[keycloak-user] Authroization: Receiving "Failed to enforce policy decisions" for valid token after sometime

Wed Oct 10 23:37:35 EDT 2018

I am using postman to create request. Attached screenshot of request.

Basically, I am generating token through KEYCLOAKINSTALLED.loginDesktop and
sending token in authorization bearer header to jetty adapter.

On Wed, Oct 10, 2018 at 10:33 PM Pedro Igor Silva <psilva at redhat.com> wrote:

> You are right, I'm going to fix that message.
>
> I could not reproduce this error, but I'm probably missing something. Are
> you using offline tokens ? Could you show how your authorization request
> looks like ?
>
> On Wed, Oct 10, 2018 at 12:31 PM Bruce Wings <testoauth55 at gmail.com>
> wrote:
>
>> As mentioned earlier,
>>
>> 1. After obtaining a token from keycloak, I am able to
>> authenticate/authorize user with this token.
>> 2. After sometime(15-20 minutes), I start receiving *"Failed to enforce
>> policy decisions"*. If the same token was valid a few minutes before,
>> shouldn't I get the "*token expired*" message instead of "*Failed to
>> enforce policy decisions*"?
>>
>> On Wed, Oct 10, 2018 at 6:16 PM Pedro Igor Silva <psilva at redhat.com>
>> wrote:
>>
>>> How your authorization request looks like ? It seems you are sending the
>>> ID Token as claim_token parameter ?
>>>
>>> On Wed, Oct 10, 2018 at 7:50 AM Bruce Wings <testoauth55 at gmail.com>
>>> wrote:
>>>
>>>> Any one else faced this issue?
>>>>
>>>> On Thu, Oct 4, 2018 at 9:50 AM Bruce Wings <testoauth55 at gmail.com>
>>>> wrote:
>>>>
>>>>> Yes. Please find below:
>>>>>
>>>>>
>>>>> 2018-10-04 09:48:43,985 ERROR
>>>>> [org.keycloak.authorization.authorization.AuthorizationTokenService]
>>>>> (default task-3) Unexpected error while evaluating permissions:
>>>>> java.lang.RuntimeException: Error while reading attributes from security
>>>>> token.
>>>>> at
>>>>> org.keycloak.authorization.common.KeycloakIdentity.<init>(KeycloakIdentity.java:139)
>>>>> at
>>>>> org.keycloak.authorization.common.KeycloakIdentity.<init>(KeycloakIdentity.java:68)
>>>>> at
>>>>> org.keycloak.authorization.authorization.AuthorizationTokenService.lambda$static$1(AuthorizationTokenService.java:124)
>>>>> at
>>>>> org.keycloak.authorization.authorization.AuthorizationTokenService.createEvaluationContext(AuthorizationTokenService.java:349)
>>>>> at
>>>>> org.keycloak.authorization.authorization.AuthorizationTokenService.authorize(AuthorizationTokenService.java:153)
>>>>> at
>>>>> org.keycloak.protocol.oidc.endpoints.TokenEndpoint.permissionGrant(TokenEndpoint.java:1143)
>>>>> at
>>>>> org.keycloak.protocol.oidc.endpoints.TokenEndpoint.processGrantRequest(TokenEndpoint.java:192)
>>>>> at sun.reflect.GeneratedMethodAccessor590.invoke(Unknown Source)
>>>>> at
>>>>> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
>>>>> at java.lang.reflect.Method.invoke(Method.java:498)
>>>>> at
>>>>> org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java:140)
>>>>> at
>>>>> org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTarget(ResourceMethodInvoker.java:295)
>>>>> at
>>>>> org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:249)
>>>>> at
>>>>> org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(ResourceLocatorInvoker.java:138)
>>>>> at
>>>>> org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:107)
>>>>> at
>>>>> org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(ResourceLocatorInvoker.java:133)
>>>>> at
>>>>> org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:101)
>>>>> at
>>>>> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:406)
>>>>> at
>>>>> org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:213)
>>>>> at
>>>>> org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:228)
>>>>> at
>>>>> org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56)
>>>>> at
>>>>> org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51)
>>>>> at javax.servlet.http.HttpServlet.service(HttpServlet.java:790)
>>>>> at
>>>>> io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:85)
>>>>> at
>>>>> io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129)
>>>>> at
>>>>> org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:90)
>>>>> at
>>>>> io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61)
>>>>> at
>>>>> io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
>>>>> at
>>>>> io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84)
>>>>> at
>>>>> io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62)
>>>>> at
>>>>> io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
>>>>> at
>>>>> org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78)
>>>>> at
>>>>> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>>>>> at
>>>>> io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:131)
>>>>> at
>>>>> io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57)
>>>>> at
>>>>> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>>>>> at
>>>>> io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)
>>>>> at
>>>>> io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)
>>>>> at
>>>>> io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)
>>>>> at
>>>>> io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77)
>>>>> at
>>>>> io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50)
>>>>> at
>>>>> io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)
>>>>> at
>>>>> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>>>>> at
>>>>> org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)
>>>>> at
>>>>> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>>>>> at
>>>>> org.wildfly.extension.undertow.deployment.GlobalRequestControllerHandler.handleRequest(GlobalRequestControllerHandler.java:68)
>>>>> at
>>>>> io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
>>>>> at
>>>>> io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:292)
>>>>> at
>>>>> io.undertow.servlet.handlers.ServletInitialHandler.access$100(ServletInitialHandler.java:81)
>>>>> at
>>>>> io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:138)
>>>>> at
>>>>> io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:135)
>>>>> at
>>>>> io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:48)
>>>>> at
>>>>> io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43)
>>>>> at
>>>>> org.wildfly.extension.undertow.security.SecurityContextThreadSetupAction.lambda$create$0(SecurityContextThreadSetupAction.java:105)
>>>>> at
>>>>> org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1508)
>>>>> at
>>>>> org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1508)
>>>>> at
>>>>> org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1508)
>>>>> at
>>>>> org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1508)
>>>>> at
>>>>> io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:272)
>>>>> at
>>>>> io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81)
>>>>> at
>>>>> io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:104)
>>>>> at
>>>>> io.undertow.server.Connectors.executeRootHandler(Connectors.java:326)
>>>>> at
>>>>> io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:812)
>>>>> at
>>>>> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
>>>>> at
>>>>> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
>>>>> at java.lang.Thread.run(Thread.java:748)
>>>>> Caused by: java.lang.NullPointerException
>>>>> at
>>>>> org.keycloak.authorization.common.KeycloakIdentity.<init>(KeycloakIdentity.java:121)
>>>>> ... 65 more
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>
>>>>> On Wed, Oct 3, 2018 at 5:48 PM Pedro Igor Silva <psilva at redhat.com>
>>>>> wrote:
>>>>>
>>>>>> Do you have a stacktrace ?
>>>>>>
>>>>>> On Wed, Oct 3, 2018 at 3:50 AM Bruce Wings <testoauth55 at gmail.com>
>>>>>> wrote:
>>>>>>
>>>>>>> Has anyone else come across this issue?
>>>>>>>
>>>>>>> On Fri, Sep 28, 2018 at 12:14 PM Bruce Wings <testoauth55 at gmail.com>
>>>>>>> wrote:
>>>>>>>
>>>>>>> > Steps:
>>>>>>> >
>>>>>>> > 1. After obtaining a token from keycloak, I am able to
>>>>>>> > authenticate/authorize user with this token.
>>>>>>> > 2. After sometime(15-20 minutes), I start receiving *"Failed to
>>>>>>> enforce
>>>>>>> > policy decisions"*. If the same token was valid a few minutes
>>>>>>> before,
>>>>>>> > shouldn't I get the "*token expired*" message instead of "*Failed
>>>>>>> to
>>>>>>> > enforce policy decisions*"?
>>>>>>> >
>>>>>>> > My access token lifespan is set to 8 hours. Still I see this
>>>>>>> behavior
>>>>>>> > after just 15-20 minutes. Attached image for token expiry settings:
>>>>>>> >
>>>>>>> >
>>>>>>> > [image: image.png]
>>>>>>> >
>>>>>>> _______________________________________________
>>>>>>> keycloak-user mailing list
>>>>>>> keycloak-user at lists.jboss.org
>>>>>>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>>>>>
>>>>>>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: request.JPG
Type: image/jpeg
Size: 36703 bytes
Desc: not available
Url : http://lists.jboss.org/pipermail/keycloak-user/attachments/20181011/7aef710c/attachment-0001.jpe 