I'm trying to add a hardcoded claim. Following this post, I was able to create the claim partially.
How do I set:
config.jsonType.label=String
AND
config.access.token.claim=true
I was able to find the create the initial part of the hardcoded claim based on this post: Add protocol-mapper to keycloak using kcadm.sh
I figured it out. -s "config.\"access.token.claim\"=true"
kcadm create clients/6842adac-982d-4b89-88b0-22b68a332807/protocol-mappers/models -r demorealm -s name=aud1 -s protocol=openid-connect -s protocolMapper=oidc-hardcoded-claim-mapper -s "config.\"access.token.claim\"=true"
Related
I'm new in docker, try to google this issue, bit found nothing.
I have to create nexus image from sonatype/nexus3 and change password in admin.password file after creating image.
It's my Dockerfile:
FROM sonatype/nexus3
WORKDIR /nexus-data
RUN ["/bin/bash", "-c", "echo root >> admin.password"]
and when i check the file admin.password (docker exec <container> cat admin.password) i have this result:
root
And Authorization works if i run continer from sonatype/nexus3 image from docker hub (with default UUID password).
What should i do?
I am thinking that maybe i rewrite admin profile or delete it somehow?
The way it works is that the sonatype/nexus3 image contains an already installed version and the random password has been written to admin.password. But it's just a log, not the password used to confgure nexus.
What you want to do has already been answered here How to set admin user/pwd when launching Nexus docker image
Here is a detailed walkthrough to change the admin password from the CLI after starting a fresh nexus3 docker container. You can easily script that once you understand how it works.
Important note to clear a possible misunderstanding: you don't build a nexus3 image containing predefined data like your admin password. You start a fresh image which will initialize fresh data when using an empty nexus-data volume, including a random admin password and you use that password to change it to your own value.
Start a docker container from the official image. Note: this is a minimal and trashable (i.e. --rm) start just for the example. Read the documentation to secure your data.
docker run -d --rm --name testnexus -p 8081:8081 sonatype/nexus3:latest
Wait a bit for nexus to start (you can check the logs with docker logs testnexus) then read the generated password into a variable:
CURRENT_PASSWORD=$(docker exec testnexus cat /nexus-data/admin.password)
Set the expected admin password into an other variable
NEW_PASSWORD=v3rys3cur3
Use the Nexus API to change the admin password:
curl -X PUT \
-u "admin:${CURRENT_PASSWORD}" \
-d "${NEW_PASSWORD}" \
-H 'accept: application/json' \
-H 'Content-Type: text/plain' \
http://localhost:8081/service/rest/v1/security/users/admin/change-password
Access Nexus GUI with your browser at http://localhost:8081, login with your newly changed password, enjoy.
I am using admin-cli to add some pre-configurations to a keycloak 3.4.3 docker container.
One of the things that i want to do is add a certain realm role to the list of Default Realm Roles, so that this role is applied automatically when a new user is registered (using the web user registration form).
I couldn’t find anything about this in the documentation.
Any ideas on how this could be achieved using admin-cli commands?
Thanks.
I faced the same question today. Here is my solution:
echo Creating realm TEST
kcadm.sh create realms -s realm=test -s enabled=true
echo Creating Test_Default role
kcadm.sh create roles -r test -s name=test_default
echo Adding Test_Default role to the TEST realm default roles
kcadm.sh update realms/test -f - << EOF
{ "realm": "test", "enabled": true, "defaultRoles" : [ "offline_access", "uma_authorization", "test_default" ] }
EOF
As of Keycloak 18.0.0 changing the Realm Default Roles using kcadm.sh doesn't work via updating the realm's JSON, but does via composite rules.
When we create a realm (e.g. named realm-test1), Keycloak automatically creates a corresponding composite rule default-roles-realm-test1 and populates it with built-in roles offline_access and uma_authorization:
Here is how we add our own role to (and remove a role from) Realm Default Roles.
$ docker exec -ti keycloak_keycloak_1 bash
bash-4.4$ /opt/keycloak/bin/kcadm.sh create realms -s realm=realm-test1 -s enabled=true
Created new realm with id 'realm-test1'
bash-4.4$ /opt/keycloak/bin/kcadm.sh create roles -r realm-test1 -s name=role-test1
Created new role with id 'role-test1'
bash-4.4$ /opt/keycloak/bin/kcadm.sh add-roles --rname default-roles-realm-test1 --rolename role-test1 -r realm-test1
bash-4.4$ /opt/keycloak/bin/kcadm.sh remove-roles --rname default-roles-realm-test1 --rolename offline_access -r realm-test1
Hitting F5 in the browser we see that it works:
Documentation
https://www.keycloak.org/docs/latest/server_admin/#adding-realm-roles-to-a-composite-role
I'm trying to run the default configuration for hashicorp and mongo but I can't complete the tutorial from here: https://www.vaultproject.io/docs/secrets/databases/mongodb.html.
It crashes here:
vault write database/config/mongodb \
plugin_name=mongodb-database-plugin \
allowed_roles="readonly" \
connection_url="mongodb://admin:Password!#mongodb.acme.com:27017/admin?ssl=true"
-bash: !mongodb.acme.com: event not found
I have mongo installed and done correctly the vault mount database
There are several things to change from that command.
vault write database/config/mongodb \
plugin_name=mongodb-database-plugin \
allowed_roles="readonly" \
connection_url="mongodb://admin:passwd#127.0.0.1:27017/admin"
Admin:Password has to be changed to the current admin:password credentials (keep in mind that mongo don't have any admin:password with a fresh installation).
!#mongodb.acme.com had to be changed to the ip of the machine where mongo is.
Finally had to disable the ssl ssl=false or removing it directly.
I'm trying to use IBM Watson Natural language Classifier but I can't proceed and load my answers. For some reason, username and password aren't working all the time.
This one executed fine:
curl -u username:password -F training_data=#questions.csv -F
training_metadata="{\"language\":\"en\",\"name\":\"my_classifier\"}"
"https://url/v1/classifiers"
But when I try to execute the following command, it doesn't work:
curl -u username:password -X POST -H "Content-Type: application/json"
-d #questions-with-classifier-ega-war/target/classes/answers.json http://yourAppName.mybluemix.net/api/v1/manage/answer
It just asks for the user and password again and again. It is the same password that just worked in the first curl command.
Thanks in advance!
I think you are confusing the service credentials (the one you use in the first command) with the credentials used to manage the database in one of the sample applications "Questions on Classifier" (see pom.xml).
In order to run your second command make sure you use the credentials from the pom.xml in your root directory
I am following the instructions at: http://apiaxle.com/docs/statistics-and-analytics-in-apiaxle/ . Unfortunately currently (May 17, 2014) apiAxle is redirecting me to the endPointserver and I am not getting statist
menelaos:~$ curl 'http://localhost:3000/v/api/test/stats?
granularity=hour&format_timestamp=ISO'
Response:
{"meta":{"version":1,"status_code":404},"results":{"error":
{"type":"ApiUnknown","message":"No api specified (via subdomain)"}}}
I also tried using the subdomain but that didn't work either:
menelaos:~$ curl 'http://test.api.localhost:3000/v/api/test/stats?granularity=hour&format_timestamp=ISO'
Typically you run multiple instances of apiaxle-proxy (which provides access to your endpoints), and a single instances of apiaxle-api (which provides access to statistics, key creation, and other API management functionality).
For example, you might be running the proxy like this:
apiaxle-proxy -f 1 -p 3000 -q
To run the API, you would run something like this:
apiaxle-api -f 1 -p 5000 -q
Note that the API needs to run on a separate port. Also note that it shouldn't be accessible to the outside world as it doesn't have any authentication.
Using the above example, your curl command would look like this:
curl -H 'content-type: application/json' \
-X GET \
'http://localhost:5000/v1/api/test/stats' \
-d '{"granularity":"hour","format_timestamp":"ISO"}'
Note that the parameters need to be sent as JSON.