SAML Config

[quer0016]

Hello team, I have configured SAML with Cloudconnexa but I have the following problems:

1. I can only validate the admin user
2. I cannot use two-factor methods in SAML validation

The configuration in cloudconnexa:

The configuration in KC:


When I log in with SAML:

And loging ok:

The problem is that if I try to access with another user other than the admin, it does not access despite existing in the local jans database.
And on the other hand, the login is done from keycloak and not jans-casa, so if I have a two-factor method, it is not used

[nynymike]

@uprightech can you investigate?

[uprightech]

A separate realm is used for janssen related resources on keycloak called jans. I can see from the screenshot you're referring to the master realm. Could you replace the IDP authentication endpoint and make sure it points to the jans realm and also that the users are created within that realm and then try again?
Thanks

[quer0016]

Hello team,
I have now this config:
In cloudconnexa

In KC - Flex:

Users:

Login has not yet been done through jans-casa

Login test:
user admin:

user test:

logs:

[nynymike]

I don't understand why you are using the KC admin GUI to configure KC. We only support configuration via the Jans Config API, e.g. using the CLI or TUI.

[quer0016]

Because I have tried it from the adminui as well as from the TUI and it has not worked.
I can configure again by those means and see what happens.

[nynymike]

We only support the Gluu interface. If you start managing stuff directly in KC, you'll need to post of the KC forums :-)

[quer0016]

Config TUI SAML

Access test:

The problem I have when doing it from the TUI or adminui I have tried loading the XML and manually

[nynymike]

@uprightech can you try to replicate?

[uprightech]

Sure , let me look into it

[quer0016]

Hello team.
I have tried to configure SAML with Nextcloud and I detect that the same problem occurs despite configuring from the ADMINUI with the XML or manually

In Nextcloud:

SAML Tracer:

[uprightech]

Please could you provide us with the keycloak logs in /opt/keycloak/logs/ ? That would be helpful , thank you.

[quer0016]

2024-05-10 12:13:00,587 INFO [org.keycloak.quarkus.runtime.hostname.DefaultHostnameProvider] (main) Hostname settings: Base URL: <unset>, Hostname: test.test.es, Strict HTTPS: true, Path: /kc, Strict BackChannel: false, Admin URL: <unset>, Admin: test.test.es, Port: -1, Proxied: true 2024-05-10 12:13:03,105 WARN [io.quarkus.agroal.runtime.DataSources] (main) Datasource <default> enables XA but transaction recovery is not enabled. Please enable transaction recovery by setting quarkus.transaction-manager.enable-recovery=true, otherwise data may be lost if the application is terminated abruptly 2024-05-10 12:13:03,438 WARN [org.infinispan.PERSISTENCE] (keycloak-cache-init) ISPN000554: jboss-marshalling is deprecated and planned for removal 2024-05-10 12:13:03,610 WARN [org.infinispan.CONFIG] (keycloak-cache-init) ISPN000569: Unable to persist Infinispan internal caches as no global state enabled 2024-05-10 12:13:03,738 INFO [org.infinispan.CONTAINER] (keycloak-cache-init) ISPN000556: Starting user marshaller 'org.infinispan.jboss.marshalling.core.JBossUserMarshaller' 2024-05-10 12:13:05,540 WARN [io.quarkus.vertx.http.runtime.VertxHttpRecorder] (main) The X-Forwarded-* and Forwarded headers will be considered when determining the proxy address. This configuration can cause a security issue as clients can forge requests and send a forwarded header that is not overwritten by the proxy. Please consider use one of these headers just to forward the proxy address in requests. 2024-05-10 12:13:05,956 INFO [org.keycloak.connections.infinispan.DefaultInfinispanConnectionProviderFactory] (main) Node name: node_642232, Site name: null 2024-05-10 12:13:05,966 INFO [org.keycloak.broker.provider.AbstractIdentityProviderMapper] (main) Registering class org.keycloak.broker.provider.mappersync.ConfigSyncEventListener 2024-05-10 12:13:07,135 INFO [io.quarkus] (main) Keycloak 23.0.3 on JVM (powered by Quarkus 3.2.9.Final) started in 8.707s. Listening on: http://127.0.0.1:8083 2024-05-10 12:13:07,136 INFO [io.quarkus] (main) Profile dev activated. 2024-05-10 12:13:07,136 INFO [io.quarkus] (main) Installed features: [agroal, cdi, hibernate-orm, jdbc-h2, jdbc-mariadb, jdbc-mssql, jdbc-mysql, jdbc-oracle, jdbc-postgresql, keycloak, logging-gelf, micrometer, narayana-jta, reactive-routes, resteasy-reactive, resteasy-reactive-jackson, smallrye-context-propagation, smallrye-health, vertx] 2024-05-10 12:13:07,218 WARN [org.keycloak.quarkus.runtime.KeycloakMain] (main) Running the server in development mode. DO NOT use this configuration in production. 2024-05-17 08:35:36,915 WARN [org.keycloak.events] (executor-thread-1) type=LOGIN_ERROR, realmId=281764bf-821f-4222-b2c3-74bce9453444, clientId=null, userId=null, ipAddress=85.62.184.58, error=client_not_found, reason=Cannot_match_source_hash 2024-05-17 08:36:20,012 WARN [org.keycloak.events] (executor-thread-2) type=LOGIN_ERROR, realmId=281764bf-821f-4222-b2c3-74bce9453444, clientId=null, userId=null, ipAddress=85.62.184.58, error=client_not_found, reason=Cannot_match_source_hash 2024-05-17 08:38:16,812 WARN [org.keycloak.events] (executor-thread-8) type=LOGIN_ERROR, realmId=281764bf-821f-4222-b2c3-74bce9453444, clientId=null, userId=null, ipAddress=85.62.184.58, error=client_not_found, reason=Cannot_match_source_hash 2024-05-17 08:44:38,163 WARN [org.keycloak.events] (executor-thread-10) type=LOGIN_ERROR, realmId=281764bf-821f-4222-b2c3-74bce9453444, clientId=null, userId=null, ipAddress=85.62.184.58, error=client_not_found, reason=Cannot_match_source_hash 2024-05-17 08:45:05,019 WARN [org.keycloak.events] (executor-thread-14) type=LOGIN_ERROR, realmId=281764bf-821f-4222-b2c3-74bce9453444, clientId=null, userId=null, ipAddress=85.62.184.58, error=client_not_found, reason=Cannot_match_source_hash 2024-05-17 08:48:50,109 WARN [org.keycloak.events] (executor-thread-13) type=LOGIN_ERROR, realmId=281764bf-821f-4222-b2c3-74bce9453444, clientId=null, userId=null, ipAddress=85.62.184.58, error=client_not_found, reason=Cannot_match_source_hash 2024-05-17 08:50:20,684 WARN [org.keycloak.events] (executor-thread-16) type=LOGIN_ERROR, realmId=281764bf-821f-4222-b2c3-74bce9453444, clientId=null, userId=null, ipAddress=85.62.184.58, error=client_not_found, reason=Cannot_match_source_hash 2024-05-17 08:52:36,309 WARN [org.keycloak.events] (executor-thread-19) type=LOGIN_ERROR, realmId=281764bf-821f-4222-b2c3-74bce9453444, clientId=null, userId=null, ipAddress=85.62.184.58, error=client_not_found, reason=Cannot_match_source_hash 2024-05-17 08:53:05,925 WARN [org.keycloak.events] (executor-thread-23) type=LOGIN_ERROR, realmId=281764bf-821f-4222-b2c3-74bce9453444, clientId=null, userId=null, ipAddress=85.62.184.58, error=client_not_found, reason=Cannot_match_source_hash 2024-05-17 08:54:24,639 WARN [org.keycloak.events] (executor-thread-23) type=LOGIN_ERROR, realmId=281764bf-821f-4222-b2c3-74bce9453444, clientId=null, userId=null, ipAddress=85.62.184.58, error=client_not_found, reason=Cannot_match_source_hash 2024-05-17 08:54:58,071 WARN [org.keycloak.events] (executor-thread-26) type=LOGIN_ERROR, realmId=281764bf-821f-4222-b2c3-74bce9453444, clientId=null, userId=null, ipAddress=85.62.184.58, error=client_not_found, reason=Cannot_match_source_hash

[uprightech]

Hello,
We may need to increase the log level to see what is happening , but first , could you log into keycloak , and send me a screenshot of the list of clients in the jans realm ? Thank you.

[uprightech]

I am sorry to hear that.
I'll verify again and get back to you. Thanks for testing.

[quer0016]

Hi @uprightech
Something new? I can´t use SAML or OpenID on my server I tried but nothing :(

[uprightech]

Hello @quer0016 ,
I have figured both issues , It just took some time to get back to you. I have this scheduled for Friday morning. We'll sort both out , hoping Friday works for you . We're also making some enhancements/bugfixes to saml which will be available soon enough.
I'll keep you posted.

[quer0016]

Ok thanks is good for me.

[uprightech]

Hello @quer0016 , I'll be with you shortly for the OpenID issue

[quer0016]

Hello @uprightech, Something new?

[quer0016]

Hello @uprightech, Nice I am waiting for the new version to test. Regarding OpenID, what is the solution or is it still unknown?

[uprightech]

Sorry for the late reply. The OpenID issue seems to be how your RP passes some OpenID connect parameters to our Authorization Server. I'll update you further in the morning.

[quer0016]

Ok thanks I await your reply.

[uprightech]

Hello @quer0016 ,
The SAML issues have been resolved. Can you try with jans_1.1.3 ?
Also , after adding a SAML SP , allow about 10 minutes for configuration sync to happen between Keycloak and Janssen. We may have to reduce it , but that's the default.

As for the OpenID issues , let me do a write up on that for Monday.

Thanks again

[quer0016]

Hello @uprightech,
I installed jans_1.1.3 but the problem is still present, I performed the SAML config on friday, but today the same problem persists:

[uprightech]

This is weird. Let's see if the scheduler ran during that time. Could you provide me with the log files located in /opt/kc-scheduler/logs/ ?

[uprightech]

In addition , could you run the following and provide me with the output ?
/opt/jans/printVersion.py

[quer0016]

hello @uprightech,
The problem was in the XML that cloudconnexa generates, apparently Jans doesn't like it and it gives an error, I configured it manually and it worked as you told me, I waited 10 minutes and it appeared in KC, thank you. Is the openid also corrected with this version?

[uprightech]

Hello @quer0016 , I'm happy to hear it works. Could we get a copy of the XML and also a screenshot of the error ? It would be good to see how to improve support for different SPs. For the OpenID issue , I do not think so. Did you open a separate ticket , because the logs you provided for the OpenID issue aren't here

[quer0016]

2024-07-15 09:40:06,078:WARN  [io.jans.kc.scheduler.TrustRelationshipSyncJob:127] - Could not create managed SAML client using tr with inum 85f663ff-a382-4921-989f-076fd3a03ca7
2024-07-15 09:40:06,079:WARN  [io.jans.kc.scheduler.TrustRelationshipSyncJob:128] - Resulting exception:
io.jans.kc.api.config.client.JansConfigApiError: SAML metadata parsing failed
        at io.jans.kc.api.config.client.JansConfigApi.getTrustRelationshipFileMetadata(JansConfigApi.java:104)
Caused by: io.jans.saml.metadata.parser.ParseError: Metadata parsing failed
        at io.jans.saml.metadata.parser.SAMLMetadataParser.parse(SAMLMetadataParser.java:85)
Caused by: javax.xml.xpath.XPathExpressionException: javax.xml.transform.TransformerException: Prefix must resolve to a namespace: xml
        at java.xml/com.sun.org.apache.xpath.internal.jaxp.XPathImpl.evaluate(XPathImpl.java:149)
Caused by: javax.xml.transform.TransformerException: Prefix must resolve to a namespace: xml
        at java.xml/com.sun.org.apache.xpath.internal.compiler.XPathParser.error(XPathParser.java:627)

XML:
<?xml version="1.0" encoding="UTF-8"?><md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" entityID="devcloudnexaquer.openvpn.cloud"><md:SPSSODescriptor WantAssertionsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"><md:Organization><md:OrganizationName xmlns:xml="http://www.w3.org/XML/1998/namespace" xml:lang="en">OpenVPN Inc.</md:OrganizationName><md:OrganizationDisplayName xmlns:xml="http://www.w3.org/XML/1998/namespace" xml:lang="en">OpenVPN Inc.</md:OrganizationDisplayName><md:OrganizationURL xmlns:xml="http://www.w3.org/XML/1998/namespace" xml:lang="en">https://openvpn.com</md:OrganizationURL></md:Organization><md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat><md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat><md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</md:NameIDFormat><md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://sso-backend.openvpn.com/sso/api/v1/saml/acs" index="1" isDefault="true"/><md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://sso-backend.openvpn.com/sso/api/v1/saml/acs" index="2"/></md:SPSSODescriptor></md:EntityDescriptor>