Error when using SSSD user federation with GitHub identity provider #19418

yann-soubeyrand · 2023-03-29T13:34:02Z

yann-soubeyrand
Mar 29, 2023

Hello,

We’re using SSSD user federation (with FreeIPA servers) and GitHub identity provider. We want that a new Keycloak local account be created for users authenticating using GitHub which don’t have an account in our FreeIPA. However, we get an SSSD exception:

[org.keycloak.services] (default task-20) KC-SERVICES0013: Failed authentication: org.keycloak.federation.sssd.api.SSSDException: Failed to retrieve user's attributes. Check if SSSD service is active.
standalone.sh[178996]:         at org.keycloak.federation.sssd.api.Sssd.getUser(Sssd.java:112)
standalone.sh[178996]:         at org.keycloak.federation.sssd.SSSDFederationProvider.importUserToKeycloak(SSSDFederationProvider.java:114)
standalone.sh[178996]:         at org.keycloak.federation.sssd.SSSDFederationProvider.findOrCreateAuthenticatedUser(SSSDFederationProvider.java:109)
standalone.sh[178996]:         at org.keycloak.federation.sssd.SSSDFederationProvider.getUserByUsername(SSSDFederationProvider.java:72)
…

My understanding of the GitHub first login authentication flow is that it will first check if the user already exists using SSSD and then create a local user if not. However, I see in the code that the behaviour is to raise an exception (the exception above) if the user doesn’t exist:
getUserByUsername function is called

keycloak/federation/sssd/src/main/java/org/keycloak/federation/sssd/SSSDFederationProvider.java

Lines 72 to 74 in a45b5dc

    
           public UserModel getUserByUsername(RealmModel realm, String username) { 
        
               return findOrCreateAuthenticatedUser(realm, username); 
        
           }

then findOrCreateAuthenticatedUser

keycloak/federation/sssd/src/main/java/org/keycloak/federation/sssd/SSSDFederationProvider.java

Lines 88 to 111 in a45b5dc

    
           protected UserModel findOrCreateAuthenticatedUser(RealmModel realm, String username) { 
        
               UserModel user = UserStoragePrivateUtil.userLocalStorage(session).getUserByUsername(realm, username); 
        
               if (user != null) { 
        
                   logger.debug("SSSD authenticated user " + username + " found in Keycloak storage"); 
        
                   if (!model.getId().equals(user.getFederationLink())) { 
        
                       logger.warn("User with username " + username + " already exists, but is not linked to provider [" + model.getName() + "]"); 
        
                       return null; 
        
                   } else { 
        
                       UserModel proxied = validateAndProxy(realm, user); 
        
                       if (proxied != null) { 
        
                           return proxied; 
        
                       } else { 
        
                           logger.warn("User with username " + username + " already exists and is linked to provider [" + model.getName() + 
        
                                   "] but principal is not correct."); 
        
                           logger.warn("Will re-create user"); 
        
                           new UserManager(session).removeUser(realm, user, UserStoragePrivateUtil.userLocalStorage(session)); 
        
                       } 
        
                   } 
        
               } 
        
               logger.debug("SSSD authenticated user " + username + " not in Keycloak storage. Creating..."); 
        
               return importUserToKeycloak(realm, username); 
        
           }

then importUserToKeycloak

keycloak/federation/sssd/src/main/java/org/keycloak/federation/sssd/SSSDFederationProvider.java

Lines 113 to 131 in a45b5dc

    
           protected UserModel importUserToKeycloak(RealmModel realm, String username) { 
        
               Sssd sssd = new Sssd(username); 
        
               User sssdUser = sssd.getUser(); 
        
               logger.debugf("Creating SSSD user: %s to local Keycloak storage", username); 
        
               UserModel user = UserStoragePrivateUtil.userLocalStorage(session).addUser(realm, username); 
        
               user.setEnabled(true); 
        
               user.setEmail(sssdUser.getEmail()); 
        
               user.setFirstName(sssdUser.getFirstName()); 
        
               user.setLastName(sssdUser.getLastName()); 
        
               for (String s : sssd.getGroups()) { 
        
                   GroupModel group = KeycloakModelUtils.findGroupByPath(realm, "/" + s); 
        
                   if (group == null) { 
        
                       group = session.groups().createGroup(realm, s); 
        
                   } 
        
                   user.joinGroup(group); 
        
               } 
        
               user.setFederationLink(model.getId()); 
        
               return validateAndProxy(realm, user); 
        
           }

and finally getUser which raises the exception

keycloak/federation/sssd/src/main/java/org/keycloak/federation/sssd/api/Sssd.java

Lines 104 to 115 in 548827b

    
           public User getUser() { 
        
               String[] attr = {"mail", "givenname", "sn", "telephoneNumber"}; 
        
               User user = null; 
        
               try { 
        
                   InfoPipe infoPipe = dBusConnection.getRemoteObject(InfoPipe.BUSNAME, InfoPipe.OBJECTPATH, InfoPipe.class); 
        
                   user = new User(infoPipe.getUserAttributes(username, Arrays.asList(attr))); 
        
               } catch (Exception e) { 
        
                   throw new SSSDException("Failed to retrieve user's attributes. Check if SSSD service is active."); 
        
               } 
        
               return user; 
        
           }

This behaviour seems to differ from the LDAP user federation:
getUserByUsername returns null when the user doesn’t exist

keycloak/federation/ldap/src/main/java/org/keycloak/storage/ldap/LDAPStorageProvider.java

Lines 532 to 539 in 548827b

    
           public UserModel getUserByUsername(RealmModel realm, String username) { 
        
               LDAPObject ldapUser = loadLDAPUserByUsername(realm, username); 
        
               if (ldapUser == null) { 
        
                   return null; 
        
               } 
        
               return importUserFromLDAP(session, realm, ldapUser); 
        
           }

Is there a technical reason behind these behavioural differences or is it something that should be fixed?

Navigation Menu

Repository navigation

Error when using SSSD user federation with GitHub identity provider #19418

Uh oh!

{{title}}

Uh oh!

Replies: 0 comments

Select a reply

Uh oh!

Error when using SSSD user federation with GitHub identity provider #19418

Uh oh!

yann-soubeyrand Mar 29, 2023

Replies: 0 comments

yann-soubeyrand
Mar 29, 2023