SAML Config

[quer0016]

Hello team, I have configured SAML with Cloudconnexa but I have the following problems:

1. I can only validate the admin user
2. I cannot use two-factor methods in SAML validation

The configuration in cloudconnexa:

The configuration in KC:


When I log in with SAML:

And loging ok:

The problem is that if I try to access with another user other than the admin, it does not access despite existing in the local jans database.
And on the other hand, the login is done from keycloak and not jans-casa, so if I have a two-factor method, it is not used

[nynymike]

@uprightech can you investigate?

[uprightech]

A separate realm is used for janssen related resources on keycloak called jans. I can see from the screenshot you're referring to the master realm. Could you replace the IDP authentication endpoint and make sure it points to the jans realm and also that the users are created within that realm and then try again?
Thanks

[quer0016]

Hello team,
I have now this config:
In cloudconnexa

In KC - Flex:

Users:

Login has not yet been done through jans-casa

Login test:
user admin:

user test:

logs:

[nynymike]

I don't understand why you are using the KC admin GUI to configure KC. We only support configuration via the Jans Config API, e.g. using the CLI or TUI.

[quer0016]

Because I have tried it from the adminui as well as from the TUI and it has not worked.
I can configure again by those means and see what happens.

[nynymike]

We only support the Gluu interface. If you start managing stuff directly in KC, you'll need to post of the KC forums :-)

[quer0016]

Config TUI SAML

Access test:

The problem I have when doing it from the TUI or adminui I have tried loading the XML and manually

[nynymike]

@uprightech can you try to replicate?

[uprightech]

Sure , let me look into it

[quer0016]

Hello team.
I have tried to configure SAML with Nextcloud and I detect that the same problem occurs despite configuring from the ADMINUI with the XML or manually

In Nextcloud:

SAML Tracer:

[uprightech]

Please could you provide us with the keycloak logs in /opt/keycloak/logs/ ? That would be helpful , thank you.

[quer0016]

2024-05-10 12:13:00,587 INFO [org.keycloak.quarkus.runtime.hostname.DefaultHostnameProvider] (main) Hostname settings: Base URL: <unset>, Hostname: test.test.es, Strict HTTPS: true, Path: /kc, Strict BackChannel: false, Admin URL: <unset>, Admin: test.test.es, Port: -1, Proxied: true 2024-05-10 12:13:03,105 WARN [io.quarkus.agroal.runtime.DataSources] (main) Datasource <default> enables XA but transaction recovery is not enabled. Please enable transaction recovery by setting quarkus.transaction-manager.enable-recovery=true, otherwise data may be lost if the application is terminated abruptly 2024-05-10 12:13:03,438 WARN [org.infinispan.PERSISTENCE] (keycloak-cache-init) ISPN000554: jboss-marshalling is deprecated and planned for removal 2024-05-10 12:13:03,610 WARN [org.infinispan.CONFIG] (keycloak-cache-init) ISPN000569: Unable to persist Infinispan internal caches as no global state enabled 2024-05-10 12:13:03,738 INFO [org.infinispan.CONTAINER] (keycloak-cache-init) ISPN000556: Starting user marshaller 'org.infinispan.jboss.marshalling.core.JBossUserMarshaller' 2024-05-10 12:13:05,540 WARN [io.quarkus.vertx.http.runtime.VertxHttpRecorder] (main) The X-Forwarded-* and Forwarded headers will be considered when determining the proxy address. This configuration can cause a security issue as clients can forge requests and send a forwarded header that is not overwritten by the proxy. Please consider use one of these headers just to forward the proxy address in requests. 2024-05-10 12:13:05,956 INFO [org.keycloak.connections.infinispan.DefaultInfinispanConnectionProviderFactory] (main) Node name: node_642232, Site name: null 2024-05-10 12:13:05,966 INFO [org.keycloak.broker.provider.AbstractIdentityProviderMapper] (main) Registering class org.keycloak.broker.provider.mappersync.ConfigSyncEventListener 2024-05-10 12:13:07,135 INFO [io.quarkus] (main) Keycloak 23.0.3 on JVM (powered by Quarkus 3.2.9.Final) started in 8.707s. Listening on: http://127.0.0.1:8083 2024-05-10 12:13:07,136 INFO [io.quarkus] (main) Profile dev activated. 2024-05-10 12:13:07,136 INFO [io.quarkus] (main) Installed features: [agroal, cdi, hibernate-orm, jdbc-h2, jdbc-mariadb, jdbc-mssql, jdbc-mysql, jdbc-oracle, jdbc-postgresql, keycloak, logging-gelf, micrometer, narayana-jta, reactive-routes, resteasy-reactive, resteasy-reactive-jackson, smallrye-context-propagation, smallrye-health, vertx] 2024-05-10 12:13:07,218 WARN [org.keycloak.quarkus.runtime.KeycloakMain] (main) Running the server in development mode. DO NOT use this configuration in production. 2024-05-17 08:35:36,915 WARN [org.keycloak.events] (executor-thread-1) type=LOGIN_ERROR, realmId=281764bf-821f-4222-b2c3-74bce9453444, clientId=null, userId=null, ipAddress=85.62.184.58, error=client_not_found, reason=Cannot_match_source_hash 2024-05-17 08:36:20,012 WARN [org.keycloak.events] (executor-thread-2) type=LOGIN_ERROR, realmId=281764bf-821f-4222-b2c3-74bce9453444, clientId=null, userId=null, ipAddress=85.62.184.58, error=client_not_found, reason=Cannot_match_source_hash 2024-05-17 08:38:16,812 WARN [org.keycloak.events] (executor-thread-8) type=LOGIN_ERROR, realmId=281764bf-821f-4222-b2c3-74bce9453444, clientId=null, userId=null, ipAddress=85.62.184.58, error=client_not_found, reason=Cannot_match_source_hash 2024-05-17 08:44:38,163 WARN [org.keycloak.events] (executor-thread-10) type=LOGIN_ERROR, realmId=281764bf-821f-4222-b2c3-74bce9453444, clientId=null, userId=null, ipAddress=85.62.184.58, error=client_not_found, reason=Cannot_match_source_hash 2024-05-17 08:45:05,019 WARN [org.keycloak.events] (executor-thread-14) type=LOGIN_ERROR, realmId=281764bf-821f-4222-b2c3-74bce9453444, clientId=null, userId=null, ipAddress=85.62.184.58, error=client_not_found, reason=Cannot_match_source_hash 2024-05-17 08:48:50,109 WARN [org.keycloak.events] (executor-thread-13) type=LOGIN_ERROR, realmId=281764bf-821f-4222-b2c3-74bce9453444, clientId=null, userId=null, ipAddress=85.62.184.58, error=client_not_found, reason=Cannot_match_source_hash 2024-05-17 08:50:20,684 WARN [org.keycloak.events] (executor-thread-16) type=LOGIN_ERROR, realmId=281764bf-821f-4222-b2c3-74bce9453444, clientId=null, userId=null, ipAddress=85.62.184.58, error=client_not_found, reason=Cannot_match_source_hash 2024-05-17 08:52:36,309 WARN [org.keycloak.events] (executor-thread-19) type=LOGIN_ERROR, realmId=281764bf-821f-4222-b2c3-74bce9453444, clientId=null, userId=null, ipAddress=85.62.184.58, error=client_not_found, reason=Cannot_match_source_hash 2024-05-17 08:53:05,925 WARN [org.keycloak.events] (executor-thread-23) type=LOGIN_ERROR, realmId=281764bf-821f-4222-b2c3-74bce9453444, clientId=null, userId=null, ipAddress=85.62.184.58, error=client_not_found, reason=Cannot_match_source_hash 2024-05-17 08:54:24,639 WARN [org.keycloak.events] (executor-thread-23) type=LOGIN_ERROR, realmId=281764bf-821f-4222-b2c3-74bce9453444, clientId=null, userId=null, ipAddress=85.62.184.58, error=client_not_found, reason=Cannot_match_source_hash 2024-05-17 08:54:58,071 WARN [org.keycloak.events] (executor-thread-26) type=LOGIN_ERROR, realmId=281764bf-821f-4222-b2c3-74bce9453444, clientId=null, userId=null, ipAddress=85.62.184.58, error=client_not_found, reason=Cannot_match_source_hash

[uprightech]

Hello,
We may need to increase the log level to see what is happening , but first , could you log into keycloak , and send me a screenshot of the list of clients in the jans realm ? Thank you.

[quer0016]

https://nextcloud.quersys.com/s/omGg9WTdj9akHKS

[uprightech]

Hello @quer0016 , I'm sorry for the delayed response. There is so much noise in the logs it's hard to pinpoint what could be wrong. If possible, could we run it this way , so we figure it out ?
. stop the jans-auth service . service jans-auth stop or systemctl stop jans-auth
. delete all logs in /opt/jans/jetty/jans-auth/logs
. start the jans-auth service again
. run the authentication again , export the logs and send.

Thanks again. Meanwhile , 1.1.2 of jans will be released soon, and will contain the relevant changes related to SAML.

[quer0016]

Hello @uprightech , do not worry about the delay, and I apologize for the noise in the logs, I have been doing many tests and I imagine it would be crazy, I attach two zip, one of Trace and one with WARN, I detect some errors in the last one.

https://colabora.quersys.com/s/WHssmQFy6T9JZK7

Great, I will check now 1.1.2

[quer0016]

The same thing is still happening in 1.1.2 :(
Logs KC

2024-05-30 08:56:23,251 INFO  [io.quarkus] (main) Installed features: [agroal, cdi, hibernate-orm, jdbc-h2, keycloak, logging-gelf, narayana-jta, reactive-routes, resteasy-reactive, resteasy-reactive-jackson, smallrye-context-propagation, vertx]
2024-05-30 08:56:23,368 WARN  [org.keycloak.quarkus.runtime.KeycloakMain] (main) Running the server in development mode. DO NOT use this configuration in production.
2024-05-30 09:30:39,495 WARN  [org.keycloak.events] (executor-thread-2) type="LOGIN_ERROR", realmId="ce469906-2e11-4e99-be7e-2244984ed129", clientId="null", userId="null", ipAddress="IP", error="client_not_found", reason="Cannot_match_source_hash"
2024-05-30 09:32:02,949 WARN  [org.keycloak.events] (executor-thread-6) type="LOGIN_ERROR", realmId="ce469906-2e11-4e99-be7e-2244984ed129", clientId="null", userId="null", ipAddress="IP", error="client_not_found", reason="Cannot_match_source_hash"
2024-05-30 09:33:47,799 WARN  [org.keycloak.events] (executor-thread-10) type="LOGIN_ERROR", realmId="ce469906-2e11-4e99-be7e-2244984ed129", clientId="null", userId="null", ipAddress="IP", error="client_not_found", reason="Cannot_match_source_hash"

[uprightech]

I am sorry to hear that.
I'll verify again and get back to you. Thanks for testing.