Errai: The browser as a platform

Wednesday, January 14, 2015

SSO with Errai and Keycloak.js

The Artificer project (http://artificer.jboss.org) has been a long-time fan of Errai, relying on it for the majority of our powerful UI. We recently switched to using Keycloak, an out-of-the-box security solution, for authentication and authorization. Typically, you'd protect your Errai index.html page with a simple security-constraint in the WAR's web.xml.  However, due to various issues, we investigated the use of Keycloak's pure-Javascript adapter (keycloak.js). This post will quickly capture the approach and a few gotchas.

Note that Errai has a built-in Keycloak module, based on Errai Security. Although that may be the best way to go, we were interested in making keycloak.js work on its own with plain Errai.

index.html

So, first things first.  When you run Keycloak, either using its standalone appliance or within a container of your choice, it serves up the keycloak.js file.  Add it to your page's header:


Right off the bat, there's a few things to notice:

  • The keycloak variable is attached to the window object.  More on that later...
  • The init call includes the {onLoad: 'login-required'} option. This tells Keycloak to redirect users to the built-in login screen, if un-authenticated.  If left off, the user must be pre-authenticated by other means.
  • Keycloak revolves around the use of tokens. Server-side, those tokens expire after a configurable period.  For Javascript-based solutions, such as Errai, that may never refresh the page, manually refreshing the token is vital. However, Keycloak's updateToken is currently asynchronous and uses a promise. Rather than deal with a complicated callback setup, we're simply updating the token on a 10 second timer.  By default, Keycloak tokens expire after a minute, however this value is configurable.

REST

The back-end REST services are also protected by Keyloak.  In order to use them, without requiring basic authentication, the Errai app must provide a "bearer token" on each call.  To accomplish this, we created a RestClientInterceptor to intercept each call and add the token.


Here, we use a bit of JSNI to obtain the Keycloak token from index.html.  Here's where the window object necessity comes in.  Since this interceptor technically runs in a nested frame, simple global variables will not work.  Attaching the variable to window, then referring to it through JSNI's $wnd, allows the cross-frame sharing.

After obtaining the token, the interceptor adds it to the request.  Note that the header key is "Authorization" and the value is "Bearer [token]".  The "Bearer" bit is vital, but can be easily forgotten.

RPC

The above approach works similarly for RPC, but is instead based on RpcInterceptor.

Servlets

What about Servlets?  In our case, Servlets are used directly from GWT FormPanel for needs such as local file uploads.  The Servlets themselves are not protected by Keycloak, but they turn around and call the same REST services described above.  So, the bearer token is still needed, but in a proxied manner. Since there's not a request originating from Errai to intercept, we have to use this workaround.


We automatically add a Hidden input, called "Authorization", to the form.  When the form is submitted, we're re-using the JSNI in KeycloakBearerTokenInterceptor to set the input's value to "Bearer [token]". Then, in the Servlet's doPost, the "Authorization" parameter is pulled from the HttpServletRequest. The token is then used on the proceeding call to the REST services.

One caveat that's often overlooked: if your form sends multipart data, such as our file upload, the "Authorization" parameter is a part of the request's file/form items, not in request.getParameter("Authorization").

For GET, it's obviously easier. Simply add the "Authorization" parameter, identical to the above (if in a form) or by adding it to the URL query string. The Servlet grabs it through request.getParameter("Authorization").

17 comments:

  1. Thank You for posting got me over a major hump in working with keycloak, now that I have a token I want to access user information such as Username, Email and Groups in the index.html scenario using mainly javascript if possible. Obviously if required I can call REST and parse JSON thanks for you help and this document as was truly helpful now I need to get to the data ;-)

    ReplyDelete
    Replies
    1. i am ERIC BRUNT by name. Greetings to every one that is reading this testimony. I have been rejected by my wife after three(3) years of marriage just because another Man had a spell on her and she left me and the kid to suffer. one day when i was reading through the web, i saw a post on how this spell caster on this address AKHERETEMPLE@gmail.com have help a woman to get back her husband and i gave him a reply to his address and he told me that a man had a spell on my wife and he told me that he will help me and after 3 days that i will have my wife back. i believed him and today i am glad to let you all know that this spell caster have the power to bring lovers back. because i am now happy with my wife. Thanks for helping me Dr Akhere contact him on email: AKHERETEMPLE@gmail.com
      or
      call/whatsapp:+2349057261346




      i am ERIC BRUNT by name. Greetings to every one that is reading this testimony. I have been rejected by my wife after three(3) years of marriage just because another Man had a spell on her and she left me and the kid to suffer. one day when i was reading through the web, i saw a post on how this spell caster on this address AKHERETEMPLE@gmail.com have help a woman to get back her husband and i gave him a reply to his address and he told me that a man had a spell on my wife and he told me that he will help me and after 3 days that i will have my wife back. i believed him and today i am glad to let you all know that this spell caster have the power to bring lovers back. because i am now happy with my wife. Thanks for helping me Dr Akhere contact him on email: AKHERETEMPLE@gmail.com
      or
      call/whatsapp:+2349057261346

      Delete
    2. AM SANDRA FROM CANADA, THANKS TO DR ONIHA WHO HELP ME BRING MY HUSBAND BACK, MY HUSBAND LEFT ME WITH THREE KIDS, FOR ANOTHER YOUNG GIRL, FOR OVER TWO YEARS, I TRIED ALL I COULD TO SETTLED OUR DIFFRENCES, BUT IT YIELDED NO RESULT, I WAS THE ONE TAKING CARE OF THE CHILDREN ALONE, UNTIL ONE DAY, I CAME IN CONTACT WITH SOME ARTICLES ONLINE, CONTAINING HOW DR ONIHA HAS HELP SO MANY LOVERS AND FAMILY REUNION AND REUNIT AGAIN, AND I DECIDED TO CONTACT HIM, AND HE CAST HIS SPELL ON MY HUSBAND, WITHIN FIVE DAYS, MY HUSBAND RAN BACK HOME, AND WAS BEGGING ME AND THE KIDS FOR FORGIVENESS, IN CASE YOU ARE PASSING THROUGH SIMILAR PROBLEMS, AND YOU WANTS TO CONTACT DR ONIHA, YOU CAN REACH HIM VIA HIS CONTACT NUMBER, ON CALL OR WHATSAP +2347089275769 OR EMAIL DRONIHASPELL@YAHOO.COM

      Delete
    3. I’m recommending Dr Godday to everyone who have herpes virus to get the cure from him. I was diagnose of genital herpes in 2015 and i have been searching and asking questions to see if i could get something to cure the disease because i did not believe what the doctors say that no cure is found yet. I came across a comment on Youtube and the person testify how she was cured from herpes and hpv after using Dr Godday herbal medicine. I quickly contact Dr email and explain my problem to him and he prepare the herbs and send it to me through courier and gave me instructions on how to use it and tell me to go for checkup after usage which i did after two weeks of taken the herbal medicine and my result was NEGATIVE. I waited another month and retested the result was still NEGATIVE and my doctor told me that am completely free from herpes. Am so happy and grateful to Dr Godday for what he has done for me and i will continue to share this for people out there to know that there is cure for herpes. You can contact Dr Godday on email and WhatsApp to get the cure from him. Email:goddayspiritualhome@gmail.com Or Call/What’s-app +1{919}4956404.




      Delete
  2. window.keycloak = Keycloak({
    url: 'http://localhost:8080/auth',
    realm: '[REALM NAME]',
    clientId: '[CLIENT ID]',
    credentials: {
    secret: '[SECRET]' // <--- Just don't look here!
    }
    });

    This just has to be wrong!

    ReplyDelete
  3. i am ERIC BRUNT by name. Greetings to every one that is reading this testimony. I have been rejected by my wife after three(3) years of marriage just because another Man had a spell on her and she left me and the kid to suffer. one day when i was reading through the web, i saw a post on how this spell caster on this address AKHERETEMPLE@gmail.com have help a woman to get back her husband and i gave him a reply to his address and he told me that a man had a spell on my wife and he told me that he will help me and after 3 days that i will have my wife back. i believed him and today i am glad to let you all know that this spell caster have the power to bring lovers back. because i am now happy with my wife. Thanks for helping me Dr Akhere contact him on email: AKHERETEMPLE@gmail.com
    or
    call/whatsapp:+2349057261346




    i am ERIC BRUNT by name. Greetings to every one that is reading this testimony. I have been rejected by my wife after three(3) years of marriage just because another Man had a spell on her and she left me and the kid to suffer. one day when i was reading through the web, i saw a post on how this spell caster on this address AKHERETEMPLE@gmail.com have help a woman to get back her husband and i gave him a reply to his address and he told me that a man had a spell on my wife and he told me that he will help me and after 3 days that i will have my wife back. i believed him and today i am glad to let you all know that this spell caster have the power to bring lovers back. because i am now happy with my wife. Thanks for helping me Dr Akhere contact him on email: AKHERETEMPLE@gmail.com
    or
    call/whatsapp:+2349057261346

    ReplyDelete
  4. I'm very happy being Herpes free now. It was a sad incident that was announced to me after the check up in the hospital and I was diagnosed of HSV 2. I thank God now for using Dr.odey Abang to cure my virus. I'm not ashamed to say this because no virus of such can be detected in me. I'm Charlotte from Columbia. I thought about it many Times when I heard about this Herbal cures for Herpes. I was really happy when I came across blogs of comments of Doctors who run cures sicknesses and was comfortable to try Dr. Abang from patients testimony I came across here on my online page. I knew now they are real Africa herbalists who run cures for Herpes. There's every opportunity to be cure with natural herbs, because all medical prescriptions are derived from herbs and roots. Its really hard time living with Herpes on drugs which can't get you cure. I tried this and I can boost of myself now as a woman. I need to be loved not to lost, get your instant cure to all sicknesses from Dr, Odey Abang.
    He cures HSV,HPV,Cancer,low spam count and much more from the evidence I saw 💯 % sure no site effects with active immune booster

    Email him for you cure
    Odeyabangherbalhome@gmail.com
    WhatsApp/calls
    +2349015049094

    ReplyDelete
  5. Nothing is not possible in this word.
    Herpes I cried out for 8moths had a cure and was making use of the Medication that never wanted a life living on drugs, I applied Antibiotics, he prescribed for me the acyclovir(Zovirax), famciclovir (Famvir), andvalacyclovir (Valtrex).
    They never get me cured.
    My God keep blessing you and your Family. Dr
    ODEY ABANG, your a powerful Herbalist fir your work in my life
    I wish you know how I feel inside me when I was making use of does tablets that never could there get me cured. I had to search about some of my favourite blogs when I thought about Dr Odey abang from the testimonies of patients and I remember a friend who told me I should try Dr. Odey Abang herbal medicine. He told me the man can cure me,but was shy and feel its dirty taking in herbs made with African herbalists.
    You need to know I would have been cured before now since I knew him then, but still interested in letting you that was my punishment.
    Thanks reading my article, feel good and not make my mistake, I love testimonies and explanations of the new beginning is all I hope for
    Think about your live and use herbs to get you cured of your challenge on
    HIV/Aids
    SYPHILIS
    DIABETES
    CANCER
    ALL CAN BE CURED WITH MANY OTHERS BY DR. ODEY ABANG
    His email is for you so you speak to him

    Odeyabangherbalhome@gmail.com
    WhatsApp number +2349015049094

    ReplyDelete
  6. Never give up in life they all say no cure to HSV 2 which is a big lie I have pass through many process also i never believe there is really cure to HERPES until I meet Dr Moonlight the doctor that have been helping many people for many years, I come across this doctor online when I was searching for cure online I found out about this man, and to my greatest surprise this man have the herbal medicine which I have been looking for years I explain my problem to him through the email I found on someone who testify about him also, Dr Moonlight write me a reply and explain how the process work so after ordering for the medicine I got it within 4 days and I took it according to the way Dr Moonlight instructed, I was so happy after two week I took the medicine there was very big change in my health when I was done with the process I go for test, I found out I am negative that was the day I have the tears of joy you can also get in contact with my doctor through his email now moonlightspellcaster@gmail.com And He also have herbs medicine to cured the following diseases; eczema,urethra wart,chronic problems.Herpes, Cancer, Als,Hepatitis, Diabetes, HPV,Infections,ulcer ETC

    ReplyDelete
  7. Ever since my husband got me divorced for the past 2 years, i v'e not been my self. I was reviewing some post of how i could get back my husband then, i saw a testimony shared by Marina Choas from SWEDEN about a spell caster named Dr. tunde. I contacted Marina Chaos to confirm about how Dr. tunde helped her and she clarified everything to me of how he helped her and that gave me the courage to get in touch with Dr. tunde for help. Dr. tunde assured me that my days of sorrows will be over within 48hours after he has finished with his work. I followed his instructions he gave to me because i had the believe, faith, hope and trust in him. Verily i say to you today that i and my husband are back together and i can proudly say and testify to the world of what Dr. tunde did for me. Contact him today via E-mail:(babatundesolutioncentre1@gmail.com) OR call him or whatsapp him +2348143581382 if you seek his help. Also specialize in treating all kinds of illness, HERPES VIRUS, HEPATITIS B, CANCER, BRAIN DISEASE, INFERTILITY, DIABETES AND MORE

    ReplyDelete

  8. I am so Happy to be writing this article in here, i am here to explore blogs forum about the wonderful and most safe cure for HERPES SIMPLEX VIRUS.I was positive to the Virus called HERPES and i lost hope completely because i was rejected even by my closet friends. i searched online to know and inquire about cure for HERPES and i saw testimony about DR Ebhota online on how he cured so many persons from Herpes Disease so i decided to contact the great herbalist because i know that nature has the power to heal everything. i contacted him to know how he can help me and he told me never to worry that he will help me with the natural herbs from God! after 2 days of contacting him, he told me that the cure has been ready and he sent it to me via FEDEX or DHL and it got to me after 4 days! i used the medicine as he instructed me (MORNING and EVENING) and i was cured! its really like a dream but i'm so happy! that's the reason i decided to also add more comment of Him so that more people can be saved just like me! and if you need his help,contact his Email: (drebhotasoltion@gmail.com) You can contact him on WhatsApp +2348089535482 He also have the herb to cure difference cure for any sickness (1) HERPES,
    (2) DIABETES,
    (3) HIV&AIDS,
    (4) URINARY TRACT INFECTION,
    (5) HEPATITIS B,
    (6) IMPOTENCE,
    (7) BARENESS/INFERTILITY
    (8) DIARRHEA
    (9) ASTHMA..

    ReplyDelete
  9. Hi viewers, I'm posting this Because i found lots of people having marriage problems which I also experienced. I recently found help from a man called Dr. Oselumen he did a great job that made my man fell back in love with me again after ten months of separation. I want you to know there are fake online spell Dr .s if someone out there needs help, can email this great spell caster, droselumen@gmail. com check or connect with him on WhatsApp +2348054265852. He will give you the best result.
    CONTACT HIM FOR ANY KIND OF HELP,MONEY SPELL,LOTTERY SPELL,PREGNANCY SPELL,DIVORCE SPELL,SPELL TO STOP COURT CASE AND WIN ANY COURT PROBLEM,DEATH SPELL,BUSINESS SPELL,HEALING SPELL,SPELL TO REMOVE BLACK MAGIC OUT FROM YOUR LIFE,FAMILY AND MARRIAGE PROBLEM.

    ReplyDelete
  10. My brother David has been diagnose with HERPES for a little more than a year. He showed signs of it for close to three years and no Doctor was able to figure out what was wrong, until my sister whom he had been living with kept trying to bring him to each doctor ---- finally found a doctor who recognised almost immediately that he had HERPES. He has been taking medication that was made available to him only through a medical grant funding from those who have donated to the continuing research for a possible cure. He has slowed down in the progression, but without side affects. My hopes and prayers are that, you can HERPESo contact the Doctor for possible cure if you have HERPES or any relative suffering for same disease here is their contact is as follow. healthmedlab@gmail.com OR info@healthmedlabclinic.com  their Website: www.healthmedlabclinic.com

    ReplyDelete
  11. Dr. Riaria cured my herpes virus that have been in my body since two years, ever since then my life has been incomplete, I have used so many drugs that was prescribed to me by doctors, but it didn't cure my herpes virus, i was checking for solution on the internet then I miraculously came across Dr. Riaria the powerful herbalist that  can cure herpes infection, then I contacted him through his email, I explained everything to him and he prepared a herbal medicine and sent it to me through FedEx, which I took for 14 days with the instruction he gave me, and when I did a test in the hospital my result came out negative it was the happiest day of my life that am cure from HSV 2,  are you also suffering from same virus or another diseases you can simply contact him via email: drriaria@gmail.com  you can also call or WhatsApp him on: +2349134987375.  

    ReplyDelete