parent
4323d796b3
commit
e872ac08d8
16 changed files with 29 additions and 29 deletions
|
@ -25,7 +25,7 @@ Example CORS application. For more information look at `cors/README.md`.
|
|||
JS Console
|
||||
----------
|
||||
|
||||
Example JavaScript application that let's you experiment with the JavaScript adapter. For more information look at `js-console/README.md`.
|
||||
Example JavaScript application that lets you experiment with the JavaScript adapter. For more information look at `js-console/README.md`.
|
||||
|
||||
|
||||
Providers
|
||||
|
|
|
@ -8,7 +8,7 @@ Start Keycloak:
|
|||
|
||||
bin/standalone.sh
|
||||
|
||||
Open the Keycloak admin console, click on Add Realm, click on 'Choose a JSON file', selct example-realm.json and click Upload.
|
||||
Open the Keycloak admin console, click on Add Realm, click on 'Choose a JSON file', select example-realm.json and click Upload.
|
||||
|
||||
Deploy the Admin Client Example to Keycloak by running:
|
||||
|
||||
|
|
|
@ -8,7 +8,7 @@ users are authenticated with Facebook using Keycloak Identity Broker capabilitie
|
|||
|
||||
From this example, you'll learn how to:
|
||||
|
||||
* Setup a social identity provider for a specific realm
|
||||
* Set up a social identity provider for a specific realm
|
||||
* Store tokens from a social identity provider and use these tokens to invoke the social provider API
|
||||
|
||||
Basically, once you try to access the application for the first time, you'll be redirected to Keycloak's login page.
|
||||
|
@ -25,7 +25,7 @@ Basically, what the application does is obtain some basic information for the au
|
|||
load their profile from Facebook. For that, this application demonstrates how to retrieve the token issued by a social provider
|
||||
for the authenticated user and use this token to invoke Facebook's API.
|
||||
|
||||
Make sure you've set up a application in Facebook
|
||||
Make sure you've set up an application in Facebook
|
||||
--------------------------------------
|
||||
|
||||
This example application requires you to create a Facebook Application. How to create it is beyond the scope of this
|
||||
|
|
|
@ -8,7 +8,7 @@ users are authenticated with Google using Keycloak Identity Broker capabilities
|
|||
|
||||
From this example, you'll learn how to:
|
||||
|
||||
* Setup a social identity provider for a specific realm
|
||||
* Set up a social identity provider for a specific realm
|
||||
* Store tokens from a social identity provider and use these tokens to invoke the social provider API
|
||||
|
||||
Basically, once you try to access the application for the first time, you'll be redirected to Keycloak's login page.
|
||||
|
@ -25,7 +25,7 @@ Basically, what the application does is obtain some basic information for the au
|
|||
load their profile from Google. For that, this application demonstrates how to retrieve the token issued by a social provider
|
||||
for the authenticated user and use this token to invoke Google's API.
|
||||
|
||||
Make sure you've set up a application in Google
|
||||
Make sure you've set up an application in Google
|
||||
--------------------------------------
|
||||
|
||||
This example application requires you to create a Google Application. How to create it is beyond the scope of this
|
||||
|
|
|
@ -10,10 +10,10 @@ applications in another realm.
|
|||
There are two main realms in this example:
|
||||
|
||||
* **saml-broker-realm.json**: the realm where the user belongs and that provides a SAML v2 Identity Provider.
|
||||
* **saml-broker-authentication-realm.json**: the realm with all the necessary configuration to setup the application and the
|
||||
* **saml-broker-authentication-realm.json**: the realm with all the necessary configuration to set up the application and the
|
||||
identity provider responsible for brokering.
|
||||
|
||||
From this example you'll understand how to setup an identity provider in order to broker an external
|
||||
From this example you'll understand how to set up an identity provider in order to broker an external
|
||||
SAML identity provider and allow users from different domains/realms to authenticate and access applications in a realm.
|
||||
|
||||
The *saml-broker-realm* realm provides two important configuration. The first one is the user that we are going to use to
|
||||
|
@ -51,7 +51,7 @@ The second one is an application to configure a SAML Identity Provider to authen
|
|||
}
|
||||
|
||||
The *saml-broker-authentication-realm.json* realm provides the configuration for the application and also the necessary
|
||||
configuration to setup an identity provider to broker the SAML Identity Provider from the other realm.
|
||||
configuration to set up an identity provider to broker the SAML Identity Provider from the other realm.
|
||||
|
||||
{
|
||||
"id" : "saml-identity-provider",
|
||||
|
|
|
@ -8,7 +8,7 @@ users are authenticated with Twitter using Keycloak Identity Broker capabilities
|
|||
|
||||
From this example, you'll learn how to:
|
||||
|
||||
* Setup a social identity provider for a specific realm
|
||||
* Set up a social identity provider for a specific realm
|
||||
* Store tokens from a social identity provider and use these tokens to invoke the social provider API
|
||||
|
||||
Basically, once you try to access the application for the first time, you'll be redirected to Keycloak's login page.
|
||||
|
@ -25,7 +25,7 @@ Basically, what the application does is obtain some basic information for the au
|
|||
load their profile from Twitter. For that, this application demonstrates how to retrieve the token issued by a social provider
|
||||
for the authenticated user and use this token to invoke Twitter's API.
|
||||
|
||||
Make sure you've set up a application in Twitter
|
||||
Make sure you've set up an application in Twitter
|
||||
--------------------------------------
|
||||
|
||||
This example application requires you to create a Twitter Application. How to create it is beyond the scope of this
|
||||
|
|
|
@ -10,7 +10,7 @@ Start Keycloak bound to an IP address available to the phone or emulator. For ex
|
|||
|
||||
bin/standalone.sh -b 192.168.0.10
|
||||
|
||||
Open the Keycloak admin console, click on Add Realm, click on 'Choose a JSON file', selct example-realm.json and click Upload.
|
||||
Open the Keycloak admin console, click on Add Realm, click on 'Choose a JSON file', select example-realm.json and click Upload.
|
||||
|
||||
Navigate to applications, click on 'Cordova', select 'Installation' and in the 'Format option' drop-down select 'keycloak.json'. Download this file to the www folder.
|
||||
|
||||
|
@ -26,7 +26,7 @@ Install to Android phone or emulator
|
|||
cordova run android
|
||||
|
||||
|
||||
Once the application is opened you can login with username: 'user', and password: 'password'.
|
||||
Once the application is opened you can log in with username: 'user', and password: 'password'.
|
||||
|
||||
|
||||
Troubleshooting
|
||||
|
|
|
@ -10,7 +10,7 @@ Start Keycloak bound to an IP address available to the phone or emulator. For ex
|
|||
|
||||
bin/standalone.sh -b 192.168.0.10
|
||||
|
||||
Open the Keycloak admin console, click on Add Realm, click on 'Choose a JSON file', selct example-realm.json and click Upload.
|
||||
Open the Keycloak admin console, click on Add Realm, click on 'Choose a JSON file', select example-realm.json and click Upload.
|
||||
|
||||
Navigate to applications, click on 'Cordova', select 'Installation' and in the 'Format option' drop-down select 'keycloak.json'. Download this file to the www folder.
|
||||
|
||||
|
@ -29,7 +29,7 @@ Install to Android phone or emulator
|
|||
cordova run android
|
||||
|
||||
|
||||
Once the application is opened you can login with username: 'user', and password: 'password'.
|
||||
Once the application is opened you can log in with username: 'user', and password: 'password'.
|
||||
|
||||
|
||||
Troubleshooting
|
||||
|
|
|
@ -31,7 +31,7 @@ C:\Windows\System32\drivers\etc\hosts) and add the following entries:
|
|||
|
||||
Step 2: Make sure you've set up the Keycloak Server and have it running
|
||||
--------------------------------------
|
||||
You will run this demo on the same server as the keycloak server. Its best to use the appliance as everything is all set up.
|
||||
You will run this demo on the same server as the keycloak server. It is best to use the appliance as everything is all set up.
|
||||
See documentation on how to set this up.
|
||||
|
||||
Step 3: Import the Test Realm
|
||||
|
|
|
@ -8,7 +8,7 @@ Start Keycloak:
|
|||
|
||||
bin/standalone.sh
|
||||
|
||||
Open the Keycloak admin console, click on Add Realm, click on 'Choose a JSON file', selct example-realm.json and click Upload.
|
||||
Open the Keycloak admin console, click on Add Realm, click on 'Choose a JSON file', select example-realm.json and click Upload.
|
||||
|
||||
Deploy the JS Console to Keycloak by running:
|
||||
|
||||
|
|
|
@ -37,7 +37,7 @@ Also if you are on Linux, make sure that record like:
|
|||
```
|
||||
is in your `/etc/hosts` before other records for the 127.0.0.1 host to avoid issues related to incompatible reverse lookup (Ensure the similar for other OS as well)
|
||||
|
||||
**4)** Install kerberos client. This is platform dependent. If you are on Fedora, Ubuntu or RHEL, you can install package `freeipa-client`, which contains Kerberos client and bunch of other stuff.
|
||||
**4)** Install kerberos client. This is platform dependent. If you are on Fedora, Ubuntu or RHEL, you can install package `freeipa-client`, which contains Kerberos client and a bunch of other stuff.
|
||||
|
||||
|
||||
**5)** Configure Kerberos client (On linux it's in file `/etc/krb5.conf` ). You need to configure `KEYCLOAK.ORG` realm for host `localhost` and enable `forwardable` flag, which is needed
|
||||
|
@ -74,7 +74,7 @@ kinit hnelson@KEYCLOAK.ORG
|
|||
with password `secret` .
|
||||
|
||||
Then in your web browser open `http://localhost:8080/kerberos-portal` . You should be logged-in automatically through SPNEGO without displaying Keycloak login screen.
|
||||
Keycloak will also transmit the delegated GSS credential to the application inside access token and application will be able to login with this credential
|
||||
Keycloak will also transmit the delegated GSS credential to the application inside access token and application will be able to log in with this credential
|
||||
to the LDAP server and retrieve some data from it (Actually it just retrieve few simple data about authenticated user themself).
|
||||
|
||||
|
||||
|
@ -84,7 +84,7 @@ Troubleshooting
|
|||
You followed the instructions, but things don't seem to be working. Follow these instructions to troubleshoot.
|
||||
|
||||
**1)** Make sure to use the default user in all Terminal / CMD sessions. Do not use 'sudo' or 'su'.
|
||||
The reason is that when you open Firefox, it will open within the context of currently signed in user. And it will use that user's Kerberos ticket to perform authentication.
|
||||
The reason is that when you open Firefox, it will open within the context of currently signed-in user. And it will use that user's Kerberos ticket to perform authentication.
|
||||
When you obtain Kerberos ticket using Terminal session, you have to be that same user, otherwise the ticket will not be visible to the browser.
|
||||
|
||||
Of course make sure to obtain the ticket:
|
||||
|
|
|
@ -30,5 +30,5 @@ This will also automatically import the LDIF from `ldap-example-users.ldif` into
|
|||
and protocol mappers. Note that there are not any roles or users in this file. All of users, roles and role mappings data will be imported automatically from LDAP.
|
||||
|
||||
|
||||
**4)** Test the example. In your web browser open `http://localhost:8080/ldap-portal` . You can login either as `jbrown` with password `password` or as
|
||||
**4)** Test the example. In your web browser open `http://localhost:8080/ldap-portal` . You can log in either as `jbrown` with password `password` or as
|
||||
`bwilson` with password `password` . You can see that access token contains all the claims and role mappings corresponding to the LDAP data provided in LDIF.
|
|
@ -13,7 +13,7 @@ Example Custom Authenticator
|
|||
4. Login to admin console. Hit browser refresh if you are already logged in so that the new providers show up.
|
||||
|
||||
5. Go to the **Authentication** menu item and go to the **Flows** tab, you will be able to view the currently
|
||||
defined flows. You cannot modify an built in flows, so, to add the Authenticator you
|
||||
defined flows. You cannot modify a built-in flows, so, to add the Authenticator you
|
||||
have to copy an existing flow or create your own. Copy the "Browser" flow.
|
||||
|
||||
6. In your copy, click the **Actions** menu item in **Forms** subflow and **Add Execution**. Pick `Secret Question` and change
|
||||
|
|
|
@ -24,7 +24,7 @@ curl -i --request POST http://localhost:8080/auth/realms/master/example/companie
|
|||
curl -i --request POST http://localhost:8080/auth/realms/master/example/companies --data "{ \"name\": \"bar company\" }" --header "Content-type: application/json"
|
||||
````
|
||||
|
||||
Then you can lookup all companies
|
||||
Then you can look up all companies
|
||||
|
||||
````
|
||||
curl -i --request GET http://localhost:8080/auth/realms/master/example/companies --header "Accept: application/json"
|
||||
|
|
|
@ -11,7 +11,7 @@ echo -e "\n\nACCESS TOKEN IS \"$ACCESS_TOKEN\"";
|
|||
echo -e "\n\nSENDING UN-AUTHENTICATED REQUEST. THIS SHOULD FAIL WITH 401: ";
|
||||
curl -i --request POST http://localhost:8080/auth/realms/master/example/companies-auth --data "{ \"name\": \"auth foo company\" }" --header "Content-type: application/json"
|
||||
|
||||
echo -e "\n\nSENDING AUTHENTICATED REQUEST. THIS SHOULD SUCCESSFULY CREATE COMPANY AND SUCCESS WITH 201: ";
|
||||
echo -e "\n\nSENDING AUTHENTICATED REQUEST. THIS SHOULD SUCCESSFULLY CREATE COMPANY AND SUCCESS WITH 201: ";
|
||||
curl -i --request POST http://localhost:8080/auth/realms/master/example/companies-auth --data "{ \"name\": \"auth foo company\" }" --header "Content-type: application/json" --header "Authorization: Bearer $ACCESS_TOKEN";
|
||||
|
||||
echo -e "\n\nSEARCH COMPANIES: ";
|
||||
|
|
|
@ -2,12 +2,12 @@
|
|||
|
||||
## Introduction
|
||||
|
||||
Basic example that demonstrates how to setup an application as a SAML v2.0 Service Provider using SAML HTTP POST Binding with Signature Support. This example uses the Keycloak Servlet Filter to accomplish this
|
||||
Basic example that demonstrates how to set up an application as a SAML v2.0 Service Provider using SAML HTTP POST Binding with Signature Support. This example uses the Keycloak Servlet Filter to accomplish this
|
||||
Note that no role checks are done with the servlet filter. You would have to do this manually.
|
||||
|
||||
## Import the test realm
|
||||
|
||||
If you haven't already done so, you need to import the test realm for this examples. Clicking on the below link will bring you to the
|
||||
If you haven't already done so, you need to import the test realm for this example. Clicking on the below link will bring you to the
|
||||
create realm page in the Admin UI. The username/password is admin/admin to login in. Keycloak will ask you to
|
||||
create a new admin password before you can go to the create realm page.
|
||||
|
||||
|
|
Loading…
Reference in a new issue