From 0230e008c53bbda7502912a013dcdd755780d726 Mon Sep 17 00:00:00 2001 From: Bill Burke Date: Fri, 9 Oct 2015 18:49:15 -0400 Subject: [PATCH] filter docs --- .../reference/en/en-US/master.xml | 2 + .../en-US/modules/servlet-filter-adapter.xml | 51 +++++++++++++++++ .../reference/en/en-US/master.xml | 2 + .../en/en-US/modules/adapter-config.xml | 24 ++++---- .../en-US/modules/servlet-filter-adapter.xml | 55 +++++++++++++++++++ 5 files changed, 122 insertions(+), 12 deletions(-) create mode 100755 docbook/auth-server-docs/reference/en/en-US/modules/servlet-filter-adapter.xml create mode 100755 docbook/saml-adapter-docs/reference/en/en-US/modules/servlet-filter-adapter.xml diff --git a/docbook/auth-server-docs/reference/en/en-US/master.xml b/docbook/auth-server-docs/reference/en/en-US/master.xml index 39a571abe5..2af744f8e9 100755 --- a/docbook/auth-server-docs/reference/en/en-US/master.xml +++ b/docbook/auth-server-docs/reference/en/en-US/master.xml @@ -47,6 +47,7 @@ + ]> @@ -105,6 +106,7 @@ This one is short &TomcatAdapter; &Jetty9Adapter; &Jetty8Adapter; + &FilterAdapter; &FuseAdapter; &JavascriptAdapter; &SpringBootAdapter; diff --git a/docbook/auth-server-docs/reference/en/en-US/modules/servlet-filter-adapter.xml b/docbook/auth-server-docs/reference/en/en-US/modules/servlet-filter-adapter.xml new file mode 100755 index 0000000000..f785b075f5 --- /dev/null +++ b/docbook/auth-server-docs/reference/en/en-US/modules/servlet-filter-adapter.xml @@ -0,0 +1,51 @@ +
+ Java Servlet Filter Adapter + + If you want to use Keycloak with a Java servlet application that doesn't have an adapter for that servlet + platform, you can opt to use the servlet filter adapter that Keycloak has. This adapter works a little + differently than the other adapters. You do not define security constraints in web.xml. Instead you define + a filter mapping using the Keycloak servlet filter adapter to secure the url patterns you want to secure. + + + + Backchannel logout works a bit differently than the standard adapters. Instead of invalidating the http session + it instead marks the session id as logged out. There's just no way of arbitrarily invalidating an http session + based on a session id. + + + + + + + customer-portal + + + Keycloak Filter + org.keycloak.adapters.servlet.KeycloakOIDCFilter + + + Keycloak Filter + /* + + +]]> + + + The Keycloak filter has the same configuration parameters available as the other adapters except you must define + them as filter init params instead of context params. + + + To use this filter, include this maven artifact in your WAR poms + + + org.keycloak + keycloak-servlet-filter-adapter + &project.version; + +]]> +
\ No newline at end of file diff --git a/docbook/saml-adapter-docs/reference/en/en-US/master.xml b/docbook/saml-adapter-docs/reference/en/en-US/master.xml index 5c36b77ff8..5b798a1ae1 100755 --- a/docbook/saml-adapter-docs/reference/en/en-US/master.xml +++ b/docbook/saml-adapter-docs/reference/en/en-US/master.xml @@ -7,6 +7,7 @@ + ]> @@ -46,6 +47,7 @@ This one is short &TomcatAdapter; &Jetty9Adapter; &Jetty8Adapter; + &FilterAdapter; &Logout; diff --git a/docbook/saml-adapter-docs/reference/en/en-US/modules/adapter-config.xml b/docbook/saml-adapter-docs/reference/en/en-US/modules/adapter-config.xml index 1f741560ec..cce3faff4d 100755 --- a/docbook/saml-adapter-docs/reference/en/en-US/modules/adapter-config.xml +++ b/docbook/saml-adapter-docs/reference/en/en-US/modules/adapter-config.xml @@ -59,13 +59,13 @@ Here is the explanation of the SP element attributes - ... -]]> +]]> @@ -129,7 +129,7 @@ or you can cut and paste the keys directly within keycloak-saml.xml in the PEM format. - @@ -139,7 +139,7 @@ ]]> - + The Key element has two optional attributes signing and encryption. When set to true these tell the adapter what the @@ -215,13 +215,13 @@
RoleIdentifiers element - -]]> +]]> This element is optional. It defines which SAML attribute values in the assertion should be mapped to a Java EE role. By default Role attribute values are converted @@ -236,7 +236,7 @@ Everything in the IDP element describes the settings for the IDP the SP is communicating with. - + ... ]]> - + @@ -300,12 +300,12 @@ The SignleSignOnService sub element defines the login SAML endpoint of the IDP. - -]]> +]]> @@ -367,7 +367,7 @@ The SignleSignOnService sub element defines the login SAML endpoint of the IDP. - -]]> +]]> diff --git a/docbook/saml-adapter-docs/reference/en/en-US/modules/servlet-filter-adapter.xml b/docbook/saml-adapter-docs/reference/en/en-US/modules/servlet-filter-adapter.xml new file mode 100755 index 0000000000..dc6526aa57 --- /dev/null +++ b/docbook/saml-adapter-docs/reference/en/en-US/modules/servlet-filter-adapter.xml @@ -0,0 +1,55 @@ + + Java Servlet Filter Adapter + + If you want to use SAML with a Java servlet application that doesn't have an adapter for that servlet + platform, you can opt to use the servlet filter adapter that Keycloak has. This adapter works a little + differently than the other adapters. You do not define security constraints in web.xml. Instead you define + a filter mapping using the Keycloak servlet filter adapter to secure the url patterns you want to secure. + + + + Backchannel logout works a bit differently than the standard adapters. Instead of invalidating the http session + it instead marks the session id as logged out. There's just no way of arbitrarily invalidating an http session + based on a session id. + + + + + Backchannel logout does not currently work when you have a clustered application that uses the SAML filter. + + + + + + customer-portal + + + Keycloak Filter + org.keycloak.adapters.saml.servlet.SamlFilter + + + Keycloak Filter + /* + + +]]> + + + The Keycloak filter has the same configuration parameters available as the other adapters except you must define + them as filter init params instead of context params. + + + To use this filter, include this maven artifact in your WAR poms + + + org.keycloak + keycloak-saml-servlet-filter-adapter + &project.version; + +]]> + \ No newline at end of file