Cannot get a custom Identity Provider to work #14514

luciano-fiandesio · 2022-09-21T07:04:36Z

luciano-fiandesio
Sep 21, 2022

Hello, I have been trying to integrate an Identity Provider with KC (19.0.1, Quarkus) without success and I'm running out of options, hope that someone can support me.

The Identity Provider is an IBM product, called Webseal. This IP simply presents a login page and, upon successful authentication, it returns the username of the logged-in user in the Response header.

My approach

I have created a fairly simple Identity Provider, which essentially has two methods:

performLogin()
callback()

// performLogin()
try {
   
   URI webSealLogin = new URI("http://localhost:80/webseal?"+auth);
            
   return Response.seeOther(webSealLogin).build();
} catch (URISyntaxException e) {
   throw new RuntimeException(e);
}

Note that the URL also contains the KC cookies AUTH_SESSION_ID, KC_RESTART and AUTH_SESSION_ID_LEGACY which I'm passing to Webseal as query params, so that Webseal can return them in the response as cookies (Not sure this is the right approach).

// callback()

return new WebSealEndpoint(this, this.getConfig(), callback);

The WebSealEndpoint class has one method:

@GET
public Response done(@Context HttpHeaders headers) {
   ...
}

Within Keycloak, I have "cloned" the Browser flow and set the Identity Provider Redirector to use my custom IDP.
Then, I created a new Client and used the custom flow to replace the standard Browser flow - the main use case here is to protect a React app.

Testing the setup

From the React app (configured to use keycloak.js) I'm correctly redirected to the Webseal login page.
On successful login, I'm redirected to the endpoint (Redirect URI) specified on the custom Identity Provider page. And that's where I'm encountering problems.

When the redirect kicks in, the method done() (see above) is triggered. I have tried several solutions based on snippets found mostly on Github, since there is basically 0 documentation.

Solution 1

String id = getUsername(headers);
try {
   BrokeredIdentityContext identity = new BrokeredIdentityContext(id);
   identity.setId(getUsername(headers));
   // set more data on the BrokeredIdentityContext

   return callback.authenticated(identity);
   
} catch (WebApplicationException e) {
   e.printStackTrace(System.out);
   return e.getResponse();
} catch (Exception e) {
   throw new RuntimeException("Failed to decode user information.", e);
}

This code fails because the authenticated method expects a non-null AuthenticationSessionModel.
More specifically, line 514 of IdentityBrokerService fails, because this call at line 496 returns null:
AuthenticationSessionModel authenticationSession = context.getAuthenticationSession();

Solution 2

Since it seems that I need an Authentication Session available, I tried the following:

String id = getUsername(headers) + ".1." + CLIENT_ID;
AuthenticationSessionModel authSession = this.callback.getAndVerifyAuthenticationSession(id);
session.getContext().setAuthenticationSession(authSession);

....
return callback.authenticated(identity);

This also fails, when calling this.callback.getAndVerifyAuthenticationSession(id);
This is what I'm seeing in the logs:

DEBUG [org.keycloak.services.resources.SessionCodeChecks] (executor-thread-7) Authentication session restart from cookie succeeded. Redirecting to http://localhost:8080/realms/my-realm/login-actions/authenticate?client_id=demo-client&tab_id=BmOL5d5YdSc
DEBUG [org.keycloak.services.error.KeycloakErrorHandler] (executor-thread-7) Error response 302: javax.ws.rs.WebApplicationException: HTTP 302 Found
   at org.keycloak.services.resources.IdentityBrokerService.parseSessionCode(IdentityBrokerService.java:1060)
   at org.keycloak.services.resources.IdentityBrokerService.getAndVerifyAuthenticationSession(IdentityBrokerService.java:1029)
   at com.idp.webseal.WebSealEndpoint.done(WebSealEndpoint.java:70)

I have started KC in debug mode and stepped through the code, but I do not understand what is going on. The code ends up here:

// SessionCodeChecks (https://github.com/keycloak/keycloak/blob/e44cea587fe97d73b83de2ea8e943cf079ce95ee/services/src/main/java/org/keycloak/services/resources/SessionCodeChecks.java#L195)

response = restartAuthenticationSessionFromCookie(existingRootAuthSession);
return null;

In both solutions, I have to pass the Keycloak cookies back and forth. I wonder if this is even needed and if Keycloak can figure out the session id in a different way.

Any help or pointer would be very appreciated.

Navigation Menu

Repository navigation

Cannot get a custom Identity Provider to work #14514

Uh oh!

{{title}}

Uh oh!

Replies: 0 comments

Select a reply

Uh oh!

Cannot get a custom Identity Provider to work #14514

Uh oh!

luciano-fiandesio Sep 21, 2022

My approach

Testing the setup

Solution 1

Solution 2

Replies: 0 comments

luciano-fiandesio
Sep 21, 2022