[keycloak-user] Keycloak 2.4 SSSD Provider setup for FreeIPA

Fri Dec 2 02:41:48 EST 2016

Hi Scott, sorry for the late response.

>From what I noticed, dbus-send works for you right? But I feel like the
user running Keycloak process does not have access to
/etc/sssd/sssd.conf, or is not the same running dbus-send. Is that true?

If yes, check if user running Keycloak is listed into sssd.conf 'allowed_uids'
section. I saw that you managed to run dbus-send, but worth to ask.
Is the user running dbus-send, the same starting Keycloak server process?

I included a very simple check to make sure that Windows users don't see the SSSD
Federation provider listed — If the user running Keycloak does not have
reading rights over /etc/sssd.

For troubleshooting some of these issues (because from time to time, I
mess up with my environment), I have this docker image[1].

Speaking about KEYCLOAK-3902, I already fixed it. I will just include
the integration tests to reproduce this scenario.

[1] - https://github.com/keycloak/keycloak-test-docker-images/tree/master/keycloak-sssd-integration-tests

On 2016-12-01, Scott Poore wrote:
>
>
> ----- Original Message -----
> > From: "Bill Burke" <bburke at redhat.com>
> > To: keycloak-user at lists.jboss.org
> > Sent: Thursday, December 1, 2016 3:35:31 PM
> > Subject: Re: [keycloak-user] Keycloak 2.4 SSSD Provider setup for FreeIPA
> >
> > Can you run your example without SSSD?  Isolate the problem to make sure
> > that its not an SP configuration issue first.  As far as SSSD setup
> > goes, you're gonna have to talk to Bruno about that. Hopefully he chimes in.
>
> I tried adding a user to the existing setup from the admin console and I see an error and then I see this in the server.log:
>
> Caused by: org.keycloak.federation.sssd.api.SSSDException: Failed to retrieve user's attributes. Check if SSSD service is active.
>
> I can't delete the sssd provider though because of this bug:
>
> https://issues.jboss.org/browse/KEYCLOAK-3902
>
> I started over fresh without the SSSD Provider setup.  It does appear that I'm not able to even authenticate as a user created from the admin console.
>
> I've bumped logging up to info on both Keycloak and httpd on the SP but, I still don't see much there.  Any suggestion on where to go from here?
>
> Thanks,
> Scott
>
>
> >
> >
> > On 12/1/16 4:21 PM, Scott Poore wrote:
> > > Hi,
> > >
> > > I am trying to setup Keycloak version 2.4.0 with FreeIPA integration using
> > > the SSSD Provider.  I am following the Server Administration Guide but,
> > > I'm hitting some error.  I'm not sure if it's a bug or a configuration
> > > issue on my part.
> > >
> > > This is the link I was following:
> > >
> > > https://keycloak.gitbooks.io/server-adminstration-guide/content/v/2.4/topics/user-federation/sssd.html
> > >
> > > The difference in setup though is that I'm not using the docker image.
> > > Instead I'm using a separate FreeIPA Master server that I have setup as a
> > > separate VM.  I have confirmed that SSSD-DBUS is working:
> > >
> > > [root at idp ~]# dbus-send --print-reply --system
> > > --dest=org.freedesktop.sssd.infopipe /org/freedesktop/sssd/infopipe
> > > org.freedesktop.sssd.infopipe.GetUserGroups string:testuser
> > > method return time=1480625438.634684 sender=:1.26 -> destination=:1.29
> > > serial=17 reply_serial=2
> > >     array [
> > >        string "ipausers"
> > >     ]
> > >
> > > For the SP, I setup a basic Apache setup with mod_auth_mellon using
> > >
> > > keycloak-httpd-client-install   \
> > >      --client-originate-method registration \
> > >      --keycloak-server-url https://idp.keycloak.test:8443 \
> > >      --keycloak-admin-username admin \
> > >      --keycloak-admin-password PASSWORD \
> > >      --app-name testapp \
> > >      --keycloak-realm test_realm \
> > >      --mellon-root mroot \
> > >      --mellon-protected-locations "/mroot/private" \
> > >      --force
> > >
> > > When I try to login to the SP, it redirects as expected to the Keycloak
> > > server and waits for a while before returning:
> > >
> > > Internal Server Error
> > >
> > > >From the httpd access log I can see:
> > >
> > >
> > > 192.168.122.1 - - [01/Dec/2016:14:07:04 -0600] "GET /mroot/private
> > > HTTP/1.1" 303 384 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36
> > > (KHTML, like Gecko) Chrome/50.0.2661.86 Safari/537.36"
> > > 192.168.122.1 - - [01/Dec/2016:14:07:04 -0600] "GET
> > > /mroot/mellon/login?ReturnTo=http%3A%2F%2Fsp1.keycloak.test%2Fmroot%2Fprivate&IdP=https%3A%2F%2Fidp.keycloak.test%3A8443%2Fauth%2Frealms%2Ftest_realm
> > > HTTP/1.1" 303 1320 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36
> > > (KHTML, like Gecko) Chrome/50.0.2661.86 Safari/537.36"
> > >
> > > >From the admin console, I can see what appears to be an active session for
> > > >the client.
> > >
> > > >From the Keycloak server.log I can see:
> > >
> > > 2016-12-01 14:14:31,576 WARN  [com.arjuna.ats.arjuna] (Transaction Reaper
> > > Worker 0) ARJUNA012108: CheckedAction::check - atomic action
> > > 0:ffffc0a87abf:7c36d3eb:58406454:81e aborting with 1 threads active!
> > > 2016-12-01 14:14:31,578 WARN
> > > [org.hibernate.resource.transaction.backend.jta.internal.synchronization.SynchronizationCallbackCoordinatorTrackingImpl]
> > > (Transaction Reaper Worker 0) HHH000451: Transaction afterCo
> > > mpletion called by a background thread; delaying afterCompletion processing
> > > until the original thread can handle it. [status=4]
> > > 2016-12-01 14:14:31,579 WARN  [com.arjuna.ats.arjuna] (Transaction Reaper
> > > Worker 0) ARJUNA012121: TransactionReaper::doCancellations worker
> > > Thread[Transaction Reaper Worker 0,5,main] successfully canceled TX 0:f
> > > fffc0a87abf:7c36d3eb:58406454:81e
> > > 2016-12-01 14:15:50,617 WARN  [com.arjuna.ats.arjuna] (default task-25)
> > > ARJUNA012077: Abort called on already aborted atomic action
> > > 0:ffffc0a87abf:7c36d3eb:58406454:81e
> > > 2016-12-01 14:15:50,620 ERROR [org.jboss.resteasy.resteasy_jaxrs.i18n]
> > > (default task-25) RESTEASY002025: Unknown exception while executing POST
> > > /realms/test_realm/login-actions/authenticate: java.lang.RuntimeExc
> > > eption: javax.transaction.RollbackException: ARJUNA016102: The transaction
> > > is not active! Uid is 0:ffffc0a87abf:7c36d3eb:58406454:81e
> > >
> > > Leaving out the traceback for brevity.  I can send that if needed/wanted.
> > >
> > >
> > > When I logout the session and set SSSD debug_level to 9 and restart sssd,
> > > keycloak, and httpd (on the SP), I do see SSSD looking up the user.  I can
> > > provide the SSSD logs if it helps.
> > >
> > >
> > > So, how do I go about troubleshooting this issue?  Are there any steps
> > > missing from the SSSD Provider doc?
> > >
> > > Thanks,
> > > Scott
> > >
> > >
> > >
> > >
> > >
> >
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user at lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
> >
> _______________________________________________
> keycloak-user mailing list
> keycloak-user at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user

--

abstractj
PGP: 0x84DC9914