Keycloak login issue #558

rafpor75 · 2024-10-09T11:17:52Z

rafpor75
Oct 9, 2024

Description

What product are you having troubles with?

authentication-service:3.7.0
login-site:8.1.2
authorization-service:2.4.2

What Console version are you using?
12

Description

Hi!

I configured all above services to use Keycloak.

when I call my backoffice it redirects to
https://backoffice_url/authorize?state=493ceb54-1ced-4b0b-a21b-b9b3ea8590a9&redirect=%2Fbackoffice
and I receive the below error:
appId and providerId query params are required

if I manually add the parameters appId=web&providerId=keycloak in the url
I have the error: the state param is not valid after login execution

this is the configuration of my authentication-service:

{ "apps": { "web": { "providers": { "keycloak": { "type": "keycloak", "clientId": "idbackoffice", "clientSecret": "blablablablablablablablablabla", "authUrl": "https://keycloak_url/auth/realms/myrealm/protocol/openid-connect/auth", "tokenUrl": "https://keycloak_url/auth/realms/myrealm/protocol/openid-connect/token", "userInfoUrl": "https://keycloak_url/auth/realms/myrealm/protocol/openid-connect/userinfo", "baseUrl": "https://keycloak_url/{tenantId}/auth/realms/myrealm/", "scope": [ "openid" ], "order": 10, "userSettingsURL": "https://keycloak_url/dashboard" } }, "authorizeStateRequired": false, "redirectUrl": "https://keycloak_url/auth/realms/myrealm/broker/keycloak/endpoint", "realm": "myrealm", "issuer": "https://keycloak_url/auth/realms/myrealm", "defaultGroups": [] } } }
Thank you

GabrieleGuelfi · 2024-10-09T12:53:56Z

GabrieleGuelfi
Oct 9, 2024
Collaborator

Hello,
you can configure your api-gateway to add automatically the appId query param, to do so you should go to the Advanced section of the Console.
Here an example for envoy, that you should put in the local-replies.yaml, assuming that you have a listener called frontend:

- listener_name: frontend
  filter:
    status_code_filter:
      comparison:
        op: EQ
        value:
          default_value: 401
          runtime_key: key_b
  status_code: 302
  body:
    inline_string: |-
      <html>
        <head>
          <meta http-equiv="content-type" content="text/html;charset=utf-8">
            <title>302 Found</title>
        </head>
      </html>
  headers_to_add:
  - header:
      key: "Location"
      value: "/web-login?appId=web&redirect=%REQ(X-ENVOY-ORIGINAL-PATH?:PATH)%"
    append: false

For the nginx gateway you should look in api-gateway -> server-extension.conf.

Hope it helps!

11 replies

rafpor75 Oct 10, 2024
Author

yes I set isWebsiteApp=true

for the call /token
I have payload:
state: fa7e24b2-9598-4144-8c25-c5721b59c745
session_state: 4814dfa8-f6f1-449e-aa05-0c6e892df539
iss: https://lemur-17.cloud-iam.com/auth/realms/idengine
code: 6da483fc-42bc-4773-89a7-1facc3c223cf.4814dfa8-f6f1-449e-aa05-0c6e892df539.e2890658-1a7a-44bf-8b3b-9e31e1163faa

response body empty

response status code: 400 Bad Request

This is the full log of a authentication service during an authentication process:

As you can see we have a problem of authorization with userinfo

{"level":30,"msg":"Starting server","port":"8080","time":1728557035191}
{"level":20,"msg":"userinfo api called without access token","reqId":"b8b4766baa77fe087d6ec0452cb764d8","time":1728557063904}
{"host":{"hostname":"authentication-service","forwardedHost":"fca-infocert.miaplatformsv.infocert.it"},"http":{"request":{"method":"GET","userAgent":{"original":"Go-http-client/1.1"}},"response":{"statusCode":401,"body":{"bytes":56}}},"level":30,"msg":"request completed","reqId":"b8b4766baa77fe087d6ec0452cb764d8","responseTime":0,"time":1728557063904,"url":{"path":"/userinfo"}}
{"level":20,"msg":"userinfo api called without access token","reqId":"ee8a2a638c1694e376b21180aae24abe","time":1728557063962}
{"host":{"hostname":"authentication-service","forwardedHost":"fca-infocert.miaplatformsv.infocert.it"},"http":{"request":{"method":"GET","userAgent":{"original":"Go-http-client/1.1"}},"response":{"statusCode":401,"body":{"bytes":56}}},"level":30,"msg":"request completed","reqId":"ee8a2a638c1694e376b21180aae24abe","responseTime":0,"time":1728557063962,"url":{"path":"/userinfo"}}
{"level":20,"msg":"userinfo api called without access token","reqId":"d6d50fae84eeaf7468d2d7f1d9f7ddf7","time":1728557064053}
{"host":{"hostname":"authentication-service","forwardedHost":"fca-infocert.miaplatformsv.infocert.it"},"http":{"request":{"method":"GET","userAgent":{"original":"Go-http-client/1.1"}},"response":{"statusCode":401,"body":{"bytes":56}}},"level":30,"msg":"request completed","reqId":"d6d50fae84eeaf7468d2d7f1d9f7ddf7","responseTime":0,"time":1728557064053,"url":{"path":"/userinfo"}}
{"level":20,"msg":"userinfo api called without access token","reqId":"11b52e2163a376b51bdad8e49d78534c","time":1728557064061}
{"host":{"hostname":"authentication-service","forwardedHost":"fca-infocert.miaplatformsv.infocert.it"},"http":{"request":{"method":"GET","userAgent":{"original":"Go-http-client/1.1"}},"response":{"statusCode":401,"body":{"bytes":56}}},"level":30,"msg":"request completed","reqId":"11b52e2163a376b51bdad8e49d78534c","responseTime":0,"time":1728557064061,"url":{"path":"/userinfo"}}
{"level":20,"msg":"userinfo api called without access token","reqId":"68e04443f9312710a7d2bc38f87826f4","time":1728557064064}
{"host":{"hostname":"authentication-service","forwardedHost":"fca-infocert.miaplatformsv.infocert.it"},"http":{"request":{"method":"GET","userAgent":{"original":"Go-http-client/1.1"}},"response":{"statusCode":401,"body":{"bytes":56}}},"level":30,"msg":"request completed","reqId":"68e04443f9312710a7d2bc38f87826f4","responseTime":0,"time":1728557064064,"url":{"path":"/userinfo"}}
{"level":20,"msg":"userinfo api called without access token","reqId":"22862ac5eb04f3210258bc41a52a3a77","time":1728557064064}
{"host":{"hostname":"authentication-service","forwardedHost":"fca-infocert.miaplatformsv.infocert.it"},"http":{"request":{"method":"GET","userAgent":{"original":"Go-http-client/1.1"}},"response":{"statusCode":401,"body":{"bytes":56}}},"level":30,"msg":"request completed","reqId":"22862ac5eb04f3210258bc41a52a3a77","responseTime":0,"time":1728557064064,"url":{"path":"/userinfo"}}
{"level":20,"msg":"userinfo api called without access token","reqId":"654357724a656b27567ae5617ecc922b","time":1728557064064}
{"host":{"hostname":"authentication-service","forwardedHost":"fca-infocert.miaplatformsv.infocert.it"},"http":{"request":{"method":"GET","userAgent":{"original":"Go-http-client/1.1"}},"response":{"statusCode":401,"body":{"bytes":56}}},"level":30,"msg":"request completed","reqId":"654357724a656b27567ae5617ecc922b","responseTime":0,"time":1728557064064,"url":{"path":"/userinfo"}}
{"level":20,"msg":"userinfo api called without access token","reqId":"b50c663a2ccb74e4bf40c92ece7e8f5b","time":1728557064403}
{"host":{"hostname":"authentication-service","forwardedHost":"fca-infocert.miaplatformsv.infocert.it"},"http":{"request":{"method":"GET","userAgent":{"original":"Go-http-client/1.1"}},"response":{"statusCode":401,"body":{"bytes":56}}},"level":30,"msg":"request completed","reqId":"b50c663a2ccb74e4bf40c92ece7e8f5b","responseTime":0,"time":1728557064404,"url":{"path":"/userinfo"}}
{"level":20,"msg":"userinfo api called without access token","reqId":"99a57f234d46a3de2d01d8a4eb47ea15","time":1728557064404}
{"host":{"hostname":"authentication-service","forwardedHost":"fca-infocert.miaplatformsv.infocert.it"},"http":{"request":{"method":"GET","userAgent":{"original":"Go-http-client/1.1"}},"response":{"statusCode":401,"body":{"bytes":56}}},"level":30,"msg":"request completed","reqId":"99a57f234d46a3de2d01d8a4eb47ea15","responseTime":0,"time":1728557064404,"url":{"path":"/userinfo"}}
{"level":20,"msg":"userinfo api called without access token","reqId":"34df6f5456d5e481246f69aa7422c73e","time":1728557064496}
{"host":{"hostname":"authentication-service","forwardedHost":"fca-infocert.miaplatformsv.infocert.it"},"http":{"request":{"method":"GET","userAgent":{"original":"Go-http-client/1.1"}},"response":{"statusCode":401,"body":{"bytes":56}}},"level":30,"msg":"request completed","reqId":"34df6f5456d5e481246f69aa7422c73e","responseTime":0,"time":1728557064496,"url":{"path":"/userinfo"}}
{"host":{"hostname":"fca-infocert.miaplatformsv.infocert.it","forwardedHost":"fca-infocert.miaplatformsv.infocert.it","ip":"10.204.180.252, 10.204.180.252"},"http":{"request":{"method":"GET","userAgent":{"original":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36"}},"response":{"statusCode":302,"body":{"bytes":313}}},"level":30,"msg":"request completed","reqId":"34df6f5456d5e481246f69aa7422c73e","responseTime":0,"time":1728557064500,"url":{"path":"/authorize?state=5db3db76-c19f-477e-bb7a-14fde3eeac82&appId=web&providerId=keycloak&redirect=%2Fbackoffice"}}
{"level":20,"msg":"userinfo api called without access token","reqId":"84a2cd798eca57c245d7853cb359946c","time":1728557069553}
{"host":{"hostname":"authentication-service","forwardedHost":"fca-infocert.miaplatformsv.infocert.it"},"http":{"request":{"method":"GET","userAgent":{"original":"Go-http-client/1.1"}},"response":{"statusCode":401,"body":{"bytes":56}}},"level":30,"msg":"request completed","reqId":"84a2cd798eca57c245d7853cb359946c","responseTime":0,"time":1728557069553,"url":{"path":"/userinfo"}}
{"level":20,"msg":"userinfo api called without access token","reqId":"36e54603cbd2304c7d7a79a8ba01db50","time":1728557069739}
{"host":{"hostname":"authentication-service","forwardedHost":"fca-infocert.miaplatformsv.infocert.it"},"http":{"request":{"method":"GET","userAgent":{"original":"Go-http-client/1.1"}},"response":{"statusCode":401,"body":{"bytes":56}}},"level":30,"msg":"request completed","reqId":"36e54603cbd2304c7d7a79a8ba01db50","responseTime":0,"time":1728557069739,"url":{"path":"/userinfo"}}
{"level":20,"msg":"userinfo api called without access token","reqId":"f30faabf2390c44d4a243760bc7e587e","time":1728557069739}
{"level":20,"msg":"userinfo api called without access token","reqId":"3991bb13891c60f45af5c8ce07ab6e88","time":1728557069739}
{"host":{"hostname":"authentication-service","forwardedHost":"fca-infocert.miaplatformsv.infocert.it"},"http":{"request":{"method":"GET","userAgent":{"original":"Go-http-client/1.1"}},"response":{"statusCode":401,"body":{"bytes":56}}},"level":30,"msg":"request completed","reqId":"3991bb13891c60f45af5c8ce07ab6e88","responseTime":0,"time":1728557069739,"url":{"path":"/userinfo"}}
{"level":20,"msg":"userinfo api called without access token","reqId":"2e9d1b457a1b0f359f3e88f16273cca0","time":1728557069739}
{"host":{"hostname":"authentication-service","forwardedHost":"fca-infocert.miaplatformsv.infocert.it"},"http":{"request":{"method":"GET","userAgent":{"original":"Go-http-client/1.1"}},"response":{"statusCode":401,"body":{"bytes":56}}},"level":30,"msg":"request completed","reqId":"2e9d1b457a1b0f359f3e88f16273cca0","responseTime":0,"time":1728557069739,"url":{"path":"/userinfo"}}
{"host":{"hostname":"authentication-service","forwardedHost":"fca-infocert.miaplatformsv.infocert.it"},"http":{"request":{"method":"GET","userAgent":{"original":"Go-http-client/1.1"}},"response":{"statusCode":401,"body":{"bytes":56}}},"level":30,"msg":"request completed","reqId":"f30faabf2390c44d4a243760bc7e587e","responseTime":0,"time":1728557069739,"url":{"path":"/userinfo"}}
{"level":20,"msg":"userinfo api called without access token","reqId":"4655bead8d780686863f5f56c574217e","time":1728557069799}
{"host":{"hostname":"authentication-service","forwardedHost":"fca-infocert.miaplatformsv.infocert.it"},"http":{"request":{"method":"GET","userAgent":{"original":"Go-http-client/1.1"}},"response":{"statusCode":401,"body":{"bytes":56}}},"level":30,"msg":"request completed","reqId":"4655bead8d780686863f5f56c574217e","responseTime":0,"time":1728557069799,"url":{"path":"/userinfo"}}
{"level":20,"msg":"userinfo api called without access token","reqId":"c24d9e4c431707f0359510eb6976ae0e","time":1728557069887}
{"host":{"hostname":"authentication-service","forwardedHost":"fca-infocert.miaplatformsv.infocert.it"},"http":{"request":{"method":"GET","userAgent":{"original":"Go-http-client/1.1"}},"response":{"statusCode":401,"body":{"bytes":56}}},"level":30,"msg":"request completed","reqId":"c24d9e4c431707f0359510eb6976ae0e","responseTime":0,"time":1728557069887,"url":{"path":"/userinfo"}}
{"level":50,"msg":"code or state not set","reqId":"c24d9e4c431707f0359510eb6976ae0e","time":1728557069888}
{"host":{"hostname":"fca-infocert.miaplatformsv.infocert.it","forwardedHost":"fca-infocert.miaplatformsv.infocert.it","ip":"10.204.180.252, 10.204.180.252"},"http":{"request":{"method":"POST","userAgent":{"original":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36"}},"response":{"statusCode":400,"body":{"bytes":48}}},"level":30,"msg":"request completed","reqId":"c24d9e4c431707f0359510eb6976ae0e","responseTime":0,"time":1728557069888,"url":{"path":"/oauth/token?state=5db3db76-c19f-477e-bb7a-14fde3eeac82&session_state=978bf0f5-d0cd-40c8-b9e4-6047cbf3cf5c&iss=https%3A%2F%2Flemur-17.cloud-iam.com%2Fauth%2Frealms%2Fidengine&code=1619cdea-2bed-4460-9c51-6891c44033f8.978bf0f5-d0cd-40c8-b9e4-6047cbf3cf5c.e2890658-1a7a-44bf-8b3b-9e31e1163faa"}}
{"level":20,"msg":"userinfo api called without access token","reqId":"645c06dc1442d0736de15eaeb87fd052","time":1728557070030}
{"host":{"hostname":"authentication-service","forwardedHost":"fca-infocert.miaplatformsv.infocert.it"},"http":{"request":{"method":"GET","userAgent":{"original":"Go-http-client/1.1"}},"response":{"statusCode":401,"body":{"bytes":56}}},"level":30,"msg":"request completed","reqId":"645c06dc1442d0736de15eaeb87fd052","responseTime":0,"time":1728557070030,"url":{"path":"/userinfo"}}
{"level":20,"msg":"userinfo api called without access token","reqId":"754c5cbfad262a8684a4b0016651bd5d","time":1728557070102}
{"host":{"hostname":"authentication-service","forwardedHost":"fca-infocert.miaplatformsv.infocert.it"},"http":{"request":{"method":"GET","userAgent":{"original":"Go-http-client/1.1"}},"response":{"statusCode":401,"body":{"bytes":56}}},"level":30,"msg":"request completed","reqId":"754c5cbfad262a8684a4b0016651bd5d","responseTime":0,"time":1728557070102,"url":{"path":"/userinfo"}}
{"level":50,"msg":"appId or providerID not set","reqId":"754c5cbfad262a8684a4b0016651bd5d","time":1728557070185}
{"host":{"hostname":"fca-infocert.miaplatformsv.infocert.it","forwardedHost":"fca-infocert.miaplatformsv.infocert.it","ip":"10.204.180.252, 10.204.180.252"},"http":{"request":{"method":"GET","userAgent":{"original":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36"}},"response":{"statusCode":400,"body":{"bytes":47}}},"level":30,"msg":"request completed","reqId":"754c5cbfad262a8684a4b0016651bd5d","responseTime":0,"time":1728557070185,"url":{"path":"/authorize?state=8f321bed-0849-4a4f-a21c-687699704f71"}}
{"level":20,"msg":"userinfo api called without access token","reqId":"6f8828fbdc9a739da2c28c1928623976","time":1728557070284}
{"host":{"hostname":"authentication-service","forwardedHost":"fca-infocert.miaplatformsv.infocert.it"},"http":{"request":{"method":"GET","userAgent":{"original":"Go-http-client/1.1"}},"response":{"statusCode":401,"body":{"bytes":56}}},"level":30,"msg":"request completed","reqId":"6f8828fbdc9a739da2c28c1928623976","responseTime":0,"time":1728557070284,"url":{"path":"/userinfo"}}
{"level":20,"msg":"userinfo api called without access token","reqId":"341e0bddb93a4ce88f4eb511cd31ecaf","time":1728557070348}
{"host":{"hostname":"authentication-service","forwardedHost":"fca-infocert.miaplatformsv.infocert.it"},"http":{"request":{"method":"GET","userAgent":{"original":"Go-http-client/1.1"}},"response":{"statusCode":401,"body":{"bytes":56}}},"level":30,"msg":"request completed","reqId":"341e0bddb93a4ce88f4eb511cd31ecaf","responseTime":0,"time":1728557070348,"url":{"path":"/userinfo"}}

GabrieleGuelfi Oct 10, 2024
Collaborator

API /oauth/token needs state and code to be in the body, not in the query param, that's why you receive the error.

Make sure everything is configured correctly, both on the authentication-service and Keycloak provider.

For example in the authentication-service, the field authorizeStateRequired must be true and the redirectUrl should be https://{{YOUR_HOST}}/web-login/oauth/callback and also set in the identity provider configuration.

rafpor75 Oct 10, 2024
Author

Ok, I configured everything following your suggestions. The state and code are now passed as form data and not as query parameters, but I received the same errors again

when I try:
curl --request GET https://backoffice_url/authorize?appId=web&providerId=keycloak&state=xyzABC123

the response is "appId and providerId query params are required"

and log:

Filter the logs below...

{"level":30,"msg":"Starting server","port":"8080","time":1728568125592}
{"level":20,"msg":"userinfo api called without access token","reqId":"3e29e2ae31a214ccd9aba086c2556a0b","time":1728568135333}
{"host":{"hostname":"authentication-service","forwardedHost":"fca-infocert.miaplatformsv.infocert.it"},"http":{"request":{"method":"GET","userAgent":{"original":"Go-http-client/1.1"}},"response":{"statusCode":401,"body":{"bytes":56}}},"level":30,"msg":"request completed","reqId":"3e29e2ae31a214ccd9aba086c2556a0b","responseTime":0,"time":1728568135333,"url":{"path":"/userinfo"}}
{"level":50,"msg":"appId or providerID not set","reqId":"3e29e2ae31a214ccd9aba086c2556a0b","time":1728568135335}
{"host":{"hostname":"fca-infocert.miaplatformsv.infocert.it","forwardedHost":"fca-infocert.miaplatformsv.infocert.it","ip":"10.204.180.252, 10.204.180.252"},"http":{"request":{"method":"GET","userAgent":{"original":"curl/8.5.0"}},"response":{"statusCode":400,"body":{"bytes":47}}},"level":30,"msg":"request completed","reqId":"3e29e2ae31a214ccd9aba086c2556a0b","responseTime":0,"time":1728568135335,"url":{"path":"/authorize?appId=web"}}

malta895 Oct 10, 2024

Hi @rafpor75,

when I try: curl --request GET https://backoffice_url/authorize?appId=web&providerId=keycloak&state=xyzABC123

the response is "appId and providerId query params are required"

That is probably because you are missing hyphens around the url, and your shell strips away the query string from the first & onward. You can see from the last line of the logs that an incomplete request path is being called: /authorize?appId=web

A request like the following should work:

curl --request GET 'https://backoffice_url/authorize?appId=web&providerId=keycloak&state=xyzABC123'

Regardless of this, you should not call directly the authorize endpoint, you should instead navigate from your browser to the /web-login endpoint, which then under the hood creates a state and calls the authorize endpoint for you:

https://backoffice_url/web-login?appId=web&providerId=keycloak

Does this work?

rafpor75 Oct 10, 2024
Author

Thank you @malta895
I solved it thanks to @GabrieleGuelfi
I had failed to create the users table in mongodb

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Keycloak login issue #558

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Replies: 1 comment 11 replies

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

Select a reply

Keycloak login issue #558

rafpor75 Oct 9, 2024

Description

Replies: 1 comment · 11 replies

GabrieleGuelfi Oct 9, 2024 Collaborator

rafpor75 Oct 10, 2024 Author

GabrieleGuelfi Oct 10, 2024 Collaborator

rafpor75 Oct 10, 2024 Author

malta895 Oct 10, 2024

rafpor75 Oct 10, 2024 Author

rafpor75
Oct 9, 2024

Replies: 1 comment 11 replies

GabrieleGuelfi
Oct 9, 2024
Collaborator

rafpor75 Oct 10, 2024
Author

GabrieleGuelfi Oct 10, 2024
Collaborator

rafpor75 Oct 10, 2024
Author

rafpor75 Oct 10, 2024
Author