keycloak linux authentication

endpoint clients can send authorization requests and obtain an RPT with all permissions granted by Keycloak. Subsequent requests should include the RPT as a bearer token for retries. Keycloak can authenticate user with existing openID connect or SAML2.0 identity provider. However, you can specify a specific client scope as required if you want to enforce a specific client scope. Keycloak leverages the UMA Protection API to allow resource servers to manage permissions for their users. For example, you can change the default policy by clicking In RBAC, roles only implicitly define access for their resources. These quickstarts run on WildFly 10. For now, there only a few built-in attributes. to build a dynamic menu where items are hidden or shown depending on the permissions associated with a resource or scope. Collect logs from Keycloak with Elastic Agent. and to determine any other information associated with the token, such as the permissions granted by Keycloak. sure the default configuration doesnt conflict with your own settings. Clients are allowed to send authorization requests to the token endpoint using the following parameters: This parameter is required. The following page is displayed: The default settings defined by Keycloak when you enable authorization services for a client application provide a simple However, Internet Banking Service in respect to Alices privacy also allows her to change specific policies for the banking account. From this interface, policies can obtain: Information about the execution context and runtime environment. Next, go to the Client Scopes tab and in the Default Client Scopes section, add "roles" and "profile" to the Assigned Default Client Scopes, as shown in Figure 10. From the Action list, select Download adapter config. To obtain permissions from Keycloak you send an authorization request to the token endpoint. Defines a URL where a client request is redirected when an "access denied" message is obtained from the server. This class provides several methods you can use to obtain permissions and ascertain whether a permission was granted for a particular resource or scope. This clients resources and their respective scopes are protected and governed by a set of authorization policies. The entitlement function is completely asynchronous and supports a few callback functions to receive notifications from the server: Both authorize and entitlement functions accept an authorization request object. to provide to Alice a space where she can select individuals and the operations (or data) they are allowed to access. Figure 2: Create a Keycloak realm for the Ministry of Education named "education."">. You can also create a client using the following procedure. If defined, the token must include a claim from where this policy is going to obtain the groups wildcard pattern that indicates to Keycloak that this resource represents all the paths in your application. A value equal to -1 can be set to disable the expiry of the cache. That's why Keycloak provides a JWKS endpoint. A protection API token (PAT) is a special OAuth2 access token with a scope defined as uma_protection. A boolean value indicating whether the server should create permission requests to the resources and scopes referenced by a permission ticket. The following You should prefer deploying your JS Policies directly to This application connects to your Keycloak instances and uses Keycloak's authentication and authorization capability through its REST API. That is, you can create individual policies, then reuse them with different permissions and build more complex policies by combining individual policies. For an easy setup, we need to use the following stater library in our spring boot application - keycloak-spring-boot-starter. Going forward to the .NET Core part: my app is 2.1, and my setup looks like that: and ClaimInformationPointProvider and also provide the file META-INF/services/org.keycloak.adapters.authorization.ClaimInformationPointProviderFactory They can create and manage applications and services, and define fine-grained authorization Procedure Go to http://localhost:8080/auth/admin/ and log in to the Keycloak admin console using the admin account. In the navigation pane on the left, choose Clients and click Create. The value of this property is a number that will be added to the base value of every port opened by Keycloak Server. Defines the time in milliseconds when the entry should be expired. At any time, Alice Enable [custom authenticators using JavaScript in your server [ (https://www.keycloak.org/docs/latest/server_installation/#profiles) by https://stackoverflow.com/a/63274532/550222creating a file profile.properties in your configuration directory that contains the following: feature.scripts=enabled Create the custom authenticator. Completely disables the evaluation of policies and allows access to any resource. providers to allow them to authenticate to the same account with different identity providers. You can no longer access the application. Resources also have an owner. Briefly, you can use this option to define whether the policy result should be kept as it is or be negated. By default, client scopes added to this policy are not specified as required and the policy will grant access if the client requesting access has been granted any of these client scopes. In this case, you need to ensure the resources are properly configured with a URIS property that matches the paths you want to protect. Make changes at runtime; applications are only concerned about the resources and scopes being protected and not how they are protected. A previously issued RPT which permissions should also be evaluated and added in a new one. In this case, permission is granted only if the current day of the month is between or equal to the two values specified. The Identity Information filters can be used to specify the user requesting permissions. However, Bob should only have access to view (scope) Alices account. Step 2 Log in to the Keycloak. With Keycloak you gain the capability to create more manageable code that focuses directly on your resources whether you are using RBAC, attribute-based access control (ABAC), or any other BAC variant. Enabling authentication and authorization involves complex functionality beyond a simple login API. Let's start the demo by creating a Keycloak realm. By default, enforcement mode is set to ALL. When processing requests, the policy enforcer will call the MyClaimInformationPointProviderFactory.create method in order to obtain an Affirmative means that at least one permission must evaluate to a positive decision in order grant access to a resource and its scopes. to obtain the location of the token endpoint and send an authorization request. In Keycloak, resource servers are provided with a rich platform for enabling fine-grained authorization for their protected resources, where authorization decisions can be made based on different access control mechanisms. Figure 1: Each user can use the same role, but with different access and privileges at each school.">. Possible values are: Indicates that responses from the server should only represent the overall decision by returning a JSON with the following format: If the authorization request does not map to any permission, a 403 HTTP status code is returned instead. With an aggregated policy, you can freely combine other policies and then apply the new aggregated policy to any permission you want. For more information on permission tickets, see User-Managed Access and the UMA specification. Access is only granted if all conditions are satisfied. Before you can use this tutorial, you need to complete the installation of Keycloak and create the initial admin user as shown in the Getting Started Guide tutorial. Defines a set of one or more scopes to protect. Visit Docker Hub to find and download docker images including a countless list of software packages. According to the OAuth2 specification, a resource server is a server hosting the protected resources and capable of accepting and responding to protected resource requests. Keycloak Quickstarts Repository contains other applications that make use of the authorization services Keycloak supports Single-Sign On, which enables services to interface with Keycloak through protocols such as OpenID Connect, OAuth 2.0, etc. First, develop the Java application starting with a pom.xml file, as shown in the following sample: The Java application also requires you to develop a simple properties file: Next, get the Keycloak certificate ID from the form shown in Figure 14. * Returns a {@link Realm} that can be used by policies to query information. In order to successfully decode your JWT token, you must know what public key is used for signing it. The Client Settings page opens. Keycloak responds to the client with the RPT, Keycloak denies the authorization request, Example: an authorization request using an access token to authenticate to the token endpoint, Example: an authorization request using client id and client secret to authenticate to the token endpoint, Client requests a protected resource without sending an RPT, Resource server responds with a permission ticket, Client sends an authorization request to the token endpoint to obtain an RPT, Example about how to obtain an RPT with permissions for all resources and scopes the user can access, Example about how to obtain an RPT with permissions for specific resources and scopes, // by default, grants any permission associated with this policy, // decide if permission should be granted, /** In most cases, you wont need to deal with this endpoint directly. We can enable login to various social-networking site such as Google, Facebook, Github through the admin . The application we are about to build and deploy is located at. For more details see the Enabling and disabling features guide. He has worked at an ISP and as a Java software engineer, system engineer, system architect and consultant. You must first obtain the adapter configuration before building and deploying the application. You can use this type of policy to define regex conditions for your permissions. On this tab, you can view the list of previously created policies as well as create and edit a policy. Now, use the API to check for whether a bearer token is valid and active or not, in order to validate whether a request is bringing a valid credential. can be used in their own applications. Try Red Hat's products and technologies without setup or configuration free for 30 days with this shared OpenShift and Kubernetes cluster. Click the user name at the top right of the Admin Console and select Manage Account. . In this tutorial we're going to. Each attribute is a key and value pair where the value can be a set of one or many strings. A permission ticket is completely opaque to clients. In this case we check if user is granted with admin role If you are about to write permissions to your own resources, be sure to remove the. * Returns the {@link EvaluationContext}. Values can be ALL or ANY. Automate your cloud provisioning, application deployment, configuration management, and more with this simple yet powerful automation engine. With Apply to Resource Type set to On, Afterwards you should read the README file for the quickstart you would like to deploy. Example of org.keycloak.adapters.authorization.ClaimInformationPointProviderFactory: Every CIP provider must be associated with a name, as defined above in the MyClaimInformationPointProviderFactory.getName method. can identify them more easily. obtained associated with the current identity: Where these attributes are mapped from whatever claim is defined in the token that was used in the authorization request. Figure 4: Add the teacher and student roles.">. specify the user identifier to configure a resource as belonging to a specific user. Simply stated, authentication means who you are, while authorization means what can you do, with each approach using separate methods for validation. Required client scopes can be useful when your policy defines multiple client scopes but only a subset of them are mandatory. The. The RPT can be obtained from You can also specify a range of hours. For instance, to allow access to a group of resources only for users granted with a role "User Premium", you can use RBAC (Role-based Access Control). and use the library to send an authorization request as follows: The authorize function is completely asynchronous and supports a few callback functions to receive notifications from the server: onGrant: The first argument of the function. Server Developer. . Click the Authorization tab and a page similar to the following is displayed: The Authorization tab contains additional sub-tabs covering the different steps that you must follow to actually protect your applications resources. The Decision Strategy for this permission. You can also specify a range of dates. Most applications should use the onGrant callback to retry a request after a 401 response. Log out of the demo application and log in again. This endpoint provides operations outlined as follows (entire path omitted for clarity): Create resource set description: POST /resource_set, Read resource set description: GET /resource_set/{_id}, Update resource set description: PUT /resource_set/{_id}, Delete resource set description: DELETE /resource_set/{_id}, List resource set descriptions: GET /resource_set. Select Repeat to repeat access being granted on a specific Day of Month, Month, Year, Hour or Minute. Open, hybrid-cloud Kubernetes platform to build, run, and scale container-based applications -- now with developer tools, CI/CD, and release management. You are here Read developer tutorials and download Red Hat software for cloud application development. They can represent a group of resources (just like a Class in Java) or they can represent a single and specific resource. Getting started. Step 5 Click Save to save the settings. Keycloak is a UMA 2.0 compliant authorization server that provides most UMA capabilities. you can start managing permissions. By default, when you add a group to this policy, access restrictions will only apply to members of the selected group. Creating a resource using the protection API, Obtaining information from the HTTP request, Obtaining information from an external HTTP service, Using the AuthorizationContext to obtain an Authorization Client Instance, Handling authorization responses from a UMA-Protected resource server, https://github.com/keycloak/keycloak-quickstarts, https://openid.net/specs/openid-connect-core-1_0.html#IDToken. If not provided, default value is 30000. Management and runtime configuration of the Keycloak server. Products Ansible.com Learn about and try our IT automation product. We can't apply and use password-less authentication options. 1.2 Keycloak. It provides flexibility and helps to: Reduce code refactoring and permission management costs, Support a more flexible security model, helping you to easily adapt to changes in your security requirements. For example, to implement a new CIP provider you need to implement org.keycloak.adapters.authorization.ClaimInformationPointProviderFactory These should be create-student-grade, view-student-grade, and view-student-profile. Do I need to invoke the server every time I want to introspect an RPT? The full code for this article can be found in my GitHub repository. For more details about how to push claims when using UMA and permission tickets, please take a look at Permission API. You can access the Policy Evaluation Tool by clicking the Evaluate tab when editing a resource server. If specified, the adapter queries the server for permission tickets and returns them to clients according to the UMA specification. Once your application is based on the resource and scope identifier, you need only change the configuration of the permissions or policies associated with a particular resource in the authorization server. Authorization services consist of the following RESTFul endpoints: Each of these services provides a specific API covering the different steps involved in the authorization process. Name the realm education, set Enabled to ON, and click Create. The EvaluationContext also gives you access to attributes related to both the execution and runtime environments. To create a new group-based policy, select Group from the policy type list. These new roles will then appear in the Realm Roles tab as shownin Figure 4. When there is a permission requests awaiting approval an icon is put next to the name of the resource. Multiple values can be defined for an attribute by separating each value with a comma. Sorry, you need to enable JavaScript to visit this website. Sometimes you might want to introspect a requesting party token (RPT) to check its validity or obtain the permissions within the token to enforce authorization decisions on the resource server side. Join us for online events, or attend regional events held around the worldyou'll meet peers, industry leaders, and Red Hat's Developer Evangelists and OpenShift Developer Advocates. The client-id of the application. a resource at the resource server without an RPT: The resource server sends a response back to the client with a permission ticket and a as_uri parameter with the location This concludes my demo of the Keycloak configuration. That means clients should first obtain an RPT from Keycloak before sending requests to the resource server. Join developers across the globe for live and virtual events led by Red Hat technology experts. This parameter allows clients to push claims to Keycloak. A resource-based permission defines a set of one or more resources to protect using a set of one or more authorization policies. For more details about how you can obtain a. Access Red Hats products and technologies without setup or configuration, and start developing quicker than ever before with our new, no-cost sandbox environments. A UMA-compliant Permission Endpoint which resource servers can use to manage permission tickets. described in this documentation. Although they are different banking accounts, they share common security requirements and constraints that are globally defined by the banking organization. that information is usually carried in a security token, typically sent as a bearer token along with every request to the server. To specify a redirection URL, edit the keycloak.json file that you updated and replace the policy-enforcer configuration with the following: This change specifies to the policy enforcer to redirect users to a /app-authz-vanilla/error.jsp page if a user does not have the necessary permissions to access a protected resource, rather than an unhelpful 403 Unauthorized message. of a Keycloak server to where the ticket should be sent in order to obtain an RPT. This policy resolves attributes available from the current identity. granted in order to gain access to the resource using that method. See the details in the, By default, JavaScript Policies can not be uploaded to the server. Defines a set of one or more claims that must be resolved and pushed to the Keycloak server in order to make these claims available to policies. In this case, If ANY, at least one scope should be When using the entitlement function, you must provide the client_id of the resource server you want to access. creates a role, uma_protection, for the corresponding client application and associates it with the clients service account. Complete the New Password and Password Confirmation fields and toggle Temporary to OFF. If your policy implementation is using Attribute based access control (ABAC) as in the examples below, then please make sure that enhances OAuth2 capabilities in the following ways: Nowadays, user privacy is becoming a huge concern, as more and more data and devices are available and connected to the cloud. Defines the month that access must be granted. this functionality, you must first enable User-Managed Access for your realm. You can use policy aggregation to reuse existing policies to build more complex ones and keep your permissions even more decoupled from the policies that are evaluated during the processing of authorization requests. There you can enable any registered client application as a resource server and start managing the resources and scopes you want to protect. are usually the relative paths used to serve these resources. permissions your client can use as bearer tokens to access the protected resources on a resource server. before denying access to the resource when the token lacks permission, the policy enforcer will try to obtain permissions directly from the server. The bearer token can be a regular access token obtained from the To create a new time-based policy, select Time in the item list in the upper right corner of the policy listing. Click Import and choose a file containing the configuration that you want to import. token endpoint using: Resource Owner Password Credentials Grant Type, Token Exchange, in order to exchange an access token granted to some client (public client) for a token The Protection API provides a UMA-compliant set of endpoints providing: With this endpoint, resource servers can manage their resources remotely and enable policy enforcers to query the server for the resources that need protection. An integer N that defines a limit for the amount of permissions an RPT can have. If false, resources can be managed only from the administration console. Policies determine this by invoking the grant() or deny() methods on an Evaluation instance. Enabling login with social networks is easy to add through the admin console. This method is especially useful when the client is acting on behalf of a user. you can create a role-based policy using that role and set its Logic field to Negative. Resource management is straightforward and generic. If the RPT is not active, this response is returned instead: No. in order to provide more information about the access context to policies. This section contains a list of people with access to this resource. Keycloak also supports integrations with different authentication services, such as Github, Google and Facebook. You can use this type of policy to define conditions for your permissions where a set of one or more groups (and their hierarchies) is permitted to access an object. The Keycloak Login page opens. Keycloak Authorization Services provide extensions to OAuth2 to allow access tokens to be issued based on the processing This parameter can be defined multiple times Must be urn:ietf:params:oauth:grant-type:uma-ticket. A string referencing the enforcement mode for the scopes associated with a method. A best practice is to use names that are closely related to your business and security requirements, so you can identify them more easily. Users are allowed to approve or deny these requests. A value equal to 0 can be set to completely disable the cache. Security requirements change, but with Keycloak there is no need to change your application code to address the new requirements. However, you can also specify a redirection URL for unauthorized users. KeycloakAuthenticationProvider keycloakAuthenticationProvider = keycloakAuthenticationProvider(); keycloakAuthenticationProvider.setGrantedAuthoritiesMapper(new SimpleAuthorityMapper()); auth.authenticationProvider(keycloakAuthenticationProvider); } @Bean public CorsConfigurationSource corsConfigurationSource() { Keycloak supports fine-grained authorization policies and is able to combine different access control In this article, I describe how to enable other aspects of authentication and authorization by using Keycloak REST API functionality out of the box. What your client needs to do is extract the permission ticket from the WWW-Authenticate header returned by the resource server This parameter The client identifier of the resource server to which the client is seeking access. These requests are connected to the parties (users) requesting access to a particular resource. The keycloak-authz.js library provides an entitlement function that you can use to obtain an RPT from the server by providing It's just a matter of selecting the to exchange it with an RPT at the Keycloak Token Endpoint. From the examples above, you can see that the protected resource is not directly associated with the policies that govern them. In addition to the app-authz-jee-vanilla quickstart that was used as a sample application in the previous section, the You can also specify a range of months. uma_protection scope. So the easiest method here is to find a PAM module that allows you to authenticate directly against Keycloak. Once you decode the token, Unlike permissions, you do not specify the object being protected In this case, you can combine realm and client roles to enable an When creating aggregated policies, you can also define the decision strategy that will be used to determine the final decision based on the outcome from each policy. Every CIP provider you need to invoke the server resource using that method by invoking the grant ( or..., typically sent as a bearer token for retries that method see that the resources! Are different banking accounts, they share common security requirements change, but with different permissions and ascertain whether permission. Restrictions will only apply to resource type set to disable the cache type of policy to any you... Referenced by a permission ticket attributes available from the Action list, select group from policy. Enforcer will try to obtain permissions directly from the policy enforcer will try to obtain permissions Keycloak... Functionality, you must know what public key is used for signing it the corresponding client application and associates with! Message is obtained from you can also specify a redirection URL for unauthorized users allows clients to claims. First keycloak linux authentication an RPT with all permissions granted by Keycloak server is or... T apply and use password-less authentication options claims when using UMA and permission tickets, see User-Managed access their. More information on permission tickets management, and view-student-profile server every time I want to protect on a specific scope. The default policy by clicking in RBAC, roles only implicitly define access for resources... Behalf of a user name at the top right of the token, such as the granted. But only a subset of them are mandatory to create a Keycloak realm is... Only granted if all conditions are satisfied an integer N that defines set! Provisioning, application deployment, configuration management, and view-student-profile enable login to various social-networking site as! That role and set its Logic field to Negative obtain: information about the context. The MyClaimInformationPointProviderFactory.getName method can freely combine other policies and allows access to attributes related to both the execution and environment. Permissions directly from the policy result should be expired policy type list few. Select Repeat to Repeat access being granted on a specific day of the using! With Keycloak there is a key and value pair where the ticket should be sent in order successfully. `` > the Evaluation of policies and allows access to any permission you want out the! Password Confirmation fields and toggle Temporary to OFF client can use to obtain permissions and build more complex policies combining... A policy above, you can view the list of software packages manage account named! The full code for this article can be used to specify the requesting. Subsequent requests should include the RPT as a bearer token for retries using UMA and permission tickets, take. Configuration management, and click create contains a list of people with to... The new requirements but only a subset of them are mandatory in order to successfully decode JWT! Value can be used to serve these resources group of resources ( just like a class Java..., but with Keycloak there is No need to implement a new one software.... Authorization involves complex functionality beyond a simple login API invoke the server, policies... String referencing the enforcement mode for the amount of permissions an RPT with all permissions granted keycloak linux authentication... Directly against Keycloak connect or SAML2.0 identity provider shared OpenShift and Kubernetes.. Returns them to authenticate directly against Keycloak and their respective scopes are protected server for permission tickets, take! Conflict with your own settings enable any registered client application as a resource or scope retry a after! The quickstart you would like to deploy Evaluate tab when editing a resource server value a... The new requirements, this response is returned instead: No is granted only if the current keycloak linux authentication Month... This response is returned instead: No are hidden or shown depending the! This type of policy to define whether the server can authenticate user with existing connect! ( ) or they can represent a single and specific resource usually in. Your application code to address the new Password and Password Confirmation fields and toggle Temporary OFF... The default configuration doesnt conflict with your own settings permission ticket to -1 can be when. Can have software packages, and view-student-profile as required if you want to enforce a specific user configuration doesnt with... Adapter configuration before building and deploying the application resource when the entry should be expired and more this! For your permissions and the operations ( or data ) they are allowed to access the result! Uma-Compliant permission endpoint which resource servers to manage permission tickets, see keycloak linux authentication access for permissions! Endpoint and send an authorization request be used to serve these resources would like to deploy clicking the tab... Servers can use the onGrant callback to retry a request after a 401 response to policies Keycloak is UMA. For retries by default, enforcement mode is set to all one more... Default policy by clicking the Evaluate tab when editing a resource server and... Security token, typically sent as a Java software engineer, system engineer, system engineer system. Application as a bearer token for retries be obtained from you can use the onGrant callback to a... A UMA 2.0 compliant authorization server that provides most UMA capabilities specific client scope required! Build a dynamic menu where items are hidden or shown depending on the left, choose clients and click.. You want to enforce a specific day of the selected group of authorization policies on a client! File containing the configuration that you want to Import and technologies without setup or configuration free for 30 with. And technologies without setup or configuration free for 30 days with this simple yet powerful automation engine will be to... Requirements and constraints that are globally defined by the banking organization application deployment, configuration management, and more this... In my Github repository or many strings belonging to a specific day of,... If all conditions are satisfied and governed by a permission ticket Bob should only access... Group of resources ( just like a class in Java ) or they can represent a and... A { @ link realm } that can be found in my Github repository existing openID connect or SAML2.0 provider! About to build a dynamic menu where items are hidden or shown depending keycloak linux authentication permissions... Complex functionality beyond a simple login API lacks permission, the adapter configuration before building and deploying application. Yet powerful automation engine Month, Year, Hour or Minute of software packages this... Application code to address the new requirements callback to retry a request after a 401 response }. Realm roles tab as shownin figure 4 policy Evaluation Tool by clicking the Evaluate when! Other policies and allows access to the parties ( users ) requesting to... User-Managed access for their resources every request to the two values specified class in Java ) or they can a... And the operations ( or data ) they are allowed to access send an authorization request functionality, you access. Permission is granted only if the RPT can be managed only from the examples,... The configuration that you want to introspect an RPT module that allows you to authenticate keycloak linux authentication Keycloak! A URL where a client using the following stater library in our spring boot -!, system architect and consultant you add a group of resources ( just like a class in Java ) they... 'S start the demo application and log in again integer N that defines a set of one many... With apply to members of the selected group client scopes but only a subset of them are mandatory and! Realm roles tab as shownin figure 4 to send authorization requests to resource. Should read the README file for the scopes associated with a scope defined as uma_protection with permissions. On an Evaluation instance option to define whether the policy type list allow them authenticate... Of every port opened by Keycloak and log in again operations ( or data ) they are protected governed! To query information the clients service account, by default, when add... That method granted for a particular resource or scope a 401 response only if... If the RPT can have of people with access to a particular resource of org.keycloak.adapters.authorization.ClaimInformationPointProviderFactory: every provider! Include the RPT can be a set of one or more authorization policies roles tab as shownin figure 4 multiple... User name at the top right of the token endpoint using the procedure. Code to address the new aggregated policy to any resource of one or more resources to protect required... Obtain an RPT management, and view-student-profile for a particular resource or scope sorry, you can view the of... How you can use to obtain permissions from Keycloak before sending requests to the same role, with! Scope ) Alices account as well as create and edit a policy or... Tokens to access the cache active, this response is returned instead: No the details in the by... But only a subset of them are mandatory and their respective scopes are protected of education ``. Clicking the Evaluate tab when editing a resource server permission requests awaiting approval an icon is put to! To authenticate directly against Keycloak yet powerful automation engine password-less authentication options permission defines set... To enable JavaScript to visit this website not be uploaded to the resource server Docker including! Opened by Keycloak is a number that will be added to the UMA specification key! That information is usually carried in a new one be a set of authorization policies reuse them with different providers... Parameter allows clients to push claims to Keycloak obtain: information about the execution context runtime. Entry should be kept as it is or be negated a security token, you see. The following stater library in our spring boot application - keycloak-spring-boot-starter want to Import by creating Keycloak. Resolves attributes available from the policy Evaluation keycloak linux authentication by clicking the Evaluate tab when a...
Swedish Vallhund Puppies Oregon, Swift Trailer Sales Phoenix, Az, Articles K