1:34 p.m.
Typical, spent two days faffing on this and as soon as I ask the forum,
I find it. I repointed the kc proxy "auth-server-url" direct at
keycloak and it works fine. Point it at the nginx proxied version of
keycloak and it dies. It authenticates, and the user sessions show in
the keycloak console, and SSO works, as I can go to another URL and that
too shows a session but neither page renders when keyclaok is behind
nginx.
anyone had a similar experience?
On 2016-05-24 11:25, Guy Bowdler wrote:
It might be this, as we have the keycloak instance running behind
another nginx proxy:
https://issues.jboss.org/browse/KEYCLOAK-2054
If anyone can help confirm this is would be a massive help as the fix
isn't due out until June 22 and would save unnecessary troubleshooting
On 2016-05-24 10:48, Guy Bowdler wrote:
> Hi:)
>
> Has anybody seen this error?
>
> I have (http://host.name/appname) --> [KeyCloakProxy:80 -->
> nginx:8080]
> --> [Web apps on different boxes] where [] denotes on same box.
> Namespace is hostname/appname where nginx location directives proxy
> out
> again to different boxes.
>
> I've previously had this working but when I changed the keystore it
> all
> broke and haven't found the problem yet. Troubleshooting steps have
> been to take out the ssl entirely and try different client settings.
> If
> I remove the contraints in the proxy config, it proxies ok to the
> webpages, and it the constraints are in, I log in ok and then the
> browser goes blank with a URL like this in the address bar:
>
>
http://apps.host.name/python?state=0%2F52043b01-976f-464f-8651-ebe295aac2...
>
> The error stack below is from the console of the keycloak proxy.
> Refreshing the page, simply returns a different error of "NO STATE
> COOKIE".
>
> Thanks in advance for any assistance,
>
> kind regards
>
> Guy
>
>
> ERROR: failed to turn code into token
> java.net.ConnectException: Connection refused
> at java.net.PlainSocketImpl.socketConnect(Native Method)
> at
> java.net.AbstractPlainSocketImpl.doConnect(AbstractPlainSocketImpl.java:350)
> at
> java.net.AbstractPlainSocketImpl.connectToAddress(AbstractPlainSocketImpl.java:206)
> at
> java.net.AbstractPlainSocketImpl.connect(AbstractPlainSocketImpl.java:188)
> at java.net.SocksSocketImpl.connect(SocksSocketImpl.java:392)
> at java.net.Socket.connect(Socket.java:589)
> at
> sun.security.ssl.SSLSocketImpl.connect(SSLSocketImpl.java:668)
> at
> org.apache.http.conn.ssl.SSLSocketFactory.connectSocket(SSLSocketFactory.java:532)
> at
>
org.keycloak.adapters.SniSSLSocketFactory.connectSocket(SniSSLSocketFactory.java:109)
> at
> org.apache.http.conn.ssl.SSLSocketFactory.connectSocket(SSLSocketFactory.java:409)
> at
>
org.apache.http.impl.conn.DefaultClientConnectionOperator.openConnection(DefaultClientConnectionOperator.java:177)
> at
> org.apache.http.impl.conn.AbstractPoolEntry.open(AbstractPoolEntry.java:144)
> at
>
org.apache.http.impl.conn.AbstractPooledConnAdapter.open(AbstractPooledConnAdapter.java:131)
> at
>
org.apache.http.impl.client.DefaultRequestDirector.tryConnect(DefaultRequestDirector.java:611)
> at
>
org.apache.http.impl.client.DefaultRequestDirector.execute(DefaultRequestDirector.java:446)
> at
>
org.apache.http.impl.client.AbstractHttpClient.doExecute(AbstractHttpClient.java:882)
> at
> org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:82)
> at
>
org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:107)
> at
> org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:55)
> at
> org.keycloak.adapters.ServerRequest.invokeAccessCodeToToken(ServerRequest.java:107)
> at
>
org.keycloak.adapters.OAuthRequestAuthenticator.resolveCode(OAuthRequestAuthenticator.java:314)
> at
>
org.keycloak.adapters.OAuthRequestAuthenticator.authenticate(OAuthRequestAuthenticator.java:260)
> at
>
org.keycloak.adapters.RequestAuthenticator.authenticate(RequestAuthenticator.java:112)
> at
>
org.keycloak.adapters.undertow.AbstractUndertowKeycloakAuthMech.keycloakAuthenticate(AbstractUndertowKeycloakAuthMech.java:110)
> at
>
org.keycloak.adapters.undertow.UndertowAuthenticationMechanism.authenticate(UndertowAuthenticationMechanism.java:56)
> at
>
io.undertow.security.impl.SecurityContextImpl$AuthAttempter.transition(SecurityContextImpl.java:233)
> at
>
io.undertow.security.impl.SecurityContextImpl$AuthAttempter.transition(SecurityContextImpl.java:250)
> at
>
io.undertow.security.impl.SecurityContextImpl$AuthAttempter.access$100(SecurityContextImpl.java:219)
> at
>
io.undertow.security.impl.SecurityContextImpl.attemptAuthentication(SecurityContextImpl.java:121)
> at
>
io.undertow.security.impl.SecurityContextImpl.authTransition(SecurityContextImpl.java:96)
> at
>
io.undertow.security.impl.SecurityContextImpl.authenticate(SecurityContextImpl.java:89)
> at
>
org.keycloak.proxy.ProxyAuthenticationCallHandler.handleRequest(ProxyAuthenticationCallHandler.java:44)
> at
>
org.keycloak.proxy.ConstraintMatcherHandler.handleRequest(ConstraintMatcherHandler.java:89)
> at
>
io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)
> at
>
org.keycloak.adapters.undertow.UndertowPreAuthActionsHandler.handleRequest(UndertowPreAuthActionsHandler.java:54)
> at
>
io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)
> at
>
io.undertow.server.session.SessionAttachmentHandler.handleRequest(SessionAttachmentHandler.java:68)
> at
> io.undertow.server.handlers.PathHandler.handleRequest(PathHandler.java:94)
> at
> io.undertow.server.Connectors.executeRootHandler(Connectors.java:202)
> at
>
io.undertow.server.protocol.http.HttpReadListener.handleEventWithNoRunningRequest(HttpReadListener.java:232)
> at
>
io.undertow.server.protocol.http.HttpReadListener.handleEvent(HttpReadListener.java:130)
> at
>
io.undertow.server.protocol.http.HttpReadListener.handleEvent(HttpReadListener.java:56)
> at
> org.xnio.ChannelListeners.invokeChannelListener(ChannelListeners.java:92)
> at
>
org.xnio.conduits.ReadReadyHandler$ChannelListenerHandler.readReady(ReadReadyHandler.java:66)
> at
> org.xnio.nio.NioSocketConduit.handleReady(NioSocketConduit.java:88)
> at org.xnio.nio.WorkerThread.run(WorkerThread.java:559)
>
> May 24, 2016 11:04:30 AM
> org.keycloak.adapters.OAuthRequestAuthenticator
> checkStateCookie
> WARN: No state cookie
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user(a)lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user