OIDC - Keycloak - Login Error #21259
Comments
|
@marcossilvestrini
This is likely b/c they are using different clients and you misconfigured in Harbor. |
reasonerjt
added
the
more-info-needed
|
@reasonerjt By the way... the oidc server test is successful... does this validate as credentials?
Client id and secret validate with curl: curl -X POST \
https://keycloak.local/realms/production/protocol/openid-connect/token \
-H "Content-Type: application/x-www-form-urlencoded" \
-d "grant_type=authorization_code" \
-d "code=foo" \
-d "redirect_uri=https://harbor.local/c/oidc/callback" \
-d "client_id=harbor" \
-d "client_secret=foo"
Result: {"access_token":"foobar","expires_in":300,"refresh_expires_in":0,"token_type":"Bearer","id_token":"foo","not-before-policy":0,"session_state":"0b1b1db7-243f-46cd-ac80-8f2bca7780ff","scope":"openid address profile email microprofile-jwt groups organization"} |
I'm having trouble using Keycloak as authentication in my Harbor.
I deployed it with this values(chart release: 1.16.0):
My harbor oidc configurations:
OIDC Provider Name keycloak OIDC Endpoint https://keycloak.local/realms/production OIDC Client ID harbor OIDC Client Secret foobarbeer OIDC Scope openid,profile,email,offline_access Verify Certificate trueMy keycloak client:
{ "clientId": "harbor", "name": "harbor", "description": "Harbor client", "rootUrl": "https://harbor.local", "adminUrl": "https://harbor.local", "baseUrl": "https://harbor.local", "surrogateAuthRequired": false, "enabled": true, "alwaysDisplayInConsole": false, "clientAuthenticatorType": "client-secret", "secret": "my-secret-here", "redirectUris": [ "https://harbor.local/c/oidc/callback" ], "webOrigins": [ "https://harbor.local" ], "notBefore": 0, "bearerOnly": false, "consentRequired": false, "standardFlowEnabled": true, "implicitFlowEnabled": false, "directAccessGrantsEnabled": true, "serviceAccountsEnabled": true, "publicClient": false, "frontchannelLogout": true, "protocol": "openid-connect", "attributes": { "oidc.ciba.grant.enabled": "false", "client.secret.creation.time": "1732804243", "backchannel.logout.session.required": "true", "oauth2.device.authorization.grant.enabled": "false", "backchannel.logout.revoke.offline.tokens": "false" }, "authenticationFlowBindingOverrides": {}, "fullScopeAllowed": true, "nodeReRegistrationTimeout": -1, "protocolMappers": [ { "name": "Client Host", "protocol": "openid-connect", "protocolMapper": "oidc-usersessionmodel-note-mapper", "consentRequired": false, "config": { "user.session.note": "clientHost", "id.token.claim": "true", "introspection.token.claim": "true", "access.token.claim": "true", "claim.name": "clientHost", "jsonType.label": "String" } }, { "name": "Client ID", "protocol": "openid-connect", "protocolMapper": "oidc-usersessionmodel-note-mapper", "consentRequired": false, "config": { "user.session.note": "client_id", "id.token.claim": "true", "introspection.token.claim": "true", "access.token.claim": "true", "claim.name": "client_id", "jsonType.label": "String" } }, { "name": "Client IP Address", "protocol": "openid-connect", "protocolMapper": "oidc-usersessionmodel-note-mapper", "consentRequired": false, "config": { "user.session.note": "clientAddress", "id.token.claim": "true", "introspection.token.claim": "true", "access.token.claim": "true", "claim.name": "clientAddress", "jsonType.label": "String" } } ], "defaultClientScopes": [ "web-origins", "acr", "address", "profile", "roles", "offline_access", "organization", "harbor", "groups", "microprofile-jwt", "basic", "email" ], "optionalClientScopes": [ "phone" ], "access": { "view": true, "configure": true, "manage": true } }Firefox error 400 :
'oauth2: "unauthorized_client" "Invalid client or Invalid client credentials"'url:
Test with curl(I modify keycloak client, parameter Use refresh tokens for this test):
Payload result:
{ "access_token": "foobarbeer", "expires_in": 300, "refresh_expires_in": 0, "token_type": "Bearer", "id_token": "foobarbeer", "not-before-policy": 0, "session_state": "fab50f9b-d4af-4757-a1cf-2c24f92636b0", "scope": "openid address profile email microprofile-jwt groups organization" }access_token decrypted:
{ "exp": 1732807056, "iat": 1732806756, "auth_time": 1732806690, "jti": "fooobarbeer", "iss": "https://keycloak.local/realms/production", "aud": [ "realm-management", "broker", "account" ], "sub": "foobarberr", "typ": "Bearer", "azp": "harbor", "sid": "fooooooo-d4af-4757-a1cf-2c24f92636b0", "acr": "1", "allowed-origins": [ "https://harbor.local" ], "realm_access": { "roles": [ "default-roles-production" ] }, "resource_access": { "realm-management": { "roles": [ "view-identity-providers", "view-realm", "manage-identity-providers", "impersonation", "realm-admin", "create-client", "manage-users", "query-realms", "view-authorization", "query-clients", "query-users", "manage-events", "manage-realm", "view-events", "view-users", "view-clients", "manage-authorization", "manage-clients", "query-groups" ] }, "broker": { "roles": [ "read-token" ] }, "account": { "roles": [ "manage-account", "view-applications", "view-consent", "view-groups", "manage-account-links", "manage-consent", "delete-account", "view-profile" ] } }, "scope": "openid address profile email microprofile-jwt groups organization", "group_membership": [ "admin", "architects" ], "upn": "marcos_roberto", "email_verified": false, "address": {}, "name": "Marcos Roberto", "groups": [ "default-roles-production", "default-roles-production", "default-roles-production" ], "preferred_username": "marcos_roberto", "given_name": "Marcos", "family_name": "Roberto" }harbor-core logs:
keycloak logs:
I've tried everything, but I can't get OIDC to work on my Harbor. I use Keycloak with all other apps like ArgoCD, Vault, Grafana, etc., but it doesn't work with Harbor.
The text was updated successfully, but these errors were encountered: