Weird behavior after creating a Javascript (JS) policy from a deployed JAR file #15001

igorya7v · 2022-10-19T00:58:38Z

igorya7v
Oct 19, 2022

After deploying the script JAR and running bin/kc.sh build (following the instructions), one would expect the added JS policies to appear under the "Policies" tab, however, the newly added policies appear in the "Create policy" dialog.

Keycloak version: 19.0.2

sh-4.4$ ./bin/kc.sh show-config
Current Mode: development
Current Configuration:
        kc.cache =  local (PersistedConfigSource)
        kc.config.built =  true (SysPropConfigSource)
        kc.db =  dev-file (PersistedConfigSource)
        kc.health-enabled =  false (PersistedConfigSource)
        kc.hostname-strict =  false (PropertiesConfigSource[source=jar:file:///opt/keycloak/lib/lib/main/org.keycloak.keycloak-quarkus-server-19.0.2.jar!/META-INF/keycloak.conf])
        kc.hostname-strict-https =  false (PropertiesConfigSource[source=jar:file:///opt/keycloak/lib/lib/main/org.keycloak.keycloak-quarkus-server-19.0.2.jar!/META-INF/keycloak.conf])
        kc.http-enabled =  true (PropertiesConfigSource[source=jar:file:///opt/keycloak/lib/lib/main/org.keycloak.keycloak-quarkus-server-19.0.2.jar!/META-INF/keycloak.conf])
        kc.http-relative-path =  / (PersistedConfigSource)
        kc.log-console-output =  default (PropertiesConfigSource[source=jar:file:///opt/keycloak/lib/lib/main/org.keycloak.keycloak-quarkus-server-19.0.2.jar!/META-INF/keycloak.conf])
        kc.log-file =  ${kc.home.dir:default}${file.separator}data${file.separator}log${file.separator}keycloak.log (PropertiesConfigSource[source=jar:file:///opt/keycloak/lib/lib/main/org.keycloak.keycloak-quarkus-server-19.0.2.jar!/META-INF/keycloak.conf])
        kc.metrics-enabled =  false (PersistedConfigSource)
        kc.provider.file.js-provider-scripts.jar.last-modified =  1666138451000 (PersistedConfigSource)
        kc.spi-map-storage-concurrenthashmap-dir =  ${kc.home.dir:default}${file.separator}data${file.separator}chm (PropertiesConfigSource[source=jar:file:///opt/keycloak/lib/lib/main/org.keycloak.keycloak-quarkus-server-19.0.2.jar!/META-INF/keycloak.conf])
        kc.spi-map-storage-concurrenthashmap-key-type-authz-resource-servers =  string (PropertiesConfigSource[source=jar:file:///opt/keycloak/lib/lib/main/org.keycloak.keycloak-quarkus-server-19.0.2.jar!/META-INF/keycloak.conf])
        kc.spi-map-storage-concurrenthashmap-key-type-realms =  string (PropertiesConfigSource[source=jar:file:///opt/keycloak/lib/lib/main/org.keycloak.keycloak-quarkus-server-19.0.2.jar!/META-INF/keycloak.conf])
        kc.spi-map-storage-concurrenthashmap-key-type-single-use-objects =  string (PropertiesConfigSource[source=jar:file:///opt/keycloak/lib/lib/main/org.keycloak.keycloak-quarkus-server-19.0.2.jar!/META-INF/keycloak.conf])
        kc.spi-theme-cache-templates =  false (PropertiesConfigSource[source=jar:file:///opt/keycloak/lib/lib/main/org.keycloak.keycloak-quarkus-server-19.0.2.jar!/META-INF/keycloak.conf])
        kc.spi-theme-cache-themes =  false (PropertiesConfigSource[source=jar:file:///opt/keycloak/lib/lib/main/org.keycloak.keycloak-quarkus-server-19.0.2.jar!/META-INF/keycloak.conf])
        kc.spi-theme-static-max-age =  -1 (PropertiesConfigSource[source=jar:file:///opt/keycloak/lib/lib/main/org.keycloak.keycloak-quarkus-server-19.0.2.jar!/META-INF/keycloak.conf])
        kc.version =  19.0.2 (SysPropConfigSource)

JAVA Version:

sh-4.4$ java --version
openjdk 11.0.16.1 2022-08-12 LTS
OpenJDK Runtime Environment (Red_Hat-11.0.16.1.1-1.el8_6) (build 11.0.16.1+1-LTS)
OpenJDK 64-Bit Server VM (Red_Hat-11.0.16.1.1-1.el8_6) (build 11.0.16.1+1-LTS, mixed mode, sharing)

keycloak-scripts.json:

{
    "authenticators": [
    ],
    "policies": [
        {
            "name": "JS Test Policy",
            "fileName": "js-script-policy.js",
            "description": "My Policy from a JS file"
        },
        {
            "name": "JS Test Policy #2",
            "fileName": "js-script-policy-2.js",
            "description": "My Policy #2 from a JS file"
        }
    ],
    "mappers": [
    ],
    "saml-mappers": [
    ]
}

js-script-policy.js:

const context = $evaluation.getContext();
const contextAttributes = context.getAttributes();

if (contextAttributes.containsValue('kc.client.network.ip_address', '127.0.0.1')) {
    $evaluation.grant();
}

js-script-policy-2.js:

const context = $evaluation.getContext();
const identity = context.getIdentity();
const attributes = identity.getAttributes();
const email = attributes.getValue('email').asString(0);

if (email.endsWith('@keycloak.org')) {
    $evaluation.grant();
}

The "Policies" tab doesn't have the newly added JS policies:

Instead, the new JS policies are present in the "Create policy" -> "Choose a policy type":

When the new policy is chosen in the "Choose a policy type" dialog, initially all the fields are empty, but after filling the Name and click save, the policy code appears:

Could someone please advise if this is expected behavior?
Do I miss something?

bcm0 · 2023-02-03T13:14:10Z

bcm0
Feb 3, 2023

This feature is broken. I think keycloak developers should either fix or remove it.

1 reply

bcm0 Feb 3, 2023

I don't know if keycloak's nashorn engine can make web requests

wojja · 2023-03-29T12:39:48Z

wojja
Mar 29, 2023

Any news on this topic? I am trying to use JS policies in 21.0.1 but somehow I cannot even get them to show up in the list under "Create policy" -> "Choose a policy type".

My JAR javascript-providers.jar is listed as kc.provider.file:

[keycloak@localhost keycloak]$ bin/kc.sh show-config
Current Mode: development
Current Configuration:
	kc.cache =  local (PersistedConfigSource)
	kc.config.built =  true (SysPropConfigSource)
	kc.db =  postgres (PropertiesConfigSource[source=file:/opt/keycloak/keycloak-21.0.1/bin/../conf/keycloak.conf])
	kc.db-password =  ******* (PropertiesConfigSource[source=file:/opt/keycloak/keycloak-21.0.1/bin/../conf/keycloak.conf])
	kc.db-url =  jdbc:postgresql://localhost/keycloak (PropertiesConfigSource[source=file:/opt/keycloak/keycloak-21.0.1/bin/../conf/keycloak.conf])
	kc.db-username =  keycloak (PropertiesConfigSource[source=file:/opt/keycloak/keycloak-21.0.1/bin/../conf/keycloak.conf])
	kc.health-enabled =  false (PersistedConfigSource)
	kc.hostname-strict =  false (PropertiesConfigSource[source=jar:file:///opt/keycloak/keycloak-21.0.1/lib/lib/main/org.keycloak.keycloak-quarkus-server-21.0.1.jar!/META-INF/keycloak.conf])
	kc.hostname-strict-https =  false (PropertiesConfigSource[source=jar:file:///opt/keycloak/keycloak-21.0.1/lib/lib/main/org.keycloak.keycloak-quarkus-server-21.0.1.jar!/META-INF/keycloak.conf])
	kc.http-enabled =  true (PropertiesConfigSource[source=jar:file:///opt/keycloak/keycloak-21.0.1/lib/lib/main/org.keycloak.keycloak-quarkus-server-21.0.1.jar!/META-INF/keycloak.conf])
	kc.http-relative-path =  / (PersistedConfigSource)
	kc.log-console-output =  default (PropertiesConfigSource[source=jar:file:///opt/keycloak/keycloak-21.0.1/lib/lib/main/org.keycloak.keycloak-quarkus-server-21.0.1.jar!/META-INF/keycloak.conf])
	kc.log-file =  ${kc.home.dir:default}${file.separator}data${file.separator}log${file.separator}keycloak.log (PropertiesConfigSource[source=jar:file:///opt/keycloak/keycloak-21.0.1/lib/lib/main/org.keycloak.keycloak-quarkus-server-21.0.1.jar!/META-INF/keycloak.conf])
	kc.metrics-enabled =  true (PropertiesConfigSource[source=file:/opt/keycloak/keycloak-21.0.1/bin/../conf/keycloak.conf])
	kc.provider.file.asm-7.3.1.jar.last-modified =  1680087754206 (PersistedConfigSource)
	kc.provider.file.asm-commons-7.3.1.jar.last-modified =  1680087754216 (PersistedConfigSource)
	kc.provider.file.asm-tree-7.3.1.jar.last-modified =  1680087754236 (PersistedConfigSource)
	kc.provider.file.asm-util-7.3.1.jar.last-modified =  1680087754246 (PersistedConfigSource)
	kc.provider.file.javascript-providers.jar.last-modified =  1680093050365 (PersistedConfigSource)
	kc.provider.file.nashorn-core-15.4.jar.last-modified =  1680087754266 (PersistedConfigSource)
	kc.spi-map-storage-concurrenthashmap-dir =  ${kc.home.dir:default}${file.separator}data${file.separator}chm (PropertiesConfigSource[source=jar:file:///opt/keycloak/keycloak-21.0.1/lib/lib/main/org.keycloak.keycloak-quarkus-server-21.0.1.jar!/META-INF/keycloak.conf])
	kc.spi-map-storage-concurrenthashmap-key-type-authz-resource-servers =  string (PropertiesConfigSource[source=jar:file:///opt/keycloak/keycloak-21.0.1/lib/lib/main/org.keycloak.keycloak-quarkus-server-21.0.1.jar!/META-INF/keycloak.conf])
	kc.spi-map-storage-concurrenthashmap-key-type-realms =  string (PropertiesConfigSource[source=jar:file:///opt/keycloak/keycloak-21.0.1/lib/lib/main/org.keycloak.keycloak-quarkus-server-21.0.1.jar!/META-INF/keycloak.conf])
	kc.spi-map-storage-concurrenthashmap-key-type-single-use-objects =  string (PropertiesConfigSource[source=jar:file:///opt/keycloak/keycloak-21.0.1/lib/lib/main/org.keycloak.keycloak-quarkus-server-21.0.1.jar!/META-INF/keycloak.conf])
	kc.spi-theme-cache-templates =  false (PropertiesConfigSource[source=jar:file:///opt/keycloak/keycloak-21.0.1/lib/lib/main/org.keycloak.keycloak-quarkus-server-21.0.1.jar!/META-INF/keycloak.conf])
	kc.spi-theme-cache-themes =  false (PropertiesConfigSource[source=jar:file:///opt/keycloak/keycloak-21.0.1/lib/lib/main/org.keycloak.keycloak-quarkus-server-21.0.1.jar!/META-INF/keycloak.conf])
	kc.spi-theme-static-max-age =  -1 (PropertiesConfigSource[source=jar:file:///opt/keycloak/keycloak-21.0.1/lib/lib/main/org.keycloak.keycloak-quarkus-server-21.0.1.jar!/META-INF/keycloak.conf])
	kc.spi-theme-welcome-theme =  droniq (PropertiesConfigSource[source=file:/opt/keycloak/keycloak-21.0.1/bin/../conf/keycloak.conf])
	kc.version =  21.0.1 (SysPropConfigSource)

0 replies

Navigation Menu

Repository navigation

Weird behavior after creating a Javascript (JS) policy from a deployed JAR file #15001

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Replies: 2 comments 1 reply

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Weird behavior after creating a Javascript (JS) policy from a deployed JAR file #15001

Uh oh!

Uh oh!

igorya7v Oct 19, 2022

Replies: 2 comments · 1 reply

Uh oh!

bcm0 Feb 3, 2023

Uh oh!

bcm0 Feb 3, 2023

Uh oh!

wojja Mar 29, 2023

igorya7v
Oct 19, 2022

Replies: 2 comments 1 reply

bcm0
Feb 3, 2023

wojja
Mar 29, 2023