Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Activating DEBUG for io.quarkus.oidc results in FORMAT_FAILURE #38606

Closed
McIntozh opened this issue Feb 6, 2024 · 2 comments · Fixed by #38612
Closed

Activating DEBUG for io.quarkus.oidc results in FORMAT_FAILURE #38606

McIntozh opened this issue Feb 6, 2024 · 2 comments · Fixed by #38612
Assignees
Labels
area/oidc kind/bug Something isn't working
Milestone

Comments

@McIntozh
Copy link

McIntozh commented Feb 6, 2024

Describe the bug

Using quarkus-oidc and setting the properties

quarkus.log.category."io.quarkus.oidc".min-level=TRACE
quarkus.log.category."io.quarkus.oidc".level=TRACE

may lead to an exception when the cookie exceed MAX_COOKIE_VALUE_LENGTH.

LogManager error of type FORMAT_FAILURE: Formatting error
java.util.IllegalFormatConversionException: d != java.lang.String
	at java.base/java.util.Formatter$FormatSpecifier.failConversion(Formatter.java:4515)
	at java.base/java.util.Formatter$FormatSpecifier.printInteger(Formatter.java:3066)
	at java.base/java.util.Formatter$FormatSpecifier.print(Formatter.java:3021)
	at java.base/java.util.Formatter.format(Formatter.java:2791)
	at java.base/java.util.Formatter.format(Formatter.java:2728)
	at java.base/java.lang.String.format(String.java:4386)
	at org.jboss.logmanager.ExtFormatter.formatMessagePrintf(ExtFormatter.java:144)
	at org.jboss.logmanager.ExtFormatter.formatMessage(ExtFormatter.java:91)
	at org.jboss.logmanager.formatters.Formatters$16.renderRaw(Formatters.java:832)
	at org.jboss.logmanager.formatters.Formatters$JustifyingFormatStep.render(Formatters.java:227)
	at org.jboss.logmanager.formatters.MultistepFormatter.format(MultistepFormatter.java:90)
	at org.jboss.logmanager.ExtFormatter$Delegating.format(ExtFormatter.java:196)
	at org.jboss.logmanager.ExtFormatter.format(ExtFormatter.java:58)
	at org.jboss.logmanager.handlers.WriterHandler.doPublish(WriterHandler.java:52)
	at org.jboss.logmanager.ExtHandler.publish(ExtHandler.java:88)
	at org.jboss.logmanager.ExtHandler.publishToNestedHandlers(ExtHandler.java:125)
	at io.quarkus.bootstrap.logging.QuarkusDelayedHandler.doPublish(QuarkusDelayedHandler.java:81)
	at org.jboss.logmanager.ExtHandler.publish(ExtHandler.java:88)
	at org.jboss.logmanager.LoggerNode.publish(LoggerNode.java:438)
	at org.jboss.logmanager.LoggerNode.publish(LoggerNode.java:480)
	at org.jboss.logmanager.LoggerNode.publish(LoggerNode.java:480)
	at org.jboss.logmanager.LoggerNode.publish(LoggerNode.java:480)
	at org.jboss.logmanager.LoggerNode.publish(LoggerNode.java:480)
	at org.jboss.logmanager.LoggerNode.publish(LoggerNode.java:480)
	at org.jboss.logmanager.Logger.logRaw(Logger.java:1089)
	at org.jboss.logmanager.Logger.log(Logger.java:1052)
	at org.jboss.logging.JBossLogManagerLogger.doLogf(JBossLogManagerLogger.java:56)
	at org.jboss.logging.Logger.debugf(Logger.java:725)
	at io.quarkus.oidc.runtime.CodeAuthenticationMechanism$11$1.apply(CodeAuthenticationMechanism.java:961)
	at io.quarkus.oidc.runtime.CodeAuthenticationMechanism$11$1.apply(CodeAuthenticationMechanism.java:953)
	at io.smallrye.context.impl.wrappers.SlowContextualFunction.apply(SlowContextualFunction.java:21)
	at io.smallrye.mutiny.operators.uni.UniOnItemTransform$UniOnItemTransformProcessor.onItem(UniOnItemTransform.java:36)
	at io.smallrye.mutiny.operators.uni.builders.UniCreateFromKnownItem$KnownItemSubscription.forward(UniCreateFromKnownItem.java:38)

This happens because in CodeAuthenticationMechanism.java:961 the debugf supplies two values where only one is wanted

LOG.debugf(
	"Session cookie length is greater than %d bytes."
		+ " The cookie will be split to chunks to avoid browsers ignoring it."
		+ " Alternative recommendations: 1. Set 'quarkus.oidc.token-state-manager.split-tokens=true'"
		+ " to have the ID, access and refresh tokens stored in separate cookies."
		+ " 2. Set 'quarkus.oidc.token-state-manager.strategy=id-refresh-tokens' if you do not need to use the access token"
		+ " as a source of roles or to request UserInfo or propagate it to the downstream services."
		+ " 3. Decrease the session cookie's length by disabling its encryption with 'quarkus.oidc.token-state-manager.encryption-required=false'"
		+ " but only if it is considered to be safe in your application's network."
		+ " 4. Register a custom 'quarkus.oidc.TokenStateManager' CDI bean with the alternative priority set to 1.",
	configContext.oidcConfig.tenantId.get(),
	OidcUtils.MAX_COOKIE_VALUE_LENGTH);

The first parameter configContext.oidcConfig.tenantId.get() should be removed.
I think this came with the commit a1b55f5 by @sberyozkin ;)

Expected behavior

No exception

Actual behavior

LogManager error of type FORMAT_FAILURE: Formatting error
java.util.IllegalFormatConversionException: d != java.lang.String

How to Reproduce?

No response

Output of uname -a or ver

No response

Output of java -version

No response

Quarkus version or git rev

3.7.1

Build tool (ie. output of mvnw --version or gradlew --version)

No response

Additional information

No response

@McIntozh McIntozh added the kind/bug Something isn't working label Feb 6, 2024
@quarkus-bot quarkus-bot bot added the area/oidc label Feb 6, 2024
Copy link

quarkus-bot bot commented Feb 6, 2024

/cc @pedroigor (oidc), @sberyozkin (oidc)

@sberyozkin
Copy link
Member

@McIntozh Sorry about that,

The first parameter configContext.oidcConfig.tenantId.get() should be removed.

Instead I've restored the capturing var for this property because there could be many tenants involved, so it is important to inform which tenant has this situation with the large cookie size

@quarkus-bot quarkus-bot bot added this to the 3.9 - main milestone Feb 6, 2024
@gsmet gsmet modified the milestones: 3.9 - main, 3.7.2 Feb 6, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
area/oidc kind/bug Something isn't working
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants