After successful login over OIDC AKHQ always redirects to login page after click on login button #1297

AdiWehrli · 2022-11-29T07:49:17Z

AdiWehrli
Nov 29, 2022

If I logged in successfully over OIDC the page with the button Login with OIDC appears. If I click on this button I am redirected again to the same page with this button. If I click again the same happens.

I'll have to remove the /login part in the URL, then the start page (topics list) appears and the application can be used as usual (no more redirects to /login).

OS: Windows 10
Browsers: Chrome, Edge
AKHQ version: 0.23.0

BTW: there are no errors reported in browser console and it has nothing to do with custom HTTP response headers (I also tried without those).

AdiWehrli · 2022-12-07T07:31:56Z

AdiWehrli
Dec 7, 2022
Author

Log chain of my login, which redirects again to /akhq/ui/login:

2022-12-07T07:26:57.602 level=INFO thread=default-nioEventLoopGroup-1-4 releaseVersion=0.23.0 logger=org.akhq.log.access msg="[Date: 2022-12-07T07:26:57.11539Z] [Duration: 487 ms] [Url: GET /akhq/oauth/callback/oidc] [Status: 303] [Ip: /10.127.79.109] [User: Anonymous]"
2022-12-07T07:26:57.672 level=INFO thread=default-nioEventLoopGroup-1-3 releaseVersion=0.23.0 logger=org.akhq.log.access msg="[Date: 2022-12-07T07:26:57.672097Z] [Duration: 0 ms] [Url: GET /akhq/ui/login] [Status: 200] [Ip: /10.127.79.109] [User: my_user_id]"
2022-12-07T07:26:57.730 level=INFO thread=default-nioEventLoopGroup-1-3 releaseVersion=0.23.0 logger=org.akhq.log.access msg="[Date: 2022-12-07T07:26:57.730406Z] [Duration: 0 ms] [Url: GET /akhq/ui/static/css/2.1e4ddb81.chunk.css] [Status: 200] [Ip: /10.127.79.109] [User: my_user_id]"
2022-12-07T07:26:57.757 level=INFO thread=default-nioEventLoopGroup-1-3 releaseVersion=0.23.0 logger=org.akhq.log.access msg="[Date: 2022-12-07T07:26:57.757935Z] [Duration: 0 ms] [Url: GET /akhq/ui/static/css/main.67b5c8bc.chunk.css] [Status: 200] [Ip: /10.127.79.109] [User: my_user_id]"
2022-12-07T07:26:57.770 level=INFO thread=default-nioEventLoopGroup-1-4 releaseVersion=0.23.0 logger=org.akhq.log.access msg="[Date: 2022-12-07T07:26:57.77083Z] [Duration: 0 ms] [Url: GET /akhq/ui/static/js/2.31f57972.chunk.js] [Status: 200] [Ip: /10.127.80.76] [User: my_user_id]"
2022-12-07T07:26:57.773 level=INFO thread=default-nioEventLoopGroup-1-3 releaseVersion=0.23.0 logger=org.akhq.log.access msg="[Date: 2022-12-07T07:26:57.773544Z] [Duration: 0 ms] [Url: GET /akhq/ui/static/js/main.ab246577.chunk.js] [Status: 200] [Ip: /10.127.79.109] [User: my_user_id]"
2022-12-07T07:26:57.913 level=INFO thread=io-executor-thread-29 releaseVersion=0.23.0 logger=org.akhq.log.access msg="[Date: 2022-12-07T07:26:57.912666Z] [Duration: 0 ms] [Url: GET /akhq/api/me] [Status: 200] [Ip: /10.127.80.76] [User: my_user_id]"
2022-12-07T07:26:57.914 level=INFO thread=io-executor-thread-27 releaseVersion=0.23.0 logger=org.akhq.log.access msg="[Date: 2022-12-07T07:26:57.914263Z] [Duration: 0 ms] [Url: GET /akhq/api/auths] [Status: 200] [Ip: /10.127.79.109] [User: my_user_id]"
2022-12-07T07:26:57.948 level=INFO thread=io-executor-thread-27 releaseVersion=0.23.0 logger=org.akhq.log.access msg="[Date: 2022-12-07T07:26:57.948507Z] [Duration: 0 ms] [Url: GET /akhq/api/cluster] [Status: 200] [Ip: /10.127.80.76] [User: my_user_id]"
2022-12-07T07:26:57.973 level=INFO thread=default-nioEventLoopGroup-1-3 releaseVersion=0.23.0 logger=org.akhq.log.access msg="[Date: 2022-12-07T07:26:57.97332Z] [Duration: 0 ms] [Url: GET /akhq/api/cluster] [Status: 200] [Ip: /10.127.79.109] [User: my_user_id]"
2022-12-07T07:26:57.983 level=INFO thread=default-nioEventLoopGroup-1-4 releaseVersion=0.23.0 logger=org.akhq.log.access msg="[Date: 2022-12-07T07:26:57.983594Z] [Duration: 0 ms] [Url: GET /akhq/ui/static/media/icon.b0009f25.svg] [Status: 200] [Ip: /10.127.80.76] [User: my_user_id]"
2022-12-07T07:26:57.983 level=INFO thread=default-nioEventLoopGroup-1-3 releaseVersion=0.23.0 logger=org.akhq.log.access msg="[Date: 2022-12-07T07:26:57.983724Z] [Duration: 0 ms] [Url: GET /akhq/ui/static/media/logo.3e63da17.svg] [Status: 200] [Ip: /10.127.79.109] [User: my_user_id]"

2 replies

czomo Dec 14, 2022

Hey @AdiWehrli What's yours redirect_url and login url in your oidc provider. Did you manage to solve it?

AdiWehrli Jan 11, 2023
Author

Hey @AdiWehrli What's yours redirect_url and login url in your oidc provider. Did you manage to solve it?

Yes, finally I could solve this using a workaround inspired by @kyleli666 in comment 4410461 using Kubernetes ingress:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /
  labels:
    app: akhq
  name: akhq-ingress
spec:
  ingressClassName: nginx
  rules:
  - host: <hostname>
    http:
      paths:
      - backend:
          service:
            name: akhq
            port:
              number: 80
        path: /
        pathType: Prefix
      - backend:
          service:
            name: akhq
            port:
              number: 80
        path: /akhq/akhq/
        pathType: Prefix

The key additions here are

nginx.ingress.kubernetes.io/rewrite-target: /
the second path definition for /akhq/akhq

kyleli666 · 2022-12-15T13:37:50Z

kyleli666
Dec 15, 2022

I have the same issue with 0.23.0. Here is the browser redirections.
I deploy it under "/akhq", but after login, the after-login page path seems to have an adittional "/akhq", which I guess cause the problem.

This does not happen on any path else, could anyone help?

7 replies

czomo Dec 15, 2022

Looks like you have, unlike me, correct roles mapping. Did you set redirect_url in your OpenID provider? I should be something like
https://<full_url_paste_here>/oauth/callback/<your_provider_name_here>

kyleli666 Dec 15, 2022

no, I use the default url, which is the same as you mentioned. I did not find how to set it from document
For role mapping, I haven't touch that. I just used default admin, and marked out all the other configs... :P

      # OIDC configuration
      oidc:
        enabled: true
        providers:
          cognito:
            label: "Login with Cognito"
            username-field: preferred_username
            # groups-field: roles
            default-group: admin
            # groups:
            #   - name: oidc-admin-group
            #     groups:
            #       - admin
            # users:
            #   - username: einstein
            #     groups:
            #       - admin

czomo Dec 15, 2022

Hmm I followed your configuration but I didn't encounter your issue. It normally redirect to /ui in my case. Unfortunately without group mapping

kyleli666 Dec 15, 2022

Did you set the groups in "akhq" part of the configuration? My "admin" group is set there.

  akhq:
    connections:
      all-in-one:
        properties:
          bootstrap.servers: "kafka.shared:9092"
    # Auth & Roles (optional)
    security:
      default-group: no-access # Default groups for all the user even unlogged user
      # Groups definition
      groups:
        no-access: {}
        admin: # unique key
          name: admin # Group name
          roles:  # roles for the group
            - group
            - group/delete

czomo Dec 15, 2022

No, I wanted to use the default groups: no-roles, admin, reader from here. As far I understand the only thing I need to add is group mapping between akhq and oidc provider

    akhq:
      security:
        default-group: no-roles
        oidc:
          enabled: true
          providers:
            jumpcloud:
              label: "Login with JumpCloud"
              default-group: reader
              username-field: email 
              groups-field: roles # field that contain user groups
              groups:
                - name: oidc-admin-group #name of group passed from oidc
                  groups:
                    - admin

kyleli666 · 2022-12-15T14:03:13Z

kyleli666
Dec 15, 2022

I found a hack workaround with the power of istio.... XD
I modify the doubled /akhq/akhq prefix to /akhq ...

---
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: akhq-vs
  namespace: manage-tool
spec:
  gateways:
    - shared/portal-gw
  hosts:
    - "*"
  http:
    - name: akhq-akhq
      match:
        - uri:
            prefix: /akhq/akhq
      rewrite:
        uri: /akhq
      route:
        - destination:
            host: akhq.manage-tool.svc.cluster.local
    - name: akhq
      match:
        - uri:
            prefix: /akhq
      route:
        - destination:
            host: akhq.manage-tool.svc.cluster.local

2 replies

czomo Dec 15, 2022

Nice one xD 🎖️

kyleli666 Dec 15, 2022

This work around also useful for issue #907

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

After successful login over OIDC AKHQ always redirects to login page after click on login button #1297

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Replies: 3 comments 11 replies

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Select a reply

After successful login over OIDC AKHQ always redirects to login page after click on login button #1297

Replies: 3 comments · 11 replies

AdiWehrli Dec 7, 2022 Author

AdiWehrli Jan 11, 2023 Author

Replies: 3 comments 11 replies

AdiWehrli
Dec 7, 2022
Author

AdiWehrli Jan 11, 2023
Author