Cannot login to Keycloak with HTTPS from Windows (but can from Linux) #10931

user1537 · 2022-03-24T21:24:32Z

user1537
Mar 24, 2022

Hi,

I have Keycloak 17.0.0 (Quarkus) running in Kubernetes. When I start the Keycloak server with HTTP (http-enabled:true; hostname-strict-https:false), I can successfully log in to the administration console from both Windows 10 and Fedora 35 systems (tried from two computers with Windows and three with Linux). I tried both Chrome and Firefox, and the behaviour is the same.

But when I start the Keycloak server with HTTPS (certificate generated using keytool, no root certificate), then I can log in from the Fedora systems, but can't from the Windows systems.

I'm not sure if this matters, but from both the Windows and Fedora systems, I'm connecting to the Keycloak server through a corporate VPN.

When trying to log in from the Windows machines, the server returns status code 400 - this is the request URL:

https://<ip>:<port>/realms/master/login-actions/authenticate?session_code=fUdxAl_f-vYHQFGUCX07SQnWEnncBCPf8hi3t3pmmHs&execution=05d68330-cbf2-4b28-9d04-2365989934d1&client_id=security-admin-console&tab_id=eK7ABwblVp8

In Keycloak logs, I see this exception (truncated where the three dots are for brevity):

2022-03-23 14:45:41,653 WARN  [org.keycloak.services] (executor-thread-6) KC-SERVICES0013: Failed authentication: java.lang.RuntimeException: java.io.IOException: Underlying input stream returned zero bytes
    at org.jboss.resteasy.plugins.server.BaseHttpRequest.getFormParameters(BaseHttpRequest.java:61)
    at org.jboss.resteasy.plugins.server.BaseHttpRequest.getDecodedFormParameters(BaseHttpRequest.java:74)
    at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
    at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.base/java.lang.reflect.Method.invoke(Method.java:566)
    at org.jboss.resteasy.core.ContextParameterInjector$GenericDelegatingProxy.invoke(ContextParameterInjector.java:166)
    at com.sun.proxy.$Proxy46.getDecodedFormParameters(Unknown Source)
    at org.keycloak.authentication.DefaultAuthenticationFlow.processAction(DefaultAuthenticationFlow.java:104)
    at org.keycloak.authentication.AuthenticationProcessor.authenticationAction(AuthenticationProcessor.java:1002)
    at org.keycloak.services.resources.LoginActionsService.processFlow(LoginActionsService.java:321)
    at org.keycloak.services.resources.LoginActionsService.processAuthentication(LoginActionsService.java:292)
    at org.keycloak.services.resources.LoginActionsService.authenticate(LoginActionsService.java:276)
    at org.keycloak.services.resources.LoginActionsService.authenticateForm(LoginActionsService.java:349)
...
Caused by: java.io.IOException: Underlying input stream returned zero bytes
    at java.base/sun.nio.cs.StreamDecoder.readBytes(StreamDecoder.java:288)
    at java.base/sun.nio.cs.StreamDecoder.implRead(StreamDecoder.java:326)
    at java.base/sun.nio.cs.StreamDecoder.read(StreamDecoder.java:178)
    at java.base/java.io.InputStreamReader.read(InputStreamReader.java:181)
    at java.base/java.io.BufferedReader.fill(BufferedReader.java:161)
    at java.base/java.io.BufferedReader.read1(BufferedReader.java:212)
    at java.base/java.io.BufferedReader.read(BufferedReader.java:287)
    at org.jboss.resteasy.plugins.providers.FormUrlEncodedProvider.parseForm(FormUrlEncodedProvider.java:88)
    at org.jboss.resteasy.plugins.server.BaseHttpRequest.getFormParameters(BaseHttpRequest.java:57)

I compared the two outgoing authentication requests (from Windows and from Fedora) in Chrome's Network tab, and they looked almost identical: small difference in accepted-language header - but only the lowest priority one, (expected) differences in session cookies.

I'd appreciate any ideas about what could be wrong with my setup.

Thanks

csi2345 · 2022-03-30T10:41:50Z

csi2345
Mar 30, 2022

I have a same issue.
I can log in on some Windows PCs, but some Windows PCs have same errors.

1 reply

user1537 Mar 30, 2022
Author

Given that I reproduced this problem on a fairly minimal VM deployment, and I'm not the only one this happens to, I created a ticket here:
#11010

DGuhr · 2022-07-26T14:18:51Z

DGuhr
Jul 26, 2022

see quarkusio/quarkus#26937 - seems to be a bug in quarkus under some circumstances

0 replies

slominskir · 2022-10-03T14:10:29Z

slominskir
Oct 3, 2022

Meant to post this comment to Keycloak: quarkusio/quarkus#26937 (comment)

This Exception happens if your SPNEGO credential cache is empty/expired.

When will this fix be available in a released Keycloak version? I'd like to test to make sure this is the same bug/cause as I'm seeing.

1 reply

slominskir Oct 3, 2022

Keycloak parent issue is here: #13315 (still didn't post to correct thread, oh well)

Navigation Menu

Repository navigation

Cannot login to Keycloak with HTTPS from Windows (but can from Linux) #10931

Uh oh!

{{title}}

Uh oh!

Replies: 3 comments 2 replies

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Cannot login to Keycloak with HTTPS from Windows (but can from Linux) #10931

Uh oh!

user1537 Mar 24, 2022

Replies: 3 comments · 2 replies

Uh oh!

csi2345 Mar 30, 2022

Uh oh!

user1537 Mar 30, 2022 Author

Uh oh!

DGuhr Jul 26, 2022

Uh oh!

Uh oh!

slominskir Oct 3, 2022

Uh oh!

slominskir Oct 3, 2022

user1537
Mar 24, 2022

Replies: 3 comments 2 replies

csi2345
Mar 30, 2022

user1537 Mar 30, 2022
Author

DGuhr
Jul 26, 2022

slominskir
Oct 3, 2022