Keycloak on ondemand having issue

prod-feng · October 27, 2023, 8:35pm

One question:

to set up OOD + Keycloak, do I also need to set up CILogon too?

tdockendorf · October 27, 2023, 11:06pm

With OnDemand if you login to Keycloak with username “foo” that username must exist on the Linux host running OnDemand. If you connected Keycloak to LDAP then the host running OnDemand must also be aware of the LDAP user using something like SSSD. You should be able to run getent passwd foo on the OnDemand host and lookup the foo user.

The error from nginx_stage about not finding testkeycloak means that if you did getent passwd testkeycloak on the OnDemand host, that should return a user.

Keycloak does not need to run as root. It can run as unprivileged user. The OnDemand stack will execute a specific command using sudo to become the user who logs into OnDemand. OnDemand itself runs as whomever is logged into OnDemand, so if I , tdockendorf logged into OSC OnDemand, the processes on the OnDemand host for my session would be running as tdockendorf. That is what nginx_stage handles among other things.

prod-feng · October 28, 2023, 2:24am

Thanks, @tdockendorf for your patient explanation! I am now understanding it more.

I have now added local user on the server, and from the OOD webportal I can login to OOD using this testkeycloak account.

Now the only issue is that I can not login using my LDAP account. On this server, I can getent passwd myusername, we use nslcd to connect ther server to an external LDAP server.

I may missed something in the “User Federation” ldap setting. Is there any way I can test on the Keycloak?

The system log about the login event is:

Oct 27 22:16:26 xxx kc.sh[3838433]: 2023-10-27 22:16:26,578 INFO [org.keycloak.storage.ldap.LDAPIdentityStoreRegistry] (executor-thread-9) Creating new LDAP Store for the LDAP storage provider: ‘ldap’, LDAP Configuration: {fullSyncPeriod=[-1], pagination=[false], startTls=[false], connectionPooling=[false], usersDn=[xxx], cachePolicy=[DEFAULT], useKerberosForPasswordAuthentication=[false], importEnabled=[false], enabled=[true], changedSyncPeriod=[-1], usernameLDAPAttribute=[cn], bindDn=[xxx], vendor=[other], uuidLDAPAttribute=[uidNumber], allowKerberosAuthentication=[false], connectionUrl=[ldaps://xxx:636], syncRegistrations=[false], authType=[simple], krbPrincipalAttribute=[krb5PrincipalName], customUserSearchFilter=[xxx], useTruststoreSpi=[always], usePasswordModifyExtendedOp=[false], trustEmail=[false], userObjectClasses=[inetOrgPerson, organizationalPerson, xxx], rdnLDAPAttribute=[cn], editMode=[READ_ONLY], validatePasswordPolicy=[false]}, binaryAttributes:
Oct 27 22:16:26 xxn kc.sh[3838433]: 2023-10-27 22:16:26,602 INFO [org.keycloak.truststore.SSLSocketFactory] (executor-thread-9) No truststore provider found - using default SSLSocketFactory
Oct 27 22:16:26 xxx kc.sh[3838433]: 2023-10-27 22:16:26,717 WARN [org.keycloak.events] (executor-thread-9) type=LOGIN_ERROR, realmId=fff93fdc-e378-4dae-ab3f-fbc985020056, clientId=ondemand, userId=null, ipAddress=xxx, error=user_not_found, auth_method=openid-connect, auth_type=code, redirect_uri=https://xxx/oidc, code_id=be92f815-af73-4866-86ea-1f7b73c55fb9, username=xxx

prod-feng · October 28, 2023, 2:42pm

Hi @tdockendorf,

Here is the setting of the LDAP on Keycloak for our server, looks different from yours, maybe because we are using Keycloak 22?

"org.keycloak.storage.UserStorageProvider" : [ {
  "id" : "811729e0-887e-4589-82ba-144ae72c35eb",
  "name" : "ldap",
  "providerId" : "ldap",
  "subComponents" : {
    "org.keycloak.storage.ldap.mappers.LDAPStorageMapper" : [ {
      "id" : "f615204e-ca17-4e04-94a3-c84ace3e626c",
      "name" : "username",
      "providerId" : "user-attribute-ldap-mapper",
      "subComponents" : { },
      "config" : {
        "ldap.attribute" : [ "cn" ],
        "is.mandatory.in.ldap" : [ "true" ],
        "read.only" : [ "true" ],
        "always.read.value.from.ldap" : [ "false" ],
        "user.model.attribute" : [ "username" ]
      }
    }, {
      "id" : "8c80fdb2-bb16-43ff-91c4-c1d9e5c131bc",
      "name" : "last name",
      "providerId" : "user-attribute-ldap-mapper",
      "subComponents" : { },
      "config" : {
        "ldap.attribute" : [ "sn" ],
        "is.mandatory.in.ldap" : [ "true" ],
        "always.read.value.from.ldap" : [ "true" ],
        "read.only" : [ "true" ],
        "user.model.attribute" : [ "lastName" ]
      }
    }, {
      "id" : "8c80fdb2-bb16-43ff-91c4-c1d9e5c131bc",
      "name" : "last name",
      "providerId" : "user-attribute-ldap-mapper",
      "subComponents" : { },
      "config" : {
        "ldap.attribute" : [ "sn" ],
        "is.mandatory.in.ldap" : [ "true" ],
        "always.read.value.from.ldap" : [ "true" ],
        "read.only" : [ "true" ],
        "user.model.attribute" : [ "lastName" ]
      }
    }, {
      "id" : "cd971510-c509-4e91-95f6-9d1971b8ec58",
      "name" : "email",
      "providerId" : "user-attribute-ldap-mapper",
      "subComponents" : { },
      "config" : {
        "ldap.attribute" : [ "mail" ],
        "is.mandatory.in.ldap" : [ "false" ],
        "read.only" : [ "true" ],
        "always.read.value.from.ldap" : [ "false" ],
        "user.model.attribute" : [ "email" ]
      }
    }, {
      "id" : "a2315378-5159-4cd8-9c60-643778cf3175",
      "name" : "creation date",
      "providerId" : "user-attribute-ldap-mapper",
      "subComponents" : { },
      "config" : {
        "ldap.attribute" : [ "whenCreated" ],
        "is.mandatory.in.ldap" : [ "false" ],
        "attribute.force.default" : [ "true" ],
        "is.binary.attribute" : [ "false" ],
        "read.only" : [ "true" ],
        "always.read.value.from.ldap" : [ "true" ],
        "user.model.attribute" : [ "createTimestamp" ]
      }
   }, {
      "id" : "c63091eb-2313-4973-a394-0a095d402f36",
      "name" : "first name",
      "providerId" : "user-attribute-ldap-mapper",
      "subComponents" : { },
      "config" : {
        "ldap.attribute" : [ "givenName" ],
        "is.mandatory.in.ldap" : [ "true" ],
        "read.only" : [ "true" ],
        "always.read.value.from.ldap" : [ "true" ],
        "user.model.attribute" : [ "firstName" ]
      }
    }, {
      "id" : "cb601f3e-8db7-4e19-95a2-c79dabf312ca",
      "name" : "modify date",
      "providerId" : "user-attribute-ldap-mapper",
      "subComponents" : { },
      "config" : {
        "ldap.attribute" : [ "whenChanged" ],
        "attribute.force.default" : [ "true" ],
        "is.mandatory.in.ldap" : [ "false" ],
        "is.binary.attribute" : [ "false" ],
        "always.read.value.from.ldap" : [ "true" ],
        "read.only" : [ "true" ],
        "user.model.attribute" : [ "modifyTimestamp" ]
      }
    } ]
  },

prod-feng · October 28, 2023, 2:44pm

and

  "config" : {
    "fullSyncPeriod" : [ "-1" ],
    "pagination" : [ "false" ],
    "startTls" : [ "false" ],
    "usersDn" : [ "dc=xx,dc=xx,dc=xx" ],
    "connectionPooling" : [ "false" ],
    "cachePolicy" : [ "DEFAULT" ],
    "useKerberosForPasswordAuthentication" : [ "false" ],
    "importEnabled" : [ "false" ],
    "enabled" : [ "true" ],
    "bindDn" : [ "CN=xx" ],
    "usernameLDAPAttribute" : [ "cn" ],
    "bindCredential" : [ "xxx" ],
    "changedSyncPeriod" : [ "-1" ],
    "vendor" : [ "other" ],
    "uuidLDAPAttribute" : [ "uidNumber" ],
    "allowKerberosAuthentication" : [ "false" ],
    "connectionUrl" : [ "ldaps://xx:636" ],
    "syncRegistrations" : [ "false" ],
    "authType" : [ "simple" ],
    "krbPrincipalAttribute" : [ "krb5PrincipalName" ],
    "searchScope" : [ "2" ],
    "useTruststoreSpi" : [ "always" ],
    "usePasswordModifyExtendedOp" : [ "false" ],
    "trustEmail" : [ "false" ],
    "userObjectClasses" : [ "inetOrgPerson, organizationalPerson, stonybrookEduPerson" ],
    "rdnLDAPAttribute" : [ "cn" ],
    "editMode" : [ "READ_ONLY" ],
    "validatePasswordPolicy" : [ "false" ]
  }
} ],

prod-feng · October 28, 2023, 2:49pm

One thing I am thinking:

Since we are running the Keycloak on the same host as OOD, and we are using the the SSL key for both the OOD virtual host on port 443, and KC on port 8443. The SSL key is obtained by using the FQDN of the server, could this be caused by the mismatch of the SSL key when KC:8443 trying to contact the LDAP server?

Thanks!

prod-feng · October 29, 2023, 12:57am

OK I found the issue I had. It is the user object class which was set wrong. Now I can login using LDAP user account.

When I tried to compile the Keycloak-duo-spi, looks like there is an big issue:

To install maven, it will install java-jdk-1.8, while I already have java 17 which needed by Keycloak 22. I force to install maven and then removed the java 1.8. Using java 17 to compile the Keycloak-duo-spi, it then failed as:

Can any help?

Thanks!

[INFO] Error stacktraces are turned on.

[INFO] Scanning for projects…

[INFO]

[INFO] -----------------------< com.duosecurity:DuoWeb >-----------------------

[INFO] Building DuoWeb 1.3

[INFO] --------------------------------[ jar ]---------------------------------

[INFO]

[INFO] — maven-clean-plugin:2.5:clean (default-clean) @ DuoWeb —

[INFO] Deleting xxx/keycloak-duo-spi/build/duo_java/DuoWeb/target

[INFO]

[INFO] — maven-resources-plugin:2.6:resources (default-resources) @ DuoWeb —

[WARNING] Using platform encoding (UTF-8 actually) to copy filtered resources, i.e. build is platform dependent!

[INFO] skip non existing resourceDirectory xxx/keycloak-duo-spi/build/duo_java/DuoWeb/src/main/resources

[INFO]

[INFO] — maven-compiler-plugin:3.1:compile (default-compile) @ DuoWeb —

[INFO] Changes detected - recompiling the module!

[WARNING] File encoding has not been set, using platform encoding UTF-8, i.e. build is platform dependent!

[INFO] Compiling 4 source files to /xxx/keycloak-duo-spi/build/duo_java/DuoWeb/target/classes

[INFO] -------------------------------------------------------------

[ERROR] COMPILATION ERROR :

[INFO] -------------------------------------------------------------

[ERROR] Source option 5 is no longer supported. Use 7 or later.

[ERROR] Target option 5 is no longer supported. Use 7 or later.

[INFO] 2 errors

[INFO] -------------------------------------------------------------

[INFO] ------------------------------------------------------------------------

[INFO] BUILD FAILURE

[INFO] ------------------------------------------------------------------------

[INFO] Total time: 0.698 s

[INFO] Finished at: 2023-10-28T20:49:00-04:00

[INFO] ------------------------------------------------------------------------

[ERROR] Failed to execute goal org.apache.maven.plugins:maven-compiler-plugin:3.1:compile (default-compile) on project DuoWeb: Compilation failure: Compilation failure:

[ERROR] Source option 5 is no longer supported. Use 7 or later.

[ERROR] Target option 5 is no longer supported. Use 7 or later.

[ERROR] → [Help 1]

org.apache.maven.lifecycle.LifecycleExecutionException: Failed to execute goal org.apache.maven.plugins:maven-compiler-plugin:3.1:compile (default-compile) on project DuoWeb: Compilation failure

at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:213)

at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:154)

at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:146)

at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:117)

at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:81)

at org.apache.maven.lifecycle.internal.builder.singlethreaded.SingleThreadedBuilder.build (SingleThreadedBuilder.java:56)

at org.apache.maven.lifecycle.internal.LifecycleStarter.execute (LifecycleStarter.java:128)

at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:305)

at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:192)

at org.apache.maven.DefaultMaven.execute (DefaultMaven.java:105)

at org.apache.maven.cli.MavenCli.execute (MavenCli.java:954)

at org.apache.maven.cli.MavenCli.doMain (MavenCli.java:288)

at org.apache.maven.cli.MavenCli.main (MavenCli.java:192)

at jdk.internal.reflect.NativeMethodAccessorImpl.invoke0 (Native Method)

at jdk.internal.reflect.NativeMethodAccessorImpl.invoke (NativeMethodAccessorImpl.java:77)

at jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke (DelegatingMethodAccessorImpl.java:43)

at java.lang.reflect.Method.invoke (Method.java:568)

at org.codehaus.plexus.classworlds.launcher.Launcher.launchEnhanced (Launcher.java:289)

at org.codehaus.plexus.classworlds.launcher.Launcher.launch (Launcher.java:229)

at org.codehaus.plexus.classworlds.launcher.Launcher.mainWithExitCode (Launcher.java:415)

at org.codehaus.plexus.classworlds.launcher.Launcher.main (Launcher.java:356)

Caused by: org.apache.maven.plugin.compiler.CompilationFailureException: Compilation failure

at org.apache.maven.plugin.compiler.AbstractCompilerMojo.execute (AbstractCompilerMojo.java:858)

at org.apache.maven.plugin.compiler.CompilerMojo.execute (CompilerMojo.java:129)

at org.apache.maven.plugin.DefaultBuildPluginManager.executeMojo (DefaultBuildPluginManager.java:137)

at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:208)