Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[AI-4595] DDS: Keycloak Integration V1.0.0 #19019

Open
wants to merge 14 commits into
base: master
Choose a base branch
from
Open

[AI-4595] DDS: Keycloak Integration V1.0.0 #19019

wants to merge 14 commits into from

Conversation

manan-crest
Copy link
Contributor

@manan-crest manan-crest commented Nov 8, 2024 •
edited
Loading

What does this PR do?

PR for a new integration Keycloak 1.0.0

Additional Notes

-- OOTB detection rules JSON would be shared separately with the required teams as a part of separate repository .
-- Since during the standard attribute remapping we are not preserving the source attributes as per suggested best practices, it would result in filters using these standard attributes populating the values of other integrations as well as per current datadog behavior.

Review checklist (to be filled by reviewers)

  • Feature or bugfix MUST have appropriate tests (unit, integration, e2e)
  • Changelog entries must be created for modifications to shipped code
  • Add the qa/skip-qa label if the PR doesn't need to be tested during QA.
  • If you need to backport this PR to another branch, you can add the backport/<branch-name> label to the PR and it will automatically open a backport PR once this one is merged

@manan-crest manan-crest marked this pull request as ready for review November 22, 2024 12:22
@manan-crest manan-crest requested review from a team as code owners November 22, 2024 12:22
@drichards-87
Copy link
Contributor

Created Jira card for Docs Team editorial review.

@drichards-87 drichards-87 added the editorial review Waiting on a more in-depth review from a docs team editor label Nov 22, 2024
thibaultkrebs
thibaultkrebs reviewed Nov 26, 2024
View reviewed changes
keycloak/assets/logs/keycloak_tests.yaml Outdated
Comment on lines 1 to 14
id: keycloak
tests:
- sample: "<15>1 2024-10-30T17:27:03.414+05:30 keycloak keycloak 81812 org.keycloak.events - {\"timestamp\":\"2024-10-30T17:27:03.414798073+05:30\",\"sequence\":9510,\"loggerClassName\":\"org.jboss.logging.Logger\",\"loggerName\":\"org.keycloak.events\",\"level\":\"DEBUG\",\"message\":\"type=\\\"CODE_TO_TOKEN\\\", realmId=\\\"f16e7899-3616-4c57-a8db-deab1da434c1\\\", realmName=\\\"master\\\", clientId=\\\"security-admin-console\\\", userId=\\\"15745079-6780-4b93-80d9-c0d3480885d3\\\", sessionId=\\\"25e60089-0911-4332-a7c3-71b17b038be5\\\", ipAddress=\\\"10.10.10.10\\\", token_id=\\\"71eea26a-b9c3-47bf-921b-c90c6cfe1c99\\\", grant_type=\\\"authorization_code\\\", refresh_token_type=\\\"Refresh\\\", scope=\\\"openid email profile\\\", refresh_token_id=\\\"d1159936-cb35-4296-8ac2-524aa9af265b\\\", code_id=\\\"25e60089-0911-4332-a7c3-71b17b038be5\\\", client_auth_method=\\\"client-secret\\\"\",\"threadName\":\"executor-thread-7\",\"threadId\":69,\"mdc\":{},\"ndc\":\"\",\"hostName\":\"keycloak\",\"processName\":\"/opt/jdk-17/bin/java\",\"processId\":81812}"
result: null
- sample: "<15>1 2024-10-30T17:28:13.784+05:30 keycloak keycloak 81812 org.keycloak.events - {\"timestamp\":\"2024-10-30T17:28:13.784703586+05:30\",\"sequence\":9511,\"loggerClassName\":\"org.jboss.logging.Logger\",\"loggerName\":\"org.keycloak.events\",\"level\":\"DEBUG\",\"message\":\"type=\\\"LOGOUT\\\", realmId=\\\"f16e7899-3616-4c57-a8db-deab1da434c1\\\", realmName=\\\"master\\\", clientId=\\\"security-admin-console\\\", userId=\\\"15745079-6780-4b93-80d9-c0d3480885d3\\\", sessionId=\\\"25e60089-0911-4332-a7c3-71b17b038be5\\\", ipAddress=\\\"10.10.10.10\\\", redirect_uri=\\\"https://keycloak/admin/master/console/#/master/realm-settings/login\\\", authSessionParentId=\\\"b048abf0-b0ce-4edd-ad5d-3dac1380b5f2\\\", authSessionTabId=\\\"UsC4tXgBJrc\\\"\",\"threadName\":\"executor-thread-9\",\"threadId\":73,\"mdc\":{},\"ndc\":\"\",\"hostName\":\"keycloak\",\"processName\":\"/opt/jdk-17/bin/java\",\"processId\":81812}"
result: null
- sample: "<15>1 2024-10-30T17:28:28.401+05:30 keycloak keycloak 81812 org.keycloak.events - {\"timestamp\":\"2024-10-30T17:28:28.401619196+05:30\",\"sequence\":9512,\"loggerClassName\":\"org.jboss.logging.Logger\",\"loggerName\":\"org.keycloak.events\",\"level\":\"DEBUG\",\"message\":\"type=\\\"LOGIN\\\", realmId=\\\"f16e7899-3616-4c57-a8db-deab1da434c1\\\", realmName=\\\"master\\\", clientId=\\\"security-admin-console\\\", userId=\\\"15745079-6780-4b93-80d9-c0d3480885d3\\\", sessionId=\\\"56bb687a-5104-4d9b-8786-58dd54b3d297\\\", ipAddress=\\\"10.10.10.10\\\", auth_method=\\\"openid-connect\\\", auth_type=\\\"code\\\", response_type=\\\"code\\\", redirect_uri=\\\"https://keycloak/admin/master/console/#/master/realm-settings/login\\\", consent=\\\"no_consent_required\\\", code_id=\\\"56bb687a-5104-4d9b-8786-58dd54b3d297\\\", username=\\\"admin\\\", response_mode=\\\"query\\\", authSessionParentId=\\\"56bb687a-5104-4d9b-8786-58dd54b3d297\\\", authSessionTabId=\\\"8qA3L4Mn4N0\\\"\",\"threadName\":\"executor-thread-9\",\"threadId\":73,\"mdc\":{},\"ndc\":\"\",\"hostName\":\"keycloak\",\"processName\":\"/opt/jdk-17/bin/java\",\"processId\":81812}"
result: null
- sample: "<15>1 2024-10-30T17:28:29.986+05:30 keycloak keycloak 81812 org.keycloak.events - {\"timestamp\":\"2024-10-30T17:28:29.986177069+05:30\",\"sequence\":9513,\"loggerClassName\":\"org.jboss.logging.Logger\",\"loggerName\":\"org.keycloak.events\",\"level\":\"DEBUG\",\"message\":\"type=\\\"CODE_TO_TOKEN\\\", realmId=\\\"f16e7899-3616-4c57-a8db-deab1da434c1\\\", realmName=\\\"master\\\", clientId=\\\"security-admin-console\\\", userId=\\\"15745079-6780-4b93-80d9-c0d3480885d3\\\", sessionId=\\\"56bb687a-5104-4d9b-8786-58dd54b3d297\\\", ipAddress=\\\"10.10.10.10\\\", token_id=\\\"9cf18c16-dead-44fb-a399-d2683a06eb4e\\\", grant_type=\\\"authorization_code\\\", refresh_token_type=\\\"Refresh\\\", scope=\\\"openid email profile\\\", refresh_token_id=\\\"b7584b74-eb4b-401d-97c4-2fcdd92a4ddc\\\", code_id=\\\"56bb687a-5104-4d9b-8786-58dd54b3d297\\\", client_auth_method=\\\"client-secret\\\"\",\"threadName\":\"executor-thread-9\",\"threadId\":73,\"mdc\":{},\"ndc\":\"\",\"hostName\":\"keycloak\",\"processName\":\"/opt/jdk-17/bin/java\",\"processId\":81812}"
result: null
- sample: "<15>1 2024-10-30T17:28:52.853+05:30 keycloak keycloak 81812 org.keycloak.events - {\"timestamp\":\"2024-10-30T17:28:52.853523237+05:30\",\"sequence\":9515,\"loggerClassName\":\"org.jboss.logging.Logger\",\"loggerName\":\"org.keycloak.events\",\"level\":\"DEBUG\",\"message\":\"operationType=\\\"CREATE\\\", realmId=\\\"f16e7899-3616-4c57-a8db-deab1da434c1\\\", realmName=\\\"master\\\", clientId=\\\"21cba97c-4ce2-4272-8787-2f8016e43971\\\", userId=\\\"15745079-6780-4b93-80d9-c0d3480885d3\\\", ipAddress=\\\"10.10.10.10\\\", resourceType=\\\"USER\\\", resourcePath=\\\"users/036f571f-fc92-4917-9e8a-64c9f37db0b0\\\"\",\"threadName\":\"executor-thread-9\",\"threadId\":73,\"mdc\":{},\"ndc\":\"\",\"hostName\":\"keycloak\",\"processName\":\"/opt/jdk-17/bin/java\",\"processId\":81812}"
result: null
- sample: "<15>1 2024-10-30T17:29:49.118+05:30 keycloak keycloak 81812 org.keycloak.events - {\"timestamp\":\"2024-10-30T17:29:49.118576618+05:30\",\"sequence\":9519,\"loggerClassName\":\"org.jboss.logging.Logger\",\"loggerName\":\"org.keycloak.events\",\"level\":\"DEBUG\",\"message\":\"type=\\\"LOGIN\\\", realmId=\\\"f16e7899-3616-4c57-a8db-deab1da434c1\\\", realmName=\\\"master\\\", clientId=\\\"security-admin-console\\\", userId=\\\"68670103-b2c3-460c-9ed1-9d166c857b47\\\", sessionId=\\\"0c5b4021-4c26-4bc8-b863-ba46a5aa7418\\\", ipAddress=\\\"10.10.10.10\\\", custom_required_action=\\\"webauthn-register-passwordless\\\", public_key_credential_id=\\\"uJ-uEa0FTMp5AdVj0PYtjw\\\", response_type=\\\"code\\\", consent=\\\"no_consent_required\\\", code_id=\\\"0c5b4021-4c26-4bc8-b863-ba46a5aa7418\\\", public_key_credential_label=\\\"Passkey (Default Label)\\\", response_mode=\\\"query\\\", credential_type=\\\"webauthn-passwordless\\\", auth_method=\\\"openid-connect\\\", public_key_credential_aaguid=\\\"ea9b8d66-4d01-1d21-3ce4-b6b48cb575d4\\\", redirect_uri=\\\"https://keycloak/admin/master/console/#/master/users/036f571f-fc92-4917-9e8a-64c9f37db0b0/settings\\\", remember_me=\\\"false\\\", username=\\\"test\\\", authSessionParentId=\\\"0c5b4021-4c26-4bc8-b863-ba46a5aa7418\\\", authSessionTabId=\\\"4djXDUqb2og\\\"\",\"threadName\":\"executor-thread-12\",\"threadId\":110,\"mdc\":{},\"ndc\":\"\",\"hostName\":\"keycloak\",\"processName\":\"/opt/jdk-17/bin/java\",\"processId\":81812}"
result: null
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
id: keycloak
tests:
- sample: "<15>1 2024-10-30T17:27:03.414+05:30 keycloak keycloak 81812 org.keycloak.events - {\"timestamp\":\"2024-10-30T17:27:03.414798073+05:30\",\"sequence\":9510,\"loggerClassName\":\"org.jboss.logging.Logger\",\"loggerName\":\"org.keycloak.events\",\"level\":\"DEBUG\",\"message\":\"type=\\\"CODE_TO_TOKEN\\\", realmId=\\\"f16e7899-3616-4c57-a8db-deab1da434c1\\\", realmName=\\\"master\\\", clientId=\\\"security-admin-console\\\", userId=\\\"15745079-6780-4b93-80d9-c0d3480885d3\\\", sessionId=\\\"25e60089-0911-4332-a7c3-71b17b038be5\\\", ipAddress=\\\"10.10.10.10\\\", token_id=\\\"71eea26a-b9c3-47bf-921b-c90c6cfe1c99\\\", grant_type=\\\"authorization_code\\\", refresh_token_type=\\\"Refresh\\\", scope=\\\"openid email profile\\\", refresh_token_id=\\\"d1159936-cb35-4296-8ac2-524aa9af265b\\\", code_id=\\\"25e60089-0911-4332-a7c3-71b17b038be5\\\", client_auth_method=\\\"client-secret\\\"\",\"threadName\":\"executor-thread-7\",\"threadId\":69,\"mdc\":{},\"ndc\":\"\",\"hostName\":\"keycloak\",\"processName\":\"/opt/jdk-17/bin/java\",\"processId\":81812}"
result: null
- sample: "<15>1 2024-10-30T17:28:13.784+05:30 keycloak keycloak 81812 org.keycloak.events - {\"timestamp\":\"2024-10-30T17:28:13.784703586+05:30\",\"sequence\":9511,\"loggerClassName\":\"org.jboss.logging.Logger\",\"loggerName\":\"org.keycloak.events\",\"level\":\"DEBUG\",\"message\":\"type=\\\"LOGOUT\\\", realmId=\\\"f16e7899-3616-4c57-a8db-deab1da434c1\\\", realmName=\\\"master\\\", clientId=\\\"security-admin-console\\\", userId=\\\"15745079-6780-4b93-80d9-c0d3480885d3\\\", sessionId=\\\"25e60089-0911-4332-a7c3-71b17b038be5\\\", ipAddress=\\\"10.10.10.10\\\", redirect_uri=\\\"https://keycloak/admin/master/console/#/master/realm-settings/login\\\", authSessionParentId=\\\"b048abf0-b0ce-4edd-ad5d-3dac1380b5f2\\\", authSessionTabId=\\\"UsC4tXgBJrc\\\"\",\"threadName\":\"executor-thread-9\",\"threadId\":73,\"mdc\":{},\"ndc\":\"\",\"hostName\":\"keycloak\",\"processName\":\"/opt/jdk-17/bin/java\",\"processId\":81812}"
result: null
- sample: "<15>1 2024-10-30T17:28:28.401+05:30 keycloak keycloak 81812 org.keycloak.events - {\"timestamp\":\"2024-10-30T17:28:28.401619196+05:30\",\"sequence\":9512,\"loggerClassName\":\"org.jboss.logging.Logger\",\"loggerName\":\"org.keycloak.events\",\"level\":\"DEBUG\",\"message\":\"type=\\\"LOGIN\\\", realmId=\\\"f16e7899-3616-4c57-a8db-deab1da434c1\\\", realmName=\\\"master\\\", clientId=\\\"security-admin-console\\\", userId=\\\"15745079-6780-4b93-80d9-c0d3480885d3\\\", sessionId=\\\"56bb687a-5104-4d9b-8786-58dd54b3d297\\\", ipAddress=\\\"10.10.10.10\\\", auth_method=\\\"openid-connect\\\", auth_type=\\\"code\\\", response_type=\\\"code\\\", redirect_uri=\\\"https://keycloak/admin/master/console/#/master/realm-settings/login\\\", consent=\\\"no_consent_required\\\", code_id=\\\"56bb687a-5104-4d9b-8786-58dd54b3d297\\\", username=\\\"admin\\\", response_mode=\\\"query\\\", authSessionParentId=\\\"56bb687a-5104-4d9b-8786-58dd54b3d297\\\", authSessionTabId=\\\"8qA3L4Mn4N0\\\"\",\"threadName\":\"executor-thread-9\",\"threadId\":73,\"mdc\":{},\"ndc\":\"\",\"hostName\":\"keycloak\",\"processName\":\"/opt/jdk-17/bin/java\",\"processId\":81812}"
result: null
- sample: "<15>1 2024-10-30T17:28:29.986+05:30 keycloak keycloak 81812 org.keycloak.events - {\"timestamp\":\"2024-10-30T17:28:29.986177069+05:30\",\"sequence\":9513,\"loggerClassName\":\"org.jboss.logging.Logger\",\"loggerName\":\"org.keycloak.events\",\"level\":\"DEBUG\",\"message\":\"type=\\\"CODE_TO_TOKEN\\\", realmId=\\\"f16e7899-3616-4c57-a8db-deab1da434c1\\\", realmName=\\\"master\\\", clientId=\\\"security-admin-console\\\", userId=\\\"15745079-6780-4b93-80d9-c0d3480885d3\\\", sessionId=\\\"56bb687a-5104-4d9b-8786-58dd54b3d297\\\", ipAddress=\\\"10.10.10.10\\\", token_id=\\\"9cf18c16-dead-44fb-a399-d2683a06eb4e\\\", grant_type=\\\"authorization_code\\\", refresh_token_type=\\\"Refresh\\\", scope=\\\"openid email profile\\\", refresh_token_id=\\\"b7584b74-eb4b-401d-97c4-2fcdd92a4ddc\\\", code_id=\\\"56bb687a-5104-4d9b-8786-58dd54b3d297\\\", client_auth_method=\\\"client-secret\\\"\",\"threadName\":\"executor-thread-9\",\"threadId\":73,\"mdc\":{},\"ndc\":\"\",\"hostName\":\"keycloak\",\"processName\":\"/opt/jdk-17/bin/java\",\"processId\":81812}"
result: null
- sample: "<15>1 2024-10-30T17:28:52.853+05:30 keycloak keycloak 81812 org.keycloak.events - {\"timestamp\":\"2024-10-30T17:28:52.853523237+05:30\",\"sequence\":9515,\"loggerClassName\":\"org.jboss.logging.Logger\",\"loggerName\":\"org.keycloak.events\",\"level\":\"DEBUG\",\"message\":\"operationType=\\\"CREATE\\\", realmId=\\\"f16e7899-3616-4c57-a8db-deab1da434c1\\\", realmName=\\\"master\\\", clientId=\\\"21cba97c-4ce2-4272-8787-2f8016e43971\\\", userId=\\\"15745079-6780-4b93-80d9-c0d3480885d3\\\", ipAddress=\\\"10.10.10.10\\\", resourceType=\\\"USER\\\", resourcePath=\\\"users/036f571f-fc92-4917-9e8a-64c9f37db0b0\\\"\",\"threadName\":\"executor-thread-9\",\"threadId\":73,\"mdc\":{},\"ndc\":\"\",\"hostName\":\"keycloak\",\"processName\":\"/opt/jdk-17/bin/java\",\"processId\":81812}"
result: null
- sample: "<15>1 2024-10-30T17:29:49.118+05:30 keycloak keycloak 81812 org.keycloak.events - {\"timestamp\":\"2024-10-30T17:29:49.118576618+05:30\",\"sequence\":9519,\"loggerClassName\":\"org.jboss.logging.Logger\",\"loggerName\":\"org.keycloak.events\",\"level\":\"DEBUG\",\"message\":\"type=\\\"LOGIN\\\", realmId=\\\"f16e7899-3616-4c57-a8db-deab1da434c1\\\", realmName=\\\"master\\\", clientId=\\\"security-admin-console\\\", userId=\\\"68670103-b2c3-460c-9ed1-9d166c857b47\\\", sessionId=\\\"0c5b4021-4c26-4bc8-b863-ba46a5aa7418\\\", ipAddress=\\\"10.10.10.10\\\", custom_required_action=\\\"webauthn-register-passwordless\\\", public_key_credential_id=\\\"uJ-uEa0FTMp5AdVj0PYtjw\\\", response_type=\\\"code\\\", consent=\\\"no_consent_required\\\", code_id=\\\"0c5b4021-4c26-4bc8-b863-ba46a5aa7418\\\", public_key_credential_label=\\\"Passkey (Default Label)\\\", response_mode=\\\"query\\\", credential_type=\\\"webauthn-passwordless\\\", auth_method=\\\"openid-connect\\\", public_key_credential_aaguid=\\\"ea9b8d66-4d01-1d21-3ce4-b6b48cb575d4\\\", redirect_uri=\\\"https://keycloak/admin/master/console/#/master/users/036f571f-fc92-4917-9e8a-64c9f37db0b0/settings\\\", remember_me=\\\"false\\\", username=\\\"test\\\", authSessionParentId=\\\"0c5b4021-4c26-4bc8-b863-ba46a5aa7418\\\", authSessionTabId=\\\"4djXDUqb2og\\\"\",\"threadName\":\"executor-thread-12\",\"threadId\":110,\"mdc\":{},\"ndc\":\"\",\"hostName\":\"keycloak\",\"processName\":\"/opt/jdk-17/bin/java\",\"processId\":81812}"
result: null
id: keycloak
tests:
-
sample: "<15>1 2024-10-30T17:27:03.414+05:30 keycloak keycloak 81812 org.keycloak.events - {\"timestamp\":\"2024-10-30T17:27:03.414798073+05:30\",\"sequence\":9510,\"loggerClassName\":\"org.jboss.logging.Logger\",\"loggerName\":\"org.keycloak.events\",\"level\":\"DEBUG\",\"message\":\"type=\\\"CODE_TO_TOKEN\\\", realmId=\\\"f16e7899-3616-4c57-a8db-deab1da434c1\\\", realmName=\\\"master\\\", clientId=\\\"security-admin-console\\\", userId=\\\"15745079-6780-4b93-80d9-c0d3480885d3\\\", sessionId=\\\"25e60089-0911-4332-a7c3-71b17b038be5\\\", ipAddress=\\\"10.10.10.10\\\", token_id=\\\"71eea26a-b9c3-47bf-921b-c90c6cfe1c99\\\", grant_type=\\\"authorization_code\\\", refresh_token_type=\\\"Refresh\\\", scope=\\\"openid email profile\\\", refresh_token_id=\\\"d1159936-cb35-4296-8ac2-524aa9af265b\\\", code_id=\\\"25e60089-0911-4332-a7c3-71b17b038be5\\\", client_auth_method=\\\"client-secret\\\"\",\"threadName\":\"executor-thread-7\",\"threadId\":69,\"mdc\":{},\"ndc\":\"\",\"hostName\":\"keycloak\",\"processName\":\"/opt/jdk-17/bin/java\",\"processId\":81812}"
result: null
-
sample: "<15>1 2024-10-30T17:28:13.784+05:30 keycloak keycloak 81812 org.keycloak.events - {\"timestamp\":\"2024-10-30T17:28:13.784703586+05:30\",\"sequence\":9511,\"loggerClassName\":\"org.jboss.logging.Logger\",\"loggerName\":\"org.keycloak.events\",\"level\":\"DEBUG\",\"message\":\"type=\\\"LOGOUT\\\", realmId=\\\"f16e7899-3616-4c57-a8db-deab1da434c1\\\", realmName=\\\"master\\\", clientId=\\\"security-admin-console\\\", userId=\\\"15745079-6780-4b93-80d9-c0d3480885d3\\\", sessionId=\\\"25e60089-0911-4332-a7c3-71b17b038be5\\\", ipAddress=\\\"10.10.10.10\\\", redirect_uri=\\\"https://keycloak/admin/master/console/#/master/realm-settings/login\\\", authSessionParentId=\\\"b048abf0-b0ce-4edd-ad5d-3dac1380b5f2\\\", authSessionTabId=\\\"UsC4tXgBJrc\\\"\",\"threadName\":\"executor-thread-9\",\"threadId\":73,\"mdc\":{},\"ndc\":\"\",\"hostName\":\"keycloak\",\"processName\":\"/opt/jdk-17/bin/java\",\"processId\":81812}"
result: null
-
sample: "<15>1 2024-10-30T17:28:28.401+05:30 keycloak keycloak 81812 org.keycloak.events - {\"timestamp\":\"2024-10-30T17:28:28.401619196+05:30\",\"sequence\":9512,\"loggerClassName\":\"org.jboss.logging.Logger\",\"loggerName\":\"org.keycloak.events\",\"level\":\"DEBUG\",\"message\":\"type=\\\"LOGIN\\\", realmId=\\\"f16e7899-3616-4c57-a8db-deab1da434c1\\\", realmName=\\\"master\\\", clientId=\\\"security-admin-console\\\", userId=\\\"15745079-6780-4b93-80d9-c0d3480885d3\\\", sessionId=\\\"56bb687a-5104-4d9b-8786-58dd54b3d297\\\", ipAddress=\\\"10.10.10.10\\\", auth_method=\\\"openid-connect\\\", auth_type=\\\"code\\\", response_type=\\\"code\\\", redirect_uri=\\\"https://keycloak/admin/master/console/#/master/realm-settings/login\\\", consent=\\\"no_consent_required\\\", code_id=\\\"56bb687a-5104-4d9b-8786-58dd54b3d297\\\", username=\\\"admin\\\", response_mode=\\\"query\\\", authSessionParentId=\\\"56bb687a-5104-4d9b-8786-58dd54b3d297\\\", authSessionTabId=\\\"8qA3L4Mn4N0\\\"\",\"threadName\":\"executor-thread-9\",\"threadId\":73,\"mdc\":{},\"ndc\":\"\",\"hostName\":\"keycloak\",\"processName\":\"/opt/jdk-17/bin/java\",\"processId\":81812}"
result: null
-
sample: "<15>1 2024-10-30T17:28:29.986+05:30 keycloak keycloak 81812 org.keycloak.events - {\"timestamp\":\"2024-10-30T17:28:29.986177069+05:30\",\"sequence\":9513,\"loggerClassName\":\"org.jboss.logging.Logger\",\"loggerName\":\"org.keycloak.events\",\"level\":\"DEBUG\",\"message\":\"type=\\\"CODE_TO_TOKEN\\\", realmId=\\\"f16e7899-3616-4c57-a8db-deab1da434c1\\\", realmName=\\\"master\\\", clientId=\\\"security-admin-console\\\", userId=\\\"15745079-6780-4b93-80d9-c0d3480885d3\\\", sessionId=\\\"56bb687a-5104-4d9b-8786-58dd54b3d297\\\", ipAddress=\\\"10.10.10.10\\\", token_id=\\\"9cf18c16-dead-44fb-a399-d2683a06eb4e\\\", grant_type=\\\"authorization_code\\\", refresh_token_type=\\\"Refresh\\\", scope=\\\"openid email profile\\\", refresh_token_id=\\\"b7584b74-eb4b-401d-97c4-2fcdd92a4ddc\\\", code_id=\\\"56bb687a-5104-4d9b-8786-58dd54b3d297\\\", client_auth_method=\\\"client-secret\\\"\",\"threadName\":\"executor-thread-9\",\"threadId\":73,\"mdc\":{},\"ndc\":\"\",\"hostName\":\"keycloak\",\"processName\":\"/opt/jdk-17/bin/java\",\"processId\":81812}"
result: null
-
sample: "<15>1 2024-10-30T17:28:52.853+05:30 keycloak keycloak 81812 org.keycloak.events - {\"timestamp\":\"2024-10-30T17:28:52.853523237+05:30\",\"sequence\":9515,\"loggerClassName\":\"org.jboss.logging.Logger\",\"loggerName\":\"org.keycloak.events\",\"level\":\"DEBUG\",\"message\":\"operationType=\\\"CREATE\\\", realmId=\\\"f16e7899-3616-4c57-a8db-deab1da434c1\\\", realmName=\\\"master\\\", clientId=\\\"21cba97c-4ce2-4272-8787-2f8016e43971\\\", userId=\\\"15745079-6780-4b93-80d9-c0d3480885d3\\\", ipAddress=\\\"10.10.10.10\\\", resourceType=\\\"USER\\\", resourcePath=\\\"users/036f571f-fc92-4917-9e8a-64c9f37db0b0\\\"\",\"threadName\":\"executor-thread-9\",\"threadId\":73,\"mdc\":{},\"ndc\":\"\",\"hostName\":\"keycloak\",\"processName\":\"/opt/jdk-17/bin/java\",\"processId\":81812}"
result: null
-
sample: "<15>1 2024-10-30T17:29:49.118+05:30 keycloak keycloak 81812 org.keycloak.events - {\"timestamp\":\"2024-10-30T17:29:49.118576618+05:30\",\"sequence\":9519,\"loggerClassName\":\"org.jboss.logging.Logger\",\"loggerName\":\"org.keycloak.events\",\"level\":\"DEBUG\",\"message\":\"type=\\\"LOGIN\\\", realmId=\\\"f16e7899-3616-4c57-a8db-deab1da434c1\\\", realmName=\\\"master\\\", clientId=\\\"security-admin-console\\\", userId=\\\"68670103-b2c3-460c-9ed1-9d166c857b47\\\", sessionId=\\\"0c5b4021-4c26-4bc8-b863-ba46a5aa7418\\\", ipAddress=\\\"10.10.10.10\\\", custom_required_action=\\\"webauthn-register-passwordless\\\", public_key_credential_id=\\\"uJ-uEa0FTMp5AdVj0PYtjw\\\", response_type=\\\"code\\\", consent=\\\"no_consent_required\\\", code_id=\\\"0c5b4021-4c26-4bc8-b863-ba46a5aa7418\\\", public_key_credential_label=\\\"Passkey (Default Label)\\\", response_mode=\\\"query\\\", credential_type=\\\"webauthn-passwordless\\\", auth_method=\\\"openid-connect\\\", public_key_credential_aaguid=\\\"ea9b8d66-4d01-1d21-3ce4-b6b48cb575d4\\\", redirect_uri=\\\"https://keycloak/admin/master/console/#/master/users/036f571f-fc92-4917-9e8a-64c9f37db0b0/settings\\\", remember_me=\\\"false\\\", username=\\\"test\\\", authSessionParentId=\\\"0c5b4021-4c26-4bc8-b863-ba46a5aa7418\\\", authSessionTabId=\\\"4djXDUqb2og\\\"\",\"threadName\":\"executor-thread-12\",\"threadId\":110,\"mdc\":{},\"ndc\":\"\",\"hostName\":\"keycloak\",\"processName\":\"/opt/jdk-17/bin/java\",\"processId\":81812}"
result: null

aliciascott
aliciascott requested changes Nov 27, 2024
View reviewed changes
Copy link
Contributor

@aliciascott aliciascott left a comment •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi @manan-crest looks good just a few suggestions for wording and consistency.

keycloak/README.md Outdated
[Keycloak][3] is an open-source identity and access management tool. It helps add authentication to applications and secure services with minimum effort. Keycloak provides user federation, strong authentication, user management, fine-grained authorization, and more.

This integration parses the following types of logs:
- **user-event** : Events generated from activity of users like authentication, profile update, etc.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
- **user-event** : Events generated from activity of users like authentication, profile update, etc.
- **user-event** : Events generated from activity of users like authentication, and profile updates.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Have updated as per suggestion.

keycloak/README.md Outdated
@@ -0,0 +1,158 @@
# Agent Integration: keycloak
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
# Agent Integration: keycloak
# Agent Integration: Keycloak

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Have updated as per suggestion.

keycloak/README.md Outdated

#### Log collection

1. Collecting logs is disabled by default in the Datadog Agent. Enable it in `datadog.yaml`:
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
1. Collecting logs is disabled by default in the Datadog Agent. Enable it in `datadog.yaml`:
1. Collecting logs is disabled by default in the Datadog Agent. Enable it in the`datadog.yaml`:

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Have updated as per suggestion.

keycloak/README.md Outdated
```
2. Add this configuration block to your `keycloak.d/conf.yaml` file to start collecting your logs.

See the sample [keycloak.d/conf.yaml][6] for available configuration options. Here the appropriate protocol (either TCP or UDP) should be chosen based on the Keycloak syslog forwarding configuration. By default, Keycloak uses TCP.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
See the sample [keycloak.d/conf.yaml][6] for available configuration options. Here the appropriate protocol (either TCP or UDP) should be chosen based on the Keycloak syslog forwarding configuration. By default, Keycloak uses TCP.
See the sample [keycloak.d/conf.yaml][6] for available configuration options. The appropriate protocol (either TCP or UDP) should be chosen based on the Keycloak syslog forwarding configuration. By default, Keycloak uses TCP.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Have updated as per suggestion.

keycloak/README.md Outdated
service: keycloak
```
**Note**:
- `PORT`: port should be similar to port provided in **Configure syslog message forwarding from keycloak** section.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
- `PORT`: port should be similar to port provided in **Configure syslog message forwarding from keycloak** section.
- `PORT`: Port should be similar to the port provided in **Configure syslog message forwarding from keycloak** section.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Have updated as per suggestion.

keycloak/README.md Outdated
--log-syslog-protocol=udp
```

4. After adding the above configuration option, start command would look like below:
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
4. After adding the above configuration option, start command would look like below:
4. After adding the above configuration option, the start command would look like the following:

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Have updated as per suggestion.

keycloak/README.md Outdated
```shell
bin/kc.[sh|bat] start --log="syslog" --log-syslog-endpoint=<IP Address>:<Port> --log-level=org.keycloak.events:debug --log-syslog-output=json
```
`IP ADDRESS`: ip address where your datadog-agent is running.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
`IP ADDRESS`: ip address where your datadog-agent is running.
`IP ADDRESS`: IP address where your Datadog Agent is running.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Have updated as per suggestion.

keycloak/README.md Outdated
```
`IP ADDRESS`: ip address where your datadog-agent is running.

`PORT`: port number to send syslog messages.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
`PORT`: port number to send syslog messages.
`PORT`: Port number to send syslog messages.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Have updated as per suggestion.

keycloak/README.md Outdated

3. [Restart the Agent][2].

Here is how to troubleshoot some possible issues.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
Here is how to troubleshoot some possible issues.

I think we can leave this sentence out since the above heading is called Troubleshooting

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Have updated as per suggestion.

keycloak/README.md Outdated

**Port already in use:**

If you see the **Port <PORT_NUMBER> Already in Use** error, see the following instructions. The example below is for port 514:
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
If you see the **Port <PORT_NUMBER> Already in Use** error, see the following instructions. The example below is for port 514:
If you see the **Port <PORT_NUMBER> Already in Use** error, see the following instructions. The following example is for port 514:

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Have updated as per suggestion.

@manan-crest manan-crest requested a review from a team as a code owner November 29, 2024 10:24
@torosmassa torosmassa changed the title DDS: Keycloak Integration V1.0.0 [AI-4595] DDS: Keycloak Integration V1.0.0 Dec 2, 2024
aliciascott
aliciascott approved these changes Dec 2, 2024
View reviewed changes
Copy link
Contributor

@aliciascott aliciascott left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you for the changes

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@thibaultkrebs thibaultkrebs thibaultkrebs left review comments

@aliciascott aliciascott aliciascott approved these changes

At least 1 approving review is required to merge this pull request.

Assignees
No one assigned
Labels
agent/review-requested dev/testing dev/tooling docs/approved documentation ecosystems/review-requested editorial review Waiting on a more in-depth review from a docs team editor product/review-requested qa/skip-qa Automatically skip this PR for the next QA release team/agent-integrations team/documentation team/logs-backend team/siem-logs-reviewers
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@manan-crest @drichards-87 @aliciascott @thibaultkrebs