Questions tagged [keycloak]

Integrated Single Sign On (SSO) and Identity Manager (IDM) for browser apps and RESTful web services. Built on top of JBoss / Wildfly and complies with OAuth 2.0, Open ID Connect, JSON Web Token (JWT) and SAML 2.0 specifications.

Filter by
Sorted by
Tagged with
0 votes
0 answers
70 views

Upgrade to KeyCloak 18 fails

I have a KeyCloak 17.0.1 that is apparently working without issues on my server, configured to use MariaDB. I say "apparently" because, as of today, it's not in production yet, albeit it ...
user avatar
0 votes
0 answers
16 views

Keycloak Throws NullPointerException with RoleMappings

Keycloak sometimes throws NPE and observed following error. We are creating SuperUser of type composite , but SuperUser is created without composite on and for other user Roles are not assigned . 2022-...
user avatar
0 votes
0 answers
32 views

How to get the client-id and client-secret from keycloak?

For a web application I need the client-id and client-secret from Keycloak. How can I access these in the web interface?
user avatar
  • 1
0 votes
0 answers
6 views

Can Keycloak emit a JWT token for interactive authentication?

Using Keycloak with OID, we normally authenticate users through our client applications via API, using the JWT access token emitted by Keycloak. Our clients receive the JWT token, which gets injected ...
user avatar
0 votes
0 answers
415 views

Conteinerized Keycloak behind Nginx reverse proxy requests localhost

Working setup I have a configuration of external VPS with public IP that has Nginx reverse proxy (A) internal server with Nginx (B) standalone application (not containerized) Keycloak 17.0.1 Which ...
user avatar
  • 101
0 votes
0 answers
482 views

next-auth ECONNREFUSED 127.0.0.1:80

I am using Next-auth with keycloak and docker-compose and I get this error: [next-auth][error][GET_AUTHORIZATION_URL_ERROR] arcade-iori | https://next-auth.js.org/errors#...
user avatar
1 vote
0 answers
188 views

Wrong redirect_uri on keycloak

I am trying to use keycloak to authenticate my service that are provided in a tomcat 8 docker by following https://github.com/keycloak/keycloak-documentation/blob/main/securing_apps/topics/oidc/java/...
user avatar
  • 121
1 vote
0 answers
114 views

Keycloak: Difference between Authentication sessions and User Sessions

I was going through the documentation https://www.keycloak.org/docs/latest/server_installation/#cache Here they have described different types of caches. I didn't quite understand the definitions they ...
user avatar
  • 123
1 vote
0 answers
107 views

Indirect Group Membership with Keycloak and oauth2-proxy

I'm using oauth2-proxy/oauth2-proxy with Keycloak-oidc provider for authentication for some pods in my Kubernetes cluster. I can specify which groups are allowed to access a resource using the --...
user avatar
  • 611
1 vote
0 answers
60 views

JBoss: How does <stacks> in the standalone-ha.xml work?

This file contains the usual Keycloak server configuration with the addition of WildFly10 High Availability extensions like Infinispan HA cache and JGroups HA communication channels and their ...
user avatar
  • 123
1 vote
1 answer
546 views

Keycloak install with helm on GKE with Cloud SQL (external) database

I'm trying to install keycloak on GKE cluster in GCP with external database, i.e. CloudSQL postrges db. I want to use helm to install it, so: helm repo add bitnami https://charts.bitnami.com/bitnami ...
user avatar
0 votes
2 answers
299 views

Wildfly standalone.xml - passing secret to KeyCloak SPI from elytron credential store

I'm migrating KeyCloak v15 (WildFly v23) passwords from the old vault to elytron credential store. It works fine for the standard use case. In standalone.xml, I have: /server/extensions/extension: <...
user avatar
  • 41
1 vote
1 answer
496 views

Logging username in KeyCloak access-log

In KeyCLoak 15.0 (that is WildFly 23.0), I’m trying to configure access-log to also include username (or any ID of the user) when a user is logged in. In keycloak/standalone/configuration/standalone....
user avatar
  • 41
0 votes
1 answer
305 views

Unable to use service account to get userinfo for Keycloak 12.0.4

I am running keycloak version 12.0.4. Previously when I was running version 11.0.2. I am able to use my service account and call the endpoint {{KEYCLOAK_URL}}/auth/realms/{{REALM}}/protocol/openid-...
user avatar
  • 101
3 votes
0 answers
640 views

Keycloak login error destination_invalid

I'm currently trying to set up keycloak to provide single sign on to a nextcloud and gitlab instance. All three services are running inside a docker compose network with an nginx server as proxy to ...
user avatar
  • 131
1 vote
1 answer
70 views

graviteeio - management-rest-api oauth role mappings

Gravitee manager can be configured with keycloak authentication as described here. They state in their documentation, that role mapping could be addressed on their gravitee.yml configuration: security:...
user avatar
1 vote
0 answers
250 views

Unable to add users from Keycloack on FreeIPA via LDAP although Keycloack host has permissions set in FreeIPA

I have the following setup: FreeIPA 4.8.7 via docker (freeipa/freeipa-server:centos-8) Keycloack 12.0.1 The FreeIPA users are in cn=users,cn=accounts,dc=freeipa,dc=example,dc=com Keycloack DN: ...
user avatar
0 votes
1 answer
336 views

GLPI appending :80 to CAS Callback URL

Problem: GLPI is appending :80 to the callback URL for CAS authentication using Keycloak. After logging in successfully on Keycloak, user gets redirected to the GLPI URL which containers :80 in the ...
user avatar
  • 109
0 votes
1 answer
200 views

How to map internal OIDC group to external K8s cluster roles

I have successfully connected my K8s cluster + dashboard to my Keycloak server, now i have asked myself the question: I have followed these instructions here. Furthermore I also made the appropriate ...
user avatar
  • 23
0 votes
1 answer
288 views

JBPM KIE Server Token Based Authentication

I have successfully installed and configured JBPM 7.40.0 and Keycloak 11.0.0 on the same server instance as per the documentation . I can succesfully do GET http://myserver/kie-server/services/rest/...
user avatar
0 votes
1 answer
88 views

Why does embedding KeyCloak into a another stack using requirements.yaml fail?

I ran into a really weird issue when using https://github.com/codecentric/helm-charts/tree/master/charts/keycloak to set up keycloak on k8s: Using this helmchart and setting it up directly works ...
user avatar
  • 11
2 votes
2 answers
1k views

How can I resolve "SAML Providers must reference at least one SAML assertion issuer" message?

I want to setup a SSO solution using Keycloak 10.0.2 as the Identity Provider. The first application I want to setup is AWS. I followed this tutorial to enable Keycloak to sign me in using SAML. I ...
user avatar
2 votes
0 answers
219 views

Keycloak takes a long time to wake up if unused during a day or more

I installed Keycloak with a docker compose, behind an NGINX reverse proxy. Keycloack is only installed now for testing. When I stop using it for a days or more, next time I have a "Request Time-out" ...
user avatar
2 votes
1 answer
121 views

Invalid keycloak URL error when installing alfresco-dbp with helm in Kubernetes on AWS

I'm currently trying to deploy Alfresco Content Services on AWS following this guide. I got as far as to "Creating File Storage for Alfresco Content Services Community" where I have to create an EFS ...
user avatar
5 votes
2 answers
12k views

KEYCLOAK + MYSQL + DOCKER --> Failed to start

I am trying to start a Keycloak instance which uses a custom mysql database instead of the embedded H2. Since I am planning to use docker, I created a network for Keyclock docker to communicate with ...
user avatar
  • 101
2 votes
1 answer
2k views

Howto traefik->keycloak gatekeeper->service?

My question is: Specifically, how do I configure traefik to double proxy through keycloak gatekeepr to authenticate my services as outlined below? I know my authentication chain looks like the ...
user avatar