I´m currently trying to have:
- Keycloak is running in Docker at a VM on my locale machine
- My Java App is running localy
I changed in the shiro.ini the localhost to the specific IP – Adress of the local machine and VM.
Here my shiro.ini:
[main]
#### Session
sessionIdCookie=org.apache.shiro.web.servlet.SimpleCookie
sessionIdCookie.path = /
sessionIdCookie.httpOnly = true
sessionIdCookie.name = sid
sessionIdCookie.domain = localhost
sessionIdCookie.maxAge=36000000
sessionIdCookie.secure = true
sessionIdCookie.sameSite = LAX
sessionManager =org.apache.shiro.web.session.mgt.DefaultWebSessionManager
sessionManager.sessionIdCookie =$sessionIdCookie
sessionManager.sessionIdCookieEnabled =true
securityManager.sessionManager= $sessionManager
# 3,600,000 milliseconds = 1 hour -> set to 10 hours
sessionManager.globalSessionTimeout= 36000000
#sessionListener1= com.myapp.util.shiropac4j.MySessionListener1
#sessionManager.sessionListeners=$sessionListener1
# Session validation = 5 minutes
#sessionManager.sessionValidationInterval = 300000
#Keycloack
oidcConfig = org.pac4j.oidc.config.KeycloakOidcConfiguration
oidcConfig.realm = myapp
oidcConfig.baseUri = http://192.168.178.96:9009/auth
oidcConfig.discoveryURI = http://192.168.178.96:9009/auth/realms/myapp/.well-known/openid-configuration
oidcConfig.clientId = myappjobsharing-frontend
oidcConfig.secret = SghQxe6rxhpZCZOEN50OWFjxHuMhjBKe
oidcConfig.clientAuthenticationMethodAsString = client_secret_basic
oidcConfig.useNonce = false
oidcConfig.scope = openid
oidcConfig.responseType = code
oidcConfig.withState = false
oidcConfig.disablePkce = true
keycloakOidClient = org.pac4j.oidc.client.KeycloakOidcClient
keycloakOidClient.name = KeycloakOidcClient
keycloakOidClient.configuration = $oidcConfig
roleAdminAuthGenerator = com.myapp.util.shiropac4j.Pac4jRoleAdminAuthGenerator
keycloakOidClient.authorizationGenerator = $roleAdminAuthGenerator
clients = org.pac4j.core.client.Clients
clients.callbackUrl = http://192.168.178.93:8080/oauth/callback
clients.clients = $keycloakOidClient
pac4jRealm = io.buji.pac4j.realm.Pac4jRealm
pac4jRealm.principalNameAttribute = preferred_username
pac4jSubjectFactory = io.buji.pac4j.subject.Pac4jSubjectFactory
securityManager.subjectFactory = $pac4jSubjectFactory
config = org.pac4j.core.config.Config
config.clients = $clients
oidcSecurityFilter = org.pac4j.jee.filter.SecurityFilter
oidcSecurityFilter.config = $config
oidcSecurityFilter.clients = KeycloakOidcClient
customAuthorizer = com.myapp.util.shiropac4j.Pac4jCustomAuthorizer
config.authorizers = authorizerCustom:$customAuthorizer
oidcSecurityFilter.authorizers = authorizerCustom
### Callback Filters
callbackFilter = org.pac4j.jee.filter.CallbackFilter
callbackFilter.config = $config
customCallbackLogic = com.myapp.util.shiropac4j.Pac4jForceDefaultURLCallbackLogic
callbackFilter.callbackLogic = $customCallbackLogic
ajaxRequestResolver = org.pac4j.core.http.ajax.DefaultAjaxRequestResolver
ajaxRequestResolver.addRedirectionUrlAsHeader = true
keycloakOidClient.ajaxRequestResolver = $ajaxRequestResolver
logoutFilter = org.pac4j.jee.filter.LogoutFilter
logoutFilter.config = $config
logoutFilter.localLogout = true
logoutFilter.centralLogout = true
logoutFilter.destroySession = true
# DataSource
ds = com.mysql.cj.jdbc.MysqlDataSource
ds.serverName = localhost
ds.user = root
ds.password = test1234
ds.databaseName = myappjobsharing
ds.useSSL = false
ds.serverTimezone = Europe/Berlin
# password hashing specification, put something big for hasIterations
sha512Matcher = org.apache.shiro.authc.credential.HashedCredentialsMatcher
sha512Matcher.hashAlgorithmName=SHA-512
sha512Matcher.hashIterations=1
# Configure JDBC realm datasource.
#jdbcRealm = org.apache.shiro.realm.jdbc.JdbcRealm
jdbcRealm = com.myapp.util.shiropac4j.ShiroJdbcRealmCustom
jdbcRealm.permissionsLookupEnabled = true
jdbcRealm.authenticationQuery = select password FROM user where UPPER(email)=UPPER(?) and status = 'ACTIVE'
jdbcRealm.userRolesQuery = SELECT r.unique_name FROM permission_role_employee pe JOIN permission_role r ON pe.permission_role_fk = r.permission_role_id JOIN employee e ON pe.employee_fk = e.employee_id JOIN user u ON e.user_fk = u.user_id WHERE UPPER(u.email)=UPPER(?) AND pe.delete_flag = false
jdbcRealm.permissionsQuery = SELECT p.unique_name FROM permission_role_object po JOIN permission p ON po.permission_fk = p.permission_id JOIN permission_role r ON po.permission_role_fk = r.permission_role_id WHERE UPPER(r.unique_name)=UPPER(?) AND po.delete_flag = false
jdbcRealm.dataSource = $ds
jdbcRealm.credentialsMatcher = $sha512Matcher
# Realm for Token Login
#tcRealm = org.apache.shiro.realm.jdbc.JdbcRealm
tcRealm = com.myapp.util.shiropac4j.ShiroJdbcRealmCustom
tcRealm.permissionsLookupEnabled = true
tcRealm.authenticationQuery = SELECT token FROM api_token WHERE token = ?
tcRealm.userRolesQuery = SELECT r.unique_name FROM permission_role_employee pe JOIN permission_role r ON pe.permission_role_fk = r.permission_role_id JOIN employee e ON pe.employee_fk = e.employee_id JOIN api_token t ON t.employee_fk = e.employee_id WHERE UPPER(t.token)=UPPER(?) AND t.delete_flag = false
tcRealm.permissionsQuery = SELECT p.unique_name FROM permission_role_object po JOIN permission p ON po.permission_fk = p.permission_id JOIN permission_role r ON po.permission_role_fk = r.permission_role_id WHERE UPPER(r.unique_name)=UPPER(?) AND po.delete_flag = false
tcRealm.dataSource = $ds
# AuthStrategy
authcStrategy = org.apache.shiro.authc.pam.AtLeastOneSuccessfulStrategy
authenticator = org.apache.shiro.authc.pam.ModularRealmAuthenticator
securityManager.authenticator = $authenticator
securityManager.authenticator.authenticationStrategy = $authcStrategy
securityManager.realms = $jdbcRealm, $tcRealm, $pac4jRealm
# Caching
cacheManager = org.apache.shiro.cache.MemoryConstrainedCacheManager
securityManager.cacheManager = $cacheManager
# Using default form based security filter org.apache.shiro.web.filter.authc.FormAuthenticationFilter
authc = org.apache.shiro.web.filter.authc.FormAuthenticationFilter
authc.loginUrl = /common/login.jsf
# Redirect to an access denied page if user does not have access rights
#[roles]
#roles.unauthorizedUrl = /common/access-denied.jsf
#perms.unauthorizedUrl = /accessdenied.jsp
anyofpermission = com.myapp.util.shiropac4j.CustomPermissionsAuthorizationFilter
# Protected URLs
[urls]
## NO_SECURITY (Rendering)
## OTHER
/WEB-INF/layout/portal/** = oidcSecurityFilter
/portal/** = oidcSecurityFilter
/admin/** = oidcSecurityFilter
/community/** = oidcSecurityFilter
/jobsharing/** = anon
#/WEB-INF/layout/portal/** = authc
#/portal/** = authc
#/admin/** = authc
#/community/** = authc
## PAC4J Filter
/oauth/callback = callbackFilter
/oauth/logout = logoutFilter
My steps:
- Call http://192.168.178.93:8080/portal/dashboard.jsf
- I will be redirected to Keyloak
- I will enter my password / username
- I will get a blank screen
In the logs I can see this issue:
[org.pac4j.oidc.profile.creator.TokenValidator] (default task-1) Signed JWT rejected: Another algorithm expected, or no matching key(s) found: com.nimbusds.jose.proc.BadJOSEException: Signed JWT rejected: Another algorithm expected, or no matching key(s) found
Additonal logs:
24-08-08 11:57:12,379 DEBUG [org.pac4j.jee.context.session.JEESessionStore] (default task-1) createSession: true, retrieved session: org.apache.shiro.web.servlet.ShiroHttpSession@3a50260a
2024-08-08 11:57:12,379 DEBUG [org.pac4j.jee.context.session.JEESessionStore] (default task-1) Get sessionId: 32b944bc-0d35-48b2-a0fa-3602d8679e2d
2024-08-08 11:57:12,379 DEBUG [org.pac4j.jee.context.session.JEESessionStore] (default task-1) createSession: false, retrieved session: org.apache.shiro.web.servlet.ShiroHttpSession@3a50260a
2024-08-08 11:57:12,379 DEBUG [org.pac4j.jee.context.session.JEESessionStore] (default task-1) Return trackable session: org.apache.shiro.web.servlet.ShiroHttpSession@3a50260a
2024-08-08 11:57:12,379 DEBUG [org.pac4j.core.logout.handler.DefaultLogoutHandler] (default task-1) key: 8ccc58d2-3516-4791-92bc-7ea1833bc198 -> trackableSession: org.apache.shiro.web.servlet.ShiroHttpSession@3a50260a
2024-08-08 11:57:12,379 DEBUG [org.pac4j.core.logout.handler.DefaultLogoutHandler] (default task-1) sessionId: 32b944bc-0d35-48b2-a0fa-3602d8679e2d
2024-08-08 11:57:12,379 DEBUG [org.pac4j.core.util.InitializableObject] (default task-1) Initializing: GuavaStore (nb: 0, last: null)
2024-08-08 11:57:12,395 DEBUG [org.pac4j.oidc.profile.creator.OidcProfileCreator] (default task-1) User info response: status=200, content={"sub":"377fed82-5cc1-4830-a6e2-103a3b7b5e6c","email_verified":true,"name":"Max Mustermann","preferred_username":"[email protected]","given_name":"Max","family_name":"Mustermann","email":"[email protected]"}
2024-08-08 11:57:12,399 DEBUG [org.pac4j.oidc.client.KeycloakOidcClient] (default task-1) profile: Optional[#KeycloakOidcProfile# | id: 377fed82-5cc1-4830-a6e2-103a3b7b5e6c | attributes: {at_hash=MQR6gNp2GLuFEzngZpe3vA, sub=377fed82-5cc1-4830-a6e2-103a3b7b5e6c, email_verified=true, id_token=eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJmdVRwUjdYbzIyTGpLd3ZETEpfSms0WEF1aThubXJCYm1JNVg3TksxRmo0In0.eyJleHAiOjE3MjMxNDcwMzIsImlhdCI6MTcyMzExMTAzMiwiYXV0aF90aW1lIjoxNzIzMTExMDMyLCJqdGkiOiIzZGM1MWQwMy03MmNjLTRlMWEtYTIxNy03NTdmNmU2YTYxMTUiLCJpc3MiOiJodHRwOi8vMTkyLjE2OC4xNzguOTY6OTAwOS9hdXRoL3JlYWxtcy9naXh4IiwiYXVkIjoiZ2l4eGpvYnNoYXJpbmctZnJvbnRlbmQiLCJzdWIiOiIzNzdmZWQ4Mi01Y2MxLTQ4MzAtYTZlMi0xMDNhM2I3YjVlNmMiLCJ0eXAiOiJJRCIsImF6cCI6ImdpeHhqb2JzaGFyaW5nLWZyb250ZW5kIiwic2Vzc2lvbl9zdGF0ZSI6IjhjY2M1OGQyLTM1MTYtNDc5MS05MmJjLTdlYTE4MzNiYzE5OCIsImF0X2hhc2giOiJNUVI2Z05wMkdMdUZFem5nWnBlM3ZBIiwiYWNyIjoiMSIsInNpZCI6IjhjY2M1OGQyLTM1MTYtNDc5MS05MmJjLTdlYTE4MzNiYzE5OCIsImVtYWlsX3ZlcmlmaWVkIjp0cnVlLCJuYW1lIjoiU2ViYXN0aWFuIFJpdHRlciIsInByZWZlcnJlZF91c2VybmFtZSI6InNlYi5yaXR0ZXJAZ214Lm5ldCIsImdpdmVuX25hbWUiOiJTZWJhc3RpYW4iLCJmYW1pbHlfbmFtZSI6IlJpdHRlciIsImVtYWlsIjoic2ViLnJpdHRlckBnbXgubmV0In0.Wek2m3BJH7XJDWdvaUQ2n7FbZNKtVRH3j417piPryNOVe73IlV1jHmchAOyHT0e7603Waq90DL8yOBk-Gb3uulCNh8fQ5hNkAUtvM37jxdhOH4-Vu7Hd1ZfgYY3aazQbtunhpPwCXJ4cMQWI_GQpCkaqTTLvdViT8ghnAaKkJKcHiewWrwSVSjFhMKsB82FJVkl8rIWWa5C1o1DszmgsKh6GRGiCGpg8V8HcnVcanrRX0oizOxee36W2dd_bZO3neYyovNpYjbVY8NCDMSVwmyVVrjNi1fFEF76o3FXPWD0PfcgYI7x7bGS8uBIM6CorUw7yE38EG3ooEmYnEvJ5ow, iss=http://192.168.178.96:9009/auth/realms/myapp, typ=ID, [email protected], given_name=Max, sid=8ccc58d2-3516-4791-92bc-7ea1833bc198, access_token=eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJmdVRwUjdYbzIyTGpLd3ZETEpfSms0WEF1aThubXJCYm1JNVg3TksxRmo0In0.eyJleHAiOjE3MjMxNDcwMzIsImlhdCI6MTcyMzExMTAzMiwiYXV0aF90aW1lIjoxNzIzMTExMDMyLCJqdGkiOiI2YjgxYWE1Yy1lNzQ4LTQ1MmItOGY4ZS1hODYxYTNhN2JiNWMiLCJpc3MiOiJodHRwOi8vMTkyLjE2OC4xNzguOTY6OTAwOS9hdXRoL3JlYWxtcy9naXh4IiwiYXVkIjoiYWNjb3VudCIsInN1YiI6IjM3N2ZlZDgyLTVjYzEtNDgzMC1hNmUyLTEwM2EzYjdiNWU2YyIsInR5cCI6IkJlYXJlciIsImF6cCI6ImdpeHhqb2JzaGFyaW5nLWZyb250ZW5kIiwic2Vzc2lvbl9zdGF0ZSI6IjhjY2M1OGQyLTM1MTYtNDc5MS05MmJjLTdlYTE4MzNiYzE5OCIsImFjciI6IjEiLCJhbGxvd2VkLW9yaWdpbnMiOlsiKiJdLCJyZWFsbV9hY2Nlc3MiOnsicm9sZXMiOlsiZGVmYXVsdC1yb2xlcy1naXh4am9ic2hhcmluZyIsIm9mZmxpbmVfYWNjZXNzIiwidW1hX2F1dGhvcml6YXRpb24iXX0sInJlc291cmNlX2FjY2VzcyI6eyJhY2NvdW50Ijp7InJvbGVzIjpbIm1hbmFnZS1hY2NvdW50IiwibWFuYWdlLWFjY291bnQtbGlua3MiLCJ2aWV3LXByb2ZpbGUiXX19LCJzY29wZSI6Im9wZW5pZCBlbWFpbCBwcm9maWxlIiwic2lkIjoiOGNjYzU4ZDItMzUxNi00NzkxLTkyYmMtN2VhMTgzM2JjMTk4IiwiZW1haWxfdmVyaWZpZWQiOnRydWUsIm5hbWUiOiJTZWJhc3RpYW4gUml0dGVyIiwicHJlZmVycmVkX3VzZXJuYW1lIjoic2ViLnJpdHRlckBnbXgubmV0IiwiZ2l2ZW5fbmFtZSI6IlNlYmFzdGlhbiIsImZhbWlseV9uYW1lIjoiUml0dGVyIiwiZW1haWwiOiJzZWIucml0dGVyQGdteC5uZXQifQ.mR5e3iNOFAnd3LBCpxu9PdAmzDySa9IUmZD26yJazY303Y5tD99JkitIY8lpkTwbvy1MflI1qLshuNjFt4VvVQ_tzN9_mEdBnTtlFzWzbsHhQnaAPf96PEpfuEvaSnQyD9VAL-jY3zAR-W7wGNMfWtIXGsOxVGqw3oOak3Nzr1bCiY5jLYYCW0eEXuh8tjOxa_K6ad9dvpVCq4H1bRRxH7dqyMN-zSLRJ-AtT170UNo_hpJUKPDgUI8A4Z8NQrnJ4HjuMyeqHMvMEKdcXKOC4aCY2bswfNCLrOvR4bVEKAHgxxedKhC6DYMEqIXldjeuhs4VqqrvqOffabI1XLXFmA, token_expiration_advance=0, aud=[myappjobsharing-frontend], acr=1, azp=myappjobsharing-frontend, auth_time=Thu Aug 08 11:57:12 CEST 2024, name=Max Mustermann, expiration=1723147032332, exp=Thu Aug 08 21:57:12 CEST 2024, session_state=8ccc58d2-3516-4791-92bc-7ea1833bc198, family_name=Mustermann, iat=Thu Aug 08 11:57:12 CEST 2024, [email protected], jti=3dc51d03-72cc-4e1a-a217-757f6e6a6115} | authenticationAttributes: {} | roles: [] | permissions: [] | isRemembered: false | clientName: null | linkedId: null |]
2024-08-08 11:57:12,600 DEBUG [org.pac4j.oidc.profile.keycloak.KeycloakOidcProfile] (default task-1) adding => key: PAC4J_LOGIN_ACCEPT / value: true / class java.lang.Boolean
If I use the Keycloak not in VM and also locale, it´s working for me.
I verified both Keycloak instances and it seems both have the same settings.
Any ideas?