One challenge with that is that you would for sure want to change log, background, favicon, and we don't have a decent way of uploading/serving that from the database, that is why the easy theme is at the moment something you need to upload to the server so it has access to images.

The question that always arises to me regarding themes is why do I have to derive an entire new theme if I just want to adjust tiny things? I am missing something like theme attributes that can be managed in each realm. As a workaround we use in our custom theme realm attributes for this that we manage via terraform. So for example having just an option to set login-theme-background-color and hitting an apply button would be great.

This gives me an idea.

It would indeed be great if you could just change a few things and apply those changes to the realm immediately. And at first, this is what we wanted to implement. However, uploading images via the admin console was considered to be a security concern due to a possible steganography attack.

This is why we turned to the idea of letting the tool create a theme jar. This way, only someone with file access on the server can add an image.

However, I'm now thinking that we can deal with that issue separately. We could create a new theme that is only used to house images and font libraries. Someone with file access could copy them there. Then the tool just allows you to select these images and fonts.

At the end of the day, we would end up with better WYSIWYG because changes could be reflected immediately instead of needing to deal with a new theme jar. It would give us what @eicki wants and more.

@edewit is not going to have time to work on this and I don't know how much time I will have in the near future. So if any of you in the community are interested in helping with the Quick Theme feature please let me know.

It would indeed be great if you could just change a few things and apply those changes to the realm immediately. And at first, this is what we wanted to implement. However, uploading images via the admin console was considered to be a security concern due to a possible steganography attack.

Now I understand, why you don't have images, for example avatars and so on. But this is one thing, that users needs and it makes things not only easier, but it makes a good feel … and that is also important.

I would appreciate to enable images … but to find a solution, how it can be safe …

Really, thank you for your work.

Best Regards,
Kal

What is a "possible steganography attack" in this context? Steganography usually refers to embedding data in an image that you later can recover with a program (ex. using the least important bit in each channel to encode data). This isn't really an attack vector? You'll presumably need admin access to be able to upload and change the company logo, are you protecting yourself from your own admin users?

A more realistic "attack vector" is just admin's uploading images with to big resolution or file size, both things you can check for.

This seems like creating a worse solution by "over engineering" for no real reason. I see zero reason to not just stick the Company logo and Favicon in the database.

Preferably Keycloak would move towards sticking less stuff on disk since that makes it harder to scale in cloud environments (Kubernetes, AWS ECS, Docker Swarm, etc).

Custom CSS would be useful, especially if could do it over the API so that you can stick it directly in your Terraform config.

Sorry. I found the problem after reading trough all the templates etc: for the master realm the HTML display name is set to:

Could you clarify whats set in the HTML display name for master realm ? I have the same problem.

i'm running into the same problem. The logo shows only on the master realm.

@pbel78 How did you do that (..=> therefor the logo is appearing => I just copied that to the other realm and magic => it works.)