When I login using keycloak, I see that the assertion is coming in over the frontend, via the browser. What should I do in the keycloak gui so that the assertion comes in in a soap message over the backend?
Related
Have Integrated a Java struts based server side application with a keycloak OIDC and Oauth provider.
Java servlet adapter mentioned in the https://access.redhat.com/documentation/en-us/red_hat_single_sign-on_continuous_delivery/3/html-single/securing_applications_and_services_guide/index#servlet_filter_adapter is used for the same implemetation.
The redirect_uri configured on the server is something like https://env.application.com/contextpath/
When the we application session timeouts and the user clicks on any link in the application the redirect_uri that goes as part of authorization code grant flow adds the URI of the link in addition to the redirect_uri configured in keycloak server. This will something like for example https://env.application.com/contextpath**/submenu?name=menu**
This will result in an invalid redirect_uri error from the keycloak server.
The keycloak server doesn't allow to configure a placeholder * to be configured for security reasons.
Could someone please let me know how to handle we application session timeouts with integrated with keycloak OIDC and OAUTH provider.
Is there any other best practise availble to handle session timeouts in webapplications integrated with keyclaok OIDC.
How to implement logout of client side services after idle timeout?
Services are secured by Keycloak + Application gateway.
The Gateway is node.js app which protects services' urls using Keycloak node.js adapter, so that authentication will be required on browser access to the urls. (redirect to login url)
Services enforce authorization locally by inspecting roles present in the access token gateway receives and attaches to the request after successful authentication.
Keycloak is behind gateway too.
I thought about adding custom event listener in Keycloak code which would notify all the services interested in session timeout event via some message bus.
Thanks in advance.
Keycloak informs all clients participating in a session that gets terminated (by timeout or explicit logout request). The only prerequisite is that the "Admin URL" is set for the client (see Keycloak admin console - client settings).
Since you're using the Keycloak node.js adapter it should be able to handle the logout request from Keycloak.
See Keycloak Server Administration Guide (look for "Admin URL").
I have a external openidconnect identity provider registered with Keycloak. When the client app tries to access the protected resource it gets redirected to KeyCloak login page. On the login page I have the external openidconnect provider buttons enabled. Once the user clicks on the button he is taken to the external identity provider (which is identityserver3 instance). The external provider does authenticate the user and send back a code.
Now the redirecturl for the registered client in the external identity provider is that of keycloak's. So after authentication is successful at the external IDP it send back the code(because it is Auth code flow) to keycloak at a redirect url:
http://localhost:5555/auth/realms/QA/broker/keycloak-client/endpoint?code=7bcf5157105199d50874e64eabf03858&state=wQhNIEKW0Ws6CotZg2EsvOorjDVQlWVvobcM2skPSXo.keycloak-client&session_state=rhgu-BXT8FniG9Z-UARKpp_f-V1nLN-VxFmSE3PSxDg.99b2d903367208e4261fefa475afb1eb
In the URL if you see it ends with endpoint. I don't think that's correct but I cannot change it in KeyCloak (it's disabled) and because of that in the external IDP client configuration.
KeyCloak does not understand above url and errors out with a message "unexpected error when authenticating with Identity Provider"
Isn't KeyCloak supposed to understand the code flow and make another request for token after receiving the code. Then the external IDP will respond with token and Keycloak will send back that token to client(will also store it for future use).
Can someone please share some knowledge on how Keycloak works with external openidconnect ID provider with code flow.
Usually the redirect URI for external identity providers take the form of {keycloak-host}/auth/realms/{realm}/broker/{provider}/endpoint. You have to specify this as the redirect URI when you register your client in the external identity provider. Once the user is authenticated through the external IdP, authorization code will be sent to this url, which in turn will redirect it to the redirect url of your client application (specified when registering the client in Keycloak).
Unexpected error when authenticating with Identity Provider is the general error message sent by Keycloak for several errors that occur during the OAuth flow. You won't be able to determine the actual cause without going through the stack trace or the logs in the prompt.
You are getting this error because keyclaok is unable to get token from identityserver3 by exchanging authorization code. Where did you hosted identityserver3? Does it have a real ca certificate or you are using self sign certificate? Have you configured client_id , secret, token endpoint properly in keycloak external IDP configuration? You can test manually my posting client_id, secret, code (that you received) in token endpoint of identityserver3.
I'm implementing an SSO authentication flow using SAML for a web server running tomcat. Everything is working ok when using POST or Redirect bindings, but from what I've read to support the SAML authentication in front of a REST API I need to also configure and use an ECP profile.
First correct me if I'm wrong but the ECP flow should be like this:
Client accesses the SP REST API
Client knows he needs to authenticate so he sets up the required ECP headers (Accept: application/vnd.paos+xml and PAOS: urn:liberty:paos:2003-08;urn:oasis:names:tc:SAML:2.0:profiles:SSO:ecp)
SP sees client is not authenticated and returns a SOAP Envelop containing PAOS Request.
The client is responsible to send this to the appropriate IdP on its ECP consumer service.
The IdP challenges the client for authentication
The IdP returns a response in the form of another SOAP Envelop, containing the saml Response in its body
The client must send this response to SP's ECP/SOAP assertion consumer service
The problem is all of this works until step 6. On this step I have the problem, that the Body of the response envelop contains a Destination attribute, which points to the POST assertion consumer service of the SP. This destination attribute is set by keycloak and mismatches the actual ECP service that I want to send the response to. The SAML library we are using is opensaml and it checks the request URI against this Destination attribute and if they do not match it throws an exception org.opensaml.xml.security.SecurityException: SAML message intended destination endpoint did not match recipient endpoint.
I understand why this exception is thrown, but cannot understand how I can configure Keycloak with the ECP/SOAP service of the SP. In Keycloak's admin console I can only configure the URLs for SSO POST/Redirect and SLO POST/Redirect, but nothing about ECP.
I'm currently in the process of configuring another IdP, but I would really like to make sure that Keycloak can also be a supported server for our solution.
Can't you just read the paos:Request responseConsumerURL and post the idp response to that url?
At least, that's how I managed to do it.
I am testing SAML SSO using WSO2 Identity Server 5.0.0 with two PHP application instances as service providers (using onelogin phpsaml). I managed to make the single sign on to work but now I'm facing a problem with single logout.
When I trigger a logout request from the PHPApp1, WSO2 IDP responds
with a logout response and it seems to works fine;
WSO2 IDP triggers a logout request to the saml session particants, in this case to the PHPApp2;
The PHPApp2 handles the logout request and redirect to the WSO2 IDP logout url with the LogoutResponse;
And now the issue: WSO2 does not seems to handle the logout response from PHPApp2 and prints in logs the following message:
WARN {org.wso2.carbon.identity.sso.saml.logout.LogoutRequestSender} - Failed single logout response from http://php-app2.dev/saml/sls with status code Moved Temporarily {org.wso2.carbon.identity.sso.saml.logout.LogoutRequestSender}
After that WSO2 keeps trying sending logout requests to the PHPApp2 and ends up with the following message:
ERROR {org.wso2.carbon.identity.sso.saml.logout.LogoutRequestSender} - Single logout failed after retrying 5 times with time interval 60000 in milli seconds. {org.wso2.carbon.identity.sso.saml.logout.LogoutRequestSender}
I tried to enable debug logs in WSO2 to obtain more detailed information about the issue but I am not able to get any helpful information.
Is there any way to get more detailed information about this issue?
Any help is welcomed.
Michael, In the SAML Single Logout implementation, when the PHPApp1 initiates the logout, it redirects the user to WSO2 IDP. Then WSO2 IDP validates the LogoutRequest message, after successful validation, WSO2 IDP figure-out the existing session participants (in this case WSO2 IDP will detect PHPApp2). So after session participants are figured, the WSO2 IDP will send Logout Requests to those in stateless way (no browser involvement) and the session participants (PHPApp2) should validate the Logout Requests from the WSO2 IDP and should send the Logout Response back (no browser involvement, no redirections) to the WSO2 IDP. After WSO2 IDP receives all the LogoutResponses back from the all session participants, WSO2 IDP contract it's Logout Response to the initiator which is PHPApp1, this will be sent as a browser redirection (HTTP Form submission).
Well, the problem is due to the fact that onelogin/php-saml implementation handles the IDP Logout request by redirecting the response to the IDP.
I change the code to returns the response instead and it is working now. Considering that I am new to the SAML standards, I am not sure if it is the correct way to solve that.
WSO2 IS works with strong assumptions that servers could see and talk to each other. This way it tries to be polite and sends the logout requests on back channel (server-to-server without user involvement). As the response the SP should send back a valid logout response. The WSO2 IS currently checks only the HTTP status code (200).
SimpleSAMLphp works with user browsers (and assuming the requests are coming from the user) and after receiving the logout request it tries to redirect the user back to IDP with the SAML Response using Redirect-binding. It's issuing HTTP 302 response.
Try to configure the SimpleSAMLphp to use POST binding for logout (in saml20-idp-remote.php). Still - SimpleSAMLphp it may try to redirect the user before returning the form with logout response and WSO2 IS will not follow the redirects.
Gabriel
Make sure you are using a database type session store.
SimpleSAMLphp can then kill the session without the browser context when it receives the LogoutRequest from the remote server directly rather than through a browser redirect.