Proof of Work
Keycloak PoW Extension — adds computational PoW (proof-of-work) challenges to login, registration, and password-reset flows. Protects against bot spam and brute-force attacks by requiring clients to solve a light cryptographic puzzle before authenticating. Uses Argon2 (memory-hard, GPU-resistant) or SHA-256, with IP-adaptive difficulty that scales challenge hardness based on per-IP request patterns. Rate state is stored in Infinispan, enabling shared difficulty tracking across clustered Keycloak instances. Deploy as a standard Keycloak SPI plugin — works with any Keycloak 26.6 instance. Three-layer defense on every submission: 1. Honeypot — silently rejects bots that auto-fill all form fields 2. Solve-time validation — rejects submissions arriving faster than configured minimum (default 500ms) 3. Hash verification — verifies proof-of-work correctness and prevents nonce replay attacks
No README available.
- keycloak-pow.jar jar · 71 KB
sha256:6b94d5702aa6…
Changelog
### Changes - Upload JAR to Package Registry, version bump v2.0.1 - Release asset now links to Package Registry instead of job artifacts, so no broken download URL. - ARTIFACT_ID resolved dynamically from pom.xml — no hardcoded names.
No pre-built JAR. Build from source.
Changelog
### Breaking Changes
- **Template renames** — all PoW FreeMarker templates have been renamed. Existing custom themes importing the old names must update:
| Old name | New name | Notes |
|----------|----------|-------|
| `pow-fields.ftl` | `pow.ftl` | Core macro — update `<#import>` |
| `pow-challenge.ftl` | `pow-login.ftl` | Login/reset standalone page |
- **Registration integration** — replace the old two-line macro pattern with a single include:
```diff
- <#import "pow-fields.ftl" as pow>
- <@pow.fields formId="kc-register-form"/>
+ <#include "pow-register.ftl">
```
### Added
- `pow-base.ftl` — internal standalone page template shared by `pow-login.ftl` and `pow-reset.ftl`; not intended for theme override
- `pow-login.ftl` — dedicated standalone PoW page for login flow (renamed from `pow-challenge.ftl`); delegates to `pow-base.ftl` by default, override independently for custom styling
- `pow-reset.ftl` — dedicated standalone PoW page for password-reset flow; delegates to `pow-base.ftl` by default, override independently for custom styling
- `pow-register.ftl` — include snippet for embedding PoW in registration forms; override in your theme to customise
- Theme override support — any PoW template can be overridden by placing a file with the same name in your Keycloak theme's `login/` directory; the JAR serves as fallback
- Auto-detection of login vs password-reset flow from HTTP request path — no admin configuration required
- **Headless mode** — `<@pow.fields headless=true/>` skips all built-in UI and fires a `pow:status` CustomEvent on the form element at every state transition (`computing` → `success` / `failure`); theme owns all visual presentation with no dependency on the built-in animations
- Two sample themes under `sample-theme/`:
- `regular-pow-theme` — Keycloak-branded dark page wrapping the built-in animated modal (cube/radar/hash); animation type set via Admin UI
- `custom-pow-theme` — headless mode examples:
- `login/pow-login.ftl` — Brave PoW card-style scanner frame UI with orange progress bar; state-driven corner colors (verifying → orange, success → green, failure → red)
- `login/pow-register.ftl` — inline progress indicator with pulsing dot; registration form integration
- i18n: New keys for headless UI state labels: `pow.title`, `pow.subtitle`, `pow.btn.verifying`, `pow.btn.verified`, `pow.btn.failed` (English, German, Hindi, Japanese)
### Changed
- `pow.ftl` (was `pow-fields.ftl`) — macro gains optional `headless` parameter (default `false`); existing callers unaffected
- `PowAuthenticator` now resolves the challenge template dynamically instead of using a hardcoded name
- `sample-theme/` restructured — previous single theme split into `regular-pow-theme/` and `custom-pow-theme/`
- Dependencies: Bouncycastle bumped to 1.84 (security update)
---
No pre-built JAR. Build from source.
Changelog
Keycloak PoW v1.0.0
FROM quay.io/keycloak/keycloak:26.0
ADD --chown=keycloak:keycloak \
https://gitlab.com/api/v4/projects/81869473/packages/generic/keycloak-pow/v2.0.1/keycloak-pow.jar \
/opt/keycloak/providers/keycloak-pow.jar
RUN /opt/keycloak/bin/kc.sh buildwget -O /opt/keycloak/providers/keycloak-pow.jar \
https://gitlab.com/api/v4/projects/81869473/packages/generic/keycloak-pow/v2.0.1/keycloak-pow.jarVerify checksum (SHA-256)
echo "6b94d5702aa637b06b0c9bb5d41404819d2b5a470ef8b94d71049728828b9fc8 /opt/keycloak/providers/keycloak-pow.jar" | sha256sum -c -A provider JAR needs kc.sh build (Docker) or a rebuild before it loads; a theme
JAR only needs a Keycloak restart. CLI and Kubernetes install methods are planned for a later phase.
Indexed automatically from public sources. Report incorrect data or request removal.