8

we are using a keycloak 1.3.1 authentication library, and I've noticed that once I initialize the keycloak with { onLoad: 'login-required' }, IE (11) gets infinite loop...

Other browsers work fine.

I'm basically doing this:

keycloak.init({ onLoad: 'login-required' }).success(function(authenticated) {
    console.info(authenticated ? 'authenticated' : 'not authenticated');

    some other stuff...

}).error(function() {
    console.warn('failed to initialize');
});

Any idea what's causing it, and to solve this? Trying to install the newest version 1.4.0 now in hopes the weird bug gets solved.

Thanks in advance.

Nemanja Milosavljevic
  • 1,251
  • 18
  • 33
  • You're using with angular? If yes, you can try to create a service. If not, please remove "angularjs" tag from your question. – Joao Polo Aug 20 '15 at 13:54
  • I've updated the Keycloak to 1.4.0 and the problem is still there. Yes I'm using AngularJs, and I've placed the keycloak initialization into the header controller from whom I then get the data about the user, name and similar which I then display where needed. – Nemanja Milosavljevic Aug 20 '15 at 14:12

3 Answers3

15

I had the same problem with keycloak v1.5.0.Final / Internet Explorer 11, and finally figured out what is going on.

1. Behind the scene

When using modes 'login-required' or 'check-sso' in Keycloak's init method, Keycloak Javascript Adapter sets an iframe that checks at timed intervals that user is authenticated.

This iframe is retrieved from keycloak's server (let's say http(s)://yourkeycloakhost:port):

http(s)://yourkeycloakhost:port/auth/realms/yourrealm/protocol/openid-connect/login-status-iframe.html?client_id=yourclientid&origin=http(s)://yourorigin

and its content is a javascript script which should be able to access KEYCLOAK_SESSION cookie previously set by keycloak on authentication (on the same domain ie http(s)://yourkeycloakhost:port).

2. The problem with IE

Yes! Here is the problem with Internet Explorer, which has a strict policy with iframes and cookies. Actually, the keycloak iframe does NOT have access to the yourkeycloakhost domain cookies due to its P3P policy (Microsoft Internet Explorer is the only major browser to support P3P).

This problem is well described on this stackoverflow question

3. Resolution

The solution is to make Internet Explorer trust our keycloak's domain (yourkeycloakhost) for using cookies, so that the iframe is able to read the KEYCLOAK_SESSION cookie value, and register it in its data.

To do that, your keycloak server must append HTTP response header with P3P information. You can do that with an apache or nginx proxy that will always set proper headers. I did that with apache and it's mod_headers module:

Header always set P3P "CP=ALL DSP COR CUR ADM PSA CONi OUR SAM OTR UNR LEG"

You can learn more on P3P with W3C and/or validate your P3P Policy with this P3P validator.

4. Consequence

You can have a look at keycloak's iframe code :

var cookie = getCookie('KEYCLOAK_SESSION');
if (cookie) {
    data.loggedIn = true;
    data.session = cookie;
}

Now the cookie on domain yourkeycloakhost is retrieved correctly by Internet Explorer, and the problem is fixed!

Community
  • 1
  • 1
François Maturel
  • 5,884
  • 6
  • 45
  • 50
  • Eventually we've abandoned the tool, so I can't really test this, also as mentioned above, the Keycloak implementation should be fixed now, but I'll set this as the accepted answer for the effort of writing it. Thanks. – Nemanja Milosavljevic Jun 03 '16 at 08:36
9

A workaround that worked for me, learnt from keycloak documentation, add the parameter checkLoginIframe when executing init method : .init({onLoad: 'login-required', checkLoginIframe: false})

yodamad
  • 1,452
  • 14
  • 24
4

The Keycloak developers fixed this problem, as described by @François Maturel, in version 1.9.3. See for more information issue #2828.

Jacob van Lingen
  • 8,989
  • 7
  • 48
  • 78