Replies: 27 comments 4 replies
-
|
Did you try clearing the cookies on your browser for both the RP hostname and Auth Server's hostname? When asking questions like this, you should always show the |
Beta Was this translation helpful? Give feedback.
-
|
I cleared browser cache (cookies included), Where so I find instructions to clear OP cache? |
Beta Was this translation helpful? Give feedback.
-
|
Server Sessions expire automatically. What about the logs. There is no question here until you post a valid description of the request to the server and the unexpected server response. |
Beta Was this translation helpful? Give feedback.
-
Here is jans-auth.log2023-12-29 02:22:37,440 INFO [ForkJoinPool.commonPool-worker-1] [io.jans.ads.Deployer] (Deployer.java:409) - Syncing in-memory state with DB state ============================ 
|
Beta Was this translation helpful? Give feedback.
-
|
How old is this server? In the VM deploy, we don't do key rotation. |
Beta Was this translation helpful? Give feedback.
-
|
@devrimyatar can you consider this? Perhaps in the VM install we should push out the default key expiration to a century? |
Beta Was this translation helpful? Give feedback.
-
|
I use Namecheap subdomains for SSL and that's controlled. There is a certificate PKI that get created as part of Janssen install. I think this is the tension. I remap to the Namecheap SSL, which provides both Https access and Jansen secure access. Is there a policy document on how this should be handled. If not, I am happy to create one, but I need some guidance, so I get it right. |
Beta Was this translation helpful? Give feedback.
-
|
VM is for development purposes only. What would be the purpose of this? |
Beta Was this translation helpful? Give feedback.
-
|
For Development. It's a development environment. On production apache gets disabled. Currently I'm just trying to gat back to GLUU 4.2,2 stable state, and then build on that |
Beta Was this translation helpful? Give feedback.
-
|
I keep getting line noise (screenshot) when I try to work on the vm. Is this TUI, or just a dirty Internet connection? Not sure when this started. It seems to start when I have TUI open on one SSH session and commandline open on another, on the same VM 
I disable Apache and reboot. then I try to load Jans-cli. and I get this (trying to display the clients in TUI). When I try display all (blank search). I get this: When I hit return I get this the TUI screen. I try to display clients (search), i 
It's displaying messages at bottom of the screen trying to load clients.. if I CRTL C and go back in TUI, I get the TUI screen I get a fresh TUI home view. But if I try to list all clients again, it does the same thing. This was fully functional and configured. it was working great. I need to figure out why it went into this state do I can resolve if it happens again. This is key if it happens n a customer account |
Beta Was this translation helpful? Give feedback.
-
|
I think its a problem with the ssh session |
Beta Was this translation helpful? Give feedback.
-
|
Ok Tx. Im maxing the speed, so could be something with cable head. Will call my ISP. |
Beta Was this translation helpful? Give feedback.
-
|
Is it a problem if I keep Apache enabled during Janssen usage? Could this have caused the issue? I'll create one whiteout enabling apache at all, to see if that makes a difference |
Beta Was this translation helpful? Give feedback.
-
|
TeST:
with something like
And as such, the Apache site adaptor is no longer pointing to
And from this I assume it doesn't matter once it's installed. it's not using the Apache sit adaptor anymore. it's mapped within Janssen. And from this I assume, you can disable apache once Janssen is installed and configured, unless you have to reconfigure it. So if you need to reconfigure it and it asks to reverify the device, which it will because the sever can time out (pervious guidance?), then you need to as2ensite https_jans.conf. Lots of assumptions so far that I could have fallen of the path. But assuming I am correct, would we not just leave https_jans.conf enabled, so we can CRUD users, since users need be added through TUI, CLI or API. All which require device validation, which can time out. This is where I am stuck. Anyone who can she some light, much appreciate. One further item. If the PKI key for the site can expire, if you don't use LetsEncrypt certbot for 90 day refresh for example, could you not just use openssl to regenerate it...isn't openssl being used in the installation process, such that you can define the life of the key? 
. |
Beta Was this translation helpful? Give feedback.
-
|
I got it... So, at least on DigitalOcean, where I am using an external FQDN (from Namecheap), I must install on a totally clean server. No apache. Nothing. Janssen installs in default config, with FQDN the Namecheap domain name. Then I download the SSL, key and CSR files for the namecheap SSL into a folder. Once that's done, I a2ensite default-ssl.conf . Then I edit default-ssl.conf and http_jans.conf and replace the cert mapping to the namecheap ssl files. And I edit default-ssl.conf and add the Servername as FQDN . Now I can validate the TUI. That's the only way it works. So with that done, if default-ssl.conf is not left enabled, how can the Janssen oidc client https reroutes work to the Janssen Server? I expect the default-ssl.conf needs remain up. So after all this, I think this is the cleanest path, where the site is on DigitalOcean, where I need an external domain name for the Janssen Server, and where I need to validate the device on which TUI is running. Please feel free to point out my errors. At least I am up again. |
Beta Was this translation helpful? Give feedback.
-
|
Further to this, it won't log in, stating that the redirect URI's different. But they don't. The jans-auth.log shows this error. Anyone know how I can resolve this? 023-12-31 12:21:51,867 INFO [Thread-7832] [io.jans.ads.Deployer] (Deployer.java:409) - Syncing in-memory state with DB state |
Beta Was this translation helpful? Give feedback.
-
|
Where did you diverge from the install instructions? |
Beta Was this translation helpful? Give feedback.
-
|
If by that you mean I didn't, that's good. The ambiguity for me was how do I work with Namecheap ssl, and how do I validate the device if no https access (per developer discussion). I would say in the past, I did not have a totally clean VM. It came preconfigured with LAMP or openDJ. Your configuration guidance on openID oauth is a little different than what we use on GLUU. I provide my openID config json below, anonymized with FQDN and *, in case I missed something there. So it looks good, I think, except the redirect_uri mismatch. But if I compare them, they are exactly the same. So I look at the log and saw the java orm error. Perhaps that's causing the redirect_url path failure? (I know that in GLUU, trailing spaces can cause a mismatch or misplaced trailing "/") cat wordpress-client_2.txt |
Beta Was this translation helpful? Give feedback.
-
|
I cannot find a difference in the redirect _uri to the registered one in Janssen. I took the redirect_uri from TUI, and the redirect url from the login page that complained about them not matching, using [Browser/Inspect/Network/Headers/redirect_uri], and compared them in a plain text document. They are exactly the same. The OpenID properties are the same (see the Json). I'm stuck again. From Janssen TUI OpenID: From the Browser URL that complained about them not being equal Any ideas what I can do next? |
Beta Was this translation helpful? Give feedback.
-
Check
|
Beta Was this translation helpful? Give feedback.
-
|
The detail got lost in the fqdn abstraction. I provide the actual config below for clarity.
This is consistent with our GLUU production sites.
There are two fqdns because there are two dependent app front channel logouts: MD: Moodle, NC: Nextcloud
The Post logout redirect addresses wp: Wordpress.
So from what I can see, it looks correct,
Any other observations?

… On Jan 4, 2024, at 9:37 AM, Michael Schwartz ***@***.***> wrote:
"frontChannelLogoutUri": "https://fqdn/logout.php, https://fqdn/logout.php",
Shouldn't that be:
"frontChannelLogoutUri": "https://fqdn/logout.php"
—
Reply to this email directly, view it on GitHub <#7215 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AARINNPJMFCNUWXO753NSGLYM3LGDAVCNFSM6AAAAABBE3PRDGVHI2DSMVQWIX3LMV43SRDJONRXK43TNFXW4Q3PNVWWK3TUHM4DAMJUHAYDS>.
You are receiving this because you authored the thread.
|
Beta Was this translation helpful? Give feedback.
-
|
Ok, understood on |
Beta Was this translation helpful? Give feedback.
-
|
HI Mike
Below I provide a screenshot of the Front Channel URI, Post Logout Redirect URI and Redirect URI.
And I also provide the Json for the openID client total config [wordpress_openId_Client.Confgi-2024-01-04.json] below. I XXXX’d out the sensitive info.
FRONT CHANNEL URI
POST LOGOUT REDIRECT

REDIRECT_URI

cat wordpress_openId_Client.Confgi-2024-01-04.json
{
"dn": “inum=XXXXXXXXX,ou=clients,o=jans",
"deletable": false,
"clientSecret": “XXXXXXXXXXXXX",
"frontChannelLogoutUri": "https://cekh-pp-main-md.abraxasdev.com/logout.php, https://cekh-pp-main-nc.abraxasdev.com/logout.php",
"frontChannelLogoutSessionRequired": false,
"redirectUris": [
"https://cekh-pp-main-wp.abraxasdev.com/wp-admin/admin-ajax.php?action=openid-connect-authorize"
],
"responseTypes": [
"code"
],
"grantTypes": [
"authorization_code"
],
"applicationType": "web",
"clientName": "Wordpress",
"clientNameLocalized": {},
"logoUriLocalized": {},
"clientUriLocalized": {},
"policyUriLocalized": {},
"tosUriLocalized": {},
"sectorIdentifierUri": "`",
"subjectType": "public",
"tokenEndpointAuthMethod": "client_secret_post",
"postLogoutRedirectUris": [
"https://cekh-pp-main-wp.abraxasdev.com/wp-login.php?loggedout=true&wp_lang=en_US"
],
"scopes": [
"inum=764C,ou=scopes,o=jans",
"inum=F0C4,ou=scopes,o=jans",
"inum=43F1,ou=scopes,o=jans",
"inum=C4F6,ou=scopes,o=jans"
],
"trustedClient": false,
"persistClientAuthorizations": false,
"includeClaimsInIdToken": false,
"customAttributes": [],
"customObjectClasses": [
"top"
],
"rptAsJwt": false,
"accessTokenAsJwt": false,
"disabled": false,
"attributes": {
"runIntrospectionScriptBeforeJwtCreation": false,
"keepClientAuthorizationAfterExpiration": false,
"allowSpontaneousScopes": false,
"backchannelLogoutUri": [
" "
],
"backchannelLogoutSessionRequired": false,
"parLifetime": 600,
"requirePar": false,
"dpopBoundAccessToken": false,
"jansDefaultPromptLogin": false,
"minimumAcrLevel": -1
},
"backchannelTokenDeliveryMode": "poll",
"backchannelUserCodeParameter": false,
"description": "Wordpress",
"displayName": "Wordpress",
"authenticationMethod": "client_secret_post",
"allAuthenticationMethods": [
"client_secret_post"
],
"baseDn": “inum=XXXXXXXXXXXXa,ou=clients,o=jans",
"inum": “XXXXXXXXXXXX”
}
… On Jan 4, 2024, at 10:11 AM, Michael Schwartz ***@***.***> wrote:
Ok, understood on frontChannelLogoutUri, but please re-suply the other two here to confirm what we are even debugging.
—
Reply to this email directly, view it on GitHub <#7215 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AARINNIGMPX74K2N742YNYTYM3PC3AVCNFSM6AAAAABBE3PRDGVHI2DSMVQWIX3LMV43SRDJONRXK43TNFXW4Q3PNVWWK3TUHM4DAMJVGE4DI>.
You are receiving this because you authored the thread.
|
Beta Was this translation helpful? Give feedback.
-
|
Still waiting for 100% of the information I requested to be supplied... |
Beta Was this translation helpful? Give feedback.
-
|
REF: re-suply the logs and client summary (not from the RP, but from the OP) jans-auth.Log: OP Client Summary: http_request_response.log If I've missed something, please inform so I can find it. Much apreciated |
Beta Was this translation helpful? Give feedback.
-
|
I see 778 errors in But I don't see any other errors. What would be more useful is for you to do a Also, The AS client entity looks fine. Also, what about logs from the RP? Is your Wordpress Plugin is logging something? |
Beta Was this translation helpful? Give feedback.
-
|
Excellent. I tailed the jans-auth.json log and did a log-in attempt in the Wordpress App. It threw an LDAP error. This ['ou=archived_jwks,o=jans' does not exist] would appear to be the culprit. (logo below). Now what? root@do-gluu:/opt/jans/jetty/jans-auth/logs# tail -f jans-auth.log |
Beta Was this translation helpful? Give feedback.
-
|
Right, it's DN which must be pre-created. It's already added a8c315d |
Beta Was this translation helpful? Give feedback.
-
|
Sorry. What steps do I take to resolve in Janssen? |
Beta Was this translation helpful? Give feedback.
-
|
Resolved. DO not use OpenDJ. No longer supported; use MySQL |
Beta Was this translation helpful? Give feedback.
-
|
Resolved. DO not use OpenDJ. No longer supported; use MySQL |
Beta Was this translation helpful? Give feedback.
-
I was using Janssen the last 2 days - no issues. Something happened overnight. No one using it but me. Janssen no longer validates the device.
To use my Wordpress app, I need to log in to Janssen, through an app login form. Now it won't log me in. Janssen says I need to authorize the device I am on, which I've done many times before. But now it either says [the logged on user (do) not have valid role] (there is a typo (do) on that message). Or it says, [unable to get access token]. I think that latter is because it invalidated my logon user. I can't seem to get out of the loop. And unless I validate the device, I can't access the TUI or CLI. SO I am stuck again.
Any ideas?
Beta Was this translation helpful? Give feedback.
All reactions