keycloak wikipedia

As usual, the fascist side of Wikipedia attracts swarms of wikilosers, in search of a victim to club down to death.

My article on Keycloak has been marked for deletion, so I am saving it here for the benefit of future generations (I know, there is no future, but let's pretend there is)

Keycloak Developer(s) JBoss, a division of Red Hat
Stable release
3.3.0 / October 26, 2017
Written in Java
Type Single sign-on system
License LGPL
Website keycloak.org


Keycloak is a software product from JBoss to allow single sign-on and Identity Management.

Contents

1 Features
2 Components
3 See also
4 References

Features

Among the many features of Keycloak include :

User Registration
Social login
Single Sign-On/Sign-Off across all applications belonging to the same Realm
2-factor authentication
LDAP integration
Kerberos broker
multitenancy with per-realm customizeable skin


Components

There are 2 main components of Keycloak:

Keycloak server
Keycloak application adapter

See also

Single sign-on
OpenSSO
Kerberos (protocol)
Identity management
List of single sign-on implementations

References
Official web site http://www.keycloak.org/
Sébastien Blanc (June 16, 2017). "Easily Secure Your Spring Boot Applications With Keycloak". dzone.com. https://dzone.com/articles/easily-secure-your-spring-boot-applications-with-k



I swear I will never touch Wikipedia again.

Remote debug Wildfly with Eclipse, KeycloakPrincipal

./standalone.bat --debug

This generates


JAVA_OPTS: "-Dprogram.name=standalone.bat -Xms64M -Xmx512M -XX:MetaspaceSize=96M -XX:MaxMetaspaceSize=256m -Djava.net.preferIPv4Stack=true -Djboss.modules.system.pkgs=org.jboss.byteman -agentlib:jdwp=transport=dt_socket,address=8787,server=y,suspend=n"

===============================================================================

Listening for transport dt_socket at address: 8787



In fact, in standalone.bat you find this code:

rem Set debug settings if not already set
if "%DEBUG_MODE%" == "true" (
   echo "%JAVA_OPTS%" | findstr /I "\-agentlib:jdwp" > nul
  if errorlevel == 1 (
     set "JAVA_OPTS=%JAVA_OPTS% -agentlib:jdwp=transport=dt_socket,address=%DEBUG_PORT_VAR%,server=y,suspend=n"
  ) else (
     echo Debug already enabled in JAVA_OPTS, ignoring --debug argument
  )
)

You can now follow these instructions https://www.eclipse.org/jetty/documentation/9.4.x/debugging-with-eclipse.html to configure Eclipse,
or simply

right-click on project in eclipse, Debug as, Remote Java Application, then you get this dialog

so I can trace this code:



public String getPrincipalName(HttpServletRequest request) {
KeycloakPrincipal keycloakPrincipal = (KeycloakPrincipal)request.getUserPrincipal();
return keycloakPrincipal != null ? keycloakPrincipal.getKeycloakSecurityContext().toString() : "unauthenticated" ;
}


and discover this:

In a ManagedBean you can inject a Principal, and Wildfly will take care of it transparently:

@Named
@RequestScoped
public class EventViewBean {
@Inject Principal principal;

public void getPrincipal() {
System.out.println("principal class name is " + principal.getClass().gtName());
}
}


This will print a:

org.jboss.weld.security.Principal$$Proxy$_$$_Weld$Proxy$


and not - as expected - a http://www.keycloak.org/docs-api/3.2/javadocs/org/keycloak/KeycloakPrincipal.html who however also implements the https://docs.oracle.com/javase/7/docs/api/java/security/Principal.html interface

Keycloak, cookies and principal

When you access a secured webapp, the first cookie to be created is a JSESSIONID

/pvkeycloakdemo is my webapp root context

When you access a protected resource, you get redirected to keycloak authentication server, and another 2 cookies appear: a OAuth_Token_Request_State (Path=/pvkeycloakdemo) and a AUTH_SESSION_ID (Path=/auth/realms/demo)

After authenticating in Keycloak, I get a KC_RESTART, a KEYCLOAK_IDENTITY and a KEYCLOAK_SESSION (Path=/auth/realms/demo)

KEYCLOAK_SESSION is a special one: it's the only one with a 12 hour expiration time (all others expire at end of session) and the value specifies the realm name : demo/34f600e7-bfd6-475c-9596-72491b9455fa/fa9c5c6b-5e70-43ce-aeb8-34b2188e3c7f (demo in this case)

If you choose the option "remember me", you get also a cookie KEYCLOAK_REMEMBER_ME



When you do a request.getPrincipal(), the java.security.Principal is a org.keycloak.KeycloakPrincipal, and the principal Name is the ID that you see in the Keycloak console, not the Name:

Keycloak

Sadly there is not even a wikipedia entry, apart this short section https://en.wikipedia.org/wiki/List_of_single_sign-on_implementations "Federated SSO (LDAP and Active Directory), standard protocols (OpenID Connect, OAuth 2.0 and SAML 2.0) for Web, clustering and single sign on"

How to setup a Keycloak server:
http://blog.keycloak.org/2015/10/getting-started-with-keycloak.html

I have done the "Standalone installation" on Windows and it works without a glitch.
The official documentation is here http://www.keycloak.org/docs/latest/getting_started/index.html - tidy and condensed.

How to secure a REST application with the previously setup Keycloak server
http://blog.keycloak.org/2015/10/getting-started-with-keycloak-securing.html

except that the link is broken and I got the repo from "git clone https://github.com/redhat-developer/redhat-sso-quickstarts.git" and cd redhat-sso-quickstarts and cd service-jee-jaxrs. Running mvn package now fails because of the missing keycloak.json file in the config folder.

I follow the instructions here https://github.com/redhat-developer/redhat-sso-quickstarts/tree/7.0.x/service-jee-jaxrs to create a config\keycloak.json file . Only after creating this file you can run mvn package and build the service.war.

I start a standalone wildfly at 8080, do mvn install wildfly:deploy and I get Unknown authentication mechanism KEYCLOAK

This because in my app the web.xml contains <login-config><auth-method>KEYCLOAK</auth-method></login-config>
If I change it to BASIC and redeploy, then hit http://localhost:8080/service/public , it all works. But I need KEYCLOAK!




Here https://stackoverflow.com/questions/27253559/keycloak-unknown-authentication-mechanism they explain how to configure Wildfly for KEYCLOAK.

I download the client adapter for Wildfly http://www.keycloak.org/downloads.html, the file is keycloak-wildfly-adapter-dist-3.3.0.CR2.zip and I unzip it in the WLIDFLY_HOME folder, so as to merge it to the existing bin and modules folders. Then I run:

jboss-cli.bat -c --file=adapter-install.cli


This adds

<security-domain name="keycloak">
 <authentication>
  <login-module code="org.keycloak.adapters.jboss.KeycloakLoginModule" flag="required"/>
 </authentication>
</security-domain>

but it still doesn't work, same error "Unknown authentication mechanism KEYCLOAK"...

strange, in Wildfly console I can see Configuration: Subsystems Subsystem: Security Security Domain: keycloak

However, I see the message "Extension module org.keycloak.keycloak-adapter-subsystem not found"... so I run also this

jboss-cli.bat -c --file=adapter-install.cli

and restart everything and it works!

Some valuable KEYCLOAK tutorials:

this one with some quick demo on how to secure webapps, nodejs etc applications:




this one is quite professional on the overall features:





Detailed configuration instructions here http://www.keycloak.org/docs/latest/getting_started/topics/secure-jboss-app/download-quickstarts.html

Quickstarts available here https://github.com/keycloak/keycloak-quickstarts