0

Ours is a wildfly based application. We configured Keycloak OIDC with Elytron. This integration works well in all our environments except this one. On hitting any URL, it returns 403 Forbidden error.

On enabling TRACE level, I could see these logs when hitting the application endpoint:

{"log_timestamp": "2023-03-31T12:34:38.629+0000", "log_level": "TRACE", "process_id": 1, "process_name": "myapp", "thread_id": 1, "thread_name": "default task-1", "action_name": "org.wildfly.security.http.servlet", "log_message": "Created ServletSecurityContextImpl enableJapi=true, integratedJaspi=true, applicationContext=default-host /my-app"}
{"log_timestamp": "2023-03-31T12:34:38.629+0000", "log_level": "TRACE", "process_id": 1, "process_name": "myapp", "thread_id": 1, "thread_name": "default task-1", "action_name": "org.wildfly.security.http.servlet", "log_message": "No AuthConfigProvider for layer=HttpServlet, appContext=default-host /my-app"}
{"log_timestamp": "2023-03-31T12:34:38.629+0000", "log_level": "TRACE", "process_id": 1, "process_name": "myapp", "thread_id": 1, "thread_name": "default task-1", "action_name": "org.wildfly.security.http.servlet", "log_message": "JASPIC Unavailable, using HTTP authentication."}
{"log_timestamp": "2023-03-31T12:34:38.629+0000", "log_level": "TRACE", "process_id": 1, "process_name": "myapp", "thread_id": 1, "thread_name": "default task-1", "action_name": "org.wildfly.security", "log_message": "No CachedIdentity to restore."}
{"log_timestamp": "2023-03-31T12:34:38.629+0000", "log_level": "TRACE", "process_id": 1, "process_name": "myapp", "thread_id": 1, "thread_name": "default task-1", "action_name": "org.wildfly.security", "log_message": "Created HttpServerAuthenticationMechanism [org.wildfly.security.auth.server.SecurityIdentityServerMechanismFactory$1@611230fa] for mechanism [OIDC]"}
{"log_timestamp": "2023-03-31T12:34:38.630+0000", "log_level": "DEBUG", "process_id": 1, "process_name": "myapp", "thread_id": 1, "thread_name": "default task-1", "action_name": "org.wildfly.security.http.oidc", "log_message": "adminRequest http://localhost:8180/my-app/"}
{"log_timestamp": "2023-03-31T12:34:38.630+0000", "log_level": "TRACE", "process_id": 1, "process_name": "myapp", "thread_id": 1, "thread_name": "default task-1", "action_name": "org.wildfly.security.http.oidc", "log_message": "--> authenticate()"}
{"log_timestamp": "2023-03-31T12:34:38.630+0000", "log_level": "TRACE", "process_id": 1, "process_name": "myapp", "thread_id": 1, "thread_name": "default task-1", "action_name": "org.wildfly.security.http.oidc", "log_message": "try bearer"}
{"log_timestamp": "2023-03-31T12:34:38.630+0000", "log_level": "TRACE", "process_id": 1, "process_name": "myapp", "thread_id": 1, "thread_name": "default task-1", "action_name": "org.wildfly.security.http.oidc", "log_message": "try query parameter auth"}
{"log_timestamp": "2023-03-31T12:34:38.630+0000", "log_level": "TRACE", "process_id": 1, "process_name": "myapp", "thread_id": 1, "thread_name": "default task-1", "action_name": "org.wildfly.security.http.oidc", "log_message": "try basic auth"}
{"log_timestamp": "2023-03-31T12:34:38.630+0000", "log_level": "TRACE", "process_id": 1, "process_name": "myapp", "thread_id": 1, "thread_name": "default task-1", "action_name": "org.wildfly.security.http.oidc", "log_message": "try oidc"}
{"log_timestamp": "2023-03-31T12:34:38.630+0000", "log_level": "DEBUG", "process_id": 1, "process_name": "myapp", "thread_id": 1, "thread_name": "default task-1", "action_name": "org.wildfly.security.http.oidc", "log_message": "Account was not in session, returning null"}
{"log_timestamp": "2023-03-31T12:34:38.630+0000", "log_level": "DEBUG", "process_id": 1, "process_name": "myapp", "thread_id": 1, "thread_name": "default task-1", "action_name": "org.wildfly.security.http.oidc", "log_message": "there was no code"}
{"log_timestamp": "2023-03-31T12:34:38.630+0000", "log_level": "DEBUG", "process_id": 1, "process_name": "myapp", "thread_id": 1, "thread_name": "default task-1", "action_name": "org.wildfly.security.http.oidc", "log_message": "redirecting to auth server"}
{"log_timestamp": "2023-03-31T12:34:38.630+0000", "log_level": "DEBUG", "process_id": 1, "process_name": "myapp", "thread_id": 1, "thread_name": "default task-1", "action_name": "org.wildfly.security.http.oidc", "log_message": "callback uri: http://localhost:8180/my-app/"}
{"log_timestamp": "2023-03-31T12:34:38.630+0000", "log_level": "DEBUG", "process_id": 1, "process_name": "myapp", "thread_id": 1, "thread_name": "default task-1", "action_name": "org.wildfly.security.http.oidc", "log_message": "Loading OpenID provider metadata from https://myidp.com/realm/myrealm/.well-known/openid-configuration"}
{"log_timestamp": "2023-03-31T12:34:38.632+0000", "log_level": "WARN", "process_id": 1, "process_name": "myapp", "thread_id": 1, "thread_name": "default task-1", "action_name": "org.wildfly.security.http.oidc", "log_message": "ELY23005: Unable to load OpenID provider metadata from https://myidp.com/realm/myrealm/.well-known/openid-configuration"}

On looking at the source code of this log, there's no evidence which line is causing the exception.

Few clues:

All our environments are created with same Helm, so there's no question of integrity or sanity. HTTPS Certificate of IDP is issued by a trusted CA. From within the container, we are able to hit the metadata configuration URL in last line Also attached standalone.xml IDP provider is Keycloak. Compared Realm settings, client settings and found no difference. Tried pointing this app to a different Keycloak instance, but getting same issue.

Karthik Murugan
  • 1,429
  • 3
  • 17
  • 28

2 Answers2

0

I think the problem is that the internal service can't reach the internal https://myidp.com over HTTPS. This is a pretty common network problem when your HTTPS is terminated in your proxy/load-balancer and the internal services mostly uses HTTP. How to fix it depends on your infrastructure, one option can be to add the HTTPS certificate to the key cloak endpoint and then map myidp.com to point to the internal IP-address on the LAN.

Tore Nestenius
  • 16,431
  • 5
  • 30
  • 40
  • IDP is configured using HTTPS endpoint. I'm able to curl the same metadata URL from the container and it returns the configuration. – Karthik Murugan Apr 03 '23 at 07:33
  • 1
    If so, then that is a bit odd if Curl works. Perhaps Java is unable to reach it while Curl can? I would try to make a HTTPS GET test request from Java to the HTTPS endpoint. – Tore Nestenius Apr 03 '23 at 07:47
0

I stumbled into this and I've solved it by adding the "truststore" and "truststore-password" properties to the OICD client configuration:

<subsystem xmlns="urn:wildfly:elytron-oidc-client:1.0">
    <secure-deployment name="myapp.war" truststore="/path/to/cacerts.p12" truststore-password="changeit">
        <provider-url>https://localhost/auth/realms/my-app-realm</provider-url>
        <ssl-required>ALL</ssl-required>
        <principal-attribute>preferred_username</principal-attribute>
        <client-id>my-app-oidc-client</client-id>
        <credential name="secret" secret="..."/>
    </secure-deployment>
</subsystem>

See https://docs.wildfly.org/28/wildscribe/subsystem/elytron-oidc-client/secure-deployment/index.html as a reference.

The trust store file cacerts.p12 was created with

keytool -importcert -alias keycloak -keystore cacerts.p12 -file localhost.crt

where localhost.crt is the server certificate.

Milad
  • 836
  • 7
  • 13