-
Clarification
-
Resolution: Unresolved
-
Major
-
None
-
1.19.1.Final
-
None
-
None
Ours is a wildfly based application. We configured Keycloak OIDC with elytron. This integration works well in all our environments except this one. On hitting any URL, it returns 403 Forbidden error.
On enabling TRACE level, I could see these logs when hitting the application endpoint:
{"log_timestamp": "2023-03-31T12:34:38.629+0000", "log_level": "TRACE", "process_id": 1, "process_name": "myapp", "thread_id": 1, "thread_name": "default task-1", "action_name": "org.wildfly.security.http.servlet", "log_message": "Created ServletSecurityContextImpl enableJapi=true, integratedJaspi=true, applicationContext=default-host /my-app"}
{"log_timestamp": "2023-03-31T12:34:38.629+0000", "log_level": "TRACE", "process_id": 1, "process_name": "myapp", "thread_id": 1, "thread_name": "default task-1", "action_name": "org.wildfly.security.http.servlet", "log_message": "No AuthConfigProvider for layer=HttpServlet, appContext=default-host /my-app"}
{"log_timestamp": "2023-03-31T12:34:38.629+0000", "log_level": "TRACE", "process_id": 1, "process_name": "myapp", "thread_id": 1, "thread_name": "default task-1", "action_name": "org.wildfly.security.http.servlet", "log_message": "JASPIC Unavailable, using HTTP authentication."}
{"log_timestamp": "2023-03-31T12:34:38.629+0000", "log_level": "TRACE", "process_id": 1, "process_name": "myapp", "thread_id": 1, "thread_name": "default task-1", "action_name": "org.wildfly.security", "log_message": "No CachedIdentity to restore."}
{"log_timestamp": "2023-03-31T12:34:38.629+0000", "log_level": "TRACE", "process_id": 1, "process_name": "myapp", "thread_id": 1, "thread_name": "default task-1", "action_name": "org.wildfly.security", "log_message": "Created HttpServerAuthenticationMechanism [org.wildfly.security.auth.server.SecurityIdentityServerMechanismFactory$1@611230fa] for mechanism [OIDC]"}
{"log_timestamp": "2023-03-31T12:34:38.630+0000", "log_level": "DEBUG", "process_id": 1, "process_name": "myapp", "thread_id": 1, "thread_name": "default task-1", "action_name": "org.wildfly.security.http.oidc", "log_message": "adminRequest http://localhost:8180/my-app/"}
{"log_timestamp": "2023-03-31T12:34:38.630+0000", "log_level": "TRACE", "process_id": 1, "process_name": "myapp", "thread_id": 1, "thread_name": "default task-1", "action_name": "org.wildfly.security.http.oidc", "log_message": "--> authenticate()"}
{"log_timestamp": "2023-03-31T12:34:38.630+0000", "log_level": "TRACE", "process_id": 1, "process_name": "myapp", "thread_id": 1, "thread_name": "default task-1", "action_name": "org.wildfly.security.http.oidc", "log_message": "try bearer"}
{"log_timestamp": "2023-03-31T12:34:38.630+0000", "log_level": "TRACE", "process_id": 1, "process_name": "myapp", "thread_id": 1, "thread_name": "default task-1", "action_name": "org.wildfly.security.http.oidc", "log_message": "try query parameter auth"}
{"log_timestamp": "2023-03-31T12:34:38.630+0000", "log_level": "TRACE", "process_id": 1, "process_name": "myapp", "thread_id": 1, "thread_name": "default task-1", "action_name": "org.wildfly.security.http.oidc", "log_message": "try basic auth"}
{"log_timestamp": "2023-03-31T12:34:38.630+0000", "log_level": "TRACE", "process_id": 1, "process_name": "myapp", "thread_id": 1, "thread_name": "default task-1", "action_name": "org.wildfly.security.http.oidc", "log_message": "try oidc"}
{"log_timestamp": "2023-03-31T12:34:38.630+0000", "log_level": "DEBUG", "process_id": 1, "process_name": "myapp", "thread_id": 1, "thread_name": "default task-1", "action_name": "org.wildfly.security.http.oidc", "log_message": "Account was not in session, returning null"}
{"log_timestamp": "2023-03-31T12:34:38.630+0000", "log_level": "DEBUG", "process_id": 1, "process_name": "myapp", "thread_id": 1, "thread_name": "default task-1", "action_name": "org.wildfly.security.http.oidc", "log_message": "there was no code"}
{"log_timestamp": "2023-03-31T12:34:38.630+0000", "log_level": "DEBUG", "process_id": 1, "process_name": "myapp", "thread_id": 1, "thread_name": "default task-1", "action_name": "org.wildfly.security.http.oidc", "log_message": "redirecting to auth server"}
{"log_timestamp": "2023-03-31T12:34:38.630+0000", "log_level": "DEBUG", "process_id": 1, "process_name": "myapp", "thread_id": 1, "thread_name": "default task-1", "action_name": "org.wildfly.security.http.oidc", "log_message": "callback uri: http://localhost:8180/my-app/"}
{"log_timestamp": "2023-03-31T12:34:38.630+0000", "log_level": "DEBUG", "process_id": 1, "process_name": "myapp", "thread_id": 1, "thread_name": "default task-1", "action_name": "org.wildfly.security.http.oidc", "log_message": "Loading OpenID provider metadata from https://myidp.com/realm/myrealm/.well-known/openid-configuration"}
{"log_timestamp": "2023-03-31T12:34:38.632+0000", "log_level": "WARN", "process_id": 1, "process_name": "myapp", "thread_id": 1, "thread_name": "default task-1", "action_name": "org.wildfly.security.http.oidc", "log_message": "ELY23005: Unable to load OpenID provider metadata from https://myidp.com/realm/myrealm/.well-known/openid-configuration"}
On looking at the source code of this log, there's no evidence which line is causing the exception.
Few clues:
- All our environments are created with same Helm, so there's no question of integrity or sanity.
- HTTPS Certificate of IDP is issued by a trusted CA.
- From within the container, we are able to hit the metadata URL in last line (attached for reference).
- Also attached standalone.xml
- IDP provider is Keycloak. Compared Realm settings, client settings and found no difference. Tried pointing this app to a different Keycloak instance, but getting same issue.
