thomasdarimont

class ClientCreate extends ClientUpdate {
    String type;
    // properties manadatory for creation
}

class ClientUpdate{
    String name;
 String description;

thomasdarimont

This import creates a new resource-indicators realm with a photoz client. The photoz client defines available resource-indicators via the authorization-services resources.

Create a user tester with password test in the resource-indicators realm.

Then you should be able to execute the following requests via curl.

Note the resource parameter which enables the client to select which resources should be associated with the authorization.

thomasdarimont

package demo;

import com.fasterxml.jackson.databind.JsonNode;
import com.fasterxml.jackson.databind.ObjectMapper;
import com.networknt.schema.JsonNodePath;
import com.networknt.schema.JsonSchema;
import com.networknt.schema.JsonSchemaFactory;
import com.networknt.schema.SpecVersion;
import com.networknt.schema.ValidationMessage;

thomasdarimont

#!/bin/bash
exec 3<>/dev/tcp/localhost/8080

echo -e "GET /auth/health/ready HTTP/1.1\nhost: localhost:8080\n" >&3

timeout --preserve-status 1 cat <&3 | grep -m 1 status | grep -m 1 UP
ERROR=$?

exec 3<&-
exec 3>&-

thomasdarimont

@Component
public class CookieSecurityContextRepository implements SecurityContextRepository {

  private static final String EMPTY_CREDENTIALS = "";
  private static final String ANONYMOUS_USER = "anonymousUser";

  private final String cookieHmacKey;

  public CookieSecurityContextRepository(@Value("${auth.cookie.hmac-key}") String cookieHmacKey) {
    this.cookieHmacKey = cookieHmacKey;

thomasdarimont

package demo.jwtclientauth;

import com.fasterxml.jackson.core.JsonProcessingException;
import com.fasterxml.jackson.databind.ObjectMapper;
import com.nimbusds.jose.JOSEException;
import com.nimbusds.jose.JOSEObjectType;
import com.nimbusds.jose.JWSAlgorithm;
import com.nimbusds.jose.JWSHeader;
import com.nimbusds.jose.JWSObject;
import com.nimbusds.jose.Payload;

thomasdarimont

package de.adorsys.keycloak.config.util;

import jakarta.ws.rs.WebApplicationException;
import jakarta.ws.rs.core.HttpHeaders;
import jakarta.ws.rs.core.MediaType;
import jakarta.ws.rs.core.Response;

import java.net.URI;
import java.util.Map;

thomasdarimont

Issue: First example does not show how to use --context, errors without it

Issue: ~/.kct folder not created if missing

Issue: How to configure trust store via CLI? Manually adding trust store at the root did not work either. Truststore setting was removed after adding new (http) context.

Issue: Truststore configuration does not work, even with truststore set, I cannot configure it.

Issue: Add support for skip certificate validation

thomasdarimont

#!/usr/bin/env bash

shopt -s expand_aliases

alias kcadm="docker run --net=host -i --user=1000:1000 --rm -v $(echo $HOME)/.acme/.keycloak:/opt/keycloak/.keycloak:z --entrypoint /opt/keycloak/bin/kcadm.sh quay.io/keycloak/keycloak:24.0.5"

KEYCLOAK_URL=http://localhost:8080/auth
KEYCLOAK_ADMIN=admin
KEYCLOAK_ADMIN_PASSWORD=admin

thomasdarimont

{
  "clientId": "reference-client",
  "name": "",
  "description": "",
  "rootUrl": "",
  "adminUrl": "",
  "baseUrl": "",
  "surrogateAuthRequired": false,
  "enabled": true,
  "alwaysDisplayInConsole": false,