Questions tagged [keycloak]
Integrated Single Sign On (SSO) and Identity Manager (IDM) for browser apps and RESTful web services. Built on top of JBoss / Wildfly and complies with OAuth 2.0, Open ID Connect, JSON Web Token (JWT) and SAML 2.0 specifications.
37
questions
0
votes
0
answers
36
views
Keycloak is automatically changing certificate
I'm using Keycloak Quay 22.0.3 with docker-compose behind a Nginx reverse proxy but I have some troubles due an automatic replace of my certificate generated with certbot.
My certificate generated ...
- 101
0
votes
2
answers
49
views
fail2ban on host for rootless podman keycloak container
running on Rocky Linux 9.2 with podman 4.4.1.
I got a podman Pod with keycloak + postgresql inside, running rootless. The pod itself with --network 'slirp4netns:port_handler=slirp4netns'. The keycloak ...
- 141
0
votes
0
answers
156
views
Multiple Kerberos Providers in Keycloak
I have a Keycloak with 2 different LDAP Providers which include Kerberos Authentication.
Provider A is on first priority, provider B on second priority. Both provider settings provide their different ...
- 131
0
votes
0
answers
148
views
Keycloak Docker fails to start due to "Negative Delay." Error
Running a keycloak container (21.0 - 21.1.1) on a Debian 11 Bullseye recently stopped working after host restart (MariaDB didn't start up, leading to keycloak also exiting. When the issue was noticed ...
- 101
0
votes
0
answers
352
views
How to scrape Prometheus secured with OAuth2-proxy and Keycloak
I have 2 prometheuses, both are with forward-auth via the oauth2-proxy, which have the same client credentials in a single keycloak.
I would like one prometheus to federate the other one. This is my ...
- 373
0
votes
0
answers
221
views
keycloak: Sharing autentication beetween different domain
my company has multiple top domains, eg.
foo.com
bar.net
baz.org
I have created a subdomain for each authentication domain:
auth.foo.com
auth.bar.net
auth.baz.org
and behind each subdomain there is ...
- 485
0
votes
1
answer
369
views
Can I use keycloak as an Idp for kibana installed using the ElasticSearch Operator in kubernetes?
I have setup a kubernetes cluster in a private network and I'm using a gateway machine for accessing the cluster. In the kubernetes cluster I have installed the elasticsearch operator and through that ...
-1
votes
1
answer
456
views
Keycloak 16 - can it log OIDC access tokens for Open-ID Connect identity providers?
How can I make Keycloak 16 log the access token, when using an Open-ID Connect identity provider? I need to see what claims the OIDC provider sends to Keycloak.
- 282
0
votes
0
answers
69
views
How to create an ready-enabled user in Active Directory with one LDAP query?
I am trying to use Keycloak to store my users in Active Directory. It creates the users, but they are not enabled by default.
I create them with a random password and with a pwdLastSet attribute so ...
- 200
0
votes
0
answers
74
views
MetalLB doesn't assign IP address to Keycloak service
I have installed both MetalLB and Keylcloak to my cluster.
Both Keycloak's and MetalLB's pods are running, but the main Keycloak Load balance service is expecting IP (EXTERNAL-IP is in pending state).
...
1
vote
1
answer
660
views
HAProxy deny HTTP request on path_beg not matching
I have a HAProxy node in front of a Keycloak node. I want to only expose the API needed to serve the users (not the Admin panel) I have the following on my haproxy.cfg
frontend block
frontend haproxy-...
- 113
2
votes
0
answers
225
views
Can't get Keycloak to add new users/groups to OpenLDAP
I've been banging my head against the wall for two days on this one now.
I have setup fresh Keycloak and OpenLDAP instances, and I want to use OpenLDAP as the source of truth for all user data. I want ...
- 457
1
vote
1
answer
481
views
Keycloak w/ EKS + ALB (401 after auth)
I’m currently trying to get Keycloak to run in EKS behind ALB and for the life of me, I can’t get it to work. I get the redirect to a login screen and after I log in - I instantly get presented with ...
- 21
0
votes
0
answers
593
views
Upgrade to KeyCloak 18 fails
I have a KeyCloak 17.0.1 that is apparently working without issues on my server, configured to use MariaDB. I say "apparently" because, as of today, it's not in production yet, albeit it ...
- 420
0
votes
2
answers
20k
views
How to get the client-id and client-secret from keycloak?
For a web application I need the client-id and client-secret from Keycloak. How can I access these in the web interface?
- 3
0
votes
0
answers
4k
views
Conteinerized Keycloak behind Nginx reverse proxy requests localhost
Working setup
I have a configuration of
external VPS with public IP that has Nginx reverse proxy (A)
internal server with Nginx (B)
standalone application (not containerized) Keycloak 17.0.1
Which ...
- 101
0
votes
0
answers
2k
views
next-auth ECONNREFUSED 127.0.0.1:80
I am using Next-auth with keycloak and docker-compose and I get this error:
[next-auth][error][GET_AUTHORIZATION_URL_ERROR]
arcade-iori | https://next-auth.js.org/errors#...
1
vote
0
answers
1k
views
Wrong redirect_uri on keycloak
I am trying to use keycloak to authenticate my service that are provided in a tomcat 8 docker by following https://github.com/keycloak/keycloak-documentation/blob/main/securing_apps/topics/oidc/java/...
- 131
1
vote
0
answers
585
views
Keycloak: Difference between Authentication sessions and User Sessions
I was going through the documentation
https://www.keycloak.org/docs/latest/server_installation/#cache
Here they have described different types of caches.
I didn't quite understand the definitions they ...
- 123
1
vote
0
answers
259
views
Indirect Group Membership with Keycloak and oauth2-proxy
I'm using oauth2-proxy/oauth2-proxy with Keycloak-oidc provider for authentication for some pods in my Kubernetes cluster.
I can specify which groups are allowed to access a resource using the --...
- 593
1
vote
0
answers
243
views
JBoss: How does <stacks> in the standalone-ha.xml work?
This file contains the usual Keycloak server configuration with the addition of WildFly10 High Availability extensions like Infinispan HA cache and JGroups HA communication channels and their ...
- 123
1
vote
1
answer
1k
views
Keycloak install with helm on GKE with Cloud SQL (external) database
I'm trying to install keycloak on GKE cluster in GCP with external database, i.e. CloudSQL postrges db.
I want to use helm to install it, so:
helm repo add bitnami https://charts.bitnami.com/bitnami
...
google-cloud-platform
0
votes
2
answers
827
views
Wildfly standalone.xml - passing secret to KeyCloak SPI from elytron credential store
I'm migrating KeyCloak v15 (WildFly v23) passwords from the old vault to elytron credential store. It works fine for the standard use case. In standalone.xml, I have:
/server/extensions/extension:
<...
- 61
1
vote
1
answer
1k
views
Logging username in KeyCloak access-log
In KeyCLoak 15.0 (that is WildFly 23.0), I’m trying to configure access-log to also include username (or any ID of the user) when a user is logged in. In keycloak/standalone/configuration/standalone....
- 61
0
votes
1
answer
733
views
Unable to use service account to get userinfo for Keycloak 12.0.4
I am running keycloak version 12.0.4.
Previously when I was running version 11.0.2.
I am able to use my service account and call the endpoint {{KEYCLOAK_URL}}/auth/realms/{{REALM}}/protocol/openid-...
- 101
3
votes
0
answers
1k
views
Keycloak login error destination_invalid
I'm currently trying to set up keycloak to provide single sign on to a nextcloud and gitlab instance. All three services are running inside a docker compose network with an nginx server as proxy to ...
- 131
1
vote
1
answer
185
views
graviteeio - management-rest-api oauth role mappings
Gravitee manager can be configured with keycloak authentication as described here.
They state in their documentation, that role mapping could be addressed on their gravitee.yml configuration:
security:...
- 11
1
vote
0
answers
743
views
Unable to add users from Keycloack on FreeIPA via LDAP although Keycloack host has permissions set in FreeIPA
I have the following setup:
FreeIPA 4.8.7 via docker (freeipa/freeipa-server:centos-8)
Keycloack 12.0.1
The FreeIPA users are in cn=users,cn=accounts,dc=freeipa,dc=example,dc=com
Keycloack DN: ...
- 111
0
votes
1
answer
811
views
GLPI appending :80 to CAS Callback URL
Problem:
GLPI is appending :80 to the callback URL for CAS authentication using Keycloak. After logging in successfully on Keycloak, user gets redirected to the GLPI URL which containers :80 in the ...
- 119
0
votes
1
answer
407
views
How to map internal OIDC group to external K8s cluster roles
I have successfully connected my K8s cluster + dashboard to my Keycloak server, now i have asked myself the question:
I have followed these instructions here.
Furthermore I also made the appropriate ...
- 143
0
votes
1
answer
459
views
JBPM KIE Server Token Based Authentication
I have successfully installed and configured JBPM 7.40.0 and Keycloak 11.0.0 on the same server instance as per the documentation . I can succesfully do GET http://myserver/kie-server/services/rest/...
- 101
0
votes
1
answer
110
views
Why does embedding KeyCloak into a another stack using requirements.yaml fail?
I ran into a really weird issue when using https://github.com/codecentric/helm-charts/tree/master/charts/keycloak to set up keycloak on k8s:
Using this helmchart and setting it up directly works ...
- 11
2
votes
2
answers
2k
views
How can I resolve "SAML Providers must reference at least one SAML assertion issuer" message?
I want to setup a SSO solution using Keycloak 10.0.2 as the Identity Provider. The first application I want to setup is AWS.
I followed this tutorial to enable Keycloak to sign me in using SAML. I ...
- 162
2
votes
0
answers
376
views
Keycloak takes a long time to wake up if unused during a day or more
I installed Keycloak with a docker compose, behind an NGINX reverse proxy. Keycloack is only installed now for testing.
When I stop using it for a days or more, next time I have a "Request Time-out" ...
- 121
2
votes
1
answer
163
views
Invalid keycloak URL error when installing alfresco-dbp with helm in Kubernetes on AWS
I'm currently trying to deploy Alfresco Content Services on AWS following this guide. I got as far as to "Creating File Storage for Alfresco Content Services Community" where I have to create an EFS ...
- 123
6
votes
2
answers
15k
views
KEYCLOAK + MYSQL + DOCKER --> Failed to start
I am trying to start a Keycloak instance which uses a custom mysql database instead of the embedded H2.
Since I am planning to use docker, I created a network for Keyclock docker to communicate with ...
- 111
2
votes
1
answer
3k
views
Howto traefik->keycloak gatekeeper->service?
My question is:
Specifically, how do I configure traefik to double proxy through keycloak gatekeepr to authenticate my services as outlined below?
I know my authentication chain looks like the ...
