Had this problem and quite giving me a headache for a while, somehow the latest Keycloak version is not showing Attributes tab in Users menu which preventing me from creating a new custom user attribute.
Actually it is quite simple for enabling the custom attributes tab, we can go to Realm Settings menu and select the Unmanaged Attributes as Enabled.
The result would be like this,
Red Hat Single Sign On (RHSSO) or its opensource project, which is Keycloak, is an open-source software product to allow single sign-on with identity and access management which can be deployed as a cloud service or containerized application. For this sample, we are trying to debug and print all http requests and responses that comes to RHSSO 7.4.6 which is being deployed on Openshift, for debugging purpose. But we also need to be very careful since it will print all http content which might contains sensitive values.
Okay, so lets start with creating a file “sso.cli” which have below content,
/subsystem=undertow/configuration=filter/expression-filter=requestDumperExpression:add(expression="dump-request") /subsystem=undertow/server=default-server/host=default-host/filter-ref=requestDumperExpression:add
And deploy it as a ConfigMap,
$ oc create configmap jboss-cli --from-file=sso-extensions.cli=sso.cli
Next is mount it as a volume to RHSSO DeploymentConfig
$ oc set volume dc/sso --add --name=jboss-cli \ -m /opt/eap/extensions -t configmap --configmap-name=jboss-cli \ --default-mode='0755' --overwrite
Rollout the corresponding DeploymentConfig and we can observe that http request-response logs now is showing, we can use this curl command to test
$ curl --location --request POST 'https://sso.url/auth/realms/realm/protocol/openid-connect/userinfo' \ --header 'Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiw......YXNzPlSVE2Oj0ImIQd6zQkw2UEMiEyJz8FrsVaS7x2M8mQjy-xQrSTGZVXKWR7KLHa-MCRx4S33Ja5nQuD3K_VVihKTyn4cOHnQ'
with below logs as the result
[0m[0m21:46:28,071 INFO [io.undertow.request.dump] (default task-1)
----------------------------REQUEST---------------------------
URI=/auth/realms/realm/protocol/openid-connect/userinfo
characterEncoding=null
contentLength=0
contentType=null
header=accept=*/*
header=accept-encoding=gzip, deflate, br
header=forwarded=for=10.161.5.3;host=sso.url;proto=https
header=authorization=Bearer eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiw......YXNzPlSVE2Oj0ImIQd6zQkw2UEMiEyJz8FrsVaS7x2M8mQjy-xQrSTGZVXKWR7KLHa-MCRx4S33Ja5nQuD3K_VVihKTyn4cOHnQ
header=x-forwarded-proto=https
header=x-forwarded-port=443
header=x-forwarded-for=10.161.5.3
header=content-length=0
header=host=sso.url
header=x-forwarded-host=sso.url
locale=[]
method=POST
protocol=HTTP/1.1
queryString=
remoteAddr=/10.161.5.3:0
remoteHost=10.161.5.3
scheme=https
host=sso.url
serverPort=8443
isSecure=true
--------------------------RESPONSE--------------------------
contentLength=73
contentType=application/json
header=X-XSS-Protection=1; mode=block
header=X-Frame-Options=SAMEORIGIN
header=Referrer-Policy=no-referrer
header=Date=Wed, 06 Nov 2024 14:46:28 GMT
header=Connection=keep-alive
header=WWW-Authenticate=Bearer realm="realm", error="invalid_token", error_description="Token verification failed"
header=Strict-Transport-Security=max-age=31536000; includeSubDomains
header=X-Content-Type-Options=nosniff
header=Content-Type=application/json
header=Content-Length=73
status=401
==============================================================
Keycloak provides a very convenient method of reducing workload to either database or active directory, and that is by using cache mechanism. But sometimes we want to trigger clearing cache manually, for example when there is some changes into the user data which coming from external applications.
We can do that by going to Keycloak menu, click on Realm Settings, and go to Cache tabs. We can clear cache by clicking on the User Cache Clear button.
But becareful since it will clear the whole user-cache, and not a specific user only.
Keycloak Operator provide a convenient method for uploading a custom SPI into Keycloak instances, and that is by using an extensions inside Keycloak YAML operator.
apiVersion: keycloak.org/v1alpha1
kind: Keycloak
metadata:
namespace: my-redhat-sso
labels:
app: sso
spec:
extensions:
- >-
https://url/custom-sso-spi-1.0.0.jar
externalAccess:
enabled: true
externalDatabase:
enabled: true
instances: 1
Rollout your Keycloak pod, and you can see that Keycloak instance is now having a custom SPI embedded within it.
We can directly accessing Keycloak’s Registration Page without have to go to the Login Page first, and it is quite simple. Here is the URL required to have that condition,
http://localhost:8080/realms/PowerRanger/protocol/openid-connect/registrations?
client_id=my-client-id&
redirect_uri=redhat.com&
response_type=code&
scope=openid
This are achieve by using Keycloak version 17.