Niko Köbler dasniko

Keycloak Stuff / URLs

Required Actions

Generic

http(s)://{host}/realms/{realm}/protocol/openid-connect/auth?response_type=code&client_id={clientId}&scope=openid&redirect_uri={redirectUri}&kc_action={requiredActionId}

Example

Because of Arjuna timeout / closing the connection after 5 mins, setting following additional JAVA_OPTS might help:

-Dquarkus.transaction-manager.default-transaction-timeout=3600
-Dkeycloak.migration.batch-enabled=true
-Dkeycloak.migration.batch-size=1000

Keycloak Cluster Configuration (How to)

This is a short and simple example on how to build a proper Keycloak cluster, using DNS_PING as discovery protocol and an NGINX server as reverse proxy.

If you prefer to use JDBC_PING, see @xgp's example gist here: https://gist.github.com/xgp/768eea11f92806b9c83f95902f7f8f80

Please see also my video about Keycloak Clustering: http://www.youtube.com/watch?v=P96VQkBBNxU
NOTE: The video covers JDBC_PING protocol and uses the legacy Keycloak Wildfly distribution!

Create X.509 certificates

(Steps taken from: https://www.baeldung.com/x-509-authentication-in-spring-security)

All passwords: changeit

RootCA

openssl req -x509 -sha256 -days 3650 -newkey rsa:4096 -keyout rootCA.key -out rootCA.crt

Keycloak Cluster Configuration (How to) - Legacy Wildfly Distribution!!!

This is a short and simple example on how to build a proper Keycloak cluster, using JDBC_PING as discovery protocol and an NGINX server as reverse proxy.

As this is for legacy Keycloak version (Wildfly based, up until version 17), you can find an example for more current and uptodate versions at this gist here: https://gist.github.com/dasniko/3a57913047af3ca1b6b0a83b294dc1a1

Please see also my video about Keycloak Clustering: http://www.youtube.com/watch?v=P96VQkBBNxU

Keycloak Events Logging CLI commands

The default Keycloak jboss-logging events listener logs the SUCCESS-events on level DEBUG and all ERROR-events on level WARN. The default logging level of the root logger is INFO, so the SUCCESS-events won't occur in the log output.

To change this and to be able to read all the events in the log output, there are 2 options (choose one of them!):

Change log level of the org.keycloak.events category logger:

Keybase proof

I hereby claim:

I am dasniko on github.
I am dasniko (https://keybase.io/dasniko) on keybase.
I have a public key ASAIPZokcnTYoxb9pRpue-YRXawuvDpwpX7mc_Qp_6gLuQo

To claim this, I am signing this object:

	embed-server --server-config=standalone.xml --std-out=echo

	/subsystem=logging/json-formatter=JSON/:add
	/subsystem=logging/console-handler=CONSOLE/:write-attribute(name=named-formatter,value=JSON)

	stop-embedded-server

	<html>
	<head>
	<script src="keycloak.js"></script>
	</head>
	<body>
	<!-- your usual content goes here... -->
	<script>
	var keycloak = new Keycloak({
	url: 'http://localhost:8080/auth',
	realm: 'demo',

	package dasniko.util;

	import java.lang.reflect.Field;
	import java.lang.reflect.Modifier;

	/**
	* @author Niko Köbler, https://www.n-k.de, @dasniko
	*/
	public class ToStringUtil {