Unable to apply configuration via terraform - Error: post request failed: did not get correct response code: 401 Unauthorized

[polsson12]

Hi,

I'm trying to apply custom configuration via terraform. I've followed the guidelines here but when using the test_client_id and the corresponding password, I'm getting the error message Error: post request failed: did not get correct response code: 401 Unauthorized. When looking into the database table jansClnt, column displayName it says Jans Test Client with all scopes

When using a different client_id, such as scim_client_id, I get Error: failed to get token: scope not granted: https://jans.io/oauth/config/scopes.write as expected.

Any ideas how I possibly can solve this?

Thanks in advance!

[nynymike]

@misba7 Can you take a look?

[misba7]

I tested on my end and the test client is working fine.
Double-check that your pods are Running, and that your FQDN is accessible.

[polsson12]

Thanks for getting back to me so quickly! Pods are running and fqdn is accessible.
However, I checked into the logs of the config-api pod and saw this:

AuthorizationFilter.java:94- ======AUTHORIZATION  FAILED ===========================================
2024-09-10T10:42:07.168402899+02:00 jakarta.ws.rs.ProcessingException: RESTEASY004655: Unable to invoke request: javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
2024-09-10T10:42:07.168410510+02:00 	at org.jboss.resteasy.client.jaxrs.engines.ManualClosingApacheHttpClient43Engine.invoke(ManualClosingApacheHttpClient43Engine.java:321) ~[resteasy-client-6.0.3.Final

The 401 seems to be related to some kind of certificate issue. Any ideas what it might be? @misba7

[misba7]

Double-check that the FQDN/IP mapping is correct(mapping to VM public IP or Ingress controller external IP) and matches the SSL certificate's common name (CN) or subject alternative names (SANs).

[misba7]

Also check /etc/certs/web_https.crt

then check if it's imported to /opt/java/lib/security/cacerts

keytool -list -v -keystore /opt/java/lib/security/cacerts -storepass changeit | grep -A 10 'Alias name: web_https'

[polsson12]

It turned out that the certificate I used was issued by our company and therefore not in the Janssen trust store. When I changed to a certificate issued by Let's encrypt it worked as expected.

Thanks for the feedback!