Compare commits
1
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Stian Thorgersen
|
12184fa6dd |
No files matched your search
+1
-1
@@ -3,7 +3,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-audit-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0-beta-2</version>
|
||||
<version>1.0-beta-1-20150523</version>
|
||||
</parent>
|
||||
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
|
||||
+1
-1
@@ -3,7 +3,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-audit-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0-beta-2</version>
|
||||
<version>1.0-beta-1-20150523</version>
|
||||
</parent>
|
||||
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-audit-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0-beta-2</version>
|
||||
<version>1.0-beta-1-20150523</version>
|
||||
</parent>
|
||||
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
|
||||
+1
-1
@@ -3,7 +3,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-audit-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0-beta-2</version>
|
||||
<version>1.0-beta-1-20150523</version>
|
||||
</parent>
|
||||
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
|
||||
+1
-4
@@ -3,7 +3,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-audit-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0-beta-2</version>
|
||||
<version>1.0-beta-1-20150523</version>
|
||||
</parent>
|
||||
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
@@ -59,7 +59,6 @@
|
||||
<keycloak.audit.mongo.port>27018</keycloak.audit.mongo.port>
|
||||
<keycloak.audit.mongo.db>keycloak</keycloak.audit.mongo.db>
|
||||
<keycloak.audit.mongo.clearOnStartup>true</keycloak.audit.mongo.clearOnStartup>
|
||||
<keycloak.audit.mongo.bindIp>127.0.0.1</keycloak.audit.mongo.bindIp>
|
||||
</properties>
|
||||
|
||||
<build>
|
||||
@@ -90,7 +89,6 @@
|
||||
<keycloak.audit.mongo.port>${keycloak.audit.mongo.port}</keycloak.audit.mongo.port>
|
||||
<keycloak.audit.mongo.db>${keycloak.audit.mongo.db}</keycloak.audit.mongo.db>
|
||||
<keycloak.audit.mongo.clearOnStartup>${keycloak.audit.mongo.clearOnStartup}</keycloak.audit.mongo.clearOnStartup>
|
||||
<keycloak.audit.mongo.bindIp>${keycloak.model.mongo.bindIp}</keycloak.audit.mongo.bindIp>
|
||||
</systemPropertyVariables>
|
||||
</configuration>
|
||||
</execution>
|
||||
@@ -118,7 +116,6 @@
|
||||
<port>${keycloak.audit.mongo.port}</port>
|
||||
<logging>file</logging>
|
||||
<logFile>${project.build.directory}/mongodb.log</logFile>
|
||||
<bindIp>${keycloak.audit.mongo.bindIp}</bindIp>
|
||||
</configuration>
|
||||
</execution>
|
||||
<execution>
|
||||
|
||||
+1
-1
@@ -3,7 +3,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0-beta-2</version>
|
||||
<version>1.0-beta-1-20150523</version>
|
||||
<relativePath>../pom.xml</relativePath>
|
||||
</parent>
|
||||
|
||||
|
||||
+1
-13
@@ -5,7 +5,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-audit-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0-beta-2</version>
|
||||
<version>1.0-beta-1-20150523</version>
|
||||
</parent>
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
|
||||
@@ -13,18 +13,6 @@
|
||||
<name>Keycloak Audit Tests</name>
|
||||
<description/>
|
||||
|
||||
<build>
|
||||
<plugins>
|
||||
<plugin>
|
||||
<groupId>org.apache.maven.plugins</groupId>
|
||||
<artifactId>maven-deploy-plugin</artifactId>
|
||||
<configuration>
|
||||
<skip>true</skip>
|
||||
</configuration>
|
||||
</plugin>
|
||||
</plugins>
|
||||
</build>
|
||||
|
||||
<dependencies>
|
||||
<dependency>
|
||||
<groupId>org.keycloak</groupId>
|
||||
|
||||
Executable → Regular
+2
-2
@@ -1,9 +1,9 @@
|
||||
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
||||
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
|
||||
<parent>
|
||||
<artifactId>keycloak-authentication-parent</artifactId>
|
||||
<artifactId>keycloak-authentication</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0-beta-2</version>
|
||||
<version>1.0-beta-1-20150523</version>
|
||||
<relativePath>../pom.xml</relativePath>
|
||||
</parent>
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
|
||||
Executable → Regular
+2
-2
@@ -1,9 +1,9 @@
|
||||
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
||||
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
|
||||
<parent>
|
||||
<artifactId>keycloak-authentication-parent</artifactId>
|
||||
<artifactId>keycloak-authentication</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0-beta-2</version>
|
||||
<version>1.0-beta-1-20150523</version>
|
||||
<relativePath>../pom.xml</relativePath>
|
||||
</parent>
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
|
||||
Executable → Regular
+2
-2
@@ -1,9 +1,9 @@
|
||||
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
||||
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
|
||||
<parent>
|
||||
<artifactId>keycloak-authentication-parent</artifactId>
|
||||
<artifactId>keycloak-authentication</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0-beta-2</version>
|
||||
<version>1.0-beta-1-20150523</version>
|
||||
<relativePath>../pom.xml</relativePath>
|
||||
</parent>
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
|
||||
Executable → Regular
+3
-3
@@ -5,13 +5,13 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0-beta-2</version>
|
||||
<version>1.0-beta-1-20150523</version>
|
||||
<relativePath>../pom.xml</relativePath>
|
||||
</parent>
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
<packaging>pom</packaging>
|
||||
|
||||
<artifactId>keycloak-authentication-parent</artifactId>
|
||||
<artifactId>keycloak-authentication</artifactId>
|
||||
<name>Keycloak Authentication</name>
|
||||
<description />
|
||||
|
||||
@@ -21,4 +21,4 @@
|
||||
<module>authentication-picketlink</module>
|
||||
</modules>
|
||||
|
||||
</project>
|
||||
</project>
|
||||
+1
-1
@@ -4,7 +4,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0-beta-2</version>
|
||||
<version>1.0-beta-1-20150523</version>
|
||||
<relativePath>../pom.xml</relativePath>
|
||||
</parent>
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
|
||||
+1
-1
@@ -4,7 +4,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0-beta-2</version>
|
||||
<version>1.0-beta-1-20150523</version>
|
||||
<relativePath>../pom.xml</relativePath>
|
||||
</parent>
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
|
||||
@@ -12,7 +12,7 @@ public class Config {
|
||||
}
|
||||
|
||||
public static String getAdminRealm() {
|
||||
return configProvider.scope("admin").get("realm", "master");
|
||||
return configProvider.scope("admin").get("realm", "keycloak-admin");
|
||||
}
|
||||
|
||||
public static String getProvider(String spi) {
|
||||
|
||||
@@ -9,15 +9,11 @@ import java.security.Principal;
|
||||
*/
|
||||
public class KeycloakPrincipal implements Principal, Serializable {
|
||||
protected final String name;
|
||||
protected final KeycloakSecurityContext context;
|
||||
protected final String surrogate;
|
||||
|
||||
public KeycloakPrincipal(String name, KeycloakSecurityContext context) {
|
||||
public KeycloakPrincipal(String name, String surrogate) {
|
||||
this.name = name;
|
||||
this.context = context;
|
||||
}
|
||||
|
||||
public KeycloakSecurityContext getKeycloakSecurityContext() {
|
||||
return context;
|
||||
this.surrogate = surrogate;
|
||||
}
|
||||
|
||||
@Override
|
||||
@@ -25,6 +21,10 @@ public class KeycloakPrincipal implements Principal, Serializable {
|
||||
return name;
|
||||
}
|
||||
|
||||
public String getSurrogate() {
|
||||
return surrogate;
|
||||
}
|
||||
|
||||
@Override
|
||||
public boolean equals(Object o) {
|
||||
if (this == o) return true;
|
||||
@@ -33,13 +33,16 @@ public class KeycloakPrincipal implements Principal, Serializable {
|
||||
KeycloakPrincipal that = (KeycloakPrincipal) o;
|
||||
|
||||
if (!name.equals(that.name)) return false;
|
||||
if (surrogate != null ? !surrogate.equals(that.surrogate) : that.surrogate != null) return false;
|
||||
|
||||
return true;
|
||||
}
|
||||
|
||||
@Override
|
||||
public int hashCode() {
|
||||
return name.hashCode();
|
||||
int result = name.hashCode();
|
||||
result = 31 * result + (surrogate != null ? surrogate.hashCode() : 0);
|
||||
return result;
|
||||
}
|
||||
|
||||
@Override
|
||||
|
||||
@@ -10,7 +10,6 @@ public interface ServiceUrlConstants {
|
||||
public static final String TOKEN_SERVICE_ACCESS_CODE_PATH = "/realms/{realm-name}/tokens/access/codes";
|
||||
public static final String TOKEN_SERVICE_REFRESH_PATH = "/realms/{realm-name}/tokens/refresh";
|
||||
public static final String TOKEN_SERVICE_LOGOUT_PATH = "/realms/{realm-name}/tokens/logout";
|
||||
public static final String TOKEN_SERVICE_DIRECT_GRANT_PATH = "/realms/{realm-name}/tokens/grants/access";
|
||||
public static final String ACCOUNT_SERVICE_PATH = "/realms/{realm-name}/account";
|
||||
public static final String REALM_INFO_PATH = "/realms/{realm-name}";
|
||||
|
||||
|
||||
@@ -27,9 +27,6 @@ public class AccessTokenResponse {
|
||||
@JsonProperty("not-before-policy")
|
||||
protected int notBeforePolicy;
|
||||
|
||||
@JsonProperty("session-state")
|
||||
protected String sessionState;
|
||||
|
||||
public String getToken() {
|
||||
return token;
|
||||
}
|
||||
@@ -77,12 +74,4 @@ public class AccessTokenResponse {
|
||||
public void setNotBeforePolicy(int notBeforePolicy) {
|
||||
this.notBeforePolicy = notBeforePolicy;
|
||||
}
|
||||
|
||||
public String getSessionState() {
|
||||
return sessionState;
|
||||
}
|
||||
|
||||
public void setSessionState(String sessionState) {
|
||||
this.sessionState = sessionState;
|
||||
}
|
||||
}
|
||||
@@ -17,7 +17,6 @@ public class OAuthClientRepresentation {
|
||||
protected ClaimRepresentation claims;
|
||||
protected Integer notBefore;
|
||||
protected Boolean publicClient;
|
||||
protected Boolean directGrantsOnly;
|
||||
|
||||
|
||||
public String getId() {
|
||||
@@ -99,12 +98,4 @@ public class OAuthClientRepresentation {
|
||||
public void setPublicClient(Boolean publicClient) {
|
||||
this.publicClient = publicClient;
|
||||
}
|
||||
|
||||
public Boolean isDirectGrantsOnly() {
|
||||
return directGrantsOnly;
|
||||
}
|
||||
|
||||
public void setDirectGrantsOnly(Boolean directGrantsOnly) {
|
||||
this.directGrantsOnly = directGrantsOnly;
|
||||
}
|
||||
}
|
||||
@@ -4,7 +4,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0-beta-2</version>
|
||||
<version>1.0-beta-1-20150523</version>
|
||||
<relativePath>../../pom.xml</relativePath>
|
||||
</parent>
|
||||
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0-beta-2</version>
|
||||
<version>1.0-beta-1-20150523</version>
|
||||
<relativePath>../../pom.xml</relativePath>
|
||||
</parent>
|
||||
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0-beta-2</version>
|
||||
<version>1.0-beta-1-20150523</version>
|
||||
<relativePath>../../pom.xml</relativePath>
|
||||
</parent>
|
||||
|
||||
|
||||
@@ -14,21 +14,10 @@
|
||||
</includes>
|
||||
<outputDirectory></outputDirectory>
|
||||
</fileSet>
|
||||
<fileSet>
|
||||
<directory>.</directory>
|
||||
<includes>
|
||||
<include>index.html</include>
|
||||
</includes>
|
||||
<outputDirectory>docs</outputDirectory>
|
||||
</fileSet>
|
||||
<fileSet>
|
||||
<directory>../../target/site/apidocs</directory>
|
||||
<outputDirectory>docs/javadocs</outputDirectory>
|
||||
</fileSet>
|
||||
<fileSet>
|
||||
<directory>../../services/target/site/apidocs</directory>
|
||||
<outputDirectory>docs/rest-api</outputDirectory>
|
||||
</fileSet>
|
||||
<fileSet>
|
||||
<directory>../../docbook/target/docbook/publish/en-US</directory>
|
||||
<outputDirectory>docs/userguide</outputDirectory>
|
||||
|
||||
@@ -20,33 +20,6 @@
|
||||
<exclude name="**/README.md.overview"/>
|
||||
</fileset>
|
||||
</copy>
|
||||
<copy todir="target/examples/providers" overwrite="true">
|
||||
<fileset dir="../../examples/providers">
|
||||
<exclude name="**/target/**"/>
|
||||
<exclude name="**/*.iml"/>
|
||||
<exclude name="**/*.unconfigured"/>
|
||||
<exclude name="**/subsystem-config.xml"/>
|
||||
<exclude name="**/README.md.overview"/>
|
||||
</fileset>
|
||||
</copy>
|
||||
<copy todir="target/examples/js-console" overwrite="true">
|
||||
<fileset dir="../../examples/js-console">
|
||||
<exclude name="**/target/**"/>
|
||||
<exclude name="**/*.iml"/>
|
||||
<exclude name="**/*.unconfigured"/>
|
||||
<exclude name="**/subsystem-config.xml"/>
|
||||
<exclude name="**/README.md.overview"/>
|
||||
</fileset>
|
||||
</copy>
|
||||
<copy todir="target/examples/themes" overwrite="true">
|
||||
<fileset dir="../../examples/themes">
|
||||
<exclude name="**/target/**"/>
|
||||
<exclude name="**/*.iml"/>
|
||||
<exclude name="**/*.unconfigured"/>
|
||||
<exclude name="**/subsystem-config.xml"/>
|
||||
<exclude name="**/README.md.overview"/>
|
||||
</fileset>
|
||||
</copy>
|
||||
<copy todir="target/examples/preconfigured-demo" overwrite="true">
|
||||
<fileset dir="../../examples/demo-template">
|
||||
<exclude name="**/target/**"/>
|
||||
|
||||
@@ -1,8 +0,0 @@
|
||||
<h1>Keyloak Documentation</h1>
|
||||
<ul>
|
||||
<li><a href="userguide/html/index.html">Userguide HTML</a></li>
|
||||
<li><a href="userguide/html_single/index.html">Userguide HTML Single Page</a></li>
|
||||
<li><a href="userguide/pdf/keycloak-reference-guide-en-US.pdf">Userguide PDF</a></li>
|
||||
<li><a href="rest-api/overview-index.html">Admin REST API</a></li>
|
||||
<li><a href="javadocs/index.html">Javadocs</a></li>
|
||||
</ul>
|
||||
@@ -4,7 +4,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0-beta-2</version>
|
||||
<version>1.0-beta-1-20150523</version>
|
||||
<relativePath>../../pom.xml</relativePath>
|
||||
</parent>
|
||||
|
||||
@@ -17,13 +17,6 @@
|
||||
</dependencies>
|
||||
<build>
|
||||
<plugins>
|
||||
<plugin>
|
||||
<groupId>org.apache.maven.plugins</groupId>
|
||||
<artifactId>maven-deploy-plugin</artifactId>
|
||||
<configuration>
|
||||
<skip>true</skip>
|
||||
</configuration>
|
||||
</plugin>
|
||||
<plugin>
|
||||
<groupId>org.apache.maven.plugins</groupId>
|
||||
<artifactId>maven-antrun-plugin</artifactId>
|
||||
|
||||
@@ -30,7 +30,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0-beta-2</version>
|
||||
<version>1.0-beta-1-20150523</version>
|
||||
<relativePath>../../pom.xml</relativePath>
|
||||
</parent>
|
||||
|
||||
@@ -88,13 +88,6 @@
|
||||
|
||||
<build>
|
||||
<plugins>
|
||||
<plugin>
|
||||
<groupId>org.apache.maven.plugins</groupId>
|
||||
<artifactId>maven-deploy-plugin</artifactId>
|
||||
<configuration>
|
||||
<skip>true</skip>
|
||||
</configuration>
|
||||
</plugin>
|
||||
<plugin>
|
||||
<groupId>org.apache.maven.plugins</groupId>
|
||||
<artifactId>maven-antrun-plugin</artifactId>
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0-beta-2</version>
|
||||
<version>1.0-beta-1-20150523</version>
|
||||
<relativePath>../pom.xml</relativePath>
|
||||
</parent>
|
||||
<name>Distribution</name>
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0-beta-2</version>
|
||||
<version>1.0-beta-1-20150523</version>
|
||||
<relativePath>../../pom.xml</relativePath>
|
||||
</parent>
|
||||
|
||||
@@ -17,13 +17,6 @@
|
||||
</dependencies>
|
||||
<build>
|
||||
<plugins>
|
||||
<plugin>
|
||||
<groupId>org.apache.maven.plugins</groupId>
|
||||
<artifactId>maven-deploy-plugin</artifactId>
|
||||
<configuration>
|
||||
<skip>true</skip>
|
||||
</configuration>
|
||||
</plugin>
|
||||
<plugin>
|
||||
<artifactId>maven-assembly-plugin</artifactId>
|
||||
<version>2.4</version>
|
||||
|
||||
@@ -2,10 +2,38 @@
|
||||
|
||||
<target name="all">
|
||||
<delete dir="target/themes"/>
|
||||
<copy todir="target/themes" overwrite="true">
|
||||
<fileset dir="../../forms/common-themes/src/main/resources/theme">
|
||||
<copy todir="target/themes/login/template" overwrite="true">
|
||||
<fileset dir="../../forms/common-themes/src/main/resources/theme/login/base">
|
||||
</fileset>
|
||||
</copy>
|
||||
<copy todir="target/themes/login/template" overwrite="true">
|
||||
<fileset dir="../../forms/common-themes/src/main/resources/theme/login/patternfly">
|
||||
</fileset>
|
||||
</copy>
|
||||
<copy tofile="target/themes/login/template/theme.properties" file="../../forms/common-themes/src/main/resources/theme/login/patternfly/theme.properties" overwrite="true">
|
||||
<filterchain>
|
||||
<linecontains negate="true">
|
||||
<contains value="parent"/>
|
||||
</linecontains>
|
||||
</filterchain>
|
||||
</copy>
|
||||
<copy todir="target/themes/account/template" overwrite="true">
|
||||
<fileset dir="../../forms/common-themes/src/main/resources/theme/account/base">
|
||||
</fileset>
|
||||
</copy>
|
||||
<copy todir="target/themes/account/template" overwrite="true">
|
||||
<fileset dir="../../forms/common-themes/src/main/resources/theme/account/patternfly">
|
||||
</fileset>
|
||||
</copy>
|
||||
<copy tofile="target/themes/account/template/theme.properties" file="../../forms/common-themes/src/main/resources/theme/account/patternfly/theme.properties" overwrite="true">
|
||||
<filterchain>
|
||||
<linecontains negate="true">
|
||||
<contains value="parent"/>
|
||||
</linecontains>
|
||||
</filterchain>
|
||||
</copy>
|
||||
<copy todir="target/themes" overwrite="true">
|
||||
<fileset dir="../../examples/themes"/>
|
||||
</copy>
|
||||
</target>
|
||||
|
||||
</project>
|
||||
</project>
|
||||
@@ -4,7 +4,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0-beta-2</version>
|
||||
<version>1.0-beta-1-20150523</version>
|
||||
<relativePath>../../pom.xml</relativePath>
|
||||
</parent>
|
||||
|
||||
@@ -17,13 +17,6 @@
|
||||
</dependencies>
|
||||
<build>
|
||||
<plugins>
|
||||
<plugin>
|
||||
<groupId>org.apache.maven.plugins</groupId>
|
||||
<artifactId>maven-deploy-plugin</artifactId>
|
||||
<configuration>
|
||||
<skip>true</skip>
|
||||
</configuration>
|
||||
</plugin>
|
||||
<plugin>
|
||||
<groupId>org.apache.maven.plugins</groupId>
|
||||
<artifactId>maven-antrun-plugin</artifactId>
|
||||
|
||||
@@ -24,12 +24,12 @@
|
||||
<outputDirectory>adapters</outputDirectory>
|
||||
</dependencySet>
|
||||
<dependencySet>
|
||||
<unpack>true</unpack>
|
||||
<unpack>false</unpack>
|
||||
<useTransitiveDependencies>false</useTransitiveDependencies>
|
||||
<includes>
|
||||
<include>org.keycloak:keycloak-example-themes-dist:zip</include>
|
||||
</includes>
|
||||
<outputDirectory>configuration</outputDirectory>
|
||||
<outputDirectory>examples</outputDirectory>
|
||||
</dependencySet>
|
||||
</dependencySets>
|
||||
<!--
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0-beta-2</version>
|
||||
<version>1.0-beta-1-20150523</version>
|
||||
<relativePath>../../pom.xml</relativePath>
|
||||
</parent>
|
||||
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0-beta-2</version>
|
||||
<version>1.0-beta-1-20150523</version>
|
||||
<relativePath>../../pom.xml</relativePath>
|
||||
</parent>
|
||||
|
||||
@@ -17,13 +17,6 @@
|
||||
</dependencies>
|
||||
<build>
|
||||
<plugins>
|
||||
<plugin>
|
||||
<groupId>org.apache.maven.plugins</groupId>
|
||||
<artifactId>maven-deploy-plugin</artifactId>
|
||||
<configuration>
|
||||
<skip>true</skip>
|
||||
</configuration>
|
||||
</plugin>
|
||||
<plugin>
|
||||
<groupId>org.apache.maven.plugins</groupId>
|
||||
<artifactId>maven-dependency-plugin</artifactId>
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0-beta-2</version>
|
||||
<version>1.0-beta-1-20150523</version>
|
||||
<relativePath>../../pom.xml</relativePath>
|
||||
</parent>
|
||||
|
||||
|
||||
+3
-10
@@ -6,7 +6,7 @@
|
||||
|
||||
<groupId>org.keycloak</groupId>
|
||||
<artifactId>keycloak-reference-guide-${translation}</artifactId>
|
||||
<version>1.0-beta-2</version>
|
||||
<version>1.0-beta-1-SNAPSHOT</version>
|
||||
<packaging>jdocbook</packaging>
|
||||
<name>Keycloak Reference Guide (${translation})</name>
|
||||
<description/>
|
||||
@@ -40,13 +40,6 @@
|
||||
|
||||
<build>
|
||||
<plugins>
|
||||
<plugin>
|
||||
<groupId>org.apache.maven.plugins</groupId>
|
||||
<artifactId>maven-deploy-plugin</artifactId>
|
||||
<configuration>
|
||||
<skip>true</skip>
|
||||
</configuration>
|
||||
</plugin>
|
||||
<plugin>
|
||||
<groupId>org.jboss.maven.plugins</groupId>
|
||||
<artifactId>maven-jdocbook-plugin</artifactId>
|
||||
@@ -70,9 +63,9 @@
|
||||
<configuration>
|
||||
<sourceDocumentName>master.xml</sourceDocumentName>
|
||||
<masterTranslation>en-US</masterTranslation>
|
||||
<sourceDirectory>${project.basedir}/reference/en</sourceDirectory>
|
||||
<sourceDirectory>reference/en</sourceDirectory>
|
||||
<imageResource>
|
||||
<directory>${project.basedir}/reference/en</directory>
|
||||
<directory>reference/en</directory>
|
||||
<includes>
|
||||
<include>images/*</include>
|
||||
</includes>
|
||||
|
||||
@@ -6,8 +6,6 @@
|
||||
<!ENTITY Installation SYSTEM "modules/server-installation.xml">
|
||||
<!ENTITY OpenShift SYSTEM "modules/openshift.xml">
|
||||
<!ENTITY AdminPermissions SYSTEM "modules/admin-permissions.xml">
|
||||
<!ENTITY PerRealmAdminPermissions SYSTEM "modules/per-realm-admin-permissions.xml">
|
||||
<!ENTITY AccessTypes SYSTEM "modules/access-types.xml">
|
||||
<!ENTITY AdapterConfig SYSTEM "modules/adapter-config.xml">
|
||||
<!ENTITY JBossAdapter SYSTEM "modules/jboss-adapter.xml">
|
||||
<!ENTITY JavascriptAdapter SYSTEM "modules/javascript-adapter.xml">
|
||||
@@ -22,14 +20,8 @@
|
||||
<!ENTITY Migration SYSTEM "modules/MigrationFromOlderVersions.xml">
|
||||
<!ENTITY Email SYSTEM "modules/email.xml">
|
||||
<!ENTITY Roles SYSTEM "modules/roles.xml">
|
||||
<!ENTITY DirectAccess SYSTEM "modules/direct-access.xml">
|
||||
<!ENTITY CORS SYSTEM "modules/cors.xml">
|
||||
<!ENTITY Timeouts SYSTEM "modules/timeouts.xml">
|
||||
<!ENTITY Audit SYSTEM "modules/audit.xml">
|
||||
<!ENTITY AdminApi SYSTEM "modules/admin-rest-api.xml">
|
||||
<!ENTITY Authentication SYSTEM "modules/authentication-spi.xml">
|
||||
<!ENTITY Ldap SYSTEM "modules/ldap.xml">
|
||||
<!ENTITY ExportImport SYSTEM "modules/export-import.xml">
|
||||
]>
|
||||
|
||||
<book>
|
||||
@@ -37,7 +29,7 @@
|
||||
<bookinfo>
|
||||
<title>Keycloak Reference Guide</title>
|
||||
<subtitle>SSO for Web Apps and REST Services</subtitle>
|
||||
<releaseinfo>1.0-beta-2</releaseinfo>
|
||||
<releaseinfo>1.0-beta-1-SNAPSHOT</releaseinfo>
|
||||
</bookinfo>
|
||||
|
||||
<toc/>
|
||||
@@ -68,7 +60,6 @@ This one is short
|
||||
&Installation;
|
||||
&OpenShift;
|
||||
&AdminPermissions;
|
||||
&PerRealmAdminPermissions;
|
||||
<chapter>
|
||||
<title>Adapters</title>
|
||||
<para>
|
||||
@@ -107,16 +98,9 @@ This one is short
|
||||
</para>
|
||||
&Email;
|
||||
</chapter>
|
||||
&AccessTypes;
|
||||
&Roles;
|
||||
&DirectAccess;
|
||||
&CORS;
|
||||
&Timeouts;
|
||||
&AdminApi;
|
||||
&Audit;
|
||||
&Authentication;
|
||||
&Ldap;
|
||||
&ExportImport;
|
||||
&Migration;
|
||||
|
||||
</book>
|
||||
|
||||
@@ -3,29 +3,10 @@
|
||||
<sect1>
|
||||
<title>Migrating from 1.0 Alpha 4 to Beta 1</title>
|
||||
<itemizedlist>
|
||||
<listitem>
|
||||
DB Schema has changed. We have added export of the database to Beta 1, but not the ability to import
|
||||
the database from older versions. This will be supported in future releases.
|
||||
</listitem>
|
||||
<listitem>
|
||||
For all clients except bearer-only applications, you must specify at least one redirect uri. Keycloak
|
||||
will not allow you to log in unless you have specified a valid redirect uri for that application.
|
||||
</listitem>
|
||||
<listitem>
|
||||
Resource Owner Password Credentials flow is now disabled by default. It can be enabled by setting the toggle
|
||||
for <literal>Direct Grant API</literal> <literal>ON</literal> under realm config in the admin console.
|
||||
</listitem>
|
||||
<listitem>
|
||||
Configuration is now done through <literal>standalone/configuration/keycloak-server.json</literal>. This
|
||||
should mainly affect those that use MongoDB.
|
||||
</listitem>
|
||||
<listitem>
|
||||
JavaScript adapter has been refactored. See the <link linkend='javascript-adapter'>JavaScript adapter</link> section for more details.
|
||||
</listitem>
|
||||
<listitem>
|
||||
The "Central Login Lifespan" setting no longer exists. Please see the <link linkend='session-timeouts'>Session Timeout</link> section
|
||||
for me details.
|
||||
</listitem>
|
||||
</itemizedlist>
|
||||
</sect1>
|
||||
<sect1>
|
||||
|
||||
@@ -23,10 +23,6 @@
|
||||
Social Login. Enable Google, GitHub, Facebook, Twitter social login with no code required.
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
LDAP and Active Directory support.
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
Optional User Registration
|
||||
</listitem>
|
||||
@@ -36,25 +32,7 @@
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
Forgot password support. User can have an email sent to them
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
Reset password/totp. Admin can force a password reset, or set up a temporary password.
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
Not-before revocation policies per realm, application, or user.
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
User session management. Admin can view user sessions and what applications/clients have an access token. Sessions can be invalidated
|
||||
per realm or per user.
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
Pluggable theme and style support for user facing screens. Login, grant pages, account mgmt, and admin console all
|
||||
can be styled, branded, and tailored to your application and organizational needs.
|
||||
Pluggable theme and style support for user facing screens.
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
@@ -86,14 +64,11 @@
|
||||
Admin Console for managing users, roles, role mappings, applications, user sessions, allowed CORS web origins, and OAuth clients.
|
||||
</listitem>
|
||||
<listitem>
|
||||
Account Management console that allows users to manage their own account, view their open sessions, reset passwords, etc.
|
||||
Account Management console that allows users to manage their own account
|
||||
</listitem>
|
||||
<listitem>
|
||||
Deployable as a WAR, appliance, or on Openshift.
|
||||
</listitem>
|
||||
<listitem>
|
||||
Multitenancy support. You can host and manage multiple realms for multiple organizations.
|
||||
</listitem>
|
||||
<listitem>
|
||||
Supports JBoss AS7, EAP 6.x, Wildfly and JavaScript applications. Plans to support Node.js, RAILS, GRAILS, and other non-Java deployments
|
||||
</listitem>
|
||||
@@ -125,7 +100,7 @@
|
||||
<section>
|
||||
<title>How Does Security Work in Keycloak?</title>
|
||||
<para>
|
||||
Keycloak uses <emphasis>access tokens</emphasis> to secure web invocations. Access tokens contains security metadata specifying the
|
||||
Keycloak uses <emphasis>access tokens</emphasis>. Access tokens contains security metadata specifying the
|
||||
identity of the user as well as the role mappings for that user. The format of these tokens is a Keycloak
|
||||
extension to the <ulink url="http://tools.ietf.org/html/draft-ietf-oauth-json-web-token-14">JSON Web Token</ulink> specification. Each realm has a private and public key pair
|
||||
which it uses to digitally sign the access token using the <ulink url="http://tools.ietf.org/html/draft-ietf-jose-json-web-signature-19">JSON Web Signature</ulink> specification.
|
||||
@@ -139,7 +114,7 @@
|
||||
no need for them to store any security metadata locally other than the public key of the realm.
|
||||
</para>
|
||||
<para>
|
||||
Signed access tokens can also be propagated by REST client requests within an <literal>Authorization</literal>
|
||||
Signed access tokens can also be proprogated by REST client requests within an <literal>Authorization</literal>
|
||||
header. This is great for distributed integration as applications can request a login from a client to obtain
|
||||
an access token, then invoke any aggregated REST invocations to other services using that access token. So,
|
||||
you have a distributed security model that is centrally managed, yet does not require a Keycloak Server hit
|
||||
|
||||
@@ -1,54 +0,0 @@
|
||||
<chapter id="access-types">
|
||||
<title>Application and Client Access Types</title>
|
||||
<para>
|
||||
When you create an Application or OAuth Client you may be wondering what the "Access Types" are.
|
||||
</para>
|
||||
<para>
|
||||
<variablelist>
|
||||
<varlistentry>
|
||||
<term>confidential</term>
|
||||
<listitem>
|
||||
<para>
|
||||
Confidential access type is for clients that need to perform a browser login and that you want
|
||||
to require a client secret when they turn an access code into an access token, (see
|
||||
<ulink url="http://tools.ietf.org/html/rfc6749#section-4.1.3">Access Token Request</ulink> in
|
||||
the OAuth 2.0 spec for more details). The advantages of this is that it is a little extra security.
|
||||
Since Keycloak requires you to register valid redirect-uris, I'm not exactly sure what this little
|
||||
extra security is though. :)
|
||||
The disadvantages of this access type is that confidential access type is pointless for pure
|
||||
Javascript clients as anybody could easily figure out your client's secret!
|
||||
</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
<varlistentry>
|
||||
<term>public</term>
|
||||
<listitem>
|
||||
<para>
|
||||
Public access type is for clients that need to perform a browser login and that you feel
|
||||
that the added extra security of confidential access type is not needed. FYI, Pure javascript
|
||||
clients are by nature public.
|
||||
</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
<varlistentry>
|
||||
<term>bearer-only</term>
|
||||
<listitem>
|
||||
<para>
|
||||
Bearer-only access type means that the application only allows bearer token requests. If this
|
||||
is turned on, this application cannot participate in browser logins.
|
||||
</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
<varlistentry>
|
||||
<term>direct access only</term>
|
||||
<listitem>
|
||||
<para>
|
||||
For OAuth clients, you would also see a "Direct Access Only" switch when creating the OAuth Client.
|
||||
This switch is for oauth clients that only use the <link linkend='direct-access-grant'>Direct Access Grant</link>
|
||||
protocol to obtain access tokens.
|
||||
</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
</variablelist>
|
||||
</para>
|
||||
</chapter>
|
||||
@@ -1,20 +1,13 @@
|
||||
<chapter id="admin-permissions">
|
||||
<title>Master Admin Access Control</title>
|
||||
<title>Admin Access Control</title>
|
||||
<para>
|
||||
You can create and manage multiple realms by logging into the <literal>master</literal> Keycloak admin console
|
||||
at <literal>/{keycloak-root}/admin/index.html</literal>
|
||||
</para>
|
||||
<para>
|
||||
Users in the Keycloak <literal>master</literal> realm can be granted permission to manage zero or more realms that are
|
||||
deployed on the Keycloak server. When a realm is created, Keycloak automatically creates various roles that grant fine-grain
|
||||
permissions to access that new realm.
|
||||
Access to The Admin Console and REST endpoints can be controlled by mapping these roles to users in the <literal>master</literal> realm.
|
||||
Access to The Admin Console and REST endpoints can be controlled by mapping roles to users in the <literal>keycloak-admin</literal> realm.
|
||||
It's possible to create multiple super users as well as users that have only access to certain operations in specific realms.
|
||||
</para>
|
||||
<section>
|
||||
<title>Global Roles</title>
|
||||
<para>
|
||||
There are two realm roles in the <literal>master</literal> realm. These are:
|
||||
There are two realm roles in the <literal>keycloak-admin</literal> realm. These are:
|
||||
<itemizedlist>
|
||||
<listitem>
|
||||
<literal>admin</literal> - This is the super-user role and grants permissions to all operations on all realms
|
||||
@@ -25,7 +18,7 @@
|
||||
</itemizedlist>
|
||||
</para>
|
||||
<para>
|
||||
To add these roles to a user select the <literal>master</literal> realm, then click on <literal>Users</literal>.
|
||||
To add these roles to a user select the <literal>keycloak-admin</literal> realm, then click on <literal>Users</literal>.
|
||||
Find the user you want to grant permissions to, open the user and click on <literal>Role Mappings</literal>. Under
|
||||
<literal>Realm Roles</literal> assign any of the above roles to the user by selecting it and clicking on the right-arrow.
|
||||
</para>
|
||||
@@ -34,7 +27,7 @@
|
||||
<section>
|
||||
<title>Realm Specific Roles</title>
|
||||
<para>
|
||||
Each realm in Keycloak is represented by an application in the <literal>master</literal> realm. The name of the application
|
||||
Each realm in Keycloak is represented by an application in the <literal>keycloak-admin</literal> realm. The name of the application
|
||||
is <literal><realm name>-realm</literal>. This allows assigning access to users for individual realms. The
|
||||
roles available are:
|
||||
<itemizedlist>
|
||||
@@ -67,10 +60,10 @@
|
||||
Manage roles includes permissions to view (for example a user with manage-realm role can also view the realm configuration).
|
||||
</para>
|
||||
<para>
|
||||
To add these roles to a user select the <literal>master</literal> realm, then click on <literal>Users</literal>.
|
||||
To add these roles to a user select the <literal>keycloak-admin</literal> realm, then click on <literal>Users</literal>.
|
||||
Find the user you want to grant permissions to, open the user and click on <literal>Role Mappings</literal>. Under
|
||||
<literal>Application Roles</literal> select the application that represents the realm you're adding permissions to
|
||||
(<literal><realm name>-realm</literal>), then assign any of the above roles to the user by selecting it and clicking on the right-arrow.
|
||||
</para>
|
||||
</section>
|
||||
</chapter>
|
||||
</chapter>
|
||||
@@ -1,17 +0,0 @@
|
||||
<chapter id="admin-rest-api">
|
||||
<title>Admin REST API</title>
|
||||
<para>
|
||||
The Keycloak Admin Console is implemented entirely with a fully functional REST admin API. You can invoke this
|
||||
REST API from your Java applications by obtaining an access token. You must have the appropriate
|
||||
permissions set up as describe in <xref linkend="admin-permissions" /> and <xref linkend="per-realm-admin-permissions" />
|
||||
</para>
|
||||
<para>
|
||||
The documentation for this REST API is auto-generated and is contained in the distribution of keycloak under
|
||||
the docs/rest-api/overview-index.html directory, or directly from the docs page at the keycloak website.
|
||||
</para>
|
||||
<para>
|
||||
There are a number of examples that come with the keycloak distribution that show you how to invoke on this REST API.
|
||||
<literal>examples/preconfigured-demo/admin-access-app</literal> shows you how to access this api from java.
|
||||
<literal>examples/cors/angular-product-app</literal> shows you how to invoke on it from Javascript.
|
||||
</para>
|
||||
</chapter>
|
||||
@@ -1,104 +0,0 @@
|
||||
<chapter id="audit">
|
||||
<title>Audit</title>
|
||||
<para>
|
||||
Keycloak provides an Audit SPI that makes it possible to register listeners for events in the system. There are two
|
||||
interfaces that can be implemented, the first is a pure listener, the second is a provider which listens for events
|
||||
as well as providing a query over persisted events. If a realm has a audit provider registered it's possible to
|
||||
view events for the realm through the admin console and account management.
|
||||
</para>
|
||||
<section>
|
||||
<title>Events</title>
|
||||
<para>
|
||||
Login events:
|
||||
<itemizedlist>
|
||||
<listitem>Login - A user has logged in</listitem>
|
||||
<listitem>Register - A user has registered</listitem>
|
||||
<listitem>Logout - A user has logged out</listitem>
|
||||
<listitem>Code to Token - An application/client has exchanged a code for a token</listitem>
|
||||
<listitem>Refresh Token - An application/client has refreshed a token</listitem>
|
||||
</itemizedlist>
|
||||
</para>
|
||||
<para>
|
||||
Account events
|
||||
<itemizedlist>
|
||||
<listitem>Social Link - An account has been linked to a social provider</listitem>
|
||||
<listitem>Remove Social Link - A social provider has been removed from an account</listitem>
|
||||
<listitem>Update Email - The email address for an account has changed</listitem>
|
||||
<listitem>Update Profile - The profile for an account has changed</listitem>
|
||||
<listitem>Send Password Reset - A password reset email has been sent</listitem>
|
||||
<listitem>Update Password - The password for an account has changed</listitem>
|
||||
<listitem>Update TOTP - The TOTP settings for an account has changed</listitem>
|
||||
<listitem>Remove TOTP - TOTP has been removed from an account</listitem>
|
||||
<listitem>Send Verify Email - A email verification email has been sent</listitem>
|
||||
<listitem>Verify Email - The email address for an account has been verified</listitem>
|
||||
</itemizedlist>
|
||||
</para>
|
||||
<para>
|
||||
For all events there is a corresponding error event.
|
||||
</para>
|
||||
</section>
|
||||
<section>
|
||||
<title>Audit Listener</title>
|
||||
<para>
|
||||
Keycloak comes with an Email Audit Listener and a JBogg Logging Audit Listener. The Email Audit Listener
|
||||
sends an email to the users account when an event occurs. The JBoss Logging Audit Listener writes to a log
|
||||
file when an events occurs.
|
||||
</para>
|
||||
<para>
|
||||
The Email Audit Listener only supports the following events at the moment:
|
||||
<itemizedlist>
|
||||
<listitem>Login Error</listitem>
|
||||
<listitem>Update Password</listitem>
|
||||
<listitem>Update TOTP</listitem>
|
||||
<listitem>Remove TOTP</listitem>
|
||||
</itemizedlist>
|
||||
You can exclude one or more events by editing <literal>standalone/configuration/keycloak-server.json</literal>
|
||||
and adding for example:
|
||||
<programlisting><![CDATA[
|
||||
"audit-listener": {
|
||||
"email": {
|
||||
"exclude-events": [ "UPDATE_TOTP", "REMOVE_TOTP" ]
|
||||
}
|
||||
}
|
||||
]]></programlisting>
|
||||
</para>
|
||||
</section>
|
||||
|
||||
<section>
|
||||
<title>Audit Provider</title>
|
||||
<para>
|
||||
Audit Providers listen for events and is expected to persist the events to make it possible to query for them
|
||||
later. This is used by the admin console and account management to view events. Keycloak includes providers
|
||||
to persist audit events to JPA and Mongo. For production you will most likely want to use a separate database
|
||||
for audit events. You may even want to use a RDBMS for your model, and Mongo for your audit.
|
||||
</para>
|
||||
<para>
|
||||
You can specify events to include or exclude by editing <literal>standalone/configuration/keycloak-server.json</literal>,
|
||||
and adding for example:
|
||||
<programlisting><![CDATA[
|
||||
"audit": {
|
||||
"jpa": {
|
||||
"exclude-events": [ "LOGIN", "REFRESH_TOKEN", "CODE_TO_TOKEN" ]
|
||||
}
|
||||
}
|
||||
]]></programlisting>
|
||||
</para>
|
||||
</section>
|
||||
|
||||
<section>
|
||||
<title>Configure Audit Settings for Realm</title>
|
||||
<para>
|
||||
To enable audit for a realm you firstly need to make sure you have a audit provider registered for Keycloak.
|
||||
By default the JPA audit provider is registered. Once you've done that open the admin console, select the
|
||||
realm you're configuring, select <literal>Audit</literal>. Then click on <literal>Config</literal>.
|
||||
You can enable audit for your realm by toggling <literal>Enabled</literal> to ON. You can also set
|
||||
an expiration on audit events. This will deleted events from the database that are older than the specified
|
||||
time.
|
||||
</para>
|
||||
<para>
|
||||
To configure listeners for a realm on the same page as above add one or more audit listeners to the <literal>
|
||||
Audit Listeners</literal> select box. This will allow you to enable any registered Audit Listeners with the
|
||||
realm.
|
||||
</para>
|
||||
</section>
|
||||
</chapter>
|
||||
@@ -1,66 +0,0 @@
|
||||
<chapter id="authentication-spi">
|
||||
<title>Authentication SPI</title>
|
||||
<para>
|
||||
Keycloak provides Authentication SPI, which allows to choose the <literal>AuthenticationProvider</literal> for authenticating users.
|
||||
AuthenticationProvider is the interface, which states how will be your usernames/passwords validated. You can choose from
|
||||
the set of available AuthenticationProviders or you can even implement and plug your own AuthenticationProvider, which
|
||||
will allow to provide your own way how will Keycloak validates users and their passwords.
|
||||
</para>
|
||||
<section id="authentication-available-providers">
|
||||
<title>Available Authentication Providers</title>
|
||||
<para>
|
||||
<itemizedlist>
|
||||
<listitem><literal>Model</literal> - This provider validates users and their passwords based on the Keycloak model. So it just delegates
|
||||
to model implementation provided either by RDBMS or Mongo at this moment. This is default AuthenticationProvider,
|
||||
which is configured for <literal>keycloak-admin</literal> realm by default and it's also automatically configured for newly created realms.
|
||||
</listitem>
|
||||
<listitem><literal>External-model</literal> - This provider also uses Keycloak model, but it uses different realm to validate your users against.
|
||||
For example if you want to create new realm "foo" and you want all users of already existing realm "bar" that they are automatically
|
||||
able to login into realm "foo" with their usernames and passwords, you can choose this provider.
|
||||
</listitem>
|
||||
<listitem><literal>Picketlink</literal> - This provider delegates Authentication to <ulink url="http://docs.jboss.org/picketlink/2/latest/reference/html-single/#chap-Identity_Management_-_Overview">Picketlink IDM</ulink>
|
||||
framework. Right now, Picketlink IDM in Keycloak is configured to always use LDAP based Identity store, which means that picketlink provider
|
||||
allows you to authenticate your users against LDAP server. Note that you will first need to configure LDAP server as described
|
||||
<link linkend="ldap">here</link> . <literal>PicketlinkAuthenticationProvider</literal> configured for the realm will automatically use LDAP configuration for this realm.
|
||||
</listitem>
|
||||
</itemizedlist>
|
||||
</para>
|
||||
</section>
|
||||
<section id="authentication-features">
|
||||
<title>Features and configuration</title>
|
||||
<para>
|
||||
<itemizedlist>
|
||||
<listitem>
|
||||
You can configure AuthenticationProviders separately for each realm. So for example you can choose that just realm
|
||||
"foo" will use <literal>PicketlinkAuthenticationProvider</literal> and authenticate users against LDAP but realm "keycloak-admin" will still use default <literal>ModelAuthenticationProvider</literal>.
|
||||
</listitem>
|
||||
<listitem>
|
||||
There is also possibility to choose more authentication providers for the realm, which actually means that Keycloak
|
||||
will use first available AuthenticationProvider and just in case that user doesn't exist here,
|
||||
it will fallback to second AuthenticationProvider in chain. So this may allow for example scenario, in which
|
||||
you authenticate user against Keycloak database (model) and just if he doesn't exist in database, it will fallback to LDAP (picketlink).
|
||||
</listitem>
|
||||
<listitem>
|
||||
You can configure for each AuthenticationProvider if you want to update passwords - option <literal>passwordUpdateSupported</literal>.
|
||||
This means that when user update password or his profile through Keycloak UI, this change will be propagated into AuthenticationProvider.
|
||||
So for example password in LDAP will be updated if it's <literal>true</literal>, but for read-only LDAP, you will likely switch it to <literal>false</literal>.
|
||||
It also means that newly registered users will be propagated to particular AuthenticationProvider too,
|
||||
but note that each user is always bind just to one AuthenticationProvider.
|
||||
</listitem>
|
||||
<listitem>
|
||||
You can add/edit/remove AuthenticationProviders in the <literal>Authentication</literal> tab in admin console, which is under URL
|
||||
<ulink url="http://localhost:8080/auth/admin/keycloak-admin/console/#/realms/YOUR_REALM/auth-settings">http://localhost:8080/auth/admin/keycloak-admin/console/#/realms/YOUR_REALM/auth-settings</ulink>
|
||||
</listitem>
|
||||
</itemizedlist>
|
||||
|
||||
</para>
|
||||
</section>
|
||||
<section id="authentication-new-provider">
|
||||
<title>Creating your own Authentication Provider</title>
|
||||
<para>
|
||||
You need to implement interface AuthenticationProvider and add the name of your AuthenticationProviderFactory class into
|
||||
<literal>META-INF/services/org.keycloak.authentication.AuthenticationProviderFactory</literal> file inside your JAR with AuthenticationProvider. You also need to copy this JAR into
|
||||
<literal>standalone/deployments/auth-server.war/WEB-INF/lib</literal> . The best is to look at <ulink url="https://github.com/keycloak/keycloak/tree/master/examples/providers/authentication-properties">example</ulink> and try it out.
|
||||
</para>
|
||||
</section>
|
||||
</chapter>
|
||||
@@ -1,128 +0,0 @@
|
||||
<chapter id="direct-access-grants">
|
||||
<title>Direct Access Grants</title>
|
||||
<para>
|
||||
Keycloak allows you to make direct REST invocations to obtain an access token.
|
||||
(See <ulink url="http://tools.ietf.org/html/rfc6749#section-4.3">Resource Owner Password Credentials Grant</ulink>
|
||||
from OAuth 2.0 spec). To use it, Direct Access Grants must be allowed by your realm. This is a configuration switch
|
||||
in the admin console under Settings->General, specifically the "Direct Grant API" switch. You must also have
|
||||
registered a valid OAuth Client or Application to use as the "client_id" for this grant request.
|
||||
</para>
|
||||
<warning>
|
||||
<para>
|
||||
It is highly recommended that you do not use Direct Access Grants to write your own login pages for your application.
|
||||
You will lose a lot of features that Keycloak has if you do this. Specifically all the account management, remember me,
|
||||
lost password, account reset features of Keycloak. Instead, if you want to tailor the look and feel of Keycloak login
|
||||
pages, you should create your own <link linkend="themes">theme</link>.
|
||||
</para>
|
||||
<para>
|
||||
It is even highly recommended that you use the browser to log in for native mobile applications! Android
|
||||
and iPhone applications allow you to redirect to and from the browser. You can use this to redirect the user
|
||||
from your native mobile app to the web browser to perform login, then the browser will redirect back to your
|
||||
native application.
|
||||
</para>
|
||||
</warning>
|
||||
|
||||
|
||||
<para>
|
||||
The REST URL to invoke on is <literal>/{keycloak-root}/realms/{realm-name}/tokens/grants/access</literal>.
|
||||
Invoking on this URL is a POST request and requires you to post the username and credentials of the user you want
|
||||
an access token for. You must also pass along the "client_id" of the application or oauth client you are creating
|
||||
an access token for. This "client_id" is the application or oauth client name (not it's id!). Depending on
|
||||
whether your application/oauth client is <link linkend='access-types'>"public" or "confidential"</link>, you may also have to pass along
|
||||
it's client secret as well.
|
||||
</para>
|
||||
<para>
|
||||
For public applications or oauth client's, the POST invocation requires form parameters that contain the username,
|
||||
credentials, and client_id of your application. For example:
|
||||
<programlisting><![CDATA[
|
||||
POST /auth/realms/demo/tokens/grants/access
|
||||
Content-Type: application/x-www-form-urlencoded
|
||||
|
||||
username=bburke&password=geheim&client_id=customer-portal]]>
|
||||
</programlisting>
|
||||
The response would be this <ulink url="http://tools.ietf.org/html/rfc6749#section-4.3.3">standard JSON document</ulink> from the OAuth 2.0 specification.
|
||||
<programlisting><![CDATA[
|
||||
HTTP/1.1 200 OK
|
||||
Content-Type: application/json;charset=UTF-8
|
||||
Cache-Control: no-store
|
||||
Pragma: no-cache
|
||||
|
||||
{
|
||||
"access_token":"2YotnFZFEjr1zCsicMWpAA",
|
||||
"token_type":"bearer",
|
||||
"expires_in":3600,
|
||||
"refresh_token":"tGzv3JOkF0XG5Qx2TlKWIA",
|
||||
"id_token":"tGzv3JOkF0XG5Qx2TlKWIA",
|
||||
"session-state":"234234-234234-234234"
|
||||
}]]>
|
||||
</programlisting>
|
||||
</para>
|
||||
<para>
|
||||
For confidential applications or oauth client's, you must create a Basic Auth <literal>Authorization</literal>
|
||||
header that contains the client_id and client secret. And pass in the form parameters for username and for
|
||||
each user credential. For example:
|
||||
<programlisting><![CDATA[
|
||||
POST /auth/realms/demo/tokens/grants/access
|
||||
Authorization: Basic atasdf023l2312023
|
||||
Content-Type: application/x-www-form-urlencoded
|
||||
|
||||
username=bburke&password=geheim]]>
|
||||
</programlisting>
|
||||
|
||||
</para>
|
||||
<para>
|
||||
Here's a Java example using Apache HTTP Client and some Keycloak utility classes.:
|
||||
<programlisting><![CDATA[
|
||||
HttpClient client = new HttpClientBuilder()
|
||||
.disableTrustManager().build();
|
||||
|
||||
|
||||
try {
|
||||
HttpPost post = new HttpPost(
|
||||
KeycloakUriBuilder.fromUri("http://localhost:8080/auth")
|
||||
.path(ServiceUrlConstants.TOKEN_SERVICE_DIRECT_GRANT_PATH).build("demo"));
|
||||
List <NameValuePair> formparams = new ArrayList <NameValuePair>();
|
||||
formparams.add(new BasicNameValuePair("username", "bburke"));
|
||||
formparams.add(new BasicNameValuePair("password", "password"));
|
||||
|
||||
if (isPublic()) { // if client is public access type
|
||||
formparams.add(new BasicNameValuePair(OAuth2Constants.CLIENT_ID, "customer-portal"));
|
||||
} else {
|
||||
String authorization = BasicAuthHelper.createHeader("customer-portal", "secret-secret-secret);
|
||||
post.setHeader("Authorization", authorization);
|
||||
}
|
||||
UrlEncodedFormEntity form = new UrlEncodedFormEntity(formparams, "UTF-8");
|
||||
post.setEntity(form);
|
||||
|
||||
HttpResponse response = client.execute(post);
|
||||
int status = response.getStatusLine().getStatusCode();
|
||||
HttpEntity entity = response.getEntity();
|
||||
if (status != 200) {
|
||||
throw new IOException("Bad status: " + status);
|
||||
}
|
||||
if (entity == null) {
|
||||
throw new IOException("No Entity");
|
||||
}
|
||||
InputStream is = entity.getContent();
|
||||
try {
|
||||
AccessTokenResponse tokenResponse = JsonSerialization.readValue(is, AccessTokenResponse.class);
|
||||
} finally {
|
||||
try {
|
||||
is.close();
|
||||
} catch (IOException ignored) { }
|
||||
}
|
||||
} finally {
|
||||
client.getConnectionManager().shutdown();
|
||||
}
|
||||
]]>
|
||||
|
||||
</programlisting>
|
||||
</para>
|
||||
<para>
|
||||
Once you have the access token string, you can use it in REST HTTP bearer token authorized requests, i.e
|
||||
<programlisting>
|
||||
GET /my/rest/api
|
||||
Authorization: Bearer 2YotnFZFEjr1zCsicMWpAA
|
||||
</programlisting>
|
||||
</para>
|
||||
</chapter>
|
||||
@@ -1,31 +0,0 @@
|
||||
<chapter id="export-import">
|
||||
<title>Export and Import</title>
|
||||
<para>
|
||||
Export/import is useful especially if you want to migrate your whole Keycloak database from one environment to another or migrate to different database (For example from MySQL to Oracle).
|
||||
You can trigger export/import at startup of Keycloak server and it's configurable with System properties right now. The fact it's done at server startup means that no-one can access Keycloak UI or REST endpoints
|
||||
and edit Keycloak database on the fly when export or import is in progress. Otherwise it could lead to inconsistent results.
|
||||
</para>
|
||||
<para>
|
||||
You can export/import your database either to directory on local filesystem (useful just for testing purposes or if your filesystem is properly protected)
|
||||
or to encrypted ZIP file on local filesystem. Encrypted ZIP is recommended as export contains many sensitive informations like passwords of your users (even if they are hashed),
|
||||
but also their email addresses, and especially private keys of the realms.
|
||||
</para>
|
||||
<para>
|
||||
So to export the content of your Keycloak database into encrypted ZIP, you can execute Keycloak server with the System properties like:
|
||||
<programlisting><![CDATA[
|
||||
bin/standalone.sh -Dkeycloak.migration.action=export
|
||||
-Dkeycloak.migration.provider=zip -Dkeycloak.migration.zipFile=<FILE TO EXPORT TO>
|
||||
-Dkeycloak.migration.zipPassword=<PASSWORD TO DECRYPT EXPORT>
|
||||
]]></programlisting>
|
||||
Then you can move or copy the encrypted ZIP file into second environment and you can trigger import from it into Keycloak server with the same command but use
|
||||
<literal>-Dkeycloak.migration.action=import</literal> instead of <literal>export</literal> .
|
||||
</para>
|
||||
<para>
|
||||
To export into unencrypted directory you can use:
|
||||
<programlisting><![CDATA[
|
||||
bin/standalone.sh -Dkeycloak.migration.action=export
|
||||
-Dkeycloak.migration.provider=dir -Dkeycloak.migration.dir=<DIR TO EXPORT TO>
|
||||
]]></programlisting>
|
||||
And similarly for import just use <literal>-Dkeycloak.migration.action=import</literal> instead of <literal>export</literal> .
|
||||
</para>
|
||||
</chapter>
|
||||
@@ -1,4 +1,4 @@
|
||||
<section id="javascript-adapter">
|
||||
<section>
|
||||
<title>Pure Client Javascript Adapter</title>
|
||||
<para>
|
||||
The Keycloak Server comes with a Javascript library you can use to secure pure HTML/Javascript applications. It
|
||||
|
||||
@@ -1,12 +0,0 @@
|
||||
<chapter id="ldap">
|
||||
<title>LDAP Integration</title>
|
||||
<para>
|
||||
Right now, LDAP server is configured separately for each Realm. Configuration is in admin console in tab <literal>Ldap</literal>
|
||||
under realm settings. It's under URL like <ulink url="http://localhost:8080/auth/admin/keycloak-admin/console/index.html#/realms/YOUR_REALM/ldap-settings">http://localhost:8080/auth/admin/keycloak-admin/console/index.html#/realms/YOUR_REALM/ldap-settings</ulink> .
|
||||
There is nothing like "shared" LDAP server for more realms in Keycloak, but it's planned for the future.
|
||||
</para>
|
||||
<para>
|
||||
LDAP is currently used just for authentication of users done through <literal>PicketlinkAuthenticationProvider</literal> as described <link linkend="authentication-available-providers">here</link> .
|
||||
In the future, we have plan to have full Sync SPI, which will allow one-way or two-way synchronization between LDAP server and Keycloak database including users and roles.
|
||||
</para>
|
||||
</chapter>
|
||||
@@ -27,7 +27,7 @@
|
||||
Scroll down to the bottom of the page to find the
|
||||
<literal>Code Anything</literal>
|
||||
section. Insert
|
||||
<literal>http://cartreflect-claytondev.rhcloud.com/github/keycloak/openshift-keycloak-cartridge</literal>
|
||||
<literal>https://raw.github.com/keycloak/openshift-keycloak-cartridge/master/metadata/manifest.yml</literal>
|
||||
into the
|
||||
<literal>URL to a cartridge definition</literal>
|
||||
field and click on <literal>Next</literal>. Fill in the
|
||||
@@ -44,7 +44,7 @@
|
||||
<title>Create Keycloak instance with the command-line tool</title>
|
||||
<para>
|
||||
Run the following command from a terminal:
|
||||
<programlisting>rhc app create <APPLICATION NAME> http://cartreflect-claytondev.rhcloud.com/github/keycloak/openshift-keycloak-cartridge</programlisting>
|
||||
<programlisting>rhc app create <APPLICATION NAME> https://raw.github.com/keycloak/openshift-keycloak-cartridge/master/metadata/manifest.yml</programlisting>
|
||||
Replace <literal><APPLICATION NAME></literal> with the name you want (for example keycloak).
|
||||
</para>
|
||||
<para>
|
||||
|
||||
@@ -1,59 +0,0 @@
|
||||
<chapter id="per-realm-admin-permissions">
|
||||
<title>Per Realm Admin Access Control</title>
|
||||
<para>
|
||||
Administering your realm through the <literal>master</literal> realm as discussed in <xref linkend="admin-permissions" /> may not always be
|
||||
ideal or feasible. For example, maybe you have more than one admin application that manages various admin aspects of your organization
|
||||
and you want to unify all these different "admin consoles" under one realm so you can do SSO between them. Keycloak allows you to
|
||||
grant realm admin privleges to users within that realm. These realm admins can participate in SSO for that realm and
|
||||
visit a keycloak admin console instance that is dedicated solely for that realm by going to the url:
|
||||
<literal>/{keycloak-root}/admin/{realm}/console</literal>
|
||||
</para>
|
||||
<section>
|
||||
<title>Realm Roles</title>
|
||||
<para>
|
||||
Each realm has a built-in application called <literal>realm-management</literal>. This application defines
|
||||
roles that define permissions that can be granted to manage the realm.
|
||||
<itemizedlist>
|
||||
<listitem>
|
||||
<literal>realm-admin</literal> - This is a composite role that grants all admin privileges for managing
|
||||
security for that realm.
|
||||
</listitem>
|
||||
</itemizedlist>
|
||||
These are more fine-grain roles you can assign to the user.
|
||||
|
||||
<itemizedlist>
|
||||
<listitem>
|
||||
<literal>view-realm</literal> - View the realm configuration
|
||||
</listitem>
|
||||
<listitem>
|
||||
<literal>view-users</literal> - View users (including details for specific user) in the realm
|
||||
</listitem>
|
||||
<listitem>
|
||||
<literal>view-applications</literal> - View applications in the realm
|
||||
</listitem>
|
||||
<listitem>
|
||||
<literal>view-clients</literal> - View clients in the realm
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
<literal>manage-realm</literal> - Modify the realm configuration (and delete the realm)
|
||||
</listitem>
|
||||
<listitem>
|
||||
<literal>manage-users</literal> - Create, modify and delete users in the realm
|
||||
</listitem>
|
||||
<listitem>
|
||||
<literal>manage-applications</literal> - Create, modify and delete applications in the realm
|
||||
</listitem>
|
||||
<listitem>
|
||||
<literal>manage-clients</literal> - Create, modify and delete clients in the realm
|
||||
</listitem>
|
||||
</itemizedlist>
|
||||
Manage roles includes permissions to view (for example a user with manage-realm role can also view the realm configuration).
|
||||
</para>
|
||||
<para>
|
||||
To add these roles to a user select the realm you want. Then click on <literal>Users</literal>.
|
||||
Find the user you want to grant permissions to, open the user and click on <literal>Role Mappings</literal>. Under
|
||||
<literal>Application Roles</literal> select <literal>realm-management</literal>, then assign any of the above roles to the user by selecting it and clicking on the right-arrow.
|
||||
</para>
|
||||
</section>
|
||||
</chapter>
|
||||
@@ -8,11 +8,11 @@
|
||||
<itemizedlist>
|
||||
|
||||
<listitem>
|
||||
keycloak-appliance-dist-all-1.0-beta-2.zip
|
||||
keycloak-appliance-dist-all-1.0-beta-1-SNAPSHOT.zip
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
keycloak-war-dist-all-1.0-beta-2.zip
|
||||
keycloak-war-dist-all-1.0-beta-1-SNAPSHOT.zip
|
||||
</listitem>
|
||||
|
||||
</itemizedlist>
|
||||
@@ -31,20 +31,18 @@
|
||||
|
||||
<para>
|
||||
<programlisting>
|
||||
keycloak-appliance-dist-all-1.0-beta-2/
|
||||
keycloak-appliance-dist-all-1.0-beta-1-SNAPSHOT/
|
||||
keycloak/
|
||||
bin/
|
||||
standalone.sh
|
||||
standalone.bat
|
||||
standalone/deployments/
|
||||
auth-server.war/
|
||||
standalone/configuration/
|
||||
keycloak-server.json
|
||||
themes/
|
||||
auth-server.war/
|
||||
|
||||
adapters/
|
||||
keycloak-as7-adapter-dist-1.0-beta-2.zip
|
||||
keycloak-eap6-adapter-dist-1.0-beta-2.zip
|
||||
keycloak-wildfly-adapter-dist-1.0-beta-2.zip
|
||||
keycloak-as7-adapter-dist-1.0-beta-1-SNAPSHOT.zip
|
||||
keycloak-eap6-adapter-dist-1.0-beta-1-SNAPSHOT.zip
|
||||
keycloak-wildfly-adapter-dist-1.0-beta-1-SNAPSHOT.zip
|
||||
examples/
|
||||
docs/
|
||||
</programlisting>
|
||||
@@ -56,8 +54,8 @@ keycloak-appliance-dist-all-1.0-beta-2/
|
||||
<literal>standalone.bat</literal>
|
||||
script is used to start the server.
|
||||
After executing that, log into the admin console at<ulink
|
||||
url="http://localhost:8080/auth/admin/index.html">
|
||||
http://localhost:8080/auth/admin/index.html</ulink>.
|
||||
url="http://localhost:8080/auth/rest/admin/login">
|
||||
http://localhost:8080/auth/rest/admin/login</ulink>.
|
||||
Username: <emphasis>admin</emphasis>
|
||||
Password: <emphasis>admin</emphasis>. Keycloak will then prompt you to
|
||||
enter in a new password.
|
||||
@@ -79,37 +77,33 @@ keycloak-appliance-dist-all-1.0-beta-2/
|
||||
</para>
|
||||
<para>
|
||||
<programlisting>
|
||||
keycloak-war-dist-all-1.0-beta-2/
|
||||
keycloak-war-dist-all-1.0-beta-1-SNAPSHOT/
|
||||
deployments/
|
||||
auth-server.war/
|
||||
keycloak-ds.xml
|
||||
configuration/
|
||||
keycloak-server.json
|
||||
themes/
|
||||
adapters/
|
||||
keycloak-as7-adapter-dist-1.0-beta-2.zip
|
||||
keycloak-eap6-adapter-dist-1.0-beta-2.zip
|
||||
keycloak-wildfly-adapter-dist-1.0-beta-2.zip
|
||||
keycloak-as7-adapter-dist-1.0-beta-1-SNAPSHOT.zip
|
||||
keycloak-eap6-adapter-dist-1.0-beta-1-SNAPSHOT.zip
|
||||
keycloak-wildfly-adapter-dist-1.0-beta-1-SNAPSHOT.zip
|
||||
examples/
|
||||
docs/
|
||||
</programlisting>
|
||||
</para>
|
||||
<para>
|
||||
After unzipping this file, copy everything in <literal>deployments</literal> directory into the
|
||||
<literal>standalone/deployments</literal> of your JBoss or Wildfly distro. Also, copy everything in
|
||||
<literal>configuration</literal> directory into the <literal>standalone/configuration</literal> directory.
|
||||
After unzipping this file, copy the <literal>deployments/</literal> directory into to the <literal>standalone/</literal>
|
||||
of your JBoss or Wildfly distro.
|
||||
</para>
|
||||
<para>
|
||||
<programlisting>
|
||||
$ cd keycloak-war-dist-all-1.0-beta-2
|
||||
$ cd keycloak-war-dist-all-1.0-beta-1-SNAPSHOT
|
||||
$ cp -r deployments $JBOSS_HOME/standalone
|
||||
</programlisting>
|
||||
</para>
|
||||
<para>
|
||||
After booting up the JBoss or Wildfly distro, you can then make sure it is installed properly
|
||||
by logging into the admin console at<ulink
|
||||
url="http://localhost:8080/auth/admin/index.html">
|
||||
http://localhost:8080/auth/admin/index.html</ulink>.
|
||||
url="http://localhost:8080/auth/rest/admin/login">
|
||||
http://localhost:8080/auth/rest/admin/login</ulink>.
|
||||
Username: <emphasis>admin</emphasis>
|
||||
Password: <emphasis>admin</emphasis>. Keycloak will then prompt you to
|
||||
enter in a new password.
|
||||
@@ -254,53 +248,20 @@ keycloak-war-dist-all-1.0-beta-2/
|
||||
<title>MongoDB based model</title>
|
||||
<para>
|
||||
Keycloak provides <ulink url="http://www.mongodb.com">MongoDB</ulink> based model implementation, which means that your identity data will be saved
|
||||
in MongoDB instead of traditional RDBMS. To configure Keycloak to use Mongo open <literal>standalone/configuration/keycloak-server.json</literal>
|
||||
in your favourite editor, then change:
|
||||
|
||||
in MongoDB instead of traditional RDBMS. To setup it, you need to add few system properties when running Keycloak.
|
||||
First you need to specify that you want to use <literal>mongo</literal> instead of default <literal>jpa</literal> model, and you may also specify
|
||||
host, port and name of mongo database. So you can start keycloak with the command like this:
|
||||
<programlisting><![CDATA[
|
||||
"audit": {
|
||||
"provider": "jpa",
|
||||
"jpa": {
|
||||
"exclude-events": [ "REFRESH_TOKEN" ]
|
||||
}
|
||||
},
|
||||
|
||||
"model": {
|
||||
"provider": "jpa"
|
||||
},
|
||||
./standalone.sh -Dkeycloak.model=mongo -Dkeycloak.model.mongo.host=localhost
|
||||
-Dkeycloak.model.mongoport=27017 -Dkeycloak.model.mongo.db=keycloak
|
||||
]]></programlisting>
|
||||
|
||||
to:
|
||||
|
||||
<programlisting><![CDATA[
|
||||
"audit": {
|
||||
"provider": "mongo",
|
||||
"mongo": {
|
||||
"exclude-events": [ "REFRESH_TOKEN" ],
|
||||
"host": "<hostname>",
|
||||
"port": <port>,
|
||||
"user": "<user>",
|
||||
"password": "<password>",
|
||||
"db": "<db name>"
|
||||
}
|
||||
},
|
||||
|
||||
"model": {
|
||||
"provider": "mongo",
|
||||
"mongo": {
|
||||
"host": "<hostname>",
|
||||
"port": <port>,
|
||||
"user": "<user>",
|
||||
"password": "<password>",
|
||||
"db": "<db name>"
|
||||
}
|
||||
},
|
||||
Note that when you install MongoDB on your laptop, it's usually on localhost/270717 by default. That's why properties
|
||||
<literal>keycloak.model.mongo.host</literal> and <literal>keycloak.model.mongo.port</literal> are not mandatory, but they already have
|
||||
default values <literal>localhost</literal> and <literal>27017</literal> . Similarly property <literal>keycloak.model.mongo.db</literal>
|
||||
has default value <literal>keycloak</literal> for name of underlying database. So the example above could be simplified like:
|
||||
<programlisting><![CDATA[
|
||||
./standalone.sh -Dkeycloak.model=mongo
|
||||
]]></programlisting>
|
||||
|
||||
All configuration options are optional. Default values for host and port are localhost and 27017. If
|
||||
user and password are not specified Keycloak will connect unauthenticated to your MongoDB. Finally, default
|
||||
values for db are keycloak for the model, and keycloak-audit for audit.
|
||||
|
||||
If you switch to Mongo model, it could be a good idea to remove RDBMS related stuff from your distribution to reduce startup time and memory footprint.
|
||||
To do it, you need to:
|
||||
<itemizedlist>
|
||||
@@ -309,7 +270,6 @@ keycloak-war-dist-all-1.0-beta-2/
|
||||
</itemizedlist>
|
||||
</para>
|
||||
</section>
|
||||
|
||||
<section>
|
||||
<title>AS7/EAP6.x Logging</title>
|
||||
<para>
|
||||
|
||||
@@ -16,30 +16,11 @@
|
||||
</para>
|
||||
</section>
|
||||
|
||||
<section>
|
||||
<title>Default themes</title>
|
||||
<para>
|
||||
Keycloak comes bundled with default themes in <literal>standalone/configuration/themes</literal>. It is
|
||||
not recommended to edit these themes directly. Instead you should create a new theme to extend a default
|
||||
theme. A good reference is to copy the keycloak themes as these extend the base theme to add styling.
|
||||
</para>
|
||||
</section>
|
||||
|
||||
<section>
|
||||
<title>Creating a theme</title>
|
||||
<para>
|
||||
There are several types of themes in Keycloak:
|
||||
<itemizedlist>
|
||||
<listitem>Account - Account management</listitem>
|
||||
<listitem>Admin - Admin console</listitem>
|
||||
<listitem>Common - Shared resources for themes</listitem>
|
||||
<listitem>Email - Emails</listitem>
|
||||
<listitem>Login - Login forms</listitem>
|
||||
</itemizedlist>
|
||||
</para>
|
||||
|
||||
<para>
|
||||
A theme consists of:
|
||||
There are two types of themes in Keycloak, <literal>login</literal> and <literal>account</literal>. Login themes are used to customize the
|
||||
login forms, while account themes are used to customize account management. A theme consists of:
|
||||
<itemizedlist>
|
||||
<listitem><para><ulink url="http://freemarker.org">FreeMarker</ulink> templates</para></listitem>
|
||||
<listitem><para>Stylesheets</para></listitem>
|
||||
@@ -56,9 +37,9 @@
|
||||
templates.
|
||||
</para>
|
||||
<para>
|
||||
To create a new theme, create a folder in <literal>.../standalone/configuration/themes/< theme type></literal>.
|
||||
The name of the folder is the name of the theme. Then create a file <literal>theme.properties</literal> inside the theme folder.
|
||||
The contents of the file should be:
|
||||
To create a new theme, create a folder in <literal>.../standalone/configuration/themes/login</literal> or
|
||||
<literal>.../standalone/configuration/themes/account</literal>. The name of the folder is the name of the theme.
|
||||
Then create a file <literal>theme.properties</literal> inside the theme folder. The contents of the file should be:
|
||||
</para>
|
||||
<programlisting>parent=base</programlisting>
|
||||
<para>
|
||||
@@ -123,6 +104,24 @@
|
||||
Check out the Freemarker website on how to form a template file.
|
||||
</para>
|
||||
</section>
|
||||
<section>
|
||||
<title>Full Example Templates</title>
|
||||
<para>
|
||||
Keycloak comes bundled with some default themes which you cannot view or modify. The distribution
|
||||
also contains full example templates which you can edit directly if you're running the Keycloak appliance
|
||||
distro, or which you can install, if you're using the WAR distro. The name of these full example themes
|
||||
is <literal>template</literal> and they contain a complex example for generating all pages related
|
||||
to login, error displaying, oauth grant pages, and user account management.
|
||||
</para>
|
||||
<para>
|
||||
For the Keycloak Appliance Distro, these theme files are in the directories
|
||||
<literal>${appliance-distro}/keycloak/standalone/configuration/themes/login/template</literal>
|
||||
and <literal>${appliance-distro}/keycloak/standalone/configuration/themes/account/template</literal>.
|
||||
For the WAR distro, there is a zip file in the examples directory called <literal>keycloak-example-themes-dist.zip</literal>
|
||||
which you will need to unzip in the <literal>standalone/configuration</literal> or <literal>domain/configuration</literal>
|
||||
directory if the JBoss or Wildfly instance you have deployed Keycloak server to.
|
||||
</para>
|
||||
</section>
|
||||
</section>
|
||||
|
||||
<section>
|
||||
@@ -154,7 +153,7 @@
|
||||
</para>
|
||||
<para>
|
||||
Keycloaks default account management provider is built on the FreeMarker template engine (<literal>forms/account-freemarker</literal>).
|
||||
To make sure your provider is loaded you will either need to delete <literal>standalone/deployments/auth-server.war/WEB-INF/lib/keycloak-account-freemarker-1.0-beta-2.jar</literal>
|
||||
To make sure your provider is loaded you will either need to delete <literal>standalone/deployments/auth-server.war/WEB-INF/lib/keycloak-account-freemarker-1.0-beta-1-SNAPSHOT.jar</literal>
|
||||
or disable it with the system property <literal>org.keycloak.account.freemarker.FreeMarkerAccountProviderFactory</literal>.
|
||||
</para>
|
||||
</section>
|
||||
@@ -167,7 +166,7 @@
|
||||
</para>
|
||||
<para>
|
||||
Keycloaks default login forms provider is built on the FreeMarker template engine (<literal>forms/login-freemarker</literal>).
|
||||
To make sure your provider is loaded you will either need to delete <literal>standalone/deployments/auth-server.war/WEB-INF/lib/keycloak-login-freemarker-1.0-beta-2.jar</literal>
|
||||
To make sure your provider is loaded you will either need to delete <literal>standalone/deployments/auth-server.war/WEB-INF/lib/keycloak-login-freemarker-1.0-beta-1-SNAPSHOT.jar</literal>
|
||||
or disable it with the system property <literal>org.keycloak.login.freemarker.FreeMarkerLoginFormsProviderFactory</literal>.
|
||||
</para>
|
||||
</section>
|
||||
|
||||
@@ -1,55 +1,40 @@
|
||||
<chapter id="timeouts">
|
||||
<title>Cookie settings, Session Timeouts, and Token Lifespans</title>
|
||||
<title>Cookie Timeouts and Token Lifespans</title>
|
||||
<para>
|
||||
Keycloak has a bunch of fine-grain settings to manage browser cookies, user login sessions, and token lifespans.
|
||||
Sessions can be viewed and managed within the admin console for all users, and individually in the user's account
|
||||
management pages. This chapter goes over configuration options for cookies, sessions, and tokens.
|
||||
If you go to the Settings->Token page of the Keycloak adminstration console there is a bunch of fine tuning
|
||||
you can do as far as login session timeouts go.
|
||||
</para>
|
||||
<para>
|
||||
If you turn on the <literal>Remember Me</literal> switch in the admin console, your login pages will show a
|
||||
"Remember Me" checkbox. This will set the central login SSO cookie to be a persistent cookie rather than a session
|
||||
cookie. So, if you close your browser, you may still be logged in if you've checked the "Remember Me" checkbox.
|
||||
</para>
|
||||
<para>
|
||||
The <literal>Central Login Lifespan</literal> sets how long a central login is valid for. When you are redirected
|
||||
to the Keycloak Server for authentication, and you have already logged in, the Keycloak Server will refresh the
|
||||
cookie used to remember you by between visits. So, the lifespan time is reset. If you have "Remember Me"
|
||||
set up, you may want to set this lifespan to be days, weeks, or even months. Usually though you want it long
|
||||
enough so users can browser various applications that are secured centrally by keycloak in one login session.
|
||||
</para>
|
||||
<para>
|
||||
The <literal>Access Token Lifespan</literal> is how long an access token is valid for. An access token contains everything
|
||||
an application needs to authorize a client. It contains roles allowed as well as other user information. When
|
||||
an access token expires, your application will attempt to refresh it using a refresh token that it obtained in the
|
||||
initial login. The value of this configuration option should be however long you feel comfortable with the
|
||||
application not knowing if the user's permissions have changed. This value is usually in minutes or hours.
|
||||
</para>
|
||||
<para>
|
||||
The <literal>Refresh Token Lifespan</literal> is how long a refresh token is valid for. The value of this is relative
|
||||
to how comfortable you feel with how long you want an application's session to be valid. This value is usually
|
||||
measured in minutes or hours and should be longer than the Access Token Lifespan.
|
||||
</para>
|
||||
<para>
|
||||
The <literal>Access Code Lifespan</literal> is how long an access code is valid for. An access code is obtained
|
||||
on the 1st leg of the OAuth 2.0 redirection protocol. This should be a short time limit. Usually seconds.
|
||||
</para>
|
||||
<para>
|
||||
The <literal>Access Code Action Lifespan</literal> is how long a user is allowed to attempt a login. When a user tries
|
||||
to login, they may have to change their password, set up TOTP, or perform some other action before they are redirected
|
||||
back to your application as an authentnicated user. This value is relatively short and is usually measured in minutes.
|
||||
</para>
|
||||
<section>
|
||||
<title>Remember Me</title>
|
||||
<para>
|
||||
If you go to the admin console page of Settings->General, you should see a <literal>Remember Me</literal> on/off switch.
|
||||
Your realm sets a SSO cookie so that you only have to enter in your login credentials once.
|
||||
This <literal>Remember Me</literal> admin config option, when turned on, will show a "Remember Me" checkbox on the user's login page.
|
||||
If the user clicks this, the realm's SSO. cookie will be persistent. This means that if the user closes their browser
|
||||
they will still be logged in the next time they start up their browser.
|
||||
</para>
|
||||
</section>
|
||||
<section id="session-timeouts">
|
||||
<title>Session Timeouts</title>
|
||||
<para>
|
||||
If you go to the Sesions and Tokens->Token Settings page of the Keycloak adminstration console there is a bunch of fine tuning
|
||||
you can do as far as login session timeouts go.
|
||||
</para>
|
||||
<para>
|
||||
The <literal>SSO Session Idle Timeout</literal> is the idle time of a user session. If there is no activity
|
||||
in the user's session for this amount of time, the user session will be destroyed, and the user will become logged
|
||||
out. The idle time is refreshed with every action against the keycloak server for that session, i.e.: a user login,
|
||||
SSO, a refresh token grant, etc.
|
||||
</para>
|
||||
<para>
|
||||
The <literal>SSO Session Max Lifespan</literal> setting is the maximum time a user session is allowed to be alive. This
|
||||
max lifespan countdown starts from when the user first logs in and is never refreshed. This works great with <literal>Remember Me</literal>
|
||||
in that it allow you to force a relogin after a set timeframe.
|
||||
</para>
|
||||
</section>
|
||||
<section>
|
||||
<title>Token Timeouts</title>
|
||||
<para>
|
||||
The <literal>Access Token Lifespan</literal> is how long an access token is valid for. An access token contains everything
|
||||
an application needs to authorize a client. It contains roles allowed as well as other user information. When
|
||||
an access token expires, your application will attempt to refresh it using a refresh token that it obtained in the
|
||||
initial login. The value of this configuration option should be however long you feel comfortable with the
|
||||
application not knowing if the user's permissions have changed. This value is usually in minutes.
|
||||
</para>
|
||||
<para>
|
||||
The <literal>Access Code Lifespan</literal> is how long an access code is valid for. An access code is obtained
|
||||
on the 1st leg of the OAuth 2.0 redirection protocol. This should be a short time limit. Usually seconds.
|
||||
</para>
|
||||
<para>
|
||||
The <literal>Access Code Action Lifespan</literal> is how long a user is allowed to attempt a login. When a user tries
|
||||
to login, they may have to change their password, set up TOTP, or perform some other action before they are redirected
|
||||
back to your application as an authentnicated user. This value is relatively short and is usually measured in minutes.
|
||||
</para>
|
||||
</section>
|
||||
</chapter>
|
||||
@@ -8,11 +8,14 @@
|
||||
<script type="text/javascript" charset="utf-8">
|
||||
var keycloak = new Keycloak();
|
||||
|
||||
keycloak.onReady = updateState;
|
||||
keycloak.onAuthSuccess = updateState;
|
||||
keycloak.onAuthRefreshSuccess = updateState;
|
||||
keycloak.onAuthLogout = updateState;
|
||||
|
||||
function updateState() {
|
||||
console.debug('Updating state');
|
||||
|
||||
if (keycloak.authenticated) {
|
||||
document.getElementById('authenticated').style.display = 'block';
|
||||
document.getElementById('not-authenticated').style.display = 'none';
|
||||
@@ -28,7 +31,9 @@
|
||||
}
|
||||
|
||||
document.addEventListener("deviceready", function() {
|
||||
keycloak.init({ onLoad: 'check-sso' });
|
||||
console.debug('Device ready');
|
||||
|
||||
keycloak.init('check-sso');
|
||||
}, false);
|
||||
</script>
|
||||
</head>
|
||||
@@ -37,7 +42,6 @@
|
||||
<div>
|
||||
<button onclick="keycloak.logout()">Log out</button>
|
||||
<button onclick="keycloak.updateToken()">Refresh token</button>
|
||||
<button onclick="keycloak.updateToken(9999)">Force Refresh token</button>
|
||||
<button onclick="keycloak.accountManagement()">Manage account</button>
|
||||
</div>
|
||||
<div>
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0-beta-2</version>
|
||||
<version>1.0-beta-1-SNAPSHOT</version>
|
||||
<relativePath>../../../pom.xml</relativePath>
|
||||
</parent>
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
@@ -20,16 +20,7 @@
|
||||
<plugin>
|
||||
<groupId>org.jboss.as.plugins</groupId>
|
||||
<artifactId>jboss-as-maven-plugin</artifactId>
|
||||
<configuration>
|
||||
<skip>false</skip>
|
||||
</configuration>
|
||||
</plugin>
|
||||
<plugin>
|
||||
<groupId>org.wildfly.plugins</groupId>
|
||||
<artifactId>wildfly-maven-plugin</artifactId>
|
||||
<configuration>
|
||||
<skip>false</skip>
|
||||
</configuration>
|
||||
<version>7.4.Final</version>
|
||||
</plugin>
|
||||
<plugin>
|
||||
<groupId>org.apache.maven.plugins</groupId>
|
||||
|
||||
@@ -34,24 +34,6 @@
|
||||
</tbody>
|
||||
</table>
|
||||
</div>
|
||||
<div>
|
||||
<h2><span>Realm Roles</span></h2>
|
||||
<button type="submit" data-ng-click="loadRoles()">load Roles</button>
|
||||
<button type="submit" data-ng-click="addRole()">Add Role</button>
|
||||
<button type="submit" data-ng-click="deleteRole()">Delete Role</button>
|
||||
<table class="table" data-ng-show="roles.length > 0">
|
||||
<thead>
|
||||
<tr>
|
||||
<th>Role Listing</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
<tr data-ng-repeat="r in roles">
|
||||
<td>{{r.name}}</a></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
</div>
|
||||
</div>
|
||||
</body>
|
||||
</html>
|
||||
+1
-23
@@ -10,12 +10,10 @@ var logout = function(){
|
||||
|
||||
|
||||
angular.element(document).ready(function ($http) {
|
||||
console.log("*** here");
|
||||
var keycloakAuth = new Keycloak('keycloak.json');
|
||||
auth.loggedIn = false;
|
||||
|
||||
keycloakAuth.init({ onLoad: 'login-required' }).success(function () {
|
||||
console.log('here login');
|
||||
keycloakAuth.init('login-required').success(function () {
|
||||
auth.loggedIn = true;
|
||||
auth.authz = keycloakAuth;
|
||||
auth.logoutUrl = keycloakAuth.authServerUrl + "/realms/" + keycloakAuth.realm + "/tokens/logout?redirect_uri=http://localhost:8080/angular-product/index.html";
|
||||
@@ -31,32 +29,12 @@ angular.element(document).ready(function ($http) {
|
||||
|
||||
module.controller('GlobalCtrl', function($scope, $http) {
|
||||
$scope.products = [];
|
||||
$scope.roles = [];
|
||||
$scope.reloadData = function() {
|
||||
$http.get("http://localhost-db:8080/database/products").success(function(data) {
|
||||
$scope.products = angular.fromJson(data);
|
||||
|
||||
});
|
||||
|
||||
};
|
||||
$scope.loadRoles = function() {
|
||||
$http.get("http://localhost-auth:8080/auth/admin/realms/" + auth.authz.realm + "/roles").success(function(data) {
|
||||
$scope.roles = angular.fromJson(data);
|
||||
|
||||
});
|
||||
|
||||
};
|
||||
$scope.addRole = function() {
|
||||
$http.post("http://localhost-auth:8080/auth/admin/realms/" + auth.authz.realm + "/roles", {name: 'stuff'}).success(function() {
|
||||
$scope.loadRoles();
|
||||
});
|
||||
|
||||
};
|
||||
$scope.deleteRole = function() {
|
||||
$http.delete("http://localhost-auth:8080/auth/admin/realms/" + auth.authz.realm + "/roles/stuff").success(function() {
|
||||
$scope.loadRoles();
|
||||
});
|
||||
|
||||
};
|
||||
$scope.logout = logout;
|
||||
});
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
{
|
||||
"realm" : "cors",
|
||||
"realm" : "cors-realm",
|
||||
"realm-public-key" : "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCrVrCuTtArbgaZzL1hvh0xtL5mc7o0NqPVnYXkLvgcwiC3BjLGw1tGEGoJaXDuSaRllobm53JBhjx33UNv+5z/UMG4kytBWxheNVKnL6GgqlNabMaFfPLPCF8kAgKnsi79NMo+n6KnSY8YeUmec/p2vjO2NjsSAVcWEQMVhJ31LwIDAQAB",
|
||||
"auth-server-url" : "http://localhost-auth:8080/auth",
|
||||
"ssl-not-required" : true,
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
{
|
||||
"realm": "cors",
|
||||
"realm": "cors-realm",
|
||||
"enabled": true,
|
||||
"accessTokenLifespan": 3000,
|
||||
"accessCodeLifespan": 10,
|
||||
@@ -57,22 +57,5 @@
|
||||
"http://localhost:8080"
|
||||
]
|
||||
}
|
||||
],
|
||||
"applicationRoleMappings": {
|
||||
"realm-management": [
|
||||
{
|
||||
"username": "bburke@redhat.com",
|
||||
"roles": ["realm-admin"]
|
||||
}
|
||||
]
|
||||
},
|
||||
"applicationScopeMappings": {
|
||||
"realm-management": [
|
||||
{
|
||||
"client": "angular-product",
|
||||
"roles": ["realm-admin"]
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
]
|
||||
}
|
||||
@@ -4,7 +4,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0-beta-2</version>
|
||||
<version>1.0-beta-1-SNAPSHOT</version>
|
||||
<relativePath>../../../pom.xml</relativePath>
|
||||
</parent>
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
@@ -57,20 +57,6 @@
|
||||
<build>
|
||||
<finalName>database</finalName>
|
||||
<plugins>
|
||||
<plugin>
|
||||
<groupId>org.jboss.as.plugins</groupId>
|
||||
<artifactId>jboss-as-maven-plugin</artifactId>
|
||||
<configuration>
|
||||
<skip>false</skip>
|
||||
</configuration>
|
||||
</plugin>
|
||||
<plugin>
|
||||
<groupId>org.wildfly.plugins</groupId>
|
||||
<artifactId>wildfly-maven-plugin</artifactId>
|
||||
<configuration>
|
||||
<skip>false</skip>
|
||||
</configuration>
|
||||
</plugin>
|
||||
<plugin>
|
||||
<groupId>org.apache.maven.plugins</groupId>
|
||||
<artifactId>maven-deploy-plugin</artifactId>
|
||||
@@ -78,6 +64,11 @@
|
||||
<skip>true</skip>
|
||||
</configuration>
|
||||
</plugin>
|
||||
<plugin>
|
||||
<groupId>org.jboss.as.plugins</groupId>
|
||||
<artifactId>jboss-as-maven-plugin</artifactId>
|
||||
<version>7.4.Final</version>
|
||||
</plugin>
|
||||
<plugin>
|
||||
<groupId>org.apache.maven.plugins</groupId>
|
||||
<artifactId>maven-compiler-plugin</artifactId>
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0-beta-2</version>
|
||||
<version>1.0-beta-1-SNAPSHOT</version>
|
||||
<relativePath>../../pom.xml</relativePath>
|
||||
</parent>
|
||||
<name>Examples</name>
|
||||
@@ -22,6 +22,14 @@
|
||||
<skip>true</skip>
|
||||
</configuration>
|
||||
</plugin>
|
||||
<plugin>
|
||||
<groupId>org.jboss.as.plugins</groupId>
|
||||
<artifactId>jboss-as-maven-plugin</artifactId>
|
||||
<version>7.1.1.Final</version>
|
||||
<configuration>
|
||||
<skip>true</skip>
|
||||
</configuration>
|
||||
</plugin>
|
||||
</plugins>
|
||||
</build>
|
||||
<modules>
|
||||
|
||||
@@ -6,7 +6,6 @@ The following examples requires Wildfly 8.0.0, JBoss EAP 6.x, or JBoss AS 7.1.1.
|
||||
* Transferring identity and role mappings via a special bearer token (Skeleton Key Token).
|
||||
* Bearer token authentication and authorization of JAX-RS services
|
||||
* Obtaining bearer tokens via the OAuth2 protocol
|
||||
* Interact with the Keycloak Admin REST Api
|
||||
|
||||
There are multiple WAR projects. These will all run on the same WildFly instance, but pretend each one is running on a different
|
||||
machine on the network or Internet.
|
||||
@@ -14,7 +13,6 @@ machine on the network or Internet.
|
||||
* **customer-app-js** A pure HTML/Javascript application that does remote login using OAuth2 browser redirects with the auth server
|
||||
* **customer-app-cli** A pure CLI application that does remote login using OAuth2 browser redirects with the auth server
|
||||
* **product-app** A WAR application that does remote login using OAuth2 browser redirects with the auth server
|
||||
* **admin-access-app** A WAR application that does remote REST login to admin console to obtain a list of realm roles from Admin REST API
|
||||
* **database-service** JAX-RS services authenticated by bearer tokens only. The customer and product app invoke on it to get data
|
||||
* **third-party** Simple WAR that obtain a bearer token using OAuth2 using browser redirects to the auth-server.
|
||||
* **third-party-cdi** Simple CDI/JSF WAR that obtain a bearer token using OAuth2 using browser redirects to the auth-server.
|
||||
@@ -123,19 +121,28 @@ next you must build and deploy
|
||||
```
|
||||
cd preconfigured-demo
|
||||
mvn clean install
|
||||
```
|
||||
|
||||
On EAP6/AS7 run:
|
||||
|
||||
```
|
||||
mvn jboss-as:deploy
|
||||
```
|
||||
|
||||
Or for WildFly run:
|
||||
Please note that jboss-as:deploy may fail on Wildfly distributions. This is because Wildfly 8.0.0.Final has turned
|
||||
off a management interface. You will hae to add this back in order to run the build. Edit standalone/configuration/standalone.xml
|
||||
|
||||
Add the native-itnerface to <management> element's <management-interfaces>:
|
||||
|
||||
<management>
|
||||
<management-interfaces>
|
||||
<native-interface security-realm="ManagementRealm">
|
||||
<socket-binding native="management-native"/>
|
||||
</native-interface>
|
||||
...
|
||||
</management-interfaces>
|
||||
</management>
|
||||
|
||||
Then add a socket port mapping for the management interface :
|
||||
|
||||
<socket-binding-group name="standard-sockets" default-interface="public" port-offset="${jboss.socket.binding.port-offset:0}">
|
||||
<socket-binding name="management-native" interface="management" port="${jboss.management.native.port:9999}"/>
|
||||
|
||||
```
|
||||
mvn wildfly:deploy
|
||||
```
|
||||
|
||||
|
||||
Step 5: Login and Observe Apps
|
||||
@@ -177,16 +184,6 @@ The CLI example has two alternative methods for login. When a browser is availab
|
||||
temporary web server on a free port. If a browser is not available the URL to login is displayed on the CLI. The user can copy this URL to another computer that has a browser available. The code
|
||||
is displayed to the user after login and the user has to copy this code back to the application.
|
||||
|
||||
Step 8: Admin REST API
|
||||
----------------------------------
|
||||
Keycloak has a Admin REST API. This example shows an application making a remove direct login to Keycloak to obtain a token
|
||||
then using that token to access the Admin REST API.
|
||||
|
||||
[http://localhost:8080/admin-access](http://localhost:8080/admin-access)
|
||||
|
||||
If you are already logged in, you will not be asked for a username and password, but you will be redirected to
|
||||
an oauth grant page. This page asks you if you want to grant certain permissions to the third-part app.
|
||||
|
||||
Admin Console
|
||||
==========================
|
||||
|
||||
|
||||
@@ -1,85 +0,0 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
||||
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0-beta-2</version>
|
||||
<relativePath>../../../pom.xml</relativePath>
|
||||
</parent>
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
<groupId>org.keycloak.example.demo</groupId>
|
||||
<artifactId>admin-access-example</artifactId>
|
||||
<packaging>war</packaging>
|
||||
<name>Admin Access Example</name>
|
||||
<description/>
|
||||
|
||||
<repositories>
|
||||
<repository>
|
||||
<id>jboss</id>
|
||||
<name>jboss repo</name>
|
||||
<url>http://repository.jboss.org/nexus/content/groups/public/</url>
|
||||
</repository>
|
||||
</repositories>
|
||||
|
||||
<dependencies>
|
||||
<dependency>
|
||||
<groupId>org.jboss.spec.javax.servlet</groupId>
|
||||
<artifactId>jboss-servlet-api_3.0_spec</artifactId>
|
||||
<scope>provided</scope>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<artifactId>keycloak-core</artifactId>
|
||||
<version>${project.version}</version>
|
||||
<scope>provided</scope>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<artifactId>keycloak-adapter-core</artifactId>
|
||||
<version>${project.version}</version>
|
||||
<scope>provided</scope>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>org.apache.httpcomponents</groupId>
|
||||
<artifactId>httpclient</artifactId>
|
||||
<version>${keycloak.apache.httpcomponents.version}</version>
|
||||
<scope>provided</scope>
|
||||
</dependency>
|
||||
</dependencies>
|
||||
|
||||
<build>
|
||||
<finalName>admin-access</finalName>
|
||||
<plugins>
|
||||
<plugin>
|
||||
<groupId>org.jboss.as.plugins</groupId>
|
||||
<artifactId>jboss-as-maven-plugin</artifactId>
|
||||
<configuration>
|
||||
<skip>false</skip>
|
||||
</configuration>
|
||||
</plugin>
|
||||
<plugin>
|
||||
<groupId>org.wildfly.plugins</groupId>
|
||||
<artifactId>wildfly-maven-plugin</artifactId>
|
||||
<configuration>
|
||||
<skip>false</skip>
|
||||
</configuration>
|
||||
</plugin>
|
||||
<plugin>
|
||||
<groupId>org.apache.maven.plugins</groupId>
|
||||
<artifactId>maven-deploy-plugin</artifactId>
|
||||
<configuration>
|
||||
<skip>true</skip>
|
||||
</configuration>
|
||||
</plugin>
|
||||
<plugin>
|
||||
<groupId>org.apache.maven.plugins</groupId>
|
||||
<artifactId>maven-compiler-plugin</artifactId>
|
||||
<configuration>
|
||||
<source>${maven.compiler.source}</source>
|
||||
<target>${maven.compiler.target}</target>
|
||||
</configuration>
|
||||
</plugin>
|
||||
</plugins>
|
||||
</build>
|
||||
</project>
|
||||
-146
@@ -1,146 +0,0 @@
|
||||
package org.keycloak.example;
|
||||
|
||||
import org.apache.http.HttpEntity;
|
||||
import org.apache.http.HttpResponse;
|
||||
import org.apache.http.NameValuePair;
|
||||
import org.apache.http.client.HttpClient;
|
||||
import org.apache.http.client.entity.UrlEncodedFormEntity;
|
||||
import org.apache.http.client.methods.HttpGet;
|
||||
import org.apache.http.client.methods.HttpPost;
|
||||
import org.apache.http.message.BasicNameValuePair;
|
||||
import org.keycloak.OAuth2Constants;
|
||||
import org.keycloak.ServiceUrlConstants;
|
||||
import org.keycloak.adapters.HttpClientBuilder;
|
||||
import org.keycloak.representations.AccessTokenResponse;
|
||||
import org.keycloak.representations.idm.RoleRepresentation;
|
||||
import org.keycloak.util.JsonSerialization;
|
||||
import org.keycloak.util.KeycloakUriBuilder;
|
||||
|
||||
import java.io.ByteArrayOutputStream;
|
||||
import java.io.IOException;
|
||||
import java.io.InputStream;
|
||||
import java.util.ArrayList;
|
||||
import java.util.List;
|
||||
|
||||
/**
|
||||
* @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
|
||||
* @version $Revision: 1 $
|
||||
*/
|
||||
public class AdminClient {
|
||||
|
||||
static class TypedList extends ArrayList<RoleRepresentation> {
|
||||
}
|
||||
|
||||
public static class Failure extends Exception {
|
||||
private int status;
|
||||
|
||||
public Failure(int status) {
|
||||
this.status = status;
|
||||
}
|
||||
|
||||
public int getStatus() {
|
||||
return status;
|
||||
}
|
||||
}
|
||||
|
||||
public static AccessTokenResponse getToken() throws IOException {
|
||||
|
||||
HttpClient client = new HttpClientBuilder()
|
||||
.disableTrustManager().build();
|
||||
|
||||
|
||||
try {
|
||||
HttpPost post = new HttpPost(KeycloakUriBuilder.fromUri("http://localhost:8080/auth")
|
||||
.path(ServiceUrlConstants.TOKEN_SERVICE_DIRECT_GRANT_PATH).build("demo"));
|
||||
List <NameValuePair> formparams = new ArrayList <NameValuePair>();
|
||||
formparams.add(new BasicNameValuePair("username", "admin"));
|
||||
formparams.add(new BasicNameValuePair("password", "password"));
|
||||
formparams.add(new BasicNameValuePair(OAuth2Constants.CLIENT_ID, "admin-client"));
|
||||
UrlEncodedFormEntity form = new UrlEncodedFormEntity(formparams, "UTF-8");
|
||||
post.setEntity(form);
|
||||
|
||||
HttpResponse response = client.execute(post);
|
||||
int status = response.getStatusLine().getStatusCode();
|
||||
HttpEntity entity = response.getEntity();
|
||||
if (status != 200) {
|
||||
throw new IOException("Bad status: " + status);
|
||||
}
|
||||
if (entity == null) {
|
||||
throw new IOException("No Entity");
|
||||
}
|
||||
InputStream is = entity.getContent();
|
||||
try {
|
||||
ByteArrayOutputStream os = new ByteArrayOutputStream();
|
||||
int c;
|
||||
while ((c = is.read()) != -1) {
|
||||
os.write(c);
|
||||
}
|
||||
byte[] bytes = os.toByteArray();
|
||||
String json = new String(bytes);
|
||||
try {
|
||||
return JsonSerialization.readValue(json, AccessTokenResponse.class);
|
||||
} catch (IOException e) {
|
||||
throw new IOException(json, e);
|
||||
}
|
||||
} finally {
|
||||
try {
|
||||
is.close();
|
||||
} catch (IOException ignored) {
|
||||
|
||||
}
|
||||
}
|
||||
} finally {
|
||||
client.getConnectionManager().shutdown();
|
||||
}
|
||||
}
|
||||
|
||||
public static void logout(AccessTokenResponse res) throws IOException {
|
||||
|
||||
HttpClient client = new HttpClientBuilder()
|
||||
.disableTrustManager().build();
|
||||
|
||||
|
||||
try {
|
||||
HttpGet get = new HttpGet(KeycloakUriBuilder.fromUri("http://localhost:8080/auth")
|
||||
.path(ServiceUrlConstants.TOKEN_SERVICE_LOGOUT_PATH)
|
||||
.queryParam("session_state", res.getSessionState())
|
||||
.build("demo"));
|
||||
HttpResponse response = client.execute(get);
|
||||
HttpEntity entity = response.getEntity();
|
||||
if (entity == null) {
|
||||
return;
|
||||
}
|
||||
InputStream is = entity.getContent();
|
||||
if (is != null) is.close();
|
||||
} finally {
|
||||
client.getConnectionManager().shutdown();
|
||||
}
|
||||
}
|
||||
|
||||
public static List<RoleRepresentation> getRealmRoles(AccessTokenResponse res) throws Failure {
|
||||
|
||||
HttpClient client = new HttpClientBuilder()
|
||||
.disableTrustManager().build();
|
||||
try {
|
||||
HttpGet get = new HttpGet("http://localhost:8080/auth/admin/realms/demo/roles");
|
||||
get.addHeader("Authorization", "Bearer " + res.getToken());
|
||||
try {
|
||||
HttpResponse response = client.execute(get);
|
||||
if (response.getStatusLine().getStatusCode() != 200) {
|
||||
throw new Failure(response.getStatusLine().getStatusCode());
|
||||
}
|
||||
HttpEntity entity = response.getEntity();
|
||||
InputStream is = entity.getContent();
|
||||
try {
|
||||
return JsonSerialization.readValue(is, TypedList.class);
|
||||
} finally {
|
||||
is.close();
|
||||
}
|
||||
} catch (IOException e) {
|
||||
throw new RuntimeException(e);
|
||||
}
|
||||
} finally {
|
||||
client.getConnectionManager().shutdown();
|
||||
}
|
||||
}
|
||||
}
|
||||
-9
@@ -1,9 +0,0 @@
|
||||
<jboss-deployment-structure>
|
||||
<deployment>
|
||||
<dependencies>
|
||||
<!-- the Demo code uses classes in these modules. These are optional to import if you are not using
|
||||
Apache Http Client or the HttpClientBuilder that comes with the adapter core -->
|
||||
<module name="org.apache.httpcomponents"/>
|
||||
</dependencies>
|
||||
</deployment>
|
||||
</jboss-deployment-structure>
|
||||
@@ -1,9 +0,0 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<web-app xmlns="http://java.sun.com/xml/ns/javaee"
|
||||
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
||||
xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"
|
||||
version="3.0">
|
||||
|
||||
<module-name>admin-access</module-name>
|
||||
|
||||
</web-app>
|
||||
@@ -1,9 +0,0 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<web-app xmlns="http://java.sun.com/xml/ns/javaee"
|
||||
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
||||
xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"
|
||||
version="3.0">
|
||||
|
||||
<module-name>admin-access</module-name>
|
||||
|
||||
</web-app>
|
||||
@@ -1,30 +0,0 @@
|
||||
<%@ page import="org.keycloak.representations.idm.RoleRepresentation" %>
|
||||
<%@ page import="org.keycloak.example.AdminClient" %>
|
||||
<%@ page import="org.keycloak.representations.AccessTokenResponse" %>
|
||||
<%@ page language="java" contentType="text/html; charset=ISO-8859-1"
|
||||
pageEncoding="ISO-8859-1" %>
|
||||
<html>
|
||||
<head>
|
||||
<title>Admin Interface</title>
|
||||
</head>
|
||||
<body bgcolor="#E3F6CE">
|
||||
<h2>List of Realm Roles from Admin REST API Call</h2>
|
||||
<%
|
||||
java.util.List<RoleRepresentation> list = null;
|
||||
try {
|
||||
AccessTokenResponse res = AdminClient.getToken();
|
||||
list = AdminClient.getRealmRoles(res);
|
||||
AdminClient.logout(res);
|
||||
} catch (AdminClient.Failure failure) {
|
||||
out.println("There was a failure processing request. You either didn't configure Keycloak properly");
|
||||
out.println("Status from database service invocation was: " + failure.getStatus());
|
||||
return;
|
||||
}
|
||||
for (RoleRepresentation role : list) {
|
||||
out.print("<p>");
|
||||
out.print(role.getName());
|
||||
out.println("</p>");
|
||||
|
||||
}
|
||||
%></body>
|
||||
</html>
|
||||
@@ -1,5 +0,0 @@
|
||||
<html>
|
||||
<head>
|
||||
<meta http-equiv="Refresh" content="0; URL=admin/admin.jsp">
|
||||
</head>
|
||||
</html>
|
||||
@@ -4,7 +4,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0-beta-2</version>
|
||||
<version>1.0-beta-1-20150523</version>
|
||||
<relativePath>../../../pom.xml</relativePath>
|
||||
</parent>
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
@@ -20,16 +20,7 @@
|
||||
<plugin>
|
||||
<groupId>org.jboss.as.plugins</groupId>
|
||||
<artifactId>jboss-as-maven-plugin</artifactId>
|
||||
<configuration>
|
||||
<skip>false</skip>
|
||||
</configuration>
|
||||
</plugin>
|
||||
<plugin>
|
||||
<groupId>org.wildfly.plugins</groupId>
|
||||
<artifactId>wildfly-maven-plugin</artifactId>
|
||||
<configuration>
|
||||
<skip>false</skip>
|
||||
</configuration>
|
||||
<version>7.4.Final</version>
|
||||
</plugin>
|
||||
<plugin>
|
||||
<groupId>org.apache.maven.plugins</groupId>
|
||||
|
||||
@@ -13,7 +13,7 @@ angular.element(document).ready(function ($http) {
|
||||
var keycloakAuth = new Keycloak('keycloak.json');
|
||||
auth.loggedIn = false;
|
||||
|
||||
keycloakAuth.init({ onLoad: 'login-required' }).success(function () {
|
||||
keycloakAuth.init('login-required').success(function () {
|
||||
auth.loggedIn = true;
|
||||
auth.authz = keycloakAuth;
|
||||
auth.logoutUrl = keycloakAuth.authServerUrl + "/realms/demo/tokens/logout?redirect_uri=http://localhost:8080/angular-product/index.html";
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0-beta-2</version>
|
||||
<version>1.0-beta-1-20150523</version>
|
||||
<relativePath>../../../pom.xml</relativePath>
|
||||
</parent>
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
@@ -17,17 +17,21 @@
|
||||
<dependencies>
|
||||
<dependency>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<artifactId>keycloak-installed-adapter</artifactId>
|
||||
<artifactId>keycloak-installed</artifactId>
|
||||
<version>${project.version}</version>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>org.jboss.logging</groupId>
|
||||
<artifactId>jboss-logging</artifactId>
|
||||
</dependency>
|
||||
</dependencies>
|
||||
|
||||
<build>
|
||||
<plugins>
|
||||
<plugin>
|
||||
<groupId>org.jboss.as.plugins</groupId>
|
||||
<artifactId>jboss-as-maven-plugin</artifactId>
|
||||
<version>7.4.Final</version>
|
||||
<configuration>
|
||||
<skip>true</skip>
|
||||
</configuration>
|
||||
</plugin>
|
||||
<plugin>
|
||||
<groupId>org.apache.maven.plugins</groupId>
|
||||
<artifactId>maven-deploy-plugin</artifactId>
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
{
|
||||
"realm" : "demo",
|
||||
"realm-public-key" : "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCrVrCuTtArbgaZzL1hvh0xtL5mc7o0NqPVnYXkLvgcwiC3BjLGw1tGEGoJaXDuSaRllobm53JBhjx33UNv+5z/UMG4kytBWxheNVKnL6GgqlNabMaFfPLPCF8kAgKnsi79NMo+n6KnSY8YeUmec/p2vjO2NjsSAVcWEQMVhJ31LwIDAQAB",
|
||||
"auth-server-url" : "http://localhost:8080/auth",
|
||||
"auth-server-url" : "http://localhost:8081/auth",
|
||||
"ssl-not-required" : true,
|
||||
"resource" : "customer-portal-cli",
|
||||
"public-client" : true
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0-beta-2</version>
|
||||
<version>1.0-beta-1-20150523</version>
|
||||
<relativePath>../../../pom.xml</relativePath>
|
||||
</parent>
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
@@ -20,16 +20,7 @@
|
||||
<plugin>
|
||||
<groupId>org.jboss.as.plugins</groupId>
|
||||
<artifactId>jboss-as-maven-plugin</artifactId>
|
||||
<configuration>
|
||||
<skip>false</skip>
|
||||
</configuration>
|
||||
</plugin>
|
||||
<plugin>
|
||||
<groupId>org.wildfly.plugins</groupId>
|
||||
<artifactId>wildfly-maven-plugin</artifactId>
|
||||
<configuration>
|
||||
<skip>false</skip>
|
||||
</configuration>
|
||||
<version>7.4.Final</version>
|
||||
</plugin>
|
||||
<plugin>
|
||||
<groupId>org.apache.maven.plugins</groupId>
|
||||
|
||||
@@ -22,25 +22,25 @@ User <b id="subject"></b> made this request.
|
||||
var keycloak = Keycloak('../keycloak.json');
|
||||
|
||||
var loadData = function () {
|
||||
document.getElementById('subject').innerHTML = keycloak.subject;
|
||||
document.getElementById('subject').innerText = keycloak.subject;
|
||||
|
||||
if (keycloak.idToken) {
|
||||
document.getElementById('profileType').innerHTML = 'IDToken';
|
||||
document.getElementById('username').innerHTML = keycloak.idToken.preferred_username;
|
||||
document.getElementById('email').innerHTML = keycloak.idToken.email;
|
||||
document.getElementById('name').innerHTML = keycloak.idToken.name;
|
||||
document.getElementById('givenName').innerHTML = keycloak.idToken.given_name;
|
||||
document.getElementById('familyName').innerHTML = keycloak.idToken.family_name;
|
||||
document.getElementById('profileType').innerText = 'IDToken';
|
||||
document.getElementById('username').innerText = keycloak.idToken.preferred_username;
|
||||
document.getElementById('email').innerText = keycloak.idToken.email;
|
||||
document.getElementById('name').innerText = keycloak.idToken.name;
|
||||
document.getElementById('givenName').innerText = keycloak.idToken.given_name;
|
||||
document.getElementById('familyName').innerText = keycloak.idToken.family_name;
|
||||
} else {
|
||||
keycloak.loadUserProfile(function() {
|
||||
document.getElementById('profileType').innerHTML = 'Account Service';
|
||||
document.getElementById('username').innerHTML = keycloak.profile.username;
|
||||
document.getElementById('email').innerHTML = keycloak.profile.email;
|
||||
document.getElementById('name').innerHTML = keycloak.profile.firstName + ' ' + keycloak.profile.lastName;
|
||||
document.getElementById('givenName').innerHTML = keycloak.profile.firstName;
|
||||
document.getElementById('familyName').innerHTML = keycloak.profile.lastName;
|
||||
document.getElementById('profileType').innerText = 'Account Service';
|
||||
document.getElementById('username').innerText = keycloak.profile.username;
|
||||
document.getElementById('email').innerText = keycloak.profile.email;
|
||||
document.getElementById('name').innerText = keycloak.profile.firstName + ' ' + keycloak.profile.lastName;
|
||||
document.getElementById('givenName').innerText = keycloak.profile.firstName;
|
||||
document.getElementById('familyName').innerText = keycloak.profile.lastName;
|
||||
}, function() {
|
||||
document.getElementById('profileType').innerHTML = 'Failed to retrieve user details. Please enable claims or account role';
|
||||
document.getElementById('profileType').innerText = 'Failed to retrieve user details. Please enable claims or account role';
|
||||
});
|
||||
}
|
||||
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0-beta-2</version>
|
||||
<version>1.0-beta-1-20150523</version>
|
||||
<relativePath>../../../pom.xml</relativePath>
|
||||
</parent>
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
@@ -54,16 +54,7 @@
|
||||
<plugin>
|
||||
<groupId>org.jboss.as.plugins</groupId>
|
||||
<artifactId>jboss-as-maven-plugin</artifactId>
|
||||
<configuration>
|
||||
<skip>false</skip>
|
||||
</configuration>
|
||||
</plugin>
|
||||
<plugin>
|
||||
<groupId>org.wildfly.plugins</groupId>
|
||||
<artifactId>wildfly-maven-plugin</artifactId>
|
||||
<configuration>
|
||||
<skip>false</skip>
|
||||
</configuration>
|
||||
<version>7.4.Final</version>
|
||||
</plugin>
|
||||
<plugin>
|
||||
<groupId>org.apache.maven.plugins</groupId>
|
||||
|
||||
-67
@@ -1,67 +0,0 @@
|
||||
package org.keycloak.example;
|
||||
|
||||
import org.apache.http.HttpEntity;
|
||||
import org.apache.http.HttpResponse;
|
||||
import org.apache.http.client.HttpClient;
|
||||
import org.apache.http.client.methods.HttpGet;
|
||||
import org.keycloak.KeycloakSecurityContext;
|
||||
import org.keycloak.adapters.HttpClientBuilder;
|
||||
import org.keycloak.representations.IDToken;
|
||||
import org.keycloak.representations.idm.RoleRepresentation;
|
||||
import org.keycloak.util.JsonSerialization;
|
||||
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import java.io.IOException;
|
||||
import java.io.InputStream;
|
||||
import java.util.ArrayList;
|
||||
import java.util.List;
|
||||
|
||||
/**
|
||||
* @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
|
||||
* @version $Revision: 1 $
|
||||
*/
|
||||
public class AdminClient {
|
||||
|
||||
static class TypedList extends ArrayList<RoleRepresentation> {
|
||||
}
|
||||
|
||||
public static class Failure extends Exception {
|
||||
private int status;
|
||||
|
||||
public Failure(int status) {
|
||||
this.status = status;
|
||||
}
|
||||
|
||||
public int getStatus() {
|
||||
return status;
|
||||
}
|
||||
}
|
||||
|
||||
public static List<RoleRepresentation> getRealmRoles(HttpServletRequest req) throws Failure {
|
||||
KeycloakSecurityContext session = (KeycloakSecurityContext) req.getAttribute(KeycloakSecurityContext.class.getName());
|
||||
|
||||
HttpClient client = new HttpClientBuilder()
|
||||
.disableTrustManager().build();
|
||||
try {
|
||||
HttpGet get = new HttpGet("http://localhost:8080/auth/admin/realms/demo/roles");
|
||||
get.addHeader("Authorization", "Bearer " + session.getTokenString());
|
||||
try {
|
||||
HttpResponse response = client.execute(get);
|
||||
if (response.getStatusLine().getStatusCode() != 200) {
|
||||
throw new Failure(response.getStatusLine().getStatusCode());
|
||||
}
|
||||
HttpEntity entity = response.getEntity();
|
||||
InputStream is = entity.getContent();
|
||||
try {
|
||||
return JsonSerialization.readValue(is, TypedList.class);
|
||||
} finally {
|
||||
is.close();
|
||||
}
|
||||
} catch (IOException e) {
|
||||
throw new RuntimeException(e);
|
||||
}
|
||||
} finally {
|
||||
client.getConnectionManager().shutdown();
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,5 +1,3 @@
|
||||
<%@ page import="org.keycloak.representations.idm.RoleRepresentation" %>
|
||||
<%@ page import="org.keycloak.example.AdminClient" %>
|
||||
<%@ page language="java" contentType="text/html; charset=ISO-8859-1"
|
||||
pageEncoding="ISO-8859-1" %>
|
||||
<html>
|
||||
@@ -10,24 +8,5 @@
|
||||
<h1>Customer Admin Interface</h1>
|
||||
User <b><%=request.getUserPrincipal().getName()%>
|
||||
</b> made this request.
|
||||
<p>
|
||||
|
||||
</p>
|
||||
<h2>Admin REST To Get Role List of Realm</h2>
|
||||
<%
|
||||
java.util.List<RoleRepresentation> list = null;
|
||||
try {
|
||||
list = AdminClient.getRealmRoles(request);
|
||||
} catch (AdminClient.Failure failure) {
|
||||
out.println("There was a failure processing request. You either didn't configure Keycloak properly");
|
||||
out.println("Status from database service invocation was: " + failure.getStatus());
|
||||
return;
|
||||
}
|
||||
for (RoleRepresentation role : list) {
|
||||
out.print("<p>");
|
||||
out.print(role.getName());
|
||||
out.println("</p>");
|
||||
|
||||
}
|
||||
%></body>
|
||||
</body>
|
||||
</html>
|
||||
@@ -4,7 +4,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0-beta-2</version>
|
||||
<version>1.0-beta-1-20150523</version>
|
||||
<relativePath>../../../pom.xml</relativePath>
|
||||
</parent>
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
@@ -57,20 +57,6 @@
|
||||
<build>
|
||||
<finalName>database</finalName>
|
||||
<plugins>
|
||||
<plugin>
|
||||
<groupId>org.jboss.as.plugins</groupId>
|
||||
<artifactId>jboss-as-maven-plugin</artifactId>
|
||||
<configuration>
|
||||
<skip>false</skip>
|
||||
</configuration>
|
||||
</plugin>
|
||||
<plugin>
|
||||
<groupId>org.wildfly.plugins</groupId>
|
||||
<artifactId>wildfly-maven-plugin</artifactId>
|
||||
<configuration>
|
||||
<skip>false</skip>
|
||||
</configuration>
|
||||
</plugin>
|
||||
<plugin>
|
||||
<groupId>org.apache.maven.plugins</groupId>
|
||||
<artifactId>maven-deploy-plugin</artifactId>
|
||||
@@ -78,6 +64,11 @@
|
||||
<skip>true</skip>
|
||||
</configuration>
|
||||
</plugin>
|
||||
<plugin>
|
||||
<groupId>org.jboss.as.plugins</groupId>
|
||||
<artifactId>jboss-as-maven-plugin</artifactId>
|
||||
<version>7.4.Final</version>
|
||||
</plugin>
|
||||
<plugin>
|
||||
<groupId>org.apache.maven.plugins</groupId>
|
||||
<artifactId>maven-compiler-plugin</artifactId>
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0-beta-2</version>
|
||||
<version>1.0-beta-1-20150523</version>
|
||||
<relativePath>../../pom.xml</relativePath>
|
||||
</parent>
|
||||
<name>Examples</name>
|
||||
@@ -22,6 +22,14 @@
|
||||
<skip>true</skip>
|
||||
</configuration>
|
||||
</plugin>
|
||||
<plugin>
|
||||
<groupId>org.jboss.as.plugins</groupId>
|
||||
<artifactId>jboss-as-maven-plugin</artifactId>
|
||||
<version>7.1.1.Final</version>
|
||||
<configuration>
|
||||
<skip>true</skip>
|
||||
</configuration>
|
||||
</plugin>
|
||||
</plugins>
|
||||
</build>
|
||||
<modules>
|
||||
@@ -30,7 +38,6 @@
|
||||
<module>customer-app-cli</module>
|
||||
<module>customer-app-js</module>
|
||||
<module>product-app</module>
|
||||
<module>admin-access-app</module>
|
||||
<module>angular-product-app</module>
|
||||
<module>database-service</module>
|
||||
<module>third-party</module>
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0-beta-2</version>
|
||||
<version>1.0-beta-1-20150523</version>
|
||||
<relativePath>../../../pom.xml</relativePath>
|
||||
</parent>
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
@@ -59,16 +59,7 @@
|
||||
<plugin>
|
||||
<groupId>org.jboss.as.plugins</groupId>
|
||||
<artifactId>jboss-as-maven-plugin</artifactId>
|
||||
<configuration>
|
||||
<skip>false</skip>
|
||||
</configuration>
|
||||
</plugin>
|
||||
<plugin>
|
||||
<groupId>org.wildfly.plugins</groupId>
|
||||
<artifactId>wildfly-maven-plugin</artifactId>
|
||||
<configuration>
|
||||
<skip>false</skip>
|
||||
</configuration>
|
||||
<version>7.4.Final</version>
|
||||
</plugin>
|
||||
<plugin>
|
||||
<groupId>org.apache.maven.plugins</groupId>
|
||||
|
||||
@@ -1,12 +1,9 @@
|
||||
{
|
||||
"realm": "demo",
|
||||
"enabled": true,
|
||||
"accessTokenLifespan": 60,
|
||||
"accessCodeLifespan": 60,
|
||||
"accessCodeLifespanUserAction": 300,
|
||||
"ssoSessionIdleTimeout": 600,
|
||||
"ssoSessionMaxLifespan": 36000,
|
||||
"passwordCredentialGrantAllowed": true,
|
||||
"accessTokenLifespan": 3000,
|
||||
"accessCodeLifespan": 10,
|
||||
"accessCodeLifespanUserAction": 6000,
|
||||
"sslNotRequired": true,
|
||||
"registrationAllowed": false,
|
||||
"social": false,
|
||||
@@ -25,17 +22,6 @@
|
||||
{ "type" : "password",
|
||||
"value" : "password" }
|
||||
]
|
||||
},
|
||||
{
|
||||
"username" : "admin",
|
||||
"enabled": true,
|
||||
"email" : "admin@admin.com",
|
||||
"firstName": "Admin",
|
||||
"lastName": "Burke",
|
||||
"credentials" : [
|
||||
{ "type" : "password",
|
||||
"value" : "password" }
|
||||
]
|
||||
}
|
||||
],
|
||||
"roles" : {
|
||||
@@ -54,10 +40,6 @@
|
||||
{
|
||||
"username": "bburke@redhat.com",
|
||||
"roles": ["user"]
|
||||
},
|
||||
{
|
||||
"username": "admin",
|
||||
"roles": ["user","admin"]
|
||||
}
|
||||
],
|
||||
"scopeMappings": [
|
||||
@@ -67,14 +49,10 @@
|
||||
},
|
||||
{
|
||||
"client": "customer-portal",
|
||||
"roles": ["user", "admin" ]
|
||||
},
|
||||
{
|
||||
"client": "customer-portal-js",
|
||||
"roles": ["user"]
|
||||
},
|
||||
{
|
||||
"client": "customer-portal-cli",
|
||||
"client": "customer-portal-js",
|
||||
"roles": ["user"]
|
||||
},
|
||||
{
|
||||
@@ -83,7 +61,7 @@
|
||||
},
|
||||
{
|
||||
"client": "product-portal",
|
||||
"roles": ["user", "admin" ]
|
||||
"roles": ["user"]
|
||||
}
|
||||
|
||||
],
|
||||
@@ -145,13 +123,6 @@
|
||||
"http://localhost:8080/oauth-client-cdi/*"
|
||||
],
|
||||
"secret": "password"
|
||||
},
|
||||
{
|
||||
"name": "admin-client",
|
||||
"enabled": true,
|
||||
"publicClient": true,
|
||||
"directGrantsOnly": true
|
||||
|
||||
}
|
||||
],
|
||||
"applicationRoleMappings": {
|
||||
@@ -160,26 +131,7 @@
|
||||
"username": "bburke@redhat.com",
|
||||
"roles": ["manage-account"]
|
||||
}
|
||||
],
|
||||
"realm-management": [
|
||||
{
|
||||
"username": "admin",
|
||||
"roles": ["realm-admin"]
|
||||
}
|
||||
]
|
||||
},
|
||||
"applicationScopeMappings": {
|
||||
"realm-management": [
|
||||
{
|
||||
"client": "admin-client",
|
||||
"roles": ["realm-admin"]
|
||||
},
|
||||
{
|
||||
"client": "customer-portal",
|
||||
"roles": ["realm-admin"]
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
|
||||
}
|
||||
@@ -4,7 +4,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0-beta-2</version>
|
||||
<version>1.0-beta-1-20150523</version>
|
||||
<relativePath>../../../pom.xml</relativePath>
|
||||
</parent>
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
@@ -70,16 +70,7 @@
|
||||
<plugin>
|
||||
<groupId>org.jboss.as.plugins</groupId>
|
||||
<artifactId>jboss-as-maven-plugin</artifactId>
|
||||
<configuration>
|
||||
<skip>false</skip>
|
||||
</configuration>
|
||||
</plugin>
|
||||
<plugin>
|
||||
<groupId>org.wildfly.plugins</groupId>
|
||||
<artifactId>wildfly-maven-plugin</artifactId>
|
||||
<configuration>
|
||||
<skip>false</skip>
|
||||
</configuration>
|
||||
<version>7.4.Final</version>
|
||||
</plugin>
|
||||
<plugin>
|
||||
<groupId>org.apache.maven.plugins</groupId>
|
||||
|
||||
+2
-11
@@ -4,7 +4,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0-beta-2</version>
|
||||
<version>1.0-beta-1-20150523</version>
|
||||
<relativePath>../../../pom.xml</relativePath>
|
||||
</parent>
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
@@ -52,16 +52,7 @@
|
||||
<plugin>
|
||||
<groupId>org.jboss.as.plugins</groupId>
|
||||
<artifactId>jboss-as-maven-plugin</artifactId>
|
||||
<configuration>
|
||||
<skip>false</skip>
|
||||
</configuration>
|
||||
</plugin>
|
||||
<plugin>
|
||||
<groupId>org.wildfly.plugins</groupId>
|
||||
<artifactId>wildfly-maven-plugin</artifactId>
|
||||
<configuration>
|
||||
<skip>false</skip>
|
||||
</configuration>
|
||||
<version>7.4.Final</version>
|
||||
</plugin>
|
||||
<plugin>
|
||||
<groupId>org.apache.maven.plugins</groupId>
|
||||
|
||||
@@ -4,8 +4,8 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0-beta-2</version>
|
||||
<relativePath>../../pom.xml</relativePath>
|
||||
<version>1.0-beta-1-SNAPSHOT</version>
|
||||
<relativePath>../../../pom.xml</relativePath>
|
||||
</parent>
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
<groupId>org.keycloak.example.demo</groupId>
|
||||
@@ -20,16 +20,7 @@
|
||||
<plugin>
|
||||
<groupId>org.jboss.as.plugins</groupId>
|
||||
<artifactId>jboss-as-maven-plugin</artifactId>
|
||||
<configuration>
|
||||
<skip>false</skip>
|
||||
</configuration>
|
||||
</plugin>
|
||||
<plugin>
|
||||
<groupId>org.wildfly.plugins</groupId>
|
||||
<artifactId>wildfly-maven-plugin</artifactId>
|
||||
<configuration>
|
||||
<skip>false</skip>
|
||||
</configuration>
|
||||
<version>7.4.Final</version>
|
||||
</plugin>
|
||||
<plugin>
|
||||
<groupId>org.apache.maven.plugins</groupId>
|
||||
|
||||
@@ -60,12 +60,12 @@
|
||||
if (typeof data === 'object') {
|
||||
data = JSON.stringify(data, null, ' ');
|
||||
}
|
||||
document.getElementById('output').innerHTML = data;
|
||||
document.getElementById('output').innerText = data;
|
||||
}
|
||||
|
||||
function event(event) {
|
||||
var e = document.getElementById('events').innerHTML;
|
||||
document.getElementById('events').innerHTML = new Date().toLocaleString() + "\t" + event + "\n" + e;
|
||||
var e = document.getElementById('events').innerText;
|
||||
document.getElementById('events').innerText = new Date().toLocaleString() + "\t" + event + "\n" + e;
|
||||
}
|
||||
|
||||
var keycloak = Keycloak();
|
||||
|
||||
+9
-4
@@ -3,7 +3,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0-beta-2</version>
|
||||
<version>1.0-beta-1-20150523</version>
|
||||
<relativePath>../pom.xml</relativePath>
|
||||
</parent>
|
||||
<name>Examples</name>
|
||||
@@ -22,12 +22,17 @@
|
||||
<skip>true</skip>
|
||||
</configuration>
|
||||
</plugin>
|
||||
<plugin>
|
||||
<groupId>org.jboss.as.plugins</groupId>
|
||||
<artifactId>jboss-as-maven-plugin</artifactId>
|
||||
<version>7.1.1.Final</version>
|
||||
<configuration>
|
||||
<skip>true</skip>
|
||||
</configuration>
|
||||
</plugin>
|
||||
</plugins>
|
||||
</build>
|
||||
<modules>
|
||||
<module>cors</module>
|
||||
<module>demo-template</module>
|
||||
<module>providers</module>
|
||||
<module>js-console</module>
|
||||
</modules>
|
||||
</project>
|
||||
@@ -1,4 +0,0 @@
|
||||
Example Audit Listener that prints events to System.out
|
||||
=======================================================
|
||||
|
||||
To deploy copy target/audit-listener-sysout-example.jar to standalone/deployments/auth-server.war/WEB-INF/lib. Then start (or restart) the server. Once started open the admin console, select your realm, then click on Audit, followed by config. Click on Audit Listeners select box, then pick sysout from the dropdown. After this try to logout and login again to see events printed to System.out.
|
||||
@@ -1,43 +0,0 @@
|
||||
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
||||
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
|
||||
<parent>
|
||||
<artifactId>examples-providers-pom</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0-beta-2</version>
|
||||
<relativePath>../pom.xml</relativePath>
|
||||
</parent>
|
||||
<name>Audit Listener System.out Example</name>
|
||||
<description/>
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
|
||||
<artifactId>audit-listener-sysout-example</artifactId>
|
||||
<packaging>jar</packaging>
|
||||
|
||||
<dependencies>
|
||||
<dependency>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<artifactId>keycloak-core</artifactId>
|
||||
<version>${project.version}</version>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<artifactId>keycloak-audit-api</artifactId>
|
||||
<version>${project.version}</version>
|
||||
</dependency>
|
||||
</dependencies>
|
||||
|
||||
<build>
|
||||
<finalName>audit-listener-sysout-example</finalName>
|
||||
<plugins>
|
||||
<plugin>
|
||||
<groupId>org.apache.maven.plugins</groupId>
|
||||
<artifactId>maven-deploy-plugin</artifactId>
|
||||
<configuration>
|
||||
<skip>true</skip>
|
||||
</configuration>
|
||||
</plugin>
|
||||
</plugins>
|
||||
</build>
|
||||
<modules>
|
||||
</modules>
|
||||
</project>
|
||||
-72
@@ -1,72 +0,0 @@
|
||||
package org.keycloak.examples.providers.audit;
|
||||
|
||||
import org.keycloak.audit.AuditListener;
|
||||
import org.keycloak.audit.Event;
|
||||
import org.keycloak.audit.EventType;
|
||||
|
||||
import java.util.Map;
|
||||
import java.util.Set;
|
||||
|
||||
/**
|
||||
* @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
|
||||
*/
|
||||
public class SysoutAuditListener implements AuditListener {
|
||||
|
||||
private Set<EventType> excludedEvents;
|
||||
|
||||
public SysoutAuditListener(Set<EventType> excludedEvents) {
|
||||
this.excludedEvents = excludedEvents;
|
||||
}
|
||||
|
||||
@Override
|
||||
public void onEvent(Event event) {
|
||||
// Ignore excluded events
|
||||
if (excludedEvents != null && excludedEvents.contains(event.getEvent())) {
|
||||
return;
|
||||
} else {
|
||||
System.out.println("EVENT: " + toString(event));
|
||||
}
|
||||
}
|
||||
|
||||
private String toString(Event event) {
|
||||
StringBuilder sb = new StringBuilder();
|
||||
|
||||
sb.append("event=");
|
||||
sb.append(event.getEvent());
|
||||
sb.append(", realmId=");
|
||||
sb.append(event.getRealmId());
|
||||
sb.append(", clientId=");
|
||||
sb.append(event.getClientId());
|
||||
sb.append(", userId=");
|
||||
sb.append(event.getUserId());
|
||||
sb.append(", ipAddress=");
|
||||
sb.append(event.getIpAddress());
|
||||
|
||||
if (event.getError() != null) {
|
||||
sb.append(", error=");
|
||||
sb.append(event.getError());
|
||||
}
|
||||
|
||||
if (event.getDetails() != null) {
|
||||
for (Map.Entry<String, String> e : event.getDetails().entrySet()) {
|
||||
sb.append(", ");
|
||||
sb.append(e.getKey());
|
||||
if (e.getValue() == null || e.getValue().indexOf(' ') == -1) {
|
||||
sb.append("=");
|
||||
sb.append(e.getValue());
|
||||
} else {
|
||||
sb.append("='");
|
||||
sb.append(e.getValue());
|
||||
sb.append("'");
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return sb.toString();
|
||||
}
|
||||
|
||||
@Override
|
||||
public void close() {
|
||||
}
|
||||
|
||||
}
|
||||
-44
@@ -1,44 +0,0 @@
|
||||
package org.keycloak.examples.providers.audit;
|
||||
|
||||
import org.keycloak.Config;
|
||||
import org.keycloak.audit.AuditListener;
|
||||
import org.keycloak.audit.AuditListenerFactory;
|
||||
import org.keycloak.audit.EventType;
|
||||
import org.keycloak.provider.ProviderSession;
|
||||
|
||||
import java.util.HashSet;
|
||||
import java.util.Set;
|
||||
|
||||
/**
|
||||
* @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
|
||||
*/
|
||||
public class SysoutAuditListenerFactory implements AuditListenerFactory {
|
||||
|
||||
private Set<EventType> excludedEvents;
|
||||
|
||||
@Override
|
||||
public AuditListener create(ProviderSession providerSession) {
|
||||
return new SysoutAuditListener(excludedEvents);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void init(Config.Scope config) {
|
||||
String excludes = config.get("excludes");
|
||||
if (excludes != null) {
|
||||
excludedEvents = new HashSet<EventType>();
|
||||
for (String e : excludes.split(",")) {
|
||||
excludedEvents.add(EventType.valueOf(e));
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@Override
|
||||
public void close() {
|
||||
}
|
||||
|
||||
@Override
|
||||
public String getId() {
|
||||
return "sysout";
|
||||
}
|
||||
|
||||
}
|
||||
-1
@@ -1 +0,0 @@
|
||||
org.keycloak.examples.providers.audit.SysoutAuditListenerFactory
|
||||
@@ -1,16 +0,0 @@
|
||||
Example Audit Provider that stores events in a List
|
||||
===================================================
|
||||
|
||||
To deploy copy target/audit-provider-mem-example.jar to standalone/deployments/auth-server.war/WEB-INF/lib. Then edit standalone/configuration/keycloak-server.json, change:
|
||||
|
||||
"audit": {
|
||||
"provider": "jpa"
|
||||
}
|
||||
|
||||
to:
|
||||
|
||||
"audit": {
|
||||
"provider": "in-mem"
|
||||
}
|
||||
|
||||
Then start (or restart)the server. Once started open the admin console, select your realm, then click on Audit, followed by config. Set the toggle for Enabled to ON. After this try to logout and login again then open the Audit tab again in the admin console to view events from the in-mem provider.
|
||||
@@ -1,43 +0,0 @@
|
||||
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
||||
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
|
||||
<parent>
|
||||
<artifactId>examples-providers-pom</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0-beta-2</version>
|
||||
<relativePath>../pom.xml</relativePath>
|
||||
</parent>
|
||||
<name>Audit Provider In-Mem Example</name>
|
||||
<description/>
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
|
||||
<artifactId>audit-provider-mem-example</artifactId>
|
||||
<packaging>jar</packaging>
|
||||
|
||||
<dependencies>
|
||||
<dependency>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<artifactId>keycloak-core</artifactId>
|
||||
<version>${project.version}</version>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<artifactId>keycloak-audit-api</artifactId>
|
||||
<version>${project.version}</version>
|
||||
</dependency>
|
||||
</dependencies>
|
||||
|
||||
<build>
|
||||
<finalName>audit-provider-mem-example</finalName>
|
||||
<plugins>
|
||||
<plugin>
|
||||
<groupId>org.apache.maven.plugins</groupId>
|
||||
<artifactId>maven-deploy-plugin</artifactId>
|
||||
<configuration>
|
||||
<skip>true</skip>
|
||||
</configuration>
|
||||
</plugin>
|
||||
</plugins>
|
||||
</build>
|
||||
<modules>
|
||||
</modules>
|
||||
</project>
|
||||
-69
@@ -1,69 +0,0 @@
|
||||
package org.keycloak.examples.providers.audit;
|
||||
|
||||
import org.keycloak.audit.AuditProvider;
|
||||
import org.keycloak.audit.Event;
|
||||
import org.keycloak.audit.EventQuery;
|
||||
import org.keycloak.audit.EventType;
|
||||
|
||||
import java.util.Iterator;
|
||||
import java.util.LinkedList;
|
||||
import java.util.List;
|
||||
import java.util.Set;
|
||||
|
||||
/**
|
||||
* @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
|
||||
*/
|
||||
public class MemAuditProvider implements AuditProvider {
|
||||
private final List<Event> events;
|
||||
private final Set<EventType> excludedEvents;
|
||||
|
||||
public MemAuditProvider(List<Event> events, Set<EventType> excludedEvents) {
|
||||
this.events = events;
|
||||
this.excludedEvents = excludedEvents;
|
||||
}
|
||||
|
||||
@Override
|
||||
public EventQuery createQuery() {
|
||||
return new MemEventQuery(new LinkedList<Event>(events));
|
||||
}
|
||||
|
||||
@Override
|
||||
public void clear() {
|
||||
|
||||
}
|
||||
|
||||
@Override
|
||||
public void clear(String realmId) {
|
||||
synchronized(events) {
|
||||
Iterator<Event> itr = events.iterator();
|
||||
while (itr.hasNext()) {
|
||||
if (itr.next().getRealmId().equals(realmId)) {
|
||||
itr.remove();
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@Override
|
||||
public void clear(String realmId, long olderThan) {
|
||||
synchronized(events) {
|
||||
Iterator<Event> itr = events.iterator();
|
||||
while (itr.hasNext()) {
|
||||
Event e = itr.next();
|
||||
if (e.getRealmId().equals(realmId) && e.getTime() < olderThan) {
|
||||
itr.remove();
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@Override
|
||||
public void onEvent(Event event) {
|
||||
events.add(event);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void close() {
|
||||
}
|
||||
|
||||
}
|
||||
-53
@@ -1,53 +0,0 @@
|
||||
package org.keycloak.examples.providers.audit;
|
||||
|
||||
import org.keycloak.Config;
|
||||
import org.keycloak.audit.AuditProvider;
|
||||
import org.keycloak.audit.AuditProviderFactory;
|
||||
import org.keycloak.audit.Event;
|
||||
import org.keycloak.audit.EventType;
|
||||
import org.keycloak.provider.ProviderSession;
|
||||
|
||||
import java.util.Collections;
|
||||
import java.util.HashSet;
|
||||
import java.util.LinkedList;
|
||||
import java.util.List;
|
||||
import java.util.Set;
|
||||
|
||||
/**
|
||||
* @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
|
||||
*/
|
||||
public class MemAuditProviderFactory implements AuditProviderFactory {
|
||||
|
||||
private List<Event> events;
|
||||
|
||||
private Set<EventType> excludedEvents;
|
||||
|
||||
@Override
|
||||
public AuditProvider create(ProviderSession providerSession) {
|
||||
return new MemAuditProvider(events, excludedEvents);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void init(Config.Scope config) {
|
||||
events = Collections.synchronizedList(new LinkedList<Event>());
|
||||
|
||||
String excludes = config.get("excludes");
|
||||
if (excludes != null) {
|
||||
excludedEvents = new HashSet<EventType>();
|
||||
for (String e : excludes.split(",")) {
|
||||
excludedEvents.add(EventType.valueOf(e));
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@Override
|
||||
public void close() {
|
||||
events = null;
|
||||
excludedEvents = null;
|
||||
}
|
||||
|
||||
@Override
|
||||
public String getId() {
|
||||
return "in-mem";
|
||||
}
|
||||
}
|
||||
-110
@@ -1,110 +0,0 @@
|
||||
package org.keycloak.examples.providers.audit;
|
||||
|
||||
import org.keycloak.audit.Event;
|
||||
import org.keycloak.audit.EventQuery;
|
||||
import org.keycloak.audit.EventType;
|
||||
|
||||
import java.util.Collections;
|
||||
import java.util.Iterator;
|
||||
import java.util.List;
|
||||
|
||||
/**
|
||||
* @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
|
||||
*/
|
||||
public class MemEventQuery implements EventQuery {
|
||||
|
||||
private List<Event> events;
|
||||
|
||||
private int first;
|
||||
private int max;
|
||||
|
||||
public MemEventQuery(List<Event> events) {
|
||||
this.events = events;
|
||||
}
|
||||
|
||||
@Override
|
||||
public EventQuery event(EventType... events) {
|
||||
Iterator<Event> itr = this.events.iterator();
|
||||
while (itr.hasNext()) {
|
||||
Event next = itr.next();
|
||||
boolean include = false;
|
||||
for (EventType e : events) {
|
||||
if (next.getEvent().equals(e)) {
|
||||
include = true;
|
||||
break;
|
||||
}
|
||||
}
|
||||
if (!include) {
|
||||
itr.remove();
|
||||
}
|
||||
}
|
||||
return this;
|
||||
}
|
||||
|
||||
@Override
|
||||
public EventQuery realm(String realmId) {
|
||||
Iterator<Event> itr = this.events.iterator();
|
||||
while (itr.hasNext()) {
|
||||
if (!itr.next().getRealmId().equals(realmId)) {
|
||||
itr.remove();
|
||||
}
|
||||
}
|
||||
return this;
|
||||
}
|
||||
|
||||
@Override
|
||||
public EventQuery client(String clientId) {
|
||||
Iterator<Event> itr = this.events.iterator();
|
||||
while (itr.hasNext()) {
|
||||
if (!itr.next().getClientId().equals(clientId)) {
|
||||
itr.remove();
|
||||
}
|
||||
}
|
||||
return this;
|
||||
}
|
||||
|
||||
@Override
|
||||
public EventQuery user(String userId) {
|
||||
Iterator<Event> itr = this.events.iterator();
|
||||
while (itr.hasNext()) {
|
||||
if (!itr.next().getUserId().equals(userId)) {
|
||||
itr.remove();
|
||||
}
|
||||
}
|
||||
return this;
|
||||
}
|
||||
|
||||
@Override
|
||||
public EventQuery ipAddress(String ipAddress) {
|
||||
Iterator<Event> itr = this.events.iterator();
|
||||
while (itr.hasNext()) {
|
||||
if (!itr.next().getIpAddress().equals(ipAddress)) {
|
||||
itr.remove();
|
||||
}
|
||||
}
|
||||
return this;
|
||||
}
|
||||
|
||||
@Override
|
||||
public EventQuery firstResult(int result) {
|
||||
this.first = result;
|
||||
return this;
|
||||
}
|
||||
|
||||
@Override
|
||||
public EventQuery maxResults(int results) {
|
||||
this.max = results;
|
||||
return this;
|
||||
}
|
||||
|
||||
@Override
|
||||
public List<Event> getResultList() {
|
||||
if (events.size() < first) {
|
||||
return Collections.emptyList();
|
||||
}
|
||||
int end = first + max <= events.size() ? first + max : events.size();
|
||||
|
||||
return events.subList(first, end);
|
||||
}
|
||||
|
||||
}
|
||||
-1
@@ -1 +0,0 @@
|
||||
org.keycloak.examples.providers.audit.MemAuditProviderFactory
|
||||
@@ -1,31 +0,0 @@
|
||||
Example Authentication Provider based on property file values
|
||||
=============================================================
|
||||
|
||||
* To deploy copy "target/authentication-properties-example.jar" to "standalone/deployments/auth-server.war/WEB-INF/lib" .
|
||||
|
||||
* Then you can configure location of property file, from which will be users and their passwords retrieved. If you omit it and won't configure, provider will use default "users.properties" file bundled inside this example.
|
||||
So for custom location, edit "standalone/configuration/keycloak-server.json" and add this:
|
||||
````
|
||||
"authentication": {
|
||||
"properties": {
|
||||
"propertiesFileLocation": "/tmp/your-own-property-file.properties"
|
||||
}
|
||||
}
|
||||
````
|
||||
|
||||
Assumption is that your file has format like:
|
||||
|
||||
````
|
||||
username1=password1
|
||||
username2=password2
|
||||
````
|
||||
|
||||
* Then start (or restart)the server. Once started open the admin console, select your realm, then click on "Authentication" and then "Add provider" and select "properties" from the list.
|
||||
This will mean that realm will use PropertiesAuthenticationProvider for authentication.
|
||||
|
||||
* Once you try to login to realm, you can login with username/password like "joe/password1" or "james/password2" (In case that you use default users.properties file) . Once joe is authenticated,
|
||||
you can see in Keycloak admin console in "Users" list that user "joe" was added to the list.
|
||||
|
||||
* You can try to login as joe and then go to [http://localhost:8080/auth/realms/demo/account/password](http://localhost:8080/auth/realms/demo/account/password) and change the password.
|
||||
You will then be able to logout and login with new password because properties were updated.
|
||||
WARNING: If you use default location, properties will be updated just in memory and won't survive server restart. So in this case, you will have again "joe" with password "password1" after restart.
|
||||
@@ -1,54 +0,0 @@
|
||||
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
||||
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
|
||||
<parent>
|
||||
<artifactId>examples-providers-pom</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0-beta-2</version>
|
||||
<relativePath>../pom.xml</relativePath>
|
||||
</parent>
|
||||
<name>Properties Authentication Provider Example</name>
|
||||
<description/>
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
|
||||
<artifactId>authentication-properties-example</artifactId>
|
||||
<packaging>jar</packaging>
|
||||
|
||||
<dependencies>
|
||||
<dependency>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<artifactId>keycloak-core</artifactId>
|
||||
<version>${project.version}</version>
|
||||
<scope>provided</scope>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<artifactId>keycloak-model-api</artifactId>
|
||||
<version>${project.version}</version>
|
||||
<scope>provided</scope>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<artifactId>keycloak-authentication-api</artifactId>
|
||||
<version>${project.version}</version>
|
||||
<scope>provided</scope>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>org.jboss.logging</groupId>
|
||||
<artifactId>jboss-logging</artifactId>
|
||||
<scope>provided</scope>
|
||||
</dependency>
|
||||
</dependencies>
|
||||
|
||||
<build>
|
||||
<finalName>authentication-properties-example</finalName>
|
||||
<plugins>
|
||||
<plugin>
|
||||
<groupId>org.apache.maven.plugins</groupId>
|
||||
<artifactId>maven-deploy-plugin</artifactId>
|
||||
<configuration>
|
||||
<skip>true</skip>
|
||||
</configuration>
|
||||
</plugin>
|
||||
</plugins>
|
||||
</build>
|
||||
</project>
|
||||
-74
@@ -1,74 +0,0 @@
|
||||
package org.keycloak.examples.providers.authentication;
|
||||
|
||||
import java.util.Collections;
|
||||
import java.util.List;
|
||||
import java.util.Map;
|
||||
import java.util.Properties;
|
||||
|
||||
import org.jboss.logging.Logger;
|
||||
import org.keycloak.authentication.AuthProviderStatus;
|
||||
import org.keycloak.authentication.AuthUser;
|
||||
import org.keycloak.authentication.AuthenticationProvider;
|
||||
import org.keycloak.authentication.AuthenticationProviderException;
|
||||
import org.keycloak.models.RealmModel;
|
||||
|
||||
/**
|
||||
* @author <a href="mailto:mposolda@redhat.com">Marek Posolda</a>
|
||||
*/
|
||||
public class PropertiesAuthenticationProvider implements AuthenticationProvider {
|
||||
|
||||
private static final Logger log = Logger.getLogger(PropertiesAuthenticationProvider.class);
|
||||
|
||||
private final Properties properties;
|
||||
|
||||
public PropertiesAuthenticationProvider(Properties properties) {
|
||||
this.properties = properties;
|
||||
}
|
||||
|
||||
@Override
|
||||
public String getName() {
|
||||
return "properties";
|
||||
}
|
||||
|
||||
@Override
|
||||
public List<String> getAvailableOptions() {
|
||||
return Collections.emptyList();
|
||||
}
|
||||
|
||||
@Override
|
||||
public AuthUser getUser(RealmModel realm, Map<String, String> configuration, String username) throws AuthenticationProviderException {
|
||||
if (properties.getProperty(username) != null) {
|
||||
return new AuthUser(username, username, getName());
|
||||
} else {
|
||||
return null;
|
||||
}
|
||||
}
|
||||
|
||||
@Override
|
||||
public String registerUser(RealmModel realm, Map<String, String> configuration, String username) throws AuthenticationProviderException {
|
||||
// Registration ignored
|
||||
return username;
|
||||
}
|
||||
|
||||
@Override
|
||||
public AuthProviderStatus validatePassword(RealmModel realm, Map<String, String> configuration, String username, String password) throws AuthenticationProviderException {
|
||||
String propertyFilePassword = properties.getProperty(username);
|
||||
if (propertyFilePassword != null && propertyFilePassword.equals(password)) {
|
||||
return AuthProviderStatus.SUCCESS;
|
||||
} else {
|
||||
return AuthProviderStatus.INVALID_CREDENTIALS;
|
||||
}
|
||||
}
|
||||
|
||||
@Override
|
||||
public boolean updateCredential(RealmModel realm, Map<String, String> configuration, String username, String password) throws AuthenticationProviderException {
|
||||
log.info("Going to update password for user " + username + " in PropertiesAuthenticationProvider");
|
||||
properties.put(username, password);
|
||||
return true;
|
||||
}
|
||||
|
||||
@Override
|
||||
public void close() {
|
||||
}
|
||||
|
||||
}
|
||||
Loaded 100 of 240 files, more files were not shown because too many files have changed in this diff.
Show more
Reference in new issue
Block a user