-
-
Notifications
You must be signed in to change notification settings - Fork 646
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
unable to login after update to latest version #485
Comments
I don't know if this is related but we had some problems with the connection to our OIDC provider. He returned a claim with a role named admin and this didn't work, as akhq doesn't know a role with the name admin. We configured our OIDC provider to return a role which exists in akhq and it worked, like topic/read. |
Well on 0.14.1 this still worked, is it a regression ? |
Really busy today, but have you seen that the configuration files have changed ? (just in case not) https://github.com/tchiotludo/akhq/releases/tag/0.16.0 |
Yes, in the screenshot you can see i'm using the new format for the |
can you provide a full configuration files please ? |
|
I'll try with your configuration files, just remove some default value and it's working : version: "3.7"
services:
akhq:
image: tchiotludo/akhq:dev
network_mode: host
environment:
AKHQ_CONFIGURATION: |
micronaut:
security:
enabled: true
ldap:
default:
enabled: true
context:
server: 'ldap://ldap.forumsys.com:389'
managerDn: 'cn=read-only-admin,dc=example,dc=com'
managerPassword: 'password'
search:
base: "dc=example,dc=com"
groups:
enabled: true
base: "dc=example,dc=com"
jmx:
add-to-factory: false
register-endpoints: false
metrics:
enabled: false
server:
port: 28081
netty:
worker:
threads: 30 # see https://docs.micronaut.io/latest/guide/index.html#threadPools
akhq:
server:
connections:
local:
properties:
bootstrap.servers: "local:9092"
schema-registry:
url: "http://schema-registry:8085"
topic:
skip-consumer-groups: true # Skip loading consumer group information when showing topics
topic-data:
size: 20 # max record per page (default: 50)
poll-timeout: 10000 # The time, in milliseconds, spent waiting in poll if data is not available in the buffer.
parallel: 4
security:
default-group: no-roles
ldap:
default-group: reader
groups:
- name: "scientists"
groups:
- admin To be honest I don't see the issue ... I've a doubt on that : groups:
- name: reuse
attributes:
topics-filter-regexp: ".*" there is no roles defined here ! |
Thanks for having a look at this. Indeed there are no roles but this used to work before. My reasoning is that the akhq group defines only the topic filter, and then in the mapping of the ldap group we give the default group |
I don't think it was an intended behavior 😄 If you add the reader role, it's work ? |
Indeed, when adding |
why not just add 2 groups for this users ? groups:
- name: "ADM_DG"
groups:
- reuse
- reader
|
I have now this configuration:
but then in the topic overview, when clicking on the hour-glass button to the right i get this exception: |
Can you post the full configuration please ? |
It's just in my above comment |
its not the full one, just a snippet :) |
go a bit higher up :-) |
We have the same issue just using plain old basic-auth... It used to work and now we can't login. I removed all groups and I'm just using the default groups and it still will not work. With default-group set to "reader" we can access topics as readers, as before, but when we try to login, the login form very briefly appears and then we're back to the topics page, still not logged in. With default-group set to "no-role" then the login page appears and endlessly loops on itself and we can't login... ever. Logs don't show any errors. Here's my security config. It can't be more simple than that...
As I said, it worked before with 0.15.0 and I just reformatted the security config to the new format... nothing else changed. Any idea?? EDIT: Found my issue... I just added this section:
Before 0.16.0 it was "optional" as.... it worked without it. Now it looks like it's mandatory. |
just for information, are you using docker image ? or jar ? |
we're using jar |
Can you look at #500 ? |
no we don't use jwt, only ldap login. |
jwt now is the default session management and are mandatory for login. |
Indeed, adding the |
glad to know it |
Hi,
After updating to the latest version and migrating our config to the new format:
.. we find that we're no longer able to login. I have verified LDAP connectivity is working and the correct groups are returned.
Trying to get more debugging using this:
doesn't work as the login page intercepts that request and returns 307.
The text was updated successfully, but these errors were encountered: