Errai 3.2.0-snapshot and Keycloak 1.2.0.Final - coninued pains

[hr.stoyanov]

Hi all.

I am stuck and I wonder if someone has been through the same issues I am facing with Errai 3.2.0-SNAPSHOT and Keycloak 1.2.0.Final (I have the same issues with older versions too). Ant clue? I am completely out of ideas, especially with the Errai Security Demo seems to work with the same configuration!

Below is my web.xml which closely mimics the one from Errai security demo:

1. What I noticed first was that after a succeessful KC login, KC redirects back to the wrong url: http://localhost:8080/draft/app-login  instead of http://localhost:8080/draft/app-login/index_draft.jsp  The reason turns out to be that the LoginRedirectFilter never gets called,, so the redirectLocation is not picked up!

2. After wasting quite some time, I discovered that I need to comment out the entire <security-constraint> ... </security-constraint> section in my web.xml, to get my debugger prove that the filter now gets called.

Why is <security-constraint> ... </security-constraint> suppressing the filter and why this is not happening with the Errai Security Demo?

Next however, this leads  to a different type of exception in the doFilter() method:

Context Path:

/draft

Servlet Path:

/app-login

Path Info:

null

Query String:

null

Stack Trace

org.jboss.weld.exceptions.IllegalProductException: WELD-000054: Producers cannot produce non-serializable instances for injection into non-transient fields of passivating beans Producer: Producer Method [AuthenticationService] with qualifiers [@Filtered @Any] declared as [[BackedAnnotatedMethod] @Produces @Filtered public org.jboss.errai.security.keycloak.extension.WrappedServiceProducer.getWrappedAuthenticationService()] Injection Point: [BackedAnnotatedField] @Inject @Filtered private org.jboss.errai.security.keycloak.KeycloakAuthenticationService.wrappedAuthService

org.jboss.weld.bean.AbstractProducerBean.checkReturnValue(AbstractProducerBean.java:157)

org.jboss.weld.bean.AbstractProducerBean.create(AbstractProducerBean.java:184)

org.jboss.weld.context.unbound.DependentContextImpl.get(DependentContextImpl.java:69)

org.jboss.weld.manager.BeanManagerImpl.getReference(BeanManagerImpl.java:742)

org.jboss.weld.manager.BeanManagerImpl.getInjectableReference(BeanManagerImpl.java:840)

org.jboss.weld.injection.FieldInjectionPoint.inject(FieldInjectionPoint.java:92)

org.jboss.weld.util.Beans.injectBoundFields(Beans.java:370)

org.jboss.weld.util.Beans.injectFieldsAndInitializers(Beans.java:381)

org.jboss.weld.injection.producer.ResourceInjector$1.proceed(ResourceInjector.java:70)

org.jboss.weld.injection.InjectionContextImpl.run(InjectionContextImpl.java:48)

org.jboss.weld.injection.producer.ResourceInjector.inject(ResourceInjector.java:72)

org.jboss.weld.injection.producer.BasicInjectionTarget.inject(BasicInjectionTarget.java:121)

org.jboss.weld.bean.ManagedBean.create(ManagedBean.java:150)

org.jboss.weld.util.bean.IsolatedForwardingBean.create(IsolatedForwardingBean.java:44)

org.jboss.weld.context.AbstractContext.get(AbstractContext.java:96)

org.jboss.weld.context.PassivatingContextWrapper$AbstractPassivatingContextWrapper.get(PassivatingContextWrapper.java:76)

org.jboss.weld.bean.proxy.ContextBeanInstance.getInstance(ContextBeanInstance.java:98)

org.jboss.weld.bean.proxy.ProxyMethodHandler.invoke(ProxyMethodHandler.java:99)

org.jboss.errai.security.keycloak.KeycloakAuthenticationService$Proxy$_$$_WeldClientProxy.setSecurityContext(Unknown Source)

org.jboss.errai.security.keycloak.LoginRedirectFilter.doFilter(LoginRedirectFilter.java:68)

====================================================================================

<?xml version="1.0" encoding="UTF-8"?>

<web-app xmlns="http://xmlns.jcp.org/xml/ns/javaee"

        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

        xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_3_1.xsd"

        version="3.1">

    <!-- Default page to serve -->

    <welcome-file-list>

        <welcome-file>index_draft.jsp</welcome-file>

    </welcome-file-list>

    <!--  This error page rule responds with the GWT Host page for pushstate Errai Navigation URLs -->

    <error-page>

        <error-code>404</error-code>

        <location>/</location>

    </error-page>

    <!-- Erray Keycloak security --> 

    <filter>

        <filter-name>ErraiLoginRedirectFilter</filter-name>

        <init-param>

            <param-name>redirectLocation</param-name>

            <param-value>/index_draft.jsp</param-value>

        </init-param>

    </filter>

    <!-- JAX-RS configuration-->

    <servlet-mapping>

        <servlet-name>javax.ws.rs.core.Application</servlet-name>

        <url-pattern>/rest/*</url-pattern>

    </servlet-mapping>

    <filter-mapping>

        <filter-name>ErraiUserCookieFilter</filter-name>

        <url-pattern>/index_draft.jsp</url-pattern>

    </filter-mapping>

    <filter-mapping>

        <filter-name>ErraiLoginRedirectFilter</filter-name>

        <url-pattern>/app-login</url-pattern>

    </filter-mapping>

    <security-constraint>

        <web-resource-collection>

            <web-resource-name>Login</web-resource-name>

            <url-pattern>/app-login</url-pattern>

        </web-resource-collection>

        <auth-constraint>

            <role-name>*</role-name>

        </auth-constraint>

    </security-constraint>

    <login-config>

        <auth-method>KEYCLOAK</auth-method>

        <realm-name>TEST</realm-name>

    </login-config>

    <security-role>

        <role-name>user</role-name>

    </security-role>

    <security-role>

        <role-name>admin</role-name>

    </security-role>

</web-app>

[ddadlani]

Hello Hristo,

We are unable to reproduce your issue. Can you give some more detail about how your app's Keycloak setup differs from the security demo?

Cheers,
Divya

[jmbarone]

I had the same issue ... fixed adding the security-picketlink dependency to the pom.

I thought that it was not necessary because i'm not using picketlink, but ...

Cheers.

[mbarkley]

Hi Jose,

You shouldn't need to add the errai-security-picketlink. The KeycloakAuthenticationService should work without any other AuthenticationService (including the one in errai-security-picketlink), but it looks like there's a bug in how the KeycloakAuthenticationService handles this case.

Rather than including errai-security-picketlink, you could try implementing your own dummy authentication service like this one (except make it @ApplicationScoped or Serializable): https://github.com/errai/errai/blob/master/errai-security/errai-security-keycloak/src/main/java/org/jboss/errai/security/keycloak/extension/WrappedServiceProducer.java#L60-L80

The KeycloakAuthenticationService always wraps another AuthenticationService that provides logins from within the application. If none is provided by the user, errai-security-keycloak provides the dummy one linked above. From the error message it looks like problem is that the above dummy service should be serializable because it is @Dependent. If adding a dummy service that is Serializable or @ApplicationScoped fixes this problem, we can add this fix to errai-security-keycloak for the next release.

Cheers.

[jmbarone]

Hi Max ... yes, the problem it is in the injection with the dummy service ...

I see that, but trying to do the "quick fix" ... i added the picketlink service and it worked ...

I agree with you that is a workaround and not a solution, but i think the solution cannot be on the developer side.

if you can add the solution to the code it will be great.

Cheers

[hr.stoyanov]

Hi Jose and Max,

I spent some time looking into this issue again as it is show-stopper for a very important project of mine. When you say that you have the "same issue", do you mean that your

<security-constraint>...</security-constraint> section in your web.xml is suppressing the LoginRedirectFilter filter as I described in the original post from June? This is what kills me and I cannot figure out why this is happening. Adding PicketLinnk did not help .

Here is what happens:

1. I have a url in my app that is supposed to trigger KC authentication: http://localhost:8080/draft/app-login

2. Because of the <decurity-constraint> KC receives this url:

http://localhost:8080/auth/realms/MyAppRealm/protocol/openid-connect/auth?response_type=code&client_id=s4g&redirect_uri…

where if you decode the redirect_uri, it is http://localhost:8080/draft/app-login, which is not what I want - after successful authentication, KC returns to this url and gets 403 - Forbidden http response.

I do specify redirectLocation for LoginRedirectFilter, but it is never used obviously.

3. As I mentioned I can prove with  debugger that the LoginRedirectFilter never gets invoked unless I comment out the entire <security-constraint> section, which is pointless.

5. As a test, I even created another filter,  TestFilter that maps to the same url: /app-login and it never gets involved either:

<filter-mapping>

        <filter-name>TestFilter</filter-name>

        <url-pattern>/app-login</url-pattern>

</filter-mapping>

At this point not sure if this is Undertow, Keycloak or Errai issue. The only think I can think of is that the WF9 Keycloak adapter somehow messes up (throws exception?)  Undertow and prevents subsequent filters from being invoked. But the WF  9.0.1 console shows nothing?

[jmbarone]

In web.xml are specified the roles that you created for the client in the keycloak server?

The redirect uri configuration it is correct?

[hr.stoyanov]

Jose,

It turns out that <security-context> should take precedence over any filter. The later are executed only after successful authorization. In my case obviously KC returns back to an invalid URL, which I need to fix somehow.

[mbarkley]

Jose,

I agree that we need a fix for this upstream. That's why I was asking if you could try implementing your own dummy service as described in my previous comment in order to verify that the problem is fixed .

If you can verify this works, I will schedule a fix for our next release.

[jmbarone]

Max ... first i removed the errai-security-picketlink dependency on pom.xml and the infamous exception appears after the login on keycloak stage

org.jboss.weld.exceptions.IllegalProductException: WELD-000054: Producers cannot produce non-serializable instances for injection into non-transient fields of passivating beans Producer: Producer Method

So, we're in the "initial status".

Then, i add the next class in my xxxxx.client.local package

public class DummyAuthenticationService implements AuthenticationService, Serializable {

    private static final long serialVersionUID = 1L;

    @Override

    public User login(String username, String password) {

          throw new FailedAuthenticationException(

                  "It should not be used!!!");

    }

    @Override

    public boolean isLoggedIn() {

        return false;

    }

    @Override

    public void logout() {

    }

    @Override

    public User getUser() {

        return User.ANONYMOUS;

    }

}

... and the execption appears again ...

then, i added @ApplicationScoped on the class with the same results ...

[mbarkley]

Jose,

Thanks for taking the time to try this! But if my reasoning is correct, the DummyAuthenticationService should be in a server package in order to fix the problem. Would you mind trying one more time with that class deployed to the server?

If that doesn't work, I will look into this issue further myself.

Cheers.

[jmbarone]

Yes! That's my mistake   sorry ... i added on the server package and it works!

Thank you Max!

[mbarkley]

Great! I've scheduled this fix for 3.2.1.Final (here is the issue).

Cheers.

[hr.stoyanov]

Confirmed too! Adding fake authentication service on the server side fixes, the issue.

When is 3.2.1 going to be released!

[mbarkley]

Hristo,

3.2.1.Final is currently scheduled for Oct 30, 2015. You can track the progress here.