alfresco + keycloak sync

ilseva

Hi everyone,

we are developing an extension of alfresco content service using the maven archetype.

Now, we would like to use keycloak for identity and access management.

We follow this guide Deploying Alfresco DBP with Identity Service using Docker Compose . 

Everything work fine for authentication. Issues come when we try to use users and groups from keycloak.

We learned that, at the moment, the only way to sync users (and groups) between keycloak and alfresco is by SAML Module, that is available only for enterprise customer and we are using the community edition.

We found another module alfresco-keycloak, but we were unable to integrate it. 

I think that the mantainer of this module is @afaust . 

To integrate alfresco-keycloak we define these dependencies in our alfresco acs pom

<dependency>
  <groupId>de.acosix.alfresco.utility</groupId>
  <artifactId>de.acosix.alfresco.utility.repo</artifactId>
  <version>1.3.0-SNAPSHOT</version>
  <classifier>installable</classifier>
</dependency>
<dependency>
   <groupId>de.acosix.alfresco.keycloak</groupId>
   <artifactId>de.acosix.alfresco.keycloak.repo</artifactId>
   <version>1.1.0-rc7-SNAPSHOT</version>
   <classifier>installable</classifier>
</dependency>

The 1.3.0-SNAPSHOT and 1.1.0-rc7-SNAPSHOT is the latest deployed on https://oss.sonatype.org/content/repositories/snapshots 

Cutted stacktrace

Error creating bean with name 'keycloakDeployment'
Caused by: java.lang.IllegalArgumentException: You did not supply enough values to fill path parameters
edi-acs_1       | 	at de.acosix.alfresco.keycloak.deps.keycloak.common.util.KeycloakUriBuilder.buildFromValues(KeycloakUriBuilder.java:577)

Configuration

authentication.chain=keycloak1:keycloak,alfrescoNtlm1:alfrescoNtlm
keycloak.adapter.auth-server-url=${KEYCLOAK_URL}
keycloak.adapter.credentials.provider=secret
keycloak.adapter.realm=${KEYCLOAK_REALM}
keycloak.adapter.resource=${KEYCLOAK_CLIENT}
keycloak.adapter.credentials.secret=xxxxxxxx

${KEYCLOAK_URL} ${KEYCLOAK_REALM} ${KEYCLOAK_CLIENT} are set through -D options

Maybe he could help us... 

Thanks

afaust

Thanks for mentioning me in your post, otherwise I might have missed it. In general, if you want the maintainer of a module to look into one of your issues, it is a good idea to raise such questions / issues in the issue tracker of the addon project - if the project has an issue tracker. Since the alfresco-keycloak addon is on GitHub, it has an issue tracker by default.

Your placeholders are not resolved because of a general limitation in how Alfresco resolves -D flags to configuration properties. In general, only configuration properties which have been pre-defined in a pre-packaged configuration file (repository.properties, module alfresco-global.properties, or subsystem instance type *.properties) can be resolved. That means in one of those files you would have to have an entry in the form of

KEYCLOAK_REALM=

for a -DKEYCLOAK_REALM=xyz property to be effective, and be referenceable via a ${KEYCLOAK_REALM} placeholder in other properties. The reason for this is that Alfresco only uses an override mode of handling -D flags instead of fully merging them.

For the ADF part, I must admit I do not test this as I do not use ADF / ACA / ADW at all in any projects (those are generally useless / too much effort to deal with to achieve even basic non-trivial solutions - compared to Share), so I can't immediately give you an educated guess of what might be failing - I also don't know anythign about your ADF / Keycloak realm config for handling OAuth. What I could imagine is that you are trying to use a Keycloak access token obtained for the ADF application (as a public client) to directly call ACS, which potentially fails in some validation step, assuming ACS is set up as its own Keycloak client. "Unfortunately", the alfresco-keycloak addon is set up to be more compliant / consistent / secure when interacting with Keycloak, while the Identity Service integration really uses a naiive fire/once-and-forget type of integration.
For alfresco-keycloak, it would normally be expected that a client calling ACS exchange their access token for an access token to the backend resource. As far as I can remember, ADF requires a public-client type of Keycloak client, which means it will be unable to do such an exchange. You may want to try

keycloak.adapter.verify-token-audience=false

to disable one of the validations, and allow an access token from a public client to be used for direct authentication without exchanging it.