docs/sso/

[giscus[bot]]

docs/sso/

How to configure Single-Sign-On (SSO) in our Pi Kubernetes cluster.

https://picluster.ricsanfre.com/docs/sso/

[i5Js]

Interesting: Following it, I'm getting the following error, after login to the oauth2 console:

Error redeeming code during OAuth2 callback: token exchange failed: oauth2: "unauthorized_client" "Invalid client or Invalid client credentials"

However, if I disable "client authentication", I can login, but getting a 404 error:

10.244.7.215:42592 - 39395285-dd23-4475-b516-89a65da11707 - <user_email> [2024/03/30 14:46:19] [AuthSuccess] Authenticated via OAuth2: Session{email:user_email user:ce458eac-2a49-4a80-aa54-bb66ef545aad PreferredUsername:<user> token:true id_token:true created:2024-03-30 14:46:19.212878477 +0000 UTC m=+2760.130704669 expires:2024-03-30 14:51:19.189199437 +0000 UTC m=+3060.107025628 groups:[role:editor role:viewer role:offline_access role:admin role:uma_authorization role:default-roles-home role:account:manage-account role:account:manage-account-links role:account:view-profile]}
10.244.7.215:42592 - 39395285-dd23-4475-b516-89a65da11707 - - [2024/03/30 14:46:19] proxy.home.dominio.com GET - "/oauth2/callback?state=LCZx-8ct628slwX9Tgi6D9_vHIvK6TOWSTiuR1F7ImU%3A%2F&session_state=0d2be827-3d06-41b0-be04-7eca54adf6a7&iss=https%3A%2F%2Fsso.home.dominio.com%2Frealms%2Fhome&code=b3fb1b30-a272-4d1f-8e43-bedb35fd1680.0d2be827-3d06-41b0-be04-7eca54adf6a7.bebb575b-cd59-4822-a2fb-7d2fe70f0731" HTTP/1.1 "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15" 302 24 0.151
10.244.7.215:42592 - 16314e6e-8182-4044-9c54-33e6aca8756a - user_email[2024/03/30 14:46:19] proxy.home.dominio.com GET - "/" HTTP/1.1 "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15" 404 19 0.002

[ricsanfre]

Client authentication has to be enabled. Otherwise, the client credentials are not created. Once the client is added to keycloak its client credentials: client_id and client_secret need to be used in the configuration: oauth2-proxy config.

[i5Js]

Hello Ricardo, thanks,

But I don't think I have understood it. I have created a user and a password in keycloak and I'm using that credentials to login to oauth2. am I doing wrong?. I mean, when I login to proxy.home.dominio.com it has for user and a password. What should I use ?

[i5Js]

Very true, I'm giving the last chance... if it doesn't work, I will move all to Nginx.

[i5Js]

Moved everything to Nginx Ingress Controller, and worked at the first shoot.
Bye bye traefik.

[i5Js]

Strange, I don't know if it's expected, but, I can login to longhorn, but, if I close the session in Keycloak, longhorn doesn't ask for a new login if I refresh it.

[ricsanfre]

Hi Javi,

Oauth2-Proxy Sign out functionality is not implemented yet. It is implemented in Grafana's SSO Keycloak integration but not in Oauth-proxy's. I have open an issue to keep track of this enhancement: (#378)

Regards
Ricardo

[i5Js]

Great, thanks Ricardo!!

[i5Js]

Yes, I saw it, it’s not encoded but “invalid credentials :(“ and it’s strange because I don’t see any error message on the pod. Enviado desde dispositivo móvil

…

________________________________ De: Ricardo Sanchez ***@***.***> Enviado: Sunday, March 31, 2024 7:05:32 PM Para: ricsanfre/pi-cluster ***@***.***> Cc: Javi ***@***.***>; Comment ***@***.***> Asunto: Re: [ricsanfre/pi-cluster] docs/sso/ (Discussion #369) If you use a Secret to store credentials (GitOps installation), you have to base64 encode them. — Reply to this email directly, view it on GitHub<#369 (reply in thread)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AAIFKG6V6YY33XAII56ETLLY3A65ZAVCNFSM6AAAAABFPTPYSCVHI2DSMVQWIX3LMV43SRDJONRXK43TNFXW4Q3PNVWWK3TUHM4DSNRVHE4TI>. You are receiving this because you commented.Message ID: ***@***.***>

[i5Js]

Finally I found a message on the keycloak pod

2024-03-31 18:02:12,535 WARN [org.keycloak.events] (executor-thread-77) type="LOGIN_ERROR", realmId="66b4fa57-c607-4d1f-8b48-4a0a1d72c464", clientId="oauth2-proxy", userId="null", ipAddress="10.244.2.0", error="user_not_found", auth_method="openid-connect"

Time to google it.

[benbourner]

I'm just getting endless crash loops trying to install this, it fails to connect to postgres...?
Pod error:

WARN  [io.agroal.pool] (agroal-11) Datasource '<default>': FATAL: password authentication failed for user "keycloak"

Postgres error:

2024-05-23 08:48:03.301 GMT [1681] FATAL:  password authentication failed for user "keycloak"
2024-05-23 08:48:03.301 GMT [1681] DETAIL:  Role "keycloak" does not exist.
	Connection matched file "/opt/bitnami/postgresql/conf/pg_hba.conf" line 1: "host     all             all             0.0.0.0/0               md5"

[benbourner]

Uninstalled and reinstalled and it worked ok, guess it was down to a timing issue somehow

[benbourner]

One more issue, maybe i've missed something along the line... I find the oauth-proxy is not able to resolve the external address oidc_issuer_url="https://sso.picluster.ricsanfre.com/realms/picluster". What might I have missed that enables the DNS resolution of sso.picluster.ricsanfre.com (and other ingresses) by the oath-proxy pod? Where should it be resolved? neither coredns nor dnsmasq know about it.

ERROR: Failed to initialise OAuth2 Proxy: error initialising provider: could not create provider data: error building OIDC ProviderVerifier: could not get verifier builder: error while discovery OIDC configuration: failed to discover OIDC configuration: error performing request: Get "https://sso.picluster.ricsanfre.com/realms/picluster/.well-known/openid-configuration": dial tcp: lookup sso.picluster.ricsanfre.com on 10.43.0.10:53: no such host

[ricsanfre]

Hi @benbourner, sso.picluster.ricsanfre.com dns is part of dnsmasq configuration. It is pointing to Ingress Gateway Load Balancer IP, so pods are able to resolve it and reach it.

See ansible variables defined for gateway node: https://github.com/ricsanfre/pi-cluster/blob/master/ansible/host_vars/gateway.yml#L40-L43

[benbourner]

Ah I see now yes thanks. So they have to be explicitly defined in dnsmasq, there is no mechanism for updating them on the fly from ingress definitions. I was trying to do that but had another issue - the name resolution on my gateway host was not pointing to dnsmasq, thus coredns was also not pointing to dnsmasq, thus the pods could not resolve the definitions. Thanks for the useful guide. There are problems to solve at every step but it all helps gain a deeper understanding.

[ricsanfre]

Services like external-dns can be used for automate the DNS configuration for exposed services. For simplicity, since I am exposing only a few services, i am not currently using it, so I need to manually configure dnsmasq.d.