Using openid authentication in dev mode

[TheKrystek]

Hi, I've been struggling to setup authentication for public users. I'm using keycloak and alfio is started in dev mode (backend running on 8080 and frontend on 4200).
I can create an account, then login, then BaseOpenIdAuthenticationManager.createOrRetrieveUser returns valid authentication. However when request is sent from angular app /api/v2/public/user/me to obtain user's identity object Authentication principal is always null. Since as far I can tell everything on keycloak side looks alight I suspect there might be something wrong/missing with alfio itself.

I'd gladly get some pointers:)

[cbellone]

Hi @TheKrystek ,

you are right. Something is definitely wrong with the configuration.
This was most likely caused by the migration to a newer Spring Security version.
I am investigating, thank you for pointing this out! 👍

[TheKrystek]

That was my original thought, that during the migration something has been misconfigured or simply missed. Today I also checked an older version from mid Feb 2024, and still I'm not able to make it work. Hope that information helps.

[cbellone]

I was referring to the "main" branch. This code has not been released yet.
Released versions should work with OpenId. It is working on multiple production instances.
Can you share the steps you followed to configure OpenId authentication, including configuration? Please remove any sensitive data before sharing, thanks

[TheKrystek]

Ok, so here is the JSON config:

{
	"scheme": "http",
	"domain": "localhost:8002",
	"clientId": "alfio",
	"clientSecret": "86g1F3Ij....",
	"callbackURI": "http://localhost:8080/openid/callback",
	"authenticationUrl": "/realms/alfio/protocol/openid-connect/auth",
	"tokenEndpoint": "/realms/alfio/protocol/openid-connect/token",
	"rolesParameter": "roles",
	"alfioGroupsParameter": "org-roles",
	"logoutUrl": "/realms/alfio/protocol/openid-connect/logout",
	"logoutRedirectUrl": "http://localhost:4200"
}

I used the latest keycloak and did the setup:

• Created a new realm alfio
• Created a new client alfio
• Added two scopes:
• given_name > mappers > add predefined mapper > given_name
• family_name > mappers > add predefined mapper > family_name

I think this is all non-trivial configuration I did.

[cbellone]

Configuration looks OK.

Please note that:

• the "scheme" parameter is not supported and will be ignored
• end users don't belong to any group, so any parameter related will be ignored

see #1380 (comment) .
Can you please try it again?

[TheKrystek]

Sure, will take a look later this week. Thank you a lot for a quick fix :)

[TheKrystek]

Can confirm that your last fix did the trick :) Now it works as intended, thx again.