parent
4323d796b3
commit
e872ac08d8
16 changed files with 29 additions and 29 deletions
|
@ -25,7 +25,7 @@ Example CORS application. For more information look at `cors/README.md`.
|
||||||
JS Console
|
JS Console
|
||||||
----------
|
----------
|
||||||
|
|
||||||
Example JavaScript application that let's you experiment with the JavaScript adapter. For more information look at `js-console/README.md`.
|
Example JavaScript application that lets you experiment with the JavaScript adapter. For more information look at `js-console/README.md`.
|
||||||
|
|
||||||
|
|
||||||
Providers
|
Providers
|
||||||
|
|
|
@ -8,7 +8,7 @@ Start Keycloak:
|
||||||
|
|
||||||
bin/standalone.sh
|
bin/standalone.sh
|
||||||
|
|
||||||
Open the Keycloak admin console, click on Add Realm, click on 'Choose a JSON file', selct example-realm.json and click Upload.
|
Open the Keycloak admin console, click on Add Realm, click on 'Choose a JSON file', select example-realm.json and click Upload.
|
||||||
|
|
||||||
Deploy the Admin Client Example to Keycloak by running:
|
Deploy the Admin Client Example to Keycloak by running:
|
||||||
|
|
||||||
|
|
|
@ -8,7 +8,7 @@ users are authenticated with Facebook using Keycloak Identity Broker capabilitie
|
||||||
|
|
||||||
From this example, you'll learn how to:
|
From this example, you'll learn how to:
|
||||||
|
|
||||||
* Setup a social identity provider for a specific realm
|
* Set up a social identity provider for a specific realm
|
||||||
* Store tokens from a social identity provider and use these tokens to invoke the social provider API
|
* Store tokens from a social identity provider and use these tokens to invoke the social provider API
|
||||||
|
|
||||||
Basically, once you try to access the application for the first time, you'll be redirected to Keycloak's login page.
|
Basically, once you try to access the application for the first time, you'll be redirected to Keycloak's login page.
|
||||||
|
@ -25,7 +25,7 @@ Basically, what the application does is obtain some basic information for the au
|
||||||
load their profile from Facebook. For that, this application demonstrates how to retrieve the token issued by a social provider
|
load their profile from Facebook. For that, this application demonstrates how to retrieve the token issued by a social provider
|
||||||
for the authenticated user and use this token to invoke Facebook's API.
|
for the authenticated user and use this token to invoke Facebook's API.
|
||||||
|
|
||||||
Make sure you've set up a application in Facebook
|
Make sure you've set up an application in Facebook
|
||||||
--------------------------------------
|
--------------------------------------
|
||||||
|
|
||||||
This example application requires you to create a Facebook Application. How to create it is beyond the scope of this
|
This example application requires you to create a Facebook Application. How to create it is beyond the scope of this
|
||||||
|
@ -179,4 +179,4 @@ Debug the Application
|
||||||
If you want to debug the source code or look at the Javadocs of any library in the project, run either of the following commands to pull them into your local repository. The IDE should then detect them.
|
If you want to debug the source code or look at the Javadocs of any library in the project, run either of the following commands to pull them into your local repository. The IDE should then detect them.
|
||||||
|
|
||||||
mvn dependency:sources
|
mvn dependency:sources
|
||||||
mvn dependency:resolve -Dclassifier=javadoc
|
mvn dependency:resolve -Dclassifier=javadoc
|
||||||
|
|
|
@ -8,7 +8,7 @@ users are authenticated with Google using Keycloak Identity Broker capabilities
|
||||||
|
|
||||||
From this example, you'll learn how to:
|
From this example, you'll learn how to:
|
||||||
|
|
||||||
* Setup a social identity provider for a specific realm
|
* Set up a social identity provider for a specific realm
|
||||||
* Store tokens from a social identity provider and use these tokens to invoke the social provider API
|
* Store tokens from a social identity provider and use these tokens to invoke the social provider API
|
||||||
|
|
||||||
Basically, once you try to access the application for the first time, you'll be redirected to Keycloak's login page.
|
Basically, once you try to access the application for the first time, you'll be redirected to Keycloak's login page.
|
||||||
|
@ -25,7 +25,7 @@ Basically, what the application does is obtain some basic information for the au
|
||||||
load their profile from Google. For that, this application demonstrates how to retrieve the token issued by a social provider
|
load their profile from Google. For that, this application demonstrates how to retrieve the token issued by a social provider
|
||||||
for the authenticated user and use this token to invoke Google's API.
|
for the authenticated user and use this token to invoke Google's API.
|
||||||
|
|
||||||
Make sure you've set up a application in Google
|
Make sure you've set up an application in Google
|
||||||
--------------------------------------
|
--------------------------------------
|
||||||
|
|
||||||
This example application requires you to create a Google Application. How to create it is beyond the scope of this
|
This example application requires you to create a Google Application. How to create it is beyond the scope of this
|
||||||
|
|
|
@ -10,10 +10,10 @@ applications in another realm.
|
||||||
There are two main realms in this example:
|
There are two main realms in this example:
|
||||||
|
|
||||||
* **saml-broker-realm.json**: the realm where the user belongs and that provides a SAML v2 Identity Provider.
|
* **saml-broker-realm.json**: the realm where the user belongs and that provides a SAML v2 Identity Provider.
|
||||||
* **saml-broker-authentication-realm.json**: the realm with all the necessary configuration to setup the application and the
|
* **saml-broker-authentication-realm.json**: the realm with all the necessary configuration to set up the application and the
|
||||||
identity provider responsible for brokering.
|
identity provider responsible for brokering.
|
||||||
|
|
||||||
From this example you'll understand how to setup an identity provider in order to broker an external
|
From this example you'll understand how to set up an identity provider in order to broker an external
|
||||||
SAML identity provider and allow users from different domains/realms to authenticate and access applications in a realm.
|
SAML identity provider and allow users from different domains/realms to authenticate and access applications in a realm.
|
||||||
|
|
||||||
The *saml-broker-realm* realm provides two important configuration. The first one is the user that we are going to use to
|
The *saml-broker-realm* realm provides two important configuration. The first one is the user that we are going to use to
|
||||||
|
@ -51,7 +51,7 @@ The second one is an application to configure a SAML Identity Provider to authen
|
||||||
}
|
}
|
||||||
|
|
||||||
The *saml-broker-authentication-realm.json* realm provides the configuration for the application and also the necessary
|
The *saml-broker-authentication-realm.json* realm provides the configuration for the application and also the necessary
|
||||||
configuration to setup an identity provider to broker the SAML Identity Provider from the other realm.
|
configuration to set up an identity provider to broker the SAML Identity Provider from the other realm.
|
||||||
|
|
||||||
{
|
{
|
||||||
"id" : "saml-identity-provider",
|
"id" : "saml-identity-provider",
|
||||||
|
|
|
@ -8,7 +8,7 @@ users are authenticated with Twitter using Keycloak Identity Broker capabilities
|
||||||
|
|
||||||
From this example, you'll learn how to:
|
From this example, you'll learn how to:
|
||||||
|
|
||||||
* Setup a social identity provider for a specific realm
|
* Set up a social identity provider for a specific realm
|
||||||
* Store tokens from a social identity provider and use these tokens to invoke the social provider API
|
* Store tokens from a social identity provider and use these tokens to invoke the social provider API
|
||||||
|
|
||||||
Basically, once you try to access the application for the first time, you'll be redirected to Keycloak's login page.
|
Basically, once you try to access the application for the first time, you'll be redirected to Keycloak's login page.
|
||||||
|
@ -25,7 +25,7 @@ Basically, what the application does is obtain some basic information for the au
|
||||||
load their profile from Twitter. For that, this application demonstrates how to retrieve the token issued by a social provider
|
load their profile from Twitter. For that, this application demonstrates how to retrieve the token issued by a social provider
|
||||||
for the authenticated user and use this token to invoke Twitter's API.
|
for the authenticated user and use this token to invoke Twitter's API.
|
||||||
|
|
||||||
Make sure you've set up a application in Twitter
|
Make sure you've set up an application in Twitter
|
||||||
--------------------------------------
|
--------------------------------------
|
||||||
|
|
||||||
This example application requires you to create a Twitter Application. How to create it is beyond the scope of this
|
This example application requires you to create a Twitter Application. How to create it is beyond the scope of this
|
||||||
|
|
|
@ -10,7 +10,7 @@ Start Keycloak bound to an IP address available to the phone or emulator. For ex
|
||||||
|
|
||||||
bin/standalone.sh -b 192.168.0.10
|
bin/standalone.sh -b 192.168.0.10
|
||||||
|
|
||||||
Open the Keycloak admin console, click on Add Realm, click on 'Choose a JSON file', selct example-realm.json and click Upload.
|
Open the Keycloak admin console, click on Add Realm, click on 'Choose a JSON file', select example-realm.json and click Upload.
|
||||||
|
|
||||||
Navigate to applications, click on 'Cordova', select 'Installation' and in the 'Format option' drop-down select 'keycloak.json'. Download this file to the www folder.
|
Navigate to applications, click on 'Cordova', select 'Installation' and in the 'Format option' drop-down select 'keycloak.json'. Download this file to the www folder.
|
||||||
|
|
||||||
|
@ -26,7 +26,7 @@ Install to Android phone or emulator
|
||||||
cordova run android
|
cordova run android
|
||||||
|
|
||||||
|
|
||||||
Once the application is opened you can login with username: 'user', and password: 'password'.
|
Once the application is opened you can log in with username: 'user', and password: 'password'.
|
||||||
|
|
||||||
|
|
||||||
Troubleshooting
|
Troubleshooting
|
||||||
|
|
|
@ -10,7 +10,7 @@ Start Keycloak bound to an IP address available to the phone or emulator. For ex
|
||||||
|
|
||||||
bin/standalone.sh -b 192.168.0.10
|
bin/standalone.sh -b 192.168.0.10
|
||||||
|
|
||||||
Open the Keycloak admin console, click on Add Realm, click on 'Choose a JSON file', selct example-realm.json and click Upload.
|
Open the Keycloak admin console, click on Add Realm, click on 'Choose a JSON file', select example-realm.json and click Upload.
|
||||||
|
|
||||||
Navigate to applications, click on 'Cordova', select 'Installation' and in the 'Format option' drop-down select 'keycloak.json'. Download this file to the www folder.
|
Navigate to applications, click on 'Cordova', select 'Installation' and in the 'Format option' drop-down select 'keycloak.json'. Download this file to the www folder.
|
||||||
|
|
||||||
|
@ -29,7 +29,7 @@ Install to Android phone or emulator
|
||||||
cordova run android
|
cordova run android
|
||||||
|
|
||||||
|
|
||||||
Once the application is opened you can login with username: 'user', and password: 'password'.
|
Once the application is opened you can log in with username: 'user', and password: 'password'.
|
||||||
|
|
||||||
|
|
||||||
Troubleshooting
|
Troubleshooting
|
||||||
|
|
|
@ -31,7 +31,7 @@ C:\Windows\System32\drivers\etc\hosts) and add the following entries:
|
||||||
|
|
||||||
Step 2: Make sure you've set up the Keycloak Server and have it running
|
Step 2: Make sure you've set up the Keycloak Server and have it running
|
||||||
--------------------------------------
|
--------------------------------------
|
||||||
You will run this demo on the same server as the keycloak server. Its best to use the appliance as everything is all set up.
|
You will run this demo on the same server as the keycloak server. It is best to use the appliance as everything is all set up.
|
||||||
See documentation on how to set this up.
|
See documentation on how to set this up.
|
||||||
|
|
||||||
Step 3: Import the Test Realm
|
Step 3: Import the Test Realm
|
||||||
|
|
|
@ -8,7 +8,7 @@ Start Keycloak:
|
||||||
|
|
||||||
bin/standalone.sh
|
bin/standalone.sh
|
||||||
|
|
||||||
Open the Keycloak admin console, click on Add Realm, click on 'Choose a JSON file', selct example-realm.json and click Upload.
|
Open the Keycloak admin console, click on Add Realm, click on 'Choose a JSON file', select example-realm.json and click Upload.
|
||||||
|
|
||||||
Deploy the JS Console to Keycloak by running:
|
Deploy the JS Console to Keycloak by running:
|
||||||
|
|
||||||
|
|
|
@ -37,7 +37,7 @@ Also if you are on Linux, make sure that record like:
|
||||||
```
|
```
|
||||||
is in your `/etc/hosts` before other records for the 127.0.0.1 host to avoid issues related to incompatible reverse lookup (Ensure the similar for other OS as well)
|
is in your `/etc/hosts` before other records for the 127.0.0.1 host to avoid issues related to incompatible reverse lookup (Ensure the similar for other OS as well)
|
||||||
|
|
||||||
**4)** Install kerberos client. This is platform dependent. If you are on Fedora, Ubuntu or RHEL, you can install package `freeipa-client`, which contains Kerberos client and bunch of other stuff.
|
**4)** Install kerberos client. This is platform dependent. If you are on Fedora, Ubuntu or RHEL, you can install package `freeipa-client`, which contains Kerberos client and a bunch of other stuff.
|
||||||
|
|
||||||
|
|
||||||
**5)** Configure Kerberos client (On linux it's in file `/etc/krb5.conf` ). You need to configure `KEYCLOAK.ORG` realm for host `localhost` and enable `forwardable` flag, which is needed
|
**5)** Configure Kerberos client (On linux it's in file `/etc/krb5.conf` ). You need to configure `KEYCLOAK.ORG` realm for host `localhost` and enable `forwardable` flag, which is needed
|
||||||
|
@ -74,7 +74,7 @@ kinit hnelson@KEYCLOAK.ORG
|
||||||
with password `secret` .
|
with password `secret` .
|
||||||
|
|
||||||
Then in your web browser open `http://localhost:8080/kerberos-portal` . You should be logged-in automatically through SPNEGO without displaying Keycloak login screen.
|
Then in your web browser open `http://localhost:8080/kerberos-portal` . You should be logged-in automatically through SPNEGO without displaying Keycloak login screen.
|
||||||
Keycloak will also transmit the delegated GSS credential to the application inside access token and application will be able to login with this credential
|
Keycloak will also transmit the delegated GSS credential to the application inside access token and application will be able to log in with this credential
|
||||||
to the LDAP server and retrieve some data from it (Actually it just retrieve few simple data about authenticated user themself).
|
to the LDAP server and retrieve some data from it (Actually it just retrieve few simple data about authenticated user themself).
|
||||||
|
|
||||||
|
|
||||||
|
@ -84,7 +84,7 @@ Troubleshooting
|
||||||
You followed the instructions, but things don't seem to be working. Follow these instructions to troubleshoot.
|
You followed the instructions, but things don't seem to be working. Follow these instructions to troubleshoot.
|
||||||
|
|
||||||
**1)** Make sure to use the default user in all Terminal / CMD sessions. Do not use 'sudo' or 'su'.
|
**1)** Make sure to use the default user in all Terminal / CMD sessions. Do not use 'sudo' or 'su'.
|
||||||
The reason is that when you open Firefox, it will open within the context of currently signed in user. And it will use that user's Kerberos ticket to perform authentication.
|
The reason is that when you open Firefox, it will open within the context of currently signed-in user. And it will use that user's Kerberos ticket to perform authentication.
|
||||||
When you obtain Kerberos ticket using Terminal session, you have to be that same user, otherwise the ticket will not be visible to the browser.
|
When you obtain Kerberos ticket using Terminal session, you have to be that same user, otherwise the ticket will not be visible to the browser.
|
||||||
|
|
||||||
Of course make sure to obtain the ticket:
|
Of course make sure to obtain the ticket:
|
||||||
|
|
|
@ -30,5 +30,5 @@ This will also automatically import the LDIF from `ldap-example-users.ldif` into
|
||||||
and protocol mappers. Note that there are not any roles or users in this file. All of users, roles and role mappings data will be imported automatically from LDAP.
|
and protocol mappers. Note that there are not any roles or users in this file. All of users, roles and role mappings data will be imported automatically from LDAP.
|
||||||
|
|
||||||
|
|
||||||
**4)** Test the example. In your web browser open `http://localhost:8080/ldap-portal` . You can login either as `jbrown` with password `password` or as
|
**4)** Test the example. In your web browser open `http://localhost:8080/ldap-portal` . You can log in either as `jbrown` with password `password` or as
|
||||||
`bwilson` with password `password` . You can see that access token contains all the claims and role mappings corresponding to the LDAP data provided in LDIF.
|
`bwilson` with password `password` . You can see that access token contains all the claims and role mappings corresponding to the LDAP data provided in LDIF.
|
||||||
|
|
|
@ -13,7 +13,7 @@ Example Custom Authenticator
|
||||||
4. Login to admin console. Hit browser refresh if you are already logged in so that the new providers show up.
|
4. Login to admin console. Hit browser refresh if you are already logged in so that the new providers show up.
|
||||||
|
|
||||||
5. Go to the **Authentication** menu item and go to the **Flows** tab, you will be able to view the currently
|
5. Go to the **Authentication** menu item and go to the **Flows** tab, you will be able to view the currently
|
||||||
defined flows. You cannot modify an built in flows, so, to add the Authenticator you
|
defined flows. You cannot modify a built-in flows, so, to add the Authenticator you
|
||||||
have to copy an existing flow or create your own. Copy the "Browser" flow.
|
have to copy an existing flow or create your own. Copy the "Browser" flow.
|
||||||
|
|
||||||
6. In your copy, click the **Actions** menu item in **Forms** subflow and **Add Execution**. Pick `Secret Question` and change
|
6. In your copy, click the **Actions** menu item in **Forms** subflow and **Add Execution**. Pick `Secret Question` and change
|
||||||
|
|
|
@ -24,7 +24,7 @@ curl -i --request POST http://localhost:8080/auth/realms/master/example/companie
|
||||||
curl -i --request POST http://localhost:8080/auth/realms/master/example/companies --data "{ \"name\": \"bar company\" }" --header "Content-type: application/json"
|
curl -i --request POST http://localhost:8080/auth/realms/master/example/companies --data "{ \"name\": \"bar company\" }" --header "Content-type: application/json"
|
||||||
````
|
````
|
||||||
|
|
||||||
Then you can lookup all companies
|
Then you can look up all companies
|
||||||
|
|
||||||
````
|
````
|
||||||
curl -i --request GET http://localhost:8080/auth/realms/master/example/companies --header "Accept: application/json"
|
curl -i --request GET http://localhost:8080/auth/realms/master/example/companies --header "Accept: application/json"
|
||||||
|
@ -41,4 +41,4 @@ of authenticated user and the user must be in realm role `admin` in order to acc
|
||||||
````
|
````
|
||||||
./invoke-authenticated.sh
|
./invoke-authenticated.sh
|
||||||
````
|
````
|
||||||
The script assumes user `admin` with password `admin` exists in realm `master`. Also it assumes that you have `curl` installed.
|
The script assumes user `admin` with password `admin` exists in realm `master`. Also it assumes that you have `curl` installed.
|
||||||
|
|
|
@ -11,7 +11,7 @@ echo -e "\n\nACCESS TOKEN IS \"$ACCESS_TOKEN\"";
|
||||||
echo -e "\n\nSENDING UN-AUTHENTICATED REQUEST. THIS SHOULD FAIL WITH 401: ";
|
echo -e "\n\nSENDING UN-AUTHENTICATED REQUEST. THIS SHOULD FAIL WITH 401: ";
|
||||||
curl -i --request POST http://localhost:8080/auth/realms/master/example/companies-auth --data "{ \"name\": \"auth foo company\" }" --header "Content-type: application/json"
|
curl -i --request POST http://localhost:8080/auth/realms/master/example/companies-auth --data "{ \"name\": \"auth foo company\" }" --header "Content-type: application/json"
|
||||||
|
|
||||||
echo -e "\n\nSENDING AUTHENTICATED REQUEST. THIS SHOULD SUCCESSFULY CREATE COMPANY AND SUCCESS WITH 201: ";
|
echo -e "\n\nSENDING AUTHENTICATED REQUEST. THIS SHOULD SUCCESSFULLY CREATE COMPANY AND SUCCESS WITH 201: ";
|
||||||
curl -i --request POST http://localhost:8080/auth/realms/master/example/companies-auth --data "{ \"name\": \"auth foo company\" }" --header "Content-type: application/json" --header "Authorization: Bearer $ACCESS_TOKEN";
|
curl -i --request POST http://localhost:8080/auth/realms/master/example/companies-auth --data "{ \"name\": \"auth foo company\" }" --header "Content-type: application/json" --header "Authorization: Bearer $ACCESS_TOKEN";
|
||||||
|
|
||||||
echo -e "\n\nSEARCH COMPANIES: ";
|
echo -e "\n\nSEARCH COMPANIES: ";
|
||||||
|
|
|
@ -2,12 +2,12 @@
|
||||||
|
|
||||||
## Introduction
|
## Introduction
|
||||||
|
|
||||||
Basic example that demonstrates how to setup an application as a SAML v2.0 Service Provider using SAML HTTP POST Binding with Signature Support. This example uses the Keycloak Servlet Filter to accomplish this
|
Basic example that demonstrates how to set up an application as a SAML v2.0 Service Provider using SAML HTTP POST Binding with Signature Support. This example uses the Keycloak Servlet Filter to accomplish this
|
||||||
Note that no role checks are done with the servlet filter. You would have to do this manually.
|
Note that no role checks are done with the servlet filter. You would have to do this manually.
|
||||||
|
|
||||||
## Import the test realm
|
## Import the test realm
|
||||||
|
|
||||||
If you haven't already done so, you need to import the test realm for this examples. Clicking on the below link will bring you to the
|
If you haven't already done so, you need to import the test realm for this example. Clicking on the below link will bring you to the
|
||||||
create realm page in the Admin UI. The username/password is admin/admin to login in. Keycloak will ask you to
|
create realm page in the Admin UI. The username/password is admin/admin to login in. Keycloak will ask you to
|
||||||
create a new admin password before you can go to the create realm page.
|
create a new admin password before you can go to the create realm page.
|
||||||
|
|
||||||
|
|
Loading…
Reference in a new issue