Compare commits
1
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Stian Thorgersen
|
1b4d682a0b |
No files matched your search
@@ -4,7 +4,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0.5.Final</version>
|
||||
<version>1.0.1.Final</version>
|
||||
<relativePath>../../pom.xml</relativePath>
|
||||
</parent>
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0.5.Final</version>
|
||||
<version>1.0.1.Final</version>
|
||||
<relativePath>../../pom.xml</relativePath>
|
||||
</parent>
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
|
||||
+1
-1
@@ -3,7 +3,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0.5.Final</version>
|
||||
<version>1.0.1.Final</version>
|
||||
</parent>
|
||||
<name>Connections Parent</name>
|
||||
<description/>
|
||||
|
||||
+1
-1
@@ -4,7 +4,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0.5.Final</version>
|
||||
<version>1.0.1.Final</version>
|
||||
<relativePath>../pom.xml</relativePath>
|
||||
</parent>
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
|
||||
+1
-1
@@ -4,7 +4,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0.5.Final</version>
|
||||
<version>1.0.1.Final</version>
|
||||
<relativePath>../pom.xml</relativePath>
|
||||
</parent>
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
|
||||
@@ -1,15 +1,12 @@
|
||||
package org.keycloak.util;
|
||||
|
||||
import java.net.URI;
|
||||
import java.util.regex.Pattern;
|
||||
|
||||
/**
|
||||
* @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
|
||||
*/
|
||||
public class UriUtils {
|
||||
|
||||
private static final Pattern originPattern = Pattern.compile("(http://|https://)[\\w-]+(\\.[\\w-]+)*(:[\\d]{2,5})?");
|
||||
|
||||
public static String getOrigin(URI uri) {
|
||||
return getOrigin(uri.toString());
|
||||
}
|
||||
@@ -19,8 +16,4 @@ public class UriUtils {
|
||||
return u.substring(0, u.indexOf('/', 8));
|
||||
}
|
||||
|
||||
public static boolean isOrigin(String url) {
|
||||
return originPattern.matcher(url).matches();
|
||||
}
|
||||
|
||||
}
|
||||
@@ -1,46 +0,0 @@
|
||||
package org.keycloak.util;
|
||||
|
||||
import org.junit.Test;
|
||||
|
||||
import static org.junit.Assert.assertFalse;
|
||||
import static org.junit.Assert.assertTrue;
|
||||
|
||||
/**
|
||||
* @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
|
||||
*/
|
||||
public class UriUtilsTest {
|
||||
|
||||
@Test
|
||||
public void testOrigins() {
|
||||
assertValid("http://test");
|
||||
assertValid("http://test:8080");
|
||||
assertValid("https://test");
|
||||
assertValid("http://test.com");
|
||||
assertValid("https://test.com");
|
||||
assertValid("https://test.com:8080");
|
||||
assertValid("http://sub.test.com");
|
||||
assertValid("https://sub.test.com");
|
||||
assertValid("https://sub.test.com:8080");
|
||||
assertValid("http://192.168.123.123");
|
||||
assertValid("https://192.168.123.123");
|
||||
assertValid("https://192.168.123.123:8080");
|
||||
assertValid("https://sub-sub.test.com");
|
||||
assertValid("https://sub.test-test.com");
|
||||
|
||||
assertInvalid("https://test/");
|
||||
assertInvalid("{");
|
||||
assertInvalid("https://{}");
|
||||
assertInvalid("https://)");
|
||||
assertInvalid("http://test:test");
|
||||
assertInvalid("http://test:8080:8080");
|
||||
}
|
||||
|
||||
public void assertValid(String origin) {
|
||||
assertTrue(UriUtils.isOrigin(origin));
|
||||
}
|
||||
|
||||
public void assertInvalid(String origin) {
|
||||
assertFalse(UriUtils.isOrigin(origin));
|
||||
}
|
||||
|
||||
}
|
||||
Vendored
+1
-1
@@ -4,7 +4,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0.5.Final</version>
|
||||
<version>1.0.1.Final</version>
|
||||
</parent>
|
||||
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
|
||||
Vendored
+1
-1
@@ -4,7 +4,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0.5.Final</version>
|
||||
<version>1.0.1.Final</version>
|
||||
<relativePath>../../pom.xml</relativePath>
|
||||
</parent>
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
|
||||
Vendored
+1
-1
@@ -4,7 +4,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0.5.Final</version>
|
||||
<version>1.0.1.Final</version>
|
||||
<relativePath>../../pom.xml</relativePath>
|
||||
</parent>
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0.5.Final</version>
|
||||
<version>1.0.1.Final</version>
|
||||
<relativePath>../../pom.xml</relativePath>
|
||||
</parent>
|
||||
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0.5.Final</version>
|
||||
<version>1.0.1.Final</version>
|
||||
<relativePath>../../pom.xml</relativePath>
|
||||
</parent>
|
||||
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0.5.Final</version>
|
||||
<version>1.0.1.Final</version>
|
||||
<relativePath>../../pom.xml</relativePath>
|
||||
</parent>
|
||||
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0.5.Final</version>
|
||||
<version>1.0.1.Final</version>
|
||||
<relativePath>../../pom.xml</relativePath>
|
||||
</parent>
|
||||
|
||||
|
||||
@@ -30,7 +30,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0.5.Final</version>
|
||||
<version>1.0.1.Final</version>
|
||||
<relativePath>../../pom.xml</relativePath>
|
||||
</parent>
|
||||
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0.5.Final</version>
|
||||
<version>1.0.1.Final</version>
|
||||
<relativePath>../pom.xml</relativePath>
|
||||
</parent>
|
||||
<name>Distribution</name>
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0.5.Final</version>
|
||||
<version>1.0.1.Final</version>
|
||||
<relativePath>../../pom.xml</relativePath>
|
||||
</parent>
|
||||
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0.5.Final</version>
|
||||
<version>1.0.1.Final</version>
|
||||
<relativePath>../../pom.xml</relativePath>
|
||||
</parent>
|
||||
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0.5.Final</version>
|
||||
<version>1.0.1.Final</version>
|
||||
<relativePath>../../pom.xml</relativePath>
|
||||
</parent>
|
||||
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0.5.Final</version>
|
||||
<version>1.0.1.Final</version>
|
||||
<relativePath>../../pom.xml</relativePath>
|
||||
</parent>
|
||||
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0.5.Final</version>
|
||||
<version>1.0.1.Final</version>
|
||||
<relativePath>../../pom.xml</relativePath>
|
||||
</parent>
|
||||
|
||||
|
||||
+1
-1
@@ -4,7 +4,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0.5.Final</version>
|
||||
<version>1.0.1.Final</version>
|
||||
<relativePath>../pom.xml</relativePath>
|
||||
</parent>
|
||||
|
||||
|
||||
@@ -31,7 +31,6 @@
|
||||
<!ENTITY UserFederation SYSTEM "modules/user-federation.xml">
|
||||
<!ENTITY ExportImport SYSTEM "modules/export-import.xml">
|
||||
<!ENTITY ServerCache SYSTEM "modules/cache.xml">
|
||||
<!ENTITY SecurityVulnerabilities SYSTEM "modules/security-vulnerabilities.xml">
|
||||
]>
|
||||
|
||||
<book>
|
||||
@@ -120,7 +119,6 @@ This one is short
|
||||
&UserFederation;
|
||||
&ExportImport;
|
||||
&ServerCache;
|
||||
&SecurityVulnerabilities;
|
||||
&Migration;
|
||||
|
||||
</book>
|
||||
|
||||
@@ -44,7 +44,7 @@
|
||||
<listitem>
|
||||
<para>
|
||||
For OAuth clients, you would also see a "Direct Access Only" switch when creating the OAuth Client.
|
||||
This switch is for oauth clients that only use the <link linkend='direct-access-grants'>Direct Access Grant</link>
|
||||
This switch is for oauth clients that only use the <link linkend='direct-access-grant'>Direct Access Grant</link>
|
||||
protocol to obtain access tokens.
|
||||
</para>
|
||||
</listitem>
|
||||
|
||||
@@ -1,155 +0,0 @@
|
||||
<chapter id="security_vulnerabilities">
|
||||
<title>Security Vulnerabilities</title>
|
||||
<para>
|
||||
This chapter discusses possible security vulnerabilities Keycloak could have, how Keycloak mitigates those
|
||||
vulnerabilities, and what steps you need to do to configure Keycloak to mitigate some vulnerabilities. A good list
|
||||
of potential vulnerabilities and what security implementations should do to mitigate them can be found in the
|
||||
<ulink url="http://tools.ietf.org/html/rfc6819">OAuth 2.0 Thread Model</ulink> document put out by the IETF. Many of those vulnerabilities are discussed here.
|
||||
</para>
|
||||
<section>
|
||||
<title>SSL/HTTPS Requirement</title>
|
||||
<para>
|
||||
If you do not use SSL/HTTPS for all communication between the Keycloak auth server and the clients it secures
|
||||
you will be very vulnerable to man in the middle attacks. OAuth 2.0/OpenID Connect uses access tokens for
|
||||
security. Without SSL/HTTPS, attackers can sniff your network and obtain an access token. Once they have an
|
||||
access token they can do any operation that the token has been given permission for.
|
||||
</para>
|
||||
<para>
|
||||
Keycloak has <link linkend="ssl_modes">three modes for SSL/HTTPS</link>. SSL can be hard to set up, so out of the box, Keycloak allows
|
||||
non-HTTPS communication over private IP addresses like localhost, 192.168.x.x, and other private IP addresses.
|
||||
In production, you should make sure SSL is enabled and required across the board.
|
||||
</para>
|
||||
<para>
|
||||
On the adapter/client side, Keycloak allows you to turn off the SSL trust manager. The trust manager ensures
|
||||
identity the client is talking to. It checks the DNS domain name against the server's certificate. In production
|
||||
you should make sure that each of your client adapters is configured to use a truststore. Otherwise you are vulnerable
|
||||
to DNS man in the middle attacks.
|
||||
</para>
|
||||
</section>
|
||||
<section>
|
||||
<title>CSRF Attacks</title>
|
||||
<para>
|
||||
Cross-site request forgery (CSRF) is a web-based attack whereby HTTP
|
||||
requests are transmitted from a user that the web site trusts or has
|
||||
authenticated (e.g., via HTTP redirects or HTML forms). Any site that uses
|
||||
cookie based authentication is vulnerable for these types of attacks. These attacks are mitigated
|
||||
by matching a state cookie against a posted form or query parameter.
|
||||
</para>
|
||||
<para>
|
||||
OAuth 2.0 login specification requires that a state cookie be used and matched against a transmitted state
|
||||
parameter. Keycloak fully implements this part of the specification so all logins are protected.
|
||||
</para>
|
||||
<para>
|
||||
The Keycloak adminstration console is a pure Javascript/HTML5 application that makes REST calls to the
|
||||
backend Keycloak admin API. These calls all require bearer token authentication and are made via Javascript
|
||||
Ajax calls. CSRF does not apply here. The admin REST API can also be configured to validate CORS origins
|
||||
as well.
|
||||
</para>
|
||||
<para>
|
||||
The only part of Keycloak that really falls into CSRF is the user account management pages. To mitigate this
|
||||
Keycloak sets a state cookie and also embeds the value of this state cookie within hidden form fields or
|
||||
query parameters in action links. This query or form parameter is checked against the state cookie to verify
|
||||
that the call was made by the user.
|
||||
</para>
|
||||
</section>
|
||||
<section>
|
||||
<title>Clickjacking</title>
|
||||
<para>
|
||||
With clickjacking, a malicious site loads the target site in a
|
||||
transparent iFrame overlaid on top of a set of dummy
|
||||
buttons that are carefully constructed to be placed directly under
|
||||
important buttons on the target site. When a user clicks a visible
|
||||
button, they are actually clicking a button (such as an "Authorize"
|
||||
button) on the hidden page. An attacker can steal a user's authentication credentials and
|
||||
access their resources.
|
||||
</para>
|
||||
<para>
|
||||
By default, every response by Keycloak sets some specific browser headers that can prevent this from happening
|
||||
specifically <ulink url="http://tools.ietf.org/html/rfc7034">X-FRAME_OPTIONS</ulink> and <ulink url="http://www.w3.org/TR/CSP/">Content-Security-Policy</ulink>. You
|
||||
should take a look at both of these headers. In the admin console you can specify the values these headers will
|
||||
have. By default, Keycloak only sets up a same-origin policy for iframes.
|
||||
</para>
|
||||
</section>
|
||||
<section>
|
||||
<title>Compromised Access Codes</title>
|
||||
<para>
|
||||
It would be very hard for an attacker to compromise Keycloak access codes. Keycloak generates a cryptographically
|
||||
strong random value for its access codes so it would be very hard to guess an access token.
|
||||
An access code can only be turned into an access token once so it can't be replayed. In the admin console
|
||||
you can specify how long an access token is valid for. This value should be really short. Like a seconds.
|
||||
Just long enough for the client to make the request to turn the code into an token.
|
||||
</para>
|
||||
</section>
|
||||
<section>
|
||||
<title>Compromised access and refresh tokens</title>
|
||||
<para>
|
||||
There's a few things you can do to mitigate access tokens and refresh tokens from being stolen.
|
||||
Most importantly is to enforce SSL/HTTPS communication between Keycloak and its clients and applications.
|
||||
Short lifespans (minutes) for access tokens allows Keycloak to check the validity of a refresh token. Making
|
||||
sure refresh tokens always stay private to the client and are never transmitted ever is very important as well.
|
||||
</para>
|
||||
<para>
|
||||
If an access token or refresh token is compromised, the first thing you should do is go to the admin console
|
||||
and push a not-before revocation policy to all applications. This will enforce that any tokens issued
|
||||
prior to that date are now invalid. You can also disable specific applications, clients, and users if you
|
||||
feel that any one of those entities is completely compromised.
|
||||
</para>
|
||||
</section>
|
||||
<section>
|
||||
<title>Open redirectors</title>
|
||||
<para>
|
||||
An attacker could use the end-user authorization endpoint and the
|
||||
redirect URI parameter to abuse the authorization server as an open
|
||||
redirector. An open redirector is an endpoint using a parameter to
|
||||
automatically redirect a user agent to the location specified by the
|
||||
parameter value without any validation. An attacker could utilize a user's trust in an authorization
|
||||
server to launch a phishing attack.
|
||||
</para>
|
||||
<para>
|
||||
Keycloak requires that all registered applications and clients register at least one redirection uri pattern.
|
||||
Any time a client asks Keycloak to perform a redirect (on login or logout for example), Keycloak will
|
||||
check the redirect uri vs. the list of valid registered uri patterns. It is important that clients and
|
||||
applications register as specific a URI pattern as possible to mitigate open redirector attacks.
|
||||
</para>
|
||||
</section>
|
||||
<section>
|
||||
<title>Password guess: brute force attacks</title>
|
||||
<para>
|
||||
A brute force attack happens when an attacker is trying to guess a user's password. Keycloak has some
|
||||
limited brute force detection capabilities. If turned on, a user account will be temporarily disabled
|
||||
if a threshold of login failures is reached. The downside of this is that this makes Keycloak vulnerable
|
||||
to denial of service attacks. Eventually we will expand this functionality to take client IP address into
|
||||
account when deciding whether to block a user.
|
||||
</para>
|
||||
<para>
|
||||
Another thing you can do to prevent password guessing is to point a tool like <ulink url="http://fail2ban.org">Fail2Ban</ulink> to the Keycloak
|
||||
server's log file. Keycloak logs every login failure and client IP address that had the failure.
|
||||
</para>
|
||||
<para>
|
||||
In the admin console, per realm, you can set up a password policy to enforce that users pick hard to guess passwords.
|
||||
</para>
|
||||
<para>
|
||||
Finally, the best way to mitigate against brute force attacks is to require user to set up a one-time-password (OTP).
|
||||
</para>
|
||||
</section>
|
||||
<section>
|
||||
<title>Password database compromised</title>
|
||||
<para>
|
||||
Keycloak does not store passwords in raw text. It stores a hash of them. Because of performance reasons,
|
||||
Keycloak only hashes passwords once. While a human could probably never crack a hashed password, it is very
|
||||
possible that a computer could. The security community suggests around 20,000 (yes thousand!) hashing iterations
|
||||
to be done to each password. This number grows every year due to increasing computing power (It was 1000 12 years ago).
|
||||
The problem with this is that password hashing is a huge performance hit as each login would require the entered
|
||||
password to be hashed that many times and compared to the stored hash. So, its up to the admin to configure the
|
||||
password hash iterations. This can be done in the admin console password policy configuration. Again, the default
|
||||
value is 1 as we thought it might be more important for Keycloak to scale out of the box. There's a lot of
|
||||
other measures admins can do to protect their password databases.
|
||||
</para>
|
||||
</section>
|
||||
<section>
|
||||
<title>SQL Injection attacks</title>
|
||||
<para>
|
||||
At this point in time, there is no knowledge of any SQL injection vulnerabilities in Keycloak
|
||||
</para>
|
||||
</section>
|
||||
</chapter>
|
||||
@@ -404,7 +404,7 @@ keycloak-war-dist-all-&project.version;/
|
||||
]]>
|
||||
</programlisting>
|
||||
</section>
|
||||
<section id="ssl_modes">
|
||||
<section>
|
||||
<title>SSL/HTTPS Requirement/Modes</title>
|
||||
<warning>
|
||||
<para>
|
||||
@@ -625,74 +625,29 @@ keycloak-war-dist-all-&project.version;/
|
||||
<literal>X-Forwarded-Proto</literal> headers on the requests made to Keycloak. Next you need to enable
|
||||
<literal>proxy-address-forwarding</literal> on the Keycloak http connector. Assuming that your reverse
|
||||
proxy doesn't use port 8443 for SSL you also need to configure what port http traffic is redirected to.
|
||||
This is done by editing <literal>standalone/configuration/standalone.xml</literal>.
|
||||
</para>
|
||||
|
||||
<section>
|
||||
<title>WildFly</title>
|
||||
|
||||
<para>
|
||||
Open <literal>standalone/configuration/standalone.xml</literal> in your favorite editor.
|
||||
</para>
|
||||
|
||||
<para>
|
||||
First add <literal>proxy-address-forwarding</literal> and <literal>redirect-socket</literal> to
|
||||
the <literal>http-listener</literal> element:
|
||||
First add <literal>proxy-address-forwarding</literal> and <literal>redirect-socket</literal> to the <literal>http-listener</literal>
|
||||
element:
|
||||
<para>
|
||||
<programlisting><![CDATA[<subsystem xmlns="urn:jboss:domain:undertow:1.1">
|
||||
...
|
||||
<http-listener name="default" socket-binding="http"
|
||||
proxy-address-forwarding="true" redirect-socket="proxy-https"/>
|
||||
<http-listener name="default" socket-binding="http" proxy-address-forwarding="true" redirect-socket="proxy-https"/>
|
||||
...
|
||||
</subsystem>
|
||||
]]></programlisting>
|
||||
</para>
|
||||
<para>
|
||||
Then add a new <literal>socket-binding</literal> element to the <literal>socket-binding-group</literal> element:
|
||||
Then add a new <literal>socket-binding</literal> element to the <literal>socket-binding-group</literal> element:
|
||||
<programlisting><![CDATA[
|
||||
<socket-binding-group name="standard-sockets" default-interface="public"
|
||||
port-offset="${jboss.socket.binding.port-offset:0}">
|
||||
<socket-binding-group name="standard-sockets" default-interface="public" port-offset="${jboss.socket.binding.port-offset:0}">
|
||||
...
|
||||
<socket-binding name="proxy-https" port="443"/>
|
||||
...
|
||||
</socket-binding-group>
|
||||
]]></programlisting>
|
||||
</para>
|
||||
<para>
|
||||
Check the <ulink url="https://docs.jboss.org/author/display/WFLY8/Undertow+(web)+subsystem+configuration">WildFly</ulink> documentation for more information.
|
||||
</para>
|
||||
</section>
|
||||
|
||||
<section>
|
||||
<title>AS7/EAP</title>
|
||||
|
||||
<para>
|
||||
Open <literal>standalone/configuration/standalone.xml</literal> in your favorite editor.
|
||||
</para>
|
||||
|
||||
<para>
|
||||
You need to add <literal>redirect-port</literal> to http <literal>connector</literal> element and
|
||||
add the <literal>RemoteIpValve</literal> valve:
|
||||
<programlisting><![CDATA[
|
||||
<subsystem xmlns="urn:jboss:domain:web:1.5"
|
||||
default-virtual-server="default-host" native="false">
|
||||
<connector name="http" protocol="HTTP/1.1" scheme="http"
|
||||
socket-binding="http"
|
||||
redirect-port="443"/>
|
||||
<virtual-server name="default-host" enable-welcome-root="true">
|
||||
<alias name="localhost"/>
|
||||
<alias name="example.com"/>
|
||||
</virtual-server>
|
||||
<valve name="remoteipvalve" module="org.jboss.as.web"
|
||||
class-name="org.apache.catalina.valves.RemoteIpValve">
|
||||
<param param-name="protocolHeader" param-value="x-forwarded-proto"/>
|
||||
</valve>
|
||||
</subsystem>
|
||||
]]></programlisting>
|
||||
</para>
|
||||
|
||||
|
||||
|
||||
</section>
|
||||
|
||||
</para>
|
||||
<para>
|
||||
Check the <ulink url="https://docs.jboss.org/author/display/WFLY8/Undertow+(web)+subsystem+configuration">WildFly</ulink> documentation for more information.
|
||||
</para>
|
||||
</section>
|
||||
|
||||
<section>
|
||||
|
||||
@@ -6,38 +6,12 @@
|
||||
and feel of end-user facing pages so they can be integrated with your brand and applications.
|
||||
</para>
|
||||
|
||||
<section>
|
||||
<title>Theme types</title>
|
||||
<para>
|
||||
There are several types of themes in Keycloak:
|
||||
<itemizedlist>
|
||||
<listitem>Account - Account management</listitem>
|
||||
<listitem>Admin - Admin console</listitem>
|
||||
<listitem>Common - Shared resources for themes</listitem>
|
||||
<listitem>Email - Emails</listitem>
|
||||
<listitem>Login - Login forms</listitem>
|
||||
<listitem>Welcome - Welcome pages</listitem>
|
||||
</itemizedlist>
|
||||
</para>
|
||||
</section>
|
||||
|
||||
<section>
|
||||
<title>Configure theme</title>
|
||||
<para>
|
||||
All theme types, except welcome, is configured through <literal>Keycloak Admin Console</literal>. To change
|
||||
the theme used for a realm open the open the <literal>Keycloak Admin Console</literal>, select your realm
|
||||
To configure the theme used by a realm open the <literal>Keycloak Admin Console</literal>, select your realm
|
||||
from the drop-down box in the top left corner. Under <literal>Settings</literal> click on <literal>Theme</literal>.
|
||||
</para>
|
||||
<para>
|
||||
To change the welcome theme you need to edit <literal>standalone/configuration/keycloak-server.json</literal>
|
||||
and add <literal>welcomeTheme</literal> to the theme element, for example:
|
||||
<programlisting>
|
||||
"theme": {
|
||||
...
|
||||
"welcomeTheme": "custom-theme"
|
||||
}
|
||||
</programlisting>
|
||||
</para>
|
||||
</section>
|
||||
|
||||
<section>
|
||||
@@ -51,15 +25,26 @@
|
||||
|
||||
<section>
|
||||
<title>Creating a theme</title>
|
||||
<para>
|
||||
There are several types of themes in Keycloak:
|
||||
<itemizedlist>
|
||||
<listitem>Account - Account management</listitem>
|
||||
<listitem>Admin - Admin console</listitem>
|
||||
<listitem>Common - Shared resources for themes</listitem>
|
||||
<listitem>Email - Emails</listitem>
|
||||
<listitem>Login - Login forms</listitem>
|
||||
</itemizedlist>
|
||||
</para>
|
||||
|
||||
<para>
|
||||
A theme consists of:
|
||||
<itemizedlist>
|
||||
<listitem><ulink url="http://freemarker.org">FreeMarker</ulink> templates</listitem>
|
||||
<listitem>Stylesheets</listitem>
|
||||
<listitem>Scripts</listitem>
|
||||
<listitem>Images</listitem>
|
||||
<listitem>Message bundles</listitem>
|
||||
<listitem>Theme properties</listitem>
|
||||
<listitem><para><ulink url="http://freemarker.org">FreeMarker</ulink> templates</para></listitem>
|
||||
<listitem><para>Stylesheets</para></listitem>
|
||||
<listitem><para>Scripts</para></listitem>
|
||||
<listitem><para>Images</para></listitem>
|
||||
<listitem><para>Message bundles</para></listitem>
|
||||
<listitem><para>Theme properties</para></listitem>
|
||||
</itemizedlist>
|
||||
</para>
|
||||
<para>
|
||||
@@ -147,9 +132,10 @@
|
||||
<section>
|
||||
<title>Theme SPI</title>
|
||||
<para>
|
||||
The Theme SPI allows creating different mechanisms to load themes for the default FreeMarker based
|
||||
The Theme SPI allows creating different mechanisms to providing themes for the default FreeMarker based
|
||||
implementations of login forms and account management. To create a theme provider you will need to implement
|
||||
<literal>org.keycloak.freemarker.ThemeProviderFactory</literal> and <literal>org.keycloak.freemarker.ThemeProvider</literal>.
|
||||
<literal>org.keycloak.freemarker.ThemeProvider</literal> and <literal>org.keycloak.freemarker.Theme</literal> in
|
||||
<literal>forms/common-freemarker</literal>.
|
||||
</para>
|
||||
<para>
|
||||
Keycloak comes with two theme providers, one that loads themes from the classpath (used by default themes)
|
||||
@@ -163,15 +149,12 @@
|
||||
<para>
|
||||
The Account SPI allows implementing the account management pages using whatever web framework or templating
|
||||
engine you want. To create an Account provider implement <literal>org.keycloak.account.AccountProviderFactory</literal>
|
||||
and <literal>org.keycloak.account.AccountProvider</literal>.
|
||||
and <literal>org.keycloak.account.AccountProvider</literal> in <literal>forms/account-api</literal>.
|
||||
</para>
|
||||
<para>
|
||||
Once you have deployed your account provider to Keycloak you need to configure <literal>keycloak-server.json</literal>to specify which provider should be used:
|
||||
<programlisting>
|
||||
"account": {
|
||||
"provider": "custom-provider"
|
||||
}
|
||||
</programlisting>
|
||||
Keycloaks default account management provider is built on the FreeMarker template engine (<literal>forms/account-freemarker</literal>).
|
||||
To make sure your provider is loaded you will either need to delete <literal>standalone/deployments/auth-server.war/WEB-INF/lib/keycloak-account-freemarker-&project.version;.jar</literal>
|
||||
or disable it with the system property <literal>org.keycloak.account.freemarker.FreeMarkerAccountProviderFactory</literal>.
|
||||
</para>
|
||||
</section>
|
||||
<section>
|
||||
@@ -182,12 +165,9 @@
|
||||
and <literal>org.keycloak.login.LoginFormsProvider</literal> in <literal>forms/login-api</literal>.
|
||||
</para>
|
||||
<para>
|
||||
Once you have deployed your account provider to Keycloak you need to configure <literal>keycloak-server.json</literal>to specify which provider should be used:
|
||||
<programlisting>
|
||||
"login": {
|
||||
"provider": "custom-provider"
|
||||
}
|
||||
</programlisting>
|
||||
Keycloaks default login forms provider is built on the FreeMarker template engine (<literal>forms/login-freemarker</literal>).
|
||||
To make sure your provider is loaded you will either need to delete <literal>standalone/deployments/auth-server.war/WEB-INF/lib/keycloak-login-freemarker-&project.version;.jar</literal>
|
||||
or disable it with the system property <literal>org.keycloak.login.freemarker.FreeMarkerLoginFormsProviderFactory</literal>.
|
||||
</para>
|
||||
</section>
|
||||
</section>
|
||||
|
||||
+1
-1
@@ -3,7 +3,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-events-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0.5.Final</version>
|
||||
<version>1.0.1.Final</version>
|
||||
</parent>
|
||||
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-events-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0.5.Final</version>
|
||||
<version>1.0.1.Final</version>
|
||||
</parent>
|
||||
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-events-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0.5.Final</version>
|
||||
<version>1.0.1.Final</version>
|
||||
</parent>
|
||||
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
|
||||
+1
-1
@@ -3,7 +3,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-events-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0.5.Final</version>
|
||||
<version>1.0.1.Final</version>
|
||||
</parent>
|
||||
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-events-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0.5.Final</version>
|
||||
<version>1.0.1.Final</version>
|
||||
</parent>
|
||||
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
|
||||
+1
-1
@@ -3,7 +3,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0.5.Final</version>
|
||||
<version>1.0.1.Final</version>
|
||||
<relativePath>../pom.xml</relativePath>
|
||||
</parent>
|
||||
|
||||
|
||||
@@ -35,6 +35,12 @@
|
||||
}
|
||||
]
|
||||
},
|
||||
"roleMappings": [
|
||||
{
|
||||
"username": "user",
|
||||
"roles": ["user"]
|
||||
}
|
||||
],
|
||||
"scopeMappings": [
|
||||
{
|
||||
"client": "cordova",
|
||||
@@ -46,10 +52,17 @@
|
||||
"name": "cordova",
|
||||
"enabled": true,
|
||||
"publicClient": true,
|
||||
"redirectUris": ["http://localhost"],
|
||||
"webOrigins": ["localhost"]
|
||||
"redirectUris": []
|
||||
}
|
||||
],
|
||||
"applicationRoleMappings": {
|
||||
"account": [
|
||||
{
|
||||
"username": "user",
|
||||
"roles": ["view-profile", "manage-account"]
|
||||
}
|
||||
]
|
||||
},
|
||||
"applicationScopeMappings": {
|
||||
"account": [
|
||||
{
|
||||
|
||||
@@ -10,5 +10,5 @@
|
||||
|
||||
<gap:plugin name="org.apache.cordova.inappbrowser" />
|
||||
|
||||
<access origin="*"/>
|
||||
<access origin="http://*"/>
|
||||
</widget>
|
||||
@@ -28,7 +28,7 @@
|
||||
}
|
||||
|
||||
document.addEventListener("deviceready", function() {
|
||||
keycloak.init({ onLoad: 'check-sso' }).success(updateState);
|
||||
keycloak.init({ onLoad: 'check-sso' });
|
||||
}, false);
|
||||
</script>
|
||||
</head>
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0.5.Final</version>
|
||||
<version>1.0.1.Final</version>
|
||||
<relativePath>../../../pom.xml</relativePath>
|
||||
</parent>
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0.5.Final</version>
|
||||
<version>1.0.1.Final</version>
|
||||
<relativePath>../../../pom.xml</relativePath>
|
||||
</parent>
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0.5.Final</version>
|
||||
<version>1.0.1.Final</version>
|
||||
<relativePath>../../pom.xml</relativePath>
|
||||
</parent>
|
||||
<name>Examples</name>
|
||||
|
||||
@@ -112,7 +112,7 @@ Next thing you have to do is import the test realm for the demo. Clicking on th
|
||||
create realm page in the Admin UI. The username/password is admin/admin to login in. Keycloak will ask you to
|
||||
create a new admin password before you can go to the create realm page.
|
||||
|
||||
[http://localhost:8080/auth/admin/master/console/#/create/realm](http://localhost:8080/auth/admin/master/console/#/create/realm)
|
||||
[http://localhost:8080/auth/admin/index.html#/create/realm](http://localhost:8080/auth/admin/index.html#/create/realm)
|
||||
|
||||
Import the testrealm.json file that is in the preconfigured-demo/ example directory.
|
||||
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0.5.Final</version>
|
||||
<version>1.0.1.Final</version>
|
||||
<relativePath>../../../pom.xml</relativePath>
|
||||
</parent>
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0.5.Final</version>
|
||||
<version>1.0.1.Final</version>
|
||||
<relativePath>../../../pom.xml</relativePath>
|
||||
</parent>
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0.5.Final</version>
|
||||
<version>1.0.1.Final</version>
|
||||
<relativePath>../../../pom.xml</relativePath>
|
||||
</parent>
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0.5.Final</version>
|
||||
<version>1.0.1.Final</version>
|
||||
<relativePath>../../../pom.xml</relativePath>
|
||||
</parent>
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0.5.Final</version>
|
||||
<version>1.0.1.Final</version>
|
||||
<relativePath>../../../pom.xml</relativePath>
|
||||
</parent>
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0.5.Final</version>
|
||||
<version>1.0.1.Final</version>
|
||||
<relativePath>../../../pom.xml</relativePath>
|
||||
</parent>
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0.5.Final</version>
|
||||
<version>1.0.1.Final</version>
|
||||
<relativePath>../../../pom.xml</relativePath>
|
||||
</parent>
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0.5.Final</version>
|
||||
<version>1.0.1.Final</version>
|
||||
<relativePath>../../pom.xml</relativePath>
|
||||
</parent>
|
||||
<name>Examples</name>
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0.5.Final</version>
|
||||
<version>1.0.1.Final</version>
|
||||
<relativePath>../../../pom.xml</relativePath>
|
||||
</parent>
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0.5.Final</version>
|
||||
<version>1.0.1.Final</version>
|
||||
<relativePath>../../../pom.xml</relativePath>
|
||||
</parent>
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
|
||||
+1
-1
@@ -4,7 +4,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0.5.Final</version>
|
||||
<version>1.0.1.Final</version>
|
||||
<relativePath>../../../pom.xml</relativePath>
|
||||
</parent>
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0.5.Final</version>
|
||||
<version>1.0.1.Final</version>
|
||||
<relativePath>../../pom.xml</relativePath>
|
||||
</parent>
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
|
||||
+1
-1
@@ -3,7 +3,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0.5.Final</version>
|
||||
<version>1.0.1.Final</version>
|
||||
<relativePath>../pom.xml</relativePath>
|
||||
</parent>
|
||||
<name>Examples</name>
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
<parent>
|
||||
<artifactId>examples-providers-pom</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0.5.Final</version>
|
||||
<version>1.0.1.Final</version>
|
||||
<relativePath>../pom.xml</relativePath>
|
||||
</parent>
|
||||
<name>Event Listener System.out Example</name>
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
<parent>
|
||||
<artifactId>examples-providers-pom</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0.5.Final</version>
|
||||
<version>1.0.1.Final</version>
|
||||
<relativePath>../pom.xml</relativePath>
|
||||
</parent>
|
||||
<name>Event Store In-Mem Example</name>
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
<parent>
|
||||
<artifactId>examples-providers-pom</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0.5.Final</version>
|
||||
<version>1.0.1.Final</version>
|
||||
<relativePath>../pom.xml</relativePath>
|
||||
</parent>
|
||||
<name>Properties Authentication Provider Example</name>
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
<parent>
|
||||
<artifactId>examples-pom</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0.5.Final</version>
|
||||
<version>1.0.1.Final</version>
|
||||
<relativePath>../pom.xml</relativePath>
|
||||
</parent>
|
||||
<name>Provider Examples</name>
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-export-import-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0.5.Final</version>
|
||||
<version>1.0.1.Final</version>
|
||||
<relativePath>../pom.xml</relativePath>
|
||||
</parent>
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
|
||||
+1
-1
@@ -45,7 +45,7 @@ import java.util.Set;
|
||||
public class ExportUtils {
|
||||
|
||||
public static RealmRepresentation exportRealm(KeycloakSession session, RealmModel realm, boolean includeUsers) {
|
||||
RealmRepresentation rep = ModelToRepresentation.toRepresentation(realm, true);
|
||||
RealmRepresentation rep = ModelToRepresentation.toRepresentation(realm);
|
||||
|
||||
// Audit
|
||||
rep.setEventsEnabled(realm.isEventsEnabled());
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-export-import-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0.5.Final</version>
|
||||
<version>1.0.1.Final</version>
|
||||
<relativePath>../pom.xml</relativePath>
|
||||
</parent>
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-export-import-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0.5.Final</version>
|
||||
<version>1.0.1.Final</version>
|
||||
<relativePath>../pom.xml</relativePath>
|
||||
</parent>
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-export-import-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0.5.Final</version>
|
||||
<version>1.0.1.Final</version>
|
||||
<relativePath>../pom.xml</relativePath>
|
||||
</parent>
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0.5.Final</version>
|
||||
<version>1.0.1.Final</version>
|
||||
<relativePath>../pom.xml</relativePath>
|
||||
</parent>
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
|
||||
@@ -3,7 +3,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0.5.Final</version>
|
||||
<version>1.0.1.Final</version>
|
||||
<relativePath>../../pom.xml</relativePath>
|
||||
</parent>
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
|
||||
+1
-1
@@ -5,7 +5,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0.5.Final</version>
|
||||
<version>1.0.1.Final</version>
|
||||
<relativePath>../pom.xml</relativePath>
|
||||
</parent>
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-forms-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0.5.Final</version>
|
||||
<version>1.0.1.Final</version>
|
||||
<relativePath>../pom.xml</relativePath>
|
||||
</parent>
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-forms-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0.5.Final</version>
|
||||
<version>1.0.1.Final</version>
|
||||
<relativePath>../pom.xml</relativePath>
|
||||
</parent>
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-forms-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0.5.Final</version>
|
||||
<version>1.0.1.Final</version>
|
||||
<relativePath>../pom.xml</relativePath>
|
||||
</parent>
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
|
||||
+10
-13
@@ -1,6 +1,5 @@
|
||||
package org.keycloak.freemarker;
|
||||
|
||||
import org.jboss.logging.Logger;
|
||||
import org.keycloak.Config;
|
||||
import org.keycloak.models.KeycloakSession;
|
||||
|
||||
@@ -22,17 +21,17 @@ import java.util.concurrent.ConcurrentHashMap;
|
||||
*/
|
||||
public class ExtendingThemeManager implements ThemeProvider {
|
||||
|
||||
private static final Logger log = Logger.getLogger(ExtendingThemeManager.class);
|
||||
|
||||
private final KeycloakSession session;
|
||||
private final ConcurrentHashMap<ExtendingThemeManagerFactory.ThemeKey, Theme> themeCache;
|
||||
private List<ThemeProvider> providers;
|
||||
private String defaultTheme;
|
||||
private int staticMaxAge;
|
||||
|
||||
public ExtendingThemeManager(KeycloakSession session, ConcurrentHashMap<ExtendingThemeManagerFactory.ThemeKey, Theme> themeCache) {
|
||||
this.session = session;
|
||||
this.themeCache = themeCache;
|
||||
this.defaultTheme = Config.scope("theme").get("default", "keycloak");
|
||||
this.staticMaxAge = Config.scope("theme").getInt("staticMaxAge", -1);
|
||||
}
|
||||
|
||||
private List<ThemeProvider> getProviders() {
|
||||
@@ -58,6 +57,10 @@ public class ExtendingThemeManager implements ThemeProvider {
|
||||
return providers;
|
||||
}
|
||||
|
||||
public int getStaticMaxAge() {
|
||||
return staticMaxAge;
|
||||
}
|
||||
|
||||
@Override
|
||||
public int getProviderPriority() {
|
||||
return 0;
|
||||
@@ -74,13 +77,7 @@ public class ExtendingThemeManager implements ThemeProvider {
|
||||
Theme theme = themeCache.get(key);
|
||||
if (theme == null) {
|
||||
theme = loadTheme(name, type);
|
||||
if (theme == null) {
|
||||
theme = loadTheme("keycloak", type);
|
||||
if (theme == null) {
|
||||
theme = loadTheme("base", type);
|
||||
}
|
||||
log.errorv("Failed to find {0} theme {1}, using built-in themes", type, name);
|
||||
} else if (themeCache.putIfAbsent(key, theme) != null) {
|
||||
if (themeCache.putIfAbsent(key, theme) != null) {
|
||||
theme = themeCache.get(key);
|
||||
}
|
||||
}
|
||||
@@ -92,7 +89,7 @@ public class ExtendingThemeManager implements ThemeProvider {
|
||||
|
||||
private Theme loadTheme(String name, Theme.Type type) throws IOException {
|
||||
Theme theme = findTheme(name, type);
|
||||
if (theme != null && theme.getParentName() != null) {
|
||||
if (theme.getParentName() != null) {
|
||||
List<Theme> themes = new LinkedList<Theme>();
|
||||
themes.add(theme);
|
||||
|
||||
@@ -147,11 +144,11 @@ public class ExtendingThemeManager implements ThemeProvider {
|
||||
try {
|
||||
return p.getTheme(name, type);
|
||||
} catch (IOException e) {
|
||||
log.errorv(e, p.getClass() + " failed to load theme, type={0}, name={1}", type, name);
|
||||
throw new RuntimeException("Failed to create " + type.toString().toLowerCase() + " theme", e);
|
||||
}
|
||||
}
|
||||
}
|
||||
return null;
|
||||
throw new RuntimeException(type.toString().toLowerCase() + " theme '" + name + "' not found");
|
||||
}
|
||||
|
||||
public static class ExtendingTheme implements Theme {
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-forms-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0.5.Final</version>
|
||||
<version>1.0.1.Final</version>
|
||||
<relativePath>../pom.xml</relativePath>
|
||||
</parent>
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
|
||||
@@ -20,7 +20,7 @@
|
||||
</div>
|
||||
|
||||
<div class="col-sm-10 col-md-10">
|
||||
<input type="text" class="form-control" id="username" name="username" disabled="disabled" value="${(account.username!'')?html}"/>
|
||||
<input type="text" class="form-control" id="username" name="username" disabled="disabled" value="${account.username!''}"/>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
@@ -30,7 +30,7 @@
|
||||
</div>
|
||||
|
||||
<div class="col-sm-10 col-md-10">
|
||||
<input type="text" class="form-control" id="email" name="email" autofocus value="${(account.email!'')?html}"/>
|
||||
<input type="text" class="form-control" id="email" name="email" autofocus value="${account.email!''}"/>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
@@ -41,7 +41,7 @@
|
||||
</div>
|
||||
|
||||
<div class="col-sm-10 col-md-10">
|
||||
<input type="text" class="form-control" id="lastName" name="lastName" value="${(account.lastName!'')?html}"/>
|
||||
<input type="text" class="form-control" id="lastName" name="lastName" value="${account.lastName!''}"/>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
@@ -51,7 +51,7 @@
|
||||
</div>
|
||||
|
||||
<div class="col-sm-10 col-md-10">
|
||||
<input type="text" class="form-control" id="firstName" name="firstName" value="${(account.firstName!'')?html}"/>
|
||||
<input type="text" class="form-control" id="firstName" name="firstName" value="${account.firstName!''}"/>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
|
||||
+1
-3
@@ -38,6 +38,4 @@ socialRedirectError=Failed to redirect to social provider
|
||||
socialProviderRemoved=Social provider removed successfully
|
||||
|
||||
accountDisabled=Account is disabled, contact admin\
|
||||
accountTemporarilyDisabled=Account is temporarily disabled, contact admin or try again later
|
||||
|
||||
logOutAllSessions=Log out all sessions
|
||||
accountTemporarilyDisabled=Account is temporarily disabled, contact admin or try again later
|
||||
@@ -42,6 +42,6 @@
|
||||
|
||||
</table>
|
||||
|
||||
<a id="logout-all-sessions" href="${url.sessionsLogoutUrl}">${rb.logOutAllSessions}</a>
|
||||
<a id="logout-all-sessions" href="${url.sessionsLogoutUrl}">Logout all sessions</a>
|
||||
|
||||
</@layout.mainLayout>
|
||||
</@layout.mainLayout>
|
||||
@@ -11,7 +11,7 @@
|
||||
<label for="email" class="${properties.kcLabelClass!}">${rb.email}</label>
|
||||
</div>
|
||||
<div class="${properties.kcInputWrapperClass!}">
|
||||
<input type="text" id="email" name="email" value="${(user.email!'')?html}" class="${properties.kcInputClass!}" />
|
||||
<input type="text" id="email" name="email" value="${user.email!''}" class="${properties.kcInputClass!}" />
|
||||
</div>
|
||||
</div>
|
||||
|
||||
@@ -20,7 +20,7 @@
|
||||
<label for="firstName" class="${properties.kcLabelClass!}">${rb.firstName}</label>
|
||||
</div>
|
||||
<div class="${properties.kcInputWrapperClass!}">
|
||||
<input type="text" id="firstName" name="firstName" value="${(user.firstName!'')?html}" class="${properties.kcInputClass!}" />
|
||||
<input type="text" id="firstName" name="firstName" value="${user.firstName!''}" class="${properties.kcInputClass!}" />
|
||||
</div>
|
||||
</div>
|
||||
|
||||
@@ -29,7 +29,7 @@
|
||||
<label for="lastName" class="${properties.kcLabelClass!}">${rb.lastName}</label>
|
||||
</div>
|
||||
<div class="${properties.kcInputWrapperClass!}">
|
||||
<input type="text" id="lastName" name="lastName" value="${(user.lastName!'')?html}" class="${properties.kcInputClass!}" />
|
||||
<input type="text" id="lastName" name="lastName" value="${user.lastName!''}" class="${properties.kcInputClass!}" />
|
||||
</div>
|
||||
</div>
|
||||
|
||||
|
||||
@@ -21,7 +21,7 @@
|
||||
</div>
|
||||
|
||||
<div class="${properties.kcInputWrapperClass!}">
|
||||
<input id="username" class="${properties.kcInputClass!}" name="username" value="${(login.username!'')?html}" type="text" autofocus />
|
||||
<input id="username" class="${properties.kcInputClass!}" name="username" value="${login.username!''}" type="text" autofocus />
|
||||
</div>
|
||||
</div>
|
||||
|
||||
|
||||
@@ -11,7 +11,7 @@
|
||||
<label for="username" class="${properties.kcLabelClass!}">${rb.username}</label>
|
||||
</div>
|
||||
<div class="${properties.kcInputWrapperClass!}">
|
||||
<input type="text" id="username" class="${properties.kcInputClass!}" name="username" value="${(register.formData.username!'')?html}" />
|
||||
<input type="text" id="username" class="${properties.kcInputClass!}" name="username" value="${register.formData.username!''}" />
|
||||
</div>
|
||||
</div>
|
||||
|
||||
@@ -20,7 +20,7 @@
|
||||
<label for="firstName" class="${properties.kcLabelClass!}">${rb.firstName}</label>
|
||||
</div>
|
||||
<div class="${properties.kcInputWrapperClass!}">
|
||||
<input type="text" id="firstName" class="${properties.kcInputClass!}" name="firstName" value="${(register.formData.firstName!'')?html}" />
|
||||
<input type="text" id="firstName" class="${properties.kcInputClass!}" name="firstName" value="${register.formData.firstName!''}" />
|
||||
</div>
|
||||
</div>
|
||||
|
||||
@@ -29,7 +29,7 @@
|
||||
<label for="lastName" class="${properties.kcLabelClass!}">${rb.lastName}</label>
|
||||
</div>
|
||||
<div class="${properties.kcInputWrapperClass!}">
|
||||
<input type="text" id="lastName" class="${properties.kcInputClass!}" name="lastName" value="${(register.formData.lastName!'')?html}" />
|
||||
<input type="text" id="lastName" class="${properties.kcInputClass!}" name="lastName" value="${register.formData.lastName!''}" />
|
||||
</div>
|
||||
</div>
|
||||
|
||||
@@ -38,7 +38,7 @@
|
||||
<label for="email" class="${properties.kcLabelClass!}">${rb.email}</label>
|
||||
</div>
|
||||
<div class="${properties.kcInputWrapperClass!}">
|
||||
<input type="text" id="email" class="${properties.kcInputClass!}" name="email" value="${(register.formData.email!'')?html}" />
|
||||
<input type="text" id="email" class="${properties.kcInputClass!}" name="email" value="${register.formData.email!''}" />
|
||||
</div>
|
||||
</div>
|
||||
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-forms-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0.5.Final</version>
|
||||
<version>1.0.1.Final</version>
|
||||
<relativePath>../pom.xml</relativePath>
|
||||
</parent>
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-forms-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0.5.Final</version>
|
||||
<version>1.0.1.Final</version>
|
||||
<relativePath>../pom.xml</relativePath>
|
||||
</parent>
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-forms-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0.5.Final</version>
|
||||
<version>1.0.1.Final</version>
|
||||
<relativePath>../pom.xml</relativePath>
|
||||
</parent>
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-forms-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0.5.Final</version>
|
||||
<version>1.0.1.Final</version>
|
||||
<relativePath>../pom.xml</relativePath>
|
||||
</parent>
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
|
||||
+1
-1
@@ -4,7 +4,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0.5.Final</version>
|
||||
<version>1.0.1.Final</version>
|
||||
<relativePath>../pom.xml</relativePath>
|
||||
</parent>
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0.5.Final</version>
|
||||
<version>1.0.1.Final</version>
|
||||
<relativePath>../../pom.xml</relativePath>
|
||||
</parent>
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
|
||||
@@ -5,7 +5,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0.5.Final</version>
|
||||
<version>1.0.1.Final</version>
|
||||
<relativePath>../../pom.xml</relativePath>
|
||||
</parent>
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
|
||||
-6
@@ -2,10 +2,8 @@ package org.keycloak.admin.client.resource;
|
||||
|
||||
import org.keycloak.representations.idm.RealmRepresentation;
|
||||
|
||||
import javax.ws.rs.Consumes;
|
||||
import javax.ws.rs.DELETE;
|
||||
import javax.ws.rs.GET;
|
||||
import javax.ws.rs.PUT;
|
||||
import javax.ws.rs.Path;
|
||||
import javax.ws.rs.Produces;
|
||||
import javax.ws.rs.core.MediaType;
|
||||
@@ -19,10 +17,6 @@ public interface RealmResource {
|
||||
@Produces(MediaType.APPLICATION_JSON)
|
||||
public RealmRepresentation toRepresentation();
|
||||
|
||||
@PUT
|
||||
@Consumes(MediaType.APPLICATION_JSON)
|
||||
public void update(RealmRepresentation realmRepresentation);
|
||||
|
||||
@Path("applications")
|
||||
public ApplicationsResource applications();
|
||||
|
||||
|
||||
@@ -20,7 +20,7 @@
|
||||
<parent>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<version>1.0.5.Final</version>
|
||||
<version>1.0.1.Final</version>
|
||||
<relativePath>../../pom.xml</relativePath>
|
||||
</parent>
|
||||
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0.5.Final</version>
|
||||
<version>1.0.1.Final</version>
|
||||
<relativePath>../../../pom.xml</relativePath>
|
||||
</parent>
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
|
||||
+1
-1
@@ -70,7 +70,7 @@ public class CatalinaRequestAuthenticator extends RequestAuthenticator {
|
||||
protected void completeBearerAuthentication(KeycloakPrincipal principal, RefreshableKeycloakSecurityContext securityContext) {
|
||||
Set<String> roles = getRolesFromToken(securityContext);
|
||||
for (String role : roles) {
|
||||
log.debug("Bearer role: " + role);
|
||||
log.info("Bearer role: " + role);
|
||||
}
|
||||
Principal generalPrincipal = new CatalinaSecurityContextHelper().createPrincipal(request.getContext().getRealm(), principal, roles, securityContext);
|
||||
request.setUserPrincipal(generalPrincipal);
|
||||
|
||||
+145
-167
@@ -1,167 +1,145 @@
|
||||
package org.keycloak.adapters.as7;
|
||||
|
||||
import org.apache.catalina.Realm;
|
||||
import org.apache.catalina.realm.GenericPrincipal;
|
||||
import org.jboss.as.web.security.JBossGenericPrincipal;
|
||||
import org.jboss.security.NestableGroup;
|
||||
import org.jboss.security.SecurityConstants;
|
||||
import org.jboss.security.SecurityContext;
|
||||
import org.jboss.security.SecurityContextAssociation;
|
||||
import org.jboss.security.SimpleGroup;
|
||||
import org.jboss.security.SimplePrincipal;
|
||||
import org.keycloak.KeycloakSecurityContext;
|
||||
import org.keycloak.adapters.KeycloakAccount;
|
||||
|
||||
import javax.security.auth.Subject;
|
||||
import java.lang.reflect.Constructor;
|
||||
import java.security.Principal;
|
||||
import java.security.acl.Group;
|
||||
import java.util.ArrayList;
|
||||
import java.util.Collection;
|
||||
import java.util.Enumeration;
|
||||
import java.util.Iterator;
|
||||
import java.util.List;
|
||||
import java.util.Set;
|
||||
|
||||
/**
|
||||
* @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
|
||||
* @version $Revision: 1 $
|
||||
*/
|
||||
public class CatalinaSecurityContextHelper {
|
||||
|
||||
private static Constructor jbossWebPrincipalConstructor = findJBossGenericPrincipalConstructor();
|
||||
|
||||
public GenericPrincipal createPrincipal(Realm realm, final Principal identity, final Set<String> roleSet, final KeycloakSecurityContext securityContext) {
|
||||
KeycloakAccount account = new KeycloakAccount() {
|
||||
@Override
|
||||
public Principal getPrincipal() {
|
||||
return identity;
|
||||
}
|
||||
|
||||
@Override
|
||||
public Set<String> getRoles() {
|
||||
return roleSet;
|
||||
}
|
||||
|
||||
@Override
|
||||
public KeycloakSecurityContext getKeycloakSecurityContext() {
|
||||
return securityContext;
|
||||
}
|
||||
};
|
||||
Subject subject = new Subject();
|
||||
Set<Principal> principals = subject.getPrincipals();
|
||||
principals.add(identity);
|
||||
Group[] roleSets = getRoleSets(roleSet);
|
||||
for (int g = 0; g < roleSets.length; g++) {
|
||||
Group group = roleSets[g];
|
||||
String name = group.getName();
|
||||
Group subjectGroup = createGroup(name, principals);
|
||||
if (subjectGroup instanceof NestableGroup) {
|
||||
/* A NestableGroup only allows Groups to be added to it so we
|
||||
need to add a SimpleGroup to subjectRoles to contain the roles
|
||||
*/
|
||||
SimpleGroup tmp = new SimpleGroup("Roles");
|
||||
subjectGroup.addMember(tmp);
|
||||
subjectGroup = tmp;
|
||||
}
|
||||
// Copy the group members to the Subject group
|
||||
Enumeration<? extends Principal> members = group.members();
|
||||
while (members.hasMoreElements()) {
|
||||
Principal role = (Principal) members.nextElement();
|
||||
subjectGroup.addMember(role);
|
||||
}
|
||||
}
|
||||
// add the CallerPrincipal group if none has been added in getRoleSets
|
||||
Group callerGroup = new SimpleGroup(SecurityConstants.CALLER_PRINCIPAL_GROUP);
|
||||
callerGroup.addMember(identity);
|
||||
principals.add(callerGroup);
|
||||
SecurityContext sc = SecurityContextAssociation.getSecurityContext();
|
||||
Principal userPrincipal = getPrincipal(subject);
|
||||
sc.getUtil().createSubjectInfo(userPrincipal, account, subject);
|
||||
List<String> rolesAsStringList = new ArrayList<String>();
|
||||
rolesAsStringList.addAll(roleSet);
|
||||
|
||||
try {
|
||||
return (GenericPrincipal) jbossWebPrincipalConstructor.newInstance(realm, userPrincipal.getName(), null, rolesAsStringList, userPrincipal, null, account, null, subject);
|
||||
} catch (Throwable t) {
|
||||
throw new RuntimeException("Failed to create JBossGenericPrincipal", t);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Get the Principal given the authenticated Subject. Currently the first subject that is not of type {@code Group} is
|
||||
* considered or the single subject inside the CallerPrincipal group.
|
||||
*
|
||||
* @param subject
|
||||
* @return the authenticated subject
|
||||
*/
|
||||
protected Principal getPrincipal(Subject subject) {
|
||||
Principal principal = null;
|
||||
Principal callerPrincipal = null;
|
||||
if (subject != null) {
|
||||
Set<Principal> principals = subject.getPrincipals();
|
||||
if (principals != null && !principals.isEmpty()) {
|
||||
for (Principal p : principals) {
|
||||
if (!(p instanceof Group) && principal == null) {
|
||||
principal = p;
|
||||
}
|
||||
if (p instanceof Group) {
|
||||
Group g = Group.class.cast(p);
|
||||
if (g.getName().equals(SecurityConstants.CALLER_PRINCIPAL_GROUP) && callerPrincipal == null) {
|
||||
Enumeration<? extends Principal> e = g.members();
|
||||
if (e.hasMoreElements())
|
||||
callerPrincipal = e.nextElement();
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
return callerPrincipal == null ? principal : callerPrincipal;
|
||||
}
|
||||
|
||||
protected Group createGroup(String name, Set<Principal> principals) {
|
||||
Group roles = null;
|
||||
Iterator<Principal> iter = principals.iterator();
|
||||
while (iter.hasNext()) {
|
||||
Object next = iter.next();
|
||||
if ((next instanceof Group) == false)
|
||||
continue;
|
||||
Group grp = (Group) next;
|
||||
if (grp.getName().equals(name)) {
|
||||
roles = grp;
|
||||
break;
|
||||
}
|
||||
}
|
||||
// If we did not find a group create one
|
||||
if (roles == null) {
|
||||
roles = new SimpleGroup(name);
|
||||
principals.add(roles);
|
||||
}
|
||||
return roles;
|
||||
}
|
||||
|
||||
protected Group[] getRoleSets(Collection<String> roleSet) {
|
||||
SimpleGroup roles = new SimpleGroup("Roles");
|
||||
Group[] roleSets = {roles};
|
||||
for (String role : roleSet) {
|
||||
roles.addMember(new SimplePrincipal(role));
|
||||
}
|
||||
return roleSets;
|
||||
}
|
||||
|
||||
static Constructor findJBossGenericPrincipalConstructor() {
|
||||
for (Constructor<?> c : JBossGenericPrincipal.class.getConstructors()) {
|
||||
if (c.getParameterTypes().length == 9 &&
|
||||
c.getParameterTypes()[0].equals(Realm.class) &&
|
||||
c.getParameterTypes()[1].equals(String.class) &&
|
||||
c.getParameterTypes()[3].equals(List.class) &&
|
||||
c.getParameterTypes()[4].equals(Principal.class) &&
|
||||
c.getParameterTypes()[6].equals(Object.class) &&
|
||||
c.getParameterTypes()[8].equals(Subject.class)) {
|
||||
return c;
|
||||
}
|
||||
}
|
||||
return null;
|
||||
}
|
||||
|
||||
}
|
||||
package org.keycloak.adapters.as7;
|
||||
|
||||
import org.apache.catalina.Realm;
|
||||
import org.apache.catalina.realm.GenericPrincipal;
|
||||
import org.jboss.as.web.security.JBossGenericPrincipal;
|
||||
import org.jboss.security.NestableGroup;
|
||||
import org.jboss.security.SecurityConstants;
|
||||
import org.jboss.security.SecurityContext;
|
||||
import org.jboss.security.SecurityContextAssociation;
|
||||
import org.jboss.security.SimpleGroup;
|
||||
import org.jboss.security.SimplePrincipal;
|
||||
import org.keycloak.KeycloakSecurityContext;
|
||||
import org.keycloak.adapters.KeycloakAccount;
|
||||
|
||||
import javax.security.auth.Subject;
|
||||
import java.security.Principal;
|
||||
import java.security.acl.Group;
|
||||
import java.util.ArrayList;
|
||||
import java.util.Collection;
|
||||
import java.util.Enumeration;
|
||||
import java.util.Iterator;
|
||||
import java.util.List;
|
||||
import java.util.Set;
|
||||
|
||||
/**
|
||||
* @author <a href="mailto:bill@burkecentral.com">Bill Burke</a>
|
||||
* @version $Revision: 1 $
|
||||
*/
|
||||
public class CatalinaSecurityContextHelper {
|
||||
public GenericPrincipal createPrincipal(Realm realm, final Principal identity, final Set<String> roleSet, final KeycloakSecurityContext securityContext) {
|
||||
KeycloakAccount account = new KeycloakAccount() {
|
||||
@Override
|
||||
public Principal getPrincipal() {
|
||||
return identity;
|
||||
}
|
||||
|
||||
@Override
|
||||
public Set<String> getRoles() {
|
||||
return roleSet;
|
||||
}
|
||||
|
||||
@Override
|
||||
public KeycloakSecurityContext getKeycloakSecurityContext() {
|
||||
return securityContext;
|
||||
}
|
||||
};
|
||||
Subject subject = new Subject();
|
||||
Set<Principal> principals = subject.getPrincipals();
|
||||
principals.add(identity);
|
||||
Group[] roleSets = getRoleSets(roleSet);
|
||||
for (int g = 0; g < roleSets.length; g++) {
|
||||
Group group = roleSets[g];
|
||||
String name = group.getName();
|
||||
Group subjectGroup = createGroup(name, principals);
|
||||
if (subjectGroup instanceof NestableGroup) {
|
||||
/* A NestableGroup only allows Groups to be added to it so we
|
||||
need to add a SimpleGroup to subjectRoles to contain the roles
|
||||
*/
|
||||
SimpleGroup tmp = new SimpleGroup("Roles");
|
||||
subjectGroup.addMember(tmp);
|
||||
subjectGroup = tmp;
|
||||
}
|
||||
// Copy the group members to the Subject group
|
||||
Enumeration<? extends Principal> members = group.members();
|
||||
while (members.hasMoreElements()) {
|
||||
Principal role = (Principal) members.nextElement();
|
||||
subjectGroup.addMember(role);
|
||||
}
|
||||
}
|
||||
// add the CallerPrincipal group if none has been added in getRoleSets
|
||||
Group callerGroup = new SimpleGroup(SecurityConstants.CALLER_PRINCIPAL_GROUP);
|
||||
callerGroup.addMember(identity);
|
||||
principals.add(callerGroup);
|
||||
SecurityContext sc = SecurityContextAssociation.getSecurityContext();
|
||||
Principal userPrincipal = getPrincipal(subject);
|
||||
sc.getUtil().createSubjectInfo(userPrincipal, account, subject);
|
||||
List<String> rolesAsStringList = new ArrayList<String>();
|
||||
rolesAsStringList.addAll(roleSet);
|
||||
return new JBossGenericPrincipal(realm, userPrincipal.getName(), null, rolesAsStringList,
|
||||
userPrincipal, null, account, null, subject);
|
||||
|
||||
}
|
||||
|
||||
/**
|
||||
* Get the Principal given the authenticated Subject. Currently the first subject that is not of type {@code Group} is
|
||||
* considered or the single subject inside the CallerPrincipal group.
|
||||
*
|
||||
* @param subject
|
||||
* @return the authenticated subject
|
||||
*/
|
||||
protected Principal getPrincipal(Subject subject) {
|
||||
Principal principal = null;
|
||||
Principal callerPrincipal = null;
|
||||
if (subject != null) {
|
||||
Set<Principal> principals = subject.getPrincipals();
|
||||
if (principals != null && !principals.isEmpty()) {
|
||||
for (Principal p : principals) {
|
||||
if (!(p instanceof Group) && principal == null) {
|
||||
principal = p;
|
||||
}
|
||||
if (p instanceof Group) {
|
||||
Group g = Group.class.cast(p);
|
||||
if (g.getName().equals(SecurityConstants.CALLER_PRINCIPAL_GROUP) && callerPrincipal == null) {
|
||||
Enumeration<? extends Principal> e = g.members();
|
||||
if (e.hasMoreElements())
|
||||
callerPrincipal = e.nextElement();
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
return callerPrincipal == null ? principal : callerPrincipal;
|
||||
}
|
||||
|
||||
protected Group createGroup(String name, Set<Principal> principals) {
|
||||
Group roles = null;
|
||||
Iterator<Principal> iter = principals.iterator();
|
||||
while (iter.hasNext()) {
|
||||
Object next = iter.next();
|
||||
if ((next instanceof Group) == false)
|
||||
continue;
|
||||
Group grp = (Group) next;
|
||||
if (grp.getName().equals(name)) {
|
||||
roles = grp;
|
||||
break;
|
||||
}
|
||||
}
|
||||
// If we did not find a group create one
|
||||
if (roles == null) {
|
||||
roles = new SimpleGroup(name);
|
||||
principals.add(roles);
|
||||
}
|
||||
return roles;
|
||||
}
|
||||
|
||||
protected Group[] getRoleSets(Collection<String> roleSet) {
|
||||
SimpleGroup roles = new SimpleGroup("Roles");
|
||||
Group[] roleSets = {roles};
|
||||
for (String role : roleSet) {
|
||||
roles.addMember(new SimplePrincipal(role));
|
||||
}
|
||||
return roleSets;
|
||||
}
|
||||
|
||||
}
|
||||
+1
-2
@@ -64,8 +64,7 @@ public class KeycloakAuthenticatorValve extends FormAuthenticator implements Lif
|
||||
if (session != null) {
|
||||
session.removeNote(KeycloakSecurityContext.class.getName());
|
||||
if (ksc instanceof RefreshableKeycloakSecurityContext) {
|
||||
CatalinaHttpFacade facade = new CatalinaHttpFacade(request, null);
|
||||
((RefreshableKeycloakSecurityContext)ksc).logout(deploymentContext.resolveDeployment(facade));
|
||||
((RefreshableKeycloakSecurityContext)ksc).logout(deploymentContext.getDeployment());
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
-29
@@ -1,29 +0,0 @@
|
||||
package org.keycloak.adapters.as7;
|
||||
|
||||
import org.apache.catalina.Realm;
|
||||
import org.junit.Assert;
|
||||
import org.junit.Test;
|
||||
|
||||
import javax.security.auth.Subject;
|
||||
import java.lang.reflect.Constructor;
|
||||
import java.security.Principal;
|
||||
import java.util.List;
|
||||
|
||||
/**
|
||||
* @author <a href="mailto:sthorger@redhat.com">Stian Thorgersen</a>
|
||||
*/
|
||||
public class CatalinaSecurityContextHelperTest {
|
||||
|
||||
@Test
|
||||
public void test() {
|
||||
Constructor constructor = CatalinaSecurityContextHelper.findJBossGenericPrincipalConstructor();
|
||||
Assert.assertNotNull(constructor);
|
||||
Assert.assertEquals(Realm.class, constructor.getParameterTypes()[0]);
|
||||
Assert.assertEquals(String.class, constructor.getParameterTypes()[1]);
|
||||
Assert.assertEquals(List.class, constructor.getParameterTypes()[3]);
|
||||
Assert.assertEquals(Principal.class, constructor.getParameterTypes()[4]);
|
||||
Assert.assertEquals(Object.class, constructor.getParameterTypes()[6]);
|
||||
Assert.assertEquals(Subject.class, constructor.getParameterTypes()[8]);
|
||||
}
|
||||
|
||||
}
|
||||
@@ -4,7 +4,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0.5.Final</version>
|
||||
<version>1.0.1.Final</version>
|
||||
<relativePath>../../pom.xml</relativePath>
|
||||
</parent>
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0.5.Final</version>
|
||||
<version>1.0.1.Final</version>
|
||||
<relativePath>../../pom.xml</relativePath>
|
||||
</parent>
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0.5.Final</version>
|
||||
<version>1.0.1.Final</version>
|
||||
<relativePath>../../pom.xml</relativePath>
|
||||
</parent>
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0.5.Final</version>
|
||||
<version>1.0.1.Final</version>
|
||||
<relativePath>../../pom.xml</relativePath>
|
||||
</parent>
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
|
||||
+1
-1
@@ -3,7 +3,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0.5.Final</version>
|
||||
<version>1.0.1.Final</version>
|
||||
<relativePath>../pom.xml</relativePath>
|
||||
</parent>
|
||||
<name>Keycloak Integration</name>
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0.5.Final</version>
|
||||
<version>1.0.1.Final</version>
|
||||
<relativePath>../../pom.xml</relativePath>
|
||||
</parent>
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0.5.Final</version>
|
||||
<version>1.0.1.Final</version>
|
||||
<relativePath>../../../pom.xml</relativePath>
|
||||
</parent>
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
|
||||
+1
-2
@@ -69,8 +69,7 @@ public class KeycloakAuthenticatorValve extends FormAuthenticator implements Lif
|
||||
if (session != null) {
|
||||
session.removeNote(KeycloakSecurityContext.class.getName());
|
||||
try {
|
||||
CatalinaHttpFacade facade = new CatalinaHttpFacade(request, null);
|
||||
ServerRequest.invokeLogout(deploymentContext.resolveDeployment(facade), ksc.getToken().getSessionState());
|
||||
ServerRequest.invokeLogout(deploymentContext.getDeployment(), ksc.getToken().getSessionState());
|
||||
} catch (Exception e) {
|
||||
log.severe("failed to invoke remote logout. " + e.getMessage());
|
||||
}
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
<parent>
|
||||
<artifactId>keycloak-parent</artifactId>
|
||||
<groupId>org.keycloak</groupId>
|
||||
<version>1.0.5.Final</version>
|
||||
<version>1.0.1.Final</version>
|
||||
<relativePath>../../pom.xml</relativePath>
|
||||
</parent>
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
|
||||
+1
-2
@@ -79,8 +79,7 @@ public class ServletKeycloakAuthMech extends UndertowKeycloakAuthMech {
|
||||
session.removeAttribute(KeycloakSecurityContext.class.getName());
|
||||
session.removeAttribute(KeycloakUndertowAccount.class.getName());
|
||||
if (account.getKeycloakSecurityContext() != null) {
|
||||
UndertowHttpFacade facade = new UndertowHttpFacade(notification.getExchange());
|
||||
account.getKeycloakSecurityContext().logout(deploymentContext.resolveDeployment(facade));
|
||||
account.getKeycloakSecurityContext().logout(deploymentContext.getDeployment());
|
||||
}
|
||||
}
|
||||
};
|
||||
|
||||
Loaded 100 of 170 files, more files were not shown because too many files have changed in this diff.
Show more
Reference in new issue
Block a user