keycloak Instances
In-Reply-To: <aade7cf1-a3a2-3a79-d190-19bc2668b04f@redhat.com>
References: <D55B0359-78C8-4431-B7D7-C4DE13A2D8D0@contoso.com>
	<b26f4842-29be-4f7f-5421-7a7f59825bb6@redhat.com>
	<C30F34E8-4658-47BE-9F05-CB9BCAA5B9EE@veritas.com>
	<aade7cf1-a3a2-3a79-d190-19bc2668b04f@redhat.com>
Message-ID: <387E1325-20A7-43F8-89D3-B0562910E707@veritas.com>

Hi Stan,

We have 3 enterprise products deployed in their own environments. Now, some of our clients use all three products, some use just one and some use any two of them. Each product is a separate with its own bundled software and not related to the others. So what we want to do is to include Keycloak in each bundle. But there are cases where even from these unrelated products, we need an option for cross product transition.

For that to happen, we need to establish trust between all these separate Keycloak instances. So even if we deploy a new product with Keycloak in its bundle, we would just need to establish trust with the existing system of Keycloak Instances. So is there a way that a token generated by one of the Keycloak instances is accepted by the other Keycloak instances?

Also, in domain mode, if we deploy two Keycloak instances separately as master, later if we decide to keep one as master and make the other one a slave, is that possible?

And about the local settings, say for example, if I had to connect an LDAP for just one of the hosts, can that be done?

Thanks,
Aditya

On 7/17/19, 3:05 PM, "keycloak-user-bounces at lists.jboss.org on behalf of Stan Silvert" <keycloak-user-bounces at lists.jboss.org on behalf of ssilvert at redhat.com> wrote:

Yes, it can be done, but I still don't understand why you would want to 
    do it this way.  You can also establish trust between two realms on the 
    same server.  That way, you don't need multiple instances of Keycloak to 
    have the apps be fully walled off from each other.
    
    That being said, I still don't understand why you wouldn't just do it 
    the easy way.  Are you saying that sometimes you want SSO and sometimes 
    you don't?  I must be missing something from your use case.
    
    Lastly, the domain features of WildFly are just used to centrally manage 
    instances of the server.  These servers can be configured any way you 
    want.  I guess this depends on what you mean by "local settings".


    On 7/16/2019 1:26 PM, Aditya Bhole wrote:
    > I understand that deploying 3 clients under one realm will easily enable SSO. Even if we keep the clients in different realms, cross-realm trust can be established. But the use case of our prototype wants the clients to be on different servers. I?ll try to explain as best as I can.
    >
    > Our company has 3 products deployed independently and these are managed by different administrators. Sometimes these have to be integrated with each other for seamless cross product experience at which time we would want SSO between the individual product UIs. We intend to use Keycloak as a broker for authentication and to achieve SSO. So that?s why I wanted to know if trust between two standalone Keycloak instances can be established.
    >
    > Also, if we deploy the domain controller, can there still be local settings on the different Keycloak instances?
    >
    > Thanks,
    > Aditya
    
    >
    > On 7/15/19, 12:25 PM, "keycloak-user-bounces at lists.jboss.org on behalf of Stan Silvert" <keycloak-user-bounces at lists.jboss.org on behalf of ssilvert at redhat.com> wrote:
    >
    >      Why do you need each to have its own Keycloak instance?  A usual setup
    >      would define all three clients in the same realm under the same Keycloak
    >      instance.
    >      
    >      On 7/15/2019 1:23 PM, Aditya Bhole wrote:
    >      > Hello,
    >      >
    >      > I?m new to Keycloak and building a prototype SSO framework for my company. The use case is that my company has 3 clients; A, B and C. Now each client is going to have its own Keycloak instance; KA, KB and KC. Now what I want is when I login through client A I should be logged into client B and C as well. And same goes for all the clients. So for this to happen, is there a way of establishing trust between these three Keycloak instances KA, KB and KC?
    >      > I?ve successfully established an SSO by using KA as a broker and KB as an IDP. But this is only a master slave kind-of an architecture. When I log in to A, I?m automatically logged into B. But if I log into B, I won?t be automatically logged into A. Is it possible for KA to be a broker for KB and KB to be a broker for KA at the same time?
    >      > TL;DR :
    >      > Is there a way where Keycloak only acts as a broker and trust is established between multiple such Keycloak instances?
    >      >
    >      > I hope my question makes sense. Please point me in the right direction if I?m looking at this in the wrong way.
    >      >
    >      > Thanks,
    >      > Aditya
    >      >
    >      > _______________________________________________
    >      > keycloak-user mailing list
    >      > keycloak-user at lists.jboss.org
    >      > https://lists.jboss.org/mailman/listinfo/keycloak-user
    >      
    >      
    >      _______________________________________________
    >      keycloak-user mailing list
    >      keycloak-user at lists.jboss.org
    >      https://lists.jboss.org/mailman/listinfo/keycloak-user
    >
    >
    > _______________________________________________
    > keycloak-user mailing list
    > keycloak-user at lists.jboss.org
    > https://lists.jboss.org/mailman/listinfo/keycloak-user
    
    
    _______________________________________________
    keycloak-user mailing list
    keycloak-user at lists.jboss.org
    https://lists.jboss.org/mailman/listinfo/keycloak-user



From Aditya.Bhole at veritas.com  Thu Jul 18 15:08:05 2019
From: Aditya.Bhole at veritas.com (Aditya Bhole)
Date: Thu, 18 Jul 2019 19:08:05 +0000
Subject: [keycloak-user] [EXTERNAL] Re: Core Services Without UI & Local
 Unix Users
In-Reply-To: <CAKeq-mmN0p0G_=kyZSqQN7_jWe8JKxViv=tL++LbfGcrDC1ShA@mail.gmail.com>
References: <3FB13325-6839-439E-ADF5-008E82E1A13A@veritas.com>
	<CAKeq-mmN0p0G_=kyZSqQN7_jWe8JKxViv=tL++LbfGcrDC1ShA@mail.gmail.com>
Message-ID: <2C0E3D64-9176-40CE-96FB-5D0D76E6F63D@veritas.com>

Hi Nick,

To authenticate the Unix local users, can we do something like-

- Take the user credentials on login screen, along with a flag/indicator that this user is a local Unix user
- Write a java API/library which takes these credentials and authenticate the user at its OS level
-? If we get success as response from the API/library, create a Keycloak access token and let the user in to access the protected resources/clients

Thanks,
Aditya

?On 7/17/19, 3:02 PM, "keycloak-user-bounces at lists.jboss.org on behalf of Nick Powers" <keycloak-user-bounces at lists.jboss.org on behalf of sshscp at gmail.com> wrote:

    Aditya,
    
    I am not sure about the Unix local users, although it sounds like a cool
    idea.  As for the GUI elements an option, rather than abandoning the
    keycloak pages is you could theme the login and admin screens to look like
    your site.  Below is a link that might help you get started with theming
    keycloak:
    
    https://github.com/keycloak/keycloak/tree/master/examples/themes
    
    Thanks - Nick
    
    On Wed, Jul 17, 2019 at 1:11 PM Aditya Bhole <Aditya.Bhole at veritas.com>
    wrote:
    
    > Hi,
    >
    > We are building an SSO framework for our company products using Keycloak
    > and want to use our existing UI and flow for login.
    > Is there a way to deploy Keycloak without using any of its UI components
    > (Login Screen and Admin Console) and still use all the core services such
    > as authentication, authorization, managing user storage etc.
    >
    > Also, we want to authenticate the Unix local users via Keycloak. Is there
    > any way to do this? Or is there any workaround that you can suggest for the
    > same?
    >
    > Regards,
    > Aditya Bhole
    > _______________________________________________
    > keycloak-user mailing list
    > keycloak-user at lists.jboss.org
    > https://lists.jboss.org/mailman/listinfo/keycloak-user
    >
    _______________________________________________
    keycloak-user mailing list
    keycloak-user at lists.jboss.org
    https://lists.jboss.org/mailman/listinfo/keycloak-user
    



From sshscp at gmail.com  Thu Jul 18 19:37:08 2019
From: sshscp at gmail.com (Nick Powers)
Date: Thu, 18 Jul 2019 17:37:08 -0600
Subject: [keycloak-user] [EXTERNAL] Re: Core Services Without UI & Local
 Unix Users
In-Reply-To: <2C0E3D64-9176-40CE-96FB-5D0D76E6F63D@veritas.com>
References: <3FB13325-6839-439E-ADF5-008E82E1A13A@veritas.com>
	<CAKeq-mmN0p0G_=kyZSqQN7_jWe8JKxViv=tL++LbfGcrDC1ShA@mail.gmail.com>
	<2C0E3D64-9176-40CE-96FB-5D0D76E6F63D@veritas.com>
Message-ID: <CAKeq-mkUhXPprBA4nK4R69fy3FZ1Dj-GN_82z1HbVrb4=fUEzg@mail.gmail.com>

Aditya,

This is only a guess, as I have never attempted what you are suggesting.
But, if I were trying to do what you are I would start off by implementing
PAM (Pluggable Authentication Modules) with LDAP (database) to authenticate
your Unix users and then use Keycloak User Federation to keep your LDAP and
Keycloak user DB in sync.  This assumes that your Unix system supports
PAM.  PAM is currently supported in the AIX operating system, DragonFly
BSD, FreeBSD, HP-UX, Linux, macOS, NetBSD and Solaris.

- Nick

On Thu, Jul 18, 2019 at 5:00 PM Aditya Bhole <Aditya.Bhole at veritas.com>
wrote:

> Hi Nick,
>
> To authenticate the Unix local users, can we do something like-
>
> - Take the user credentials on login screen, along with a flag/indicator
> that this user is a local Unix user
> - Write a java API/library which takes these credentials and authenticate
> the user at its OS level
> -  If we get success as response from the API/library, create a Keycloak
> access token and let the user in to access the protected resources/clients
>
> Thanks,
> Aditya
>
> ?On 7/17/19, 3:02 PM, "keycloak-user-bounces at lists.jboss.org on behalf of
> Nick Powers" <keycloak-user-bounces at lists.jboss.org on behalf of
> sshscp at gmail.com> wrote:
>
>     Aditya,
>
>     I am not sure about the Unix local users, although it sounds like a
> cool
>     idea.  As for the GUI elements an option, rather than abandoning the
>     keycloak pages is you could theme the login and admin screens to look
> like
>     your site.  Below is a link that might help you get started with
> theming
>     keycloak:
>
>     https://github.com/keycloak/keycloak/tree/master/examples/themes
>
>     Thanks - Nick
>
>     On Wed, Jul 17, 2019 at 1:11 PM Aditya Bhole <Aditya.Bhole at veritas.com
> >
>     wrote:
>
>     > Hi,
>     >
>     > We are building an SSO framework for our company products using
> Keycloak
>     > and want to use our existing UI and flow for login.
>     > Is there a way to deploy Keycloak without using any of its UI
> components
>     > (Login Screen and Admin Console) and still use all the core services
> such
>     > as authentication, authorization, managing user storage etc.
>     >
>     > Also, we want to authenticate the Unix local users via Keycloak. Is
> there
>     > any way to do this? Or is there any workaround that you can suggest
> for the
>     > same?
>     >
>     > Regards,
>     > Aditya Bhole
>     > _______________________________________________
>     > keycloak-user mailing list
>     > keycloak-user at lists.jboss.org
>     > https://lists.jboss.org/mailman/listinfo/keycloak-user
>     >
>     _______________________________________________
>     keycloak-user mailing list
>     keycloak-user at lists.jboss.org
>     https://lists.jboss.org/mailman/listinfo/keycloak-user
>
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From Bo.Y at dell.com  Thu Jul 18 22:57:18 2019
From: Bo.Y at dell.com (Bo.Y at dell.com)
Date: Fri, 19 Jul 2019 02:57:18 +0000
Subject: [keycloak-user] Uncaught server error:
 java.lang.NoClassDefFoundError: org/keycloak/services/validation/Validation
In-Reply-To: <6c806c18-bd1d-e84b-3db3-3cf06f71cf01@redhat.com>
References: <5cf0cf066cad47bf808b41977bee0c33@KULX13MDC123.APAC.DELL.COM>
	<6c806c18-bd1d-e84b-3db3-3cf06f71cf01@redhat.com>
Message-ID: <c8b81e164c184b81a68a5a1a60585dd1@KULX13MDC123.APAC.DELL.COM>

Hi Vlasta,
I think I have had them in "jboss-deployment-structure"

[/opt/jboss/keycloak/modules/system/layers/keycloak/org/keycloak/keycloak-server-subsystem/main/server-war/WEB-INF/ jboss-deployment-structure]
<jboss-deployment-structure>
    <deployment>
        <dependencies>
            <module name="org.keycloak.keycloak-server-subsystem.dependencies"/>
            <!-- Kie requires access to kie.conf files from META-INF -->
            <module name="org.kie">
                <imports>
                    <include path="META-INF"/>
                </imports>
            </module>
        </dependencies>
        <exclude-subsystems>
            <subsystem name="webservices"/>
            <subsystem name="weld"/>
        </exclude-subsystems>
   </deployment>
</jboss-deployment-structure>

[/opt/jboss/keycloak/modules/system/layers/keycloak/org/keycloak/keycloak-server-subsystem/dependencies/main/module.xml]
<module name="org.keycloak.keycloak-server-subsystem.dependencies" xmlns="urn:jboss:module:1.1">
    <resources>
    </resources>

    <dependencies>
        <module name="org.keycloak.keycloak-services" export="true"/>
        <module name="org.jboss.msc"/>
        <module name="org.infinispan" export="true"/>
    </dependencies>
</module>

Thanks,
Bo
From: Vlasta Ramik <vramik at redhat.com>
Sent: Thursday, July 18, 2019 7:28 PM
To: Yang, Bo; keycloak-user at lists.jboss.org
Subject: Re: [keycloak-user] Uncaught server error: java.lang.NoClassDefFoundError: org/keycloak/services/validation/Validation


[EXTERNAL EMAIL]

Hey,

I think you could try to add dependency to the keycloak-services, see https://docs.jboss.org/author/display/WFLY/Class+Loading+in+WildFly section JBoss Deployment Structure File.

V.
On 7/18/19 12:59 PM, Bo.Y at dell.com<mailto:Bo.Y at dell.com> wrote:

Hi Experts,



When I follow https://www.keycloak.org/docs/latest/server_development/index.html#packaging-the-action step by step to do customize the validation in keycloak. After I throw my jar into standalone/deployment, it creates a deployed file and the log shows the jar is deployed.  I can found my execution in keycloak admin console which shows in the screen shot below. But when it comes to register page, after I click register button with my filled content I got exception in keycloak log file. I also checked `standalone.xml` and `jboss-deployment-structure.xml` which seems fine too which means it include "keycloak-services-4.7.0.Final.jar". I don't find any useful information in the search. So could anyone help to have a look please?



Keycloak  version:

    compile group: 'org.keycloak', name: 'keycloak-core', version: '4.7.0.Final'

    compile group: 'org.keycloak', name: 'keycloak-server-spi', version: '4.7.0.Final'

    compile group: 'org.keycloak', name: 'keycloak-server-spi-private', version: '4.7.0.Final'

    compile group: 'org.keycloak', name: 'keycloak-services', version: '4.7.0.Final'



[Screen Shot]

[cid:image003.jpg at 01D53D9A.DBB94DF0]



[Exception]

09:04:01,128 ERROR [org.keycloak.services.error.KeycloakErrorHandler] (default task-35) Uncaught server error: java.lang.NoClassDefFoundError: org/keycloak/services/validation/Validation

               at com.xxxxxx.registerformcustom.validate(registerformcustom.java:51)

               at org.keycloak.authentication.FormAuthenticationFlow.processAction(FormAuthenticationFlow.java:214)

               at org.keycloak.authentication.DefaultAuthenticationFlow.processAction(DefaultAuthenticationFlow.java:97)

               at org.keycloak.authentication.AuthenticationProcessor.authenticationAction(AuthenticationProcessor.java:873)

               at org.keycloak.services.resources.LoginActionsService.processFlow(LoginActionsService.java:292)

               at org.keycloak.services.resources.LoginActionsService.processRegistration(LoginActionsService.java:627)

               at org.keycloak.services.resources.LoginActionsService.registerRequest(LoginActionsService.java:681)

               at org.keycloak.services.resources.LoginActionsService.processRegister(LoginActionsService.java:661)

               at sun.reflect.GeneratedMethodAccessor1030.invoke(Unknown Source)

               at sun.reflect.DelegatingMethodAccessorImpl.invoke(Delegati











_______________________________________________

keycloak-user mailing list

keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>

https://lists.jboss.org/mailman/listinfo/keycloak-user

From lahadidi at uni-mainz.de  Fri Jul 19 07:33:07 2019
From: lahadidi at uni-mainz.de (Hadidi, Lars)
Date: Fri, 19 Jul 2019 11:33:07 +0000
Subject: [keycloak-user] keycloak-nodejs-connect: ERR_TOO_MANY_REDIRECTS
Message-ID: <057f48464ca44785991dafe4dd3bef03@uni-mainz.de>

I set up a NodeJS Server to use the keycloak-connect module:

// Setup keycloak to use the session memoryStore
var memoryStore = new SESSION.MemoryStore();
var keycloak = new KEYCLOAK({ store: memoryStore });

// Set up a server instance and create a session middleware
const APP = EXPRESS();

APP.use(SESSION({
    secret: CRYPTO.randomBytes(512).toString('hex'),
    resave: false,
    saveUninitialized: true,
    store: memoryStore
}));


// Default route handler
APP.get('/login', keycloak.protect(), function(req, res) {
                    ...some custom logic, involving AXIOS XHR stuff
                    ...getting tokens from REST endpoints


    res.redirect('/app/html/createCustomer?' +  QUERYSTRING.encode({'tokenId': tokenID}));

}



APP.use(keycloak.middleware( { logout: '/logout'}));



// Start servers

HTTP.createServer(APP).listen(CONF.serverPort, CONF.serverInterface, () =>

console.log('Server listening on %s:%d', CONF.serverInterface,

CONF.serverPort));



The CONF objects holds CONF.serverPort=9080 and CONF.serverInterface=127.0.0.1

The keycloak.json reads

{

    "realm": "app-realm",

    "auth-server-url": "https://192.168.32.132/auth",

    "ssl-required": "external",

    "resource": "app-client",

    "public-client": true,

    "confidential-port": 0

}


Both NodeJS and Keycloak Docker Container are binding to 127.0.0.1, living behind an nginx revrse proxy.

The nginx reverse proxy uses TLS and terminates all HTTPS, sending all traffic to those upstream servers via plain HTTP.


The configuration of nginx reads

server {

    listen 80;

    listen [::]:80;



    server_name 192.168.32.132;



    return 301 https://$server_name$request_uri;

}



server {

    listen 443 ssl;

    listen [::]:443 ssl;



    server_name 192.168.32.132;



    ssl_certificate     /etc/ssl/private/fullchain.pem;

    ssl_certificate_key /etc/ssl/private/privkey.pem;

    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;



    location /login {

        proxy_pass http://127.0.0.1:9080;



        proxy_set_header    Host                          $host;

        proxy_set_header    X-Forwarded-For    $proxy_add_x_forwarded_for;

        proxy_set_header    X-Forwarded-Proto $scheme;

    }



    location /auth {

        proxy_pass http://127.0.0.1:8080;



        proxy_set_header    Host                          $host;

        proxy_set_header    X-Forwarded-For    $proxy_add_x_forwarded_for;

        proxy_set_header    X-Forwarded-Proto $scheme;

    }



    location /app {

        rewrite ^/app(.*)$ $1 last;

        proxy_pass http://127.0.0.1:7080;



        proxy_set_header    Host                          $host;

        proxy_set_header    X-Forwarded-For    $proxy_add_x_forwarded_for;

        proxy_set_header    X-Forwarded-Proto $scheme;

        }

    }



Additionally, the following lines are added for EVERY location block:


        proxy_set_header    X-Forwarded-Host    $host;

        proxy_set_header    X-Forwarded-Server $host;

        proxy_set_header    X-Forwarded-Port     $server_port;



        proxy_buffer_size          128k;

        proxy_buffers              4 256k;

        proxy_busy_buffers_size    256k;



There is a realm, a client with redirect URIs set to WILDCARD and one user.


Accessing route /login always leads to a redirect loop.




Following the HTTP stream via WireShark yields these results:

GET /login HTTP/1.1
Host: 192.168.32.132
Upgrade-Insecure-Requests: 1

HTTP/1.1 301 Moved Permanently
Server: nginx
Location: https://192.168.32.132/login
Strict-Transport-Security: max-age=31536000; includeSubdomains;

GET /login?auth_callback=1&state=eb22b4f5-e262-4deb-8e7d-f483ec1af553&session_state=9759ce64-400e-4e53-8cf5-613b2409a1c1&code=854efde1-71dc-4052-a0ad-7503ea3af7e4.9759ce64-400e-4e53-8cf5-613b2409a1c1.c00e43ce-79c2-48ee-8b92-639a6c9ade44 HTTP/1.1
Host: 192.168.32.132
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Cookie: connect.sid=s%3AhkFnuXd3uHPZym3mvFd2v6v2_bEmOYCm.jAeQvvN%2FZP7%2F9hV77wBI80pi%2B7T9CJo4LENc9kF5eSc

HTTP/1.1 301 Moved Permanently
Server: nginx
Location: https://192.168.32.132/login?auth_callback=1&state=eb22b4f5-e262-4deb-8e7d-f483ec1af553&session_state=9759ce64-400e-4e53-8cf5-613b2409a1c1&code=854efde1-71dc-4052-a0ad-7503ea3af7e4.9759ce64-400e-4e53-8cf5-613b2409a1c1.c00e43ce-79c2-48ee-8b92-639a6c9ade44
Strict-Transport-Security: max-age=31536000; includeSubdomains;

GET /login?auth_callback=1&state=eb22b4f5-e262-4deb-8e7d-f483ec1af553&session_state=9759ce64-400e-4e53-8cf5-613b2409a1c1&code=854efde1-71dc-4052-a0ad-7503ea3af7e4.9759ce64-400e-4e53-8cf5-613b2409a1c1.c00e43ce-79c2-48ee-8b92-639a6c9ade44&auth_callback=1&state=30d7d290-e967-488d-887c-b6eec1cc5d27&session_state=9759ce64-400e-4e53-8cf5-613b2409a1c1&code=089d3ff9-702f-430c-9e97-f0aa5b9ae0a3.9759ce64-400e-4e53-8cf5-613b2409a1c1.c00e43ce-79c2-48ee-8b92-639a6c9ade44 HTTP/1.1
Host: 192.168.32.132
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Cookie: connect.sid=s%3AhkFnuXd3uHPZym3mvFd2v6v2_bEmOYCm.jAeQvvN%2FZP7%2F9hV77wBI80pi%2B7T9CJo4LENc9kF5eSc

HTTP/1.1 301 Moved Permanently
Server: nginx
Location: https://192.168.32.132/login?auth_callback=1&state=eb22b4f5-e262-4deb-8e7d-f483ec1af553&session_state=9759ce64-400e-4e53-8cf5-613b2409a1c1&code=854efde1-71dc-4052-a0ad-7503ea3af7e4.9759ce64-400e-4e53-8cf5-613b2409a1c1.c00e43ce-79c2-48ee-8b92-639a6c9ade44&auth_callback=1&state=30d7d290-e967-488d-887c-b6eec1cc5d27&session_state=9759ce64-400e-4e53-8cf5-613b2409a1c1&code=089d3ff9-702f-430c-9e97-f0aa5b9ae0a3.9759ce64-400e-4e53-8cf5-613b2409a1c1.c00e43ce-79c2-48ee-8b92-639a6c9ade44
Strict-Transport-Security: max-age=31536000; includeSubdomains;

GET /login?auth_callback=1&state=eb22b4f5-e262-4deb-8e7d-f483ec1af553&session_state=9759ce64-400e-4e53-8cf5-613b2409a1c1&code=854efde1-71dc-4052-a0ad-7503ea3af7e4.9759ce64-400e-4e53-8cf5-613b2409a1c1.c00e43ce-79c2-48ee-8b92-639a6c9ade44&auth_callback=1&state=30d7d290-e967-488d-887c-b6eec1cc5d27&session_state=9759ce64-400e-4e53-8cf5-613b2409a1c1&code=089d3ff9-702f-430c-9e97-f0aa5b9ae0a3.9759ce64-400e-4e53-8cf5-613b2409a1c1.c00e43ce-79c2-48ee-8b92-639a6c9ade44&auth_callback=1&state=d60d22a4-7098-4f6c-8974-0fd98d65d247&session_state=9759ce64-400e-4e53-8cf5-613b2409a1c1&code=27f41194-4dda-412c-b35c-f3e4ad9f987a.9759ce64-400e-4e53-8cf5-613b2409a1c1.c00e43ce-79c2-48ee-8b92-639a6c9ade44 HTTP/1.1
Host: 192.168.32.132
etc.


What is the problem with the server setup ?




From s.booth at epcc.ed.ac.uk  Fri Jul 19 08:47:01 2019
From: s.booth at epcc.ed.ac.uk (BOOTH Stephen)
Date: Fri, 19 Jul 2019 12:47:01 +0000
Subject: [keycloak-user] How to increase logging authenticating against
	remote IdP
Message-ID: <5365f25c-660c-43ec-06a6-7be4190b3829@epcc.ed.ac.uk>

I'm trying to get keycloak to use an existing application
as an Idp by writing just enough oidc to allow keycloak to authenticate 
but I'm having difficulty debugging as keycloak is not very informative 
when its not happy with a response from the IdP

Pretty much the only info I'm getting is "Invalid Request"


  13:06:51,042 WARN  [org.keycloak.events] (default task-2) 
type=IDENTITY_PROVIDER_LOGIN_ERROR, realmId=openidctest, clientId=null, 
userId=null, ipAddress=127.0.0.1, error=invalidRequestMessage
13:06:51,042 ERROR 
[org.keycloak.services.resources.IdentityBrokerService] (default task-2) 
invalidRequestMessage

I can see my authorization token and userinfo endpoints being called
(userinfo is not called if I disable this in the keycloak settings)

Does anyone have any tips on how to get more debugging info out of 
keycloak other than attaching a debugger and trying to single step through.

			Stephen

-- 
======================================================================
|epcc| Dr Stephen P Booth             Principal Architect       |epcc|
|epcc| s.booth at epcc.ed.ac.uk          Phone 0131 650 5746       |epcc|
======================================================================
--
The University of Edinburgh is a charitable body, registered in
Scotland, with registration number SC005336.


From ssilvert at redhat.com  Fri Jul 19 15:42:37 2019
From: ssilvert at redhat.com (Stan Silvert)
Date: Fri, 19 Jul 2019 15:42:37 -0400
Subject: [keycloak-user] [EXTERNAL] Re: Trust between two standalone
 Keycloak Instances
In-Reply-To: <387E1325-20A7-43F8-89D3-B0562910E707@veritas.com>
References: <D55B0359-78C8-4431-B7D7-C4DE13A2D8D0@contoso.com>
	<b26f4842-29be-4f7f-5421-7a7f59825bb6@redhat.com>
	<C30F34E8-4658-47BE-9F05-CB9BCAA5B9EE@veritas.com>
	<aade7cf1-a3a2-3a79-d190-19bc2668b04f@redhat.com>
	<387E1325-20A7-43F8-89D3-B0562910E707@veritas.com>
Message-ID: <ad604ef2-01b7-6acc-0b47-e60967db41b3@redhat.com>

On 7/18/2019 2:38 PM, Aditya Bhole wrote:
> Hi Stan,
>
> We have 3 enterprise products deployed in their own environments. Now, some of our clients use all three products, some use just one and some use any two of them. Each product is a separate with its own bundled software and not related to the others. So what we want to do is to include Keycloak in each bundle. But there are cases where even from these unrelated products, we need an option for cross product transition.
So your customers should just install one instance of Keycloak.? If they 
want all three products to have SSO with each other then all the users 
should be in the same realm.? If they don't want SSO then each 
application would connect to a different realm.? But it could all be 
done with a single instance (or a clustered, redundant instance).

I get the impression that your product is running on the same instance 
as Keycloak?? That is not recommended.

My advice is not to let the packaging dictate the architecture.? It 
sounds like you will be forcing your customers to manage users spread 
across as many as three Keycloak instances.? I'm sure they would rather 
manage all their users in one place.

You haven't said why you might need domain mode.? Note that domain mode 
is not required for clustering Keycloak.? If you have only a handful of 
Keycloak instances, standalone clustered mode is simpler.? It sounds 
like that's the situation you are in.

If you are bound and determined to do things the hard way, look at the 
documentation on identity brokering in the Server Admin guide. It is 
possible to establish trust between Keycloak realms regardless of 
whether the realms live on the same instance or on different instances.


>
> For that to happen, we need to establish trust between all these separate Keycloak instances. So even if we deploy a new product with Keycloak in its bundle, we would just need to establish trust with the existing system of Keycloak Instances. So is there a way that a token generated by one of the Keycloak instances is accepted by the other Keycloak instances?
>
> Also, in domain mode, if we deploy two Keycloak instances separately as master, later if we decide to keep one as master and make the other one a slave, is that possible?
>
> And about the local settings, say for example, if I had to connect an LDAP for just one of the hosts, can that be done?
>
> Thanks,
> Aditya
>
> On 7/17/19, 3:05 PM, "keycloak-user-bounces at lists.jboss.org on behalf of Stan Silvert" <keycloak-user-bounces at lists.jboss.org on behalf of ssilvert at redhat.com> wrote:
>
> Yes, it can be done, but I still don't understand why you would want to
>      do it this way.  You can also establish trust between two realms on the
>      same server.  That way, you don't need multiple instances of Keycloak to
>      have the apps be fully walled off from each other.
>      
>      That being said, I still don't understand why you wouldn't just do it
>      the easy way.  Are you saying that sometimes you want SSO and sometimes
>      you don't?  I must be missing something from your use case.
>      
>      Lastly, the domain features of WildFly are just used to centrally manage
>      instances of the server.  These servers can be configured any way you
>      want.  I guess this depends on what you mean by "local settings".
>
>
>      On 7/16/2019 1:26 PM, Aditya Bhole wrote:
>      > I understand that deploying 3 clients under one realm will easily enable SSO. Even if we keep the clients in different realms, cross-realm trust can be established. But the use case of our prototype wants the clients to be on different servers. I?ll try to explain as best as I can.
>      >
>      > Our company has 3 products deployed independently and these are managed by different administrators. Sometimes these have to be integrated with each other for seamless cross product experience at which time we would want SSO between the individual product UIs. We intend to use Keycloak as a broker for authentication and to achieve SSO. So that?s why I wanted to know if trust between two standalone Keycloak instances can be established.
>      >
>      > Also, if we deploy the domain controller, can there still be local settings on the different Keycloak instances?
>      >
>      > Thanks,
>      > Aditya
>      
>      >
>      > On 7/15/19, 12:25 PM, "keycloak-user-bounces at lists.jboss.org on behalf of Stan Silvert" <keycloak-user-bounces at lists.jboss.org on behalf of ssilvert at redhat.com> wrote:
>      >
>      >      Why do you need each to have its own Keycloak instance?  A usual setup
>      >      would define all three clients in the same realm under the same Keycloak
>      >      instance.
>      >
>      >      On 7/15/2019 1:23 PM, Aditya Bhole wrote:
>      >      > Hello,
>      >      >
>      >      > I?m new to Keycloak and building a prototype SSO framework for my company. The use case is that my company has 3 clients; A, B and C. Now each client is going to have its own Keycloak instance; KA, KB and KC. Now what I want is when I login through client A I should be logged into client B and C as well. And same goes for all the clients. So for this to happen, is there a way of establishing trust between these three Keycloak instances KA, KB and KC?
>      >      > I?ve successfully established an SSO by using KA as a broker and KB as an IDP. But this is only a master slave kind-of an architecture. When I log in to A, I?m automatically logged into B. But if I log into B, I won?t be automatically logged into A. Is it possible for KA to be a broker for KB and KB to be a broker for KA at the same time?
>      >      > TL;DR :
>      >      > Is there a way where Keycloak only acts as a broker and trust is established between multiple such Keycloak instances?
>      >      >
>      >      > I hope my question makes sense. Please point me in the right direction if I?m looking at this in the wrong way.
>      >      >
>      >      > Thanks,
>      >      > Aditya
>      >      >
>      >      > _______________________________________________
>      >      > keycloak-user mailing list
>      >      > keycloak-user at lists.jboss.org
>      >      > https://lists.jboss.org/mailman/listinfo/keycloak-user
>      >
>      >
>      >      _______________________________________________
>      >      keycloak-user mailing list
>      >      keycloak-user at lists.jboss.org
>      >      https://lists.jboss.org/mailman/listinfo/keycloak-user
>      >
>      >
>      > _______________________________________________
>      > keycloak-user mailing list
>      > keycloak-user at lists.jboss.org
>      > https://lists.jboss.org/mailman/listinfo/keycloak-user
>      
>      
>      _______________________________________________
>      keycloak-user mailing list
>      keycloak-user at lists.jboss.org
>      https://lists.jboss.org/mailman/listinfo/keycloak-user
>
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user



From Mitchell.S.Bowers at kp.org  Fri Jul 19 16:27:04 2019
From: Mitchell.S.Bowers at kp.org (Mitchell S Bowers)
Date: Fri, 19 Jul 2019 20:27:04 +0000
Subject: [keycloak-user] Keycloak with Ping Identity OpenID Connect Provider
Message-ID: <CO1P109MB0199D6C28312E3CE659504D9C6CB0@CO1P109MB0199.NAMP109.PROD.OUTLOOK.COM>

Hello,

Is there any documentation on configuring Keycloak to use Ping as an external OIDC provider? I've used the documentation provided for Okta, which should be essentially the same.

However, we are experiencing issues (specifically token issuance and logout). Any info would be greatly appreciated.

https://ultimatesecurity.pro/post/okta-oidc/

Thanks - Mitchell

NOTICE TO RECIPIENT:  If you are not the intended recipient of this e-mail, you are prohibited from sharing, copying, or otherwise using or disclosing its contents.  If you have received this e-mail in error, please notify the sender immediately by reply e-mail and permanently delete this e-mail and any attachments without reading, forwarding or saving them.  Thank you.

From edewolff at gmail.com  Sun Jul 21 00:36:42 2019
From: edewolff at gmail.com (Erwin de Wolff)
Date: Sun, 21 Jul 2019 06:36:42 +0200
Subject: [keycloak-user] Token store cookie too slow for large tokens?
Message-ID: <CAOFba1ZrXehPwqDt8wA2qFHmS+RRfoNPi6CPWWwU+j7EE0+5KA@mail.gmail.com>

Hi,

I've configured wildfly 16 with keycloak 6.0.1 with token-store cookie.
Everything works fine, until the number of roles of increased to 30+. It
appears that the check if the token exists fails direct after the
successful authentication and a new authentication is started etc.
Resulting in a too many redirections error in the browser. Is this a known
issue?

Using wildfly 10.1 and keycloak 4.8.3 results in an out of memory exception
NIO.

Best Regards

From mgeorge at dspace.de  Mon Jul 22 02:40:10 2019
From: mgeorge at dspace.de (Mathew George)
Date: Mon, 22 Jul 2019 06:40:10 +0000
Subject: [keycloak-user] Create users in the imported real using helm
Message-ID: <3EA94E88DDCA184497D91E288100DD2201ABAA7BD9@Exchange2010.dspace.de>

Hello,

I am using keycloak helm charts for installing keycloak in our cluster and I am able to import a custom realm as described in the documentation. Now I want to create some users in this custom realm. I tried using the 'prestartScript'.  See the contents of my value.yaml


  extraVolumes: |
    - name: realm-secret
      secret:
        secretName: realm-secret

  extraVolumeMounts: |
    - name: realm-secret
      mountPath: "/realm/"
      readOnly: true

  extraArgs: -Dkeycloak.import=/realm/realmData.json

  preStartScript: |
    /opt/jboss/keycloak/bin/kcadm.sh create users -r MyCustomRealm -s username=admin -s enabled=true;/opt/jboss/keycloak/bin/kcadm.sh set-password -r MyCustomRealm --username admin --new-password admin;
  enabled: false



But this is not working. I also tried the following command in the 'preStartScript'. ( This is also not working)

/opt/jboss/keycloak/bin/add-user-keycloak.sh -r MyCustomRealm -u admin -p admin


Kindly provide inputs.


Best regards

[cid:image001.png at 01D54069.121BC050]

Mathew George
Experiment Software ECTA

dSPACE GmbH
Rathenaustra?e 26
33102 Paderborn

Tel.: +49 5251 1638-507
Fax: +49 5251 16198-0
Mail: mgeorge at dspace.de<mailto:mgeorge at dspace.de>
Web: www.dspace.com<http://www.dspace.com>


We comply with our obligation to inform you about data protection according to Art. 13-14 of the GDPR by publishing said information on our website. Read our data protection regulations here<https://www.dspace.com/en/pub/home/privacypolicy.cfm>.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.png
Type: image/png
Size: 3439 bytes
Desc: image001.png
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20190722/b929233a/attachment-0001.png 

From tony.yip at shinetown.com.hk  Mon Jul 22 03:06:53 2019
From: tony.yip at shinetown.com.hk (Tony Yip)
Date: Mon, 22 Jul 2019 15:06:53 +0800
Subject: [keycloak-user] Create users in the imported real using helm
In-Reply-To: <3EA94E88DDCA184497D91E288100DD2201ABAA7BD9@Exchange2010.dspace.de>
References: <3EA94E88DDCA184497D91E288100DD2201ABAA7BD9@Exchange2010.dspace.de>
Message-ID: <59D6B1B0-516C-4FF0-AFF7-CEC7554F0805@shinetown.com.hk>

Hi Mathew,

According to e35e046 <https://github.com/helm/charts/commit/e35e046cf78c89d800362dd97fbd761d2c892a70> of https://github.com/helm/charts/blob/master/stable/keycloak/templates/configmap.yaml <https://github.com/helm/charts/blob/master/stable/keycloak/templates/configmap.yaml>, the preStartScript is executed (line 20) before the realm is import (line 24). You may import user with realm data.

Tony Yip
Frontend Developer

Shinetown Telecommunication Limited
https://shinetown.com.hk/ <https://shinetown.com.hk/>

> On 22 Jul 2019, at 2:40 PM, Mathew George <mgeorge at dspace.de> wrote:
> 
> Hello,
> 
> I am using keycloak helm charts for installing keycloak in our cluster and I am able to import a custom realm as described in the documentation. Now I want to create some users in this custom realm. I tried using the 'prestartScript'.  See the contents of my value.yaml
> 
> 
>  extraVolumes: |
>    - name: realm-secret
>      secret:
>        secretName: realm-secret
> 
>  extraVolumeMounts: |
>    - name: realm-secret
>      mountPath: "/realm/"
>      readOnly: true
> 
>  extraArgs: -Dkeycloak.import=/realm/realmData.json
> 
>  preStartScript: |
>    /opt/jboss/keycloak/bin/kcadm.sh create users -r MyCustomRealm -s username=admin -s enabled=true;/opt/jboss/keycloak/bin/kcadm.sh set-password -r MyCustomRealm --username admin --new-password admin;
>  enabled: false
> 
> 
> 
> But this is not working. I also tried the following command in the 'preStartScript'. ( This is also not working)
> 
> /opt/jboss/keycloak/bin/add-user-keycloak.sh -r MyCustomRealm -u admin -p admin
> 
> 
> Kindly provide inputs.
> 
> 
> Best regards
> 
> [cid:image001.png at 01D54069.121BC050]
> 
> Mathew George
> Experiment Software ECTA
> 
> dSPACE GmbH
> Rathenaustra?e 26
> 33102 Paderborn
> 
> Tel.: +49 5251 1638-507
> Fax: +49 5251 16198-0
> Mail: mgeorge at dspace.de<mailto:mgeorge at dspace.de>
> Web: www.dspace.com<http://www.dspace.com>
> 
> 
> We comply with our obligation to inform you about data protection according to Art. 13-14 of the GDPR by publishing said information on our website. Read our data protection regulations here<https://www.dspace.com/en/pub/home/privacypolicy.cfm>.
> <image001.png>_______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user


From mgeorge at dspace.de  Mon Jul 22 03:30:28 2019
From: mgeorge at dspace.de (Mathew George)
Date: Mon, 22 Jul 2019 07:30:28 +0000
Subject: [keycloak-user] Create users in the imported real using helm
In-Reply-To: <59D6B1B0-516C-4FF0-AFF7-CEC7554F0805@shinetown.com.hk>
References: <3EA94E88DDCA184497D91E288100DD2201ABAA7BD9@Exchange2010.dspace.de>
	<59D6B1B0-516C-4FF0-AFF7-CEC7554F0805@shinetown.com.hk>
Message-ID: <3EA94E88DDCA184497D91E288100DD2201ABAA7BFD@Exchange2010.dspace.de>

Hello Tony,

Thanks for the speedy response. I tried to export our custom realm, but the ?JSON? file does not contain any users. Is there anyway to export a realm with users, so that I can import it.

Best regards

[cid:image002.png at 01D54070.1902B3E0]

Mathew George
Experiment Software ECTA

dSPACE GmbH
Rathenaustra?e 26
33102 Paderborn

Tel.: +49 5251 1638-507
Fax: +49 5251 16198-0
Mail: mgeorge at dspace.de<mailto:mgeorge at dspace.de>
Web: www.dspace.com<http://www.dspace.com>


We comply with our obligation to inform you about data protection according to Art. 13-14 of the GDPR by publishing said information on our website. Read our data protection regulations here<https://www.dspace.com/en/pub/home/privacypolicy.cfm>.
From: Tony Yip <tony.yip at shinetown.com.hk>
Sent: Monday, July 22, 2019 9:07 AM
To: Mathew George <mgeorge at dspace.de>
Cc: keycloak-user at lists.jboss.org
Subject: Re: [keycloak-user] Create users in the imported real using helm

Hi Mathew,

According to e35e046<https://github.com/helm/charts/commit/e35e046cf78c89d800362dd97fbd761d2c892a70> of https://github.com/helm/charts/blob/master/stable/keycloak/templates/configmap.yaml, the preStartScript is executed (line 20) before the realm is import (line 24). You may import user with realm data.

Tony Yip
Frontend Developer

Shinetown Telecommunication Limited
https://shinetown.com.hk/


On 22 Jul 2019, at 2:40 PM, Mathew George <mgeorge at dspace.de<mailto:mgeorge at dspace.de>> wrote:

Hello,

I am using keycloak helm charts for installing keycloak in our cluster and I am able to import a custom realm as described in the documentation. Now I want to create some users in this custom realm. I tried using the 'prestartScript'.  See the contents of my value.yaml


 extraVolumes: |
   - name: realm-secret
     secret:
       secretName: realm-secret

 extraVolumeMounts: |
   - name: realm-secret
     mountPath: "/realm/"
     readOnly: true

 extraArgs: -Dkeycloak.import=/realm/realmData.json

 preStartScript: |
   /opt/jboss/keycloak/bin/kcadm.sh create users -r MyCustomRealm -s username=admin -s enabled=true;/opt/jboss/keycloak/bin/kcadm.sh set-password -r MyCustomRealm --username admin --new-password admin;
 enabled: false



But this is not working. I also tried the following command in the 'preStartScript'. ( This is also not working)

/opt/jboss/keycloak/bin/add-user-keycloak.sh -r MyCustomRealm -u admin -p admin


Kindly provide inputs.


Best regards

[cid:image001.png at 01D54069.121BC050]

Mathew George
Experiment Software ECTA

dSPACE GmbH
Rathenaustra?e 26
33102 Paderborn

Tel.: +49 5251 1638-507
Fax: +49 5251 16198-0
Mail: mgeorge at dspace.de<mailto:mgeorge at dspace.de><mailto:mgeorge at dspace.de>
Web: www.dspace.com<http://www.dspace.com><http://www.dspace.com>


We comply with our obligation to inform you about data protection according to Art. 13-14 of the GDPR by publishing said information on our website. Read our data protection regulations here<https://www.dspace.com/en/pub/home/privacypolicy.cfm>.
<image001.png>_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user

-------------- next part --------------
A non-text attachment was scrubbed...
Name: image002.png
Type: image/png
Size: 3439 bytes
Desc: image002.png
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20190722/8bef1041/attachment.png 

From external.Benjamin.Weimer at bosch-si.com  Mon Jul 22 05:06:46 2019
From: external.Benjamin.Weimer at bosch-si.com (EXTERNAL Weimer Benjamin (TNG, INST-CSS/BSV-OS2))
Date: Mon, 22 Jul 2019 09:06:46 +0000
Subject: [keycloak-user] realm-management client role "view-realm"
 needed to view/edit a user?
In-Reply-To: <b8c3e421-2897-825e-7a33-5a83ac71927a@redhat.com>
References: <b9cdb7129b034640a55ab5d90678c2c6@bosch-si.com>
	<VI1P192MB0239576ED1745C3E9248B716B1C90@VI1P192MB0239.EURP192.PROD.OUTLOOK.COM>
	<016be823832845ebb230b6e6598008f6@bosch-si.com>
	<e106d6c36a1a42b3bd7d83f84ee8ed97@bosch-si.com>
	<b8c3e421-2897-825e-7a33-5a83ac71927a@redhat.com>
Message-ID: <c66befff3ae841ec9401f2201285f884@bosch-si.com>

Hi Ricardo,

My last answer was not correct, I tested it with version 4.8.3 of Keycloak. With the recent version 6.0.1 it works as you described. Thanks for your answer!

Best regards
Benjamin Weimer



-----Urspr?ngliche Nachricht-----
Von: Ricardo Martin Camarero <rmartinc at redhat.com> 
Gesendet: Mittwoch, 17. Juli 2019 21:30
An: Schuster Sebastian (INST-CSS/BSV-OS2) <Sebastian.Schuster at bosch-si.com>; EXTERNAL Weimer Benjamin (TNG, INST-CSS/BSV-OS2) <external.Benjamin.Weimer at bosch-si.com>; Huw McNamara <huwmcnamara at msn.com>; keycloak-user at lists.jboss.org
Betreff: Re: [keycloak-user] realm-management client role "view-realm" needed to view/edit a user?

Hi,

I think that in order to edit users you need "manage-users" and "query-users". Try adding "query-users" permission to the administrator (and removing the "view-realm").

Best regards!

On 7/17/19 6:52 PM, Schuster Sebastian (INST-CSS/BSV-OS2) wrote:
> I assume this issue is fixed in 6.0.1 with this PR: 
> https://github.com/keycloak/keycloak/pull/5893/files
>
> Best regards,
> Sebastian
>
> Mit freundlichen Gr??en / Best regards
>
> Dr.-Ing. Sebastian Schuster
>
> Open Source Services (INST-CSS/BSV-OS2) Bosch?Software Innovations?
> GmbH | Ullsteinstr. 128 | 12109 Berlin | GERMANY | www.bosch-si.com 
> Tel. +49 30 726112-485 | Mobil +49 152 02177668 | Fax +49 30 
> 726112-100 | Sebastian.Schuster at bosch-si.com
>
> Sitz: Berlin, Registergericht: Amtsgericht Charlottenburg; HRB 148411 
> B
> Aufsichtsratsvorsitzender: Dr.-Ing. Thorsten L?cke; Gesch?ftsf?hrung: 
> Dr. Stefan Ferber, Michael Hahn, Dr. Aleksandar Mitrovic
>
>
>
>
> -----Urspr?ngliche Nachricht-----
> Von: keycloak-user-bounces at lists.jboss.org 
> <keycloak-user-bounces at lists.jboss.org> Im Auftrag von EXTERNAL Weimer 
> Benjamin (TNG, INST-CSS/BSV-OS2)
> Gesendet: Mittwoch, 17. Juli 2019 17:43
> An: Huw McNamara <huwmcnamara at msn.com>; keycloak-user at lists.jboss.org
> Betreff: Re: [keycloak-user] realm-management client role "view-realm" needed to view/edit a user?
>
> Hi Huw,
>
> Thanks for your reply! I added the info to the JIRA ticket.
>
> Best regards
> Benjamin
>
> Von: Huw McNamara <huwmcnamara at msn.com>
> Gesendet: Mittwoch, 17. Juli 2019 17:32
> An: EXTERNAL Weimer Benjamin (TNG, INST-CSS/BSV-OS2) 
> <external.Benjamin.Weimer at bosch-si.com>; keycloak-user at lists.jboss.org
> Betreff: Re: [keycloak-user] realm-management client role "view-realm" needed to view/edit a user?
>
> Hi Benjamin,
>
> There's an open bug for view-realm being needed to access the credentials tab for clients https://issues.jboss.org/browse/KEYCLOAK-10782.
> Maybe they are related and you could add the info to the JIRA ticket? Although fine grain permissions are tech preview.
>
> Thanks,
> Huw
>
> ________________________________
> From: 
> keycloak-user-bounces at lists.jboss.org<mailto:keycloak-user-bounces at lis
> ts.jboss.org> 
> <keycloak-user-bounces at lists.jboss.org<mailto:keycloak-user-bounces at li
> sts.jboss.org>> on behalf of EXTERNAL Weimer Benjamin (TNG, 
> INST-CSS/BSV-OS2) 
> <external.Benjamin.Weimer at bosch-si.com<mailto:external.Benjamin.Weimer
> @bosch-si.com>>
> Sent: 17 July 2019 15:39
> To: 
> keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>
> Subject: [keycloak-user] realm-management client role "view-realm" needed to view/edit a user?
>
> Hi all,
>
> we are using fine grain permissions in Keycloak to set the rights to edit certain users and have noticed that the roles "manage-users" and "query-realm" of the "realm-management" client are not sufficient to view and edit single users. The "view-realm" role seems to be needed for that. Can you explain me why this role is needed for this action?
>
> Best regards and thanks in advance
> Benjamin Weimer
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>
> https://lists.jboss.org/mailman/listinfo/keycloak-user
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user




From alvaro.gomez.gimenez at tecsisa.com  Mon Jul 22 08:42:38 2019
From: alvaro.gomez.gimenez at tecsisa.com (=?UTF-8?B?w4FsdmFybyBHw7NtZXo=?=)
Date: Mon, 22 Jul 2019 14:42:38 +0200
Subject: [keycloak-user] Questions about scope-permissions and resource types
Message-ID: <CAPcMcKaULsBqijJqaAwzuM=+r6UMMt1wuOApMGktL=qw084Hsw@mail.gmail.com>

Hi,

We are using UMA and scope-permissions to manage fine grained access to
resources. We've
noticed that we can specify a set of involved resources when defining
scope-permissions (The UI
only supports specifying a single resource but the API allows defining a
set of resources).

Referencing the involved resources in a scope-permission using a fixed list
could be problematic
if the size of that list is big enough. We think it would be useful to
group all the resources using a
resource-type and specify that resource-type in the scope-permission as one
can do in a
resource-permission. Is there any reason why this is not supported in a
scope-permission?

Having a resource type reference available in scope-permissions would be
useful solving the following scenario:

* Given a large amount of bank accounts, each one represented by a resource
(associated with some
  scopes like read, update or delete) in the Resource Server and owned by
an specific user.
* Users can manage their own accounts following the UMA rules (Sharing
specific scopes of their
  accounts with other users).
* Some user with an Administrator role should be able to read ALL accounts
without having them
  shared with him and without needing to update any permission when a new
bank account is created.

We would like to "group" all accounts using a resource-type and define a
single permission "can-read-bank-account"
which grants access to the scope read of all bank accounts to the owner
(via JS policy) and to any administrator
user (using a role policy). If we protect the following endpoint:

GET /accounts/3273af-544b3940-211da3

, using the resource "bank-account-3273af-544b3940-211da3" and the scope
"read", both the resource owner
and the Administrator user must be granted when evaluating the permission
"can-read-bank-account".

From psilva at redhat.com  Mon Jul 22 09:15:11 2019
From: psilva at redhat.com (Pedro Igor Silva)
Date: Mon, 22 Jul 2019 10:15:11 -0300
Subject: [keycloak-user] Questions about scope-permissions and resource
	types
In-Reply-To: <CAPcMcKaULsBqijJqaAwzuM=+r6UMMt1wuOApMGktL=qw084Hsw@mail.gmail.com>
References: <CAPcMcKaULsBqijJqaAwzuM=+r6UMMt1wuOApMGktL=qw084Hsw@mail.gmail.com>
Message-ID: <CAJrcDBdqcqaS7iiXuvYt=C4u-WnyOGFW3Na+S-a5RS3PYjZsEA@mail.gmail.com>

Hi ?lvaro,

There is no restriction for doing that. I think this issue is related:
https://issues.jboss.org/browse/KEYCLOAK-10663.

Regards.
Pedro Igor

On Mon, Jul 22, 2019 at 9:55 AM ?lvaro G?mez <
alvaro.gomez.gimenez at tecsisa.com> wrote:

> Hi,
>
> We are using UMA and scope-permissions to manage fine grained access to
> resources. We've
> noticed that we can specify a set of involved resources when defining
> scope-permissions (The UI
> only supports specifying a single resource but the API allows defining a
> set of resources).
>
> Referencing the involved resources in a scope-permission using a fixed list
> could be problematic
> if the size of that list is big enough. We think it would be useful to
> group all the resources using a
> resource-type and specify that resource-type in the scope-permission as one
> can do in a
> resource-permission. Is there any reason why this is not supported in a
> scope-permission?
>
> Having a resource type reference available in scope-permissions would be
> useful solving the following scenario:
>
> * Given a large amount of bank accounts, each one represented by a resource
> (associated with some
>   scopes like read, update or delete) in the Resource Server and owned by
> an specific user.
> * Users can manage their own accounts following the UMA rules (Sharing
> specific scopes of their
>   accounts with other users).
> * Some user with an Administrator role should be able to read ALL accounts
> without having them
>   shared with him and without needing to update any permission when a new
> bank account is created.
>
> We would like to "group" all accounts using a resource-type and define a
> single permission "can-read-bank-account"
> which grants access to the scope read of all bank accounts to the owner
> (via JS policy) and to any administrator
> user (using a role policy). If we protect the following endpoint:
>
> GET /accounts/3273af-544b3940-211da3
>
> , using the resource "bank-account-3273af-544b3940-211da3" and the scope
> "read", both the resource owner
> and the Administrator user must be granted when evaluating the permission
> "can-read-bank-account".
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

From psilva at redhat.com  Mon Jul 22 11:01:54 2019
From: psilva at redhat.com (Pedro Igor Silva)
Date: Mon, 22 Jul 2019 12:01:54 -0300
Subject: [keycloak-user] Token store cookie too slow for large tokens?
In-Reply-To: <CAOFba1ZrXehPwqDt8wA2qFHmS+RRfoNPi6CPWWwU+j7EE0+5KA@mail.gmail.com>
References: <CAOFba1ZrXehPwqDt8wA2qFHmS+RRfoNPi6CPWWwU+j7EE0+5KA@mail.gmail.com>
Message-ID: <CAJrcDBfhCPBrmq2KGX+4q9DuLQ09=Cf0LSAOuVeBgEYcukT3Mg@mail.gmail.com>

Hi,

I think you reached cookie max limit. Do you know the size of
the KEYCLOAK_ADAPTER_STATE ?

On Sun, Jul 21, 2019 at 1:39 AM Erwin de Wolff <edewolff at gmail.com> wrote:

> Hi,
>
> I've configured wildfly 16 with keycloak 6.0.1 with token-store cookie.
> Everything works fine, until the number of roles of increased to 30+. It
> appears that the check if the token exists fails direct after the
> successful authentication and a new authentication is started etc.
> Resulting in a too many redirections error in the browser. Is this a known
> issue?
>
> Using wildfly 10.1 and keycloak 4.8.3 results in an out of memory exception
> NIO.
>
> Best Regards
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

From luis.villaca at petrobras.com.br  Mon Jul 22 11:05:58 2019
From: luis.villaca at petrobras.com.br (luis.villaca at petrobras.com.br)
Date: Mon, 22 Jul 2019 12:05:58 -0300
Subject: [keycloak-user] [EXTERNAL] Re: Trust between two standalone
 Keycloak Instances
In-Reply-To: <387E1325-20A7-43F8-89D3-B0562910E707@veritas.com>
References: <D55B0359-78C8-4431-B7D7-C4DE13A2D8D0@contoso.com><b26f4842-29be-4f7f-5421-7a7f59825bb6@redhat.com><C30F34E8-4658-47BE-9F05-CB9BCAA5B9EE@veritas.com><aade7cf1-a3a2-3a79-d190-19bc2668b04f@redhat.com>
	<387E1325-20A7-43F8-89D3-B0562910E707@veritas.com>
Message-ID: <OF337F35FC.C2073093-ON8325843F.004D7865-8325843F.0052F1C6@LocalDomain>

Hi Aditya,

Related to this comment:
> I?ve successfully established an SSO by using KA as a broker and KB as an
IDP. But this is only a master slave kind-of an architecture. When I log in
to A, I?m automatically logged into B. But if I log into B, I won?t be
automatically logged into A. Is it possible for KA to be a broker for KB
and KB to be a broker for KA at the same time?

First, let me say Stan comments makes a lot of sense to me - I was also not
convinced yet that you really need different instances/realms.
It seems to me the transition for the calls between your products would be
handled fine with a single realm. Yet, I am sharing my (short) experience
if you do..

In my case, I created realms isolating calls to our corporate
authentication + authorization services (re-evaluating it btw).  So I
created different realms, where each one maintains users with different
roles (related to different solutions we have - each solution holds many
systems). Those roles are shared among clients from each realm (e.g.
microservices).
I also created one authentication-only realm - in my case with a user
federation plugin that calls our corporate authentication Service (maybe
LDAP for you).

So all realms delegate authentication (via identity provider, pointing to
the same broker) to this authentication-only realm, and this way we achieve
SSO.



Regards,
Luis


De:	"Aditya Bhole" <Aditya.Bhole at veritas.com>
Para:	"keycloak-user at lists.jboss.org" <keycloak-user at lists.jboss.org>
Data:	18/07/2019 19:23
Assunto:	Re: [keycloak-user] [EXTERNAL] Re: Trust between two standalone
            Keycloak Instances
Enviado por:	keycloak-user-bounces at lists.jboss.org



Hi Stan,

We have 3 enterprise products deployed in their own environments. Now, some
of our clients use all three products, some use just one and some use any
two of them. Each product is a separate with its own bundled software and
not related to the others. So what we want to do is to include Keycloak in
each bundle. But there are cases where even from these unrelated products,
we need an option for cross product transition.

For that to happen, we need to establish trust between all these separate
Keycloak instances. So even if we deploy a new product with Keycloak in its
bundle, we would just need to establish trust with the existing system of
Keycloak Instances. So is there a way that a token generated by one of the
Keycloak instances is accepted by the other Keycloak instances?

Also, in domain mode, if we deploy two Keycloak instances separately as
master, later if we decide to keep one as master and make the other one a
slave, is that possible?

And about the local settings, say for example, if I had to connect an LDAP
for just one of the hosts, can that be done?

Thanks,
Aditya

On 7/17/19, 3:05 PM, "keycloak-user-bounces at lists.jboss.org on behalf of
Stan Silvert" <keycloak-user-bounces at lists.jboss.org on behalf of
ssilvert at redhat.com> wrote:

Yes, it can be done, but I still don't understand why you would want to
    do it this way.  You can also establish trust between two realms on the

    same server.  That way, you don't need multiple instances of Keycloak
to
    have the apps be fully walled off from each other.

    That being said, I still don't understand why you wouldn't just do it
    the easy way.  Are you saying that sometimes you want SSO and sometimes

    you don't?  I must be missing something from your use case.

    Lastly, the domain features of WildFly are just used to centrally
manage
    instances of the server.  These servers can be configured any way you
    want.  I guess this depends on what you mean by "local settings".


    On 7/16/2019 1:26 PM, Aditya Bhole wrote:
    > I understand that deploying 3 clients under one realm will easily
enable SSO. Even if we keep the clients in different realms, cross-realm
trust can be established. But the use case of our prototype wants the
clients to be on different servers. I?ll try to explain as best as I can.
    >
    > Our company has 3 products deployed independently and these are
managed by different administrators. Sometimes these have to be integrated
with each other for seamless cross product experience at which time we
would want SSO between the individual product UIs. We intend to use
Keycloak as a broker for authentication and to achieve SSO. So that?s why I
wanted to know if trust between two standalone Keycloak instances can be
established.
    >
    > Also, if we deploy the domain controller, can there still be local
settings on the different Keycloak instances?
    >
    > Thanks,
    > Aditya

    >
    > On 7/15/19, 12:25 PM, "keycloak-user-bounces at lists.jboss.org on
behalf of Stan Silvert" <keycloak-user-bounces at lists.jboss.org on behalf of
ssilvert at redhat.com> wrote:
    >
    >      Why do you need each to have its own Keycloak instance?  A usual
setup
    >      would define all three clients in the same realm under the same
Keycloak
    >      instance.
    >
    >      On 7/15/2019 1:23 PM, Aditya Bhole wrote:
    >      > Hello,
    >      >
    >      > I?m new to Keycloak and building a prototype SSO framework for
my company. The use case is that my company has 3 clients; A, B and C. Now
each client is going to have its own Keycloak instance; KA, KB and KC. Now
what I want is when I login through client A I should be logged into client
B and C as well. And same goes for all the clients. So for this to happen,
is there a way of establishing trust between these three Keycloak instances
KA, KB and KC?
    >      > I?ve successfully established an SSO by using KA as a broker
and KB as an IDP. But this is only a master slave kind-of an architecture.
When I log in to A, I?m automatically logged into B. But if I log into B, I
won?t be automatically logged into A. Is it possible for KA to be a broker
for KB and KB to be a broker for KA at the same time?
    >      > TL;DR :
    >      > Is there a way where Keycloak only acts as a broker and trust
is established between multiple such Keycloak instances?
    >      >
    >      > I hope my question makes sense. Please point me in the right
direction if I?m looking at this in the wrong way.
    >      >
    >      > Thanks,
    >      > Aditya
    >      >
    >      > _______________________________________________
    >      > keycloak-user mailing list
    >      > keycloak-user at lists.jboss.org
    >      > https://lists.jboss.org/mailman/listinfo/keycloak-user
    >
    >
    >      _______________________________________________
    >      keycloak-user mailing list
    >      keycloak-user at lists.jboss.org
    >      https://lists.jboss.org/mailman/listinfo/keycloak-user
    >
    >
    > _______________________________________________
    > keycloak-user mailing list
    > keycloak-user at lists.jboss.org
    > https://lists.jboss.org/mailman/listinfo/keycloak-user


    _______________________________________________
    keycloak-user mailing list
    keycloak-user at lists.jboss.org
    https://lists.jboss.org/mailman/listinfo/keycloak-user


_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
 
"O emitente desta mensagem ? respons?vel por seu conte?do e endere?amento. Cabe ao destinat?rio cuidar quanto ao tratamento adequado. Sem a devida autoriza??o, a divulga??o, a reprodu??o, a distribui??o ou qualquer outra a??o em desconformidade com as normas internas do Sistema Petrobras s?o proibidas e pass?veis de san??o disciplinar, c?vel e criminal."
 
"The sender of this message is responsible for its content and addressing. The receiver shall take proper care of it. Without due authorization, the publication, reproduction, distribution or the performance of  any other action not conforming to Petrobras System internal policies and procedures is forbidden and liable to disciplinary, civil or criminal sanctions."
 
"El emisor de este mensaje es responsable por su contenido y direccionamiento. Cabe al destinatario darle el tratamiento adecuado. Sin la debida autorizaci?n, su divulgaci?n, reproducci?n, distribuci?n o cualquier otra acci?n no conforme a las normas internas del Sistema Petrobras est?n prohibidas y ser?n pasibles de sanci?n disciplinaria, civil y penal."
-------------- next part --------------
A non-text attachment was scrubbed...
Name: graycol.gif
Type: image/gif
Size: 105 bytes
Desc: not available
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20190722/cf04eb82/attachment.gif 

From psilva at redhat.com  Mon Jul 22 11:08:13 2019
From: psilva at redhat.com (Pedro Igor Silva)
Date: Mon, 22 Jul 2019 12:08:13 -0300
Subject: [keycloak-user] Keycloak with Ping Identity OpenID Connect
	Provider
In-Reply-To: <CO1P109MB0199D6C28312E3CE659504D9C6CB0@CO1P109MB0199.NAMP109.PROD.OUTLOOK.COM>
References: <CO1P109MB0199D6C28312E3CE659504D9C6CB0@CO1P109MB0199.NAMP109.PROD.OUTLOOK.COM>
Message-ID: <CAJrcDBcC7s0PPPYtdp-q6GRs=nR7yVA4ZzPtjBy0TXoppjR6ZQ@mail.gmail.com>

Hi,

I have never configured PingIdentity as a broker before, but the
configuration steps should be the same. Could you provide more details
about the issues you are facing? Any specific error in logs?

On Fri, Jul 19, 2019 at 8:14 PM Mitchell S Bowers <Mitchell.S.Bowers at kp.org>
wrote:

> Hello,
>
> Is there any documentation on configuring Keycloak to use Ping as an
> external OIDC provider? I've used the documentation provided for Okta,
> which should be essentially the same.
>
> However, we are experiencing issues (specifically token issuance and
> logout). Any info would be greatly appreciated.
>
> https://ultimatesecurity.pro/post/okta-oidc/
>
> Thanks - Mitchell
>
> NOTICE TO RECIPIENT:  If you are not the intended recipient of this
> e-mail, you are prohibited from sharing, copying, or otherwise using or
> disclosing its contents.  If you have received this e-mail in error, please
> notify the sender immediately by reply e-mail and permanently delete this
> e-mail and any attachments without reading, forwarding or saving them.
> Thank you.
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

From jlim1561 at gmail.com  Mon Jul 22 11:55:40 2019
From: jlim1561 at gmail.com (jim lim)
Date: Mon, 22 Jul 2019 08:55:40 -0700
Subject: [keycloak-user] Define custom roles for different companies
Message-ID: <CACiFfXgsoHnQxMQ0pQv=Q2ngxb45aHvbTrVO6A7YNcvvUROFOA@mail.gmail.com>

Hi,

I'm currently evaluating whether or not Keycloak's authorization service is
a good option for us. My question is regarding RBAC. I want to allow users
to be able to define custom roles. There are two models - companies and
users. Each company has their own set of users. Is there a way to separate
the roles by company? I want to display a list of roles defined by a
company so that when an admin needs to assign a role to a user, they won't
be assigning roles defined by another company. For example, if role1 were
defined by company1 and role2 were defined by company2, I can only assign
role1 to users from company1 and role2 to users from company2.

From Mitchell.S.Bowers at kp.org  Mon Jul 22 12:19:47 2019
From: Mitchell.S.Bowers at kp.org (Mitchell S Bowers)
Date: Mon, 22 Jul 2019 16:19:47 +0000
Subject: [keycloak-user] Keycloak with Ping Identity OpenID Connect
 Provider
In-Reply-To: <CAJrcDBcC7s0PPPYtdp-q6GRs=nR7yVA4ZzPtjBy0TXoppjR6ZQ@mail.gmail.com>
References: <CO1P109MB0199D6C28312E3CE659504D9C6CB0@CO1P109MB0199.NAMP109.PROD.OUTLOOK.COM>
	<CAJrcDBcC7s0PPPYtdp-q6GRs=nR7yVA4ZzPtjBy0TXoppjR6ZQ@mail.gmail.com>
Message-ID: <CO1P109MB01995377D272FD91285EEA31C6C40@CO1P109MB0199.NAMP109.PROD.OUTLOOK.COM>

Hello Pedro,

I don?t have any error logs to share but let me explain further. After configuring Ping as the OIDC provider, we would be routed to Ping for authentication. After successfully authenticating, we?d be sent back to the application (Keycloak) with the ID token and Access token. After decoding the JWT, we see that the issuer had changed to Keycloak. So not sure if Keycloak issues it?s own token after receiving the one from Ping.

The other issue is around session management. When invoking logout at our OIDC provider, the session remains active (even after closing the browser). We see the logout happening at our OIDC provider (Ping) but when the user navigates back to the app (Keycloak), they are not challenged. Is there a setting for invalidating the session on logout in Keycloak?

Thanks,

Mitchell

From: Pedro Igor Silva <psilva at redhat.com>
Sent: Monday, July 22, 2019 8:08 AM
To: Mitchell S Bowers <Mitchell.S.Bowers at kp.org>
Cc: keycloak-user at lists.jboss.org
Subject: Re: [keycloak-user] Keycloak with Ping Identity OpenID Connect Provider


Caution: This email came from outside Kaiser Permanente. Do not open attachments or click on links if you do not recognize the sender.

________________________________
Hi,

I have never configured PingIdentity as a broker before, but the configuration steps should be the same. Could you provide more details about the issues you are facing? Any specific error in logs?

On Fri, Jul 19, 2019 at 8:14 PM Mitchell S Bowers <Mitchell.S.Bowers at kp.org<mailto:Mitchell.S.Bowers at kp.org>> wrote:
Hello,

Is there any documentation on configuring Keycloak to use Ping as an external OIDC provider? I've used the documentation provided for Okta, which should be essentially the same.

However, we are experiencing issues (specifically token issuance and logout). Any info would be greatly appreciated.

https://ultimatesecurity.pro/post/okta-oidc/<https://urldefense.proofpoint.com/v2/url?u=https-3A__ultimatesecurity.pro_post_okta-2Doidc_&d=DwMFaQ&c=V-WiB07a9ZG9AUogGPqIYBXfVnjryhYX1W_SjITv1Oo&r=VcrfVILBQLZrURPoC8PnflvbtsRzK_VMx7MCP6S2hyI&m=12QW91npVFVsrPGWUUgNypU-HQuCg1cj6RDXSZd69NY&s=g0NJX9qRVuh5-xBfiwa3IdLZ5iX1zAWhcFNFlEv2ES0&e=>

Thanks - Mitchell

NOTICE TO RECIPIENT:  If you are not the intended recipient of this e-mail, you are prohibited from sharing, copying, or otherwise using or disclosing its contents.  If you have received this e-mail in error, please notify the sender immediately by reply e-mail and permanently delete this e-mail and any attachments without reading, forwarding or saving them.  Thank you.
_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user<https://urldefense.proofpoint.com/v2/url?u=https-3A__lists.jboss.org_mailman_listinfo_keycloak-2Duser&d=DwMFaQ&c=V-WiB07a9ZG9AUogGPqIYBXfVnjryhYX1W_SjITv1Oo&r=VcrfVILBQLZrURPoC8PnflvbtsRzK_VMx7MCP6S2hyI&m=12QW91npVFVsrPGWUUgNypU-HQuCg1cj6RDXSZd69NY&s=yrtLyzLrA4PEDSUtI8BmxCSrmlYxhyTgUU6AznIwu9o&e=>
NOTICE TO RECIPIENT:  If you are not the intended recipient of this e-mail, you are prohibited from sharing, copying, or otherwise using or disclosing its contents.  If you have received this e-mail in error, please notify the sender immediately by reply e-mail and permanently delete this e-mail and any attachments without reading, forwarding or saving them.  Thank you.

From psilva at redhat.com  Mon Jul 22 12:47:50 2019
From: psilva at redhat.com (Pedro Igor Silva)
Date: Mon, 22 Jul 2019 13:47:50 -0300
Subject: [keycloak-user] Keycloak with Ping Identity OpenID Connect
	Provider
In-Reply-To: <CO1P109MB01995377D272FD91285EEA31C6C40@CO1P109MB0199.NAMP109.PROD.OUTLOOK.COM>
References: <CO1P109MB0199D6C28312E3CE659504D9C6CB0@CO1P109MB0199.NAMP109.PROD.OUTLOOK.COM>
	<CAJrcDBcC7s0PPPYtdp-q6GRs=nR7yVA4ZzPtjBy0TXoppjR6ZQ@mail.gmail.com>
	<CO1P109MB01995377D272FD91285EEA31C6C40@CO1P109MB0199.NAMP109.PROD.OUTLOOK.COM>
Message-ID: <CAJrcDBcnQr7_veN5Lf5q1DZv1QR-5ojW2Y2kVC15WSqT4EWiow@mail.gmail.com>

On Mon, Jul 22, 2019 at 1:19 PM Mitchell S Bowers <Mitchell.S.Bowers at kp.org>
wrote:

> Hello Pedro,
>
>
>
> I don?t have any error logs to share but let me explain further. After
> configuring Ping as the OIDC provider, we would be routed to Ping for
> authentication. After successfully authenticating, we?d be sent back to the
> application (Keycloak) with the ID token and Access token. After decoding
> the JWT, we see that the issuer had changed to Keycloak. So not sure if
> Keycloak issues it?s own token after receiving the one from Ping.
>

It does. But you should still be able to obtain the original tokens as per
https://www.keycloak.org/docs/latest/server_admin/#retrieving-external-idp-tokens
.


>
>
> The other issue is around session management. When invoking logout at our
> OIDC provider, the session remains active (even after closing the browser).
> We see the logout happening at our OIDC provider (Ping) but when the user
> navigates back to the app (Keycloak), they are not challenged. Is there a
> setting for invalidating the session on logout in Keycloak?
>

IIRC, If the logout is starting at the brokered IdP, it should send a
logout request to Keycloak including the initiating_idp parameter. I would
check if the brokered IdP is at least sending a request to Keycloak.

Regards.


>
>
> Thanks,
>
>
>
> Mitchell
>
>
>
> *From:* Pedro Igor Silva <psilva at redhat.com>
> *Sent:* Monday, July 22, 2019 8:08 AM
> *To:* Mitchell S Bowers <Mitchell.S.Bowers at kp.org>
> *Cc:* keycloak-user at lists.jboss.org
> *Subject:* Re: [keycloak-user] Keycloak with Ping Identity OpenID Connect
> Provider
>
>
>
> *Caution: *This email came from outside Kaiser Permanente. Do not open
> attachments or click on links if you do not recognize the sender.
> ------------------------------
>
> Hi,
>
>
>
> I have never configured PingIdentity as a broker before, but the
> configuration steps should be the same. Could you provide more details
> about the issues you are facing? Any specific error in logs?
>
>
>
> On Fri, Jul 19, 2019 at 8:14 PM Mitchell S Bowers <
> Mitchell.S.Bowers at kp.org> wrote:
>
> Hello,
>
> Is there any documentation on configuring Keycloak to use Ping as an
> external OIDC provider? I've used the documentation provided for Okta,
> which should be essentially the same.
>
> However, we are experiencing issues (specifically token issuance and
> logout). Any info would be greatly appreciated.
>
> https://ultimatesecurity.pro/post/okta-oidc/
> <https://urldefense.proofpoint.com/v2/url?u=https-3A__ultimatesecurity.pro_post_okta-2Doidc_&d=DwMFaQ&c=V-WiB07a9ZG9AUogGPqIYBXfVnjryhYX1W_SjITv1Oo&r=VcrfVILBQLZrURPoC8PnflvbtsRzK_VMx7MCP6S2hyI&m=12QW91npVFVsrPGWUUgNypU-HQuCg1cj6RDXSZd69NY&s=g0NJX9qRVuh5-xBfiwa3IdLZ5iX1zAWhcFNFlEv2ES0&e=>
>
> Thanks - Mitchell
>
> NOTICE TO RECIPIENT:  If you are not the intended recipient of this
> e-mail, you are prohibited from sharing, copying, or otherwise using or
> disclosing its contents.  If you have received this e-mail in error, please
> notify the sender immediately by reply e-mail and permanently delete this
> e-mail and any attachments without reading, forwarding or saving them.
> Thank you.
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
> <https://urldefense.proofpoint.com/v2/url?u=https-3A__lists.jboss.org_mailman_listinfo_keycloak-2Duser&d=DwMFaQ&c=V-WiB07a9ZG9AUogGPqIYBXfVnjryhYX1W_SjITv1Oo&r=VcrfVILBQLZrURPoC8PnflvbtsRzK_VMx7MCP6S2hyI&m=12QW91npVFVsrPGWUUgNypU-HQuCg1cj6RDXSZd69NY&s=yrtLyzLrA4PEDSUtI8BmxCSrmlYxhyTgUU6AznIwu9o&e=>
>
> *NOTICE TO RECIPIENT:*  If you are not the intended recipient of this
> e-mail, you are prohibited from sharing, copying, or otherwise using or
> disclosing its contents.  If you have received this e-mail in error,
> please notify the sender immediately by reply e-mail and permanently delete
> this e-mail and any attachments without reading, forwarding or saving them.
> Thank you.
>

From Mitchell.S.Bowers at kp.org  Mon Jul 22 14:15:08 2019
From: Mitchell.S.Bowers at kp.org (Mitchell S Bowers)
Date: Mon, 22 Jul 2019 18:15:08 +0000
Subject: [keycloak-user] Keycloak with Ping Identity OpenID Connect
 Provider
In-Reply-To: <CAJrcDBcnQr7_veN5Lf5q1DZv1QR-5ojW2Y2kVC15WSqT4EWiow@mail.gmail.com>
References: <CO1P109MB0199D6C28312E3CE659504D9C6CB0@CO1P109MB0199.NAMP109.PROD.OUTLOOK.COM>
	<CAJrcDBcC7s0PPPYtdp-q6GRs=nR7yVA4ZzPtjBy0TXoppjR6ZQ@mail.gmail.com>
	<CO1P109MB01995377D272FD91285EEA31C6C40@CO1P109MB0199.NAMP109.PROD.OUTLOOK.COM>
	<CAJrcDBcnQr7_veN5Lf5q1DZv1QR-5ojW2Y2kVC15WSqT4EWiow@mail.gmail.com>
Message-ID: <CO1P109MB01997FBAAC3D29D73D05471DC6C40@CO1P109MB0199.NAMP109.PROD.OUTLOOK.COM>

Hello Pedro,

Thank you for the prompt response. As for your statement below:

IIRC, If the logout is starting at the brokered IdP, it should send a logout request to Keycloak including the initiating_idp parameter. I would check if the brokered IdP is at least sending a request to Keycloak

We?ve configured the logout URL (from our brokered IdP) with our Keycloak client. When tracing the request on logout, it?s making a POST call to Keycloak for a refresh token (not sure why). Then doing a GET logout call to Keycloak (https://keycloak.sandbox.adf.kp.org/auth/realms/master/protocol/openid-connect/logout? , then making a GET call to brokered IdP (Ping).

Thanks


From: Pedro Igor Silva <psilva at redhat.com>
Sent: Monday, July 22, 2019 9:48 AM
To: Mitchell S Bowers <Mitchell.S.Bowers at kp.org>
Cc: keycloak-user at lists.jboss.org
Subject: Re: [keycloak-user] Keycloak with Ping Identity OpenID Connect Provider



On Mon, Jul 22, 2019 at 1:19 PM Mitchell S Bowers <Mitchell.S.Bowers at kp.org<mailto:Mitchell.S.Bowers at kp.org>> wrote:
Hello Pedro,

I don?t have any error logs to share but let me explain further. After configuring Ping as the OIDC provider, we would be routed to Ping for authentication. After successfully authenticating, we?d be sent back to the application (Keycloak) with the ID token and Access token. After decoding the JWT, we see that the issuer had changed to Keycloak. So not sure if Keycloak issues it?s own token after receiving the one from Ping.

It does. But you should still be able to obtain the original tokens as per https://www.keycloak.org/docs/latest/server_admin/#retrieving-external-idp-tokens<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.keycloak.org_docs_latest_server-5Fadmin_-23retrieving-2Dexternal-2Didp-2Dtokens&d=DwMFaQ&c=V-WiB07a9ZG9AUogGPqIYBXfVnjryhYX1W_SjITv1Oo&r=VcrfVILBQLZrURPoC8PnflvbtsRzK_VMx7MCP6S2hyI&m=Hbc8uf9Y6vwoyofVCH55ucl3ZrLC65wYeLreDv3adMo&s=0XMlyrg4uBWbGpdPDkxUu-6T5Qm8BfewLrPbP9Pf-rA&e=>.


The other issue is around session management. When invoking logout at our OIDC provider, the session remains active (even after closing the browser). We see the logout happening at our OIDC provider (Ping) but when the user navigates back to the app (Keycloak), they are not challenged. Is there a setting for invalidating the session on logout in Keycloak?

IIRC, If the logout is starting at the brokered IdP, it should send a logout request to Keycloak including the initiating_idp parameter. I would check if the brokered IdP is at least sending a request to Keycloak.

Regards.


Thanks,

Mitchell

From: Pedro Igor Silva <psilva at redhat.com<mailto:psilva at redhat.com>>
Sent: Monday, July 22, 2019 8:08 AM
To: Mitchell S Bowers <Mitchell.S.Bowers at kp.org<mailto:Mitchell.S.Bowers at kp.org>>
Cc: keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>
Subject: Re: [keycloak-user] Keycloak with Ping Identity OpenID Connect Provider


Caution: This email came from outside Kaiser Permanente. Do not open attachments or click on links if you do not recognize the sender.

________________________________
Hi,

I have never configured PingIdentity as a broker before, but the configuration steps should be the same. Could you provide more details about the issues you are facing? Any specific error in logs?

On Fri, Jul 19, 2019 at 8:14 PM Mitchell S Bowers <Mitchell.S.Bowers at kp.org<mailto:Mitchell.S.Bowers at kp.org>> wrote:
Hello,

Is there any documentation on configuring Keycloak to use Ping as an external OIDC provider? I've used the documentation provided for Okta, which should be essentially the same.

However, we are experiencing issues (specifically token issuance and logout). Any info would be greatly appreciated.

https://ultimatesecurity.pro/post/okta-oidc/<https://urldefense.proofpoint.com/v2/url?u=https-3A__ultimatesecurity.pro_post_okta-2Doidc_&d=DwMFaQ&c=V-WiB07a9ZG9AUogGPqIYBXfVnjryhYX1W_SjITv1Oo&r=VcrfVILBQLZrURPoC8PnflvbtsRzK_VMx7MCP6S2hyI&m=12QW91npVFVsrPGWUUgNypU-HQuCg1cj6RDXSZd69NY&s=g0NJX9qRVuh5-xBfiwa3IdLZ5iX1zAWhcFNFlEv2ES0&e=>

Thanks - Mitchell

NOTICE TO RECIPIENT:  If you are not the intended recipient of this e-mail, you are prohibited from sharing, copying, or otherwise using or disclosing its contents.  If you have received this e-mail in error, please notify the sender immediately by reply e-mail and permanently delete this e-mail and any attachments without reading, forwarding or saving them.  Thank you.
_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user<https://urldefense.proofpoint.com/v2/url?u=https-3A__lists.jboss.org_mailman_listinfo_keycloak-2Duser&d=DwMFaQ&c=V-WiB07a9ZG9AUogGPqIYBXfVnjryhYX1W_SjITv1Oo&r=VcrfVILBQLZrURPoC8PnflvbtsRzK_VMx7MCP6S2hyI&m=12QW91npVFVsrPGWUUgNypU-HQuCg1cj6RDXSZd69NY&s=yrtLyzLrA4PEDSUtI8BmxCSrmlYxhyTgUU6AznIwu9o&e=>
NOTICE TO RECIPIENT:  If you are not the intended recipient of this e-mail, you are prohibited from sharing, copying, or otherwise using or disclosing its contents.  If you have received this e-mail in error, please notify the sender immediately by reply e-mail and permanently delete this e-mail and any attachments without reading, forwarding or saving them.  Thank you.
NOTICE TO RECIPIENT:  If you are not the intended recipient of this e-mail, you are prohibited from sharing, copying, or otherwise using or disclosing its contents.  If you have received this e-mail in error, please notify the sender immediately by reply e-mail and permanently delete this e-mail and any attachments without reading, forwarding or saving them.  Thank you.

From reid.watson at auckland.ac.nz  Tue Jul 23 01:58:52 2019
From: reid.watson at auckland.ac.nz (Reid Watson)
Date: Tue, 23 Jul 2019 05:58:52 +0000
Subject: [keycloak-user] General Question - Keycloak Configuration as SAML
	Service Provider
Message-ID: <E0F43660-0A62-498E-96C1-BC0C93574D65@auckland.ac.nz>

Hi Everyone, 

Were investigating ?Keycloak? with oAuth2 / OIDC and SAML and I?m wondering does the application have the ability for users to configure an SP (Service Provider) within Keycloak .   

As I understand it Keycloak server plays the role of an Identity Provider (IDP) and provides means to authenticate a user for a Service Provider. 

There is no mention or guides for users to configuring a Service Provider but I might not be looking at the incorrect documentation. 

Cheers

Reid  


From nikmess at hotmail.it  Tue Jul 23 05:06:04 2019
From: nikmess at hotmail.it (Nicola Messina)
Date: Tue, 23 Jul 2019 09:06:04 +0000
Subject: [keycloak-user] Forbidden 403
Message-ID: <VE1PR08MB52639D3174FD99D97C59EE0ED7C70@VE1PR08MB5263.eurprd08.prod.outlook.com>

Hi,

i'm trying to recreate the photoz-uma-example, so, on keycloak i created two client, resource and assigned permission, created JAX-RS server and created an HTML5 & plain Javascript client (not AngularJS, i dont know angular), so, if i use the policy based on user role, everything goes well, i can create resource, view resource, view shared resource, but wen i use the "Owner only policy" in javascript, i obtain ever the 403 Forbidden.
what am I doing wrong?

I think I'm wrong in the client, but I don't understand what I have to send to keycloak server.

I'm doing this, should be enough?
 authorizationRequest.ticket = ticket;

    // send the authorization request, if successful retry the request
    identity.authorization.authorize(authorizationRequest).then(function (rpt)

I'll have some stupid things wrong
Thanks in advance.

From Bo.Y at dell.com  Tue Jul 23 05:07:19 2019
From: Bo.Y at dell.com (Bo.Y at dell.com)
Date: Tue, 23 Jul 2019 09:07:19 +0000
Subject: [keycloak-user] Uncaught server error:
 java.lang.NoClassDefFoundError: org/keycloak/services/validation/Validation
In-Reply-To: <c8b81e164c184b81a68a5a1a60585dd1@KULX13MDC123.APAC.DELL.COM>
References: <5cf0cf066cad47bf808b41977bee0c33@KULX13MDC123.APAC.DELL.COM>
	<6c806c18-bd1d-e84b-3db3-3cf06f71cf01@redhat.com>
	<c8b81e164c184b81a68a5a1a60585dd1@KULX13MDC123.APAC.DELL.COM>
Message-ID: <051804ded694439dabbcdc396a3b69b9@KULX13MDC123.APAC.DELL.COM>

Hi, Did any one has any ideas?
From: Yang, Bo
Sent: Friday, July 19, 2019 10:57 AM
To: 'Vlasta Ramik'; keycloak-user at lists.jboss.org
Subject: RE: [keycloak-user] Uncaught server error: java.lang.NoClassDefFoundError: org/keycloak/services/validation/Validation

Hi Vlasta,
I think I have had them in "jboss-deployment-structure"

[/opt/jboss/keycloak/modules/system/layers/keycloak/org/keycloak/keycloak-server-subsystem/main/server-war/WEB-INF/ jboss-deployment-structure]
<jboss-deployment-structure>
    <deployment>
        <dependencies>
            <module name="org.keycloak.keycloak-server-subsystem.dependencies"/>
            <!-- Kie requires access to kie.conf files from META-INF -->
            <module name="org.kie">
                <imports>
                    <include path="META-INF"/>
                </imports>
            </module>
        </dependencies>
        <exclude-subsystems>
            <subsystem name="webservices"/>
            <subsystem name="weld"/>
        </exclude-subsystems>
   </deployment>
</jboss-deployment-structure>

[/opt/jboss/keycloak/modules/system/layers/keycloak/org/keycloak/keycloak-server-subsystem/dependencies/main/module.xml]
<module name="org.keycloak.keycloak-server-subsystem.dependencies" xmlns="urn:jboss:module:1.1">
    <resources>
    </resources>

    <dependencies>
        <module name="org.keycloak.keycloak-services" export="true"/>
        <module name="org.jboss.msc"/>
        <module name="org.infinispan" export="true"/>
    </dependencies>
</module>

Thanks,
Bo
From: Vlasta Ramik <vramik at redhat.com<mailto:vramik at redhat.com>>
Sent: Thursday, July 18, 2019 7:28 PM
To: Yang, Bo; keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>
Subject: Re: [keycloak-user] Uncaught server error: java.lang.NoClassDefFoundError: org/keycloak/services/validation/Validation


[EXTERNAL EMAIL]

Hey,

I think you could try to add dependency to the keycloak-services, see https://docs.jboss.org/author/display/WFLY/Class+Loading+in+WildFly section JBoss Deployment Structure File.

V.
On 7/18/19 12:59 PM, Bo.Y at dell.com<mailto:Bo.Y at dell.com> wrote:

Hi Experts,



When I follow https://www.keycloak.org/docs/latest/server_development/index.html#packaging-the-action step by step to do customize the validation in keycloak. After I throw my jar into standalone/deployment, it creates a deployed file and the log shows the jar is deployed.  I can found my execution in keycloak admin console which shows in the screen shot below. But when it comes to register page, after I click register button with my filled content I got exception in keycloak log file. I also checked `standalone.xml` and `jboss-deployment-structure.xml` which seems fine too which means it include "keycloak-services-4.7.0.Final.jar". I don't find any useful information in the search. So could anyone help to have a look please?



Keycloak  version:

    compile group: 'org.keycloak', name: 'keycloak-core', version: '4.7.0.Final'

    compile group: 'org.keycloak', name: 'keycloak-server-spi', version: '4.7.0.Final'

    compile group: 'org.keycloak', name: 'keycloak-server-spi-private', version: '4.7.0.Final'

    compile group: 'org.keycloak', name: 'keycloak-services', version: '4.7.0.Final'



[Screen Shot]

[cid:image003.jpg at 01D53D9A.DBB94DF0]



[Exception]

09:04:01,128 ERROR [org.keycloak.services.error.KeycloakErrorHandler] (default task-35) Uncaught server error: java.lang.NoClassDefFoundError: org/keycloak/services/validation/Validation

               at com.xxxxxx.registerformcustom.validate(registerformcustom.java:51)

               at org.keycloak.authentication.FormAuthenticationFlow.processAction(FormAuthenticationFlow.java:214)

               at org.keycloak.authentication.DefaultAuthenticationFlow.processAction(DefaultAuthenticationFlow.java:97)

               at org.keycloak.authentication.AuthenticationProcessor.authenticationAction(AuthenticationProcessor.java:873)

               at org.keycloak.services.resources.LoginActionsService.processFlow(LoginActionsService.java:292)

               at org.keycloak.services.resources.LoginActionsService.processRegistration(LoginActionsService.java:627)

               at org.keycloak.services.resources.LoginActionsService.registerRequest(LoginActionsService.java:681)

               at org.keycloak.services.resources.LoginActionsService.processRegister(LoginActionsService.java:661)

               at sun.reflect.GeneratedMethodAccessor1030.invoke(Unknown Source)

               at sun.reflect.DelegatingMethodAccessorImpl.invoke(Delegati










_______________________________________________

keycloak-user mailing list

keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>

https://lists.jboss.org/mailman/listinfo/keycloak-user

From alvaro.gomez.gimenez at tecsisa.com  Tue Jul 23 06:11:01 2019
From: alvaro.gomez.gimenez at tecsisa.com (=?UTF-8?B?w4FsdmFybyBHw7NtZXo=?=)
Date: Tue, 23 Jul 2019 12:11:01 +0200
Subject: [keycloak-user] Questions about scope-permissions and resource
	types
In-Reply-To: <CAJrcDBdqcqaS7iiXuvYt=C4u-WnyOGFW3Na+S-a5RS3PYjZsEA@mail.gmail.com>
References: <CAPcMcKaULsBqijJqaAwzuM=+r6UMMt1wuOApMGktL=qw084Hsw@mail.gmail.com>
	<CAJrcDBdqcqaS7iiXuvYt=C4u-WnyOGFW3Na+S-a5RS3PYjZsEA@mail.gmail.com>
Message-ID: <CAPcMcKY3XXjOU16-pxBYmxB4-0vG5MyC30TPLxo9ZVpS2voWng@mail.gmail.com>

Hi Pedro,

Thanks for the response. Do you mean this is currently supported in the API
or will it be available in future versions of Keycloak? The issue you
linked refers to an UI functionality and we are interested in this use case
mentioned in the issue:

<<it should also cover use cases where scope permissions are set for a
resource type and not to any resource associated with the granted scopes.>>

But we don't know if that lack of functionality refers only to the UI or
also the API.

We've tested the following scenario using Keycloak#master API:

* Create two scopes:
  - read
  - write
* Create two resources (Both with resource-type "x"):
  - x1 (Associated with read & write scopes)
  - x2 (Associated with read & write scopes)

Since we want to create a permission for the read scope of all resources of
type "x" we've tried the following API requests without success:

* Create a scope-permission with a resource-type:

  POST
http://localhost:8081/auth/admin/realms/***/clients/***/authz/resource-server/permission/scope
  {
    "type": "scope",
    "logic": "POSITIVE",
    "decisionStrategy": "UNANIMOUS",
    "name": "x:read",
    "scopes": [ "read" ],
    "policies": [ "..." ],
    "resourceType": "x"
  }

  This fails since "resourceType" is not available when creating
scope-permissions.

* Create a resource-permission specifying a set of scopes (Since they are
available in the AbstractPolicyRepresentation):

  POST
http://localhost:8081/auth/admin/realms/***/clients/***/authz/resource-server/permission/resource
  {
    "type": "resource",
    "logic": "POSITIVE",
    "decisionStrategy": "UNANIMOUS",
    "name": "x:read",
    "scopes": [ "read" ],
    "policies": [ "..." ],
    "resourceType": "x"
  }

  This request is successfully executed but the scopes are ignored when
requesting permissions for the resource "x1" (All scopes are granted
instead of only the "read" scope):

  POST http://localhost:8080/auth/realms/***/protocol/openid-connect/token
    grant_type:urn:ietf:params:oauth:grant-type:uma-ticket
    audience:test
    submit_request:false
    response_mode:permissions
    permission:x1

  Response:

  [
    {
        "scopes": [
            "read",
            "write"
        ],
        "rsid": "e0734205-af2f-4b6d-bd5e-4eb550b2616c",
        "rsname": "x1"
    }
  ]

  We'd like only the "read" scope to be granted but all the Resource scopes
are granted instead.
  Thanks.


El lun., 22 jul. 2019 a las 15:15, Pedro Igor Silva (<psilva at redhat.com>)
escribi?:

> Hi ?lvaro,
>
> There is no restriction for doing that. I think this issue is related:
> https://issues.jboss.org/browse/KEYCLOAK-10663.
>
> Regards.
> Pedro Igor
>
> On Mon, Jul 22, 2019 at 9:55 AM ?lvaro G?mez <
> alvaro.gomez.gimenez at tecsisa.com> wrote:
>
>> Hi,
>>
>> We are using UMA and scope-permissions to manage fine grained access to
>> resources. We've
>> noticed that we can specify a set of involved resources when defining
>> scope-permissions (The UI
>> only supports specifying a single resource but the API allows defining a
>> set of resources).
>>
>> Referencing the involved resources in a scope-permission using a fixed
>> list
>> could be problematic
>> if the size of that list is big enough. We think it would be useful to
>> group all the resources using a
>> resource-type and specify that resource-type in the scope-permission as
>> one
>> can do in a
>> resource-permission. Is there any reason why this is not supported in a
>> scope-permission?
>>
>> Having a resource type reference available in scope-permissions would be
>> useful solving the following scenario:
>>
>> * Given a large amount of bank accounts, each one represented by a
>> resource
>> (associated with some
>>   scopes like read, update or delete) in the Resource Server and owned by
>> an specific user.
>> * Users can manage their own accounts following the UMA rules (Sharing
>> specific scopes of their
>>   accounts with other users).
>> * Some user with an Administrator role should be able to read ALL accounts
>> without having them
>>   shared with him and without needing to update any permission when a new
>> bank account is created.
>>
>> We would like to "group" all accounts using a resource-type and define a
>> single permission "can-read-bank-account"
>> which grants access to the scope read of all bank accounts to the owner
>> (via JS policy) and to any administrator
>> user (using a role policy). If we protect the following endpoint:
>>
>> GET /accounts/3273af-544b3940-211da3
>>
>> , using the resource "bank-account-3273af-544b3940-211da3" and the scope
>> "read", both the resource owner
>> and the Administrator user must be granted when evaluating the permission
>> "can-read-bank-account".
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>

From psilva at redhat.com  Tue Jul 23 08:00:02 2019
From: psilva at redhat.com (Pedro Igor Silva)
Date: Tue, 23 Jul 2019 09:00:02 -0300
Subject: [keycloak-user] Questions about scope-permissions and resource
	types
In-Reply-To: <CAPcMcKY3XXjOU16-pxBYmxB4-0vG5MyC30TPLxo9ZVpS2voWng@mail.gmail.com>
References: <CAPcMcKaULsBqijJqaAwzuM=+r6UMMt1wuOApMGktL=qw084Hsw@mail.gmail.com>
	<CAJrcDBdqcqaS7iiXuvYt=C4u-WnyOGFW3Na+S-a5RS3PYjZsEA@mail.gmail.com>
	<CAPcMcKY3XXjOU16-pxBYmxB4-0vG5MyC30TPLxo9ZVpS2voWng@mail.gmail.com>
Message-ID: <CAJrcDBfTSk4rn9iTYYt2E5_TpjOyt3qLoZVxZ6ip48G3MshSuQ@mail.gmail.com>

Both API and UI need a review in order to support what you are looking for
(as well as the requirement from that JIRA).

Currently, resource permissions grant access to a resource and any
associated scope where scope permissions allow you to restrict the set of
scopes that could be granted. The idea is to unify both types of permission
using a single API so you can make the process of defining permissions more
simple as well as support some scenarios that are not possible today
because of this separation (like the one you are looking for).

To be honest, I like the separation we have today and I'm still not sure if
unifying both permission types is the best way to go. Maybe just support
the resource type in scope-permissions is enough .... Wdyt ?

Regards.
Pedro Igor

On Tue, Jul 23, 2019 at 7:11 AM ?lvaro G?mez <
alvaro.gomez.gimenez at tecsisa.com> wrote:

> Hi Pedro,
>
> Thanks for the response. Do you mean this is currently supported in the
> API or will it be available in future versions of Keycloak? The issue you
> linked refers to an UI functionality and we are interested in this use case
> mentioned in the issue:
>
> <<it should also cover use cases where scope permissions are set for a
> resource type and not to any resource associated with the granted scopes.>>
>
> But we don't know if that lack of functionality refers only to the UI or
> also the API.
>
> We've tested the following scenario using Keycloak#master API:
>
> * Create two scopes:
>   - read
>   - write
> * Create two resources (Both with resource-type "x"):
>   - x1 (Associated with read & write scopes)
>   - x2 (Associated with read & write scopes)
>
> Since we want to create a permission for the read scope of all resources
> of type "x" we've tried the following API requests without success:
>
> * Create a scope-permission with a resource-type:
>
>   POST
> http://localhost:8081/auth/admin/realms/***/clients/***/authz/resource-server/permission/scope
>   {
>     "type": "scope",
>     "logic": "POSITIVE",
>     "decisionStrategy": "UNANIMOUS",
>     "name": "x:read",
>     "scopes": [ "read" ],
>     "policies": [ "..." ],
>     "resourceType": "x"
>   }
>
>   This fails since "resourceType" is not available when creating
> scope-permissions.
>
> * Create a resource-permission specifying a set of scopes (Since they are
> available in the AbstractPolicyRepresentation):
>
>   POST
> http://localhost:8081/auth/admin/realms/***/clients/***/authz/resource-server/permission/resource
>   {
>     "type": "resource",
>     "logic": "POSITIVE",
>     "decisionStrategy": "UNANIMOUS",
>     "name": "x:read",
>     "scopes": [ "read" ],
>     "policies": [ "..." ],
>     "resourceType": "x"
>   }
>
>   This request is successfully executed but the scopes are ignored when
> requesting permissions for the resource "x1" (All scopes are granted
> instead of only the "read" scope):
>
>   POST http://localhost:8080/auth/realms/***/protocol/openid-connect/token
>     grant_type:urn:ietf:params:oauth:grant-type:uma-ticket
>     audience:test
>     submit_request:false
>     response_mode:permissions
>     permission:x1
>
>   Response:
>
>   [
>     {
>         "scopes": [
>             "read",
>             "write"
>         ],
>         "rsid": "e0734205-af2f-4b6d-bd5e-4eb550b2616c",
>         "rsname": "x1"
>     }
>   ]
>
>   We'd like only the "read" scope to be granted but all the Resource
> scopes are granted instead.
>   Thanks.
>
>
> El lun., 22 jul. 2019 a las 15:15, Pedro Igor Silva (<psilva at redhat.com>)
> escribi?:
>
>> Hi ?lvaro,
>>
>> There is no restriction for doing that. I think this issue is related:
>> https://issues.jboss.org/browse/KEYCLOAK-10663.
>>
>> Regards.
>> Pedro Igor
>>
>> On Mon, Jul 22, 2019 at 9:55 AM ?lvaro G?mez <
>> alvaro.gomez.gimenez at tecsisa.com> wrote:
>>
>>> Hi,
>>>
>>> We are using UMA and scope-permissions to manage fine grained access to
>>> resources. We've
>>> noticed that we can specify a set of involved resources when defining
>>> scope-permissions (The UI
>>> only supports specifying a single resource but the API allows defining a
>>> set of resources).
>>>
>>> Referencing the involved resources in a scope-permission using a fixed
>>> list
>>> could be problematic
>>> if the size of that list is big enough. We think it would be useful to
>>> group all the resources using a
>>> resource-type and specify that resource-type in the scope-permission as
>>> one
>>> can do in a
>>> resource-permission. Is there any reason why this is not supported in a
>>> scope-permission?
>>>
>>> Having a resource type reference available in scope-permissions would be
>>> useful solving the following scenario:
>>>
>>> * Given a large amount of bank accounts, each one represented by a
>>> resource
>>> (associated with some
>>>   scopes like read, update or delete) in the Resource Server and owned by
>>> an specific user.
>>> * Users can manage their own accounts following the UMA rules (Sharing
>>> specific scopes of their
>>>   accounts with other users).
>>> * Some user with an Administrator role should be able to read ALL
>>> accounts
>>> without having them
>>>   shared with him and without needing to update any permission when a new
>>> bank account is created.
>>>
>>> We would like to "group" all accounts using a resource-type and define a
>>> single permission "can-read-bank-account"
>>> which grants access to the scope read of all bank accounts to the owner
>>> (via JS policy) and to any administrator
>>> user (using a role policy). If we protect the following endpoint:
>>>
>>> GET /accounts/3273af-544b3940-211da3
>>>
>>> , using the resource "bank-account-3273af-544b3940-211da3" and the scope
>>> "read", both the resource owner
>>> and the Administrator user must be granted when evaluating the permission
>>> "can-read-bank-account".
>>> _______________________________________________
>>> keycloak-user mailing list
>>> keycloak-user at lists.jboss.org
>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>
>>

From alvaro.gomez.gimenez at tecsisa.com  Tue Jul 23 09:36:46 2019
From: alvaro.gomez.gimenez at tecsisa.com (=?UTF-8?B?w4FsdmFybyBHw7NtZXo=?=)
Date: Tue, 23 Jul 2019 15:36:46 +0200
Subject: [keycloak-user] Questions about scope-permissions and resource
	types
In-Reply-To: <CAJrcDBfTSk4rn9iTYYt2E5_TpjOyt3qLoZVxZ6ip48G3MshSuQ@mail.gmail.com>
References: <CAPcMcKaULsBqijJqaAwzuM=+r6UMMt1wuOApMGktL=qw084Hsw@mail.gmail.com>
	<CAJrcDBdqcqaS7iiXuvYt=C4u-WnyOGFW3Na+S-a5RS3PYjZsEA@mail.gmail.com>
	<CAPcMcKY3XXjOU16-pxBYmxB4-0vG5MyC30TPLxo9ZVpS2voWng@mail.gmail.com>
	<CAJrcDBfTSk4rn9iTYYt2E5_TpjOyt3qLoZVxZ6ip48G3MshSuQ@mail.gmail.com>
Message-ID: <CAPcMcKbKr1mQYQZAncdCV5fJMDq=taxsH3qedEeFp1uHofvTOA@mail.gmail.com>

Supporting resource types in scope-permissions would be great for us.
Honestly, I don't know if mixing both permissions in a single UI would make
it even more confusing. For the moment, we only need Keycloak to support
resource types in scope-permissions at the API level. We'll keep an eye on
the issue so we can upgrade to a newer version of Keycloak when it's solved
and we will try to find a workaround in the meanwhile.
Thank you very much!
?lvaro.

El mar., 23 jul. 2019 a las 14:00, Pedro Igor Silva (<psilva at redhat.com>)
escribi?:

> Both API and UI need a review in order to support what you are looking for
> (as well as the requirement from that JIRA).
>
> Currently, resource permissions grant access to a resource and any
> associated scope where scope permissions allow you to restrict the set of
> scopes that could be granted. The idea is to unify both types of permission
> using a single API so you can make the process of defining permissions more
> simple as well as support some scenarios that are not possible today
> because of this separation (like the one you are looking for).
>
> To be honest, I like the separation we have today and I'm still not sure
> if unifying both permission types is the best way to go. Maybe just support
> the resource type in scope-permissions is enough .... Wdyt ?
>
> Regards.
> Pedro Igor
>
> On Tue, Jul 23, 2019 at 7:11 AM ?lvaro G?mez <
> alvaro.gomez.gimenez at tecsisa.com> wrote:
>
>> Hi Pedro,
>>
>> Thanks for the response. Do you mean this is currently supported in the
>> API or will it be available in future versions of Keycloak? The issue you
>> linked refers to an UI functionality and we are interested in this use case
>> mentioned in the issue:
>>
>> <<it should also cover use cases where scope permissions are set for a
>> resource type and not to any resource associated with the granted scopes.>>
>>
>> But we don't know if that lack of functionality refers only to the UI or
>> also the API.
>>
>> We've tested the following scenario using Keycloak#master API:
>>
>> * Create two scopes:
>>   - read
>>   - write
>> * Create two resources (Both with resource-type "x"):
>>   - x1 (Associated with read & write scopes)
>>   - x2 (Associated with read & write scopes)
>>
>> Since we want to create a permission for the read scope of all resources
>> of type "x" we've tried the following API requests without success:
>>
>> * Create a scope-permission with a resource-type:
>>
>>   POST
>> http://localhost:8081/auth/admin/realms/***/clients/***/authz/resource-server/permission/scope
>>   {
>>     "type": "scope",
>>     "logic": "POSITIVE",
>>     "decisionStrategy": "UNANIMOUS",
>>     "name": "x:read",
>>     "scopes": [ "read" ],
>>     "policies": [ "..." ],
>>     "resourceType": "x"
>>   }
>>
>>   This fails since "resourceType" is not available when creating
>> scope-permissions.
>>
>> * Create a resource-permission specifying a set of scopes (Since they are
>> available in the AbstractPolicyRepresentation):
>>
>>   POST
>> http://localhost:8081/auth/admin/realms/***/clients/***/authz/resource-server/permission/resource
>>   {
>>     "type": "resource",
>>     "logic": "POSITIVE",
>>     "decisionStrategy": "UNANIMOUS",
>>     "name": "x:read",
>>     "scopes": [ "read" ],
>>     "policies": [ "..." ],
>>     "resourceType": "x"
>>   }
>>
>>   This request is successfully executed but the scopes are ignored when
>> requesting permissions for the resource "x1" (All scopes are granted
>> instead of only the "read" scope):
>>
>>   POST
>> http://localhost:8080/auth/realms/***/protocol/openid-connect/token
>>     grant_type:urn:ietf:params:oauth:grant-type:uma-ticket
>>     audience:test
>>     submit_request:false
>>     response_mode:permissions
>>     permission:x1
>>
>>   Response:
>>
>>   [
>>     {
>>         "scopes": [
>>             "read",
>>             "write"
>>         ],
>>         "rsid": "e0734205-af2f-4b6d-bd5e-4eb550b2616c",
>>         "rsname": "x1"
>>     }
>>   ]
>>
>>   We'd like only the "read" scope to be granted but all the Resource
>> scopes are granted instead.
>>   Thanks.
>>
>>
>> El lun., 22 jul. 2019 a las 15:15, Pedro Igor Silva (<psilva at redhat.com>)
>> escribi?:
>>
>>> Hi ?lvaro,
>>>
>>> There is no restriction for doing that. I think this issue is related:
>>> https://issues.jboss.org/browse/KEYCLOAK-10663.
>>>
>>> Regards.
>>> Pedro Igor
>>>
>>> On Mon, Jul 22, 2019 at 9:55 AM ?lvaro G?mez <
>>> alvaro.gomez.gimenez at tecsisa.com> wrote:
>>>
>>>> Hi,
>>>>
>>>> We are using UMA and scope-permissions to manage fine grained access to
>>>> resources. We've
>>>> noticed that we can specify a set of involved resources when defining
>>>> scope-permissions (The UI
>>>> only supports specifying a single resource but the API allows defining a
>>>> set of resources).
>>>>
>>>> Referencing the involved resources in a scope-permission using a fixed
>>>> list
>>>> could be problematic
>>>> if the size of that list is big enough. We think it would be useful to
>>>> group all the resources using a
>>>> resource-type and specify that resource-type in the scope-permission as
>>>> one
>>>> can do in a
>>>> resource-permission. Is there any reason why this is not supported in a
>>>> scope-permission?
>>>>
>>>> Having a resource type reference available in scope-permissions would be
>>>> useful solving the following scenario:
>>>>
>>>> * Given a large amount of bank accounts, each one represented by a
>>>> resource
>>>> (associated with some
>>>>   scopes like read, update or delete) in the Resource Server and owned
>>>> by
>>>> an specific user.
>>>> * Users can manage their own accounts following the UMA rules (Sharing
>>>> specific scopes of their
>>>>   accounts with other users).
>>>> * Some user with an Administrator role should be able to read ALL
>>>> accounts
>>>> without having them
>>>>   shared with him and without needing to update any permission when a
>>>> new
>>>> bank account is created.
>>>>
>>>> We would like to "group" all accounts using a resource-type and define a
>>>> single permission "can-read-bank-account"
>>>> which grants access to the scope read of all bank accounts to the owner
>>>> (via JS policy) and to any administrator
>>>> user (using a role policy). If we protect the following endpoint:
>>>>
>>>> GET /accounts/3273af-544b3940-211da3
>>>>
>>>> , using the resource "bank-account-3273af-544b3940-211da3" and the scope
>>>> "read", both the resource owner
>>>> and the Administrator user must be granted when evaluating the
>>>> permission
>>>> "can-read-bank-account".
>>>> _______________________________________________
>>>> keycloak-user mailing list
>>>> keycloak-user at lists.jboss.org
>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>
>>>

From David.Leonard at flexential.com  Tue Jul 23 16:44:18 2019
From: David.Leonard at flexential.com (David Leonard)
Date: Tue, 23 Jul 2019 20:44:18 +0000
Subject: [keycloak-user] CORS Headers not present on OPTIONS request
Message-ID: <33b4d24a5640a872d3c05b7239a53340d00baf50.camel@flexential.com>

Hello everyone,

We're running a Keycloak 6.0.1 cluster running in kubernetes, and we're
running into issues with CORS requests by Kibana as a part of
refreshing the access token. Here is the situation

1. User logs into the SP and is able to successfully authenticate.
2. The users token expires in the background.
3. The SP notices this expired token, and attempts to refresh the token
starting to issue an auth request to Keycloak. It issues an 'OPTIONS'
request to determine what it can perform, and this request is missing
headers. Here is the full output sample from curl:

[jboss at keycloak-dev-0 ~]$ curl '
http://127.0.0.1:8080/auth/realms/globalauth/protocol/openid-connect/auth?client_id=fps-demo&response_type=code&redirect_uri=https%3A%2F%2F[[SPURL]]%2Fauth%2Fopenid%2Flogin&state=hP95iVphOxSnWk0tkjE2rg&scope=openid%20profile%20email%20address%20phone'
-X OPTIONS -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0)
Gecko/20100101 Firefox/68.0' -H 'Accept: */*' -H 'Accept-Language: en-
US,en;q=0.5' --compressed -H 'Access-Control-Request-Method: GET' -H
'Access-Control-Request-Headers: content-type,kbn-version' -H 'Referer:
https://kibana.[[SPURL]]/app/kibana' -H 'Origin: https://[[SPURL]]' -H
'Connection: keep-alive' -H 'Host: [[IDPURL]]' -v
* About to connect() to 127.0.0.1 port 8080 (#0)
*   Trying 127.0.0.1...
* Connected to 127.0.0.1 (127.0.0.1) port 8080 (#0)
> OPTIONS /auth/realms/globalauth/protocol/openid-
connect/auth?client_id=fps-
demo&response_type=code&redirect_uri=https%3A%2F%2F[[SPURL]]%2Fauth%2Fo
penid%2Flogin&state=hP95iVphOxSnWk0tkjE2rg&scope=openid%20profile%20ema
il%20address%20phone HTTP/1.1
> Accept-Encoding: deflate, gzip
> User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101
Firefox/68.0
> Accept: */*
> Accept-Language: en-US,en;q=0.5
> Access-Control-Request-Method: GET
> Access-Control-Request-Headers: content-type,kbn-version
> Referer: https://[[SPURL]]/app/kibana
> Origin: https://[[SPURL]]
> Connection: keep-alive
> Host: [[IDPURL]]
>
< HTTP/1.1 204 No Content
< Date: Tue, 23 Jul 2019 20:38:39 GMT
<
* Connection #0 to host 127.0.0.1 left intact
[jboss at keycloak-dev-0 ~]$

Here is the configuration of the client, the "Web Origins" item has
been set to the specific origin, +, and *. The result is the same
across all.

{
    "clientId": "fps-demo",
    "surrogateAuthRequired": false,
    "enabled": true,
    "clientAuthenticatorType": "client-secret",
    "redirectUris": [
        "https://kibana.[[SPURL]]"
    ],
    "webOrigins": [
        "+"
    ],
    "notBefore": 0,
    "bearerOnly": false,
    "consentRequired": false,
    "standardFlowEnabled": true,
    "implicitFlowEnabled": false,
    "directAccessGrantsEnabled": true,
    "serviceAccountsEnabled": false,
    "publicClient": false,
    "frontchannelLogout": false,
    "protocol": "openid-connect",
    "attributes": {
        "saml.assertion.signature": "false",
        "saml.multivalued.roles": "false",
        "saml.force.post.binding": "false",
        "saml.encrypt": "false",
        "saml.server.signature": "false",
        "saml.server.signature.keyinfo.ext": "false",
        "exclude.session.state.from.auth.response": "false",
        "saml_force_name_id_format": "false",
        "saml.client.signature": "false",
        "tls.client.certificate.bound.access.tokens": "false",
        "saml.authnstatement": "false",
        "display.on.consent.screen": "false",
        "saml.onetimeuse.condition": "false"
    },
    "authenticationFlowBindingOverrides": {},
    "fullScopeAllowed": false,
    "nodeReRegistrationTimeout": -1,
    "protocolMappers": [
        {
            "name": "client roles",
            "protocol": "openid-connect",
            "protocolMapper": "oidc-usermodel-client-role-mapper",
            "consentRequired": false,
            "config": {
                "multivalued": "true",
                "userinfo.token.claim": "false",
                "id.token.claim": "true",
                "access.token.claim": "true",
                "claim.name": "roles",
                "jsonType.label": "String",
                "usermodel.clientRoleMapping.clientId": "fps-demo"
            }
        },
        {
            "name": "allowed web origins",
            "protocol": "openid-connect",
            "protocolMapper": "oidc-allowed-origins-mapper",
            "consentRequired": false,
            "config": {}
        }
    ],
    "defaultClientScopes": [
        "web-origins",
        "role_list",
        "profile",
        "roles",
        "email"
    ],
    "optionalClientScopes": [
        "address",
        "phone",
        "offline_access"
    ],
    "access": {
        "view": true,
        "configure": true,
        "manage": true
    }
}

Help is appreciated. We've tried multiple different combinations of
configs with no success.
Thanks! David
This message contains information that may be confidential, privileged or otherwise protected by law from disclosure. It is intended for the exclusive use of the addressee(s) and only the addressee or authorized agent of the addressee may review, copy, distribute or disclose to anyone the message or any information contained within. If you are not the addressee, please contact the sender by electronic reply and immediately delete all copies of the message. This message is not an offer capable of acceptance, does not create an obligation of any kind and no recipient may rely on this message.


From cedric at couralet.eu  Wed Jul 24 01:43:07 2019
From: cedric at couralet.eu (=?utf-8?q?cedric=40couralet=2Eeu?=)
Date: Wed, 24 Jul 2019 07:43:07 +0200
Subject: [keycloak-user]
 =?utf-8?q?CORS_Headers_not_present_on_OPTIONS_req?= =?utf-8?q?uest?=
In-Reply-To: <33b4d24a5640a872d3c05b7239a53340d00baf50.camel@flexential.com>
Message-ID: <6295-5d37f000-39-51109100@233781651>

Hello,

Le Mardi, Juillet 23, 2019 22:44 CEST, David Leonard <David.Leonard at flexential.com> a ?crit: 
 
> Hello everyone,
> 
> We're running a Keycloak 6.0.1 cluster running in kubernetes, and we're
> running into issues with CORS requests by Kibana as a part of
> refreshing the access token. Here is the situation
> 
> 1. User logs into the SP and is able to successfully authenticate.
> 2. The users token expires in the background.
> 3. The SP notices this expired token, and attempts to refresh the token
> starting to issue an auth request to Keycloak. It issues an 'OPTIONS'
> request to determine what it can perform, and this request is missing
> headers..

I may have missed something, but I don't understand this. 

As I see it, there are two options when a token expires : 
- try to refresh it with the refresh token you got (on the /protocol/openid-connect/token endpoint which should provides the correct CORS headers)
- if it failed, redirect the user through the authentication (so no request by the javascript, only a redirect, no CORS involved)

What do you use to manage authentication in kibana?

C?dric



From ghabchi at console.com.au  Wed Jul 24 02:14:38 2019
From: ghabchi at console.com.au (Gerard Habchi)
Date: Wed, 24 Jul 2019 16:14:38 +1000
Subject: [keycloak-user] Fwd: Keycloak 4.4.0 - WFLYSRV0056: Server boot has
 failed in an unrecoverable manner
In-Reply-To: <CA+_1ramh71Ev5ndYWdGDZXkjhxvfYSvJk1+7ismQEHWR_KqkvQ@mail.gmail.com>
References: <CA+_1ramh71Ev5ndYWdGDZXkjhxvfYSvJk1+7ismQEHWR_KqkvQ@mail.gmail.com>
Message-ID: <CA+_1ran8vxyH_Ppjwx3dCDuWgKi54R3fTmZuMXeghNxCuPsq8Q@mail.gmail.com>

Hey All,

I'm running into a strange issue trying to run keycloak version 4.4.0 in
docker...

Please see errors below;

I'm not really sure why this is occurring ?\_(?)_/?

2019-07-24 05:59:44,892 DEBUG [org.jboss.as.config] (MSC service thread
1-1) VM Arguments: -D[Standalone] -Xms64m -Xmx512m -XX:MetaspaceSize=96M
-XX:MaxMetaspaceSize=256m -Djava.net.preferIPv4Stack=true
-Djboss.modules.system.pkgs=org.jboss.byteman -Djava.awt.headless=true
-Dorg.jboss.boot.log.file=/opt/jboss/keycloak/standalone/log/server.log
-Dlogging.configuration=file:/opt/jboss/keycloak/standalone/configuration/logging.properties

2019-07-24 05:59:45,105 INFO  [org.jboss.vfs] (MSC service thread 1-3)
VFS000002: Failed to clean existing content for temp file provider of type
temp. Enable DEBUG level log to find what caused this
2019-07-24 05:59:46,976 INFO  [org.jboss.as.controller] (Controller Boot
Thread) OPVDX002: Failed to pretty print validation error: null
2019-07-24 05:59:46,978 ERROR [org.jboss.as.server] (Controller Boot
Thread) WFLYSRV0055: Caught exception during boot:
org.jboss.as.controller.persistence.ConfigurationPersistenceException:
WFLYCTL0085: Failed to parse configuration
at
org.jboss.as.controller.persistence.XmlConfigurationPersister.load(XmlConfigurationPersister.java:143)
at org.jboss.as.server.ServerService.boot(ServerService.java:377)
at
org.jboss.as.controller.AbstractControllerService$1.run(AbstractControllerService.java:372)
at java.lang.Thread.run(Thread.java:748)
Caused by: javax.xml.stream.XMLStreamException: WFLYCTL0083: Failed to load
module org.jboss.as.clustering.infinispan
at
org.jboss.as.controller.parsing.DeferredExtensionContext.load(DeferredExtensionContext.java:100)
at
org.jboss.as.server.parsing.StandaloneXml_5.readServerElement(StandaloneXml_5.java:203)
at
org.jboss.as.server.parsing.StandaloneXml_5.readElement(StandaloneXml_5.java:124)
at
org.jboss.as.server.parsing.StandaloneXml.readElement(StandaloneXml.java:111)
at
org.jboss.as.server.parsing.StandaloneXml.readElement(StandaloneXml.java:52)
at org.jboss.staxmapper.XMLMapperImpl.processNested(XMLMapperImpl.java:122)
at org.jboss.staxmapper.XMLMapperImpl.parseDocument(XMLMapperImpl.java:76)
at
org.jboss.as.controller.persistence.XmlConfigurationPersister.load(XmlConfigurationPersister.java:126)
... 3 more
Caused by: java.util.concurrent.ExecutionException:
javax.xml.stream.XMLStreamException: WFLYCTL0083: Failed to load module
at java.util.concurrent.FutureTask.report(FutureTask.java:122)
at java.util.concurrent.FutureTask.get(FutureTask.java:192)
at
org.jboss.as.controller.parsing.DeferredExtensionContext.load(DeferredExtensionContext.java:92)
... 10 more
Caused by: javax.xml.stream.XMLStreamException: WFLYCTL0083: Failed to load
module
at
org.jboss.as.controller.parsing.DeferredExtensionContext.loadModule(DeferredExtensionContext.java:129)
at
org.jboss.as.controller.parsing.DeferredExtensionContext.access$000(DeferredExtensionContext.java:44)
at
org.jboss.as.controller.parsing.DeferredExtensionContext$1.call(DeferredExtensionContext.java:74)
at
org.jboss.as.controller.parsing.DeferredExtensionContext$1.call(DeferredExtensionContext.java:71)
at java.util.concurrent.FutureTask.run(FutureTask.java:266)
at
org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35)
at
org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1985)
at
org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1487)
at
org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1349)
at java.lang.Thread.run(Thread.java:748)
at org.jboss.threads.JBossThread.run(JBossThread.java:485)
Caused by: org.jboss.modules.ModuleLoadException: Error loading module from
/opt/jboss/keycloak/modules/system/layers/base/org/jgroups/main/module.xml
at
org.jboss.modules.xml.ModuleXmlParser.parseModuleXml(ModuleXmlParser.java:314)
at
org.jboss.modules.xml.ModuleXmlParser.parseModuleXml(ModuleXmlParser.java:270)
at
org.jboss.modules.xml.ModuleXmlParser.parseModuleXml(ModuleXmlParser.java:231)
at
org.jboss.modules.LocalModuleFinder.parseModuleXmlFile(LocalModuleFinder.java:250)
at
org.jboss.modules.LocalModuleFinder.lambda$findModule$1(LocalModuleFinder.java:195)
at java.security.AccessController.doPrivileged(Native Method)
at
org.jboss.modules.LocalModuleFinder.findModule(LocalModuleFinder.java:195)
at org.jboss.modules.ModuleLoader.findModule0(ModuleLoader.java:693)
at org.jboss.modules.ModuleLoader.findModule(ModuleLoader.java:686)
at org.jboss.modules.ModuleLoader.loadModuleLocal(ModuleLoader.java:496)
at
org.jboss.modules.DelegatingModuleLoader.preloadModule(DelegatingModuleLoader.java:57)
at org.jboss.modules.Module.addPaths(Module.java:1252)
at org.jboss.modules.Module.link(Module.java:1622)
at org.jboss.modules.Module.relinkIfNecessary(Module.java:1650)
at org.jboss.modules.ModuleLoader.loadModule(ModuleLoader.java:296)
at org.jboss.modules.ModuleLoader.loadModule(ModuleLoader.java:280)
at
org.jboss.as.controller.parsing.DeferredExtensionContext.loadModule(DeferredExtensionContext.java:111)
... 10 more
Caused by: org.jboss.modules.xml.XmlPullParserException: Failed to add
resource root 'jgroups-3.6.13.Final.jar' at path 'jgroups-3.6.13.Final.jar'
(position: END_TAG seen ...esources>\n        <resource-root
path="jgroups-3.6.13.Final.jar"/>... @32:57) caused by:
java.io.FileNotFoundException:
/opt/jboss/keycloak/modules/system/layers/base/org/jgroups/main/jgroups-3.6.13.Final.jar
(No such file or directory)
at
org.jboss.modules.xml.ModuleXmlParser.parseResourceRoot(ModuleXmlParser.java:1091)
at
org.jboss.modules.xml.ModuleXmlParser.parseResources(ModuleXmlParser.java:906)
at
org.jboss.modules.xml.ModuleXmlParser.parseModuleContents(ModuleXmlParser.java:680)
at
org.jboss.modules.xml.ModuleXmlParser.parseDocument(ModuleXmlParser.java:441)
at
org.jboss.modules.xml.ModuleXmlParser.parseModuleXml(ModuleXmlParser.java:312)
... 26 more
Caused by: java.io.FileNotFoundException:
/opt/jboss/keycloak/modules/system/layers/base/org/jgroups/main/jgroups-3.6.13.Final.jar
(No such file or directory)
at java.util.zip.ZipFile.open(Native Method)
at java.util.zip.ZipFile.<init>(ZipFile.java:225)
at java.util.zip.ZipFile.<init>(ZipFile.java:155)
at java.util.jar.JarFile.<init>(JarFile.java:166)
at java.util.jar.JarFile.<init>(JarFile.java:145)
at org.jboss.modules.xml.JDKSpecific.getJarFile(JDKSpecific.java:33)
at
org.jboss.modules.xml.ModuleXmlParser$DefaultResourceRootFactory.createResourceLoader(ModuleXmlParser.java:1591)
at
org.jboss.modules.LocalModuleFinder.lambda$new$0(LocalModuleFinder.java:103)
at
org.jboss.modules.xml.ModuleXmlParser.parseResourceRoot(ModuleXmlParser.java:1089)
... 30 more

2019-07-24 05:59:46,982 FATAL [org.jboss.as.server] (Controller Boot
Thread) WFLYSRV0056: Server boot has failed in an unrecoverable manner;
exiting. See previous messages for details.
2019-07-24 05:59:47,028 INFO  [org.jboss.as] (MSC service thread 1-2)
WFLYSRV0050: Keycloak 4.4.0.Final (WildFly Core 5.0.0.Final) stopped in 15ms
Gerard Habchi
*DevOps Engineer*
ghabchi at console.com.au | 1300 131 311
AU 1300 131 311 | NZ 0508 641 199
Console| console.com.au
<http://www.console.com.au?utm_source=signaturesatori&utm_medium=email&utm_campaign=general_signature>
Head Office Level 2 200 Adelaide Street Brisbane QLD 4000
<http://www.twitter.com/consoleau> <http://www.facebook.com/consoleau>
<https://www.linkedin.com/company/console-australia-new-zealand>
------------------------------
<https://consolegroup.zoom.us/webinar/register/9715590027745/WN_FrkgwzGvQ7OOGtjZGncw3Q>

From alvaro.gomez.gimenez at tecsisa.com  Wed Jul 24 09:15:00 2019
From: alvaro.gomez.gimenez at tecsisa.com (=?UTF-8?B?w4FsdmFybyBHw7NtZXo=?=)
Date: Wed, 24 Jul 2019 15:15:00 +0200
Subject: [keycloak-user] Question about CBAC + Pushing Claims +
	Authorization Scopes
Message-ID: <CAPcMcKbufPfUrA+5ec_KswHPhBBVocGGZNRVdkft7egHvSGLMw@mail.gmail.com>

Hi,

We are applying RBAC and CBAC models to evaluate permissions in a
multi-tenant UMA application. We are using Pushing Claims to let custom
policies determine if an user has an specific role in a provided context
(tenant) via Pushing Claims.

Everything works fine if we use non-scoped resources but things get a bit
confusing when we use scoped ones since the pushing-claims (representing
the tenants) end up mixed in the RPT permission claim without leaving any
trace of the scopes with which they were pushed along. Consider the
following example:

We have an application which manages products (represented by resources).
There are profiles (represented by roles) which allow users to sell, modify
or delete products (represented by scopes). A certain user may interact
with one product in the context of a tenant (Determined by the Pushing
claim) with an specific role and with some different role from other
tenant.

- Resource:
  * product (With scopes sell and update)

- Roles:
  * Seller
  * Product-Manager

- Policies:
  * Is-Seller (In the Tenant specified in the Pushing Claim "tenant")
  * Is-Product-Manager (In the Tenant specified in the Pushing Claim
"tenant")

- Permissions:
  * product:sell -> Provides the "sell" scope of the resource "product" if
the "Is-Seller" policy evaluates to grant.
  * product:update -> Provides the "update" scope of the resource
"product" if the "Is-Product-Manager" policy evaluates to grant.

- Users:
  * Alice -> Alice is "Seller" in the tenant "Organization-1" and is
"Product-Manager" in the tenant "Organization 2" so she should be able to
sell products in the context of the tenant "Organization-1" and update
products in the context of "Organization-2" but neither "update" products
in the context of "Organization-1" or sell products in the context of
"Organization-2".

1.- Alice requests an RPT using the following ticket:
     { "resource": "product", "resource_scopes": ["sell"], "claims": {
"tenant": ["Organization-1"] } }

    Since Alice is "Seller" in the "Organization-1" (meaning the Policy
"Is-Seller" will evaluate to "grant" if the provided claim value is
"Organization-1" and the evaluated Identity is Alice) an RPT is emitted
with the following "permission" claim:

    [{
       "resource": "product",
       "resource_scopes": ["sell"],
       "claims": { "tenant": ["Organization-1"] }
    }]

2.- Alice upgrades the previous RPT with the following ticket:
     { "resource": "product", "resource_scopes": ["update"], "claims": {
"tenant": ["Organization-2"] } }

   Here is were things get confusing to us. We'd expect Alice to be granted
when requesting the scope "update" in the context of "Organization-2" since
Alice has the role "Product-Manager" in that tenant. That would be what
happened if Alice was requesting the RPT for the first time instead of
upgrading a previous one. However, since we are upgrading the RPT obtained
in Step 1, when the policy "Is-Product-Manager" is evaluated, the claim
"tenant" is mixed with the one in Step 1 (Since they are not grouped by
scope) resulting in the following permission:

   {
      "resource": "product",
      "resource_scopes": ["sell", "update"],
      "claims": {
          "tenant": ["Organization-1", "Organization-2"]
       }
   }

  The policy can't evaluate to grant since Alice is not "Product-Manager"
in both tenants "Organization-1" and "Organization-2" (Obtained through
$evaluation.getPermission().getClaims()). When evaluating this policy we
would only be interested in the pushing-claim `{ "tenant":
["Organization-2"] }` which was pushed along with the scope "update" (which
is the one being evaluated by the permission "product:update" associated
with this Policy).

   Shouldn't the claims be grouped by the scopes which with they were
pushed along? (See example at the end of this text), Are we missing
something?

   Example:
   {
      "resource": "product",
      "resource_scopes": [
          { "name": "sell", "claims": { "tenant": ["Organization-1"] } },
          { "name": "update", "claims": { "tenant": ["Organization-2"] } },
      ]

Thanks in advance,
?lvaro.

From navptr at bk.ru  Wed Jul 24 14:37:02 2019
From: navptr at bk.ru (=?UTF-8?B?QWw=?=)
Date: Wed, 24 Jul 2019 21:37:02 +0300
Subject: [keycloak-user] =?utf-8?q?On_the_gateway=2C_the_Keycloak_adapter_?=
 =?utf-8?q?=28KeycloakWebSecurityConfigurerAdapter=29_skips_the_token_afte?=
 =?utf-8?q?r_the_user_logs_off?=
Message-ID: <1563993422.118411037@f512.i.mail.ru>

On the gateway, the Keycloak adapter (KeycloakWebSecurityConfigurerAdapter) skips the token after the user logs off:

1. User entered the application. Session is active. Remember the token (Authorization: bearer)

2. The user exits the application (keycloak.logout()). No session in keycloak.

3. Make a request to auth/realms/realm/account with the saved token. No access. Good.

4. Make a request to the resource through the gateway (KeycloakWebSecurityConfigurerAdapter) with the saved token - there is access. Bug!?

Shouldn't this check the KeycloakWebSecurityConfigurerAdapter by default?

How to make gateway not to pass the token after keycloak.logout()?
----------------


From federico.punzo at globant.com  Wed Jul 24 15:30:37 2019
From: federico.punzo at globant.com (Federico Punzo)
Date: Wed, 24 Jul 2019 16:30:37 -0300
Subject: [keycloak-user] Support for MongoDB
Message-ID: <CALcz9x2SsZ-CUe3NAVoGRULk8w6UFLe42+ug5Ns3MW9XeWT6NQ@mail.gmail.com>

Hi,
I'm evaluating using MongoDB as the persistence database for a big KeyCloak
deployment.
However, it appears that currently MongoDB is not supported.
Would you please confirm?

Thanks!

Federico Punzo | Tech Director - BigData Studio
GLOBANT UY: +598 2 927 2270 ext. 37071 | US: +1 877 215 5230 ext. 37071
<https://www.facebook.com/Globant> <http://www.twitter.com/globant>
<http://www.linkedin.com/company/globant> <http://www.globant.com/>

-- 


The information contained in this e-mail may be?confidential. It has been 
sent for the sole use of the intended recipient(s). If the reader of this 
message is not an intended recipient, you are hereby notified that any 
unauthorized review, use, disclosure, dissemination, distribution or 
copying of this communication, or any of its contents, is?strictly?
prohibited.?If you have received it by mistake please let us know by e-mail 
immediately and delete it from your system.?Many thanks.

?

La informaci?n 
contenida en este mensaje puede ser confidencial. Ha sido enviada para el 
uso exclusivo del destinatario(s) previsto. Si el lector de este mensaje no 
fuera el destinatario previsto, por el presente queda Ud. notificado que 
cualquier lectura, uso, publicaci?n, diseminaci?n, distribuci?n o copiado 
de esta comunicaci?n o su contenido est? estrictamente prohibido. En caso 
de que Ud. hubiera recibido este mensaje por error le agradeceremos 
notificarnos por e-mail inmediatamente y eliminarlo de su sistema.?Muchas 
gracias.


From psilva at redhat.com  Wed Jul 24 16:34:27 2019
From: psilva at redhat.com (Pedro Igor Silva)
Date: Wed, 24 Jul 2019 17:34:27 -0300
Subject: [keycloak-user] Question about CBAC + Pushing Claims +
 Authorization Scopes
In-Reply-To: <CAPcMcKbufPfUrA+5ec_KswHPhBBVocGGZNRVdkft7egHvSGLMw@mail.gmail.com>
References: <CAPcMcKbufPfUrA+5ec_KswHPhBBVocGGZNRVdkft7egHvSGLMw@mail.gmail.com>
Message-ID: <CAJrcDBfYjP0cXZMLeQ0rV6fM=NW-3Lh=waoBqh0V3wXhEUH-RA@mail.gmail.com>

Hi ?lvaro,

You are not missing anything and that is how claims are handled. They are a
permission-level (resource + scopes) info and not specific to only the
scopes being requested/granted.

Before finding alternatives, could you tell me how are you pushing these
claims? Are you using our adapters or manually performing HTTP requests
from your app?

Regards.

On Wed, Jul 24, 2019 at 10:20 AM ?lvaro G?mez <
alvaro.gomez.gimenez at tecsisa.com> wrote:

> Hi,
>
> We are applying RBAC and CBAC models to evaluate permissions in a
> multi-tenant UMA application. We are using Pushing Claims to let custom
> policies determine if an user has an specific role in a provided context
> (tenant) via Pushing Claims.
>
> Everything works fine if we use non-scoped resources but things get a bit
> confusing when we use scoped ones since the pushing-claims (representing
> the tenants) end up mixed in the RPT permission claim without leaving any
> trace of the scopes with which they were pushed along. Consider the
> following example:
>
> We have an application which manages products (represented by resources).
> There are profiles (represented by roles) which allow users to sell, modify
> or delete products (represented by scopes). A certain user may interact
> with one product in the context of a tenant (Determined by the Pushing
> claim) with an specific role and with some different role from other
> tenant.
>
> - Resource:
>   * product (With scopes sell and update)
>
> - Roles:
>   * Seller
>   * Product-Manager
>
> - Policies:
>   * Is-Seller (In the Tenant specified in the Pushing Claim "tenant")
>   * Is-Product-Manager (In the Tenant specified in the Pushing Claim
> "tenant")
>
> - Permissions:
>   * product:sell -> Provides the "sell" scope of the resource "product" if
> the "Is-Seller" policy evaluates to grant.
>   * product:update -> Provides the "update" scope of the resource
> "product" if the "Is-Product-Manager" policy evaluates to grant.
>
> - Users:
>   * Alice -> Alice is "Seller" in the tenant "Organization-1" and is
> "Product-Manager" in the tenant "Organization 2" so she should be able to
> sell products in the context of the tenant "Organization-1" and update
> products in the context of "Organization-2" but neither "update" products
> in the context of "Organization-1" or sell products in the context of
> "Organization-2".
>
> 1.- Alice requests an RPT using the following ticket:
>      { "resource": "product", "resource_scopes": ["sell"], "claims": {
> "tenant": ["Organization-1"] } }
>
>     Since Alice is "Seller" in the "Organization-1" (meaning the Policy
> "Is-Seller" will evaluate to "grant" if the provided claim value is
> "Organization-1" and the evaluated Identity is Alice) an RPT is emitted
> with the following "permission" claim:
>
>     [{
>        "resource": "product",
>        "resource_scopes": ["sell"],
>        "claims": { "tenant": ["Organization-1"] }
>     }]
>
> 2.- Alice upgrades the previous RPT with the following ticket:
>      { "resource": "product", "resource_scopes": ["update"], "claims": {
> "tenant": ["Organization-2"] } }
>
>    Here is were things get confusing to us. We'd expect Alice to be granted
> when requesting the scope "update" in the context of "Organization-2" since
> Alice has the role "Product-Manager" in that tenant. That would be what
> happened if Alice was requesting the RPT for the first time instead of
> upgrading a previous one. However, since we are upgrading the RPT obtained
> in Step 1, when the policy "Is-Product-Manager" is evaluated, the claim
> "tenant" is mixed with the one in Step 1 (Since they are not grouped by
> scope) resulting in the following permission:
>
>    {
>       "resource": "product",
>       "resource_scopes": ["sell", "update"],
>       "claims": {
>           "tenant": ["Organization-1", "Organization-2"]
>        }
>    }
>
>   The policy can't evaluate to grant since Alice is not "Product-Manager"
> in both tenants "Organization-1" and "Organization-2" (Obtained through
> $evaluation.getPermission().getClaims()). When evaluating this policy we
> would only be interested in the pushing-claim `{ "tenant":
> ["Organization-2"] }` which was pushed along with the scope "update" (which
> is the one being evaluated by the permission "product:update" associated
> with this Policy).
>
>    Shouldn't the claims be grouped by the scopes which with they were
> pushed along? (See example at the end of this text), Are we missing
> something?
>
>    Example:
>    {
>       "resource": "product",
>       "resource_scopes": [
>           { "name": "sell", "claims": { "tenant": ["Organization-1"] } },
>           { "name": "update", "claims": { "tenant": ["Organization-2"] } },
>       ]
>
> Thanks in advance,
> ?lvaro.
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From kkzxak47 at gmail.com  Wed Jul 24 22:56:59 2019
From: kkzxak47 at gmail.com (kkzxak47)
Date: Thu, 25 Jul 2019 10:56:59 +0800
Subject: [keycloak-user] Custom Social Login, cache access_token,
	Enterprise Wechat
Message-ID: <CAFcwZ1nz94g0GZfAiimH0JphsabvAzOpKrpa3d4kxcP9xPo9wA@mail.gmail.com>

Hi,
  I'm building a SSO service for my company (~1000 employee).
  After investigation I decided to adopt Keycloak as the core component.
  We are using Wechat Work as IM tool (https://work.weixin.qq.com/),
employee DB is based on its Contacts. So it's natural to integrate it as a
social login into Keycloak SSO service.
  In the process of implementing the 'WechatIdentityProvider' and
'WechatIdentityProviderFactory' classes I encountered some trouble.
  Just like Twitter / Google and other providers, some of Wechat Work's
OAuth2 flow is not aligned with standards. For example, the processing of
retrieving the access_token is relatively independent of other OAuth2 code
flow, the access_token is valid for 7200 seconds, its API is limited to be
called 2000 times per day for a single client. We are forced to cache a
global access_token for each client. I noticed that Keycloak is heavily
using Infinispan. My question is can I use it for caching access_token too?
Is it safe to do so? What is your recommendation?
  And I'm working based on version 6.0.1 in standalone mode, is it
appropriate?

  My main programming language is not Java by the way. I learned it ~10
years ago and Spring is new to me. So I'm still learning. It's of great
help to give relevant document links or code snippets, thanks!


Victor

From borislav.sirakov at cantanea.com  Thu Jul 25 05:27:01 2019
From: borislav.sirakov at cantanea.com (Borislav Sirakov)
Date: Thu, 25 Jul 2019 12:27:01 +0300
Subject: [keycloak-user] Keycloak Registration Flow: do not expose "Email
	already exists."
Message-ID: <7064e3f7-36e8-abfd-4ebb-e8874e01c154@cantanea.com>

Hi,

My purpose is to entirely remove the "Email already exists." validation 
from the registration flow. That way I want to prevent exposing any 
information (to the other users) who is registered and who is not.

So, when the user tries to register with an existing email I want to 
redirect him to the email validation template immediately, that way I 
want to make him think that he is registered. Meanwhile keycloak must 
not create a new user or update the user profile at all, it has to skip 
these steps.

I have tried the FormActionFactory and FormAction interfaces, but just 
changing the validation and success methods doesn't seem enough. Any 
suggestions how to override the last step which actually sets the user 
into the storage and sends a verification email and instead of that just 
redirect the user to the verify email page? Is it possible?

Other suggestions, solutions how to achieve described effect (or other 
way to prevent exposing that info) are welcomed. Thank you!

Regards,
Borislav


From dhara.basida at azilen.com  Thu Jul 25 06:55:13 2019
From: dhara.basida at azilen.com (Dhara Basida)
Date: Thu, 25 Jul 2019 16:25:13 +0530
Subject: [keycloak-user] Implementing Multi-tenancy through Keycloak
Message-ID: <75ecc407-9813-ae4a-a1d2-a23f05470101@azilen.com>

Hi Team,

We are currently planning to integrate our application with keycloak in 
order to achieve multi-tenancy. We have hierarchy like :

1)??? Super Admin : Who have access to eveything and will create tenant.
2)??? Tenant Admin :? This admin can create their Members and one tenant 
admin cannot see the data of another tenant admin or Tenant. Also he 
could not able to see any details of Super Admin.
3)??? Members : Member are specific to Tenant. Member have rights to 
create their employees and roles which are applicable for their 
employees. But Member cannot see details of other Members or their 
Tenant Admin.
4)??? Employees : Employees are users who can only have view permissions 
for role applicable to them and manage their profile. He could not able 
to see any details of Member or Tenant.

QUestions :
 ??? I have created admin and tenant. I have link admin with Super Admin 
and Tenant Admin with Realm admin. For Member I linked it with Client 
but somehow I don't find the way to manage it. As I am not able to 
create Employees from member (Not able to get Add options for users and 
If I enable manage users or view users role from tenant admin than I can 
also see data of tenant which is wrong).

 ??? Kindly provide the way to achieve these hierarchy.


Thank you,
Dhara Basida


---
This email has been checked for viruses by Avast antivirus software.
https://www.avast.com/antivirus


From alvaro.gomez.gimenez at tecsisa.com  Thu Jul 25 08:12:10 2019
From: alvaro.gomez.gimenez at tecsisa.com (=?UTF-8?B?w4FsdmFybyBHw7NtZXo=?=)
Date: Thu, 25 Jul 2019 14:12:10 +0200
Subject: [keycloak-user] Question about CBAC + Pushing Claims +
 Authorization Scopes
In-Reply-To: <CAJrcDBfYjP0cXZMLeQ0rV6fM=NW-3Lh=waoBqh0V3wXhEUH-RA@mail.gmail.com>
References: <CAPcMcKbufPfUrA+5ec_KswHPhBBVocGGZNRVdkft7egHvSGLMw@mail.gmail.com>
	<CAJrcDBfYjP0cXZMLeQ0rV6fM=NW-3Lh=waoBqh0V3wXhEUH-RA@mail.gmail.com>
Message-ID: <CAPcMcKbhtjVNi7-AG8RagQzX45mm14EdijBqEggWDCB7+zRVag@mail.gmail.com>

Hi Pedro,

We are performing HTTP ticket requests from our application (An API acting
as a Resource Server). As an example, having the following endpoint:

GET /api/tenants/__TENANT_ID__/products/__PRODUCT_ID__

If we use non-scoped resources (In order to simplify the example) the API
behaves as follows:

  ** The Requesting Party performs this action:

     GET /api/tenants/Organization-1/products/Product-X

  1.- If there is no "permissions" claim (Or it does not contain the
required authorization info, described in step 2) the API performs a ticket
request for the resource "Product-X" pushing the tenant "Organization-1" in
a claim:

    POST https://localhost:8080/auth/realms/***/authz/protection/permission
       [{
            "resource_id": "Product-X",
            "claims": { "tenant": [ "Organization-1" ] }
       }]

  The Requesting Party uses the ticket to obtain a valid RPT containing the
following authorization info:

      "permissions": [
        {
            "resource_id": "Product-X",
            "claims": { "tenant" : ["Organization-1"] }
        }
      ]

  ** The Requesting Party performs the following action using the
previously obtained RPT:

     GET /api/tenants/Organization-2/product/Product-X

  2.- The API checks if the specified resource "Product-X" exists in the
RPT "permissions" claim and contains "Organization-2" in the "tenant"
pushed claim. Since the resource "Product-X" is only provided for the
context "Organization-1" the API requests a ticket for the resource
"Product-X" in the context of the tenant "Organization-2".

   POST https://localhost:8080/auth/realms/***/authz/protection/permission
        [{
            "resource_id": "Product-X",
            "claims": { "tenant": [ "Organization-2" ] }
        }]

    The Requesting Party uses the ticket to upgrade the previous RPT. The
upgraded RPT now contains both tenants in the pushed claims:

        "permissions": [
            {
                "resource_id": "Product-X",
                "claims": { "tenant" : ["Organization-1", "Organization-2"]
}
            }
        ]

This works great with non-scoped resources since, for now on, the Resource
server can grant access to "Product-X" in both contexts "Organization-1"
and "Organization-2". Also, the Resource Server will obtain new tickets if
new contexts (tenants) are requested. However, when we use
scoped-resources, since the pushing claims are not specific to the scopes
being requested, the Resource Server could not determine if the combination
of "Product-X" and some scope is defined for an specific tenant. We could
support this use-case removing scopes from the equation and creating
non-scoped resources like "Product-X:read", "Product-X:write", etc.
However, while we think that this should be implemented using scopes
instead of non-scoped resources, we don't know how to manage claims as we
discussed in the first mail.

Regards,
?lvaro.

El mi?., 24 jul. 2019 a las 22:34, Pedro Igor Silva (<psilva at redhat.com>)
escribi?:

> Hi ?lvaro,
>
> You are not missing anything and that is how claims are handled. They are
> a permission-level (resource + scopes) info and not specific to only the
> scopes being requested/granted.
>
> Before finding alternatives, could you tell me how are you pushing these
> claims? Are you using our adapters or manually performing HTTP requests
> from your app?
>
> Regards.
>
> On Wed, Jul 24, 2019 at 10:20 AM ?lvaro G?mez <
> alvaro.gomez.gimenez at tecsisa.com> wrote:
>
>> Hi,
>>
>> We are applying RBAC and CBAC models to evaluate permissions in a
>> multi-tenant UMA application. We are using Pushing Claims to let custom
>> policies determine if an user has an specific role in a provided context
>> (tenant) via Pushing Claims.
>>
>> Everything works fine if we use non-scoped resources but things get a bit
>> confusing when we use scoped ones since the pushing-claims (representing
>> the tenants) end up mixed in the RPT permission claim without leaving any
>> trace of the scopes with which they were pushed along. Consider the
>> following example:
>>
>> We have an application which manages products (represented by resources).
>> There are profiles (represented by roles) which allow users to sell,
>> modify
>> or delete products (represented by scopes). A certain user may interact
>> with one product in the context of a tenant (Determined by the Pushing
>> claim) with an specific role and with some different role from other
>> tenant.
>>
>> - Resource:
>>   * product (With scopes sell and update)
>>
>> - Roles:
>>   * Seller
>>   * Product-Manager
>>
>> - Policies:
>>   * Is-Seller (In the Tenant specified in the Pushing Claim "tenant")
>>   * Is-Product-Manager (In the Tenant specified in the Pushing Claim
>> "tenant")
>>
>> - Permissions:
>>   * product:sell -> Provides the "sell" scope of the resource "product" if
>> the "Is-Seller" policy evaluates to grant.
>>   * product:update -> Provides the "update" scope of the resource
>> "product" if the "Is-Product-Manager" policy evaluates to grant.
>>
>> - Users:
>>   * Alice -> Alice is "Seller" in the tenant "Organization-1" and is
>> "Product-Manager" in the tenant "Organization 2" so she should be able to
>> sell products in the context of the tenant "Organization-1" and update
>> products in the context of "Organization-2" but neither "update" products
>> in the context of "Organization-1" or sell products in the context of
>> "Organization-2".
>>
>> 1.- Alice requests an RPT using the following ticket:
>>      { "resource": "product", "resource_scopes": ["sell"], "claims": {
>> "tenant": ["Organization-1"] } }
>>
>>     Since Alice is "Seller" in the "Organization-1" (meaning the Policy
>> "Is-Seller" will evaluate to "grant" if the provided claim value is
>> "Organization-1" and the evaluated Identity is Alice) an RPT is emitted
>> with the following "permission" claim:
>>
>>     [{
>>        "resource": "product",
>>        "resource_scopes": ["sell"],
>>        "claims": { "tenant": ["Organization-1"] }
>>     }]
>>
>> 2.- Alice upgrades the previous RPT with the following ticket:
>>      { "resource": "product", "resource_scopes": ["update"], "claims": {
>> "tenant": ["Organization-2"] } }
>>
>>    Here is were things get confusing to us. We'd expect Alice to be
>> granted
>> when requesting the scope "update" in the context of "Organization-2"
>> since
>> Alice has the role "Product-Manager" in that tenant. That would be what
>> happened if Alice was requesting the RPT for the first time instead of
>> upgrading a previous one. However, since we are upgrading the RPT obtained
>> in Step 1, when the policy "Is-Product-Manager" is evaluated, the claim
>> "tenant" is mixed with the one in Step 1 (Since they are not grouped by
>> scope) resulting in the following permission:
>>
>>    {
>>       "resource": "product",
>>       "resource_scopes": ["sell", "update"],
>>       "claims": {
>>           "tenant": ["Organization-1", "Organization-2"]
>>        }
>>    }
>>
>>   The policy can't evaluate to grant since Alice is not "Product-Manager"
>> in both tenants "Organization-1" and "Organization-2" (Obtained through
>> $evaluation.getPermission().getClaims()). When evaluating this policy we
>> would only be interested in the pushing-claim `{ "tenant":
>> ["Organization-2"] }` which was pushed along with the scope "update"
>> (which
>> is the one being evaluated by the permission "product:update" associated
>> with this Policy).
>>
>>    Shouldn't the claims be grouped by the scopes which with they were
>> pushed along? (See example at the end of this text), Are we missing
>> something?
>>
>>    Example:
>>    {
>>       "resource": "product",
>>       "resource_scopes": [
>>           { "name": "sell", "claims": { "tenant": ["Organization-1"] } },
>>           { "name": "update", "claims": { "tenant": ["Organization-2"] }
>> },
>>       ]
>>
>> Thanks in advance,
>> ?lvaro.
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
>

From psilva at redhat.com  Thu Jul 25 08:16:41 2019
From: psilva at redhat.com (Pedro Igor Silva)
Date: Thu, 25 Jul 2019 09:16:41 -0300
Subject: [keycloak-user] Question about CBAC + Pushing Claims +
 Authorization Scopes
In-Reply-To: <CAPcMcKbhtjVNi7-AG8RagQzX45mm14EdijBqEggWDCB7+zRVag@mail.gmail.com>
References: <CAPcMcKbufPfUrA+5ec_KswHPhBBVocGGZNRVdkft7egHvSGLMw@mail.gmail.com>
	<CAJrcDBfYjP0cXZMLeQ0rV6fM=NW-3Lh=waoBqh0V3wXhEUH-RA@mail.gmail.com>
	<CAPcMcKbhtjVNi7-AG8RagQzX45mm14EdijBqEggWDCB7+zRVag@mail.gmail.com>
Message-ID: <CAJrcDBedMF3xzPKzump9iJMNMV4FgwTFDOR98qBdCqxz4k7J7w@mail.gmail.com>

Considering you are in control on how the ticket is created and how claims
are set on it, would be an option to use a specific claim for each tenant
so that in your policies you check tenants based on the claim's key ?

On Thu, Jul 25, 2019 at 9:12 AM ?lvaro G?mez <
alvaro.gomez.gimenez at tecsisa.com> wrote:

> Hi Pedro,
>
> We are performing HTTP ticket requests from our application (An API acting
> as a Resource Server). As an example, having the following endpoint:
>
> GET /api/tenants/__TENANT_ID__/products/__PRODUCT_ID__
>
> If we use non-scoped resources (In order to simplify the example) the API
> behaves as follows:
>
>   ** The Requesting Party performs this action:
>
>      GET /api/tenants/Organization-1/products/Product-X
>
>   1.- If there is no "permissions" claim (Or it does not contain the
> required authorization info, described in step 2) the API performs a ticket
> request for the resource "Product-X" pushing the tenant "Organization-1" in
> a claim:
>
>     POST
> https://localhost:8080/auth/realms/***/authz/protection/permission
>        [{
>             "resource_id": "Product-X",
>             "claims": { "tenant": [ "Organization-1" ] }
>        }]
>
>   The Requesting Party uses the ticket to obtain a valid RPT containing
> the following authorization info:
>
>       "permissions": [
>         {
>             "resource_id": "Product-X",
>             "claims": { "tenant" : ["Organization-1"] }
>         }
>       ]
>
>   ** The Requesting Party performs the following action using the
> previously obtained RPT:
>
>      GET /api/tenants/Organization-2/product/Product-X
>
>   2.- The API checks if the specified resource "Product-X" exists in the
> RPT "permissions" claim and contains "Organization-2" in the "tenant"
> pushed claim. Since the resource "Product-X" is only provided for the
> context "Organization-1" the API requests a ticket for the resource
> "Product-X" in the context of the tenant "Organization-2".
>
>    POST https://localhost:8080/auth/realms/***/authz/protection/permission
>         [{
>             "resource_id": "Product-X",
>             "claims": { "tenant": [ "Organization-2" ] }
>         }]
>
>     The Requesting Party uses the ticket to upgrade the previous RPT. The
> upgraded RPT now contains both tenants in the pushed claims:
>
>         "permissions": [
>             {
>                 "resource_id": "Product-X",
>                 "claims": { "tenant" : ["Organization-1",
> "Organization-2"] }
>             }
>         ]
>
> This works great with non-scoped resources since, for now on, the Resource
> server can grant access to "Product-X" in both contexts "Organization-1"
> and "Organization-2". Also, the Resource Server will obtain new tickets if
> new contexts (tenants) are requested. However, when we use
> scoped-resources, since the pushing claims are not specific to the scopes
> being requested, the Resource Server could not determine if the combination
> of "Product-X" and some scope is defined for an specific tenant. We could
> support this use-case removing scopes from the equation and creating
> non-scoped resources like "Product-X:read", "Product-X:write", etc.
> However, while we think that this should be implemented using scopes
> instead of non-scoped resources, we don't know how to manage claims as we
> discussed in the first mail.
>
> Regards,
> ?lvaro.
>
> El mi?., 24 jul. 2019 a las 22:34, Pedro Igor Silva (<psilva at redhat.com>)
> escribi?:
>
>> Hi ?lvaro,
>>
>> You are not missing anything and that is how claims are handled. They are
>> a permission-level (resource + scopes) info and not specific to only the
>> scopes being requested/granted.
>>
>> Before finding alternatives, could you tell me how are you pushing these
>> claims? Are you using our adapters or manually performing HTTP requests
>> from your app?
>>
>> Regards.
>>
>> On Wed, Jul 24, 2019 at 10:20 AM ?lvaro G?mez <
>> alvaro.gomez.gimenez at tecsisa.com> wrote:
>>
>>> Hi,
>>>
>>> We are applying RBAC and CBAC models to evaluate permissions in a
>>> multi-tenant UMA application. We are using Pushing Claims to let custom
>>> policies determine if an user has an specific role in a provided context
>>> (tenant) via Pushing Claims.
>>>
>>> Everything works fine if we use non-scoped resources but things get a bit
>>> confusing when we use scoped ones since the pushing-claims (representing
>>> the tenants) end up mixed in the RPT permission claim without leaving any
>>> trace of the scopes with which they were pushed along. Consider the
>>> following example:
>>>
>>> We have an application which manages products (represented by resources).
>>> There are profiles (represented by roles) which allow users to sell,
>>> modify
>>> or delete products (represented by scopes). A certain user may interact
>>> with one product in the context of a tenant (Determined by the Pushing
>>> claim) with an specific role and with some different role from other
>>> tenant.
>>>
>>> - Resource:
>>>   * product (With scopes sell and update)
>>>
>>> - Roles:
>>>   * Seller
>>>   * Product-Manager
>>>
>>> - Policies:
>>>   * Is-Seller (In the Tenant specified in the Pushing Claim "tenant")
>>>   * Is-Product-Manager (In the Tenant specified in the Pushing Claim
>>> "tenant")
>>>
>>> - Permissions:
>>>   * product:sell -> Provides the "sell" scope of the resource "product"
>>> if
>>> the "Is-Seller" policy evaluates to grant.
>>>   * product:update -> Provides the "update" scope of the resource
>>> "product" if the "Is-Product-Manager" policy evaluates to grant.
>>>
>>> - Users:
>>>   * Alice -> Alice is "Seller" in the tenant "Organization-1" and is
>>> "Product-Manager" in the tenant "Organization 2" so she should be able to
>>> sell products in the context of the tenant "Organization-1" and update
>>> products in the context of "Organization-2" but neither "update" products
>>> in the context of "Organization-1" or sell products in the context of
>>> "Organization-2".
>>>
>>> 1.- Alice requests an RPT using the following ticket:
>>>      { "resource": "product", "resource_scopes": ["sell"], "claims": {
>>> "tenant": ["Organization-1"] } }
>>>
>>>     Since Alice is "Seller" in the "Organization-1" (meaning the Policy
>>> "Is-Seller" will evaluate to "grant" if the provided claim value is
>>> "Organization-1" and the evaluated Identity is Alice) an RPT is emitted
>>> with the following "permission" claim:
>>>
>>>     [{
>>>        "resource": "product",
>>>        "resource_scopes": ["sell"],
>>>        "claims": { "tenant": ["Organization-1"] }
>>>     }]
>>>
>>> 2.- Alice upgrades the previous RPT with the following ticket:
>>>      { "resource": "product", "resource_scopes": ["update"], "claims": {
>>> "tenant": ["Organization-2"] } }
>>>
>>>    Here is were things get confusing to us. We'd expect Alice to be
>>> granted
>>> when requesting the scope "update" in the context of "Organization-2"
>>> since
>>> Alice has the role "Product-Manager" in that tenant. That would be what
>>> happened if Alice was requesting the RPT for the first time instead of
>>> upgrading a previous one. However, since we are upgrading the RPT
>>> obtained
>>> in Step 1, when the policy "Is-Product-Manager" is evaluated, the claim
>>> "tenant" is mixed with the one in Step 1 (Since they are not grouped by
>>> scope) resulting in the following permission:
>>>
>>>    {
>>>       "resource": "product",
>>>       "resource_scopes": ["sell", "update"],
>>>       "claims": {
>>>           "tenant": ["Organization-1", "Organization-2"]
>>>        }
>>>    }
>>>
>>>   The policy can't evaluate to grant since Alice is not "Product-Manager"
>>> in both tenants "Organization-1" and "Organization-2" (Obtained through
>>> $evaluation.getPermission().getClaims()). When evaluating this policy we
>>> would only be interested in the pushing-claim `{ "tenant":
>>> ["Organization-2"] }` which was pushed along with the scope "update"
>>> (which
>>> is the one being evaluated by the permission "product:update" associated
>>> with this Policy).
>>>
>>>    Shouldn't the claims be grouped by the scopes which with they were
>>> pushed along? (See example at the end of this text), Are we missing
>>> something?
>>>
>>>    Example:
>>>    {
>>>       "resource": "product",
>>>       "resource_scopes": [
>>>           { "name": "sell", "claims": { "tenant": ["Organization-1"] } },
>>>           { "name": "update", "claims": { "tenant": ["Organization-2"] }
>>> },
>>>       ]
>>>
>>> Thanks in advance,
>>> ?lvaro.
>>> _______________________________________________
>>> keycloak-user mailing list
>>> keycloak-user at lists.jboss.org
>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>>

From alvaro.gomez.gimenez at tecsisa.com  Thu Jul 25 09:12:32 2019
From: alvaro.gomez.gimenez at tecsisa.com (=?UTF-8?B?w4FsdmFybyBHw7NtZXo=?=)
Date: Thu, 25 Jul 2019 15:12:32 +0200
Subject: [keycloak-user] Question about CBAC + Pushing Claims +
 Authorization Scopes
In-Reply-To: <CAJrcDBedMF3xzPKzump9iJMNMV4FgwTFDOR98qBdCqxz4k7J7w@mail.gmail.com>
References: <CAPcMcKbufPfUrA+5ec_KswHPhBBVocGGZNRVdkft7egHvSGLMw@mail.gmail.com>
	<CAJrcDBfYjP0cXZMLeQ0rV6fM=NW-3Lh=waoBqh0V3wXhEUH-RA@mail.gmail.com>
	<CAPcMcKbhtjVNi7-AG8RagQzX45mm14EdijBqEggWDCB7+zRVag@mail.gmail.com>
	<CAJrcDBedMF3xzPKzump9iJMNMV4FgwTFDOR98qBdCqxz4k7J7w@mail.gmail.com>
Message-ID: <CAPcMcKaZV=n-xzNw7VCBMPFU96BRTHT+w+3Ziz07yT_xpaJ5Mw@mail.gmail.com>

That would be possible but gets a bit messy when you try to mix it with
scoped-resources (we already thought about this situation). If we consider
the original example (sellers and product-managers trying to access
products from different tenants) we could, as you say, build our pushing
claims as follows:

{
  "resource": "product",
  "resource_scopes": ["sell"],
  "claims": {
    "Organization-1": ["sell"]
  }
}

That permission would represent a Requesting Party trying to gain access to
the scope "sell" in the context of "Organization-1". We need to include the
scope reference in the pushing claims since otherwise we won't know in the
future which scopes were granted to which contexts. This is where things
start to get confusing for us. Considering the previous permission is
correct, if the Requesting Party upgrades the permission trying to access
to the "update" scope of the same resource in the context of
"Organization-2" it will result in the following permission:

{
  "resource": "product",
  "resource_scopes": ["sell", "update"],
  "claims": {
    "Organization-1": ["sell"],
    "Organization-2": ["update"]
  }
}

To be able to grant that permission we find two issues:

1.- The policy "Is-Product-Manager", involved in the permission
"product:update", should only check if the Requesting Party is
"Product-Manager" in the context of the tenants which contains "update" in
the values of the claims. In the example, the policy "Is-Product-Manager",
when evaluated for the permission "product:update", should only check if
the Requesting Party is "Product-Manager" in the context of
"Organization-2" since it makes no sense to check if it's "Product-Manager"
in "Organization-1" (The "update" scope was only requested for
"Organization-2"). This could be solved by creating a policy
"Is-Product-Manager:update" (which only checks tenants associated to the
scope "update" in the pushing claims) but we found this solution a bit
tricky.

2.- If a Requesting Party requested access to the scope "update" along with
other scope "read" in the context of "Organization-2" without being
"Product-Manger" in such organization (which implies it can "read" but not
"update" a product in that organization), we would end up with the
following permission (The first time you request an RPT, Keycloak returns
the granted scopes even though they are not the whole requested scopes):

{
  "resource": "product",
  "resource_scopes": ["read"],
  "claims": {
    "Organization-2": ["update", "read"]
  }
}

As we can see, the granted scope is only "read" but the pushed claims in
"Organization-2" are both "update" and "read" (We requested both scopes in
the ticket). The claim becomes inconsistent since the scope "update" should
be removed and keycloak is not able to do so since it does not understand
our custom claims. If claims were natively grouped by scopes, Keycloak
would clean claims from not-granted scopes. Wdyt?

Thanks!
?lvaro.

El jue., 25 jul. 2019 a las 14:16, Pedro Igor Silva (<psilva at redhat.com>)
escribi?:

> Considering you are in control on how the ticket is created and how claims
> are set on it, would be an option to use a specific claim for each tenant
> so that in your policies you check tenants based on the claim's key ?
>
> On Thu, Jul 25, 2019 at 9:12 AM ?lvaro G?mez <
> alvaro.gomez.gimenez at tecsisa.com> wrote:
>
>> Hi Pedro,
>>
>> We are performing HTTP ticket requests from our application (An API
>> acting as a Resource Server). As an example, having the following endpoint:
>>
>> GET /api/tenants/__TENANT_ID__/products/__PRODUCT_ID__
>>
>> If we use non-scoped resources (In order to simplify the example) the API
>> behaves as follows:
>>
>>   ** The Requesting Party performs this action:
>>
>>      GET /api/tenants/Organization-1/products/Product-X
>>
>>   1.- If there is no "permissions" claim (Or it does not contain the
>> required authorization info, described in step 2) the API performs a ticket
>> request for the resource "Product-X" pushing the tenant "Organization-1" in
>> a claim:
>>
>>     POST
>> https://localhost:8080/auth/realms/***/authz/protection/permission
>>        [{
>>             "resource_id": "Product-X",
>>             "claims": { "tenant": [ "Organization-1" ] }
>>        }]
>>
>>   The Requesting Party uses the ticket to obtain a valid RPT containing
>> the following authorization info:
>>
>>       "permissions": [
>>         {
>>             "resource_id": "Product-X",
>>             "claims": { "tenant" : ["Organization-1"] }
>>         }
>>       ]
>>
>>   ** The Requesting Party performs the following action using the
>> previously obtained RPT:
>>
>>      GET /api/tenants/Organization-2/product/Product-X
>>
>>   2.- The API checks if the specified resource "Product-X" exists in the
>> RPT "permissions" claim and contains "Organization-2" in the "tenant"
>> pushed claim. Since the resource "Product-X" is only provided for the
>> context "Organization-1" the API requests a ticket for the resource
>> "Product-X" in the context of the tenant "Organization-2".
>>
>>    POST
>> https://localhost:8080/auth/realms/***/authz/protection/permission
>>         [{
>>             "resource_id": "Product-X",
>>             "claims": { "tenant": [ "Organization-2" ] }
>>         }]
>>
>>     The Requesting Party uses the ticket to upgrade the previous RPT. The
>> upgraded RPT now contains both tenants in the pushed claims:
>>
>>         "permissions": [
>>             {
>>                 "resource_id": "Product-X",
>>                 "claims": { "tenant" : ["Organization-1",
>> "Organization-2"] }
>>             }
>>         ]
>>
>> This works great with non-scoped resources since, for now on, the
>> Resource server can grant access to "Product-X" in both contexts
>> "Organization-1" and "Organization-2". Also, the Resource Server will
>> obtain new tickets if new contexts (tenants) are requested. However, when
>> we use scoped-resources, since the pushing claims are not specific to the
>> scopes being requested, the Resource Server could not determine if the
>> combination of "Product-X" and some scope is defined for an specific
>> tenant. We could support this use-case removing scopes from the equation
>> and creating non-scoped resources like "Product-X:read", "Product-X:write",
>> etc. However, while we think that this should be implemented using scopes
>> instead of non-scoped resources, we don't know how to manage claims as we
>> discussed in the first mail.
>>
>> Regards,
>> ?lvaro.
>>
>> El mi?., 24 jul. 2019 a las 22:34, Pedro Igor Silva (<psilva at redhat.com>)
>> escribi?:
>>
>>> Hi ?lvaro,
>>>
>>> You are not missing anything and that is how claims are handled. They
>>> are a permission-level (resource + scopes) info and not specific to only
>>> the scopes being requested/granted.
>>>
>>> Before finding alternatives, could you tell me how are you pushing these
>>> claims? Are you using our adapters or manually performing HTTP requests
>>> from your app?
>>>
>>> Regards.
>>>
>>> On Wed, Jul 24, 2019 at 10:20 AM ?lvaro G?mez <
>>> alvaro.gomez.gimenez at tecsisa.com> wrote:
>>>
>>>> Hi,
>>>>
>>>> We are applying RBAC and CBAC models to evaluate permissions in a
>>>> multi-tenant UMA application. We are using Pushing Claims to let custom
>>>> policies determine if an user has an specific role in a provided context
>>>> (tenant) via Pushing Claims.
>>>>
>>>> Everything works fine if we use non-scoped resources but things get a
>>>> bit
>>>> confusing when we use scoped ones since the pushing-claims (representing
>>>> the tenants) end up mixed in the RPT permission claim without leaving
>>>> any
>>>> trace of the scopes with which they were pushed along. Consider the
>>>> following example:
>>>>
>>>> We have an application which manages products (represented by
>>>> resources).
>>>> There are profiles (represented by roles) which allow users to sell,
>>>> modify
>>>> or delete products (represented by scopes). A certain user may interact
>>>> with one product in the context of a tenant (Determined by the Pushing
>>>> claim) with an specific role and with some different role from other
>>>> tenant.
>>>>
>>>> - Resource:
>>>>   * product (With scopes sell and update)
>>>>
>>>> - Roles:
>>>>   * Seller
>>>>   * Product-Manager
>>>>
>>>> - Policies:
>>>>   * Is-Seller (In the Tenant specified in the Pushing Claim "tenant")
>>>>   * Is-Product-Manager (In the Tenant specified in the Pushing Claim
>>>> "tenant")
>>>>
>>>> - Permissions:
>>>>   * product:sell -> Provides the "sell" scope of the resource "product"
>>>> if
>>>> the "Is-Seller" policy evaluates to grant.
>>>>   * product:update -> Provides the "update" scope of the resource
>>>> "product" if the "Is-Product-Manager" policy evaluates to grant.
>>>>
>>>> - Users:
>>>>   * Alice -> Alice is "Seller" in the tenant "Organization-1" and is
>>>> "Product-Manager" in the tenant "Organization 2" so she should be able
>>>> to
>>>> sell products in the context of the tenant "Organization-1" and update
>>>> products in the context of "Organization-2" but neither "update"
>>>> products
>>>> in the context of "Organization-1" or sell products in the context of
>>>> "Organization-2".
>>>>
>>>> 1.- Alice requests an RPT using the following ticket:
>>>>      { "resource": "product", "resource_scopes": ["sell"], "claims": {
>>>> "tenant": ["Organization-1"] } }
>>>>
>>>>     Since Alice is "Seller" in the "Organization-1" (meaning the Policy
>>>> "Is-Seller" will evaluate to "grant" if the provided claim value is
>>>> "Organization-1" and the evaluated Identity is Alice) an RPT is emitted
>>>> with the following "permission" claim:
>>>>
>>>>     [{
>>>>        "resource": "product",
>>>>        "resource_scopes": ["sell"],
>>>>        "claims": { "tenant": ["Organization-1"] }
>>>>     }]
>>>>
>>>> 2.- Alice upgrades the previous RPT with the following ticket:
>>>>      { "resource": "product", "resource_scopes": ["update"], "claims": {
>>>> "tenant": ["Organization-2"] } }
>>>>
>>>>    Here is were things get confusing to us. We'd expect Alice to be
>>>> granted
>>>> when requesting the scope "update" in the context of "Organization-2"
>>>> since
>>>> Alice has the role "Product-Manager" in that tenant. That would be what
>>>> happened if Alice was requesting the RPT for the first time instead of
>>>> upgrading a previous one. However, since we are upgrading the RPT
>>>> obtained
>>>> in Step 1, when the policy "Is-Product-Manager" is evaluated, the claim
>>>> "tenant" is mixed with the one in Step 1 (Since they are not grouped by
>>>> scope) resulting in the following permission:
>>>>
>>>>    {
>>>>       "resource": "product",
>>>>       "resource_scopes": ["sell", "update"],
>>>>       "claims": {
>>>>           "tenant": ["Organization-1", "Organization-2"]
>>>>        }
>>>>    }
>>>>
>>>>   The policy can't evaluate to grant since Alice is not
>>>> "Product-Manager"
>>>> in both tenants "Organization-1" and "Organization-2" (Obtained through
>>>> $evaluation.getPermission().getClaims()). When evaluating this policy we
>>>> would only be interested in the pushing-claim `{ "tenant":
>>>> ["Organization-2"] }` which was pushed along with the scope "update"
>>>> (which
>>>> is the one being evaluated by the permission "product:update" associated
>>>> with this Policy).
>>>>
>>>>    Shouldn't the claims be grouped by the scopes which with they were
>>>> pushed along? (See example at the end of this text), Are we missing
>>>> something?
>>>>
>>>>    Example:
>>>>    {
>>>>       "resource": "product",
>>>>       "resource_scopes": [
>>>>           { "name": "sell", "claims": { "tenant": ["Organization-1"] }
>>>> },
>>>>           { "name": "update", "claims": { "tenant": ["Organization-2"]
>>>> } },
>>>>       ]
>>>>
>>>> Thanks in advance,
>>>> ?lvaro.
>>>> _______________________________________________
>>>> keycloak-user mailing list
>>>> keycloak-user at lists.jboss.org
>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>
>>>

From sshscp at gmail.com  Thu Jul 25 13:29:17 2019
From: sshscp at gmail.com (Nick Powers)
Date: Thu, 25 Jul 2019 11:29:17 -0600
Subject: [keycloak-user] Keycloak Google IDP Broken & wont be fixed!
Message-ID: <CAKeq-mk1QPjB0v0y0aXPmnkEsBTLZkRoz8jXRZWi9X_85Z8foQ@mail.gmail.com>

I ran into an issue with Google IDP & Keycloak, where offline access cannot
be requested and therefore refresh tokens cannot be received from Google.

I then started researching to see if this problem have been previously
identified and resolved.  Although I did find find many people identifying
the problem who were looking for an answer in both this mailing list and in
the keycloak dev mailing list, there was no solutions in any of those
messages.  These questions spanned 4 years, and yet Google IDP remains
broken.

When the question is posed to the user group the messages are either not
answered at all or don't provide any solutions.  In the Keycloak dev
mailing list it is discussed but in general they are dismissed, along the
line of "Why would you need to use offline access?" dismissing it as a
useless feature.  This is a difficult answer to swallow if you need to use
Google offline access with Keycloak.  Especially when all it would take is
to add "access_type=offline" to the Google auth UR.  To be absolutely clear
they devs could easily fix this, they just don't want to.

So, if you have found this message, now or in the future, hoping to find a
way to obtain refresh tokens from Google using Keycloak all I can do is try
and spare you any more time wasted on this pursuit.  Keycloak does NOT
offline access for Google IDP and therefore you cannot receive refresh
tokens from Google with Keycloak, and chances are that it will NEVER
support it.

I wish I was wrong but it doesn't appear that way.

Good Luck!

Nick

From danny.a.opitz at gmail.com  Thu Jul 25 13:38:34 2019
From: danny.a.opitz at gmail.com (Danny Opitz)
Date: Thu, 25 Jul 2019 12:38:34 -0500
Subject: [keycloak-user] Keycloak Gatekeeper Custom Header/Cookie
Message-ID: <CAF0fWi4ZCXp8Un+yY+G1JWc854JGTfv4aYNstgC7O4SpjgjpAg@mail.gmail.com>

Hi,



I have Keycloak and Keycloak-Gatekeeper set up in OpenShift and it's acting
as a proxy for an application.



I have successfully configured Gatekeeper to redirect to Keycloak and set
the access token correctly.



The application that Keycloak Gatekeeper is proxying requires a custom
cookie to be set so I figured I could use the Gatekeeper's custom header
configuration to set this however I'm running into issues.



Configuration looks like:



  discovery-url: https://keycloak-url.com/auth/realms/MyRealm

  client-id: MyClient

  client-secret: MyClientSecret

  cookie-access-name: my.token

  encryption_key: MY_KEY

  listen: :3000

  redirection-url: https://gatekeeper-url.com

  upstream-url: https://app-url.com

  verbose: true

  resources:

  - uri: /home/*

    roles:

      - MyClient:general-access

  headers:

    Set-Cookie: isLoggedIn=true



After re-deploying and running through the auth flow, the upstream
URL/application is not receiving the custom header.  I tried with multiple
headers (key/value) but can't seem to get it working or find where that
header is being injected in the flow.



Any suggestions/ideas on how to get this working?



Thanks,

Dan

From Shweta.Shetty at Teradata.com  Thu Jul 25 13:55:42 2019
From: Shweta.Shetty at Teradata.com (Shetty, Shweta)
Date: Thu, 25 Jul 2019 17:55:42 +0000
Subject: [keycloak-user] API to evict user cache
Message-ID: <MWHPR1301MB220859D688630B674773447992C10@MWHPR1301MB2208.namprd13.prod.outlook.com>

Is there an admin api to evict just a single user-cache ?

Shweta

From psilva at redhat.com  Thu Jul 25 17:19:25 2019
From: psilva at redhat.com (Pedro Igor Silva)
Date: Thu, 25 Jul 2019 18:19:25 -0300
Subject: [keycloak-user] Question about CBAC + Pushing Claims +
 Authorization Scopes
In-Reply-To: <CAPcMcKaZV=n-xzNw7VCBMPFU96BRTHT+w+3Ziz07yT_xpaJ5Mw@mail.gmail.com>
References: <CAPcMcKbufPfUrA+5ec_KswHPhBBVocGGZNRVdkft7egHvSGLMw@mail.gmail.com>
	<CAJrcDBfYjP0cXZMLeQ0rV6fM=NW-3Lh=waoBqh0V3wXhEUH-RA@mail.gmail.com>
	<CAPcMcKbhtjVNi7-AG8RagQzX45mm14EdijBqEggWDCB7+zRVag@mail.gmail.com>
	<CAJrcDBedMF3xzPKzump9iJMNMV4FgwTFDOR98qBdCqxz4k7J7w@mail.gmail.com>
	<CAPcMcKaZV=n-xzNw7VCBMPFU96BRTHT+w+3Ziz07yT_xpaJ5Mw@mail.gmail.com>
Message-ID: <CAJrcDBfyc=ehjzKtuj+3QoGuG8OA6LrUXoVYwgrAbLhqiQ-yzA@mail.gmail.com>

On Thu, Jul 25, 2019 at 10:13 AM ?lvaro G?mez <
alvaro.gomez.gimenez at tecsisa.com> wrote:

>
> 1.- The policy "Is-Product-Manager", involved in the permission
> "product:update", should only check if the Requesting Party is
> "Product-Manager" in the context of the tenants which contains "update" in
> the values of the claims. In the example, the policy "Is-Product-Manager",
> when evaluated for the permission "product:update", should only check if
> the Requesting Party is "Product-Manager" in the context of
> "Organization-2" since it makes no sense to check if it's "Product-Manager"
> in "Organization-1" (The "update" scope was only requested for
> "Organization-2"). This could be solved by creating a policy
> "Is-Product-Manager:update" (which only checks tenants associated to the
> scope "update" in the pushing claims) but we found this solution a bit
> tricky.
>

Could you share how the "Is-Product-Manager" looks like?


> 2.- If a Requesting Party requested access to the scope "update" along
> with other scope "read" in the context of "Organization-2" without being
> "Product-Manger" in such organization (which implies it can "read" but not
> "update" a product in that organization), we would end up with the
> following permission (The first time you request an RPT, Keycloak returns
> the granted scopes even though they are not the whole requested scopes):
>
> {
>   "resource": "product",
>   "resource_scopes": ["read"],
>   "claims": {
>     "Organization-2": ["update", "read"]
>   }
> }
>

> As we can see, the granted scope is only "read" but the pushed claims in
> "Organization-2" are both "update" and "read" (We requested both scopes in
> the ticket). The claim becomes inconsistent since the scope "update" should
> be removed and keycloak is not able to do so since it does not understand
> our custom claims. If claims were natively grouped by scopes, Keycloak
> would clean claims from not-granted scopes. Wdyt?
>

Based on your description, the permission looks correct given that only
"read" was granted but not "update" for org-2. So if you try to update a
resource in org-2 you should be blocked. I guess your point is that
"update" is still as a claim for org-2 ?

FYI, from JS policies you should be able to remove/add claims from
permissions so that you have more control over what is sent back to your
application. As well as, push back claims so that you can advertise actions
or anything else that the resource server should do before granting access
to a resource. Maybe this can be an alternative.

>
> Thanks!
> ?lvaro.
>
> El jue., 25 jul. 2019 a las 14:16, Pedro Igor Silva (<psilva at redhat.com>)
> escribi?:
>
>> Considering you are in control on how the ticket is created and how
>> claims are set on it, would be an option to use a specific claim for each
>> tenant so that in your policies you check tenants based on the claim's key ?
>>
>> On Thu, Jul 25, 2019 at 9:12 AM ?lvaro G?mez <
>> alvaro.gomez.gimenez at tecsisa.com> wrote:
>>
>>> Hi Pedro,
>>>
>>> We are performing HTTP ticket requests from our application (An API
>>> acting as a Resource Server). As an example, having the following endpoint:
>>>
>>> GET /api/tenants/__TENANT_ID__/products/__PRODUCT_ID__
>>>
>>> If we use non-scoped resources (In order to simplify the example) the
>>> API behaves as follows:
>>>
>>>   ** The Requesting Party performs this action:
>>>
>>>      GET /api/tenants/Organization-1/products/Product-X
>>>
>>>   1.- If there is no "permissions" claim (Or it does not contain the
>>> required authorization info, described in step 2) the API performs a ticket
>>> request for the resource "Product-X" pushing the tenant "Organization-1" in
>>> a claim:
>>>
>>>     POST
>>> https://localhost:8080/auth/realms/***/authz/protection/permission
>>>        [{
>>>             "resource_id": "Product-X",
>>>             "claims": { "tenant": [ "Organization-1" ] }
>>>        }]
>>>
>>>   The Requesting Party uses the ticket to obtain a valid RPT containing
>>> the following authorization info:
>>>
>>>       "permissions": [
>>>         {
>>>             "resource_id": "Product-X",
>>>             "claims": { "tenant" : ["Organization-1"] }
>>>         }
>>>       ]
>>>
>>>   ** The Requesting Party performs the following action using the
>>> previously obtained RPT:
>>>
>>>      GET /api/tenants/Organization-2/product/Product-X
>>>
>>>   2.- The API checks if the specified resource "Product-X" exists in the
>>> RPT "permissions" claim and contains "Organization-2" in the "tenant"
>>> pushed claim. Since the resource "Product-X" is only provided for the
>>> context "Organization-1" the API requests a ticket for the resource
>>> "Product-X" in the context of the tenant "Organization-2".
>>>
>>>    POST
>>> https://localhost:8080/auth/realms/***/authz/protection/permission
>>>         [{
>>>             "resource_id": "Product-X",
>>>             "claims": { "tenant": [ "Organization-2" ] }
>>>         }]
>>>
>>>     The Requesting Party uses the ticket to upgrade the previous RPT.
>>> The upgraded RPT now contains both tenants in the pushed claims:
>>>
>>>         "permissions": [
>>>             {
>>>                 "resource_id": "Product-X",
>>>                 "claims": { "tenant" : ["Organization-1",
>>> "Organization-2"] }
>>>             }
>>>         ]
>>>
>>> This works great with non-scoped resources since, for now on, the
>>> Resource server can grant access to "Product-X" in both contexts
>>> "Organization-1" and "Organization-2". Also, the Resource Server will
>>> obtain new tickets if new contexts (tenants) are requested. However, when
>>> we use scoped-resources, since the pushing claims are not specific to the
>>> scopes being requested, the Resource Server could not determine if the
>>> combination of "Product-X" and some scope is defined for an specific
>>> tenant. We could support this use-case removing scopes from the equation
>>> and creating non-scoped resources like "Product-X:read", "Product-X:write",
>>> etc. However, while we think that this should be implemented using scopes
>>> instead of non-scoped resources, we don't know how to manage claims as we
>>> discussed in the first mail.
>>>
>>> Regards,
>>> ?lvaro.
>>>
>>> El mi?., 24 jul. 2019 a las 22:34, Pedro Igor Silva (<psilva at redhat.com>)
>>> escribi?:
>>>
>>>> Hi ?lvaro,
>>>>
>>>> You are not missing anything and that is how claims are handled. They
>>>> are a permission-level (resource + scopes) info and not specific to only
>>>> the scopes being requested/granted.
>>>>
>>>> Before finding alternatives, could you tell me how are you pushing
>>>> these claims? Are you using our adapters or manually performing HTTP
>>>> requests from your app?
>>>>
>>>> Regards.
>>>>
>>>> On Wed, Jul 24, 2019 at 10:20 AM ?lvaro G?mez <
>>>> alvaro.gomez.gimenez at tecsisa.com> wrote:
>>>>
>>>>> Hi,
>>>>>
>>>>> We are applying RBAC and CBAC models to evaluate permissions in a
>>>>> multi-tenant UMA application. We are using Pushing Claims to let custom
>>>>> policies determine if an user has an specific role in a provided
>>>>> context
>>>>> (tenant) via Pushing Claims.
>>>>>
>>>>> Everything works fine if we use non-scoped resources but things get a
>>>>> bit
>>>>> confusing when we use scoped ones since the pushing-claims
>>>>> (representing
>>>>> the tenants) end up mixed in the RPT permission claim without leaving
>>>>> any
>>>>> trace of the scopes with which they were pushed along. Consider the
>>>>> following example:
>>>>>
>>>>> We have an application which manages products (represented by
>>>>> resources).
>>>>> There are profiles (represented by roles) which allow users to sell,
>>>>> modify
>>>>> or delete products (represented by scopes). A certain user may interact
>>>>> with one product in the context of a tenant (Determined by the Pushing
>>>>> claim) with an specific role and with some different role from other
>>>>> tenant.
>>>>>
>>>>> - Resource:
>>>>>   * product (With scopes sell and update)
>>>>>
>>>>> - Roles:
>>>>>   * Seller
>>>>>   * Product-Manager
>>>>>
>>>>> - Policies:
>>>>>   * Is-Seller (In the Tenant specified in the Pushing Claim "tenant")
>>>>>   * Is-Product-Manager (In the Tenant specified in the Pushing Claim
>>>>> "tenant")
>>>>>
>>>>> - Permissions:
>>>>>   * product:sell -> Provides the "sell" scope of the resource
>>>>> "product" if
>>>>> the "Is-Seller" policy evaluates to grant.
>>>>>   * product:update -> Provides the "update" scope of the resource
>>>>> "product" if the "Is-Product-Manager" policy evaluates to grant.
>>>>>
>>>>> - Users:
>>>>>   * Alice -> Alice is "Seller" in the tenant "Organization-1" and is
>>>>> "Product-Manager" in the tenant "Organization 2" so she should be able
>>>>> to
>>>>> sell products in the context of the tenant "Organization-1" and update
>>>>> products in the context of "Organization-2" but neither "update"
>>>>> products
>>>>> in the context of "Organization-1" or sell products in the context of
>>>>> "Organization-2".
>>>>>
>>>>> 1.- Alice requests an RPT using the following ticket:
>>>>>      { "resource": "product", "resource_scopes": ["sell"], "claims": {
>>>>> "tenant": ["Organization-1"] } }
>>>>>
>>>>>     Since Alice is "Seller" in the "Organization-1" (meaning the Policy
>>>>> "Is-Seller" will evaluate to "grant" if the provided claim value is
>>>>> "Organization-1" and the evaluated Identity is Alice) an RPT is emitted
>>>>> with the following "permission" claim:
>>>>>
>>>>>     [{
>>>>>        "resource": "product",
>>>>>        "resource_scopes": ["sell"],
>>>>>        "claims": { "tenant": ["Organization-1"] }
>>>>>     }]
>>>>>
>>>>> 2.- Alice upgrades the previous RPT with the following ticket:
>>>>>      { "resource": "product", "resource_scopes": ["update"], "claims":
>>>>> {
>>>>> "tenant": ["Organization-2"] } }
>>>>>
>>>>>    Here is were things get confusing to us. We'd expect Alice to be
>>>>> granted
>>>>> when requesting the scope "update" in the context of "Organization-2"
>>>>> since
>>>>> Alice has the role "Product-Manager" in that tenant. That would be what
>>>>> happened if Alice was requesting the RPT for the first time instead of
>>>>> upgrading a previous one. However, since we are upgrading the RPT
>>>>> obtained
>>>>> in Step 1, when the policy "Is-Product-Manager" is evaluated, the claim
>>>>> "tenant" is mixed with the one in Step 1 (Since they are not grouped by
>>>>> scope) resulting in the following permission:
>>>>>
>>>>>    {
>>>>>       "resource": "product",
>>>>>       "resource_scopes": ["sell", "update"],
>>>>>       "claims": {
>>>>>           "tenant": ["Organization-1", "Organization-2"]
>>>>>        }
>>>>>    }
>>>>>
>>>>>   The policy can't evaluate to grant since Alice is not
>>>>> "Product-Manager"
>>>>> in both tenants "Organization-1" and "Organization-2" (Obtained through
>>>>> $evaluation.getPermission().getClaims()). When evaluating this policy
>>>>> we
>>>>> would only be interested in the pushing-claim `{ "tenant":
>>>>> ["Organization-2"] }` which was pushed along with the scope "update"
>>>>> (which
>>>>> is the one being evaluated by the permission "product:update"
>>>>> associated
>>>>> with this Policy).
>>>>>
>>>>>    Shouldn't the claims be grouped by the scopes which with they were
>>>>> pushed along? (See example at the end of this text), Are we missing
>>>>> something?
>>>>>
>>>>>    Example:
>>>>>    {
>>>>>       "resource": "product",
>>>>>       "resource_scopes": [
>>>>>           { "name": "sell", "claims": { "tenant": ["Organization-1"] }
>>>>> },
>>>>>           { "name": "update", "claims": { "tenant": ["Organization-2"]
>>>>> } },
>>>>>       ]
>>>>>
>>>>> Thanks in advance,
>>>>> ?lvaro.
>>>>> _______________________________________________
>>>>> keycloak-user mailing list
>>>>> keycloak-user at lists.jboss.org
>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>
>>>>

From psilva at redhat.com  Thu Jul 25 17:30:44 2019
From: psilva at redhat.com (Pedro Igor Silva)
Date: Thu, 25 Jul 2019 18:30:44 -0300
Subject: [keycloak-user] Keycloak Google IDP Broken & wont be fixed!
In-Reply-To: <CAKeq-mk1QPjB0v0y0aXPmnkEsBTLZkRoz8jXRZWi9X_85Z8foQ@mail.gmail.com>
References: <CAKeq-mk1QPjB0v0y0aXPmnkEsBTLZkRoz8jXRZWi9X_85Z8foQ@mail.gmail.com>
Message-ID: <CAJrcDBd+x4agG0qDfy8D7GZ7MmrquC49S0=jKa-T-qtzEVOFHw@mail.gmail.com>

Hi Nick,

Let's try to revert this. We are always trying to do our best to help
people as much as we can.

The documentation [1] does not seem to be updated but there is a "Request
refresh token" switch in the Google Identity Provider that when enabled
makes an offline request (access_type=offline as a query param).

Did you try it out? The related issue is
https://issues.jboss.org/browse/KEYCLOAK-6614.

Please, let me know if you have issues using it. Or maybe you are facing
some other issue that is blocking you to use this functionality.

[1] https://www.keycloak.org/docs/latest/server_admin/index.html#google

Regards.
Pedro Igor

On Thu, Jul 25, 2019 at 3:35 PM Nick Powers <sshscp at gmail.com> wrote:

> I ran into an issue with Google IDP & Keycloak, where offline access cannot
> be requested and therefore refresh tokens cannot be received from Google.
>
> I then started researching to see if this problem have been previously
> identified and resolved.  Although I did find find many people identifying
> the problem who were looking for an answer in both this mailing list and in
> the keycloak dev mailing list, there was no solutions in any of those
> messages.  These questions spanned 4 years, and yet Google IDP remains
> broken.
>
> When the question is posed to the user group the messages are either not
> answered at all or don't provide any solutions.  In the Keycloak dev
> mailing list it is discussed but in general they are dismissed, along the
> line of "Why would you need to use offline access?" dismissing it as a
> useless feature.  This is a difficult answer to swallow if you need to use
> Google offline access with Keycloak.  Especially when all it would take is
> to add "access_type=offline" to the Google auth UR.  To be absolutely clear
> they devs could easily fix this, they just don't want to.
>
> So, if you have found this message, now or in the future, hoping to find a
> way to obtain refresh tokens from Google using Keycloak all I can do is try
> and spare you any more time wasted on this pursuit.  Keycloak does NOT
> offline access for Google IDP and therefore you cannot receive refresh
> tokens from Google with Keycloak, and chances are that it will NEVER
> support it.
>
> I wish I was wrong but it doesn't appear that way.
>
> Good Luck!
>
> Nick
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

From sshscp at gmail.com  Thu Jul 25 17:43:22 2019
From: sshscp at gmail.com (Nick Powers)
Date: Thu, 25 Jul 2019 15:43:22 -0600
Subject: [keycloak-user] Keycloak Google IDP Broken & wont be fixed!
In-Reply-To: <CAJrcDBd+x4agG0qDfy8D7GZ7MmrquC49S0=jKa-T-qtzEVOFHw@mail.gmail.com>
References: <CAKeq-mk1QPjB0v0y0aXPmnkEsBTLZkRoz8jXRZWi9X_85Z8foQ@mail.gmail.com>
	<CAJrcDBd+x4agG0qDfy8D7GZ7MmrquC49S0=jKa-T-qtzEVOFHw@mail.gmail.com>
Message-ID: <CAKeq-mmspfe-00s5QjEKm2usObm-QWOpRrcrBKRNNBVEkDAgAg@mail.gmail.com>

Thanks for responding Pedro!  I will try it with that enabled and see if
that helps.  It does look promising! :)  I'll update once I have tested it.

Thanks again! :)

Nick

On Thu, Jul 25, 2019 at 3:30 PM Pedro Igor Silva <psilva at redhat.com> wrote:

> Hi Nick,
>
> Let's try to revert this. We are always trying to do our best to help
> people as much as we can.
>
> The documentation [1] does not seem to be updated but there is a "Request
> refresh token" switch in the Google Identity Provider that when enabled
> makes an offline request (access_type=offline as a query param).
>
> Did you try it out? The related issue is
> https://issues.jboss.org/browse/KEYCLOAK-6614.
>
> Please, let me know if you have issues using it. Or maybe you are facing
> some other issue that is blocking you to use this functionality.
>
> [1] https://www.keycloak.org/docs/latest/server_admin/index.html#google
>
> Regards.
> Pedro Igor
>
> On Thu, Jul 25, 2019 at 3:35 PM Nick Powers <sshscp at gmail.com> wrote:
>
>> I ran into an issue with Google IDP & Keycloak, where offline access
>> cannot
>> be requested and therefore refresh tokens cannot be received from Google.
>>
>> I then started researching to see if this problem have been previously
>> identified and resolved.  Although I did find find many people identifying
>> the problem who were looking for an answer in both this mailing list and
>> in
>> the keycloak dev mailing list, there was no solutions in any of those
>> messages.  These questions spanned 4 years, and yet Google IDP remains
>> broken.
>>
>> When the question is posed to the user group the messages are either not
>> answered at all or don't provide any solutions.  In the Keycloak dev
>> mailing list it is discussed but in general they are dismissed, along the
>> line of "Why would you need to use offline access?" dismissing it as a
>> useless feature.  This is a difficult answer to swallow if you need to use
>> Google offline access with Keycloak.  Especially when all it would take is
>> to add "access_type=offline" to the Google auth UR.  To be absolutely
>> clear
>> they devs could easily fix this, they just don't want to.
>>
>> So, if you have found this message, now or in the future, hoping to find a
>> way to obtain refresh tokens from Google using Keycloak all I can do is
>> try
>> and spare you any more time wasted on this pursuit.  Keycloak does NOT
>> offline access for Google IDP and therefore you cannot receive refresh
>> tokens from Google with Keycloak, and chances are that it will NEVER
>> support it.
>>
>> I wish I was wrong but it doesn't appear that way.
>>
>> Good Luck!
>>
>> Nick
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>

From sshscp at gmail.com  Thu Jul 25 20:34:40 2019
From: sshscp at gmail.com (Nick Powers)
Date: Thu, 25 Jul 2019 18:34:40 -0600
Subject: [keycloak-user] Keycloak Google IDP Broken & wont be fixed!
In-Reply-To: <CAKeq-mmspfe-00s5QjEKm2usObm-QWOpRrcrBKRNNBVEkDAgAg@mail.gmail.com>
References: <CAKeq-mk1QPjB0v0y0aXPmnkEsBTLZkRoz8jXRZWi9X_85Z8foQ@mail.gmail.com>
	<CAJrcDBd+x4agG0qDfy8D7GZ7MmrquC49S0=jKa-T-qtzEVOFHw@mail.gmail.com>
	<CAKeq-mmspfe-00s5QjEKm2usObm-QWOpRrcrBKRNNBVEkDAgAg@mail.gmail.com>
Message-ID: <CAKeq-mkRka1i-_qzNobYQyeM_TFa4eY1KTKQ0uqiosEQ+h_GJw@mail.gmail.com>

It worked!  With that enabled, I was able to retrieve the Google refresh
token using:

GET /auth/realms/{realm}/broker/{provider_alias}/token
Authorization: Bearer {keycloak_access_token}

Thank you sooo much!  Now I feel bad for getting pissy, but I had pretty
much given up on Keycloak at that point.  Please everyone ignore my
original post.  Although it is undocumented it works exactly as Pedro has
described.

Thanks again!

Nick :)


On Thu, Jul 25, 2019 at 3:43 PM Nick Powers <sshscp at gmail.com> wrote:

> Thanks for responding Pedro!  I will try it with that enabled and see if
> that helps.  It does look promising! :)  I'll update once I have tested it.
>
> Thanks again! :)
>
> Nick
>
> On Thu, Jul 25, 2019 at 3:30 PM Pedro Igor Silva <psilva at redhat.com>
> wrote:
>
>> Hi Nick,
>>
>> Let's try to revert this. We are always trying to do our best to help
>> people as much as we can.
>>
>> The documentation [1] does not seem to be updated but there is a "Request
>> refresh token" switch in the Google Identity Provider that when enabled
>> makes an offline request (access_type=offline as a query param).
>>
>> Did you try it out? The related issue is
>> https://issues.jboss.org/browse/KEYCLOAK-6614.
>>
>> Please, let me know if you have issues using it. Or maybe you are facing
>> some other issue that is blocking you to use this functionality.
>>
>> [1] https://www.keycloak.org/docs/latest/server_admin/index.html#google
>>
>> Regards.
>> Pedro Igor
>>
>> On Thu, Jul 25, 2019 at 3:35 PM Nick Powers <sshscp at gmail.com> wrote:
>>
>>> I ran into an issue with Google IDP & Keycloak, where offline access
>>> cannot
>>> be requested and therefore refresh tokens cannot be received from Google.
>>>
>>> I then started researching to see if this problem have been previously
>>> identified and resolved.  Although I did find find many people
>>> identifying
>>> the problem who were looking for an answer in both this mailing list and
>>> in
>>> the keycloak dev mailing list, there was no solutions in any of those
>>> messages.  These questions spanned 4 years, and yet Google IDP remains
>>> broken.
>>>
>>> When the question is posed to the user group the messages are either not
>>> answered at all or don't provide any solutions.  In the Keycloak dev
>>> mailing list it is discussed but in general they are dismissed, along the
>>> line of "Why would you need to use offline access?" dismissing it as a
>>> useless feature.  This is a difficult answer to swallow if you need to
>>> use
>>> Google offline access with Keycloak.  Especially when all it would take
>>> is
>>> to add "access_type=offline" to the Google auth UR.  To be absolutely
>>> clear
>>> they devs could easily fix this, they just don't want to.
>>>
>>> So, if you have found this message, now or in the future, hoping to find
>>> a
>>> way to obtain refresh tokens from Google using Keycloak all I can do is
>>> try
>>> and spare you any more time wasted on this pursuit.  Keycloak does NOT
>>> offline access for Google IDP and therefore you cannot receive refresh
>>> tokens from Google with Keycloak, and chances are that it will NEVER
>>> support it.
>>>
>>> I wish I was wrong but it doesn't appear that way.
>>>
>>> Good Luck!
>>>
>>> Nick
>>> _______________________________________________
>>> keycloak-user mailing list
>>> keycloak-user at lists.jboss.org
>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>
>>

From kdafop at yahoo.com  Fri Jul 26 06:19:28 2019
From: kdafop at yahoo.com (Konstantinos Dafopoulos)
Date: Fri, 26 Jul 2019 13:19:28 +0300
Subject: [keycloak-user] (no subject)
Message-ID: <E962F4A2-277E-49D9-ADAA-FAB3D0E11B54@yahoo.com>



From psilva at redhat.com  Fri Jul 26 07:43:07 2019
From: psilva at redhat.com (Pedro Igor Silva)
Date: Fri, 26 Jul 2019 08:43:07 -0300
Subject: [keycloak-user] Keycloak Google IDP Broken & wont be fixed!
In-Reply-To: <CAKeq-mkRka1i-_qzNobYQyeM_TFa4eY1KTKQ0uqiosEQ+h_GJw@mail.gmail.com>
References: <CAKeq-mk1QPjB0v0y0aXPmnkEsBTLZkRoz8jXRZWi9X_85Z8foQ@mail.gmail.com>
	<CAJrcDBd+x4agG0qDfy8D7GZ7MmrquC49S0=jKa-T-qtzEVOFHw@mail.gmail.com>
	<CAKeq-mmspfe-00s5QjEKm2usObm-QWOpRrcrBKRNNBVEkDAgAg@mail.gmail.com>
	<CAKeq-mkRka1i-_qzNobYQyeM_TFa4eY1KTKQ0uqiosEQ+h_GJw@mail.gmail.com>
Message-ID: <CAJrcDBfU9gVLv9ETosdUnn4fJW0diMWbFjWtfJdor23q8zyFFg@mail.gmail.com>

Hi Nick,

Glad it worked. No worries!

Regards.
Pedro Igor

On Thu, Jul 25, 2019 at 9:34 PM Nick Powers <sshscp at gmail.com> wrote:

> It worked!  With that enabled, I was able to retrieve the Google refresh
> token using:
>
> GET /auth/realms/{realm}/broker/{provider_alias}/token
> Authorization: Bearer {keycloak_access_token}
>
> Thank you sooo much!  Now I feel bad for getting pissy, but I had pretty
> much given up on Keycloak at that point.  Please everyone ignore my
> original post.  Although it is undocumented it works exactly as Pedro has
> described.
>
> Thanks again!
>
> Nick :)
>
>
> On Thu, Jul 25, 2019 at 3:43 PM Nick Powers <sshscp at gmail.com> wrote:
>
>> Thanks for responding Pedro!  I will try it with that enabled and see if
>> that helps.  It does look promising! :)  I'll update once I have tested it.
>>
>> Thanks again! :)
>>
>> Nick
>>
>> On Thu, Jul 25, 2019 at 3:30 PM Pedro Igor Silva <psilva at redhat.com>
>> wrote:
>>
>>> Hi Nick,
>>>
>>> Let's try to revert this. We are always trying to do our best to help
>>> people as much as we can.
>>>
>>> The documentation [1] does not seem to be updated but there is a
>>> "Request refresh token" switch in the Google Identity Provider that when
>>> enabled makes an offline request (access_type=offline as a query param).
>>>
>>> Did you try it out? The related issue is
>>> https://issues.jboss.org/browse/KEYCLOAK-6614.
>>>
>>> Please, let me know if you have issues using it. Or maybe you are facing
>>> some other issue that is blocking you to use this functionality.
>>>
>>> [1] https://www.keycloak.org/docs/latest/server_admin/index.html#google
>>>
>>> Regards.
>>> Pedro Igor
>>>
>>> On Thu, Jul 25, 2019 at 3:35 PM Nick Powers <sshscp at gmail.com> wrote:
>>>
>>>> I ran into an issue with Google IDP & Keycloak, where offline access
>>>> cannot
>>>> be requested and therefore refresh tokens cannot be received from
>>>> Google.
>>>>
>>>> I then started researching to see if this problem have been previously
>>>> identified and resolved.  Although I did find find many people
>>>> identifying
>>>> the problem who were looking for an answer in both this mailing list
>>>> and in
>>>> the keycloak dev mailing list, there was no solutions in any of those
>>>> messages.  These questions spanned 4 years, and yet Google IDP remains
>>>> broken.
>>>>
>>>> When the question is posed to the user group the messages are either not
>>>> answered at all or don't provide any solutions.  In the Keycloak dev
>>>> mailing list it is discussed but in general they are dismissed, along
>>>> the
>>>> line of "Why would you need to use offline access?" dismissing it as a
>>>> useless feature.  This is a difficult answer to swallow if you need to
>>>> use
>>>> Google offline access with Keycloak.  Especially when all it would take
>>>> is
>>>> to add "access_type=offline" to the Google auth UR.  To be absolutely
>>>> clear
>>>> they devs could easily fix this, they just don't want to.
>>>>
>>>> So, if you have found this message, now or in the future, hoping to
>>>> find a
>>>> way to obtain refresh tokens from Google using Keycloak all I can do is
>>>> try
>>>> and spare you any more time wasted on this pursuit.  Keycloak does NOT
>>>> offline access for Google IDP and therefore you cannot receive refresh
>>>> tokens from Google with Keycloak, and chances are that it will NEVER
>>>> support it.
>>>>
>>>> I wish I was wrong but it doesn't appear that way.
>>>>
>>>> Good Luck!
>>>>
>>>> Nick
>>>> _______________________________________________
>>>> keycloak-user mailing list
>>>> keycloak-user at lists.jboss.org
>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>
>>>

From psilva at redhat.com  Fri Jul 26 08:00:20 2019
From: psilva at redhat.com (Pedro Igor Silva)
Date: Fri, 26 Jul 2019 09:00:20 -0300
Subject: [keycloak-user] API to evict user cache
In-Reply-To: <MWHPR1301MB220859D688630B674773447992C10@MWHPR1301MB2208.namprd13.prod.outlook.com>
References: <MWHPR1301MB220859D688630B674773447992C10@MWHPR1301MB2208.namprd13.prod.outlook.com>
Message-ID: <CAJrcDBeAAfxey2dNh8HpVYy+nVHKy+fDd6TjGWCDNr1W_XTR_g@mail.gmail.com>

If you mean a single entry in the cache no. But you can clear all entries
in user cache (see admin console).

AFAIK, if you want to force a reload to a specific entry you could update
some user info so that the entry is invalidated and eventually cached again.

On Thu, Jul 25, 2019 at 4:15 PM Shetty, Shweta <Shweta.Shetty at teradata.com>
wrote:

> Is there an admin api to evict just a single user-cache ?
>
> Shweta
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

From mrestelli at cuebiq.com  Fri Jul 26 09:26:02 2019
From: mrestelli at cuebiq.com (Matteo Restelli)
Date: Fri, 26 Jul 2019 15:26:02 +0200
Subject: [keycloak-user] Strange behaviour during RPT call -
 java.lang.RuntimeException: Error while reading attributes
Message-ID: <CAHpjjTYzCvQATEnio7_8n=T8W_yBNDdmaxuStjqkViGf2WWdsw@mail.gmail.com>

Hi all,
We're noticing a strange behaviour during RPT call performed by our
adapter. More specifically, we're getting a 500 HTTP Error with the
following description: "Unexpected error while evaluating permissions:
java.lang.RuntimeException: Error while reading attributes" and with a
NullPointerException.
I had a keycloak access token with 5 hours of expiration time and "SSO
Session Idle time", in Keycloak, was set to 30 minutes. I know, it's a
strange configuration, but we've used it just for testing purposes of the
RPT / Authorization part.
Once i've received the error, i've started thinking that the problem was
probably due to the fact that the user's session was expired (i've notice
the error after lunch where i've left the pc alone for about 1 hour), so
i've tried to reproduce the error in this way:

- Login via Resource Owner Password grant flow (via Postman)
- Getting the token and calling our test microservice where the adapter was
configured
- RPT Call worked
- After that, logout the user's session from the user admin console
- Retried the call to the microservice with the same token
- Received the 500 HTTP Error

We're using Keycloak 6.0.1.
I've a question about: is it right that error? In my opinion we should
receive a 401, not 500...

At the bottom you can find the stacktrace.

Thank you very much,
Matteo


12:58:23,179 ERROR
[org.keycloak.authorization.authorization.AuthorizationTokenService]
(default task-784) Unexpected error while evaluating permissions:
java.lang.RuntimeException: Error while reading attributes from security
token.

at
org.keycloak.authorization.common.KeycloakIdentity.<init>(KeycloakIdentity.java:146)

at
org.keycloak.authorization.common.KeycloakIdentity.<init>(KeycloakIdentity.java:69)

at
org.keycloak.authorization.authorization.AuthorizationTokenService.lambda$static$1(AuthorizationTokenService.java:131)

at
org.keycloak.authorization.authorization.AuthorizationTokenService.createEvaluationContext(AuthorizationTokenService.java:379)

at
org.keycloak.authorization.authorization.AuthorizationTokenService.authorize(AuthorizationTokenService.java:160)

at
org.keycloak.protocol.oidc.endpoints.TokenEndpoint.permissionGrant(TokenEndpoint.java:1157)

at
org.keycloak.protocol.oidc.endpoints.TokenEndpoint.processGrantRequest(TokenEndpoint.java:196)

at sun.reflect.GeneratedMethodAccessor811.invoke(Unknown Source)

at
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)

at java.lang.reflect.Method.invoke(Method.java:498)

at
org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java:139)

at
org.jboss.resteasy.core.ResourceMethodInvoker.internalInvokeOnTarget(ResourceMethodInvoker.java:510)

at
org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTargetAfterFilter(ResourceMethodInvoker.java:400)

at
org.jboss.resteasy.core.ResourceMethodInvoker.lambda$invokeOnTarget$0(ResourceMethodInvoker.java:364)

at
org.jboss.resteasy.core.interception.PreMatchContainerRequestContext.filter(PreMatchContainerRequestContext.java:355)

at
org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTarget(ResourceMethodInvoker.java:366)

at
org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:338)

at
org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(ResourceLocatorInvoker.java:137)

at
org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:106)

at
org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(ResourceLocatorInvoker.java:132)

at
org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:100)

at
org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:439)

at
org.jboss.resteasy.core.SynchronousDispatcher.lambda$invoke$4(SynchronousDispatcher.java:229)

at
org.jboss.resteasy.core.SynchronousDispatcher.lambda$preprocess$0(SynchronousDispatcher.java:135)

at
org.jboss.resteasy.core.interception.PreMatchContainerRequestContext.filter(PreMatchContainerRequestContext.java:355)

at
org.jboss.resteasy.core.SynchronousDispatcher.preprocess(SynchronousDispatcher.java:138)

at
org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:215)

at
org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:227)

at
org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56)

at
org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51)

at javax.servlet.http.HttpServlet.service(HttpServlet.java:791)

at
io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:74)

at
io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129)

at
org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:90)

at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61)

at
io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)

at
io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84)

at
io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62)

at
io.undertow.servlet.handlers.ServletChain$1.handleRequest(ServletChain.java:68)

at
io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)

at
org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78)

at
io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)

at
io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:132)

at
io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57)

at
io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)

at
io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)

at
io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)

at
io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)

at
io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77)

at
io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50)

at
io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)

at
io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)

at
org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)

at
io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)

at
org.wildfly.extension.undertow.deployment.GlobalRequestControllerHandler.handleRequest(GlobalRequestControllerHandler.java:68)

at
io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)

at
io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:292)

at
io.undertow.servlet.handlers.ServletInitialHandler.access$100(ServletInitialHandler.java:81)

at
io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:138)

at
io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:135)

at
io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:48)

at
io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43)

at
org.wildfly.extension.undertow.security.SecurityContextThreadSetupAction.lambda$create$0(SecurityContextThreadSetupAction.java:105)

at
org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)

at
org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)

at
org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)

at
org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)

at
io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:272)

at
io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81)

at
io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:104)

at io.undertow.server.Connectors.executeRootHandler(Connectors.java:364)

at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:830)

at
org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35)

at
org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1982)

at
org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1486)

at
org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1377)

at java.lang.Thread.run(Thread.java:748)

Caused by: java.lang.NullPointerException

-- 

Like <https://www.facebook.com/cuebiq/> I Follow  
<https://twitter.com/Cuebiq>I Connect 
<https://www.linkedin.com/company/cuebiq>


This email is reserved 
exclusively for sending and receiving messages inherent working activities, 
and is not intended nor authorized for personal use. Therefore, any 
outgoing messages or incoming response messages will be treated as company 
messages and will be subject to the corporate IT policy and may possibly to 
be read by persons other than by the subscriber of the box. Confidential 
information may be contained in this message. If you are not the address 
indicated in this message, please do not copy or deliver this message to 
anyone. In such case, you should notify the sender immediately and delete 
the original message.

From Shweta.Shetty at Teradata.com  Fri Jul 26 09:50:12 2019
From: Shweta.Shetty at Teradata.com (Shetty, Shweta)
Date: Fri, 26 Jul 2019 13:50:12 +0000
Subject: [keycloak-user] API to evict user cache
In-Reply-To: <CAJrcDBeAAfxey2dNh8HpVYy+nVHKy+fDd6TjGWCDNr1W_XTR_g@mail.gmail.com>
References: <MWHPR1301MB220859D688630B674773447992C10@MWHPR1301MB2208.namprd13.prod.outlook.com>,
	<CAJrcDBeAAfxey2dNh8HpVYy+nVHKy+fDd6TjGWCDNr1W_XTR_g@mail.gmail.com>
Message-ID: <MWHPR1301MB2208F21906744B87D121D2AF92C00@MWHPR1301MB2208.namprd13.prod.outlook.com>

Thanks for your response Pedro. Yes, the updating of the user is helping in evicting the user cache, just tested.

The reason we are resorting in this because: If we use the logout API of keycloak admin then Keycloak evicts the user from the cache in the same method that sets the `notBefore` field in the user. The setting of the 'notBefore'  makes the offline tokens STALE which in my assumption should have been done - since the assumption is offline tokens should still be valid if a user has logged out? Am I wrong here? We use offline tokens for background jobs and these fail. What is the best approach for such jobs then?

Shweta
________________________________
From: Pedro Igor Silva <psilva at redhat.com>
Sent: Friday, July 26, 2019 5:00 AM
To: Shetty, Shweta <Shweta.Shetty at Teradata.com>
Cc: keycloak-user at lists.jboss.org <keycloak-user at lists.jboss.org>
Subject: Re: [keycloak-user] API to evict user cache

[External Email]
________________________________
If you mean a single entry in the cache no. But you can clear all entries in user cache (see admin console).

AFAIK, if you want to force a reload to a specific entry you could update some user info so that the entry is invalidated and eventually cached again.

On Thu, Jul 25, 2019 at 4:15 PM Shetty, Shweta <Shweta.Shetty at teradata.com<mailto:Shweta.Shetty at teradata.com>> wrote:
Is there an admin api to evict just a single user-cache ?

Shweta
_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user

From Shweta.Shetty at Teradata.com  Fri Jul 26 09:59:30 2019
From: Shweta.Shetty at Teradata.com (Shetty, Shweta)
Date: Fri, 26 Jul 2019 13:59:30 +0000
Subject: [keycloak-user] API to evict user cache
In-Reply-To: <MWHPR1301MB2208F21906744B87D121D2AF92C00@MWHPR1301MB2208.namprd13.prod.outlook.com>
References: <MWHPR1301MB220859D688630B674773447992C10@MWHPR1301MB2208.namprd13.prod.outlook.com>,
	<CAJrcDBeAAfxey2dNh8HpVYy+nVHKy+fDd6TjGWCDNr1W_XTR_g@mail.gmail.com>,
	<MWHPR1301MB2208F21906744B87D121D2AF92C00@MWHPR1301MB2208.namprd13.prod.outlook.com>
Message-ID: <MWHPR1301MB22081597950BE5EA6A2BF91492C00@MWHPR1301MB2208.namprd13.prod.outlook.com>

I guess it was not clear why I need to evict a single user cache - I should have completed the previous email.

Since the logout keycloak admin API - sets the 'notBefore' and makes the offline token STALE which we don't want. So what we are resorting is:
1) removing each active session individually
2)Update on the user to evict the user the from cache. (We need to do this because if a user has logged out we want him to cleanly log back in- (for example if he gets added to a new group when he logs back in he will get the new LDAP group else the cache will prevent it from happening)

Shweta

________________________________
From: Shetty, Shweta <Shweta.Shetty at Teradata.com>
Sent: Friday, July 26, 2019 6:50 AM
To: Pedro Igor Silva <psilva at redhat.com>
Cc: keycloak-user at lists.jboss.org <keycloak-user at lists.jboss.org>
Subject: Re: [keycloak-user] API to evict user cache

Thanks for your response Pedro. Yes, the updating of the user is helping in evicting the user cache, just tested.

The reason we are resorting in this because: If we use the logout API of keycloak admin then Keycloak evicts the user from the cache in the same method that sets the `notBefore` field in the user. The setting of the 'notBefore'  makes the offline tokens STALE which in my assumption should have been done - since the assumption is offline tokens should still be valid if a user has logged out? Am I wrong here? We use offline tokens for background jobs and these fail. What is the best approach for such jobs then?

Shweta
________________________________
From: Pedro Igor Silva <psilva at redhat.com>
Sent: Friday, July 26, 2019 5:00 AM
To: Shetty, Shweta <Shweta.Shetty at Teradata.com>
Cc: keycloak-user at lists.jboss.org <keycloak-user at lists.jboss.org>
Subject: Re: [keycloak-user] API to evict user cache

[External Email]
________________________________
If you mean a single entry in the cache no. But you can clear all entries in user cache (see admin console).

AFAIK, if you want to force a reload to a specific entry you could update some user info so that the entry is invalidated and eventually cached again.

On Thu, Jul 25, 2019 at 4:15 PM Shetty, Shweta <Shweta.Shetty at teradata.com<mailto:Shweta.Shetty at teradata.com>> wrote:
Is there an admin api to evict just a single user-cache ?

Shweta
_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user

From kkzxak47 at gmail.com  Fri Jul 26 10:17:08 2019
From: kkzxak47 at gmail.com (kkzxak47)
Date: Fri, 26 Jul 2019 22:17:08 +0800
Subject: [keycloak-user] Custom Social Login, cache access_token,
	Enterprise Wechat
In-Reply-To: <CAFcwZ1nz94g0GZfAiimH0JphsabvAzOpKrpa3d4kxcP9xPo9wA@mail.gmail.com>
References: <CAFcwZ1nz94g0GZfAiimH0JphsabvAzOpKrpa3d4kxcP9xPo9wA@mail.gmail.com>
Message-ID: <CAFcwZ1kBUOOpo3N2vH0k5Oh1QKj6nukzYcPkP=+2qXs9TKV8hA@mail.gmail.com>

I managed to get infinispan running in customized identity provider, but
apart from predefined caches, I am not able to add new cache:
the error reads:
```
21:59:01,683 ERROR [org.jboss.as.controller.management-operation]
(Controller Boot Thread) WFLYCTL0013: Operation ("add") failed - address:
([("deployment" => "keycloak-server.war")]
) - failure description: {
    "WFLYCTL0412: Required services that are not installed:" =>
["org.wildfly.clustering.infinispan.cache.keycloak.xsyxsso"],
    "WFLYCTL0180: Services with missing/unavailable dependencies" => [
        "jboss.naming.context.java.module.auth.auth.ModuleName is missing
[org.wildfly.clustering.infinispan.cache.keycloak.xsyxsso]",
        "jboss.naming.context.java.app.auth is missing
[org.wildfly.clustering.infinispan.cache.keycloak.xsyxsso]",
        "jboss.naming.context.java.module.auth.auth.Validator is missing
[org.wildfly.clustering.infinispan.cache.keycloak.xsyxsso]",

"jboss.deployment.unit.\"keycloak-server.war\".jca.cachedConnectionManagerSetupProcessor
is missing [org.wildfly.clustering.infinispan.cache.keycloak.xsyxsso]",
        "jboss.concurrent.ee.context.config.auth.auth is missing
[org.wildfly.clustering.infinispan.cache.keycloak.xsyxsso]",
        "jboss.deployment.discovery.\"keycloak-server.war\" is missing
[org.wildfly.clustering.infinispan.cache.keycloak.xsyxsso]",
        "jboss.naming.context.java.module.auth.auth.InAppClientContainer is
missing [org.wildfly.clustering.infinispan.cache.keycloak.xsyxsso]",
        "jboss.deployment.unit.\"keycloak-server.war\".INSTALL is missing
[org.wildfly.clustering.infinispan.cache.keycloak.xsyxsso]",
        "jboss.naming.context.java.app.auth.AppName is missing
[org.wildfly.clustering.infinispan.cache.keycloak.xsyxsso]",
        "jboss.naming.context.java.module.auth.auth.InstanceName is missing
[org.wildfly.clustering.infinispan.cache.keycloak.xsyxsso]",
        "jboss.naming.context.java.module.auth.auth is missing
[org.wildfly.clustering.infinispan.cache.keycloak.xsyxsso]",
        "jboss.naming.context.java.module.auth.auth.ValidatorFactory is
missing [org.wildfly.clustering.infinispan.cache.keycloak.xsyxsso]",

"jboss.deployment.unit.\"keycloak-server.war\".ejb3.client-context.registration-service
is missing [org.wildfly.clustering.infinispan.cache.keycloak.xsyxsso]"
    ]
}
```

How can I set up a new cache in infinispan? What is the proper steps to
create it?

kkzxak47 <kkzxak47 at gmail.com> ?2019?7?25??? ??10:56???

> Hi,
>   I'm building a SSO service for my company (~1000 employee).
>   After investigation I decided to adopt Keycloak as the core component.
>   We are using Wechat Work as IM tool (https://work.weixin.qq.com/),
> employee DB is based on its Contacts. So it's natural to integrate it as a
> social login into Keycloak SSO service.
>   In the process of implementing the 'WechatIdentityProvider' and
> 'WechatIdentityProviderFactory' classes I encountered some trouble.
>   Just like Twitter / Google and other providers, some of Wechat Work's
> OAuth2 flow is not aligned with standards. For example, the processing of
> retrieving the access_token is relatively independent of other OAuth2 code
> flow, the access_token is valid for 7200 seconds, its API is limited to be
> called 2000 times per day for a single client. We are forced to cache a
> global access_token for each client. I noticed that Keycloak is heavily
> using Infinispan. My question is can I use it for caching access_token too?
> Is it safe to do so? What is your recommendation?
>   And I'm working based on version 6.0.1 in standalone mode, is it
> appropriate?
>
>   My main programming language is not Java by the way. I learned it ~10
> years ago and Spring is new to me. So I'm still learning. It's of great
> help to give relevant document links or code snippets, thanks!
>
>
> Victor
>

From psilva at redhat.com  Fri Jul 26 11:02:02 2019
From: psilva at redhat.com (Pedro Igor Silva)
Date: Fri, 26 Jul 2019 12:02:02 -0300
Subject: [keycloak-user] API to evict user cache
In-Reply-To: <MWHPR1301MB22081597950BE5EA6A2BF91492C00@MWHPR1301MB2208.namprd13.prod.outlook.com>
References: <MWHPR1301MB220859D688630B674773447992C10@MWHPR1301MB2208.namprd13.prod.outlook.com>
	<CAJrcDBeAAfxey2dNh8HpVYy+nVHKy+fDd6TjGWCDNr1W_XTR_g@mail.gmail.com>
	<MWHPR1301MB2208F21906744B87D121D2AF92C00@MWHPR1301MB2208.namprd13.prod.outlook.com>
	<MWHPR1301MB22081597950BE5EA6A2BF91492C00@MWHPR1301MB2208.namprd13.prod.outlook.com>
Message-ID: <CAJrcDBdL=7xX+TCrZjZDq9DUwvN4j=qnU9P_Vau+b7fg7Yk7JQ@mail.gmail.com>

If the logout is started by a GET to logout endpoint you should still be
able to refresh tokens. I think I'm not following your problem.

On Fri, Jul 26, 2019 at 10:59 AM Shetty, Shweta <Shweta.Shetty at teradata.com>
wrote:

> I guess it was not clear why I need to evict a single user cache - I
> should have completed the previous email.
>
> Since the logout keycloak admin API - sets the 'notBefore' and makes the
> offline token STALE which we don't want. So what we are resorting is:
> 1) removing each active session individually
> 2)Update on the user to evict the user the from cache. (We need to do this
> because if a user has logged out we want him to cleanly log back in- (for
> example if he gets added to a new group when he logs back in he will get
> the new LDAP group else the cache will prevent it from happening)
>
> Shweta
>
> ------------------------------
> *From:* Shetty, Shweta <Shweta.Shetty at Teradata.com>
> *Sent:* Friday, July 26, 2019 6:50 AM
> *To:* Pedro Igor Silva <psilva at redhat.com>
> *Cc:* keycloak-user at lists.jboss.org <keycloak-user at lists.jboss.org>
> *Subject:* Re: [keycloak-user] API to evict user cache
>
> Thanks for your response Pedro. Yes, the updating of the user is helping
> in evicting the user cache, just tested.
>
> The reason we are resorting in this because: If we use the logout API of
> keycloak admin then Keycloak evicts the user from the cache in the same
> method that sets the `notBefore` field in the user. The setting of the
> 'notBefore'  makes the offline tokens STALE which in my assumption should
> have been done - since the assumption is offline tokens should still be
> valid if a user has logged out? Am I wrong here? We use offline tokens for
> background jobs and these fail. What is the best approach for such jobs
> then?
>
> Shweta
> ------------------------------
> *From:* Pedro Igor Silva <psilva at redhat.com>
> *Sent:* Friday, July 26, 2019 5:00 AM
> *To:* Shetty, Shweta <Shweta.Shetty at Teradata.com>
> *Cc:* keycloak-user at lists.jboss.org <keycloak-user at lists.jboss.org>
> *Subject:* Re: [keycloak-user] API to evict user cache
>
> [External Email]
> ------------------------------
> If you mean a single entry in the cache no. But you can clear all entries
> in user cache (see admin console).
>
> AFAIK, if you want to force a reload to a specific entry you could update
> some user info so that the entry is invalidated and eventually cached again.
>
> On Thu, Jul 25, 2019 at 4:15 PM Shetty, Shweta <Shweta.Shetty at teradata.com>
> wrote:
>
> Is there an admin api to evict just a single user-cache ?
>
> Shweta
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
>

From jblashka at redhat.com  Fri Jul 26 13:20:04 2019
From: jblashka at redhat.com (Jared Blashka)
Date: Fri, 26 Jul 2019 13:20:04 -0400
Subject: [keycloak-user] Configuring signing keys on a per-client basis?
Message-ID: <CALO-DfAR7PGzrO8J8ivzb43uSnjC0gM3cmFHecGLRAUx+m4ARg@mail.gmail.com>

We're in the process of rotating one of our realm certificates. I'm aware
that Keycloak can have multiple active and/or passive key providers
configured but it looks like Keycloak will only ever use the single active
key provider with the highest priority for signing.

I'm pretty sure the answer is no but is there any way of configuring
Keycloak to use a specific active key provider when signing for a specific
client? Having that feature would make the key rotation process slightly
easier if you have to coordinate the rotation timing with multiple clients
that can only hardcode a single certificate/public key to trust.

Jared

From Shweta.Shetty at Teradata.com  Fri Jul 26 13:36:23 2019
From: Shweta.Shetty at Teradata.com (Shetty, Shweta)
Date: Fri, 26 Jul 2019 17:36:23 +0000
Subject: [keycloak-user] API to evict user cache
In-Reply-To: <CAJrcDBdL=7xX+TCrZjZDq9DUwvN4j=qnU9P_Vau+b7fg7Yk7JQ@mail.gmail.com>
References: <MWHPR1301MB220859D688630B674773447992C10@MWHPR1301MB2208.namprd13.prod.outlook.com>
	<CAJrcDBeAAfxey2dNh8HpVYy+nVHKy+fDd6TjGWCDNr1W_XTR_g@mail.gmail.com>
	<MWHPR1301MB2208F21906744B87D121D2AF92C00@MWHPR1301MB2208.namprd13.prod.outlook.com>
	<MWHPR1301MB22081597950BE5EA6A2BF91492C00@MWHPR1301MB2208.namprd13.prod.outlook.com>,
	<CAJrcDBdL=7xX+TCrZjZDq9DUwvN4j=qnU9P_Vau+b7fg7Yk7JQ@mail.gmail.com>
Message-ID: <MWHPR1301MB2208C83CA86FFED7297309AD92C00@MWHPR1301MB2208.namprd13.prod.outlook.com>

I am talking about this bug which clears offline tokens on Logout and becomes unusable.
 https://issues.jboss.org/browse/KEYCLOAK-8638?_sscc=t

Shweta

________________________________
From: Pedro Igor Silva <psilva at redhat.com>
Sent: Friday, July 26, 2019 8:02 AM
To: Shetty, Shweta <Shweta.Shetty at Teradata.com>
Cc: keycloak-user at lists.jboss.org <keycloak-user at lists.jboss.org>
Subject: Re: [keycloak-user] API to evict user cache

If the logout is started by a GET to logout endpoint you should still be able to refresh tokens. I think I'm not following your problem.

On Fri, Jul 26, 2019 at 10:59 AM Shetty, Shweta <Shweta.Shetty at teradata.com<mailto:Shweta.Shetty at teradata.com>> wrote:
I guess it was not clear why I need to evict a single user cache - I should have completed the previous email.

Since the logout keycloak admin API - sets the 'notBefore' and makes the offline token STALE which we don't want. So what we are resorting is:
1) removing each active session individually
2)Update on the user to evict the user the from cache. (We need to do this because if a user has logged out we want him to cleanly log back in- (for example if he gets added to a new group when he logs back in he will get the new LDAP group else the cache will prevent it from happening)

Shweta

________________________________
From: Shetty, Shweta <Shweta.Shetty at Teradata.com>
Sent: Friday, July 26, 2019 6:50 AM
To: Pedro Igor Silva <psilva at redhat.com<mailto:psilva at redhat.com>>
Cc: keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org> <keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>>
Subject: Re: [keycloak-user] API to evict user cache

Thanks for your response Pedro. Yes, the updating of the user is helping in evicting the user cache, just tested.

The reason we are resorting in this because: If we use the logout API of keycloak admin then Keycloak evicts the user from the cache in the same method that sets the `notBefore` field in the user. The setting of the 'notBefore'  makes the offline tokens STALE which in my assumption should have been done - since the assumption is offline tokens should still be valid if a user has logged out? Am I wrong here? We use offline tokens for background jobs and these fail. What is the best approach for such jobs then?

Shweta
________________________________
From: Pedro Igor Silva <psilva at redhat.com<mailto:psilva at redhat.com>>
Sent: Friday, July 26, 2019 5:00 AM
To: Shetty, Shweta <Shweta.Shetty at Teradata.com>
Cc: keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org> <keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>>
Subject: Re: [keycloak-user] API to evict user cache

[External Email]
________________________________
If you mean a single entry in the cache no. But you can clear all entries in user cache (see admin console).

AFAIK, if you want to force a reload to a specific entry you could update some user info so that the entry is invalidated and eventually cached again.

On Thu, Jul 25, 2019 at 4:15 PM Shetty, Shweta <Shweta.Shetty at teradata.com<mailto:Shweta.Shetty at teradata.com>> wrote:
Is there an admin api to evict just a single user-cache ?

Shweta
_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user

From psilva at redhat.com  Fri Jul 26 13:43:30 2019
From: psilva at redhat.com (Pedro Igor Silva)
Date: Fri, 26 Jul 2019 14:43:30 -0300
Subject: [keycloak-user] API to evict user cache
In-Reply-To: <MWHPR1301MB2208C83CA86FFED7297309AD92C00@MWHPR1301MB2208.namprd13.prod.outlook.com>
References: <MWHPR1301MB220859D688630B674773447992C10@MWHPR1301MB2208.namprd13.prod.outlook.com>
	<CAJrcDBeAAfxey2dNh8HpVYy+nVHKy+fDd6TjGWCDNr1W_XTR_g@mail.gmail.com>
	<MWHPR1301MB2208F21906744B87D121D2AF92C00@MWHPR1301MB2208.namprd13.prod.outlook.com>
	<MWHPR1301MB22081597950BE5EA6A2BF91492C00@MWHPR1301MB2208.namprd13.prod.outlook.com>
	<CAJrcDBdL=7xX+TCrZjZDq9DUwvN4j=qnU9P_Vau+b7fg7Yk7JQ@mail.gmail.com>
	<MWHPR1301MB2208C83CA86FFED7297309AD92C00@MWHPR1301MB2208.namprd13.prod.outlook.com>
Message-ID: <CAJrcDBcByKTGv+Wia7xjOZNLA8NovCCvy-T9GQbR9A9GNUs0Eg@mail.gmail.com>

Now I see. Thanks for the link. Indeed, the notBefore on the realm is
impacting the persistent sessions. Will comment on that JIRA.

On Fri, Jul 26, 2019 at 2:36 PM Shetty, Shweta <Shweta.Shetty at teradata.com>
wrote:

> I am talking about this bug which clears offline tokens on Logout and
> becomes unusable.
>  https://issues.jboss.org/browse/KEYCLOAK-8638?_sscc=t
>
> Shweta
>
> ------------------------------
> *From:* Pedro Igor Silva <psilva at redhat.com>
> *Sent:* Friday, July 26, 2019 8:02 AM
> *To:* Shetty, Shweta <Shweta.Shetty at Teradata.com>
> *Cc:* keycloak-user at lists.jboss.org <keycloak-user at lists.jboss.org>
> *Subject:* Re: [keycloak-user] API to evict user cache
>
> If the logout is started by a GET to logout endpoint you should still be
> able to refresh tokens. I think I'm not following your problem.
>
> On Fri, Jul 26, 2019 at 10:59 AM Shetty, Shweta <
> Shweta.Shetty at teradata.com> wrote:
>
> I guess it was not clear why I need to evict a single user cache - I
> should have completed the previous email.
>
> Since the logout keycloak admin API - sets the 'notBefore' and makes the
> offline token STALE which we don't want. So what we are resorting is:
> 1) removing each active session individually
> 2)Update on the user to evict the user the from cache. (We need to do this
> because if a user has logged out we want him to cleanly log back in- (for
> example if he gets added to a new group when he logs back in he will get
> the new LDAP group else the cache will prevent it from happening)
>
> Shweta
>
> ------------------------------
> *From:* Shetty, Shweta <Shweta.Shetty at Teradata.com>
> *Sent:* Friday, July 26, 2019 6:50 AM
> *To:* Pedro Igor Silva <psilva at redhat.com>
> *Cc:* keycloak-user at lists.jboss.org <keycloak-user at lists.jboss.org>
> *Subject:* Re: [keycloak-user] API to evict user cache
>
> Thanks for your response Pedro. Yes, the updating of the user is helping
> in evicting the user cache, just tested.
>
> The reason we are resorting in this because: If we use the logout API of
> keycloak admin then Keycloak evicts the user from the cache in the same
> method that sets the `notBefore` field in the user. The setting of the
> 'notBefore'  makes the offline tokens STALE which in my assumption should
> have been done - since the assumption is offline tokens should still be
> valid if a user has logged out? Am I wrong here? We use offline tokens for
> background jobs and these fail. What is the best approach for such jobs
> then?
>
> Shweta
> ------------------------------
> *From:* Pedro Igor Silva <psilva at redhat.com>
> *Sent:* Friday, July 26, 2019 5:00 AM
> *To:* Shetty, Shweta <Shweta.Shetty at Teradata.com>
> *Cc:* keycloak-user at lists.jboss.org <keycloak-user at lists.jboss.org>
> *Subject:* Re: [keycloak-user] API to evict user cache
>
> [External Email]
> ------------------------------
> If you mean a single entry in the cache no. But you can clear all entries
> in user cache (see admin console).
>
> AFAIK, if you want to force a reload to a specific entry you could update
> some user info so that the entry is invalidated and eventually cached again.
>
> On Thu, Jul 25, 2019 at 4:15 PM Shetty, Shweta <Shweta.Shetty at teradata.com>
> wrote:
>
> Is there an admin api to evict just a single user-cache ?
>
> Shweta
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
>

From psilva at redhat.com  Fri Jul 26 15:47:05 2019
From: psilva at redhat.com (Pedro Igor Silva)
Date: Fri, 26 Jul 2019 16:47:05 -0300
Subject: [keycloak-user] Strange behaviour during RPT call -
 java.lang.RuntimeException: Error while reading attributes
In-Reply-To: <CAHpjjTYzCvQATEnio7_8n=T8W_yBNDdmaxuStjqkViGf2WWdsw@mail.gmail.com>
References: <CAHpjjTYzCvQATEnio7_8n=T8W_yBNDdmaxuStjqkViGf2WWdsw@mail.gmail.com>
Message-ID: <CAJrcDBcRTtqu0viA9VeggRYob1-35MeTZaZPTKmf7r9Vi0yOoA@mail.gmail.com>

Hi,

I've created https://issues.jboss.org/browse/KEYCLOAK-10949.

Regards.
Pedro Igor

On Fri, Jul 26, 2019 at 10:50 AM Matteo Restelli <mrestelli at cuebiq.com>
wrote:

> Hi all,
> We're noticing a strange behaviour during RPT call performed by our
> adapter. More specifically, we're getting a 500 HTTP Error with the
> following description: "Unexpected error while evaluating permissions:
> java.lang.RuntimeException: Error while reading attributes" and with a
> NullPointerException.
> I had a keycloak access token with 5 hours of expiration time and "SSO
> Session Idle time", in Keycloak, was set to 30 minutes. I know, it's a
> strange configuration, but we've used it just for testing purposes of the
> RPT / Authorization part.
> Once i've received the error, i've started thinking that the problem was
> probably due to the fact that the user's session was expired (i've notice
> the error after lunch where i've left the pc alone for about 1 hour), so
> i've tried to reproduce the error in this way:
>
> - Login via Resource Owner Password grant flow (via Postman)
> - Getting the token and calling our test microservice where the adapter was
> configured
> - RPT Call worked
> - After that, logout the user's session from the user admin console
> - Retried the call to the microservice with the same token
> - Received the 500 HTTP Error
>
> We're using Keycloak 6.0.1.
> I've a question about: is it right that error? In my opinion we should
> receive a 401, not 500...
>
> At the bottom you can find the stacktrace.
>
> Thank you very much,
> Matteo
>
>
> 12:58:23,179 ERROR
> [org.keycloak.authorization.authorization.AuthorizationTokenService]
> (default task-784) Unexpected error while evaluating permissions:
> java.lang.RuntimeException: Error while reading attributes from security
> token.
>
> at
>
> org.keycloak.authorization.common.KeycloakIdentity.<init>(KeycloakIdentity.java:146)
>
> at
>
> org.keycloak.authorization.common.KeycloakIdentity.<init>(KeycloakIdentity.java:69)
>
> at
>
> org.keycloak.authorization.authorization.AuthorizationTokenService.lambda$static$1(AuthorizationTokenService.java:131)
>
> at
>
> org.keycloak.authorization.authorization.AuthorizationTokenService.createEvaluationContext(AuthorizationTokenService.java:379)
>
> at
>
> org.keycloak.authorization.authorization.AuthorizationTokenService.authorize(AuthorizationTokenService.java:160)
>
> at
>
> org.keycloak.protocol.oidc.endpoints.TokenEndpoint.permissionGrant(TokenEndpoint.java:1157)
>
> at
>
> org.keycloak.protocol.oidc.endpoints.TokenEndpoint.processGrantRequest(TokenEndpoint.java:196)
>
> at sun.reflect.GeneratedMethodAccessor811.invoke(Unknown Source)
>
> at
>
> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
>
> at java.lang.reflect.Method.invoke(Method.java:498)
>
> at
>
> org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java:139)
>
> at
>
> org.jboss.resteasy.core.ResourceMethodInvoker.internalInvokeOnTarget(ResourceMethodInvoker.java:510)
>
> at
>
> org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTargetAfterFilter(ResourceMethodInvoker.java:400)
>
> at
>
> org.jboss.resteasy.core.ResourceMethodInvoker.lambda$invokeOnTarget$0(ResourceMethodInvoker.java:364)
>
> at
>
> org.jboss.resteasy.core.interception.PreMatchContainerRequestContext.filter(PreMatchContainerRequestContext.java:355)
>
> at
>
> org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTarget(ResourceMethodInvoker.java:366)
>
> at
>
> org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:338)
>
> at
>
> org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(ResourceLocatorInvoker.java:137)
>
> at
>
> org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:106)
>
> at
>
> org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(ResourceLocatorInvoker.java:132)
>
> at
>
> org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:100)
>
> at
>
> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:439)
>
> at
>
> org.jboss.resteasy.core.SynchronousDispatcher.lambda$invoke$4(SynchronousDispatcher.java:229)
>
> at
>
> org.jboss.resteasy.core.SynchronousDispatcher.lambda$preprocess$0(SynchronousDispatcher.java:135)
>
> at
>
> org.jboss.resteasy.core.interception.PreMatchContainerRequestContext.filter(PreMatchContainerRequestContext.java:355)
>
> at
>
> org.jboss.resteasy.core.SynchronousDispatcher.preprocess(SynchronousDispatcher.java:138)
>
> at
>
> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:215)
>
> at
>
> org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:227)
>
> at
>
> org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56)
>
> at
>
> org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51)
>
> at javax.servlet.http.HttpServlet.service(HttpServlet.java:791)
>
> at
>
> io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:74)
>
> at
>
> io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129)
>
> at
>
> org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:90)
>
> at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61)
>
> at
>
> io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
>
> at
>
> io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84)
>
> at
>
> io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62)
>
> at
>
> io.undertow.servlet.handlers.ServletChain$1.handleRequest(ServletChain.java:68)
>
> at
>
> io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
>
> at
>
> org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78)
>
> at
>
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>
> at
>
> io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:132)
>
> at
>
> io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57)
>
> at
>
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>
> at
>
> io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)
>
> at
>
> io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)
>
> at
>
> io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)
>
> at
>
> io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77)
>
> at
>
> io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50)
>
> at
>
> io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)
>
> at
>
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>
> at
>
> org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)
>
> at
>
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>
> at
>
> org.wildfly.extension.undertow.deployment.GlobalRequestControllerHandler.handleRequest(GlobalRequestControllerHandler.java:68)
>
> at
>
> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>
> at
>
> io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:292)
>
> at
>
> io.undertow.servlet.handlers.ServletInitialHandler.access$100(ServletInitialHandler.java:81)
>
> at
>
> io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:138)
>
> at
>
> io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:135)
>
> at
>
> io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:48)
>
> at
>
> io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43)
>
> at
>
> org.wildfly.extension.undertow.security.SecurityContextThreadSetupAction.lambda$create$0(SecurityContextThreadSetupAction.java:105)
>
> at
>
> org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)
>
> at
>
> org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)
>
> at
>
> org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)
>
> at
>
> org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)
>
> at
>
> io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:272)
>
> at
>
> io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81)
>
> at
>
> io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:104)
>
> at io.undertow.server.Connectors.executeRootHandler(Connectors.java:364)
>
> at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:830)
>
> at
>
> org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35)
>
> at
>
> org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1982)
>
> at
>
> org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1486)
>
> at
>
> org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1377)
>
> at java.lang.Thread.run(Thread.java:748)
>
> Caused by: java.lang.NullPointerException
>
> --
>
> Like <https://www.facebook.com/cuebiq/> I Follow
> <https://twitter.com/Cuebiq>I Connect
> <https://www.linkedin.com/company/cuebiq>
>
>
> This email is reserved
> exclusively for sending and receiving messages inherent working
> activities,
> and is not intended nor authorized for personal use. Therefore, any
> outgoing messages or incoming response messages will be treated as company
> messages and will be subject to the corporate IT policy and may possibly
> to
> be read by persons other than by the subscriber of the box. Confidential
> information may be contained in this message. If you are not the address
> indicated in this message, please do not copy or deliver this message to
> anyone. In such case, you should notify the sender immediately and delete
> the original message.
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

From Mitchell.S.Bowers at kp.org  Fri Jul 26 17:19:57 2019
From: Mitchell.S.Bowers at kp.org (Mitchell S Bowers)
Date: Fri, 26 Jul 2019 21:19:57 +0000
Subject: [keycloak-user] Keycloak with Ping Identity OpenID Connect
 Provider
In-Reply-To: <CO1P109MB01997FBAAC3D29D73D05471DC6C40@CO1P109MB0199.NAMP109.PROD.OUTLOOK.COM>
References: <CO1P109MB0199D6C28312E3CE659504D9C6CB0@CO1P109MB0199.NAMP109.PROD.OUTLOOK.COM>
	<CAJrcDBcC7s0PPPYtdp-q6GRs=nR7yVA4ZzPtjBy0TXoppjR6ZQ@mail.gmail.com>
	<CO1P109MB01995377D272FD91285EEA31C6C40@CO1P109MB0199.NAMP109.PROD.OUTLOOK.COM>
	<CAJrcDBcnQr7_veN5Lf5q1DZv1QR-5ojW2Y2kVC15WSqT4EWiow@mail.gmail.com>
	<CO1P109MB01997FBAAC3D29D73D05471DC6C40@CO1P109MB0199.NAMP109.PROD.OUTLOOK.COM>
Message-ID: <CO1P109MB019901E85284AB5A4E202D58C6C00@CO1P109MB0199.NAMP109.PROD.OUTLOOK.COM>

Hello Pedro,

When configuring Keycloak to use an external IDP, I?m not finding any documentation regarding logout. Logout is happening at our IDP, however the session and token generated by Keycloak is remaining active.

We?ve also manually terminated the session (Logout all) and revoked all (Revocation tab) but session is still active.

Thanks,

Mitchell

From: Mitchell S Bowers
Sent: Monday, July 22, 2019 11:15 AM
To: Pedro Igor Silva <psilva at redhat.com>
Cc: keycloak-user at lists.jboss.org
Subject: RE: [keycloak-user] Keycloak with Ping Identity OpenID Connect Provider

Hello Pedro,

Thank you for the prompt response. As for your statement below:

IIRC, If the logout is starting at the brokered IdP, it should send a logout request to Keycloak including the initiating_idp parameter. I would check if the brokered IdP is at least sending a request to Keycloak

We?ve configured the logout URL (from our brokered IdP) with our Keycloak client. When tracing the request on logout, it?s making a POST call to Keycloak for a refresh token (not sure why). Then doing a GET logout call to Keycloak (https://keycloak.sandbox.adf.kp.org/auth/realms/master/protocol/openid-connect/logout? , then making a GET call to brokered IdP (Ping).

Thanks


From: Pedro Igor Silva <psilva at redhat.com<mailto:psilva at redhat.com>>
Sent: Monday, July 22, 2019 9:48 AM
To: Mitchell S Bowers <Mitchell.S.Bowers at kp.org<mailto:Mitchell.S.Bowers at kp.org>>
Cc: keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>
Subject: Re: [keycloak-user] Keycloak with Ping Identity OpenID Connect Provider



On Mon, Jul 22, 2019 at 1:19 PM Mitchell S Bowers <Mitchell.S.Bowers at kp.org<mailto:Mitchell.S.Bowers at kp.org>> wrote:
Hello Pedro,

I don?t have any error logs to share but let me explain further. After configuring Ping as the OIDC provider, we would be routed to Ping for authentication. After successfully authenticating, we?d be sent back to the application (Keycloak) with the ID token and Access token. After decoding the JWT, we see that the issuer had changed to Keycloak. So not sure if Keycloak issues it?s own token after receiving the one from Ping.

It does. But you should still be able to obtain the original tokens as per https://www.keycloak.org/docs/latest/server_admin/#retrieving-external-idp-tokens<https://urldefense.proofpoint.com/v2/url?u=https-3A__www.keycloak.org_docs_latest_server-5Fadmin_-23retrieving-2Dexternal-2Didp-2Dtokens&d=DwMFaQ&c=V-WiB07a9ZG9AUogGPqIYBXfVnjryhYX1W_SjITv1Oo&r=VcrfVILBQLZrURPoC8PnflvbtsRzK_VMx7MCP6S2hyI&m=Hbc8uf9Y6vwoyofVCH55ucl3ZrLC65wYeLreDv3adMo&s=0XMlyrg4uBWbGpdPDkxUu-6T5Qm8BfewLrPbP9Pf-rA&e=>.


The other issue is around session management. When invoking logout at our OIDC provider, the session remains active (even after closing the browser). We see the logout happening at our OIDC provider (Ping) but when the user navigates back to the app (Keycloak), they are not challenged. Is there a setting for invalidating the session on logout in Keycloak?

IIRC, If the logout is starting at the brokered IdP, it should send a logout request to Keycloak including the initiating_idp parameter. I would check if the brokered IdP is at least sending a request to Keycloak.

Regards.


Thanks,

Mitchell

From: Pedro Igor Silva <psilva at redhat.com<mailto:psilva at redhat.com>>
Sent: Monday, July 22, 2019 8:08 AM
To: Mitchell S Bowers <Mitchell.S.Bowers at kp.org<mailto:Mitchell.S.Bowers at kp.org>>
Cc: keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>
Subject: Re: [keycloak-user] Keycloak with Ping Identity OpenID Connect Provider


Caution: This email came from outside Kaiser Permanente. Do not open attachments or click on links if you do not recognize the sender.

________________________________
Hi,

I have never configured PingIdentity as a broker before, but the configuration steps should be the same. Could you provide more details about the issues you are facing? Any specific error in logs?

On Fri, Jul 19, 2019 at 8:14 PM Mitchell S Bowers <Mitchell.S.Bowers at kp.org<mailto:Mitchell.S.Bowers at kp.org>> wrote:
Hello,

Is there any documentation on configuring Keycloak to use Ping as an external OIDC provider? I've used the documentation provided for Okta, which should be essentially the same.

However, we are experiencing issues (specifically token issuance and logout). Any info would be greatly appreciated.

https://ultimatesecurity.pro/post/okta-oidc/<https://urldefense.proofpoint.com/v2/url?u=https-3A__ultimatesecurity.pro_post_okta-2Doidc_&d=DwMFaQ&c=V-WiB07a9ZG9AUogGPqIYBXfVnjryhYX1W_SjITv1Oo&r=VcrfVILBQLZrURPoC8PnflvbtsRzK_VMx7MCP6S2hyI&m=12QW91npVFVsrPGWUUgNypU-HQuCg1cj6RDXSZd69NY&s=g0NJX9qRVuh5-xBfiwa3IdLZ5iX1zAWhcFNFlEv2ES0&e=>

Thanks - Mitchell

NOTICE TO RECIPIENT:  If you are not the intended recipient of this e-mail, you are prohibited from sharing, copying, or otherwise using or disclosing its contents.  If you have received this e-mail in error, please notify the sender immediately by reply e-mail and permanently delete this e-mail and any attachments without reading, forwarding or saving them.  Thank you.
_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user<https://urldefense.proofpoint.com/v2/url?u=https-3A__lists.jboss.org_mailman_listinfo_keycloak-2Duser&d=DwMFaQ&c=V-WiB07a9ZG9AUogGPqIYBXfVnjryhYX1W_SjITv1Oo&r=VcrfVILBQLZrURPoC8PnflvbtsRzK_VMx7MCP6S2hyI&m=12QW91npVFVsrPGWUUgNypU-HQuCg1cj6RDXSZd69NY&s=yrtLyzLrA4PEDSUtI8BmxCSrmlYxhyTgUU6AznIwu9o&e=>
NOTICE TO RECIPIENT:  If you are not the intended recipient of this e-mail, you are prohibited from sharing, copying, or otherwise using or disclosing its contents.  If you have received this e-mail in error, please notify the sender immediately by reply e-mail and permanently delete this e-mail and any attachments without reading, forwarding or saving them.  Thank you.
NOTICE TO RECIPIENT:  If you are not the intended recipient of this e-mail, you are prohibited from sharing, copying, or otherwise using or disclosing its contents.  If you have received this e-mail in error, please notify the sender immediately by reply e-mail and permanently delete this e-mail and any attachments without reading, forwarding or saving them.  Thank you.

From philip at yhbt.com  Fri Jul 26 19:31:58 2019
From: philip at yhbt.com (Philip Lowman)
Date: Fri, 26 Jul 2019 19:31:58 -0400
Subject: [keycloak-user] invalid_grant (Code not valid) error
Message-ID: <CAEdY9m9ph3So_Ahm2wkQua-zidMnPCcz9-uwNrPx0Nxg7JNGUg@mail.gmail.com>

Hi,

I'm playing around with integrating KeyCloak 6.0.1 with the Tomcat 8 Adapter
<https://www.keycloak.org/docs/latest/securing_apps/index.html#_tomcat_adapter>
(Open ID Connect).

I'm running into a problem where the Tomcat adapter redirects to KeyCloak
just fine, authentication in Keycloak works, and it redirects back to the
application, but subsequently the Tomcat adapter gets a 400 error response
from the Keycloak server trying to turn the Access Code into a Token.

The error returned from Keycloak is:
       {"error":"invalid_grant","error_description":"Code not valid"}

Here's the code that is logging an error.  The error isn't intermittent,
happens on every request.

protected AuthChallenge resolveCode(String code) {
...
try {
  String httpSessionId = this.deployment.getTokenStore() ==
TokenStore.SESSION ? this.reqAuthenticator.changeHttpSessionId(true) :
null;
  tokenResponse =
ServerRequest.invokeAccessCodeToToken(this.deployment, code,
this.strippedOauthParametersRequestUri, httpSessionId);
} catch (HttpFailure var6) {
  log.error("failed to turn code into token");
  log.error("status from server: " + var6.getStatus());

I've grabbed TRACE logs for org.keycloak category on the server and
included them below, but don't see a smoking gun.

I suspect I have something misconfigured somewhere in Keycloak, as this is
my first time configuring this.
Just wondering if anyone has some suggestions for what I should be doing to
troubleshoot this further?

Thanks!


keycloak.json  (effectively copy/paste from KeyCloak Admin UI)

{
  "realm" : "myrealm",
  "auth-server-url" : "http://myhost.example.org:8080/auth",
  "ssl-required" : "external",
  "resource" : "myclient",
  "verify-token-audience" : true,
  "credentials" : {
    "secret" : "a41c8c84-ac43-43ae-bf9a-0241e24ce56f"
  },
  "use-resource-role-mappings": true,
  "confidential-port" : 0
}


keycloak server.log w/org.keyloak at TRACE
            <logger category="org.keycloak">
                <level name="TRACE"/>
            </logger>

2019-07-26 18:11:26,865 TRACE [org.keycloak.events] (default task-1) type=
*LOGIN*, realmId=308af72f-9f89-4fae-a583-b508d07b521a, clientId=myclient,
userId=19c4c859-e062-4528-b176-3a17caf443af, ipAddress=10.192.226.126,
auth_method=openid-connect, auth_type=code, redirect_uri=
http://localhost:7700/myapp/Foo.do, consent=no_consent_required,
code_id=9634b07b-6191-4a09-85b3-507ff9dcead1, username=myuser, requestUri=
http://myhost.example.org:8080/auth/realms/myrealm/login-actions/authenticate?session_code=jPGBXUCBH0K8dRZshxAbngFZYkXN2w3fkQgA0f2Sczg&execution=4ca897a0-89ef-406c-a889-55e71275643e&client_id=myclient&tab_id=SeyomGlfpSQ,
cookies=[KC_RESTART=eyJhbGciOiJIUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICIyZjc5NzQyZS1jZTA1LTQ3ZGEtYmFhZS05ZTkwMmMyYWUzYmYifQ.eyJjaWQiOiJXVG5BIiwicHR5Ijoib3BlbmlkLWNvbm5lY3QiLCJydXJpIjoiaHR0cDovL2xvY2FsaG9zdDo3NzAwL3dvcmtmb3JjZS9Ib21lLmRvP2FjdGlvbj1zdGFydCIsImFjdCI6IkFVVEhFTlRJQ0FURSIsIm5vdGVzIjp7InNjb3BlIjoib3BlbmlkIiwiaXNzIjoiaHR0cDovL3VzNGxhdGNhczAwMS51c2Rldi53ZnNhYXMubmV0OjgwODAvYXV0aC9yZWFsbXMvcGxvd21hbiIsInJlc3BvbnNlX3R5cGUiOiJjb2RlIiwiY29kZV9jaGFsbGVuZ2VfbWV0aG9kIjoicGxhaW4iLCJyZWRpcmVjdF91cmkiOiJodHRwOi8vbG9jYWxob3N0Ojc3MDAvd29ya2ZvcmNlL0hvbWUuZG8_YWN0aW9uPXN0YXJ0Iiwic3RhdGUiOiIyYzIwYzM0OC04M2Q0LTQ3YzQtOWZlOS0yZWUzZTE5ZjFjNDMiLCJjbGllbnRfcmVxdWVzdF9wYXJhbV9sb2dpbiI6InRydWUifX0.lol6rrM0GZpLxNY8tbMwPQt8_HBPnDSqHzGKvHU9zeY,
AUTH_SESSION_ID=9634b07b-6191-4a09-85b3-507ff9dcead1.myhost]
2019-07-26 18:11:26,865 TRACE
[org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1)
getuserById 19c4c859-e062-4528-b176-3a17caf443af
2019-07-26 18:11:26,865 TRACE
[org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1)
return managedusers
2019-07-26 18:11:26,865 TRACE
[org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1)
getuserById 19c4c859-e062-4528-b176-3a17caf443af
2019-07-26 18:11:26,865 TRACE
[org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1)
return managedusers
2019-07-26 18:11:26,865 TRACE [org.keycloak.keys.DefaultKeyManager]
(default task-1) Active key found: realm=myrealm
kid=2f79742e-ce05-47da-baae-9e902c2ae3bf algorithm=HS256 use=SIG
2019-07-26 18:11:26,865 DEBUG
[org.keycloak.services.managers.AuthenticationManager] (default task-1)
Create login cookie - name: KEYCLOAK_IDENTITY, path: /auth/realms/myrealm/,
max-age: -1
2019-07-26 18:11:26,866 DEBUG
[org.keycloak.services.managers.AuthenticationManager] (default task-1)
Expiring remember me cookie
2019-07-26 18:11:26,866 DEBUG
[org.keycloak.services.managers.AuthenticationManager] (default task-1)
Expiring cookie: KEYCLOAK_REMEMBER_ME path: /auth/realms/myrealm/
2019-07-26 18:11:26,866 DEBUG
[org.keycloak.protocol.oidc.OIDCLoginProtocol] (default task-1)
redirectAccessCode: state: 2c20c348-83d4-47c4-9fe9-2ee3e19f1c43
2019-07-26 18:11:26,866 DEBUG
[org.keycloak.models.sessions.infinispan.InfinispanCodeToTokenStoreProviderFactory]
(default task-1) Not having remote stores. Using normal cache
'actionTokens' for single-use cache of code
2019-07-26 18:11:26,866 DEBUG
[org.keycloak.transaction.JtaTransactionWrapper] (default task-1)
JtaTransactionWrapper  commit
2019-07-26 18:11:26,867 DEBUG
[org.keycloak.transaction.JtaTransactionWrapper] (default task-1)
JtaTransactionWrapper end
2019-07-26 18:11:26,867 TRACE
[org.keycloak.connections.jpa.DefaultJpaConnectionProvider] (default
task-1) DefaultJpaConnectionProvider close()
2019-07-26 18:11:26,982 DEBUG
[org.keycloak.transaction.JtaTransactionWrapper] (default task-1) new
JtaTransactionWrapper
2019-07-26 18:11:26,982 DEBUG
[org.keycloak.transaction.JtaTransactionWrapper] (default task-1) was
existing? false
2019-07-26 18:11:26,982 TRACE
[org.keycloak.models.cache.infinispan.RealmCacheSession] (default task-1)
realm by name cache hit: myrealm
2019-07-26 18:11:26,982 TRACE
[org.keycloak.models.cache.infinispan.RealmCacheSession] (default task-1)
by id cache hit: myrealm
2019-07-26 18:11:26,984 DEBUG
[org.keycloak.authentication.AuthenticationProcessor] (default task-1)
AUTHENTICATE CLIENT
2019-07-26 18:11:26,985 TRACE
[org.keycloak.authentication.ClientAuthenticationFlow] (default task-1)
Using executions for client authentication:
[abb870f0-a067-47db-8ff9-38812ccfadb0,
29a6449f-2624-461d-ae61-a099a4086428, ed974344-8b7c-4ff8-85ea-c61289ef23f0,
1ddbb0e6-5e92-45e6-b8fd-a82ba6b2b0a9]
2019-07-26 18:11:26,985 DEBUG
[org.keycloak.authentication.ClientAuthenticationFlow] (default task-1)
client authenticator: client-secret
2019-07-26 18:11:26,985 TRACE
[org.keycloak.models.cache.infinispan.RealmCacheSession] (default task-1)
client by name cache hit: myclient
2019-07-26 18:11:26,985 TRACE
[org.keycloak.models.cache.infinispan.RealmCacheSession] (default task-1)
client by id cache hit: myclient
2019-07-26 18:11:26,985 DEBUG
[org.keycloak.authentication.ClientAuthenticationFlow] (default task-1)
client authenticator SUCCESS: client-secret
2019-07-26 18:11:26,985 DEBUG
[org.keycloak.authentication.ClientAuthenticationFlow] (default task-1)
Client myclient authenticated by client-secret
2019-07-26 18:11:26,985 TRACE
[org.keycloak.models.cache.infinispan.RealmCacheSession] (default task-1)
by id cache hit: myrealm
2019-07-26 18:11:26,985 TRACE
[org.keycloak.models.cache.infinispan.RealmCacheSession] (default task-1)
client by id cache hit: myclient
2019-07-26 18:11:26,985 TRACE
[org.keycloak.models.cache.infinispan.RealmCacheSession] (default task-1)
by id cache hit: myrealm
2019-07-26 18:11:26,985 DEBUG
[org.keycloak.models.sessions.infinispan.InfinispanUserSessionProvider]
(default task-1)
getUserSessionWithPredicate(9634b07b-6191-4a09-85b3-507ff9dcead1): found in
local cache
2019-07-26 18:11:26,985 TRACE
[org.keycloak.models.cache.infinispan.RealmCacheSession] (default task-1)
client by id cache hit: myclient
2019-07-26 18:11:26,985 TRACE
[org.keycloak.protocol.oidc.utils.OAuth2CodeParser] (default task-1)
Successfully verified code '124e5aba-eb17-4eee-b435-6faf7aaf92ae'. User
session: '9634b07b-6191-4a09-85b3-507ff9dcead1', client:
'd6cce783-5559-48c1-b1b8-7f20d2fcf166'
2019-07-26 18:11:26,985 TRACE
[org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1)
getuserById 19c4c859-e062-4528-b176-3a17caf443af
2019-07-26 18:11:26,985 TRACE
[org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1)
getuserById 19c4c859-e062-4528-b176-3a17caf443af
2019-07-26 18:11:26,986 TRACE
[org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1)
return managedusers
2019-07-26 18:11:26,986 DEBUG
[org.keycloak.protocol.oidc.endpoints.TokenEndpoint] (default task-1)
Adapter Session '562F91F71B1FFDABD7E0EE2761BA03CE-n1' saved in
ClientSession for client 'myclient'. Host is 'mybox'
2019-07-26 18:11:26,986 TRACE
[org.keycloak.connections.jpa.DefaultJpaConnectionProviderFactory] (default
task-1) Create JpaConnectionProvider
2019-07-26 18:11:26,986 TRACE
[org.keycloak.models.cache.infinispan.RealmCacheSession] (default task-1)
client by id cache hit: myclient
2019-07-26 18:11:26,987 TRACE
[org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1)
getuserById 19c4c859-e062-4528-b176-3a17caf443af
2019-07-26 18:11:26,987 TRACE
[org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1)
return managedusers
2019-07-26 18:11:26,992 TRACE
[org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1)
getuserById 19c4c859-e062-4528-b176-3a17caf443af
2019-07-26 18:11:26,992 TRACE
[org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1)
return managedusers
2019-07-26 18:11:26,992 TRACE
[org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1)
getuserById 19c4c859-e062-4528-b176-3a17caf443af
2019-07-26 18:11:26,992 TRACE
[org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1)
return managedusers
2019-07-26 18:11:26,992 TRACE
[org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1)
getuserById 19c4c859-e062-4528-b176-3a17caf443af
2019-07-26 18:11:26,993 TRACE
[org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1)
return managedusers
2019-07-26 18:11:26,993 TRACE
[org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1)
getuserById 19c4c859-e062-4528-b176-3a17caf443af
2019-07-26 18:11:26,993 TRACE
[org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1)
return managedusers
2019-07-26 18:11:26,993 TRACE
[org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1)
getuserById 19c4c859-e062-4528-b176-3a17caf443af
2019-07-26 18:11:26,993 TRACE
[org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1)
return managedusers
2019-07-26 18:11:26,993 TRACE
[org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1)
getuserById 19c4c859-e062-4528-b176-3a17caf443af
2019-07-26 18:11:26,993 TRACE
[org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1)
return managedusers
2019-07-26 18:11:26,993 TRACE
[org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1)
getuserById 19c4c859-e062-4528-b176-3a17caf443af
2019-07-26 18:11:26,993 TRACE
[org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1)
return managedusers
2019-07-26 18:11:26,993 TRACE
[org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1)
getuserById 19c4c859-e062-4528-b176-3a17caf443af
2019-07-26 18:11:26,993 TRACE
[org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1)
return managedusers
2019-07-26 18:11:26,993 TRACE
[org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1)
getuserById 19c4c859-e062-4528-b176-3a17caf443af
2019-07-26 18:11:26,993 TRACE
[org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1)
return managedusers
2019-07-26 18:11:26,993 TRACE
[org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1)
getuserById 19c4c859-e062-4528-b176-3a17caf443af
2019-07-26 18:11:26,993 TRACE
[org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1)
return managedusers
2019-07-26 18:11:26,993 TRACE
[org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1)
getuserById 19c4c859-e062-4528-b176-3a17caf443af
2019-07-26 18:11:26,993 TRACE
[org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1)
return managedusers
2019-07-26 18:11:27,021 TRACE [org.keycloak.keys.DefaultKeyManager]
(default task-1) Active key found: realm=myrealm
kid=YWkA3p3uFbmG1gsE_9bUAVCz0K_vZjkU8U4Q-WeN4Do algorithm=RS256 use=SIG
2019-07-26 18:11:27,023 TRACE [org.keycloak.keys.DefaultKeyManager]
(default task-1) Active key found: realm=myrealm
kid=YWkA3p3uFbmG1gsE_9bUAVCz0K_vZjkU8U4Q-WeN4Do algorithm=RS256 use=SIG
2019-07-26 18:11:27,025 TRACE [org.keycloak.keys.DefaultKeyManager]
(default task-1) Active key found: realm=myrealm
kid=2f79742e-ce05-47da-baae-9e902c2ae3bf algorithm=HS256 use=SIG
2019-07-26 18:11:27,025 TRACE
[org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1)
getuserById 19c4c859-e062-4528-b176-3a17caf443af
2019-07-26 18:11:27,025 TRACE
[org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1)
return managedusers
2019-07-26 18:11:27,025 TRACE
[org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1)
getuserById 19c4c859-e062-4528-b176-3a17caf443af
2019-07-26 18:11:27,025 TRACE
[org.keycloak.models.cache.infinispan.UserCacheSession] (default task-1)
return managedusers
2019-07-26 18:11:27,025 TRACE [org.keycloak.events] (default task-1) type=
*CODE_TO_TOKEN*, realmId=308af72f-9f89-4fae-a583-b508d07b521a,
clientId=myclient, userId=19c4c859-e062-4528-b176-3a17caf443af,
ipAddress=10.192.226.126, client_session_host=mybox,
token_id=0773e6dc-8da1-4241-9fa8-081e95916042,
grant_type=authorization_code, refresh_token_type=Refresh, scope='openid
profile email', client_session_state=562F91F71B1FFDABD7E0EE2761BA03CE-n1,
refresh_token_id=57801953-87a2-4d3e-a4fb-5d91f2ed262f,
code_id=9634b07b-6191-4a09-85b3-507ff9dcead1,
client_auth_method=client-secret, requestUri=
http://myhost.example.org:8080/auth/realms/myrealm/protocol/openid-connect/token,
cookies=[]
2019-07-26 18:11:27,025 TRACE [org.keycloak.services.resources.Cors]
(default task-1) No origin header ignoring
2019-07-26 18:11:27,026 DEBUG
[org.keycloak.transaction.JtaTransactionWrapper] (default task-1)
JtaTransactionWrapper  commit
2019-07-26 18:11:27,026 DEBUG
[org.keycloak.transaction.JtaTransactionWrapper] (default task-1)
JtaTransactionWrapper end
2019-07-26 18:11:27,037 TRACE
[org.keycloak.connections.jpa.DefaultJpaConnectionProvider] (default
task-1) DefaultJpaConnectionProvider close()
2019-07-26 18:11:27,409 DEBUG
[org.keycloak.transaction.JtaTransactionWrapper] (default task-1) new
JtaTransactionWrapper
2019-07-26 18:11:27,409 DEBUG
[org.keycloak.transaction.JtaTransactionWrapper] (default task-1) was
existing? false
2019-07-26 18:11:27,410 TRACE
[org.keycloak.models.cache.infinispan.RealmCacheSession] (default task-1)
realm by name cache hit: myrealm
2019-07-26 18:11:27,410 TRACE
[org.keycloak.models.cache.infinispan.RealmCacheSession] (default task-1)
by id cache hit: myrealm
2019-07-26 18:11:27,410 TRACE
[org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint] (default
task-1) Processing @GET request
2019-07-26 18:11:27,410 TRACE
[org.keycloak.models.cache.infinispan.RealmCacheSession] (default task-1)
client by name cache hit: myclient
2019-07-26 18:11:27,410 TRACE
[org.keycloak.models.cache.infinispan.RealmCacheSession] (default task-1)
client by id cache hit: myclient
2019-07-26 18:11:27,410 DEBUG
[org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint] (default
task-1) PKCE non-supporting Client
2019-07-26 18:11:27,410 DEBUG
[org.keycloak.services.managers.AuthenticationSessionManager] (default
task-1) Not found AUTH_SESSION_ID cookie
2019-07-26 18:11:27,410 DEBUG
[org.keycloak.services.managers.AuthenticationSessionManager] (default
task-1) Not found AUTH_SESSION_ID cookie
2019-07-26 18:11:27,410 TRACE
[org.keycloak.models.sessions.infinispan.InfinispanKeycloakTransaction]
(default task-1) Adding cache operation: ADD on
93ca18a6-fea5-42d5-bad9-125fd97906af
2019-07-26 18:11:27,410 DEBUG
[org.keycloak.services.managers.AuthenticationSessionManager] (default
task-1) Set AUTH_SESSION_ID cookie with value
93ca18a6-fea5-42d5-bad9-125fd97906af.myhost
2019-07-26 18:11:27,411 TRACE
[org.keycloak.models.sessions.infinispan.InfinispanKeycloakTransaction]
(default task-1) Adding cache operation: REPLACE on
93ca18a6-fea5-42d5-bad9-125fd97906af
2019-07-26 18:11:27,411 DEBUG
[org.keycloak.protocol.AuthorizationEndpointBase] (default task-1) Sent
request to authz endpoint. Created new root authentication session with ID
'93ca18a6-fea5-42d5-bad9-125fd97906af' . Client: myclient . New
authentication session tab ID: uG3knkEjbEE
2019-07-26 18:11:27,411 TRACE
[org.keycloak.models.sessions.infinispan.InfinispanKeycloakTransaction]
(default task-1) Adding cache operation: REPLACE on
93ca18a6-fea5-42d5-bad9-125fd97906af
2019-07-26 18:11:27,411 TRACE
[org.keycloak.models.sessions.infinispan.InfinispanKeycloakTransaction]
(default task-1) Adding cache operation: REPLACE on
93ca18a6-fea5-42d5-bad9-125fd97906af
2019-07-26 18:11:27,411 TRACE
[org.keycloak.models.sessions.infinispan.InfinispanKeycloakTransaction]
(default task-1) Adding cache operation: REPLACE on
93ca18a6-fea5-42d5-bad9-125fd97906af
2019-07-26 18:11:27,411 TRACE
[org.keycloak.models.sessions.infinispan.InfinispanKeycloakTransaction]
(default task-1) Adding cache operation: REPLACE on
93ca18a6-fea5-42d5-bad9-125fd97906af
2019-07-26 18:11:27,411 TRACE
[org.keycloak.models.sessions.infinispan.InfinispanKeycloakTransaction]
(default task-1) Adding cache operation: REPLACE on
93ca18a6-fea5-42d5-bad9-125fd97906af
2019-07-26 18:11:27,411 TRACE
[org.keycloak.models.sessions.infinispan.InfinispanKeycloakTransaction]
(default task-1) Adding cache operation: REPLACE on
93ca18a6-fea5-42d5-bad9-125fd97906af
2019-07-26 18:11:27,411 TRACE
[org.keycloak.models.sessions.infinispan.InfinispanKeycloakTransaction]
(default task-1) Adding cache operation: REPLACE on
93ca18a6-fea5-42d5-bad9-125fd97906af
2019-07-26 18:11:27,411 TRACE
[org.keycloak.models.sessions.infinispan.InfinispanKeycloakTransaction]
(default task-1) Adding cache operation: REPLACE on
93ca18a6-fea5-42d5-bad9-125fd97906af
2019-07-26 18:11:27,411 TRACE
[org.keycloak.models.sessions.infinispan.InfinispanKeycloakTransaction]
(default task-1) Adding cache operation: REPLACE on
93ca18a6-fea5-42d5-bad9-125fd97906af
2019-07-26 18:11:27,411 TRACE
[org.keycloak.models.sessions.infinispan.InfinispanKeycloakTransaction]
(default task-1) Adding cache operation: REPLACE on
93ca18a6-fea5-42d5-bad9-125fd97906af
2019-07-26 18:11:27,411 TRACE
[org.keycloak.models.sessions.infinispan.InfinispanKeycloakTransaction]
(default task-1) Adding cache operation: REPLACE on
93ca18a6-fea5-42d5-bad9-125fd97906af
2019-07-26 18:11:27,411 TRACE
[org.keycloak.models.cache.infinispan.RealmCacheSession] (default task-1)
client by id cache hit: myclient
2019-07-26 18:11:27,411 TRACE
[org.keycloak.models.sessions.infinispan.InfinispanKeycloakTransaction]
(default task-1) Adding cache operation: REPLACE on
93ca18a6-fea5-42d5-bad9-125fd97906af
2019-07-26 18:11:27,411 TRACE
[org.keycloak.models.cache.infinispan.RealmCacheSession] (default task-1)
client by id cache hit: myclient
2019-07-26 18:11:27,411 TRACE [org.keycloak.keys.DefaultKeyManager]
(default task-1) Active key found: realm=myrealm
kid=2f79742e-ce05-47da-baae-9e902c2ae3bf algorithm=HS256 use=SIG
2019-07-26 18:11:27,411 DEBUG
[org.keycloak.authentication.AuthenticationProcessor] (default task-1)
AUTHENTICATE
2019-07-26 18:11:27,411 DEBUG
[org.keycloak.authentication.AuthenticationProcessor] (default task-1)
AUTHENTICATE ONLY
2019-07-26 18:11:27,411 TRACE
[org.keycloak.models.sessions.infinispan.InfinispanKeycloakTransaction]
(default task-1) Adding cache operation: REPLACE on
93ca18a6-fea5-42d5-bad9-125fd97906af
2019-07-26 18:11:27,411 TRACE
[org.keycloak.models.cache.infinispan.RealmCacheSession] (default task-1)
client by id cache hit: myclient
2019-07-26 18:11:27,411 DEBUG
[org.keycloak.authentication.DefaultAuthenticationFlow] (default task-1)
processFlow
2019-07-26 18:11:27,411 DEBUG
[org.keycloak.authentication.DefaultAuthenticationFlow] (default task-1)
check execution: auth-cookie requirement: ALTERNATIVE
2019-07-26 18:11:27,411 DEBUG
[org.keycloak.authentication.DefaultAuthenticationFlow] (default task-1)
authenticator: auth-cookie
2019-07-26 18:11:27,411 DEBUG
[org.keycloak.authentication.DefaultAuthenticationFlow] (default task-1)
invoke authenticator.authenticate: auth-cookie
2019-07-26 18:11:27,411 DEBUG
[org.keycloak.services.managers.AuthenticationManager] (default task-1)
Could not find cookie: KEYCLOAK_IDENTITY
2019-07-26 18:11:27,411 DEBUG
[org.keycloak.authentication.DefaultAuthenticationFlow] (default task-1)
authenticator ATTEMPTED: auth-cookie
2019-07-26 18:11:27,411 TRACE
[org.keycloak.models.sessions.infinispan.InfinispanKeycloakTransaction]
(default task-1) Adding cache operation: REPLACE on
93ca18a6-fea5-42d5-bad9-125fd97906af
2019-07-26 18:11:27,411 DEBUG
[org.keycloak.authentication.DefaultAuthenticationFlow] (default task-1)
check execution: auth-spnego requirement: DISABLED
2019-07-26 18:11:27,411 DEBUG
[org.keycloak.authentication.DefaultAuthenticationFlow] (default task-1)
execution is processed
2019-07-26 18:11:27,411 DEBUG
[org.keycloak.authentication.DefaultAuthenticationFlow] (default task-1)
check execution: identity-provider-redirector requirement: ALTERNATIVE
2019-07-26 18:11:27,411 DEBUG
[org.keycloak.authentication.DefaultAuthenticationFlow] (default task-1)
authenticator: identity-provider-redirector
2019-07-26 18:11:27,411 DEBUG
[org.keycloak.authentication.DefaultAuthenticationFlow] (default task-1)
invoke authenticator.authenticate: identity-provider-redirector
2019-07-26 18:11:27,411 TRACE
[org.keycloak.authentication.authenticators.browser.IdentityProviderAuthenticator]
(default task-1) No default provider set or kc_idp_hint query parameter
provided
2019-07-26 18:11:27,411 DEBUG
[org.keycloak.authentication.DefaultAuthenticationFlow] (default task-1)
authenticator ATTEMPTED: identity-provider-redirector
2019-07-26 18:11:27,411 TRACE
[org.keycloak.models.sessions.infinispan.InfinispanKeycloakTransaction]
(default task-1) Adding cache operation: REPLACE on
93ca18a6-fea5-42d5-bad9-125fd97906af
2019-07-26 18:11:27,411 DEBUG
[org.keycloak.authentication.DefaultAuthenticationFlow] (default task-1)
check execution: null requirement: ALTERNATIVE
2019-07-26 18:11:27,411 DEBUG
[org.keycloak.authentication.DefaultAuthenticationFlow] (default task-1)
execution is flow
2019-07-26 18:11:27,412 DEBUG
[org.keycloak.authentication.DefaultAuthenticationFlow] (default task-1)
processFlow
2019-07-26 18:11:27,412 DEBUG
[org.keycloak.authentication.DefaultAuthenticationFlow] (default task-1)
check execution: auth-username-password-form requirement: REQUIRED
2019-07-26 18:11:27,412 DEBUG
[org.keycloak.authentication.DefaultAuthenticationFlow] (default task-1)
authenticator: auth-username-password-form
2019-07-26 18:11:27,412 DEBUG
[org.keycloak.authentication.DefaultAuthenticationFlow] (default task-1)
invoke authenticator.authenticate: auth-username-password-form
2019-07-26 18:11:27,412 TRACE
[org.keycloak.models.sessions.infinispan.InfinispanKeycloakTransaction]
(default task-1) Adding cache operation: REPLACE on
93ca18a6-fea5-42d5-bad9-125fd97906af
2019-07-26 18:11:27,412 TRACE
[org.keycloak.models.sessions.infinispan.InfinispanKeycloakTransaction]
(default task-1) Adding cache operation: REPLACE on
93ca18a6-fea5-42d5-bad9-125fd97906af
2019-07-26 18:11:27,412 TRACE
[org.keycloak.models.cache.infinispan.RealmCacheSession] (default task-1)
client by id cache hit: myclient
2019-07-26 18:11:27,416 DEBUG
[org.keycloak.authentication.DefaultAuthenticationFlow] (default task-1)
authenticator CHALLENGE: auth-username-password-form
2019-07-26 18:11:27,416 TRACE
[org.keycloak.models.sessions.infinispan.InfinispanKeycloakTransaction]
(default task-1) Adding cache operation: REPLACE on
93ca18a6-fea5-42d5-bad9-125fd97906af
2019-07-26 18:11:27,416 TRACE
[org.keycloak.models.sessions.infinispan.InfinispanKeycloakTransaction]
(default task-1) Adding cache operation: REPLACE on
93ca18a6-fea5-42d5-bad9-125fd97906af
2019-07-26 18:11:27,416 DEBUG
[org.keycloak.transaction.JtaTransactionWrapper] (default task-1)
JtaTransactionWrapper  commit
2019-07-26 18:11:27,416 DEBUG
[org.keycloak.transaction.JtaTransactionWrapper] (default task-1)
JtaTransactionWrapper end


-- 
Philip Lowman

From warrior7089 at gmail.com  Sun Jul 28 03:28:04 2019
From: warrior7089 at gmail.com (Roman Ok)
Date: Sun, 28 Jul 2019 10:28:04 +0300
Subject: [keycloak-user] Is quorum needed in Keycloak Standalone Clustered
	Configuration?
Message-ID: <288371564298884@vla1-5413378edd9f.qloud-c.yandex.net>


From anupa.shah91 at gmail.com  Sun Jul 28 06:38:03 2019
From: anupa.shah91 at gmail.com (anupa shah)
Date: Sun, 28 Jul 2019 16:08:03 +0530
Subject: [keycloak-user] Keycloak session management
Message-ID: <CACLEKFOPFc1jhz-KwS2pLesFSCMrzmHUn+C7akxu_3HJ86c1Tw@mail.gmail.com>

 Hello Sir,

I am using keycloak with spring-adaptor approach with xml base. I am not
able to get keycloak session in my project. So my application is not able
to use keycloak session.Please guide me.
Below is link where i posted my question.
https://github.com/spring-projects/spring-security/issues/7152

Please guide me.

Thanks,
Anupa

From chris.stephens at edlogics.com  Sun Jul 28 12:17:49 2019
From: chris.stephens at edlogics.com (Chris Stephens)
Date: Sun, 28 Jul 2019 16:17:49 +0000
Subject: [keycloak-user] Keycloak as SP with ping federate
Message-ID: <60FC4E2B-000A-470C-B6AF-643F5EDC6A5B@edlogics.com>

I am having issues integrating keycloak with ping federate. We are using keycloak version 5.0.0. Ping federate is the idp and keycloak is the service provider. Keycloak gives me a generic error "An internal server error has occurred?. When I dive deeper into the logs I see this stack trace.


[0m[31m15:59:02,925 ERROR [org.keycloak.services.error.KeycloakErrorHandler] (default task-341) Uncaught server error:  org.keycloak.broker.provider.IdentityBrokerException: Could not process response from SAML identity provider.
                        at org.keycloak.broker.saml.SAMLEndpoint$Binding.handleLoginResponse(SAMLEndpoint.java:469)
                        at org.keycloak.broker.saml.SAMLEndpoint$Binding.handleSamlResponse(SAMLEndpoint.java:504)
                        at org.keycloak.broker.saml.SAMLEndpoint$Binding.execute(SAMLEndpoint.java:244)
                        at org.keycloak.broker.saml.SAMLEndpoint.postBinding(SAMLEndpoint.java:160)
                        at sun.reflect.GeneratedMethodAccessor1101.invoke(Unknown Source)
                        ...
                        at java.lang.Thread.run(Thread.java:748)
                        Caused by: java.lang.NullPointerException

There is no line number on the above null pointer exception. I only know it is happening in handleLoginResponse.

Here is the formatted xml from the /endpoint response in the browser":

                        <?xml version="1.0"?>
<samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" Version="2.0" ID="J8RPRFTJWzphQNpjsdDMOBAzanc" IssueInstant="2019-07-28T15:47:20.101Z" Destination="https://access-dev.myedlogics.com/auth/realms/intervent/broker/intervent/endpoint">
<saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">localhost:default:entityId</saml:Issuer>
<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
            <ds:SignedInfo>
                        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
                        <ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
                        <ds:Reference URI="#J8RPRFTJWzphQNpjsdDMOBAzanc">
                                    <ds:Transforms>
                                                <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
                                                <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
                                    </ds:Transforms>
                                    <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
                                    <ds:DigestValue>nhnAGsnEubW52HlCQIQ6X9aRQvsiKt2QMxu82hqka3E=</ds:DigestValue>
                        </ds:Reference>
            </ds:SignedInfo>
            <ds:SignatureValue>Z2zn8MXkhPk8iw4AXmFV/qK+UbyKQhYT5faq9yyPzF2OCS7joaboMm29/qtZhBHBrFNf0113f3jeAG6mX9RvOYOsoI9k0aLNvH42UDSZw9Iwv8AOIBxa06bqVw7VfJpxwNp4spJgvMRme61OnJd57sqF8V7CNe4X8VMm6L1DDDkvrpL1WieN8OrEjMOm7F3HtlIBTAfy3WvFn2P/Ly3ofSM4CFb9pOgyG0Ypi9KWVaCOQ0qVvaOXu97HpOY4+fp9kg/fMq3UlxJ93WTLiZ8/hXgz9x+Of6DXqY/+XjjRUPdhH2dSXwg7vpXCIc1q5JyG79uNHotLQoDhbO21Osp/QQ==</ds:SignatureValue>
</ds:Signature>
<samlp:Status>
            <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>
</samlp:Status>
<saml:Assertion xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="fCWnVphoi6J6jBnD.Ohe_UTtf1D" IssueInstant="2019-07-28T15:47:20.158Z" Version="2.0">
            <saml:Issuer>localhost:default:entityId</saml:Issuer>
            <saml:Subject>
                        <saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">joe</saml:NameID>
                        <saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
                                    <saml:SubjectConfirmationData Recipient="https://access-dev.myedlogics.com/auth/realms/intervent/broker/intervent/endpoint" NotOnOrAfter="2019-07-28T15:52:20.162Z"/>
                        </saml:SubjectConfirmation>
            </saml:Subject>
            <saml:Conditions NotBefore="2019-07-28T15:42:20.162Z" NotOnOrAfter="2019-07-28T15:52:20.162Z">
                        <saml:AudienceRestriction>
                                    <saml:Audience>https://access-dev.myedlogics.com/auth/realms/intervent</saml:Audience>
                        </saml:AudienceRestriction>
            </saml:Conditions>
            <saml:AuthnStatement SessionIndex="fCWnVphoi6J6jBnD.Ohe_UTtf1D" AuthnInstant="2019-07-28T15:47:20.136Z">
                        <saml:AuthnContext>
                                    <saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:Password</saml:AuthnContextClassRef>
                        </saml:AuthnContext>
            </saml:AuthnStatement>
            <saml:AttributeStatement>
                        <saml:Attribute Name="email" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
                                    <saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">chris.stephens+1 at edlogics.net</saml:AttributeValue>
                        </saml:Attribute>
            </saml:AttributeStatement>
</saml:Assertion>
</samlp:Response>


Does anyone see any obvious mistakes I am making? Is the xml invalid and messing with keycloak?

Thanks,
Chris

From mrestelli at cuebiq.com  Mon Jul 29 02:55:37 2019
From: mrestelli at cuebiq.com (Matteo Restelli)
Date: Mon, 29 Jul 2019 08:55:37 +0200
Subject: [keycloak-user] Strange behaviour during RPT call -
 java.lang.RuntimeException: Error while reading attributes
In-Reply-To: <CAJrcDBcRTtqu0viA9VeggRYob1-35MeTZaZPTKmf7r9Vi0yOoA@mail.gmail.com>
References: <CAHpjjTYzCvQATEnio7_8n=T8W_yBNDdmaxuStjqkViGf2WWdsw@mail.gmail.com>
	<CAJrcDBcRTtqu0viA9VeggRYob1-35MeTZaZPTKmf7r9Vi0yOoA@mail.gmail.com>
Message-ID: <CAHpjjTYE3qsx_UW8dLJ0fDcHM77jsN7HG3-agvKtuxjfxRtboA@mail.gmail.com>

Thank you Pedro ;)

Have a nice day,
Matteo

On Fri, Jul 26, 2019 at 9:47 PM Pedro Igor Silva <psilva at redhat.com> wrote:

> Hi,
>
> I've created https://issues.jboss.org/browse/KEYCLOAK-10949.
>
> Regards.
> Pedro Igor
>
> On Fri, Jul 26, 2019 at 10:50 AM Matteo Restelli <mrestelli at cuebiq.com>
> wrote:
>
>> Hi all,
>> We're noticing a strange behaviour during RPT call performed by our
>> adapter. More specifically, we're getting a 500 HTTP Error with the
>> following description: "Unexpected error while evaluating permissions:
>> java.lang.RuntimeException: Error while reading attributes" and with a
>> NullPointerException.
>> I had a keycloak access token with 5 hours of expiration time and "SSO
>> Session Idle time", in Keycloak, was set to 30 minutes. I know, it's a
>> strange configuration, but we've used it just for testing purposes of the
>> RPT / Authorization part.
>> Once i've received the error, i've started thinking that the problem was
>> probably due to the fact that the user's session was expired (i've notice
>> the error after lunch where i've left the pc alone for about 1 hour), so
>> i've tried to reproduce the error in this way:
>>
>> - Login via Resource Owner Password grant flow (via Postman)
>> - Getting the token and calling our test microservice where the adapter
>> was
>> configured
>> - RPT Call worked
>> - After that, logout the user's session from the user admin console
>> - Retried the call to the microservice with the same token
>> - Received the 500 HTTP Error
>>
>> We're using Keycloak 6.0.1.
>> I've a question about: is it right that error? In my opinion we should
>> receive a 401, not 500...
>>
>> At the bottom you can find the stacktrace.
>>
>> Thank you very much,
>> Matteo
>>
>>
>> 12:58:23,179 ERROR
>> [org.keycloak.authorization.authorization.AuthorizationTokenService]
>> (default task-784) Unexpected error while evaluating permissions:
>> java.lang.RuntimeException: Error while reading attributes from security
>> token.
>>
>> at
>>
>> org.keycloak.authorization.common.KeycloakIdentity.<init>(KeycloakIdentity.java:146)
>>
>> at
>>
>> org.keycloak.authorization.common.KeycloakIdentity.<init>(KeycloakIdentity.java:69)
>>
>> at
>>
>> org.keycloak.authorization.authorization.AuthorizationTokenService.lambda$static$1(AuthorizationTokenService.java:131)
>>
>> at
>>
>> org.keycloak.authorization.authorization.AuthorizationTokenService.createEvaluationContext(AuthorizationTokenService.java:379)
>>
>> at
>>
>> org.keycloak.authorization.authorization.AuthorizationTokenService.authorize(AuthorizationTokenService.java:160)
>>
>> at
>>
>> org.keycloak.protocol.oidc.endpoints.TokenEndpoint.permissionGrant(TokenEndpoint.java:1157)
>>
>> at
>>
>> org.keycloak.protocol.oidc.endpoints.TokenEndpoint.processGrantRequest(TokenEndpoint.java:196)
>>
>> at sun.reflect.GeneratedMethodAccessor811.invoke(Unknown Source)
>>
>> at
>>
>> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
>>
>> at java.lang.reflect.Method.invoke(Method.java:498)
>>
>> at
>>
>> org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java:139)
>>
>> at
>>
>> org.jboss.resteasy.core.ResourceMethodInvoker.internalInvokeOnTarget(ResourceMethodInvoker.java:510)
>>
>> at
>>
>> org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTargetAfterFilter(ResourceMethodInvoker.java:400)
>>
>> at
>>
>> org.jboss.resteasy.core.ResourceMethodInvoker.lambda$invokeOnTarget$0(ResourceMethodInvoker.java:364)
>>
>> at
>>
>> org.jboss.resteasy.core.interception.PreMatchContainerRequestContext.filter(PreMatchContainerRequestContext.java:355)
>>
>> at
>>
>> org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTarget(ResourceMethodInvoker.java:366)
>>
>> at
>>
>> org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:338)
>>
>> at
>>
>> org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(ResourceLocatorInvoker.java:137)
>>
>> at
>>
>> org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:106)
>>
>> at
>>
>> org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(ResourceLocatorInvoker.java:132)
>>
>> at
>>
>> org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:100)
>>
>> at
>>
>> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:439)
>>
>> at
>>
>> org.jboss.resteasy.core.SynchronousDispatcher.lambda$invoke$4(SynchronousDispatcher.java:229)
>>
>> at
>>
>> org.jboss.resteasy.core.SynchronousDispatcher.lambda$preprocess$0(SynchronousDispatcher.java:135)
>>
>> at
>>
>> org.jboss.resteasy.core.interception.PreMatchContainerRequestContext.filter(PreMatchContainerRequestContext.java:355)
>>
>> at
>>
>> org.jboss.resteasy.core.SynchronousDispatcher.preprocess(SynchronousDispatcher.java:138)
>>
>> at
>>
>> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:215)
>>
>> at
>>
>> org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:227)
>>
>> at
>>
>> org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56)
>>
>> at
>>
>> org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51)
>>
>> at javax.servlet.http.HttpServlet.service(HttpServlet.java:791)
>>
>> at
>>
>> io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:74)
>>
>> at
>>
>> io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129)
>>
>> at
>>
>> org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:90)
>>
>> at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61)
>>
>> at
>>
>> io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
>>
>> at
>>
>> io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84)
>>
>> at
>>
>> io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62)
>>
>> at
>>
>> io.undertow.servlet.handlers.ServletChain$1.handleRequest(ServletChain.java:68)
>>
>> at
>>
>> io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
>>
>> at
>>
>> org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78)
>>
>> at
>>
>> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>>
>> at
>>
>> io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:132)
>>
>> at
>>
>> io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57)
>>
>> at
>>
>> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>>
>> at
>>
>> io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)
>>
>> at
>>
>> io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)
>>
>> at
>>
>> io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)
>>
>> at
>>
>> io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77)
>>
>> at
>>
>> io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50)
>>
>> at
>>
>> io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)
>>
>> at
>>
>> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>>
>> at
>>
>> org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)
>>
>> at
>>
>> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>>
>> at
>>
>> org.wildfly.extension.undertow.deployment.GlobalRequestControllerHandler.handleRequest(GlobalRequestControllerHandler.java:68)
>>
>> at
>>
>> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>>
>> at
>>
>> io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:292)
>>
>> at
>>
>> io.undertow.servlet.handlers.ServletInitialHandler.access$100(ServletInitialHandler.java:81)
>>
>> at
>>
>> io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:138)
>>
>> at
>>
>> io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:135)
>>
>> at
>>
>> io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:48)
>>
>> at
>>
>> io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43)
>>
>> at
>>
>> org.wildfly.extension.undertow.security.SecurityContextThreadSetupAction.lambda$create$0(SecurityContextThreadSetupAction.java:105)
>>
>> at
>>
>> org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)
>>
>> at
>>
>> org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)
>>
>> at
>>
>> org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)
>>
>> at
>>
>> org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)
>>
>> at
>>
>> io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:272)
>>
>> at
>>
>> io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81)
>>
>> at
>>
>> io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:104)
>>
>> at io.undertow.server.Connectors.executeRootHandler(Connectors.java:364)
>>
>> at
>> io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:830)
>>
>> at
>>
>> org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35)
>>
>> at
>>
>> org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1982)
>>
>> at
>>
>> org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1486)
>>
>> at
>>
>> org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1377)
>>
>> at java.lang.Thread.run(Thread.java:748)
>>
>> Caused by: java.lang.NullPointerException
>>
>> --
>>
>> Like <https://www.facebook.com/cuebiq/> I Follow
>> <https://twitter.com/Cuebiq>I Connect
>> <https://www.linkedin.com/company/cuebiq>
>>
>>
>> This email is reserved
>> exclusively for sending and receiving messages inherent working
>> activities,
>> and is not intended nor authorized for personal use. Therefore, any
>> outgoing messages or incoming response messages will be treated as
>> company
>> messages and will be subject to the corporate IT policy and may possibly
>> to
>> be read by persons other than by the subscriber of the box. Confidential
>> information may be contained in this message. If you are not the address
>> indicated in this message, please do not copy or deliver this message to
>> anyone. In such case, you should notify the sender immediately and delete
>> the original message.
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>

-- 

Like <https://www.facebook.com/cuebiq/> I Follow  
<https://twitter.com/Cuebiq>I Connect 
<https://www.linkedin.com/company/cuebiq>


This email is reserved 
exclusively for sending and receiving messages inherent working activities, 
and is not intended nor authorized for personal use. Therefore, any 
outgoing messages or incoming response messages will be treated as company 
messages and will be subject to the corporate IT policy and may possibly to 
be read by persons other than by the subscriber of the box. Confidential 
information may be contained in this message. If you are not the address 
indicated in this message, please do not copy or deliver this message to 
anyone. In such case, you should notify the sender immediately and delete 
the original message.

From mgiammarco at gmail.com  Mon Jul 29 03:15:49 2019
From: mgiammarco at gmail.com (Mario Giammarco)
Date: Mon, 29 Jul 2019 09:15:49 +0200
Subject: [keycloak-user] Keycloak using Sql Server on Azure as db: stops
	working after few days
Message-ID: <CABQ2P6EsOTzU4MM4rD6wQBD+ESS2WNMDgpvt7kRpXBgLgtQa3Q@mail.gmail.com>

Hello,

I have installed a Keycloak as an Azure virtual machine. As database I have
chosen the Sql Server offered as an Azure service. I have configured it
correctly because all works. But after some days it stops working. I get
these exceptions:



Caused by: org.hibernate.exception.GenericJDBCException: could not
prepare statement
    at org.hibernate.exception.internal.StandardSQLExceptionConverter.convert(StandardSQLExceptionConverter.java:47)
    at org.hibernate.engine.jdbc.spi.SqlExceptionHelper.convert(SqlExceptionHelper.java:113)
    at org.hibernate.engine.jdbc.internal.StatementPreparerImpl$StatementPreparationTemplate.prepareStatement(StatementPreparerImpl.java:182)
    at org.hibernate.engine.jdbc.internal.StatementPreparerImpl.prepareQueryStatement(StatementPreparerImpl.java:148)
    at org.hibernate.loader.Loader.prepareQueryStatement(Loader.java:1984)
    at org.hibernate.loader.Loader.executeQueryStatement(Loader.java:1914)
    at org.hibernate.loader.Loader.executeQueryStatement(Loader.java:1892)
    at org.hibernate.loader.Loader.doQuery(Loader.java:937)
    at org.hibernate.loader.Loader.doQueryAndInitializeNonLazyCollections(Loader.java:340)
    at org.hibernate.loader.Loader.doList(Loader.java:2689)
    at org.hibernate.loader.Loader.doList(Loader.java:2672)
    at org.hibernate.loader.Loader.listIgnoreQueryCache(Loader.java:2506)
    at org.hibernate.loader.Loader.list(Loader.java:2501)
    at org.hibernate.loader.hql.QueryLoader.list(QueryLoader.java:504)
    at org.hibernate.hql.internal.ast.QueryTranslatorImpl.list(QueryTranslatorImpl.java:395)
    at org.hibernate.engine.query.spi.HQLQueryPlan.performList(HQLQueryPlan.java:220)
    at org.hibernate.internal.SessionImpl.list(SessionImpl.java:1507)
    at org.hibernate.query.internal.AbstractProducedQuery.doList(AbstractProducedQuery.java:1537)
    at org.hibernate.query.internal.AbstractProducedQuery.list(AbstractProducedQuery.java:1505)
    ... 13 more
Caused by: com.microsoft.sqlserver.jdbc.SQLServerException: The
connection is closed.
    at com.microsoft.sqlserver.jdbc.SQLServerException.makeFromDriverError(SQLServerException.java:234)
    at com.microsoft.sqlserver.jdbc.SQLServerConnection.checkClosed(SQLServerConnection.java:1088)
    at com.microsoft.sqlserver.jdbc.SQLServerConnection.prepareStatement(SQLServerConnection.java:3409)
    at org.jboss.jca.adapters.jdbc.BaseWrapperManagedConnection.doPrepareStatement(BaseWrapperManagedConnection.java:758)
    at org.jboss.jca.adapters.jdbc.BaseWrapperManagedConnection.prepareStatement(BaseWrapperManagedConnection.java:744)
    at org.jboss.jca.adapters.jdbc.WrappedConnection.prepareStatement(WrappedConnection.java:459)
    at org.hibernate.engine.jdbc.internal.StatementPreparerImpl$5.doPrepare(StatementPreparerImpl.java:146)
    at org.hibernate.engine.jdbc.internal.StatementPreparerImpl$StatementPreparationTemplate.prepareStatement(StatementPreparerImpl.java:172)




It seems that, after some time, sql server refuses new connections.
I have tried reducing max-pool-size and I have obtained that it now
gives the problem some days before.
I need help because the exception is not very informative.
Thanks in advance for any hints.
Mario

From hannah.short at cern.ch  Mon Jul 29 04:31:29 2019
From: hannah.short at cern.ch (Hannah Short)
Date: Mon, 29 Jul 2019 08:31:29 +0000
Subject: [keycloak-user] Java minor update missing files
Message-ID: <38C8D8DD-32E9-4658-8E65-1A9972054875@cern.ch>

Hi keycloak users,

We are having issues with broken links in Keycloak each time Java is updated on our servers. Does anyone have advice? E.g. java.io.FileNotFoundException: /usr/lib/jvm/java-1.8.0?

We would like to have minor updates included automatically, for security purposes, but they currently result in java runtime errors when trying to authenticate afterwards.

Thanks in advance,
Hannah

From hannah.short at cern.ch  Mon Jul 29 04:32:09 2019
From: hannah.short at cern.ch (Hannah Short)
Date: Mon, 29 Jul 2019 08:32:09 +0000
Subject: [keycloak-user] How do I integrate with a SAML federation
In-Reply-To: <e404c1be-83a3-abc5-1a0b-539dcd7a2398@epcc.ed.ac.uk>
References: <e404c1be-83a3-abc5-1a0b-539dcd7a2398@epcc.ed.ac.uk>
Message-ID: <FEC0381F-0F42-4AE9-BCED-248C4E1B055C@cern.ch>

Hi Stephen,

Was just browsing past threads. You?ve probably solved it by now but hopefully this helps others!

We are using a SATOSA proxy to integrate with eduGAIN, which acts as an Identity Provider to our Keycloak instance: https://github.com/IdentityPython/SATOSA

In addition we use PyFF to handle the metadata: https://github.com/IdentityPython/pyFF

The benefit of using these tools is because they are maintained by the eduGAIN community and natively support many of the quirks found in Identity Federations (both technically and in terms of trust and policy).

Cheers,
Hannah

On 17 Jun 2019, at 14:48, BOOTH Stephen <s.booth at epcc.ed.ac.uk<mailto:s.booth at epcc.ed.ac.uk>> wrote:

I'm wanting configure keycloak to use authenticate against a SAML
federation (externally curated set of IdPs) rather than a single SAML
IdP. Specifically I want to support EduGAIN.

Is this something that keycloak supports natively? The form for
configuring a SAML Identity provider appears to assume a single IdP.

If not, does anyone have any suggestions for the best approach to
bridging a shibboleth SP into something keycloak can use as an Identity
provider.

Stephen

--
======================================================================
|epcc| Dr Stephen P Booth             Principal Architect       |epcc|
|epcc| s.booth at epcc.ed.ac.uk<mailto:s.booth at epcc.ed.ac.uk>          Phone 0131 650 5746       |epcc|
======================================================================
--
The University of Edinburgh is a charitable body, registered in
Scotland, with registration number SC005336.

_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user


From dominik at dominikdorn.com  Mon Jul 29 05:16:05 2019
From: dominik at dominikdorn.com (Dominik Dorn)
Date: Mon, 29 Jul 2019 11:16:05 +0200
Subject: [keycloak-user] Java minor update missing files
In-Reply-To: <38C8D8DD-32E9-4658-8E65-1A9972054875@cern.ch>
References: <38C8D8DD-32E9-4658-8E65-1A9972054875@cern.ch>
Message-ID: <CABHM76V=dKJ-CSMAW3hcSbW0hwAHmuKbRO+n3xdBU7fcyjfHcw@mail.gmail.com>

Please provide the full path of at least one file that is "missing"..
/usr/lib/jvm/java-1.8.0 could be anything..



On Mon, Jul 29, 2019 at 10:32 AM Hannah Short <hannah.short at cern.ch> wrote:

> Hi keycloak users,
>
> We are having issues with broken links in Keycloak each time Java is
> updated on our servers. Does anyone have advice? E.g.
> java.io.FileNotFoundException: /usr/lib/jvm/java-1.8.0?
>
> We would like to have minor updates included automatically, for security
> purposes, but they currently result in java runtime errors when trying to
> authenticate afterwards.
>
> Thanks in advance,
> Hannah
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user



-- 
Dominik Dorn
https://dominikdorn.com/ | https://twitter.com/domdorn
XING: https://www.xing.com/profile/Dominik_Dorn
LINKEDIN: https://www.linkedin.com/in/dominik-dorn/

From pbraun at redhat.com  Mon Jul 29 05:41:41 2019
From: pbraun at redhat.com (Peter Braun)
Date: Mon, 29 Jul 2019 11:41:41 +0200
Subject: [keycloak-user] Github Identity Provider does not allow restricting
	organizations
Message-ID: <CA+jftcES4fr8HkfguCy_RG4rSyqWedF8cKyeUnoda35k0Qy+9A@mail.gmail.com>

Hi,

when setting up a Github Identity Provider it is currently (RHSSO 7.2) not
possible to restrict access to certain Github organizations from the
console. Github does support this and it is also documented in the identity
providers section of the OpenShift docs:
https://docs.openshift.com/container-platform/3.11/install_config/configuring_authentication.html#config-github-auth-on-master

It would be very useful to have this exposed in the UI, what are your
thoughs?


Regards,
Peter

From hannah.short at cern.ch  Mon Jul 29 05:49:42 2019
From: hannah.short at cern.ch (Hannah Short)
Date: Mon, 29 Jul 2019 09:49:42 +0000
Subject: [keycloak-user] Java minor update missing files
In-Reply-To: <CABHM76V=dKJ-CSMAW3hcSbW0hwAHmuKbRO+n3xdBU7fcyjfHcw@mail.gmail.com>
References: <38C8D8DD-32E9-4658-8E65-1A9972054875@cern.ch>
	<CABHM76V=dKJ-CSMAW3hcSbW0hwAHmuKbRO+n3xdBU7fcyjfHcw@mail.gmail.com>
Message-ID: <767F873B-A93A-4DBC-BCFB-87A5D918E1C4@cern.ch>

Hi Dominik,

Sure: java.io.FileNotFoundException: /usr/lib/jvm/java-1.8.0-openjdk-1.8.0.212.b04-0.el7_6.x86_64/jre/lib/ext/nashorn.jar

Cheers,
Hannah

On 29 Jul 2019, at 11:16, Dominik Dorn <dominik at dominikdorn.com<mailto:dominik at dominikdorn.com>> wrote:

Please provide the full path of at least one file that is "missing".. /usr/lib/jvm/java-1.8.0 could be anything..



On Mon, Jul 29, 2019 at 10:32 AM Hannah Short <hannah.short at cern.ch<mailto:hannah.short at cern.ch>> wrote:
Hi keycloak users,

We are having issues with broken links in Keycloak each time Java is updated on our servers. Does anyone have advice? E.g. java.io.FileNotFoundException: /usr/lib/jvm/java-1.8.0?

We would like to have minor updates included automatically, for security purposes, but they currently result in java runtime errors when trying to authenticate afterwards.

Thanks in advance,
Hannah
_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user


--
Dominik Dorn
https://dominikdorn.com/ | https://twitter.com/domdorn
XING: https://www.xing.com/profile/Dominik_Dorn
LINKEDIN: https://www.linkedin.com/in/dominik-dorn/


From dominik at dominikdorn.com  Mon Jul 29 06:06:50 2019
From: dominik at dominikdorn.com (Dominik Dorn)
Date: Mon, 29 Jul 2019 12:06:50 +0200
Subject: [keycloak-user] Java minor update missing files
In-Reply-To: <767F873B-A93A-4DBC-BCFB-87A5D918E1C4@cern.ch>
References: <38C8D8DD-32E9-4658-8E65-1A9972054875@cern.ch>
	<CABHM76V=dKJ-CSMAW3hcSbW0hwAHmuKbRO+n3xdBU7fcyjfHcw@mail.gmail.com>
	<767F873B-A93A-4DBC-BCFB-87A5D918E1C4@cern.ch>
Message-ID: <CABHM76X+FN3ikvJ7LB63k_0FEFFzMTjMDiKYXEGt3PQnPn_e9g@mail.gmail.com>

Do you have custom code in your Keycloak instance that is using Nashorn? It
was deprecated in
https://openjdk.java.net/jeps/335 but afaik is not supposed to be removed
before JDK 11



On Mon, Jul 29, 2019 at 11:49 AM Hannah Short <hannah.short at cern.ch> wrote:

> Hi Dominik,
>
> Sure: java.io.FileNotFoundException:
> /usr/lib/jvm/java-1.8.0-openjdk-1.8.0.212.b04-0.el7_6.x86_64/jre/lib/ext/nashorn.jar
>
> Cheers,
> Hannah
>
> On 29 Jul 2019, at 11:16, Dominik Dorn <dominik at dominikdorn.com> wrote:
>
> Please provide the full path of at least one file that is "missing"..
> /usr/lib/jvm/java-1.8.0 could be anything..
>
>
>
> On Mon, Jul 29, 2019 at 10:32 AM Hannah Short <hannah.short at cern.ch>
> wrote:
>
>> Hi keycloak users,
>>
>> We are having issues with broken links in Keycloak each time Java is
>> updated on our servers. Does anyone have advice? E.g.
>> java.io.FileNotFoundException: /usr/lib/jvm/java-1.8.0?
>>
>> We would like to have minor updates included automatically, for security
>> purposes, but they currently result in java runtime errors when trying to
>> authenticate afterwards.
>>
>> Thanks in advance,
>> Hannah
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
>
>
> --
> Dominik Dorn
> https://dominikdorn.com/ | https://twitter.com/domdorn
> XING: https://www.xing.com/profile/Dominik_Dorn
> LINKEDIN: https://www.linkedin.com/in/dominik-dorn/
>
>
>

-- 
Dominik Dorn
https://dominikdorn.com/ | https://twitter.com/domdorn
XING: https://www.xing.com/profile/Dominik_Dorn
LINKEDIN: https://www.linkedin.com/in/dominik-dorn/

From tony.yip at shinetown.com.hk  Mon Jul 29 06:08:21 2019
From: tony.yip at shinetown.com.hk (Tony Yip)
Date: Mon, 29 Jul 2019 18:08:21 +0800
Subject: [keycloak-user] Java minor update missing files
In-Reply-To: <767F873B-A93A-4DBC-BCFB-87A5D918E1C4@cern.ch>
References: <38C8D8DD-32E9-4658-8E65-1A9972054875@cern.ch>
	<CABHM76V=dKJ-CSMAW3hcSbW0hwAHmuKbRO+n3xdBU7fcyjfHcw@mail.gmail.com>
	<767F873B-A93A-4DBC-BCFB-87A5D918E1C4@cern.ch>
Message-ID: <A413725C-B361-41EC-8DF5-608317EE4E18@shinetown.com.hk>

Hi Hannah,

You could config the JAVA_HOME parameter in the startup script (e.g. standalone.sh). You may set JAVA_HOME to /usr/lib/jvm/jre-openjdk which is a symbolic link to the latest jdk. In case you want to fix the major java version, you may use /usr/lib/jvm/jre-1.8.0

Hope this could help.

Yours sincerely,
Tony Yip
tony.yip at shinetown.com.hk
Frontend Developer
Shinetown Telecommunication Limited

Web: shinetown.com.hk

> On 29 Jul 2019, at 5:49 PM, Hannah Short <hannah.short at cern.ch> wrote:
> 
> Hi Dominik,
> 
> Sure: java.io.FileNotFoundException: /usr/lib/jvm/java-1.8.0-openjdk-1.8.0.212.b04-0.el7_6.x86_64/jre/lib/ext/nashorn.jar
> 
> Cheers,
> Hannah
> 
> On 29 Jul 2019, at 11:16, Dominik Dorn <dominik at dominikdorn.com<mailto:dominik at dominikdorn.com>> wrote:
> 
> Please provide the full path of at least one file that is "missing".. /usr/lib/jvm/java-1.8.0 could be anything..
> 
> 
> 
> On Mon, Jul 29, 2019 at 10:32 AM Hannah Short <hannah.short at cern.ch<mailto:hannah.short at cern.ch>> wrote:
> Hi keycloak users,
> 
> We are having issues with broken links in Keycloak each time Java is updated on our servers. Does anyone have advice? E.g. java.io.FileNotFoundException: /usr/lib/jvm/java-1.8.0?
> 
> We would like to have minor updates included automatically, for security purposes, but they currently result in java runtime errors when trying to authenticate afterwards.
> 
> Thanks in advance,
> Hannah
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>
> https://lists.jboss.org/mailman/listinfo/keycloak-user
> 
> 
> --
> Dominik Dorn
> https://dominikdorn.com/ | https://twitter.com/domdorn
> XING: https://www.xing.com/profile/Dominik_Dorn
> LINKEDIN: https://www.linkedin.com/in/dominik-dorn/
> 
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user



From mrestelli at cuebiq.com  Mon Jul 29 06:32:32 2019
From: mrestelli at cuebiq.com (Matteo Restelli)
Date: Mon, 29 Jul 2019 12:32:32 +0200
Subject: [keycloak-user] Cache invalidation Javascript policies - cluster
	mode
Message-ID: <CAHpjjTbiyJj6+vBRbCxVqf73dPHNHR+8s35WgjK2=7q1gioDsw@mail.gmail.com>

Hi all,
We have a custom Javascript policy, and we're running 3 Keycloak instances
in a Kubernetes cluster.
Cluster configuration is based on DNS_PING and we've followed the Helm
provided by Codecentric.
The three Keycloak pods successfully joined the cluster (in standalone
mode). We're seeing this from following log lines:

10:16:02,114 INFO  [org.infinispan.CLUSTER] (MSC service thread 1-4)
ISPN000094: Received new cluster view for channel ejb: [keycloak-2|13] (3)
[keycloak-2, keycloak-1, keycloak-0]
10:16:02,114 INFO  [org.infinispan.CLUSTER] (MSC service thread 1-3)
ISPN000094: Received new cluster view for channel ejb: [keycloak-2|13] (3)
[keycloak-2, keycloak-1, keycloak-0]
10:16:02,114 INFO  [org.infinispan.CLUSTER] (MSC service thread 1-2)
ISPN000094: Received new cluster view for channel ejb: [keycloak-2|13] (3)
[keycloak-2, keycloak-1, keycloak-0]
10:16:02,114 INFO  [org.infinispan.CLUSTER] (MSC service thread 1-1)
ISPN000094: Received new cluster view for channel ejb: [keycloak-2|13] (3)
[keycloak-2, keycloak-1, keycloak-0]
10:16:02,120 INFO
 [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service
thread 1-4) ISPN000079: Channel ejb local address is keycloak-0, physical
addresses are [10.71.10.170:7600]
10:16:02,120 INFO
 [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service
thread 1-3) ISPN000079: Channel ejb local address is keycloak-0, physical
addresses are [10.71.10.170:7600]
10:16:02,120 INFO
 [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service
thread 1-1) ISPN000079: Channel ejb local address is keycloak-0, physical
addresses are [10.71.10.170:7600]
10:16:02,120 INFO
 [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service
thread 1-2) ISPN000079: Channel ejb local address is keycloak-0, physical
addresses are [10.71.10.170:7600]
10:16:02,755 INFO
 [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service
thread 1-3) ISPN000078: Starting JGroups channel ejb
10:16:02,756 INFO  [org.infinispan.CLUSTER] (MSC service thread 1-3)
ISPN000094: Received new cluster view for channel ejb: [keycloak-2|13] (3)
[keycloak-2, keycloak-1, keycloak-0]
10:16:02,757 INFO
 [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service
thread 1-3) ISPN000079: Channel ejb local address is keycloak-0, physical
addresses are [10.71.10.170:7600]


The problem can be reproduced by the following:
- We update the code of our Javascript policy, adding a new "print"
- We just see the new log line on one node, the others are not printing the
new log

Maybe is something related to cache invalidation?

Thank you very much,
Matteo Restelli

-- 

Like <https://www.facebook.com/cuebiq/> I Follow  
<https://twitter.com/Cuebiq>I Connect 
<https://www.linkedin.com/company/cuebiq>


This email is reserved 
exclusively for sending and receiving messages inherent working activities, 
and is not intended nor authorized for personal use. Therefore, any 
outgoing messages or incoming response messages will be treated as company 
messages and will be subject to the corporate IT policy and may possibly to 
be read by persons other than by the subscriber of the box. Confidential 
information may be contained in this message. If you are not the address 
indicated in this message, please do not copy or deliver this message to 
anyone. In such case, you should notify the sender immediately and delete 
the original message.

From hannah.short at cern.ch  Mon Jul 29 07:24:05 2019
From: hannah.short at cern.ch (Hannah Short)
Date: Mon, 29 Jul 2019 11:24:05 +0000
Subject: [keycloak-user] Java minor update missing files
In-Reply-To: <A413725C-B361-41EC-8DF5-608317EE4E18@shinetown.com.hk>
References: <38C8D8DD-32E9-4658-8E65-1A9972054875@cern.ch>
	<CABHM76V=dKJ-CSMAW3hcSbW0hwAHmuKbRO+n3xdBU7fcyjfHcw@mail.gmail.com>
	<767F873B-A93A-4DBC-BCFB-87A5D918E1C4@cern.ch>
	<A413725C-B361-41EC-8DF5-608317EE4E18@shinetown.com.hk>
Message-ID: <B44A3446-ECE5-451A-830C-9D169EFC130D@cern.ch>

Thanks, both, very much! 

We?ll take a look and report back with anything interesting :) 

Cheers,
Hannah

> On 29 Jul 2019, at 12:08, Tony Yip <tony.yip at shinetown.com.hk> wrote:
> 
> Hi Hannah,
> 
> You could config the JAVA_HOME parameter in the startup script (e.g. standalone.sh). You may set JAVA_HOME to /usr/lib/jvm/jre-openjdk which is a symbolic link to the latest jdk. In case you want to fix the major java version, you may use /usr/lib/jvm/jre-1.8.0
> 
> Hope this could help.
> 
> Yours sincerely,
> Tony Yip
> tony.yip at shinetown.com.hk
> Frontend Developer
> Shinetown Telecommunication Limited
> 
> Web: shinetown.com.hk
> 
>> On 29 Jul 2019, at 5:49 PM, Hannah Short <hannah.short at cern.ch> wrote:
>> 
>> Hi Dominik,
>> 
>> Sure: java.io.FileNotFoundException: /usr/lib/jvm/java-1.8.0-openjdk-1.8.0.212.b04-0.el7_6.x86_64/jre/lib/ext/nashorn.jar
>> 
>> Cheers,
>> Hannah
>> 
>> On 29 Jul 2019, at 11:16, Dominik Dorn <dominik at dominikdorn.com<mailto:dominik at dominikdorn.com>> wrote:
>> 
>> Please provide the full path of at least one file that is "missing".. /usr/lib/jvm/java-1.8.0 could be anything..
>> 
>> 
>> 
>> On Mon, Jul 29, 2019 at 10:32 AM Hannah Short <hannah.short at cern.ch<mailto:hannah.short at cern.ch>> wrote:
>> Hi keycloak users,
>> 
>> We are having issues with broken links in Keycloak each time Java is updated on our servers. Does anyone have advice? E.g. java.io.FileNotFoundException: /usr/lib/jvm/java-1.8.0?
>> 
>> We would like to have minor updates included automatically, for security purposes, but they currently result in java runtime errors when trying to authenticate afterwards.
>> 
>> Thanks in advance,
>> Hannah
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>> 
>> 
>> --
>> Dominik Dorn
>> https://dominikdorn.com/ | https://twitter.com/domdorn
>> XING: https://www.xing.com/profile/Dominik_Dorn
>> LINKEDIN: https://www.linkedin.com/in/dominik-dorn/
>> 
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
> 



From Alexandra.Orth at oliverwyman.com  Mon Jul 29 07:54:55 2019
From: Alexandra.Orth at oliverwyman.com (Orth, Alexandra)
Date: Mon, 29 Jul 2019 11:54:55 +0000
Subject: [keycloak-user] Keycloak in Websphere
Message-ID: <FFE92401-52E7-4F18-A32B-6375759645F6@oliverwyman.com>

Hello,

I want to ask about the feasibility of getting Keycloak to run in Websphere instead of Wildfly. I found this link from 2018 (https://dzone.com/articles/deploying-keycloak-in-tomcat) describing how to deploy to Tomcat and was wondering if a similar approach might work now.

Any advice and/or instructions would be appreciated!

Thanks,
Alexandra

From corentin.dupont at gmail.com  Mon Jul 29 08:23:03 2019
From: corentin.dupont at gmail.com (Corentin Dupont)
Date: Mon, 29 Jul 2019 14:23:03 +0200
Subject: [keycloak-user] Delete all resources
Message-ID: <CAEyhvmoeB5tHuqwwJoxcHO7FKU5+1TcCwT6obB8E0mwKpJ67Hw@mail.gmail.com>

Hi guys,
is there an easy way to delete all resources? The UI doesn't seem to offer
this functionality.
It seems I need to create a small script with the API, right?
Or can performing some DB commands (drop TABLE) could do it?
Thanks
Corentin

From corentin.dupont at gmail.com  Mon Jul 29 08:33:44 2019
From: corentin.dupont at gmail.com (Corentin Dupont)
Date: Mon, 29 Jul 2019 14:33:44 +0200
Subject: [keycloak-user] Duplicate entry for key
Message-ID: <CAEyhvmqWXAfqWDbusSV8UDaHe0sVe3ZCHTmVWdYShjiya-HSXA@mail.gmail.com>

Dear all,
I often have this error:
keycloak_1_c37c1c45aa45 | 12:28:02,524 ERROR
[org.keycloak.services.error.KeycloakErrorHandler] (default task-10)
Uncaught server error: org.keycloak.models.ModelDuplicateException:
javax.persistence.PersistenceException:
org.hibernate.exception.ConstraintViolationException: could not execute
statement
...
keycloak_1_c37c1c45aa45 | Caused by:
com.mysql.jdbc.exceptions.jdbc4.MySQLIntegrityConstraintViolationException:
Duplicate entry
'GW1-d9d54300-3791-443c-884c-0c52c43d64db-0892e431-5daf-413e-b4cf' for key
'UK_FRSR6T700S9V50BU18WS5HA6'

For instance, I have this error when trying to create a resource.
What does it mean? How to solve it?
Thanks
Corentin

From psilva at redhat.com  Mon Jul 29 08:45:10 2019
From: psilva at redhat.com (Pedro Igor Silva)
Date: Mon, 29 Jul 2019 09:45:10 -0300
Subject: [keycloak-user] Cache invalidation Javascript policies -
	cluster mode
In-Reply-To: <CAHpjjTbiyJj6+vBRbCxVqf73dPHNHR+8s35WgjK2=7q1gioDsw@mail.gmail.com>
References: <CAHpjjTbiyJj6+vBRbCxVqf73dPHNHR+8s35WgjK2=7q1gioDsw@mail.gmail.com>
Message-ID: <CAJrcDBce8ZPDet2D6g0iPkv1FyjFJd3O7yUo-FFz9LuT-om0Mg@mail.gmail.com>

Hi,

It does. But at the same time, I'm quite sure we are invalidating entries
in the cache when a policy is updated. Could you please create a JIRA to
track this? I'll need to spend some time testing this locally and try to
reproduce the issue. If you provide some steps to reproduce this (and are
able to do so) using a vanilla installation, I appreciate.

Regards.
Pedro Igor

On Mon, Jul 29, 2019 at 7:47 AM Matteo Restelli <mrestelli at cuebiq.com>
wrote:

> Hi all,
> We have a custom Javascript policy, and we're running 3 Keycloak instances
> in a Kubernetes cluster.
> Cluster configuration is based on DNS_PING and we've followed the Helm
> provided by Codecentric.
> The three Keycloak pods successfully joined the cluster (in standalone
> mode). We're seeing this from following log lines:
>
> 10:16:02,114 INFO  [org.infinispan.CLUSTER] (MSC service thread 1-4)
> ISPN000094: Received new cluster view for channel ejb: [keycloak-2|13] (3)
> [keycloak-2, keycloak-1, keycloak-0]
> 10:16:02,114 INFO  [org.infinispan.CLUSTER] (MSC service thread 1-3)
> ISPN000094: Received new cluster view for channel ejb: [keycloak-2|13] (3)
> [keycloak-2, keycloak-1, keycloak-0]
> 10:16:02,114 INFO  [org.infinispan.CLUSTER] (MSC service thread 1-2)
> ISPN000094: Received new cluster view for channel ejb: [keycloak-2|13] (3)
> [keycloak-2, keycloak-1, keycloak-0]
> 10:16:02,114 INFO  [org.infinispan.CLUSTER] (MSC service thread 1-1)
> ISPN000094: Received new cluster view for channel ejb: [keycloak-2|13] (3)
> [keycloak-2, keycloak-1, keycloak-0]
> 10:16:02,120 INFO
>  [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service
> thread 1-4) ISPN000079: Channel ejb local address is keycloak-0, physical
> addresses are [10.71.10.170:7600]
> 10:16:02,120 INFO
>  [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service
> thread 1-3) ISPN000079: Channel ejb local address is keycloak-0, physical
> addresses are [10.71.10.170:7600]
> 10:16:02,120 INFO
>  [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service
> thread 1-1) ISPN000079: Channel ejb local address is keycloak-0, physical
> addresses are [10.71.10.170:7600]
> 10:16:02,120 INFO
>  [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service
> thread 1-2) ISPN000079: Channel ejb local address is keycloak-0, physical
> addresses are [10.71.10.170:7600]
> 10:16:02,755 INFO
>  [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service
> thread 1-3) ISPN000078: Starting JGroups channel ejb
> 10:16:02,756 INFO  [org.infinispan.CLUSTER] (MSC service thread 1-3)
> ISPN000094: Received new cluster view for channel ejb: [keycloak-2|13] (3)
> [keycloak-2, keycloak-1, keycloak-0]
> 10:16:02,757 INFO
>  [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service
> thread 1-3) ISPN000079: Channel ejb local address is keycloak-0, physical
> addresses are [10.71.10.170:7600]
>
>
> The problem can be reproduced by the following:
> - We update the code of our Javascript policy, adding a new "print"
> - We just see the new log line on one node, the others are not printing the
> new log
>
> Maybe is something related to cache invalidation?
>
> Thank you very much,
> Matteo Restelli
>
> --
>
> Like <https://www.facebook.com/cuebiq/> I Follow
> <https://twitter.com/Cuebiq>I Connect
> <https://www.linkedin.com/company/cuebiq>
>
>
> This email is reserved
> exclusively for sending and receiving messages inherent working
> activities,
> and is not intended nor authorized for personal use. Therefore, any
> outgoing messages or incoming response messages will be treated as company
> messages and will be subject to the corporate IT policy and may possibly
> to
> be read by persons other than by the subscriber of the box. Confidential
> information may be contained in this message. If you are not the address
> indicated in this message, please do not copy or deliver this message to
> anyone. In such case, you should notify the sender immediately and delete
> the original message.
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

From jdennis at redhat.com  Mon Jul 29 08:46:07 2019
From: jdennis at redhat.com (John Dennis)
Date: Mon, 29 Jul 2019 08:46:07 -0400
Subject: [keycloak-user] General Question - Keycloak Configuration as
 SAML Service Provider
In-Reply-To: <E0F43660-0A62-498E-96C1-BC0C93574D65@auckland.ac.nz>
References: <E0F43660-0A62-498E-96C1-BC0C93574D65@auckland.ac.nz>
Message-ID: <05b8f3a6-5635-b7a0-554e-99700b504f52@redhat.com>

On 7/23/19 1:58 AM, Reid Watson wrote:
> Hi Everyone,
> 
> Were investigating ?Keycloak? with oAuth2 / OIDC and SAML and I?m wondering does the application have the ability for users to configure an SP (Service Provider) within Keycloak .
> 
> As I understand it Keycloak server plays the role of an Identity Provider (IDP) and provides means to authenticate a user for a Service Provider.
> 
> There is no mention or guides for users to configuring a Service Provider but I might not be looking at the incorrect documentation.

Keycloak operates as an SP when you configure it to authenticate against 
another IdP in federated mode.


-- 
John Dennis

From psilva at redhat.com  Mon Jul 29 08:53:53 2019
From: psilva at redhat.com (Pedro Igor Silva)
Date: Mon, 29 Jul 2019 09:53:53 -0300
Subject: [keycloak-user] Delete all resources
In-Reply-To: <CAEyhvmoeB5tHuqwwJoxcHO7FKU5+1TcCwT6obB8E0mwKpJ67Hw@mail.gmail.com>
References: <CAEyhvmoeB5tHuqwwJoxcHO7FKU5+1TcCwT6obB8E0mwKpJ67Hw@mail.gmail.com>
Message-ID: <CAJrcDBfXo_TAC=zC_bDWahe91Huu_av_oKWaThr+cNRteRLyXw@mail.gmail.com>

Hi Corentin,

It should be related to https://issues.jboss.org/browse/KEYCLOAK-8784.

Doing it directly in the DB will not work because of the cache.

One thing you could do, as a workaround, is disable the authz settings and
enable it again for a particular client. By doing that, any authz setting
associated with the client will be removed, not only resources. After that,
you should be able to import your policies and start from scratch.

Regards.
Pedro Igor

On Mon, Jul 29, 2019 at 9:45 AM Corentin Dupont <corentin.dupont at gmail.com>
wrote:

> Hi guys,
> is there an easy way to delete all resources? The UI doesn't seem to offer
> this functionality.
> It seems I need to create a small script with the API, right?
> Or can performing some DB commands (drop TABLE) could do it?
> Thanks
> Corentin
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

From psilva at redhat.com  Mon Jul 29 08:59:05 2019
From: psilva at redhat.com (Pedro Igor Silva)
Date: Mon, 29 Jul 2019 09:59:05 -0300
Subject: [keycloak-user] Keycloak using Sql Server on Azure as db: stops
 working after few days
In-Reply-To: <CABQ2P6EsOTzU4MM4rD6wQBD+ESS2WNMDgpvt7kRpXBgLgtQa3Q@mail.gmail.com>
References: <CABQ2P6EsOTzU4MM4rD6wQBD+ESS2WNMDgpvt7kRpXBgLgtQa3Q@mail.gmail.com>
Message-ID: <CAJrcDBcJ64AMhSs30fj5K4Au5D61E2vQRmrD9wNrOaUkXR2aLw@mail.gmail.com>

Maybe your server is being restarted and the connections in the pool get
stale.

You could try to change server's data source as follows:

/subsystem=datasources/data-source=KeycloakDS/:write-attribute(name=background-validation,value=true)
/subsystem=datasources/data-source=KeycloakDS/:write-attribute(name=check-valid-connection-sql,value="select
1")
/subsystem=datasources/data-source=KeycloakDS/:write-attribute(name=background-validation-millis,value=120000)


Regards.
Pedro Igor

On Mon, Jul 29, 2019 at 4:22 AM Mario Giammarco <mgiammarco at gmail.com>
wrote:

> Hello,
>
> I have installed a Keycloak as an Azure virtual machine. As database I have
> chosen the Sql Server offered as an Azure service. I have configured it
> correctly because all works. But after some days it stops working. I get
> these exceptions:
>
>
>
> Caused by: org.hibernate.exception.GenericJDBCException: could not
> prepare statement
>     at
> org.hibernate.exception.internal.StandardSQLExceptionConverter.convert(StandardSQLExceptionConverter.java:47)
>     at
> org.hibernate.engine.jdbc.spi.SqlExceptionHelper.convert(SqlExceptionHelper.java:113)
>     at
> org.hibernate.engine.jdbc.internal.StatementPreparerImpl$StatementPreparationTemplate.prepareStatement(StatementPreparerImpl.java:182)
>     at
> org.hibernate.engine.jdbc.internal.StatementPreparerImpl.prepareQueryStatement(StatementPreparerImpl.java:148)
>     at org.hibernate.loader.Loader.prepareQueryStatement(Loader.java:1984)
>     at org.hibernate.loader.Loader.executeQueryStatement(Loader.java:1914)
>     at org.hibernate.loader.Loader.executeQueryStatement(Loader.java:1892)
>     at org.hibernate.loader.Loader.doQuery(Loader.java:937)
>     at
> org.hibernate.loader.Loader.doQueryAndInitializeNonLazyCollections(Loader.java:340)
>     at org.hibernate.loader.Loader.doList(Loader.java:2689)
>     at org.hibernate.loader.Loader.doList(Loader.java:2672)
>     at org.hibernate.loader.Loader.listIgnoreQueryCache(Loader.java:2506)
>     at org.hibernate.loader.Loader.list(Loader.java:2501)
>     at org.hibernate.loader.hql.QueryLoader.list(QueryLoader.java:504)
>     at
> org.hibernate.hql.internal.ast.QueryTranslatorImpl.list(QueryTranslatorImpl.java:395)
>     at
> org.hibernate.engine.query.spi.HQLQueryPlan.performList(HQLQueryPlan.java:220)
>     at org.hibernate.internal.SessionImpl.list(SessionImpl.java:1507)
>     at
> org.hibernate.query.internal.AbstractProducedQuery.doList(AbstractProducedQuery.java:1537)
>     at
> org.hibernate.query.internal.AbstractProducedQuery.list(AbstractProducedQuery.java:1505)
>     ... 13 more
> Caused by: com.microsoft.sqlserver.jdbc.SQLServerException: The
> connection is closed.
>     at
> com.microsoft.sqlserver.jdbc.SQLServerException.makeFromDriverError(SQLServerException.java:234)
>     at
> com.microsoft.sqlserver.jdbc.SQLServerConnection.checkClosed(SQLServerConnection.java:1088)
>     at
> com.microsoft.sqlserver.jdbc.SQLServerConnection.prepareStatement(SQLServerConnection.java:3409)
>     at
> org.jboss.jca.adapters.jdbc.BaseWrapperManagedConnection.doPrepareStatement(BaseWrapperManagedConnection.java:758)
>     at
> org.jboss.jca.adapters.jdbc.BaseWrapperManagedConnection.prepareStatement(BaseWrapperManagedConnection.java:744)
>     at
> org.jboss.jca.adapters.jdbc.WrappedConnection.prepareStatement(WrappedConnection.java:459)
>     at
> org.hibernate.engine.jdbc.internal.StatementPreparerImpl$5.doPrepare(StatementPreparerImpl.java:146)
>     at
> org.hibernate.engine.jdbc.internal.StatementPreparerImpl$StatementPreparationTemplate.prepareStatement(StatementPreparerImpl.java:172)
>
>
>
>
> It seems that, after some time, sql server refuses new connections.
> I have tried reducing max-pool-size and I have obtained that it now
> gives the problem some days before.
> I need help because the exception is not very informative.
> Thanks in advance for any hints.
> Mario
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>

From stef.graces at nubera.be  Mon Jul 29 09:01:30 2019
From: stef.graces at nubera.be (Stef Graces)
Date: Mon, 29 Jul 2019 15:01:30 +0200
Subject: [keycloak-user] Keycloak sign secret HS256 JWT
Message-ID: <EF0035BC-D449-4BA0-A194-D5B74D2B11CF@nubera.be>

Hi,

I?ve been trying to create a static website with role based access. To achieve this, I use a HS256 signed JSON-web token, which is verified by the site using the shared secret.
However, I have been unable to find this secret. I have tried the method described in this email: https://lists.jboss.org/pipermail/keycloak-user/2018-December/016818.html <https://lists.jboss.org/pipermail/keycloak-user/2018-December/016818.html>, But I have been unable to verify the token I received from Keycloak using many different tools.
Can I retrieve the secret somewhere else or is there a way for me to create a secret myself for signing JWT?s using the HS256 algorithm? 
Note: to host my website I am using a service that only supports HS256 signed JWT?s.

Kind regards,

Stef Graces

From mrestelli at cuebiq.com  Mon Jul 29 09:35:05 2019
From: mrestelli at cuebiq.com (Matteo Restelli)
Date: Mon, 29 Jul 2019 15:35:05 +0200
Subject: [keycloak-user] Cache invalidation Javascript policies -
	cluster mode
In-Reply-To: <CAJrcDBce8ZPDet2D6g0iPkv1FyjFJd3O7yUo-FFz9LuT-om0Mg@mail.gmail.com>
References: <CAHpjjTbiyJj6+vBRbCxVqf73dPHNHR+8s35WgjK2=7q1gioDsw@mail.gmail.com>
	<CAJrcDBce8ZPDet2D6g0iPkv1FyjFJd3O7yUo-FFz9LuT-om0Mg@mail.gmail.com>
Message-ID: <CAHpjjTao2um14RiMmnPonmqD_rgzhw39CJ0q1pmi27nD+Tcw=w@mail.gmail.com>

Hi Pedro,
It seems that the cache gets invalidated only in the node which received
the policy update request. I'm not sure if i'll be able to provide the
steps in a vanilla installation, but i'm going to open a Jira.

Thank you again,
Matteo

On Mon, Jul 29, 2019 at 2:45 PM Pedro Igor Silva <psilva at redhat.com> wrote:

> Hi,
>
> It does. But at the same time, I'm quite sure we are invalidating entries
> in the cache when a policy is updated. Could you please create a JIRA to
> track this? I'll need to spend some time testing this locally and try to
> reproduce the issue. If you provide some steps to reproduce this (and are
> able to do so) using a vanilla installation, I appreciate.
>
> Regards.
> Pedro Igor
>
> On Mon, Jul 29, 2019 at 7:47 AM Matteo Restelli <mrestelli at cuebiq.com>
> wrote:
>
>> Hi all,
>> We have a custom Javascript policy, and we're running 3 Keycloak instances
>> in a Kubernetes cluster.
>> Cluster configuration is based on DNS_PING and we've followed the Helm
>> provided by Codecentric.
>> The three Keycloak pods successfully joined the cluster (in standalone
>> mode). We're seeing this from following log lines:
>>
>> 10:16:02,114 INFO  [org.infinispan.CLUSTER] (MSC service thread 1-4)
>> ISPN000094: Received new cluster view for channel ejb: [keycloak-2|13] (3)
>> [keycloak-2, keycloak-1, keycloak-0]
>> 10:16:02,114 INFO  [org.infinispan.CLUSTER] (MSC service thread 1-3)
>> ISPN000094: Received new cluster view for channel ejb: [keycloak-2|13] (3)
>> [keycloak-2, keycloak-1, keycloak-0]
>> 10:16:02,114 INFO  [org.infinispan.CLUSTER] (MSC service thread 1-2)
>> ISPN000094: Received new cluster view for channel ejb: [keycloak-2|13] (3)
>> [keycloak-2, keycloak-1, keycloak-0]
>> 10:16:02,114 INFO  [org.infinispan.CLUSTER] (MSC service thread 1-1)
>> ISPN000094: Received new cluster view for channel ejb: [keycloak-2|13] (3)
>> [keycloak-2, keycloak-1, keycloak-0]
>> 10:16:02,120 INFO
>>  [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service
>> thread 1-4) ISPN000079: Channel ejb local address is keycloak-0, physical
>> addresses are [10.71.10.170:7600]
>> 10:16:02,120 INFO
>>  [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service
>> thread 1-3) ISPN000079: Channel ejb local address is keycloak-0, physical
>> addresses are [10.71.10.170:7600]
>> 10:16:02,120 INFO
>>  [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service
>> thread 1-1) ISPN000079: Channel ejb local address is keycloak-0, physical
>> addresses are [10.71.10.170:7600]
>> 10:16:02,120 INFO
>>  [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service
>> thread 1-2) ISPN000079: Channel ejb local address is keycloak-0, physical
>> addresses are [10.71.10.170:7600]
>> 10:16:02,755 INFO
>>  [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service
>> thread 1-3) ISPN000078: Starting JGroups channel ejb
>> 10:16:02,756 INFO  [org.infinispan.CLUSTER] (MSC service thread 1-3)
>> ISPN000094: Received new cluster view for channel ejb: [keycloak-2|13] (3)
>> [keycloak-2, keycloak-1, keycloak-0]
>> 10:16:02,757 INFO
>>  [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC service
>> thread 1-3) ISPN000079: Channel ejb local address is keycloak-0, physical
>> addresses are [10.71.10.170:7600]
>>
>>
>> The problem can be reproduced by the following:
>> - We update the code of our Javascript policy, adding a new "print"
>> - We just see the new log line on one node, the others are not printing
>> the
>> new log
>>
>> Maybe is something related to cache invalidation?
>>
>> Thank you very much,
>> Matteo Restelli
>>
>> --
>>
>> Like <https://www.facebook.com/cuebiq/> I Follow
>> <https://twitter.com/Cuebiq>I Connect
>> <https://www.linkedin.com/company/cuebiq>
>>
>>
>> This email is reserved
>> exclusively for sending and receiving messages inherent working
>> activities,
>> and is not intended nor authorized for personal use. Therefore, any
>> outgoing messages or incoming response messages will be treated as
>> company
>> messages and will be subject to the corporate IT policy and may possibly
>> to
>> be read by persons other than by the subscriber of the box. Confidential
>> information may be contained in this message. If you are not the address
>> indicated in this message, please do not copy or deliver this message to
>> anyone. In such case, you should notify the sender immediately and delete
>> the original message.
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>

-- 

Like <https://www.facebook.com/cuebiq/> I Follow  
<https://twitter.com/Cuebiq>I Connect 
<https://www.linkedin.com/company/cuebiq>


This email is reserved 
exclusively for sending and receiving messages inherent working activities, 
and is not intended nor authorized for personal use. Therefore, any 
outgoing messages or incoming response messages will be treated as company 
messages and will be subject to the corporate IT policy and may possibly to 
be read by persons other than by the subscriber of the box. Confidential 
information may be contained in this message. If you are not the address 
indicated in this message, please do not copy or deliver this message to 
anyone. In such case, you should notify the sender immediately and delete 
the original message.

From corentin.dupont at gmail.com  Mon Jul 29 09:35:06 2019
From: corentin.dupont at gmail.com (Corentin Dupont)
Date: Mon, 29 Jul 2019 15:35:06 +0200
Subject: [keycloak-user] Delete all resources
In-Reply-To: <CAJrcDBfXo_TAC=zC_bDWahe91Huu_av_oKWaThr+cNRteRLyXw@mail.gmail.com>
References: <CAEyhvmoeB5tHuqwwJoxcHO7FKU5+1TcCwT6obB8E0mwKpJ67Hw@mail.gmail.com>
	<CAJrcDBfXo_TAC=zC_bDWahe91Huu_av_oKWaThr+cNRteRLyXw@mail.gmail.com>
Message-ID: <CAEyhvmp8qT8K3FQN4eayswDaMxumL_Lmccpt5OzUqR7r0K7rvQ@mail.gmail.com>

Thanks a lot.
This is the script I wrote:

CLIENTTOKEN=`curl -X POST -H "Content-Type:
application/x-www-form-urlencoded" -d
'grant_type=client_credentials&client_id=api-server&client_secret=XXXXXX' "
http://localhost:8080/auth/realms/waziup/protocol/openid-connect/token" |
jq .access_token -r`

curl "
http://localhost:8080/auth/realms/waziup/authz/protection/resource_set?max=1000"
-H "Authorization: Bearer $CLIENTTOKEN" -H "Content-Type: application/json"
-v > resources.json

jq -c -r '.[]' resources.json | while read i; do
  echo "deleting $i"
  curl -X DELETE "
http://localhost:8080/auth/realms/waziup/authz/protection/resource_set/$i"
-H "Authorization: Bearer $CLIENTTOKEN"
done

Seems to work.
Cheers

On Mon, Jul 29, 2019 at 2:54 PM Pedro Igor Silva <psilva at redhat.com> wrote:

> Hi Corentin,
>
> It should be related to https://issues.jboss.org/browse/KEYCLOAK-8784.
>
> Doing it directly in the DB will not work because of the cache.
>
> One thing you could do, as a workaround, is disable the authz settings and
> enable it again for a particular client. By doing that, any authz setting
> associated with the client will be removed, not only resources. After that,
> you should be able to import your policies and start from scratch.
>
> Regards.
> Pedro Igor
>
> On Mon, Jul 29, 2019 at 9:45 AM Corentin Dupont <corentin.dupont at gmail.com>
> wrote:
>
>> Hi guys,
>> is there an easy way to delete all resources? The UI doesn't seem to offer
>> this functionality.
>> It seems I need to create a small script with the API, right?
>> Or can performing some DB commands (drop TABLE) could do it?
>> Thanks
>> Corentin
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>

From gdiodato at ifc.cnr.it  Mon Jul 29 09:41:03 2019
From: gdiodato at ifc.cnr.it (Gianluca Diodato)
Date: Mon, 29 Jul 2019 15:41:03 +0200 (CEST)
Subject: [keycloak-user] XHRs resulting in 401 unauthorized
Message-ID: <993828493.6327249.1564407663149.JavaMail.zimbra@ifc.cnr.it>

Hi All, 
We have a problem in our platform configuration: 

Server 1: 
Apache 2.4.x 
mod_auth_openidc 2.3.11 
Symfony 3.x application + Javascript & Ajax code (no headers into our xhr requests) 

Server 2: 
Keycloack 4.8.3 Final (client is confidential type) 

All work fine but after few minutes (about 4 minutes) any requests (XHRs)fails with error 401 unauthorized into browser. 
To bypass the error, we added this parameter into ssl.conf (attached file): 

OIDCSessionInactivityTimeout 1800 

But we would find a definitive solution. 
We googled about this problem: 

https://github.com/zmartzone/mod_auth_openidc/wiki/Cookies 
https://github.com/zmartzone/mod_auth_openidc/wiki/Access-Tokens-and-Refresh-Tokens 

but we not found anything help us. We missed something? 

Comments and suggestions are welcome. 

Bests 
Gianluca Diodato
-------------- next part --------------
A non-text attachment was scrubbed...
Name: ssl.conf
Type: application/octet-stream
Size: 10151 bytes
Desc: not available
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20190729/47f5c18d/attachment-0001.obj 

From mrestelli at cuebiq.com  Mon Jul 29 09:43:44 2019
From: mrestelli at cuebiq.com (Matteo Restelli)
Date: Mon, 29 Jul 2019 15:43:44 +0200
Subject: [keycloak-user] Cache invalidation Javascript policies -
	cluster mode
In-Reply-To: <CAHpjjTao2um14RiMmnPonmqD_rgzhw39CJ0q1pmi27nD+Tcw=w@mail.gmail.com>
References: <CAHpjjTbiyJj6+vBRbCxVqf73dPHNHR+8s35WgjK2=7q1gioDsw@mail.gmail.com>
	<CAJrcDBce8ZPDet2D6g0iPkv1FyjFJd3O7yUo-FFz9LuT-om0Mg@mail.gmail.com>
	<CAHpjjTao2um14RiMmnPonmqD_rgzhw39CJ0q1pmi27nD+Tcw=w@mail.gmail.com>
Message-ID: <CAHpjjTapo1V9NV7FFWOyLLAHPSV_HUQ64L4kER4X23GtUtm95Q@mail.gmail.com>

Hi Pedro,
i've just created the following Jira Issue:
https://issues.jboss.org/browse/KEYCLOAK-10954

Thank you,
Matteo

On Mon, Jul 29, 2019 at 3:35 PM Matteo Restelli <mrestelli at cuebiq.com>
wrote:

> Hi Pedro,
> It seems that the cache gets invalidated only in the node which received
> the policy update request. I'm not sure if i'll be able to provide the
> steps in a vanilla installation, but i'm going to open a Jira.
>
> Thank you again,
> Matteo
>
> On Mon, Jul 29, 2019 at 2:45 PM Pedro Igor Silva <psilva at redhat.com>
> wrote:
>
>> Hi,
>>
>> It does. But at the same time, I'm quite sure we are invalidating entries
>> in the cache when a policy is updated. Could you please create a JIRA to
>> track this? I'll need to spend some time testing this locally and try to
>> reproduce the issue. If you provide some steps to reproduce this (and are
>> able to do so) using a vanilla installation, I appreciate.
>>
>> Regards.
>> Pedro Igor
>>
>> On Mon, Jul 29, 2019 at 7:47 AM Matteo Restelli <mrestelli at cuebiq.com>
>> wrote:
>>
>>> Hi all,
>>> We have a custom Javascript policy, and we're running 3 Keycloak
>>> instances
>>> in a Kubernetes cluster.
>>> Cluster configuration is based on DNS_PING and we've followed the Helm
>>> provided by Codecentric.
>>> The three Keycloak pods successfully joined the cluster (in standalone
>>> mode). We're seeing this from following log lines:
>>>
>>> 10:16:02,114 INFO  [org.infinispan.CLUSTER] (MSC service thread 1-4)
>>> ISPN000094: Received new cluster view for channel ejb: [keycloak-2|13]
>>> (3)
>>> [keycloak-2, keycloak-1, keycloak-0]
>>> 10:16:02,114 INFO  [org.infinispan.CLUSTER] (MSC service thread 1-3)
>>> ISPN000094: Received new cluster view for channel ejb: [keycloak-2|13]
>>> (3)
>>> [keycloak-2, keycloak-1, keycloak-0]
>>> 10:16:02,114 INFO  [org.infinispan.CLUSTER] (MSC service thread 1-2)
>>> ISPN000094: Received new cluster view for channel ejb: [keycloak-2|13]
>>> (3)
>>> [keycloak-2, keycloak-1, keycloak-0]
>>> 10:16:02,114 INFO  [org.infinispan.CLUSTER] (MSC service thread 1-1)
>>> ISPN000094: Received new cluster view for channel ejb: [keycloak-2|13]
>>> (3)
>>> [keycloak-2, keycloak-1, keycloak-0]
>>> 10:16:02,120 INFO
>>>  [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC
>>> service
>>> thread 1-4) ISPN000079: Channel ejb local address is keycloak-0, physical
>>> addresses are [10.71.10.170:7600]
>>> 10:16:02,120 INFO
>>>  [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC
>>> service
>>> thread 1-3) ISPN000079: Channel ejb local address is keycloak-0, physical
>>> addresses are [10.71.10.170:7600]
>>> 10:16:02,120 INFO
>>>  [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC
>>> service
>>> thread 1-1) ISPN000079: Channel ejb local address is keycloak-0, physical
>>> addresses are [10.71.10.170:7600]
>>> 10:16:02,120 INFO
>>>  [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC
>>> service
>>> thread 1-2) ISPN000079: Channel ejb local address is keycloak-0, physical
>>> addresses are [10.71.10.170:7600]
>>> 10:16:02,755 INFO
>>>  [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC
>>> service
>>> thread 1-3) ISPN000078: Starting JGroups channel ejb
>>> 10:16:02,756 INFO  [org.infinispan.CLUSTER] (MSC service thread 1-3)
>>> ISPN000094: Received new cluster view for channel ejb: [keycloak-2|13]
>>> (3)
>>> [keycloak-2, keycloak-1, keycloak-0]
>>> 10:16:02,757 INFO
>>>  [org.infinispan.remoting.transport.jgroups.JGroupsTransport] (MSC
>>> service
>>> thread 1-3) ISPN000079: Channel ejb local address is keycloak-0, physical
>>> addresses are [10.71.10.170:7600]
>>>
>>>
>>> The problem can be reproduced by the following:
>>> - We update the code of our Javascript policy, adding a new "print"
>>> - We just see the new log line on one node, the others are not printing
>>> the
>>> new log
>>>
>>> Maybe is something related to cache invalidation?
>>>
>>> Thank you very much,
>>> Matteo Restelli
>>>
>>> --
>>>
>>> Like <https://www.facebook.com/cuebiq/> I Follow
>>> <https://twitter.com/Cuebiq>I Connect
>>> <https://www.linkedin.com/company/cuebiq>
>>>
>>>
>>> This email is reserved
>>> exclusively for sending and receiving messages inherent working
>>> activities,
>>> and is not intended nor authorized for personal use. Therefore, any
>>> outgoing messages or incoming response messages will be treated as
>>> company
>>> messages and will be subject to the corporate IT policy and may possibly
>>> to
>>> be read by persons other than by the subscriber of the box. Confidential
>>> information may be contained in this message. If you are not the address
>>> indicated in this message, please do not copy or deliver this message to
>>> anyone. In such case, you should notify the sender immediately and
>>> delete
>>> the original message.
>>> _______________________________________________
>>> keycloak-user mailing list
>>> keycloak-user at lists.jboss.org
>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>
>>

-- 

Like <https://www.facebook.com/cuebiq/> I Follow  
<https://twitter.com/Cuebiq>I Connect 
<https://www.linkedin.com/company/cuebiq>


This email is reserved 
exclusively for sending and receiving messages inherent working activities, 
and is not intended nor authorized for personal use. Therefore, any 
outgoing messages or incoming response messages will be treated as company 
messages and will be subject to the corporate IT policy and may possibly to 
be read by persons other than by the subscriber of the box. Confidential 
information may be contained in this message. If you are not the address 
indicated in this message, please do not copy or deliver this message to 
anyone. In such case, you should notify the sender immediately and delete 
the original message.

From anupa.shah91 at gmail.com  Mon Jul 29 11:16:36 2019
From: anupa.shah91 at gmail.com (anupa shah)
Date: Mon, 29 Jul 2019 20:46:36 +0530
Subject: [keycloak-user] Keycloak session management
Message-ID: <50EA41D0-99A2-4D9C-A590-866EF5DA2D48@gmail.com>

Hello Sir,

I am using keycloak with spring-adaptor approach with xml base. I am not able to get keycloak session in my project. So my application is not able to use keycloak session.Please guide me.
Below is link where i posted my question.
https://github.com/spring-projects/spring-security/issues/7152 

Please guide me.

Thanks,
Anupa

From alhezmi at yahoo.de  Mon Jul 29 11:56:20 2019
From: alhezmi at yahoo.de (alhezmi at yahoo.de)
Date: Mon, 29 Jul 2019 15:56:20 +0000 (UTC)
Subject: [keycloak-user] Keycloak process is killed during the booting-up
 and before the deployment of REST resources
References: <1494651390.1292143.1564415780372.ref@mail.yahoo.com>
Message-ID: <1494651390.1292143.1564415780372@mail.yahoo.com>

Hi,?
I managed to install?locally?the Keycloak as Standalone and tested with all required test cases fine.?
But when I tried to run it on another host available on the public Internet, the Keycloak process is killed after the Hibernat process is started?
"HHH000397: Using ASTQueryTranslatorFactory"

and before the process:?
"RESTEASY002225: Deploying javax.ws.rs.core.Application: class org.keycloak.services.resources.KeycloakApplication", where I compare the log files of the local and remote processes.
What could be the reason for such termination??
The server log is attached as text file. I appreciate your feedback.?

Best Regards/viele Gruesse, Adel Al-Hezmi
-------------- next part --------------
A non-text attachment was scrubbed...
Name: keycloak-server.log
Type: text/x-log
Size: 17529 bytes
Desc: not available
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20190729/a9de5ac5/attachment-0001.bin 

From lilian.benoit at lbenoit.fr  Mon Jul 29 16:24:51 2019
From: lilian.benoit at lbenoit.fr (Lilian BENOIT)
Date: Mon, 29 Jul 2019 22:24:51 +0200
Subject: [keycloak-user] Keycloak in Websphere
In-Reply-To: <FFE92401-52E7-4F18-A32B-6375759645F6@oliverwyman.com>
References: <FFE92401-52E7-4F18-A32B-6375759645F6@oliverwyman.com>
Message-ID: <0f5f82b9f66eabef056dcf0ba454ae1e@lbenoit.fr>


Hi Alexandra

Keycloak package isn't more a war archive.
Currently, Keycloak package is archive tar.gz that contains server 
(wildfly) + keycloak. It's inseparable.

Getting started is here 
(https://www.keycloak.org/docs/latest/getting_started/index.html)

PS : Your blog is dating from 2015 and not 2018.

Regards,
Lilian.

Le 29/07/2019 13:54, Orth, Alexandra a ?crit?:
> Hello,
> 
> I want to ask about the feasibility of getting Keycloak to run in
> Websphere instead of Wildfly. I found this link from 2018
> (https://dzone.com/articles/deploying-keycloak-in-tomcat) describing
> how to deploy to Tomcat and was wondering if a similar approach might
> work now.
> 
> Any advice and/or instructions would be appreciated!
> 
> Thanks,
> Alexandra
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From l.lech at ringler.ch  Tue Jul 30 04:30:17 2019
From: l.lech at ringler.ch (Lukasz Lech)
Date: Tue, 30 Jul 2019 08:30:17 +0000
Subject: [keycloak-user] Unable to log in with keycloak-js on localhost in
	Microsoft Edge
Message-ID: <5E48B917000C984B86B77170F441903A215A52AD@exch.ringler.ch>

Hello,

I'm unable to log-in on localhost (both using http://localhost and http://mylocalhostname ) using keycloak-js (https://www.npmjs.com/package/keycloak-js) on Microsoft Edge.

The problem is , that no POST is made to /auth/realms/REALM/protocol/openid-connect/token , only GET. On other browsers, or when using the same Edge to access the same app deployed remotely, there's both POST and GET made (BTW, why?).
The keycloak is deployed on remote machine.

I've tested keycloak-js versions 4.5.0, 4.8.3 and 6.0.1
The keycloak server configuration is identical in both cases.

Do anybody experience that behavior? Is this Edge blocking some requests on random criteria when the app is loaded from localhost?

Best regards,
Lukasz Lech



From alvaro.gomez.gimenez at tecsisa.com  Tue Jul 30 06:34:35 2019
From: alvaro.gomez.gimenez at tecsisa.com (=?UTF-8?B?w4FsdmFybyBHw7NtZXo=?=)
Date: Tue, 30 Jul 2019 12:34:35 +0200
Subject: [keycloak-user] Question about CBAC + Pushing Claims +
 Authorization Scopes
In-Reply-To: <CAJrcDBfyc=ehjzKtuj+3QoGuG8OA6LrUXoVYwgrAbLhqiQ-yzA@mail.gmail.com>
References: <CAPcMcKbufPfUrA+5ec_KswHPhBBVocGGZNRVdkft7egHvSGLMw@mail.gmail.com>
	<CAJrcDBfYjP0cXZMLeQ0rV6fM=NW-3Lh=waoBqh0V3wXhEUH-RA@mail.gmail.com>
	<CAPcMcKbhtjVNi7-AG8RagQzX45mm14EdijBqEggWDCB7+zRVag@mail.gmail.com>
	<CAJrcDBedMF3xzPKzump9iJMNMV4FgwTFDOR98qBdCqxz4k7J7w@mail.gmail.com>
	<CAPcMcKaZV=n-xzNw7VCBMPFU96BRTHT+w+3Ziz07yT_xpaJ5Mw@mail.gmail.com>
	<CAJrcDBfyc=ehjzKtuj+3QoGuG8OA6LrUXoVYwgrAbLhqiQ-yzA@mail.gmail.com>
Message-ID: <CAPcMcKbvUtJJGcqBQ97BVqBfb+X_ykdg4Kf5VXZATDXVXtDCbw@mail.gmail.com>

Hi Pedro,

Sorry for the delay, we've been implementing some POCs in order to
experiment with the tools you mentioned (add & remove claims from
policies). Answering your questions:

<<Could you share how the "Is-Product-Manager" looks like?>>

Our role polices are based in client-roles (denormalized by tenant using
'@'). E.g.:

 * Product-Manager at Organization-1
 * Product-Manager at Organization-2
 * Is-Seller at Organization-1
 * Is-Seller at Organization-2

We implement our custom policies in Scala using SPIs but we made an example
of the "Is-Product-Manager" policy in Javascript to show you it's basic
behavior:

    var roleName = 'admin';
    var clientId = 'test-client';
    var tenants =  $evaluation.getPermission().getClaims().get("tenants");

    var hasTenantRole = true;
    for (var i in tenants) {
        hasTenantRole &=
            $evaluation
                .getContext()
                .getIdentity()
                .hasClientRole(clientId, roleName + '@' + tenants[i]);
    }

    if(hasTenantRole) {
        $evaluation.grant();
    } else {
        $evaluation.deny();
    }

The policy checks the claim "tenants" and evaluates if the requesting
identity has all the corresponding client roles (role @ tenant). This
policy works well with non-scoped resources but, as we exposed in previous
mails, it won't work with scoped resources (since the claims are more
complex). To support scoped-resources (with the scope-aware claim
structure) we could use policies which only check tenants for an specific
scope. E.g.:

    var roleName = 'admin';
    var clientId = 'test-client';
    var scope =    'sell';
    var scopesByTenant =  $evaluation.getPermission().getClaims();

    var hasTenantRole = true;
    for (var tenant in scopesByTenant) {
        if(scopesByTenant[tenant].contains(scope)) {
            hasTenantRole &=
                $evaluation
                    .getContext()
                    .getIdentity()
                    .hasClientRole(clientId, roleName + '@' + tenant);
        }
    }

    if(hasTenantRole) {
        $evaluation.grant();
    } else {
        $evaluation.deny();
    }



<<Based on your description, the permission looks correct given that only
"read" was granted but not "update" for org-2. So if you try to update a
resource in org-2 you should be blocked. I guess your point is that
"update" is still as a claim for org-2 ?>>


Yes, our problem is that Keycloak does not know our claim structure so it
can't remove denied scopes. We tried to manipulate the claims inside the
policies (using add and remove claim mechanisms) but we didn't find an
algorithm that suits our needs. We can't remove our scope claims inside a
Policy since the overall scope granting decision is made by the
Scope-Permission. That means that, inside a Policy, you don't have enough
information to remove our scope claims since they may be granted by further
policies (assuming the scope-permissions involve multiple policies with an
affirmative decision strategy).

Our best approach to clean denied scopes from our custom claim structure is
to override the default Scope-Permission behavior. We've noticed that
Scope-Permissions are, in fact, implemented as Policies so we can deploy an
SPI overriding the ScopePolicyProvider (We tried to create a new type of
permission instead of overriding it but Keycloak seems to assume that only
resource and scope policy-permissions exist). We added a piece of code to
remove denied scopes and the OverridedScopePolicyProvider looks as follows:

    public class OverridedScopePolicyProviderJava extends
ScopePolicyProvider {
        @Override
        public void evaluate(Evaluation evaluation) {
            super.evaluate(evaluation);

            DefaultEvaluation defaultEvaluation =
DefaultEvaluation.class.cast(evaluation);
            if(defaultEvaluation.getEffect() == Decision.Effect.DENY) {
                evaluation
                    .getPermission()
                    .getClaims()
                    .entrySet()
                    .stream()
                    .collect(
                        Collectors.toMap(
                            Map.Entry::getKey,
                            e ->
                                e.getValue()
                                .removeAll(
                                    defaultEvaluation
                                        .getParentPolicy()
                                        .getScopes()
                                        .stream()
                                        .map(s -> s.getName()
                                ).collect(Collectors.toSet())
                            )
                        )
                    );
            }
        }
    }

We know this is a bit tricky since, even though scope and resource
permissions are implemented as policies, we know they are special ones. Are
we going too far with SPIs? Is there a better way to solve this scenario?
Maybe Keycloak should allow scope-defined claims in permissions? If any
changes were needed in Keycloak to support this we could help with the PR.

Regards,
?lvaro.

El jue., 25 jul. 2019 a las 23:19, Pedro Igor Silva (<psilva at redhat.com>)
escribi?:

> On Thu, Jul 25, 2019 at 10:13 AM ?lvaro G?mez <
> alvaro.gomez.gimenez at tecsisa.com> wrote:
>
>>
>> 1.- The policy "Is-Product-Manager", involved in the permission
>> "product:update", should only check if the Requesting Party is
>> "Product-Manager" in the context of the tenants which contains "update" in
>> the values of the claims. In the example, the policy "Is-Product-Manager",
>> when evaluated for the permission "product:update", should only check if
>> the Requesting Party is "Product-Manager" in the context of
>> "Organization-2" since it makes no sense to check if it's "Product-Manager"
>> in "Organization-1" (The "update" scope was only requested for
>> "Organization-2"). This could be solved by creating a policy
>> "Is-Product-Manager:update" (which only checks tenants associated to the
>> scope "update" in the pushing claims) but we found this solution a bit
>> tricky.
>>
>
> Could you share how the "Is-Product-Manager" looks like?
>
>
>> 2.- If a Requesting Party requested access to the scope "update" along
>> with other scope "read" in the context of "Organization-2" without being
>> "Product-Manger" in such organization (which implies it can "read" but not
>> "update" a product in that organization), we would end up with the
>> following permission (The first time you request an RPT, Keycloak returns
>> the granted scopes even though they are not the whole requested scopes):
>>
>> {
>>   "resource": "product",
>>   "resource_scopes": ["read"],
>>   "claims": {
>>     "Organization-2": ["update", "read"]
>>   }
>> }
>>
>
>> As we can see, the granted scope is only "read" but the pushed claims in
>> "Organization-2" are both "update" and "read" (We requested both scopes in
>> the ticket). The claim becomes inconsistent since the scope "update" should
>> be removed and keycloak is not able to do so since it does not understand
>> our custom claims. If claims were natively grouped by scopes, Keycloak
>> would clean claims from not-granted scopes. Wdyt?
>>
>
> Based on your description, the permission looks correct given that only
> "read" was granted but not "update" for org-2. So if you try to update a
> resource in org-2 you should be blocked. I guess your point is that
> "update" is still as a claim for org-2 ?
>
> FYI, from JS policies you should be able to remove/add claims from
> permissions so that you have more control over what is sent back to your
> application. As well as, push back claims so that you can advertise actions
> or anything else that the resource server should do before granting access
> to a resource. Maybe this can be an alternative.
>
>>
>> Thanks!
>> ?lvaro.
>>
>> El jue., 25 jul. 2019 a las 14:16, Pedro Igor Silva (<psilva at redhat.com>)
>> escribi?:
>>
>>> Considering you are in control on how the ticket is created and how
>>> claims are set on it, would be an option to use a specific claim for each
>>> tenant so that in your policies you check tenants based on the claim's key ?
>>>
>>> On Thu, Jul 25, 2019 at 9:12 AM ?lvaro G?mez <
>>> alvaro.gomez.gimenez at tecsisa.com> wrote:
>>>
>>>> Hi Pedro,
>>>>
>>>> We are performing HTTP ticket requests from our application (An API
>>>> acting as a Resource Server). As an example, having the following endpoint:
>>>>
>>>> GET /api/tenants/__TENANT_ID__/products/__PRODUCT_ID__
>>>>
>>>> If we use non-scoped resources (In order to simplify the example) the
>>>> API behaves as follows:
>>>>
>>>>   ** The Requesting Party performs this action:
>>>>
>>>>      GET /api/tenants/Organization-1/products/Product-X
>>>>
>>>>   1.- If there is no "permissions" claim (Or it does not contain the
>>>> required authorization info, described in step 2) the API performs a ticket
>>>> request for the resource "Product-X" pushing the tenant "Organization-1" in
>>>> a claim:
>>>>
>>>>     POST
>>>> https://localhost:8080/auth/realms/***/authz/protection/permission
>>>>        [{
>>>>             "resource_id": "Product-X",
>>>>             "claims": { "tenant": [ "Organization-1" ] }
>>>>        }]
>>>>
>>>>   The Requesting Party uses the ticket to obtain a valid RPT containing
>>>> the following authorization info:
>>>>
>>>>       "permissions": [
>>>>         {
>>>>             "resource_id": "Product-X",
>>>>             "claims": { "tenant" : ["Organization-1"] }
>>>>         }
>>>>       ]
>>>>
>>>>   ** The Requesting Party performs the following action using the
>>>> previously obtained RPT:
>>>>
>>>>      GET /api/tenants/Organization-2/product/Product-X
>>>>
>>>>   2.- The API checks if the specified resource "Product-X" exists in
>>>> the RPT "permissions" claim and contains "Organization-2" in the "tenant"
>>>> pushed claim. Since the resource "Product-X" is only provided for the
>>>> context "Organization-1" the API requests a ticket for the resource
>>>> "Product-X" in the context of the tenant "Organization-2".
>>>>
>>>>    POST
>>>> https://localhost:8080/auth/realms/***/authz/protection/permission
>>>>         [{
>>>>             "resource_id": "Product-X",
>>>>             "claims": { "tenant": [ "Organization-2" ] }
>>>>         }]
>>>>
>>>>     The Requesting Party uses the ticket to upgrade the previous RPT.
>>>> The upgraded RPT now contains both tenants in the pushed claims:
>>>>
>>>>         "permissions": [
>>>>             {
>>>>                 "resource_id": "Product-X",
>>>>                 "claims": { "tenant" : ["Organization-1",
>>>> "Organization-2"] }
>>>>             }
>>>>         ]
>>>>
>>>> This works great with non-scoped resources since, for now on, the
>>>> Resource server can grant access to "Product-X" in both contexts
>>>> "Organization-1" and "Organization-2". Also, the Resource Server will
>>>> obtain new tickets if new contexts (tenants) are requested. However, when
>>>> we use scoped-resources, since the pushing claims are not specific to the
>>>> scopes being requested, the Resource Server could not determine if the
>>>> combination of "Product-X" and some scope is defined for an specific
>>>> tenant. We could support this use-case removing scopes from the equation
>>>> and creating non-scoped resources like "Product-X:read", "Product-X:write",
>>>> etc. However, while we think that this should be implemented using scopes
>>>> instead of non-scoped resources, we don't know how to manage claims as we
>>>> discussed in the first mail.
>>>>
>>>> Regards,
>>>> ?lvaro.
>>>>
>>>> El mi?., 24 jul. 2019 a las 22:34, Pedro Igor Silva (<psilva at redhat.com>)
>>>> escribi?:
>>>>
>>>>> Hi ?lvaro,
>>>>>
>>>>> You are not missing anything and that is how claims are handled. They
>>>>> are a permission-level (resource + scopes) info and not specific to only
>>>>> the scopes being requested/granted.
>>>>>
>>>>> Before finding alternatives, could you tell me how are you pushing
>>>>> these claims? Are you using our adapters or manually performing HTTP
>>>>> requests from your app?
>>>>>
>>>>> Regards.
>>>>>
>>>>> On Wed, Jul 24, 2019 at 10:20 AM ?lvaro G?mez <
>>>>> alvaro.gomez.gimenez at tecsisa.com> wrote:
>>>>>
>>>>>> Hi,
>>>>>>
>>>>>> We are applying RBAC and CBAC models to evaluate permissions in a
>>>>>> multi-tenant UMA application. We are using Pushing Claims to let
>>>>>> custom
>>>>>> policies determine if an user has an specific role in a provided
>>>>>> context
>>>>>> (tenant) via Pushing Claims.
>>>>>>
>>>>>> Everything works fine if we use non-scoped resources but things get a
>>>>>> bit
>>>>>> confusing when we use scoped ones since the pushing-claims
>>>>>> (representing
>>>>>> the tenants) end up mixed in the RPT permission claim without leaving
>>>>>> any
>>>>>> trace of the scopes with which they were pushed along. Consider the
>>>>>> following example:
>>>>>>
>>>>>> We have an application which manages products (represented by
>>>>>> resources).
>>>>>> There are profiles (represented by roles) which allow users to sell,
>>>>>> modify
>>>>>> or delete products (represented by scopes). A certain user may
>>>>>> interact
>>>>>> with one product in the context of a tenant (Determined by the Pushing
>>>>>> claim) with an specific role and with some different role from other
>>>>>> tenant.
>>>>>>
>>>>>> - Resource:
>>>>>>   * product (With scopes sell and update)
>>>>>>
>>>>>> - Roles:
>>>>>>   * Seller
>>>>>>   * Product-Manager
>>>>>>
>>>>>> - Policies:
>>>>>>   * Is-Seller (In the Tenant specified in the Pushing Claim "tenant")
>>>>>>   * Is-Product-Manager (In the Tenant specified in the Pushing Claim
>>>>>> "tenant")
>>>>>>
>>>>>> - Permissions:
>>>>>>   * product:sell -> Provides the "sell" scope of the resource
>>>>>> "product" if
>>>>>> the "Is-Seller" policy evaluates to grant.
>>>>>>   * product:update -> Provides the "update" scope of the resource
>>>>>> "product" if the "Is-Product-Manager" policy evaluates to grant.
>>>>>>
>>>>>> - Users:
>>>>>>   * Alice -> Alice is "Seller" in the tenant "Organization-1" and is
>>>>>> "Product-Manager" in the tenant "Organization 2" so she should be
>>>>>> able to
>>>>>> sell products in the context of the tenant "Organization-1" and update
>>>>>> products in the context of "Organization-2" but neither "update"
>>>>>> products
>>>>>> in the context of "Organization-1" or sell products in the context of
>>>>>> "Organization-2".
>>>>>>
>>>>>> 1.- Alice requests an RPT using the following ticket:
>>>>>>      { "resource": "product", "resource_scopes": ["sell"], "claims": {
>>>>>> "tenant": ["Organization-1"] } }
>>>>>>
>>>>>>     Since Alice is "Seller" in the "Organization-1" (meaning the
>>>>>> Policy
>>>>>> "Is-Seller" will evaluate to "grant" if the provided claim value is
>>>>>> "Organization-1" and the evaluated Identity is Alice) an RPT is
>>>>>> emitted
>>>>>> with the following "permission" claim:
>>>>>>
>>>>>>     [{
>>>>>>        "resource": "product",
>>>>>>        "resource_scopes": ["sell"],
>>>>>>        "claims": { "tenant": ["Organization-1"] }
>>>>>>     }]
>>>>>>
>>>>>> 2.- Alice upgrades the previous RPT with the following ticket:
>>>>>>      { "resource": "product", "resource_scopes": ["update"],
>>>>>> "claims": {
>>>>>> "tenant": ["Organization-2"] } }
>>>>>>
>>>>>>    Here is were things get confusing to us. We'd expect Alice to be
>>>>>> granted
>>>>>> when requesting the scope "update" in the context of "Organization-2"
>>>>>> since
>>>>>> Alice has the role "Product-Manager" in that tenant. That would be
>>>>>> what
>>>>>> happened if Alice was requesting the RPT for the first time instead of
>>>>>> upgrading a previous one. However, since we are upgrading the RPT
>>>>>> obtained
>>>>>> in Step 1, when the policy "Is-Product-Manager" is evaluated, the
>>>>>> claim
>>>>>> "tenant" is mixed with the one in Step 1 (Since they are not grouped
>>>>>> by
>>>>>> scope) resulting in the following permission:
>>>>>>
>>>>>>    {
>>>>>>       "resource": "product",
>>>>>>       "resource_scopes": ["sell", "update"],
>>>>>>       "claims": {
>>>>>>           "tenant": ["Organization-1", "Organization-2"]
>>>>>>        }
>>>>>>    }
>>>>>>
>>>>>>   The policy can't evaluate to grant since Alice is not
>>>>>> "Product-Manager"
>>>>>> in both tenants "Organization-1" and "Organization-2" (Obtained
>>>>>> through
>>>>>> $evaluation.getPermission().getClaims()). When evaluating this policy
>>>>>> we
>>>>>> would only be interested in the pushing-claim `{ "tenant":
>>>>>> ["Organization-2"] }` which was pushed along with the scope "update"
>>>>>> (which
>>>>>> is the one being evaluated by the permission "product:update"
>>>>>> associated
>>>>>> with this Policy).
>>>>>>
>>>>>>    Shouldn't the claims be grouped by the scopes which with they were
>>>>>> pushed along? (See example at the end of this text), Are we missing
>>>>>> something?
>>>>>>
>>>>>>    Example:
>>>>>>    {
>>>>>>       "resource": "product",
>>>>>>       "resource_scopes": [
>>>>>>           { "name": "sell", "claims": { "tenant": ["Organization-1"]
>>>>>> } },
>>>>>>           { "name": "update", "claims": { "tenant":
>>>>>> ["Organization-2"] } },
>>>>>>       ]
>>>>>>
>>>>>> Thanks in advance,
>>>>>> ?lvaro.
>>>>>> _______________________________________________
>>>>>> keycloak-user mailing list
>>>>>> keycloak-user at lists.jboss.org
>>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>>
>>>>>

From s.booth at epcc.ed.ac.uk  Tue Jul 30 07:43:37 2019
From: s.booth at epcc.ed.ac.uk (BOOTH Stephen)
Date: Tue, 30 Jul 2019 11:43:37 +0000
Subject: [keycloak-user] How do I integrate with a SAML federation
In-Reply-To: <FEC0381F-0F42-4AE9-BCED-248C4E1B055C@cern.ch>
References: <e404c1be-83a3-abc5-1a0b-539dcd7a2398@epcc.ed.ac.uk>
	<FEC0381F-0F42-4AE9-BCED-248C4E1B055C@cern.ch>
Message-ID: <75583903-40a2-e90d-461e-7ea6d746fad5@epcc.ed.ac.uk>

Thanks to everyone who replied its really useful to have a number of 
known solutions to this problem.

For my original use case I've ended up implementing a basic OIDC Idp in 
an existing application that is already using the SAML federation, and 
can bridge to keycloak that way. This lets me seamlessly carry over my 
existing users and registrations.

				Stephen

On 29/07/2019 09:32, Hannah Short wrote:
> Hi Stephen,
> 
> Was just browsing past threads. You?ve probably solved it by now but 
> hopefully this helps others!
> 
> We are using a SATOSA proxy to integrate with eduGAIN, which acts as an 
> Identity Provider to our Keycloak instance: 
> https://github.com/IdentityPython/SATOSA
> 
> In addition we use PyFF to handle the metadata: 
> https://github.com/IdentityPython/pyFF
> 
> The benefit of using these tools is because they are maintained by the 
> eduGAIN community and natively support many of the quirks found in 
> Identity Federations (both technically and in terms of trust and policy).
> 
> Cheers,
> Hannah
> 
>> On 17 Jun 2019, at 14:48, BOOTH Stephen <s.booth at epcc.ed.ac.uk 
>> <mailto:s.booth at epcc.ed.ac.uk>> wrote:
>>
>> I'm wanting configure keycloak to use authenticate against a SAML
>> federation (externally curated set of IdPs) rather than a single SAML
>> IdP. Specifically I want to support EduGAIN.
>>
>> Is this something that keycloak supports natively? The form for
>> configuring a SAML Identity provider appears to assume a single IdP.
>>
>> If not, does anyone have any suggestions for the best approach to
>> bridging a shibboleth SP into something keycloak can use as an Identity
>> provider.
>>
>> Stephen
>>
>> -- 
>> ======================================================================
>> |epcc| Dr Stephen P Booth ????????????Principal Architect ??????|epcc|
>> |epcc| s.booth at epcc.ed.ac.uk <mailto:s.booth at epcc.ed.ac.uk> 
>> ?????????Phone 0131 650 5746 ??????|epcc|
>> ======================================================================
>> --
>> The University of Edinburgh is a charitable body, registered in
>> Scotland, with registration number SC005336.
>>
>> _______________________________________________
>> keycloak-user mailing list
>> keycloak-user at lists.jboss.org <mailto:keycloak-user at lists.jboss.org>
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
> 

-- 
======================================================================
|epcc| Dr Stephen P Booth             Principal Architect       |epcc|
|epcc| s.booth at epcc.ed.ac.uk          Phone 0131 650 5746       |epcc|
======================================================================
--
The University of Edinburgh is a charitable body, registered in
Scotland, with registration number SC005336.


From chris.stephens at edlogics.com  Tue Jul 30 15:15:21 2019
From: chris.stephens at edlogics.com (Chris Stephens)
Date: Tue, 30 Jul 2019 19:15:21 +0000
Subject: [keycloak-user] Keycloak as SP with ping federate
In-Reply-To: <f3b439e27e42aa7a3e80493c8f7582c963b319d7.camel@gmail.com>
References: <60FC4E2B-000A-470C-B6AF-643F5EDC6A5B@edlogics.com>
	<f3b439e27e42aa7a3e80493c8f7582c963b319d7.camel@gmail.com>
Message-ID: <6E5E3768-D871-4140-B3E9-1D459BC7443E@edlogics.com>

Hello,

Thanks for responding so quickly. I was not able to see the error in the logs. However, after setting up a local instance of Keycloak I was able to track it down. You are correct I was not using SP-initiated SSO. After changing the configurations in Keycloak the relay state was being passed correctly. The client id was no longer null and I was able to authenticate.

Thanks again,

Chris

--
?On 7/30/19, 2:27 PM, "Dmitry Telegin (Carretti Consulting)" <carretti.pro at gmail.com> wrote:

    at java.util.regex.Matcher.getTextLength(Matcher.java:1283)
    	at java.util.regex.Matcher.reset(Matcher.java:309)
    	at java.util.regex.Matcher.<init>(Matcher.java:229)
    	at java.util.regex.Pattern.matcher(Pattern.java:1093)
    	at java.util.regex.Pattern.split(Pattern.java:1206)
    	at org.keycloak.broker.provider.util.IdentityBrokerState.encoded(IdentityBrokerState.java:41)
    	at org.keycloak.services.resources.IdentityBrokerService.parseEncodedSessionCode(IdentityBrokerService.java:987)
    	at org.keycloak.services.resources.IdentityBrokerService.authenticated(IdentityBrokerService.java:497)
    	at org.keycloak.broker.saml.SAMLEndpoint$Binding.handleLoginResponse(SAMLEndpoint.java:465)



From chamila.sujeewa at gmail.com  Tue Jul 30 21:36:49 2019
From: chamila.sujeewa at gmail.com (chamila)
Date: Wed, 31 Jul 2019 13:36:49 +1200
Subject: [keycloak-user] Having multiple admin realms
Message-ID: <CAB2A5_=BeFsdPQmnoZrJQ8-DY8e5AyYUC4Etmx7XaGT-+fU71w@mail.gmail.com>

Hello,

I came across a requirement where we needed to allow a certain set of users
to perform a limited set of admin tasks like realm creation, user creation
etc. IIUC this is directly achievable by allocating those users to
`create-realm` role in the `master` realm. However the requirement demands
that the users should not be in the `master` realm itself. So the user
model is something like the following.

0. super users - Ops, and other super admins that take care of the most
privileged tasks like IdP federation, auth flows, etc - limited set of
users in the `master` realm
1. organization root users - users who act as admins for their realm  and
are able to create other realms and add users to them, basically
organization admins (ex: `org1` realm)
2. realm specific users - users confined to their own realms (ex: `deptx`
realm)

In this model, `organization root users` should be able to create realms
but should not be part of the `master` realm itself. From the code I can
see that this requirement is not something possible as
org.keycloak.services.resources.admin.permissions.MgmtPermissions#canCreateRealm()
checks the following.

1. Is current realm the administrative realm
2. Does current user has `create-realm` role

However, is there a way to mark *multiple* realms other than `master` as
administrative realms so that those realms could have a realm role named
`create-realm` to be assigned to the above mentioned `organization root
users`?

Regards,
Chamila
Blog: medium.com/@chamilad

From chamila.sujeewa at gmail.com  Tue Jul 30 21:48:18 2019
From: chamila.sujeewa at gmail.com (chamila)
Date: Wed, 31 Jul 2019 13:48:18 +1200
Subject: [keycloak-user] How do I integrate with a SAML federation
In-Reply-To: <FEC0381F-0F42-4AE9-BCED-248C4E1B055C@cern.ch>
References: <e404c1be-83a3-abc5-1a0b-539dcd7a2398@epcc.ed.ac.uk>
	<FEC0381F-0F42-4AE9-BCED-248C4E1B055C@cern.ch>
Message-ID: <CAB2A5_=QbMivQKajuKVB-zTTytQ2z=enB0=8zGs=wgTzWtep8Q@mail.gmail.com>

Hi,

IIUC I had a similar requirement, described in thread [1], where a SAML
only SP did not support multiple IdPs (in this case, these were different
KeyCloak realms themselves). We arrived at the IdP federation approach
after discussing internally and implemented that successfully, in the
browser flow.

Basically, each realm was added as a separate federated OIDC IdP in a
"broker" realm. A SAML client was created in the broker realm and the SP
was pointed to that. During authentication, the user is shown all the
realms as federated IdP options in the login form, and when selected the
user will be able to authenticate against the required realm. With a set of
mappers associated with each IdP configuration, a well-formed SAML
assertion could be returned to the SP to do role mapping successfully. I
haven't used SATOSA but from a brief glance, looks like SAML<->SAML flow is
the same as what KC provides OOTB.

Hope this helps too :)

[1] - https://lists.jboss.org/pipermail/keycloak-user/2019-July/018721.html

Regards,
Chamila
Blog: medium.com/@chamilad



On Mon, Jul 29, 2019 at 8:34 PM Hannah Short <hannah.short at cern.ch> wrote:

> Hi Stephen,
>
> Was just browsing past threads. You?ve probably solved it by now but
> hopefully this helps others!
>
> We are using a SATOSA proxy to integrate with eduGAIN, which acts as an
> Identity Provider to our Keycloak instance:
> https://github.com/IdentityPython/SATOSA
>
> In addition we use PyFF to handle the metadata:
> https://github.com/IdentityPython/pyFF
>
> The benefit of using these tools is because they are maintained by the
> eduGAIN community and natively support many of the quirks found in Identity
> Federations (both technically and in terms of trust and policy).
>
> Cheers,
> Hannah
>
> On 17 Jun 2019, at 14:48, BOOTH Stephen <s.booth at epcc.ed.ac.uk<mailto:
> s.booth at epcc.ed.ac.uk>> wrote:
>
> I'm wanting configure keycloak to use authenticate against a SAML
> federation (externally curated set of IdPs) rather than a single SAML
> IdP. Specifically I want to support EduGAIN.
>
> Is this something that keycloak supports natively? The form for
> configuring a SAML Identity provider appears to assume a single IdP.
>
> If not, does anyone have any suggestions for the best approach to
> bridging a shibboleth SP into something keycloak can use as an Identity
> provider.
>
> Stephen
>
> --
> ======================================================================
> |epcc| Dr Stephen P Booth             Principal Architect       |epcc|
> |epcc| s.booth at epcc.ed.ac.uk<mailto:s.booth at epcc.ed.ac.uk>          Phone
> 0131 650 5746       |epcc|
> ======================================================================
> --
> The University of Edinburgh is a charitable body, registered in
> Scotland, with registration number SC005336.
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From christian.froehlich at agfa.com  Wed Jul 31 04:22:35 2019
From: christian.froehlich at agfa.com (Christian Froehlich)
Date: Wed, 31 Jul 2019 08:22:35 +0000
Subject: [keycloak-user] CDI Support in keycloak
Message-ID: <AM4P190MB01484D80711656B52D9EB45693DF0@AM4P190MB0148.EURP190.PROD.OUTLOOK.COM>

Hi,

CDI (Weld subsystem) is deactivated inside the keycloak server if I understood it right in the documentation. Is there a specific reason why you explicitly deactivate CDI?

Regards
Christian


From joerg.lammerich at csoc.de  Wed Jul 31 06:05:09 2019
From: joerg.lammerich at csoc.de (Joerg Lammerich)
Date: Wed, 31 Jul 2019 10:05:09 +0000
Subject: [keycloak-user] Keycloak Kibana integration
Message-ID: <AM0PR07MB4082AF3C0C60FFB9B7D1C043EADF0@AM0PR07MB4082.eurprd07.prod.outlook.com>

Hello,

we are new in Keycloak and we want to integrate it in our Elasticsearch/Kibana.
We read a lot of documentation, but we are not able to get it run!

After the "login-Page" in Keycloak, we are redirect to the Kibana and we get a error like die sreenshot in the attachment.

What can we do???

Regards,
Joerg
-------------- next part --------------
A non-text attachment was scrubbed...
Name: keycloak1.png
Type: image/png
Size: 27255 bytes
Desc: keycloak1.png
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20190731/d4598a9a/attachment-0001.png 

From chamila.sujeewa at gmail.com  Wed Jul 31 06:26:23 2019
From: chamila.sujeewa at gmail.com (chamila)
Date: Wed, 31 Jul 2019 22:26:23 +1200
Subject: [keycloak-user] Keycloak Kibana integration
In-Reply-To: <AM0PR07MB4082AF3C0C60FFB9B7D1C043EADF0@AM0PR07MB4082.eurprd07.prod.outlook.com>
References: <AM0PR07MB4082AF3C0C60FFB9B7D1C043EADF0@AM0PR07MB4082.eurprd07.prod.outlook.com>
Message-ID: <CAB2A5_=M8JCJ0ysnmf7vRJVdqCjei4taaO1nvFtonx3-526xEg@mail.gmail.com>

Hi Joerg,

Did you also add a role mapping to map the user to "kibana-user" role?

https://www.elastic.co/guide/en/elastic-stack-overview/current/oidc-role-mapping.html


Regards,
Chamila




On Wed, Jul 31, 2019 at 10:06 PM Joerg Lammerich <joerg.lammerich at csoc.de>
wrote:

> Hello,
>
> we are new in Keycloak and we want to integrate it in our
> Elasticsearch/Kibana.
> We read a lot of documentation, but we are not able to get it run!
>
> After the "login-Page" in Keycloak, we are redirect to the Kibana and we
> get a error like die sreenshot in the attachment.
>
> What can we do???
>
> Regards,
> Joerg
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

From ales.fuchs at eventival.com  Wed Jul 31 10:08:16 2019
From: ales.fuchs at eventival.com (Ales Fuchs)
Date: Wed, 31 Jul 2019 16:08:16 +0200
Subject: [keycloak-user] Prevent users from changing email address when
	email is used as username
Message-ID: <CAP-efg-87qWsaMojsa=z+HaV+K1C5KA6ZLN_G75k9eAQRdkmTw@mail.gmail.com>

Hello,

We are using Keycloak version 4.8.3 and in our setting we have the option
"Email as username" switched on and "Edit username" switched off.

At the same time we need to let users to log in and change their name in
the account console. Once the name and surname is editable, email can be
changed too, which changes also the username.

The input with email can be hidden, but whoever knows how Keycloak works
can simply add this input and update the username.

Does anyone have any idea how updating of username can be prevented?

Best regards,
Ales Fuchs

From l.lech at ringler.ch  Wed Jul 31 10:30:59 2019
From: l.lech at ringler.ch (Lukasz Lech)
Date: Wed, 31 Jul 2019 14:30:59 +0000
Subject: [keycloak-user] Prevent users from changing email address
	when	email is used as username
In-Reply-To: <CAP-efg-87qWsaMojsa=z+HaV+K1C5KA6ZLN_G75k9eAQRdkmTw@mail.gmail.com>
References: <CAP-efg-87qWsaMojsa=z+HaV+K1C5KA6ZLN_G75k9eAQRdkmTw@mail.gmail.com>
Message-ID: <5E48B917000C984B86B77170F441903A215A53E1@exch.ringler.ch>

What do you mean by 'the input with email can be hidden'? Do you mean disabling editing username in Realm Settings -> Login ?

We've also discovered recently that the email change flow is broken If email is used as username, and the recommended solution was to disable editing username.  Have you tested, that this setting has only visual implication and you can still edit email via manipulating the form? 

However, I  suppose if the user locks himself out by manually the html, you can say, self-guilty.

Best regards,
Lukasz Lech


-----Original Message-----
From: keycloak-user-bounces at lists.jboss.org [mailto:keycloak-user-bounces at lists.jboss.org] On Behalf Of Ales Fuchs
Sent: Mittwoch, 31. Juli 2019 16:08
To: keycloak-user at lists.jboss.org
Subject: [keycloak-user] Prevent users from changing email address when email is used as username

Hello,

We are using Keycloak version 4.8.3 and in our setting we have the option "Email as username" switched on and "Edit username" switched off.

At the same time we need to let users to log in and change their name in the account console. Once the name and surname is editable, email can be changed too, which changes also the username.

The input with email can be hidden, but whoever knows how Keycloak works can simply add this input and update the username.

Does anyone have any idea how updating of username can be prevented?

Best regards,
Ales Fuchs
_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user


From ssilvert at redhat.com  Wed Jul 31 13:11:33 2019
From: ssilvert at redhat.com (Stan Silvert)
Date: Wed, 31 Jul 2019 13:11:33 -0400
Subject: [keycloak-user] Prevent users from changing email address when
 email is used as username
In-Reply-To: <CAP-efg-87qWsaMojsa=z+HaV+K1C5KA6ZLN_G75k9eAQRdkmTw@mail.gmail.com>
References: <CAP-efg-87qWsaMojsa=z+HaV+K1C5KA6ZLN_G75k9eAQRdkmTw@mail.gmail.com>
Message-ID: <fb457e66-90b5-199c-adc4-9123f530aeff@redhat.com>

Are you sure that is what you want?

Email addresses do change.? Is there some reason it should never be updated?

On 7/31/2019 10:08 AM, Ales Fuchs wrote:
> Hello,
>
> We are using Keycloak version 4.8.3 and in our setting we have the option
> "Email as username" switched on and "Edit username" switched off.
>
> At the same time we need to let users to log in and change their name in
> the account console. Once the name and surname is editable, email can be
> changed too, which changes also the username.
>
> The input with email can be hidden, but whoever knows how Keycloak works
> can simply add this input and update the username.
>
> Does anyone have any idea how updating of username can be prevented?
>
> Best regards,
> Ales Fuchs
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user



From ronaldo.yamada at serpro.gov.br  Wed Jul 31 16:32:31 2019
From: ronaldo.yamada at serpro.gov.br (Ronaldo Hideki Yamada)
Date: Wed, 31 Jul 2019 17:32:31 -0300 (BRT)
Subject: [keycloak-user] IdentityProvider access to AuthenticationSession
Message-ID: <31561293.23331823.1564605151294.JavaMail.zimbra@serpro.gov.br>

Hi people, 


I was implementing a PKCE handshake with an OAUTH provider, everything works, but by now my codeVerifier is static! 

On method createAuthorizationUrl I can get a instance from request.getAuthenticationSession(), but on inner class I cant. 

I need access to a instance of AuthenticationSession on Endpoint inner class. to retrieve an random string. 


Some ideas? 


==== Some parts of my code ====================== 
... 
public class NeoIDProvider extends AbstractOAuth2IdentityProvider<OIDCIdentityProviderConfig> 
implements SocialIdentityProvider<OIDCIdentityProviderConfig> { 

public final static String codeVerifier = NeoIDUtil.S256("neoid"); 

public NeoIDProvider(KeycloakSession session, OIDCIdentityProviderConfig config) { 
super(session, config); 
} 

@Override 
protected UriBuilder createAuthorizationUrl(AuthenticationRequest request) { 
return super.createAuthorizationUrl(request).queryParam("code_challenge", NeoIDUtil.S256(codeVerifier)) 
.queryParam("code_challenge_method", "S256"); 
} 

@Override 
public Object callback(RealmModel realm, AuthenticationCallback callback, EventBuilder event) { 
return new Endpoint(callback, realm, event) { 
@Override 
public SimpleHttp generateTokenRequest(String authorizationCode) { 
return super.generateTokenRequest(authorizationCode) 
.param("code_verifier", codeVerifier); 
} 
}; 
} 
... 
====================================================== 

Ronaldo Hideki Yamada 
Analista 
Superintend?ncia de Prod e Servi?os-Eng de Infra de Tecnologia da Informa??o 
Diretoria de Opera??es 
(11)2173-1797 

-


"Esta mensagem do SERVI?O FEDERAL DE PROCESSAMENTO DE DADOS (SERPRO), empresa p?blica federal regida pelo disposto na Lei Federal n? 5.615, ? enviada exclusivamente a seu destinat?rio e pode conter informa??es confidenciais, protegidas por sigilo profissional. Sua utiliza??o desautorizada ? ilegal e sujeita o infrator ?s penas da lei. Se voc? a recebeu indevidamente, queira, por gentileza, reenvi?-la ao emitente, esclarecendo o equ?voco."

"This message from SERVI?O FEDERAL DE PROCESSAMENTO DE DADOS (SERPRO) -- a government company established under Brazilian law (5.615/70) -- is directed exclusively to its addressee and may contain confidential data, protected under professional secrecy rules. Its unauthorized use is illegal and may subject the transgressor to the law's penalties. If you're not the addressee, please send it back, elucidating the failure."

From chris.smith at cmfirstgroup.com  Wed Jul 31 19:09:29 2019
From: chris.smith at cmfirstgroup.com (Chris Smith)
Date: Wed, 31 Jul 2019 23:09:29 +0000
Subject: [keycloak-user] Keycloak self registration and Active Directory
	issues
In-Reply-To: <CY4PR22MB02480FEF5C991F9C1974CD4398F30@CY4PR22MB0248.namprd22.prod.outlook.com>
References: <CY4PR22MB02480FEF5C991F9C1974CD4398F30@CY4PR22MB0248.namprd22.prod.outlook.com>
Message-ID: <CY4PR22MB0248A5F82B97428EA15931D798DF0@CY4PR22MB0248.namprd22.prod.outlook.com>

After much googling, I stumbled a post where it was suggested the what I needed was not to set Active Directory policies, but rather to use a LDAPS URL in my AD federation instead of just a LDAP URL

A default fresh AD Domain controller was setup, then everything just seemed to work

-----Original Message-----
From: Chris Smith 
Sent: Thursday, July 11, 2019 12:56 PM
To: keycloak-user at lists.jboss.org
Subject: Keycloak self registration and Active Directory issues

My requirements are
  1. Active Directory federation (really only as a Kerberos Server...  I have a Windoze Only requirement imposed on me)
  2. Keycloak self-regestration for users
  3. Application and user maintenance done in as much Out Of Box Keycloak as possible
  4. Application Admins should never have access to AD management.

I've set as many AD password policies as I can easily find or google to be as permissive as possible
  Policy
  Enforce password history, 0 
  passwords remembered, 0
  Maximum password age, 0
  Minimum password age, 0 days
  Minimum password length, 1 characters
  Password must meet complexity requirements, Disabled
  Store passwords using reversible encryption, Not Defined

I've set KC password policies 
  Minimum Length          8
  Uppercase Characters  1
  Lowercase Characters  1
  Expire Password         30
  Special Characters       1
  Not Username	
  Not Recently Used    25
  Digits                             1

KC Authentication 
  Required Action  
    Update Password disabled

So when a new user users self-registration, in AD, the user account is set to require password Change
  Any advice on how to Change that

In Active Directory I remove the "Require password Change" on the user account 
  The KC user login fails with "invalid User or Password" error

If I try to Change the new Users Password in the KC Console, 
  Error! Could not modify attribute for DN [CN=xxx.yyyy,CN=Users,DC=xxx-sso,DC=com]
  Any Advice on what is going on?