eXo openId configuration redirectUrl getting Issue

[Rajamuthukrishna]

Hi Team,

We are trying to access the eXo application in some other application, while try to hit the api getting CORS and 302 Issue,

Regards,
Raja

[rdenarie]

Hello @Rajamuthukrishna

You will have to configure the nginx to add the header Allow-Access-control-origin on all requests :
https://serverfault.com/questions/162429/how-do-i-add-access-control-allow-origin-in-nginx

Update the file ./conf/nginx.conf to add such header.

[Rajamuthukrishna]

Hello @rdenarie ,

As suggested, I have updated the headers in nginx, getting the below exception, please find the logs and help to resolve the issue.
nginx.txt

Regards,
Raja

[rdenarie]

Hello Raja,

I'm not nginx expert, so I will not be able to help you on this point.

What I see is not related to CORS, so the configuration seems to work.
The first problem is coming from the browser, which that your are trying to load a http resource in a https page, and the browser blocks it.

The second one seems not related to eXo

The 2 last are related to ws, but as I understand you tried to access to eXo API, it should not be a problem.

[Rajamuthukrishna]

Hello @rdenarie
We are trying to access the eXo url in some other application. getting the 302 exception, kindly help to resolve the issue.

[rdenarie]

Hello,
HTTP 302 is not an exception.
It is a redirect code, so the application redirects you to /portal/sso?initialURI=%2Fportal%2Fdw%2F

It means that your request requires an authentication, and it redirect you the SSO authentication workflow

[Rajamuthukrishna]

Hello @rdenarie x

Thanks for your prompt response.

Kindly share the documentation or videos for configuring eXo SSO configuration with keyclock using openId.

[rdenarie]

Hi,
You will find documentation related to eXo Platform configuration for OpenId here : https://docs.exoplatform.org/administration/oauth-integration.html#registering-your-oauth-application

[Rajamuthukrishna]

Hi @rdenarie
As you suggest the docs for OpenId Configuration - I have configured Keyclock and exo properties but facing below issue, kindly let me know if any configuration is missed. please help me resolve the issue.
exo.txt

[rdenarie]

In exo.properties, the properties wellKnowConfigurationUrl and redirectUrl are commented.
Could you uncomment it ?

As you can see in your last screenshot, the redirect_uri is not replaced in the request url (we can see ${exO.oauth.openid.redirectURL}

[Rajamuthukrishna]

Hello @rdenarie
I have updated the exo.properties and restart the service. please find the below logs and let me know if any configuration is missed...


exo.txt

[rdenarie]

Please check your redirectURL configuration.
It should be
exo.oauth.openid.redirectURL=http://localhost/portal/openidAuth
instead of
exo.oauth.openid.redirectURL=http://localhost/portal/login/openidAuth

[Rajamuthukrishna]

@rdenarie - Have used the below configuration in exo.prop and tried getting some null in RequestUrl. please find the logs and kindly help to resolve the issue.

OAuth

exo.base.url=http://localhost/portal/login

OpenId

exo.oauth.openid.enabled=true
exo.oauth.openid.clientId=exo-openid
exo.oauth.openid.clientSecret=etR0yjUJ7fK9sNuobgvkxRgqywPHi9RG

OpenId Urls

exo.oauth.openid.wellKnownConfigurationUrl=https://openid.server.com/.well-known/openid-configuration
exo.oauth.openid.redirectURL=http://localhost/portal/openidAuth
exo.oauth.registraterOnFly=OPENID

[rdenarie]

This property seems also not correct :
exo.oauth.openid.wellKnownConfigurationUrl=https://openid.server.com/.well-known/openid-configuration
You must adapt it to have the well-known url of your IDP server.
You can find information on how to find it in keycloak here : https://stackoverflow.com/questions/28658735/what-are-keycloaks-oauth2-openid-connect-endpoints

For Using google as IDP for example, the url is : https://accounts.google.com/.well-known/openid-configuration

[rdenarie]

Can you provide platform log, so that I can check exactly where the problem is coming from ?
Thanks

[Rajamuthukrishna]

@rdenarie - modified the exo.prop but still having the same null issue in redirectUrl. Please find the logs..
While click the signin with single account., first request is
http://localhost/portal/openidAuth?_oauthInteraction=start&_initialURI=%2Fportal&_rememberme=true
then redirect to
http://localhost/portal/null?response_type=code&client_id=exo-openid&scope=openid%20profile%20email&redirect_uri=http://localhost/portal/openidAuth&state=-2988670562276671434

exo.txt

[Rajamuthukrishna]

@rdenarie - Can you please find the logs and help to find the configuration generating the redirecturl causing issue..
**http://localhost/portal/null**?response_type=code&client_id=exo-openid&scope=openid%20profile%20email&redirect_uri=http://localhost/portal/openidAuth&state=1951980419119501194
Logs:
eXo-logs.txt

[Rajamuthukrishna]

@rdenarie @plamarque @margondicco @ahamdi - I have shared the all the configuration and properties files. We are waiting for your response kindly find the details and help to resolve the configuration redirecting url issue.

Keyclock Configuration:






docker-compose:
docker-compose.txt
nginx.conf:
nginx.txt
exo.properties
exo.txt
Logs:
eXo-logs.txt

Redirecting URL having issue:
**http://localhost/portal/null**?response_type=code&client_id=exo-openid&scope=openid%20profile%20email&redirect_uri=http://localhost/portal/openidAuth&state=1951980419119501194

[rdenarie]

Hello,
I'm sorry for the delay in the anwser, we are quite busy currently.

So, when looking in your logs, I can see the request /portal/openidAuth?_oauthInteraction=start&_initialURI=%2Fportal&_rememberme=true
This is call when you click on button "Connect with openId"

When click on this button, eXo will read the well-known configuration file, to search the entry 'authorization_endpoint'. Then the request redirect on this.

For example, I configure my local instance with google open id.
The well-know url is https://accounts.google.com/.well-known/openid-configuration and you can see into the 'authorization_endpoint' :
"authorization_endpoint": "https://accounts.google.com/o/oauth2/v2/auth",

When I click on the button on the login page, I see this :

The /portal/openidAuth (1) redirect to https://accounts.google.com/o/oauth2/v2/auth (2) with some parameters.

In your case, what is the value of authorization_endpoint in well-known configuration file ?

[Rajamuthukrishna]

Hello @rdenarie
We have used the exo.properties and added the below configurations, but still having the issue, please suggest to resolve the issue.
exo.txt

OAuth

exo.base.url=http://localhost/portal/

OpenId

exo.oauth.openid.enabled=true
exo.oauth.openid.clientId=exo-openid
exo.oauth.openid.clientSecret=Lv5apBzX3dRvtnMxKpFVDh6l6nGL2GLD

OpenId Urls

exo.oauth.openid.wellKnownConfigurationUrl=http://localhost:8090/auth/realms/master/.well-known/openid-configuration
exo.oauth.openid.redirectURL=http://localhost:8090/auth/realms/master/o/oauth2/v2/auth
exo.oauth.registraterOnFly=OPENID

Regards,
Raja

[rdenarie]

In your case, what is the value of authorization_endpoint in well-known configuration file ?

You didnt provide this point

[Rajamuthukrishna]

@rdenarie - Previously We are not used well-known configuration file, have used exo.properties file only and added the above configuration.
Application URLS:
eXo Application : http://localhost/portal/
Keyclock : http://localhost:8090/

As you suggested - have created the well-knownconfiguration.properties and added the below urls. please correct me..

OpenId Urls

exo.oauth.openid.authorization_endpoint=http://localhost:8090/auth/realms/master/o/oauth2/v2/auth

[rdenarie]

well-know configuration is a file provided by the IDP. It contains all informations that exo need to use the IDP, it IS NOT a property on exo side.
The authorization_endpoint property is present inside the well-known configuration file.

When I use google as IDP for open ID, google provide the well-know configuration file, available here : https://accounts.google.com/.well-known/openid-configuration
As you can see in this file, the property is present.

Without this file, eXo CANNOT use open id protocol

Hint for keycloack : https://stackoverflow.com/questions/28658735/what-are-keycloaks-oauth2-openid-connect-endpoints

[Rajamuthukrishna]

@rdenarie - Got it. We have used below wellKnownConfigurationUrl in exo.properties and authorization_endpoint also generated by the IDP using wellKnownConfigurationUrl but still that value is NOT picked BY exo.

exo.oauth.openid.wellKnownConfigurationUrl=http://localhost:8090/auth/realms/master/.well-known/openid-configuration

{
"issuer": "http://localhost:8090/auth/realms/master",
"authorization_endpoint": "http://localhost:8090/auth/realms/master/protocol/openid-connect/auth",
"token_endpoint": "http://localhost:8090/auth/realms/master/protocol/openid-connect/token",
"introspection_endpoint": "http://localhost:8090/auth/realms/master/protocol/openid-connect/token/introspect",
"userinfo_endpoint": "http://localhost:8090/auth/realms/master/protocol/openid-connect/userinfo",
"end_session_endpoint": "http://localhost:8090/auth/realms/master/protocol/openid-connect/logout",
"frontchannel_logout_session_supported": true,
"frontchannel_logout_supported": true,
"jwks_uri": "http://localhost:8090/auth/realms/master/protocol/openid-connect/certs",
"check_session_iframe": "http://localhost:8090/auth/realms/master/protocol/openid-connect/login-status-iframe.html",

[rdenarie]

Do you use docker ? or standalone installation ?
We will need to add some trace logs to understand the problem.

Please, modify the file ${eXoHome}/conf/logback.xml by adding this line :
<logger name="io.meeds.oauth.openid" level="TRACE" />
with other exiting loggers.
If you use docker, you will have to get the existing file inside the exo container, copy on the local machine, edit it, and modify the docker-compose file to mount it inside eXo
Then restart the platform, and try an access.

Can you send the result log file ?

Thanks

[Rajamuthukrishna]

@rdenarie - I have updated the my local machine path of logback.xml in docker-compose file. please verify..

logback.xml : C:\app\EXO_HOME\conf\logback.xml
logback.xml.txt

docker-compose.yml : C:\app\EXO_HOME\docker-compose.yml
docker-compose.txt

please find the downloaded log file from the the path of the container in below,
$ pwd
/opt/exo/logs
platform.log

[rdenarie]

As your logback file is in conf folder, your volume line in docker-compose must be
- ./conf/logback.xml:C:/app/EXO_HOME/conf/logback.xml:rw

[Rajamuthukrishna]

@rdenarie - After adding this below line and execute the docker-compose file in local - getting too many colons exception...
docker-compose.yml
volumes:
- exo_data:/srv/exo
- exo_logs:/var/log/exo
- ./conf/logback.xml:C:/app/EXO_HOME/conf/logback.xml:rw

[rdenarie]

My mistake :

• ./conf/logback.xml:/opt/exo/conf/logback.xml:rw

[Rajamuthukrishna]

@rdenarie - Please find the logs...
docker-compose.yml:
volumes:
- exo_data:/srv/exo
- exo_logs:/var/log/exo
- ./conf/logback.xml:/opt/exo/conf/logback.xml:rw

Logs:
platform.log

[rdenarie]

Ok, your properties for openid seems not taken in account.
As you do for logback file, can you provide the exact of the file exo.properties on your local machine ?

You should have line like this in your docker compose file :
- ./conf/exo.properties:/opt/exo/gatein/conf/exo.properties:rw

[Rajamuthukrishna]

@rdenarie - Please find the path of the exo.properties in local machine.
C:\app\EXO_HOME\gatein\conf\exo.properties

[rdenarie]

So your path in docker-compose should be adapted.
you put ./conf/exo.properties, but it should be
./gatein/conf/exo.properties :
- ./gatein/conf/exo.properties:/opt/exo/gatein/conf/exo.properties:rw

[Rajamuthukrishna]

@rdenarie -Please find the logs..
platform.log

docker-compose.yml:
volumes:
- exo_data:/srv/exo
- exo_logs:/var/log/exo
- ./gatein/conf/exo.properties:/opt/exo/gatein/conf/exo.properties:rw

[rdenarie]

Hello
I can see this in log
2023-11-30 06:56:01,704 | ERROR | Connection refused [o.g.s.oauth.openid.OpenIdProcessorImpl<main>]

I'm afraid that your exo docker container cannot contact the IDP, he didnt manage to read the well-known url.

Please ensure that communication between exo docker container and IDP is possible (connect inside the container, and check with ping, wget ....)

It is problem related to your docker installation, on which I will not be able to help you.
So I let you check and get back when you are sure that link between eXo and IDP is ok.

Thanks

[Rajamuthukrishna]

Tried multiple time for uninstall and install the docker and tried to connect well-known url in docker container getting below details..,Any idea?
$ pwd
/opt/exo
$ wget http://localhost:8090/auth/realms/master/.well-known/openid-configuration

Can you pls confirm the exo.properties configuration..
exo.txt

[rdenarie]

The exo properties seems ok.

in fact, in exo container, when you ping or wget localhost, you address the exo container.

As your idp seems running on your local, physical machine, I think you need to provide the IP of your machine as IDP host name

[Rajamuthukrishna]

I have tried my machine IP - getting connection refused.

even, if we use machine IP also- we are getting localhost in the response. please find the logs..

[rdenarie]

In fact, it seems related to your docker installation and machine related.

As there is no link with exo platform, I will not be able to help you on this point

[Rajamuthukrishna]

@rdenarie Yes - You are correct. The issue is from my local keyclock only.

I just use different keyclock, able to connect and redirect the keyclock page..but getting some url issue

platform.log

[rdenarie]

Invalid parameter redirect_uri generally means that you didnt register your service provider in the IDP.

When using Google as IDP, you haev to configure which redirect uri are authorized :

In your case you shouln't have done this step

[Rajamuthukrishna]

I haven't provided the redirectUrl in keyclock IDP but still getting some issue. I think it will refer from exo.prop only.

If I have commented the redirectUrl in eXo.properties getting below exception., Can you pls confirm any proper url will provide in rediectURL in exo.props.

[rdenarie]

redirect_uri is mandatory in exo.properties.
It is also mandatory in Keycloack configuration

[Rajamuthukrishna]

Ok, Can you pls confirm - which redirecturi provide to eXo.prop and keyclock? I have added below uri but not working..
exo.oauth.openid.redirectURL=http://localhost/portal/openidAuth

[rdenarie]

Perhaps you should follow these type of questions : https://stackoverflow.com/questions/45352880/keycloak-invalid-parameter-redirect-uri

This one is ok
exo.oauth.openid.redirectURL=http://localhost/portal/openidAuth

[Rajamuthukrishna]

Its Resolved.

@rdenarie -Thank you so much for your kind response. without your support not able to complete this task.

[rdenarie]

Thanks for your notice. I close the discussion