javascript to collect keycloak user list

but not sure which keycloak version.

---- 

$('.js-user-link').each(function() { console.log({ userId: $(this).data('user-id'), username: $(this).data('username'), fullName: $(this).find('.gl-avatar-labeled-label').text().trim(), email: $(this).find('.gl-avatar-labeled-sublabel').text().trim(), avatar: $(this).find('img').attr('src'), isAdmin: $(this).find('.badge').text().includes('Admin') }); });

Keycloak 25.0.1 - Subject (sub)

 
Keycloak, OAuth2

25.0.1

doesn't have 

Subject (sub)

by default

required to add it manually

Valid redirect URIs for Keycloak 20.0.1

 
Keycloak Error:

Invalid parameter: redirect_uri


Valid redirect URIs 

Recognized:

http://localhost:9099/sfa/*

Unrecognized

http://localhost*/sfa/*

OAuthRequestAuthenticator : failed to turn code into token

 


I was having:

2022-12-07 09:21:25.077 ERROR 25057 --- [nio-8001-exec-4] o.k.adapters.OAuthRequestAuthenticator   : failed to turn code into token

java.net.ConnectException: Connection timed out (Connection timed out)

        at java.net.PlainSocketImpl.socketConnect(Native Method) ~[na:1.8.0_352]

        at java.net.AbstractPlainSocketImpl.doConnect(AbstractPlainSocketImpl.java:350) ~[na:1.8.0_352]

        at java.net.AbstractPlainSocketImpl.connectToAddress(AbstractPlainSocketImpl.java:206) ~[na:1.8.0_352]

        at java.net.AbstractPlainSocketImpl.connect(AbstractPlainSocketImpl.java:188) ~[na:1.8.0_352]

        at java.net.SocksSocketImpl.connect(SocksSocketImpl.java:392) ~[na:1.8.0_352]

        at java.net.Socket.connect(Socket.java:607) ~[na:1.8.0_352]

        at org.apache.http.conn.ssl.SSLSocketFactory.connectSocket(SSLSocketFactory.java:542) ~[httpclient-4.5.3.jar!/:4.5.3]

        at org.keycloak.adapters.SniSSLSocketFactory.connectSocket(SniSSLSocketFactory.java:109) ~[keycloak-adapter-core-4.5.0.Final.jar!/:4.5.0.Final]

        at org.apache.http.conn.ssl.SSLSocketFactory.connectSocket(SSLSocketFactory.java:414) ~[httpclient-4.5.3.jar!/:4.5.3]

        at org.apache.http.impl.conn.DefaultClientConnectionOperator.openConnection(DefaultClientConnectionOperator.java:180) ~[httpclient-4.5.3.jar!/:4.5.3]

        at org.apache.http.impl.conn.AbstractPoolEntry.open(AbstractPoolEntry.java:144) ~[httpclient-4.5.3.jar!/:4.5.3]

        at org.apache.http.impl.conn.AbstractPooledConnAdapter.open(AbstractPooledConnAdapter.java:134) ~[httpclient-4.5.3.jar!/:4.5.3]

        at org.apache.http.impl.client.DefaultRequestDirector.tryConnect(DefaultRequestDirector.java:610) ~[httpclient-4.5.3.jar!/:4.5.3]

        at org.apache.http.impl.client.DefaultRequestDirector.execute(DefaultRequestDirector.java:445) ~[httpclient-4.5.3.jar!/:4.5.3]

        at org.apache.http.impl.client.AbstractHttpClient.doExecute(AbstractHttpClient.java:835) ~[httpclient-4.5.3.jar!/:4.5.3]

        at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:83) ~[httpclient-4.5.3.jar!/:4.5.3]

        at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:108) ~[httpclient-4.5.3.jar!/:4.5.3]

        at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:56) ~[httpclient-4.5.3.jar!/:4.5.3]

        at org.keycloak.adapters.ServerRequest.invokeAccessCodeToToken(ServerRequest.java:111) ~[keycloak-adapter-core-4.5.0.Final.jar!/:4.5.0.Final]

        at org.keycloak.adapters.OAuthRequestAuthenticator.resolveCode(OAuthRequestAuthenticator.java:335) ~[keycloak-adapter-core-4.5.0.Final.jar!/:4.5.0.Final]

        at org.keycloak.adapters.OAuthRequestAuthenticator.authenticate(OAuthRequestAuthenticator.java:280) ~[keycloak-adapter-core-4.5.0.Final.jar!/:4.5.0.Final]

        at org.keycloak.adapters.RequestAuthenticator.authenticate(RequestAuthenticator.java:139) ~[keycloak-adapter-core-4.5.0.Final.jar!/:4.5.0.Final]

        at org.keycloak.adapters.tomcat.AbstractKeycloakAuthenticatorValve.authenticateInternal(AbstractKeycloakAuthenticatorValve.java:203) ~[keycloak-tomcat-core-adapter-4.5.0.Final.jar!/:4.5.0.Final]

        at org.keycloak.adapters.tomcat.KeycloakAuthenticatorValve.authenticate(KeycloakAuthenticatorValve.java:50) [keycloak-tomcat8-adapter-4.5.0.Final.jar!/:4.5.0.Final]

        at org.keycloak.adapters.tomcat.KeycloakAuthenticatorValve.doAuthenticate(KeycloakAuthenticatorValve.java:57) [keycloak-tomcat8-adapter-4.5.0.Final.jar!/:4.5.0.Final]

        at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:556) [tomcat-embed-core-8.5.11.jar!/:8.5.11]

        at org.keycloak.adapters.tomcat.AbstractKeycloakAuthenticatorValve.invoke(AbstractKeycloakAuthenticatorValve.java:181) ~[keycloak-tomcat-core-adapter-4.5.0.Final.jar!/:4.5.0.Final]

        at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:140) [tomcat-embed-core-8.5.11.jar!/:8.5.11]

        at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:79) [tomcat-embed-core-8.5.11.jar!/:8.5.11]

        at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:87) [tomcat-embed-core-8.5.11.jar!/:8.5.11]

        at org.apache.catalina.valves.RemoteIpValve.invoke(RemoteIpValve.java:677) [tomcat-embed-core-8.5.11.jar!/:8.5.11]

        at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:349) [tomcat-embed-core-8.5.11.jar!/:8.5.11]

        at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:783) [tomcat-embed-core-8.5.11.jar!/:8.5.11]

        at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66) [tomcat-embed-core-8.5.11.jar!/:8.5.11]

        at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:798) [tomcat-embed-core-8.5.11.jar!/:8.5.11]

        at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1434) [tomcat-embed-core-8.5.11.jar!/:8.5.11]

        at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49) [tomcat-embed-core-8.5.11.jar!/:8.5.11]

        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [na:1.8.0_352]

        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [na:1.8.0_352]

        at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) [tomcat-embed-core-8.5.11.jar!/:8.5.11]

        at java.lang.Thread.run(Thread.java:750) [na:1.8.0_352]

Found out that server couldn't curl to keyclock which installed on the same machine by using public domain:

curl https://your.public.keycloak.com

curl: (7) Failed connect to your.public.keycloak.com:443; Connection timed out

 

Keycloak 18.0.2

 

HTTP Error

302

401

500

clientId missing

solved by changing json config from installation as below

from:

  "auth-server-url": "http://localhost:9000/",

  "ssl-required": "none",

  "resource": "localsfaportal",

to:

  "url": "http://localhost:9000/",

  "ssl-required": "none",

  "clientId": "localsfaportal",

       [KEYCLOAK] Usage of legacy style promise methods such as `.error()` and `.success()` has been deprecated and support will be removed in future versions. Use standard style promise methods such as `.then() and `.catch()` instead.

resolved by changing init javascript

from:

keycloak.init().success().error()

to:

keycloak.init().then().catch()

has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.

Solved by adding * as print screen below:

Upgrade Spring Boot from 1.5.20.RELEASE to 2.7.2

as of: 20220727_pm070452, Still editing...

Stacks

From Spring Boot + Keycloak

To: Spring Boot + Keycloak + Spring Security 

Version

from: 1.5.20.RELEASE

to: 2.7.2

Changes

1. pom.xml
2. CSRF - default implementation of Spring Security
1. JSP
3. Controllers
4. Services
1. Repo
1. Batch Save
2. Batch Delete
3. Delete
4. FindOne
5. Pageable
5. application.properties
6. 
   

pom.xml

Added

<dependency>

<groupId>org.springframework.security</groupId>

<artifactId>spring-security-config</artifactId>

</dependency>

<dependency>

<groupId>org.springframework.boot</groupId>

<artifactId>spring-boot-starter-security</artifactId>

</dependency>

<dependency>

<groupId>org.keycloak</groupId>

<artifactId>keycloak-spring-boot-starter</artifactId>

<version>18.0.2</version>

</dependency>

<dependency>

<groupId>org.keycloak</groupId>

<artifactId>keycloak-spring-security-adapter</artifactId>

<version>18.0.2</version>

</dependency>

<dependency>

<groupId>org.springframework.boot</groupId>

<artifactId>spring-boot-starter-validation</artifactId>

</dependency>

<dependency>

<groupId>org.keycloak.bom</groupId>

<artifactId>keycloak-adapter-bom</artifactId>

<version>${version.keycloak-adapter-bom}</version>

<type>pom</type>

</dependency>

Modified

from:

  <parent>

<groupId>org.springframework.boot</groupId>

<artifactId>spring-boot-starter-parent</artifactId>

<version>1.5.20.RELEASE</version>

</parent>

to:

  <parent>

<groupId>org.springframework.boot</groupId>

<artifactId>spring-boot-starter-parent</artifactId>

<version>2.7.2</version>

</parent>

from:

<properties>

<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>

<project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>

<java.version>1.8</java.version>

<spring-cloud.version>Edgware.SR5</spring-cloud.version>

</properties>

to:

<properties>

<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>

<project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>

<java.version>1.8</java.version>

<start-class>com.tiongnam.sfa.cdr.MainClass</start-class>

<spring-cloud.version>2021.0.3</spring-cloud.version>

<version.keycloak-adapter-bom>18.0.2</version.keycloak-adapter-bom>

</properties>

from:

<dependency>

<groupId>org.keycloak</groupId>

<artifactId>keycloak-spring-boot-adapter</artifactId>

<version>4.5.0.Final</version>

</dependency>

to:

<dependency>

<groupId>org.keycloak</groupId>

<artifactId>keycloak-spring-boot-adapter</artifactId>

<version>18.0.2</version>

</dependency>

CSRF - default implementation of Spring Security

Added header into ajax post request

, headers: {"${_csrf.headerName}": '${_csrf.token}'}

Added spring security tag within POST form:

<sec:csrfInput />

or

turn off csrf checking

protected void configure(HttpSecurity http) throws Exception {

org.springframework.security.config.annotation.web.builders.HttpSecurity http.csrf().disable();

...

...

Controllers:

Changed

From:

org.keycloak.KeycloakPrincipal<RefreshableKeycloakSecurityContext> principal

To:

java.security.Principal principal

Services

Batch Save

Changed

From:

repo.save(batchList)

To:

repo.saveAll(batchList);

findOne

From:

repo.findOne(new Long("1"));

To:

repo.getReferenceById(new Long("1"));

Delete

From:

delete(entity.getId());

To:

deleteById(entity.getId());

Pageable

From:

Pageable page_req = new PageRequest(index,reqData.getLength(), orderBy(reqData), reqData.getOrder().getData());

To:

Pageable page_req = PageRequest.of(index, reqData.getLength(), orderBy(reqData), reqData.getOrder().getData());

application.properties

Added

server.tomcat.max-http-form-post-size

server.tomcat.max-swallow-size

Changed

server.contextPath

to

server.servlet.context-path

spring.http.multipart.max-file-size

to

spring.servlet.multipart.max-file-size

spring.http.multipart.max-request-size

to

spring.servlet.multipart.max-request-size

keycloak.securityConstraints[0].authRoles[0]=read-only-common

keycloak.securityConstraints[0].securityCollections[0].patterns[0]=/welcome

keycloak.securityConstraints[0].securityCollections[0].patterns[1]=/logout

keycloak.securityConstraints[0].securityCollections[0].patterns[2]=/dashboard

keycloak.securityConstraints[0].securityCollections[0].patterns[3]=/web/getDashboard

to

@Override

protected void configure(HttpSecurity http) throws Exception {

super.configure(http);

http.authorizeRequests()

.antMatchers("/vendor/**", "/css/**", "/js/**", "/img/**").permitAll()

.antMatchers("/upload").authenticated()

.antMatchers("/formd/**", "/module1/**", "/maintenance/**").authenticated()

.anyRequest().authenticated()

;

}

Setup local Keycloak for development

 




https://stackoverflow.com/a/72600716

Keycloak 18.0.2 doesn't required "/auth" as endpoint

new config:

keycloak.auth-server-url=http://localhost:8080

would be enough

We are sorry... page not found... error

Mandatory Config in Keycloak

while hitting we are sorry page not found error

was using http://localhost:8080/auth for keycloak.auth-server

while testing with https://www.keycloak.org/app/

hit error if didn't fill: https://www.keycloak.org/app/

to:

Root URL: https://www.keycloak.org/app/

If config below never in place, will trigger error: Invalid parameter: redirect_uri

Valid Redirect URIs: *

Respective Keycloak role in Spring Boot authRole config

 





keycloak.securityConstraints[0].authRoles[0]=xyz





Respective config in Keycloak (18.0.2)

In user Role mappings: