Algorithm SHA256withRSA not available when trying to setup identity provider #12222

AlexGoris-KasparSolutions · 2022-05-27T11:05:06Z

AlexGoris-KasparSolutions
May 27, 2022

I'm trying to setup an identity provider ('It's me', a Belgian national identification service) which uses client id and secret authentication, but right at the end it is failing with this error:

2022-05-27 10:52:00,620 ERROR [org.keycloak.broker.oidc.AbstractOAuth2IdentityProvider] (executor-thread-55) Failed to make identity provider oauth callback: java.lang.RuntimeException: org.keycloak.crypto.SignatureException: Signing failed
        at org.keycloak.jose.jws.JWSBuilder$EncodingBuilder.sign(JWSBuilder.java:116)
        at org.keycloak.broker.oidc.AbstractOAuth2IdentityProvider.authenticateTokenRequest(AbstractOAuth2IdentityProvider.java:408)
        at org.keycloak.broker.oidc.AbstractOAuth2IdentityProvider$Endpoint.generateTokenRequest(AbstractOAuth2IdentityProvider.java:576)
        at org.keycloak.broker.oidc.OIDCIdentityProvider$OIDCEndpoint.generateTokenRequest(OIDCIdentityProvider.java:324)
        at org.keycloak.broker.oidc.AbstractOAuth2IdentityProvider$Endpoint.authResponse(AbstractOAuth2IdentityProvider.java:500)
        at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
        at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.base/java.lang.reflect.Method.invoke(Method.java:566)
        at org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java:170)
        at org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java:130)
        at org.jboss.resteasy.core.ResourceMethodInvoker.internalInvokeOnTarget(ResourceMethodInvoker.java:660)
        at org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTargetAfterFilter(ResourceMethodInvoker.java:524)
        at org.jboss.resteasy.core.ResourceMethodInvoker.lambda$invokeOnTarget$2(ResourceMethodInvoker.java:474)
        at org.jboss.resteasy.core.interception.jaxrs.PreMatchContainerRequestContext.filter(PreMatchContainerRequestContext.java:364)
        at org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTarget(ResourceMethodInvoker.java:476)
        at org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:434)
        at org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(ResourceLocatorInvoker.java:192)
        at org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:152)
        at org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(ResourceLocatorInvoker.java:183)
        at org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:141)
        at org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:32)
        at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:492)
        at org.jboss.resteasy.core.SynchronousDispatcher.lambda$invoke$4(SynchronousDispatcher.java:261)
        at org.jboss.resteasy.core.SynchronousDispatcher.lambda$preprocess$0(SynchronousDispatcher.java:161)
        at org.jboss.resteasy.core.interception.jaxrs.PreMatchContainerRequestContext.filter(PreMatchContainerRequestContext.java:364)
        at org.jboss.resteasy.core.SynchronousDispatcher.preprocess(SynchronousDispatcher.java:164)
        at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:247)
        at io.quarkus.resteasy.runtime.standalone.RequestDispatcher.service(RequestDispatcher.java:73)
        at io.quarkus.resteasy.runtime.standalone.VertxRequestHandler.dispatch(VertxRequestHandler.java:151)
        at io.quarkus.resteasy.runtime.standalone.VertxRequestHandler.handle(VertxRequestHandler.java:82)
        at io.quarkus.resteasy.runtime.standalone.VertxRequestHandler.handle(VertxRequestHandler.java:42)
        at io.vertx.ext.web.impl.RouteState.handleContext(RouteState.java:1212)
        at io.vertx.ext.web.impl.RoutingContextImplBase.iterateNext(RoutingContextImplBase.java:163)
        at io.vertx.ext.web.impl.RoutingContextWrapper.next(RoutingContextWrapper.java:201)
        at io.quarkus.vertx.http.runtime.StaticResourcesRecorder$2.handle(StaticResourcesRecorder.java:67)
        at io.quarkus.vertx.http.runtime.StaticResourcesRecorder$2.handle(StaticResourcesRecorder.java:55)
        at io.vertx.ext.web.impl.RouteState.handleContext(RouteState.java:1212)
        at io.vertx.ext.web.impl.RoutingContextImplBase.iterateNext(RoutingContextImplBase.java:163)
        at io.vertx.ext.web.impl.RoutingContextWrapper.next(RoutingContextWrapper.java:201)
        at io.quarkus.vertx.http.runtime.VertxHttpRecorder$5.handle(VertxHttpRecorder.java:380)
        at io.quarkus.vertx.http.runtime.VertxHttpRecorder$5.handle(VertxHttpRecorder.java:358)
        at io.vertx.ext.web.impl.RouteState.handleContext(RouteState.java:1212)
        at io.vertx.ext.web.impl.RoutingContextImplBase.iterateNext(RoutingContextImplBase.java:163)
        at io.vertx.ext.web.impl.RoutingContextWrapper.next(RoutingContextWrapper.java:201)
        at org.keycloak.quarkus.runtime.integration.web.QuarkusRequestFilter.lambda$createBlockingHandler$1(QuarkusRequestFilter.java:71)
        at io.vertx.core.impl.ContextImpl.lambda$null$0(ContextImpl.java:159)
        at io.vertx.core.impl.AbstractContext.dispatch(AbstractContext.java:100)
        at io.vertx.core.impl.ContextImpl.lambda$executeBlocking$1(ContextImpl.java:157)
        at io.quarkus.vertx.core.runtime.VertxCoreRecorder$13.runWith(VertxCoreRecorder.java:543)
        at org.jboss.threads.EnhancedQueueExecutor$Task.run(EnhancedQueueExecutor.java:2449)
        at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1478)
        at org.jboss.threads.DelegatingRunnable.run(DelegatingRunnable.java:29)
        at org.jboss.threads.ThreadLocalResettingRunnable.run(ThreadLocalResettingRunnable.java:29)
        at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30)
        at java.base/java.lang.Thread.run(Thread.java:829)
Caused by: org.keycloak.crypto.SignatureException: Signing failed
        at org.keycloak.crypto.MacSignatureSignerContext.sign(MacSignatureSignerContext.java:52)
        at org.keycloak.jose.jws.JWSBuilder$EncodingBuilder.sign(JWSBuilder.java:114)
        ... 55 more
Caused by: java.security.NoSuchAlgorithmException: Algorithm SHA256withRSA not available
        at java.base/javax.crypto.Mac.getInstance(Mac.java:191)
        at org.keycloak.crypto.MacSignatureSignerContext.sign(MacSignatureSignerContext.java:47)
        ... 56 more

The important part seems to be at the bottom of the exception:

Caused by: java.security.NoSuchAlgorithmException: Algorithm SHA256withRSA not available

I'm running Keycloak v18.0.0 using the official docker image with args start --auto-build.
How can I see which algorithms are available, and is it possible to add this SHA256withRSA one which seems to be required by the identity provider?

More information about It's me:

Their OpenID Connect documentation: https://belgianmobileid.github.io/slate/login.html
Well-known endpoint for their sandbox (dev/testing) environment: https://e2emerchant.itsme.be/oidc/.well-known/openid-configuration

Answered by koendehaen

Jun 15, 2022

Hi @AlexGoris-KasparSolutions did you get this to work in the end ? Want to set up an integration ourselves, but run into the same issues.

View full answer

abstractj · 2022-05-27T12:15:51Z

abstractj
May 27, 2022
Maintainer

@AlexGoris-KasparSolutions could you please provide more details? Like:

Which kind of identity provider
Reproducible steps if possible
Are you able to share your configuration file?

That can help others to understand more about the issue.

< 8000 tool-tip id="tooltip-3743cb05-fffa-4da0-9bec-a55ff6146617" for="discussion-upvote-button-DiscussionComment-2833865" popover="manual" data-direction="s" data-type="description" data-view-component="true" class="sr-only position-absolute">You must be logged in to vote

4 replies

AlexGoris-KasparSolutions May 27, 2022
Author

I've added some information about the identity provider (It's me) to the my orignal post. Anyone trying to reproduce this would need to request an account with them though.

Below is a screenshot of the identity provider configuration with sensitive information blurred out, I would not be able to share my current configuration since I'm configuring this on a live dev environment, so it would expose sensitive information. However I could reproduce the configuration on a local docker container which would not be reachable externally and export that configuration if really necessary.

Some research on the NoSuchAlgorithmException shows that this would be related to an OS or OpenJDK issue, so I would hope someone can point me in the right direction regarding the verification of available algorithms in the docker image provided by Keycloak.

mlvnd Jun 6, 2022

Hi @AlexGoris-KasparSolutions, trying to configure a self-hosted Gitlab as an Identity Provider, I ran into the same issue. Did you try setting "Client Authentication" to "Client secret sent as post"? That solved it for me.

AlexGoris-KasparSolutions Jun 6, 2022
Author

Hi @AlexGoris-KasparSolutions, trying to configure a self-hosted Gitlab as an Identity Provider, I ran into the same issue. Did you try setting "Client Authentication" to "Client secret sent as post"? That solved it for me.

If I set the client authentication to 'CLient secret sent as post', I get the following error from the server:

{"error":"unauthorized_client","detail":"Assertion type should be urn:ietf:params:oauth:client-assertion-type:jwt-bearer"}

Which AFAIK means that client authentication should be client secret as jwt.

Thanks for the suggestion!

mlvnd Jun 6, 2022

I guess you're right… You're welcome, I'm sorry it didn't work out for you.

AlexGoris-KasparSolutions · 2022-05-30T12:55:54Z

AlexGoris-KasparSolutions
May 30, 2022
Author

Managed to get a little bit further today, I think I found out how to get a list of available algorithms out of the keycloak container. This requires running the container locally, so you can exec into it with the root user:

docker run -n keycloak-dev quay.io/keycloak/keycloak start-dev
docker exec -it -u root keycloak-dev /bin/bash

O 8000 nce inside the container, run the following commands to instal openssl:

microdnf update
microdnf install openssl

Finally, use openssl to get list of digest algoriths:

openssl list -digest-algorithms

This shows me a list of numerous algorithms, with one interesting in there (others removed for brevity

[root@7fda6a095890 /]# openssl list -digest-algorithms
...
sha256WithRSAEncryption => SHA256
...

So there seems to be an algorithm with the name sha256WithRSAEncryption, looking on google (ref) leads me to believe that sha256WithRSAEncryption and SHA256withRSA are in fact the same algorithm, yet the identity provider I'm trying to integrate with seems to specifically ask for SHA256withRSA, which isn't known by Keycloak.

Any ideas how I can add the sha256WithRSAEncryption algorithm to keycloak? Perhaps add it as an alias of SHA256withRSA?

0 replies

koendehaen · 2022-06-15T07:43:15Z

koendehaen
Jun 15, 2022

Hi @AlexGoris-KasparSolutions did you get this to work in the end ? Want to set up an integration ourselves, but run into the same issues.

1 reply

AlexGoris-KasparSolutions Jun 24, 2022
Author

Sorry for the late reply, yes I did. Somehow I ended up with the wrong oidc urls (e2emerchant.itsme.be/... instead of oidc.e2e.itsme.services/...). I think the it's me docs could be structured a bit better, first of all I got this link, which seems to be old (that document mentions the e2emerchant.itsme.be/... urls). Then I got sent this link, which contains the correct URLs, but you still need to take care to select the 'Secret key' tab so you get the correct urls.

Below are our latest keycloak settings which are working for us:

koendehaen · 2022-08-18T11:39:40Z

koendehaen
Aug 18, 2022

Thanks for your reply! We got it to work now as well! Kind regards Koen Dehaen Op vr 24 jun. 2022 om 12:14 schreef AlexGoris-KasparSolutions < ***@***.***>:

…

Sorry for the late reply, yes I did. Somehow I ended up with the wrong oidc urls (e2emerchant.itsme.be/... instead of oidc.e2e.itsme.services/...). I think the it's me docs could be structured a bit better, first of all I got this link <https://belgianmobileid.github.io/slate/sharedata.html#3-integration-guide>, which seems to be old (that document mentions the e2emerchant.itsme.be/... urls). Then I got sent this link <https://belgianmobileid.github.io/doc/identification/#itsme-discovery-document>, which contains the correct URLs, but you still need to take care to select the 'Secret key' tab so you get the correct urls. Below are our latest keycloak settings which are working for us: [image: image] <https://user-images.githubusercontent.com/67314459/175513887-8624ee09-0565-478f-adf3-ac8187d72904.png> — Reply to this email directly, view it on GitHub <#12222 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AB4KMYFJZZYOCTTBGOCPJOLVQWC6RANCNFSM5XD4RNXA> . You are receiving this because you commented.Message ID: ***@***.***>

0 replies

Navigation Menu

Repository navigation

Algorithm SHA256withRSA not available when trying to setup identity provider #12222

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Replies: 4 comments 5 replies

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Algorithm SHA256withRSA not available when trying to setup identity provider #12222

Uh oh!

Uh oh!

AlexGoris-KasparSolutions May 27, 2022

Replies: 4 comments · 5 replies

Uh oh!

abstractj May 27, 2022 Maintainer

Uh oh!

AlexGoris-KasparSolutions May 27, 2022 Author

Uh oh!

mlvnd Jun 6, 2022

Uh oh!

AlexGoris-KasparSolutions Jun 6, 2022 Author

Uh oh!

mlvnd Jun 6, 2022

Uh oh!

AlexGoris-KasparSolutions May 30, 2022 Author

Uh oh!

koendehaen Jun 15, 2022

Uh oh!

AlexGoris-KasparSolutions Jun 24, 2022 Author

Uh oh!

koendehaen Aug 18, 2022

AlexGoris-KasparSolutions
May 27, 2022

Replies: 4 comments 5 replies

abstractj
May 27, 2022
Maintainer

AlexGoris-KasparSolutions May 27, 2022
Author

AlexGoris-KasparSolutions Jun 6, 2022
Author

AlexGoris-KasparSolutions
May 30, 2022
Author

koendehaen
Jun 15, 2022

AlexGoris-KasparSolutions Jun 24, 2022
Author

koendehaen
Aug 18, 2022