I've been trying to set up a quarkus server to validate tokens from Azure Active Directory with quarkus-oidc. I noticed that under the hood quarkus-oidc uses vert.x oauth2 implementation, which has support for Azure Active Directory amongst other providers but unfortunately there seems to be no way to configure quarkus-oidc. The keycloak provider seems to be hardcoded in the class OidcRecorder. Is there a way to bypass it? replace it? or configure it properly?
Related
I'm integrating the alfresco rest API with an external application. using the latest version of Alfresco configured with Keyclok as an identity server with the open-source module provided by alfresco-keycloak.
Keycloak has been configured with 2 different realms each one with its user provider and roles and Alfresco has been configured with 2 Authentication subsystems and different Keycloak adapters:
-Dauthentication.chain=keycloak1:keycloak,keycloak2:keycloak
-Dsynchronization.import.cron=\"0 0 0/4 ? * * *\"
-Dsynchronization.allowDeletions=true"
This configuration works well when logging in through Alfresco Share, chaining across each subsystem until the user logs in successfully.
But the same configuration won't work with the Alfresco public API. When my external application calls an endpoint with a valid Bearer token Alfresco uses just the first of two adapters configured so if my token has been released by the last keycloak realm it always fails and a 401 error is returned.
I can't find any solution to this problem or any documentation about that. I can't understand if the authorization mechanism used to authorize for rest-API doesn't use the same security chain as Alfresco Share.
Does anybody else have the same problem and found a solution to fix it?
Thanks in advance.
Stefano
I'm using tensorflow serving version 2.2 on Docker with the client REST on Google Cloud Run, i would like to create some authentication method to improve the security.
How can I implement TF Serving with authentication ? I don't found references.
Cloud Run currently doesn’t have builtin support end-user authentication easily. You can use something like Firebase Auth with Cloud Run to authenticate interactive (browser) users.
However, it seems you have a REST API (headless requests). If you want to built authentication/authorization you pretty much have to build something like OAuth (also explained in the same link above).
If you are trying to just authenticate yourself, you can implement HTTP Basic Authentication (username:password, passed in a header).
You can add a authentication by linux firewall......
I am using Kong and the JWT plugin to authenticate my upstream services. I have a use case where i would like to expose an endpoint in one of the services without having Kong authenticate against it. I was wondering if there is any way to specify exclusion patterns to let Kong know to ignore authentication for this endpoint?
Thanks in advance for any help!
Kong looks at the configured APIs in order of length. So it should be possible (without have tested it) that you use a longer uri (the one you want to make publicly accessible) without the JWT plugin, while keeping your current endpoint with the JWT plugin.
For example, if your current configuration is on /myApi and the path you want to make public is /myApi/login, then add an API on the latter without configuring the JWT on it.
We are considering to use the keycloak as our SSO framework.
According to the keycloak documentation for multi-tenancy support the application server should hold all the keycloak.json authentication files, the way to acquire those files is from the keycloak admin, is there a way to get them dynamically via API ? or at least to get the realm public key ? we would like to avoid to manually add this file for each realm to the application server (to avoid downtime, etc).
Another multi-tenancy related question - according to the documentation the same clients should be created for each realm, so if I have 100 realms and 10 clients, I should define the same 10 clients 100 times ? is there an alternative ?
One of our flows is backend micro-service that should be authenticated against an application (defined as keycloak client), we would like to avoid keeping user/psw on the server for security reasons, is there a way that an admin can acquire a token and place it manually on the server file system for that micro service ? is there a option to generate this token in the keycloak UI ?
Thanks in advance.
All Keycloak functionality is available via the admin REST API, so you can automate this. The realm's public key is available via http://localhost:8080/auth/realms/{realm}/
A realm for each tenant will give a tenant-specific login page. Therefore this is the way to go - 10 clients registered 100 times. See more in the chapter Client Registration of the Keycloak documentation. If you don't need specific themes, you can opt to put everything in one realm, but you will lose a lot of flexibility on that path.
If your backend micro service should appear like one (technical) user, you can issue an offline token that doesn't expire. This is the online documentation for offline tokens. Currently there is no admin functionality to retrieve an offline token for a user by an admin. You'll need to build this yourself. An admin can later revoke offline tokens using the given admin API.
I want to integrate keycloak security features to my spring boot based rest apis.
I am using KeyCloak 1.3.1 Final.
Now this is pure rest based api and am doing my testing through postman
I have got my rest api secured and when i try to access it do asks me for authorization, but am not able to execute my request. basically am locked out of my api.
I will quickly list out things that I have already done
Created a spring boot rest api and tested it. It works fine.
Modified my gradle for KeyCloak and configured it as per this document
Configured my keyCloak for the "bearer only" application
I tried to generate access token, but I was not able to. Therefore I created another Client in keycloak with "confidential" and used this client to generate the access token (both the clients were pointing to same application. Am not sure if this is correct)
With this access token, I am trying to make api call but am getting 401
Again am using this document.
I am new to both keycloak and spring.
So what I want to ask here is how can we generate the access token for testing a rest api in a scenario like one which is here.
Any useful resource on KeyCloak that can help me out here. As of now I dont have a clue as to where the problem is? Is it with my api or with how I have configured the KeyCloak.
Also since I am new to spring and I just could not found a decent document on how to configure cloak for spring boot. If you can help with that as well.
Moving further on this I was informed on the KeyCloak mailing list that spring boot adapter only supports basic authentication, and so I decided to incorporate the spring security adapter itself.
I did that and when am running the application and providing creds am still not able to make it work. However something interesting is happening. I am being redirected to http://127.0.0.1:8090/sso/login
I double checked it and that is not the redirect url i have provided.
???
Any idea why?
(Once again am new to it and learning about spring and security on way through this project. So please bear with me.)
So after spending quite a good amount of time and getting some help from keycloak user list here is how i got it to work.
Use Spring Security instead of spring boost security adapter (as I have already mentioned in the the edit, boot adapter is only for basic authentication)
There documentation does a decent job of explaining out everything else refer to that.
I am still testing the whole thing and will document it out for future references.