Unable to retrieve user from repository (token-exchange turned off) #15
Comments
|
The users I tested were existing ones in Alfresco and in the Keyclock realm (same username and e-mail). |
|
Can you also check for (and provide) any log messages from the Repository log files (alfresco.log). Typically, the failure of Share to load the user data is based on the authentication / token being rejected at the backend. |
|
Hi @AFaust I have the same problem. However, as soon as I assign any role (https://github.com/Acosix/alfresco-keycloak/blob/docs-wip/docs/Simple-Configuration.md#roles--groups) to the user then Share can successfully load the user data. Is this related? |
|
Hi @AFaust , thank you for the reply!
I have checked alfresco.log for any failure message, but I was unable to find any. Apparently, the user succesfully log-in to Share, however the exception shown in the log doesn't allow the user to get to his dashboard. On Keycloak, I can list the active Share session.
I disabled verify-token-audience on Repository tier only ( On Share tier, I set
No problem! It is a complex project and I hope my doubts may help to evolve the project documentation. I will redo my setup using alfresco-7 docker images. |
@ayian2004 , thank you for the suggestion. I have browsed keycloak UI in order to assign roles, but I wasn't able to find a spot/tab/page where I could to the role configuration. Could you point me to keycloak docs where I could learn about? I believe that the suggested configuration should be done on share-client (keycloak). |
|
The assignment of roles on the Keycloak side of things should not have any impact on the default operation of the module. While my test setup contains a default role "admin", it is only there to test the dedicated role mapping functionality of the Keycloak integration. |
|
Hi guys! I tried to repeat the setup using alfresco-content-repository-community:7.0.0 image(s) and Snapshot versions from alfresco-utility and alfresco-keycloak amps I compiled. My keycloak server is on version 13.0.0. Keycloak (port 9080) and alfresco's docker images are both running locally. I configured Repo and Share tiers to talk to Keycloak on the external IP of my machine. On the Keycloak clients, the root URL's for repo-client and share-client are localhost:8080/alfresco and localhost:8080/share respectively. On Share tier, I set I tested using all the available values for verify-token-audience on Repository tier. I got the following exception on the Share logs when using verify-token-audience=true The error is basically the same, however the exceptions are a bit more informative. I double checked the configurations on Repo and Share tiers and also on Keycloak. I got the sessions on Keycloak for Share and Repo tiers, however the admin user still can't get to its dashboard. No error messages on Keycloak or on Repo tier. I believe I am missing a detail, but I can't figure out. |
|
Hi guys, Just another update. If I don't configure the connector in Alfresco Connector in the Share tier ( However, I miss the features like Log in via SSO button in the Share login form and forced SSO. |
|
That is to be expected. The alfrescoCookie connector and /wcs endpoints are essential for SSO handling towards the backend. as the /s endpoint is incapable of handling Keycloak tokens (or anything else other than user + password). |
|
Hi @AFaust , thanks for replying. I believe that my Keycloak setup is okay in some sense, because I am able to delegate credentials checking to Keycloak without the connector. When I turn on the connector (and the remaning entries that redirect to /wcs), I get the modified login Form (or the forced SSO Form). I can verify the user credentials but unable to get to the user's dashboard. The exception I got was (as above, thrown by I am double checking every setting and I realized that I configured Repo tier using the global file: It seems to work because without point the Another finding is that, when I use the enhanced login Form (Share tier) and fill in using the credentials I have either on Alfresco or on Keycloak, I fail to log in and I get the following exception: I if try the Login via SSO, the credentials are verified by Keycloak and a session is created on Keycloak, but the user can't get to its dashboard. I am using a fresh/empty Alfresco installation. While digging (and updating this comment), I found a acosix-keycloak Warning message on the Repo tier: |
|
Hello! @AFaust - I have also same issue. Same error message and have checked the configuration and followed this thread. If there ever was a solution to this problem or any thoughts how to fix it, would be highly appreciated. The errors are the same already mentioned here: ..etc Regards, |
|
I have played now quite a lot with the different parameters and the error is the same, but now I have also tcpdumped the communication happening and I see: ... and the response is 401 page with following error. However, did not found any way how to solve this "Authorization Bearer not supported" error on Alfresco side. |
|
Same issue here after setting: User is correctly authenticated on Keycloak side (you can see the active user session on Keycloak admin panel).
The endpoint for user properties is: |
|
I was running into a similar error screen when attempting to login using email and password. Everything worked fine logging in with username and password, but Share wasn't reconciling that the email address should map to the username in alfresco. Turned out I had only bothered to configure the alfresco parts and not the share bits. I was wrongly assuming that because authing with username and password worked and I didn't want SSO, I didn't need to setup the share code from this library. For me, installing the share extensions was the key to getting everything working. Hopefully someone sees this and finds it helpful in the future! |
Probably related to #12
First, I would like to thank you for this awesome addon!
I am experimenting with alfresco-keycloak using docker images (alfresco-content-repository-community:6.2.1-A8) and I managed to use keycloak as an authentication backend.
I made my best effort to follow the alfresco-keycloak documentation, by configuring a realm and different clients for Repo (repo-client) and Share (share-client). (I believe) I didn't miss any step when configuring Repo and Share to allow for alfresco-keycloak extended services.
In a first approach, I decided to turn off token exchange after setting verify-token-audience and perform-token-exchange to false. In this scenario, I didn't configure a authorization policy in realm-management client.
I managed to log in to Repo resources (http://localhost:8080/alfresco/wcs/admin) using keycloak repo-client and I was able to login to Share (http://localhost:8080/share), but, as soon as keycloak share-client checks the user's credentials, I can't get to the user's dashboard. I get the following page.
Share log reports Unable to retrieve user from repository
Any debugging suggestion?
Thanks in advance!
The text was updated successfully, but these errors were encountered: