[keycloak-user] (no subject)

[Metehan Selvi]

Hello,
I have got a Problem with Keycloak 2.5.0 Final on Wildfly with an war
deployed on a Tomcat 7 and registered
org.keycloak.adapters.saml.tomcat.SamlAuthenticatorValve and generated
keycloak-saml.xml from AARealm ( just a name)
After navigating to the Ressource , I got a correct redirect with
SAML-AuthnRequest to Wildfly with Keycloak.
I can login with a user successful, a correct SAML-Response is created, but
then I got a *loop *on requests
on the same ressource on Wildfly (!),
so there is no outcome till I close the window again.

What's wrong?
- Are the Redirects wrong?
- Why are the cookies expiring again? (see below)




Here are the details:
- AA.war is deployed on tomcat with port 8280 , inside there is just an
jsp-Page
- Keycloak runs on 8080
- A RealmAA is created with Client registration and SAML Protocol on
Keycloak
- Valid Redirect URIs is http://localhost:8280/AA/*
- Base URL is http://localhost:8280/AA
- no other URLs are registered
- loop on requests go on
http://localhost:8080/auth/realms/AARealm/login-actions/authenticate?code=
<changing_every_time> HTTP/1.1
- Output on Wildfly is (again and again, the loop!)
2017-01-13 20:31:23,645 WARN  [org.keycloak.events] (default task-45)
type=LOGIN_ERROR, realmId=AARealm, clientId=null, userId=null,
ipAddress=127.0.0.1, error=expired_code, restart_after_timeout=true
2017-01-13 20:31:23,645 DEBUG
[org.keycloak.authentication.AuthenticationProcessor]
(default task-45) AUTHENTICATE
2017-01-13 20:31:23,645 DEBUG
[org.keycloak.authentication.AuthenticationProcessor]
(default task-45) AUTHENTICATE ONLY
2017-01-13 20:31:23,646 DEBUG
[org.keycloak.authentication.DefaultAuthenticationFlow]
(default task-45) processFlow
2017-01-13 20:31:23,646 DEBUG
[org.keycloak.authentication.DefaultAuthenticationFlow]
(default task-45) check execution: auth-cookie requirement: ALTERNATIVE
2017-01-13 20:31:23,646 DEBUG
[org.keycloak.authentication.DefaultAuthenticationFlow]
(default task-45) authenticator: auth-cookie
2017-01-13 20:31:23,646 DEBUG
[org.keycloak.authentication.DefaultAuthenticationFlow]
(default task-45) invoke authenticator.authenticate
2017-01-13 20:31:23,646 DEBUG
[org.keycloak.authentication.DefaultAuthenticationFlow]
(default task-45) authenticator SUCCESS: auth-cookie
2017-01-13 20:31:23,646 DEBUG
[org.keycloak.authentication.DefaultAuthenticationFlow]
(default task-45) check execution: auth-spnego requirement: DISABLED
2017-01-13 20:31:23,646 DEBUG
[org.keycloak.authentication.DefaultAuthenticationFlow]
(default task-45) execution is processed
2017-01-13 20:31:23,646 DEBUG
[org.keycloak.authentication.DefaultAuthenticationFlow]
(default task-45) check execution: identity-provider-redirector
requirement: ALTERNATIVE
2017-01-13 20:31:23,647 DEBUG
[org.keycloak.authentication.DefaultAuthenticationFlow]
(default task-45) Skip alternative execution
2017-01-13 20:31:23,647 DEBUG
[org.keycloak.authentication.DefaultAuthenticationFlow]
(default task-45) check execution: null requirement: ALTERNATIVE
2017-01-13 20:31:23,647 DEBUG
[org.keycloak.authentication.DefaultAuthenticationFlow]
(default task-45) Skip alternative execution
2017-01-13 20:31:23,647 DEBUG [org.keycloak.protocol.oidc.TokenManager]
(default task-45) Using full scope for client
2017-01-13 20:31:23,647 DEBUG [org.keycloak.events] (default task-45)
type=LOGIN, realmId=AARealm, clientId=AA,
userId=1b24603d-c9e8-4317-995a-b42b0f91bae1,
ipAddress=127.0.0.1, auth_method=saml, consent=no_consent_required,
code_id=7ed8cc51-6c7e-4ffc-8d2a-261b9f03559d, username=user
2017-01-13 20:31:23,647 DEBUG
[org.keycloak.services.managers.AuthenticationManager]
(default task-45) Create login cookie - name: KEYCLOAK_IDENTITY, path:
/auth/realms/AARealm, max-age: -1
2017-01-13 20:31:23,648 DEBUG
[org.keycloak.services.managers.AuthenticationManager]
(default task-45) Expiring remember me cookie
2017-01-13 20:31:23,648 DEBUG
[org.keycloak.services.managers.AuthenticationManager]
(default task-45) Expiring cookie: KEYCLOAK_REMEMBER_ME path:
/auth/realms/AARealm
2017-01-13 20:31:23,672 DEBUG [org.keycloak.transaction.JtaTransactionWrapper]
(default task-45) JtaTransactionWrapper  commit
2017-01-13 20:31:23,672 DEBUG [org.keycloak.transaction.JtaTransactionWrapper]
(default task-45) JtaTransactionWrapper end
2017-01-13 20:31:23,815 DEBUG [org.keycloak.transaction.JtaTransactionWrapper]
(default task-46) new JtaTransactionWrapper
2017-01-13 20:31:23,816 DEBUG [org.keycloak.transaction.JtaTransactionWrapper]
(default task-46) was existing? false
2017-01-13 20:31:23,818 WARN  [org.keycloak.events] (default task-46)
type=LOGIN_ERROR, realmId=AARealm, clientId=null, userId=null,
ipAddress=127.0.0.1, error=expired_code, restart_after_timeout=true
2017-01-13 20:31:23,819 DEBUG
[org.keycloak.authentication.AuthenticationProcessor]
(default task-46) AUTHENTICATE
2017-01-13 20:31:23,819 DEBUG
[org.keycloak.authentication.AuthenticationProcessor]
(default task-46) AUTHENTICATE ONLY


If I register http://localhost:8280/AA/saml as "Master SAML Processing URL"
on Keycloak, then I got a 403 Forbidden.

Thanks in advance
Metehan Selvi