# Error -- failed to map user (keycloak, dex with ldap, google id)

**URL:** <https://discourse.openondemand.org/t/error-failed-to-map-user-keycloak-dex-with-ldap-google-id/2613>\
**Category:** Get Help\
**Created:** [April 10, 2023, 10:07pm UTC](https://discourse.openondemand.org/t/error-failed-to-map-user-keycloak-dex-with-ldap-google-id/2613 "2023-04-10T22:07:49Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![nassim09](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/nassim09/32/1583_2.png) [@nassim09](https://discourse.openondemand.org/u/nassim09)\
**Post date:** [April 10, 2023, 10:07pm UTC](https://discourse.openondemand.org/t/error-failed-to-map-user-keycloak-dex-with-ldap-google-id/2613/1 "2023-04-10T22:07:49Z")

</div>

Dear all,

i installed ondemand in rocky with a valid domaine name and certificate, however none of openID services can login to ondemand, all have te same error after succing login in the openID provider. it cannot redirect to open ondemand session “Error – failed to map user …”.

i tried; keycloak, dex ith ldap, google id, all the same error

ondemand version :3.0  
user\_map\_match: ‘.\*’

example of logs of goole (same or keycloak or dex with ldap):  
[lua:debug] [pid 33201:tid 139804968724224] @/opt/ood/mod\_ood\_proxy/lib/ood/user\_map.lua(21): [client 41.109.65.93:4623] Mapped ‘nassim09@gmail.com’ =\> ‘’ [4.635 ms], referer: [https://accounts.google.dz/](https://accounts.google.dz/)  
[Mon Apr 10 21:54:50.067008 2023] [lua:debug] [pid 33201:tid 139804968724224] lua\_request.c(1868): [client 41.109.65.93:4623] AH01488: request\_rec-\>dispatching user → string, referer: [https://accounts.google.dz/](https://accounts.google.dz/)  
[Mon Apr 10 21:54:50.067023 2023] [lua:debug] [pid 33201:tid 139804968724224] lua\_request.c(1860): [client 41.109.65.93:4623] AH01487: request\_rec-\>dispatching write → lua\_CFunction, referer: [https://accounts.google.dz/](https://accounts.google.dz/)  
[Mon Apr 10 21:54:50.067942 2023] [lua:debug] [pid 33201:tid 139804968724224] lua\_request.c(1850): [client 41.109.65.93:4623] AH01486: request\_rec-\>dispatching subpr

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [April 11, 2023, 2:03pm UTC](https://discourse.openondemand.org/t/error-failed-to-map-user-keycloak-dex-with-ldap-google-id/2613/2 "2023-04-11T14:03:45Z")

</div>

As long as you have `ondemand-dex` installed it’ll use some defaults. If you’re trying to use google directly (which is fine), then you have to remove that package first.

Once you remove that package, I’m sure keycloak or google directly would work.

---

<div class="post-metadata">

**Author:** ![nassim09](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/nassim09/32/1583_2.png) [@nassim09](https://discourse.openondemand.org/u/nassim09)\
**Post date:** [April 11, 2023, 2:40pm UTC](https://discourse.openondemand.org/t/error-failed-to-map-user-keycloak-dex-with-ldap-google-id/2613/3 "2023-04-11T14:40:42Z")

</div>

> [@jeff.ohrstrom](#):
>
> ondemand-dex

Thank you for responce, yes i have remove ondemand-dex and sometime i create new machines without installed it in at all. however, even when i can identify with keycloak and others but when it redirect to ondemand the error show up “Error – failed to map user …”

maybe there is problem in vm rocky, permission, really i don’t understund.

my setup:  
vm\_1: rocky 8.7 with domain name and ssl (i have tested the same also in ubuntu)  
vm\_2: keycloak with domaine name for example  
install ondemand 3.0 as in intstructions  
create client ondemand, and create some users in keycloak  
user\_map\_match: ‘.\*’

when enter to ondemand, it redirect me to keycloak, then i succeed to loging but then the error come ☹

thank you in advance all your help

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [April 11, 2023, 2:49pm UTC](https://discourse.openondemand.org/t/error-failed-to-map-user-keycloak-dex-with-ldap-google-id/2613/4 "2023-04-11T14:49:29Z")

</div>

> [@nassim09](#):
>
> user\_map\_match: ‘.\*’

With this config, you should be able to map any user. In fact you _should_ be getting a _different_ error about not being able to find the `nassim09@gmail.com` user.

The only thing I can think of is you’re using `user_map_cmd` and that’s overriding `user_map_match`.

If you search the conf file for MATCH, what does this return? What’s being used in the apache config?

```auto
[root@3384d5b1413f ~]# grep MATCH /etc/httpd/conf.d/ood-portal.conf
  SetEnv OOD_USER_MAP_MATCH "^([^@]+)@.*$"

```

---

<div class="post-metadata">

**Author:** ![nassim09](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/nassim09/32/1583_2.png) [@nassim09](https://discourse.openondemand.org/u/nassim09)\
**Post date:** [April 11, 2023, 10:21pm UTC](https://discourse.openondemand.org/t/error-failed-to-map-user-keycloak-dex-with-ldap-google-id/2613/5 "2023-04-11T22:21:30Z")

</div>

> [@jeff.ohrstrom](#):
>
> `^([^@]+)@.*$`

i have generate another vm and installed ondemand from scratch and without dex, configured with open id and test it with keyckoak and google, and the same error apear !!!

i have this output (SELINUX disable):

[rocky@ondemand ~]$ sudo grep MATCH /etc/httpd/conf.d/ood-portal.conf  
SetEnv OOD\_USER\_MAP\_MATCH “.\*”

sometimes when i play with user\_map\_match or cmd using simple scripr mapping i have this errors:  
Error – can’t find user for nassim09  
Run ‘nginx\_stage --help’ to see a full list of available command line options.  
LOGS:  
@/opt/ood/mod\_ood\_proxy/lib/ood/user\_map.lua(21): Mapped ‘nassim09@gmail.com’ =\> ‘nassim09’ [13.879 ms]  
…  
AH01487: request\_rec-\>dispatching info → lua\_CFunction  
[Wed Apr 12 08:56:45.887083 2023] [lua:info] [pid 98960:tid 140395515041536] [client 41.110.187.86:50709] req\_handler=“” req\_protocol=“HTTP/1.1” req\_origin=“” res\_content\_length=“116” res\_content\_language=“” res\_content\_disp=“” req\_filename=“/var/www/html/pun” req\_accept\_encoding=“gzip, deflate, br” req\_accept\_language=“fr” req\_accept=“text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,_/_;q=0.8,application/signed-exchange;v=b3;q=0.7” req\_method=“GET” allowed\_hosts=“plateforms” res\_content\_location=“” req\_hostname=“plateforms” req\_is\_https=“true” res\_location=“” log\_id=“ZDZyRtDoEpM08@EME0-jBgAAAIQ” req\_cache\_control=“max-age=0” req\_content\_type=“” req\_server\_name=“plateforms” local\_user=“nassim09” res\_content\_encoding=“” req\_is\_websocket=“false” req\_user\_ip= " req\_uri=“/pun/sys/dashboard” time\_user\_map=“13.879” time\_proxy=“0” log\_time=“2023-04-12T08:56:45.886174.0Z” res\_content\_type=“” req\_referer=“” req\_port=“443” [remote\_user="nassim09@gmail.com](mailto:remote_user=%22nassim09@gmail.com)" req\_status=“404” req\_accept\_charset=“” log\_hook=“ood” req\_user\_agent=“Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36 Edg/111.0.1661.62”

1. here is ood\_portal in apache:

OIDCProviderMetadataURL [https://keycloak/auth/realms/ondemand/.well-known/openid-configuration](https://keycloak/auth/realms/ondemand/.well-known/openid-configuration)  
OIDCClientID ondemand  
OIDCClientSecret …  
OIDCRedirectURI [https://plateforms/oidc](https://plateforms/oidc)  
OIDCRemoteUserClaim preferred\_username  
OIDCScope “openid profile”  
OIDCCryptoPassphrase …  
OIDCSessionInactivityTimeout 28800  
OIDCSessionMaxDuration 28800  
OIDCStateMaxNumberOfCookies 10 true  
OIDCCookieSameSite Off  
OIDCPassClaimsAs environment  
OIDCPassIDTokenAs serialized  
OIDCPassRefreshToken On  
OIDCStripCookies mod\_auth\_openidc\_session mod\_auth\_openidc\_session\_chunks mod\_auth\_openidc\_session\_0 mod\_auth\_openidc\_session\_1

LuaRoot “/opt/ood/mod\_ood\_proxy/lib”  
LogLevel lua\_module:debug

LuaHookLog logger.lua logger

SetEnv OOD\_USER\_MAP\_MATCH “\*.”

SetEnv OOD\_PUN\_STAGE\_CMD “sudo /opt/ood/nginx\_stage/sbin/nginx\_stage”

SetEnv OOD\_ALLOWED\_HOSTS “plateforms”

---

<div class="post-metadata">

**Author:** ![nassim09](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/nassim09/32/1583_2.png) [@nassim09](https://discourse.openondemand.org/u/nassim09)\
**Post date:** [April 12, 2023, 1:29pm UTC](https://discourse.openondemand.org/t/error-failed-to-map-user-keycloak-dex-with-ldap-google-id/2613/6 "2023-04-12T13:29:53Z")

</div>

The wierd thing, even with basic auth, i can loging but same error !!!

auth:

- ‘AuthType Basic’
- ‘AuthName “private”’
- ‘RequestHeader unset Authorization’
- ‘AuthUserFile /etc/httpd/.htpasswd’
- ‘Require valid-user’

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [April 12, 2023, 1:39pm UTC](https://discourse.openondemand.org/t/error-failed-to-map-user-keycloak-dex-with-ldap-google-id/2613/7 "2023-04-12T13:39:23Z")

</div>

> [@nassim09](#):
>
> Error – can’t find user for nassim09  
> Run ‘nginx\_stage --help’ to see a full list of available command line options.  
> LOGS:  
> @/opt/ood/mod\_ood\_proxy/lib/ood/user\_map.lua(21): Mapped ‘nassim09@gmail.com’ =\> ‘nassim09’ [13.879 ms]

The configuration that got you here is good. This is what you’d want to see. Of course you need to actually have the the Linux local user `nassim09`. That’s what _this_ error is referring to, we’re able to map you correctly to a user, only that user doesn’t exist on the system. Without tying into an LDAP you’d have to create these users manually.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex015/uploads/osc/original/2X/b/bae70bd0ed39a3ae769c2108155f4cb3e9da8385.png) [@system](https://discourse.openondemand.org/u/system)\
**Post date:** [October 9, 2023, 1:39pm UTC](https://discourse.openondemand.org/t/error-failed-to-map-user-keycloak-dex-with-ldap-google-id/2613/8 "2023-10-09T13:39:24Z")

</div>

This topic was automatically closed 180 days after the last reply. New replies are no longer allowed.