How to enable brute force detection in keycloak using kcadm? - keycloak

I need to enable brute force detection in security defences tab in keycloak, but i dont want to enable it manually is there way to do it using kcadm ???
thankyou in advance!


You can do this via the REST API and therefore via kcadm when creating or updating the realm.
Check the RealmRepresentation for such attributes as bruteForceProtected, permanentLockout etc.

Related

How would I go about authenticating just the domain apex?

Hi i'm currently running a program on localhost:8000 and using Cloudflare tunnel turn make it into a public url.
The problem is the domain apex for example website.com has sensitive information and I
don't want anyone to be able to access it.
However I want website.com/123 or website.com/1234 and so on to be accessible.
I tried using cloudflare zero trust to do this but it seems impossible to only authenticate the domain apex. So I believe I have to make changes to the source code.
How would I go about this?
Thank you in advance. This is my first question on here.
I really wish I can get to the point where I can fix these things myself.

WildFly can't use rotating database passwords?

I'm trying to implement a custom credential-store (with custom CredentialStoreSpi implementation) to integrate with data-sources through credential-reference.
The idea is to use a vault service with rotating passwords, and, for now, when I start WildFly, it calls CredentialStoreSpi.retrieve() and initializes data-source with current password, but if I flush data-source and request a new connection there are no calls to .retrieve(). And if I rotate password, then, it fails to create connection with username/password error, and still do not call for a new password.
Looking in specs I see that data-source connection security has a config to some "Reauth Plugin Class Name", but I can't find any clues on what is that.
There is any way to change this behavior and force that any new connection should require password directly from credential-store?
Found this spec: https://docs.wildfly.org/20/wildscribe/subsystem/datasources/data-source/ExampleDS/index.html#attr-reauth-plugin-class-name
reauth-plugin-class-name The fully qualified class name of the reauthentication plugin implementation
Looking at web but find no documentation on this.
Anyone knows what is that? Could it help in this use case?

if the credential store is updated externally you have to do a reload of that credential store. Maybe calling the retrieve method or reloading the credential store in the server at a certain intervals might make sense

Is there a better way to handle user sessions in Flutter, than using "flutter_session" or "local_storage", or is impossible to handle that on mobile?

Do we have to handle them from the back-end only? Because those two libraries to me they act as storage, they not doing what I am expecting.
Do I have to send a request to the back-end every time I want to resume my app state to renew the token, if the app was on foreground for some period of time?

I feel by far the best way to handle sessions in flutter is by using Shared Preferences
Link to the package:
https://pub.dev/packages/shared_preferences
It can be used to create multiple tokens or flag which can be said as cookie equivalents of a website.
I think you will figure out the working by looking at the documentation or the example, it is fairly simple

For more sensitive data you may be better to use Secure Storage which will ensure that the data is encrypted. Shared preferences stores the data that is not encrypted

Adding relying parties in ADFS using C# or Powershell

I need to add Relying parties in ADFS everytime a new client comes on. I would like to automate this by just specifying either the url to the federation metadata or a file picker for the admin to load the federation metadata file.
I have been following the instructions on this site Adding a New Relying Party Trust
However I get the following error
ADMIN0120: The client is not authorized to access the endpoint
net.tcp://localhost:1500/policy.
The client process must be run with elevated administrative privileges.
not sure what I am doing wrong. I guess the bigger question is : is this the best way to set up Relying parties and Claims using code or should I use powershell commands?

This error doesn't means you have code issue. It is something related to the privilege. Test it by right mouse click the client and "Run as administrator" to see if it goes through.

As per your link, there are three ways:
Using the AD FS 2.0 Management console
Using the Windows PowerShell command-line interface
Programmatically using the AD FS 2.0 application programming interface (API)
All three are equally valid - the only difference is how much work you have to do for each e.g. the wizard is lots of mouse clicks.
What I do is set up the RP the first time via the wizard and then save the setup using PowerShell (Get RP, Get Claims etc.) and then use these to set up subsequent ones as you migrate from dev. to test. to staging etc.

Using HTTPS and multiple NSURLProtectionSpace's in iOS

I'm creating a iOS app that requires the user to log in at startup, and then uses those credentials to query 4-5 different services on a server over the course of the session.
The server (xyz) it self doesn't accept the credentials, but if the services that it provides are queried then they get accepted. For example https://xyz/service1 works, https://xyz doesn't.
Now what I'm wondering about is if there is anything that stands in the way of creating 4-5 NSURLProtectionSpace's at log in, one for each service on the server, and then use the corresponding protection space when use each service?
Or is there a better way of implementing something that could work in this situation?
All help would be appreciated.

Turns out that there is nothing that stands in the way of creating multiple NSURLProtectionSpace's since each is created for a separate url.