CODEWITHSUNDEEP
tomcatkeycloaksaml
Freiheit
Freiheit

Reputation: 8767

Tomcat is using FormAuthentication instead of the KeyCloak Tomcat Valve SAML Authentication

I have Tomcat set up with the KeyCloak SAML Valve.

I see in the logs that the Valve loads and reads its configuration from keycloak-saml.xml . When I access my application I also see in the logs that the session is not authenticated.

In my logs I see it continuing to call the FormAuthenticator and not the KeyCloak authenticator:

  15-Jun-2020 11:07:33.281 DEBUG [https-jsse-nio-8443-exec-9] org.keycloak.adapters.saml.SamlUtil.validateSamlSession SamlSession was not found in the session
15-Jun-2020 11:07:33.282 FINE [https-jsse-nio-8443-exec-9] org.apache.catalina.authenticator.AuthenticatorBase.invoke Security checking request GET /orbeon/fr
15-Jun-2020 11:07:33.282 FINE [https-jsse-nio-8443-exec-9] org.apache.catalina.realm.RealmBase.findSecurityConstraints   Checking constraint 'SecurityConstraint[Form Runner services and public pages and resources]' against GET /fr --> true
15-Jun-2020 11:07:33.282 FINE [https-jsse-nio-8443-exec-9] org.apache.catalina.realm.RealmBase.findSecurityConstraints   Checking constraint 'SecurityConstraint[Form Runner services and public pages and resources]' against GET /fr --> true
15-Jun-2020 11:07:33.282 FINE [https-jsse-nio-8443-exec-9] org.apache.catalina.authenticator.AuthenticatorBase.invoke  Calling hasUserDataPermission()
15-Jun-2020 11:07:33.282 FINE [https-jsse-nio-8443-exec-9] org.apache.catalina.realm.RealmBase.hasUserDataPermission   User data constraint already satisfied
15-Jun-2020 11:07:33.282 FINE [https-jsse-nio-8443-exec-9] org.apache.catalina.authenticator.AuthenticatorBase.invoke  Calling authenticate()
15-Jun-2020 11:07:33.282 FINE [https-jsse-nio-8443-exec-9] org.apache.catalina.authenticator.FormAuthenticator.doAuthenticate Checking for reauthenticate in session StandardSession[B4143AFBD9BB4D6D1E208687CF9F5581]
15-Jun-2020 11:07:33.282 FINE [https-jsse-nio-8443-exec-9] org.apache.catalina.authenticator.FormAuthenticator.doAuthenticate Save request in session 'B4143AFBD9BB4D6D1E208687CF9F5581'
15-Jun-2020 11:07:33.283 FINE [https-jsse-nio-8443-exec-9] org.apache.catalina.authenticator.FormAuthenticator.forwardToLoginPage Forwarding request for [/orbeon/fr] made with method [GET] to login page [null] of context [/orbeon] using request method GET
15-Jun-2020 11:07:33.283 WARNING [https-jsse-nio-8443-exec-9] org.apache.catalina.authenticator.FormAuthenticator.forwardToLoginPage No login page was defined for FORM authentication in context [/orbeon]
15-Jun-2020 11:07:33.283 FINE [https-jsse-nio-8443-exec-9] org.apache.catalina.authenticator.AuthenticatorBase.invoke  Failed authenticate() test

Comparing it to a different environment where the Valve does work I see:

12-Jun-2020 14:21:43.644 FINE [ContainerBackgroundProcessor[StandardEngine[Catalina]]] org.apache.catalina.session.ManagerBase.processExpires Start expire sessions StandardManager at 1591989703644 sessioncount 0
12-Jun-2020 14:21:43.645 FINE [ContainerBackgroundProcessor[StandardEngine[Catalina]]] org.apache.catalina.session.ManagerBase.processExpires End expire sessions StandardManager processingTime 1 expired sessions: 0
12-Jun-2020 14:21:43.646 FINE [ContainerBackgroundProcessor[StandardEngine[Catalina]]] org.apache.catalina.session.ManagerBase.processExpires Start expire sessions StandardManager at 1591989703646 sessioncount 0
12-Jun-2020 14:21:43.646 FINE [ContainerBackgroundProcessor[StandardEngine[Catalina]]] org.apache.catalina.session.ManagerBase.processExpires End expire sessions StandardManager processingTime 0 expired sessions: 0
12-Jun-2020 14:21:54.746 DEBUG [https-jsse-nio-8443-exec-4] org.keycloak.adapters.saml.CatalinaSamlSessionStore.isLoggedIn session was null, returning null
12-Jun-2020 14:21:54.747 FINE [https-jsse-nio-8443-exec-4] org.apache.catalina.authenticator.AuthenticatorBase.invoke Security checking request GET /the-app/
12-Jun-2020 14:21:54.747 FINE [https-jsse-nio-8443-exec-4] org.apache.catalina.realm.RealmBase.findSecurityConstraints   Checking constraint 'SecurityConstraint[Form Runner services and public pages and resources]' against GET / --> true
12-Jun-2020 14:21:54.748 FINE [https-jsse-nio-8443-exec-4] org.apache.catalina.realm.RealmBase.findSecurityConstraints   Checking constraint 'SecurityConstraint[Form Runner services and public pages and resources]' against GET / --> true
12-Jun-2020 14:21:54.750 FINE [https-jsse-nio-8443-exec-4] org.apache.catalina.authenticator.jaspic.AuthConfigFactoryImpl.loadPersistentRegistrations Loading persistent provider registrations from [/opt/tomcat/conf/jaspic-providers.xml]
12-Jun-2020 14:21:54.765 FINE [https-jsse-nio-8443-exec-4] org.apache.catalina.authenticator.AuthenticatorBase.invoke  Calling hasUserDataPermission()
12-Jun-2020 14:21:54.765 FINE [https-jsse-nio-8443-exec-4] org.apache.catalina.realm.RealmBase.hasUserDataPermission   User data constraint already satisfied
12-Jun-2020 14:21:54.765 FINE [https-jsse-nio-8443-exec-4] org.apache.catalina.authenticator.AuthenticatorBase.invoke  Calling authenticate()
12-Jun-2020 14:21:54.776 DEBUG [https-jsse-nio-8443-exec-4] org.keycloak.adapters.saml.SamlAuthenticator.authenticate SamlAuthenticator is using handler [org.keycloak.adapters.saml.profile.webbrowsersso.BrowserHandler@68df1d6a]
12-Jun-2020 14:21:54.776 DEBUG [https-jsse-nio-8443-exec-4] org.keycloak.adapters.saml.CatalinaSamlSessionStore.isLoggedIn session was null, returning null
12-Jun-2020 14:21:54.783 DEBUG [https-jsse-nio-8443-exec-4] org.keycloak.saml.common.DefaultPicketLinkLogger.debug org.keycloak.saml.processing.core.saml.v2.util.XMLTimeUtil issueInstant: 2020-06-12T19:21:54.781Z
12-Jun-2020 14:21:54.832 DEBUG [https-jsse-nio-8443-exec-4] org.keycloak.saml.common.DefaultPicketLinkLogger.debug The provider ApacheXMLDSig - 2.14 was added at position: 2
SLF4J: Failed to load class "org.slf4j.impl.StaticLoggerBinder".
SLF4J: Defaulting to no-operation (NOP) logger implementation
SLF4J: See http://www.slf4j.org/codes.html#StaticLoggerBinder for further details.
12-Jun-2020 14:21:54.911 FINE [https-jsse-nio-8443-exec-4] org.apache.catalina.authenticator.AuthenticatorBase.invoke  Failed authenticate() test

What logger options can I set to determine why Tomcat is loading Form authentication instead of using the valve?

Whats interesting is that I can see KeyCloak logging org.keycloak.adapters.saml.SamlUtil.validateSamlSession SamlSession was not found in the session for BOTH environments. After that the failing environment appears to call FormAuthenticator while the working environment calls SamlAuthenticator

BOTH environments show that KeyCloak is initializing and reading its config:

15-Jun-2020 11:40:56.921 DEBUG [localhost-startStop-1] org.keycloak.saml.common.DefaultPicketLinkLogger.usingLoggerImplementation Using logger implementation: org.keycloak.saml.common.DefaultPicketLinkLogger
15-Jun-2020 11:40:56.947 DEBUG [localhost-startStop-1] org.keycloak.saml.common.DefaultPicketLinkLogger.debug Element {urn:keycloak:saml:adapter}PrivateKey bypassed
15-Jun-2020 11:40:56.947 DEBUG [localhost-startStop-1] org.keycloak.saml.common.DefaultPicketLinkLogger.debug Element {urn:keycloak:saml:adapter}Certificate bypassed
15-Jun-2020 11:40:56.949 DEBUG [localhost-startStop-1] org.keycloak.saml.common.DefaultPicketLinkLogger.debug Element {urn:keycloak:saml:adapter}Attribute bypassed
15-Jun-2020 11:40:56.949 DEBUG [localhost-startStop-1] org.keycloak.saml.common.DefaultPicketLinkLogger.debug Element {urn:keycloak:saml:adapter}Attribute bypassed
15-Jun-2020 11:40:56.950 DEBUG [localhost-startStop-1] org.keycloak.saml.common.DefaultPicketLinkLogger.debug Element {urn:keycloak:saml:adapter}Property bypassed
15-Jun-2020 11:40:56.955 DEBUG [localhost-startStop-1] org.keycloak.saml.common.DefaultPicketLinkLogger.debug Element {urn:keycloak:saml:adapter}Certificate bypassed
15-Jun-2020 11:40:56.957 DEBUG [localhost-startStop-1] org.keycloak.adapters.saml.config.parsers.DeploymentBuilder.build Try to load key [mykey]
15-Jun-2020 11:40:57.320 DEBUG [localhost-startStop-1] org.keycloak.adapters.saml.RoleMappingsProviderUtils.loadProviders Loaded RoleMappingsProvider properties-based-role-mapper
15-Jun-2020 11:40:57.321 DEBUG [localhost-startStop-1] org.keycloak.adapters.saml.RoleMappingsProviderUtils.loadProviders Loaded RoleMappingsProvider properties-based-role-mapper
15-Jun-2020 11:40:57.321 DEBUG [localhost-startStop-1] org.keycloak.adapters.saml.PropertiesBasedRoleMapper.init Resource loader successfully loaded role mappings from /WEB-INF/role-mappings.properties
15-Jun-2020 11:40:57.322 DEBUG [localhost-startStop-1] org.keycloak.adapters.saml.AbstractSamlAuthenticatorValve.keycloakInit Keycloak is using a per-deployment configuration.

BOTH environments have META-INF/context.xml as:

<Context path="/orbeon">
        <Valve className="org.keycloak.adapters.saml.tomcat.SamlAuthenticatorValve"/>
        <Resource ... DATABASE RESOURCE INFO HERE ... />
</Context>

Web.xml is lengthy but I think the relevant sections for the security config are:

<security-constraint>
        <web-resource-collection>
            <web-resource-name>Form Runner services and public pages and resources</web-resource-name>
            <url-pattern>/*</url-pattern>
            <url-pattern>/fr/service/*</url-pattern>
            <url-pattern>/fr/style/*</url-pattern>
            <url-pattern>/fr/not-found</url-pattern>
            <url-pattern>/fr/unauthorized</url-pattern>
            <url-pattern>/fr/error</url-pattern>
            <url-pattern>/fr/login</url-pattern>
            <url-pattern>/fr/login-error</url-pattern>
        </web-resource-collection>
        <user-data-constraint>
            <transport-guarantee>CONFIDENTIAL</transport-guarantee>
        </user-data-constraint>
        <auth-constraint>
            <role-name>orbeon-user</role-name>
        </auth-constraint>
    </security-constraint>
    <login-config>
        <auth-method>FORM</auth-method>
        <form-login-config>
            <form-login-page>/fr/login</form-login-page>
            <form-error-page>/fr/login-error</form-error-page>
        </form-login-config>
    </login-config>
    <security-role>
        <role-name>orbeon-user</role-name>
    </security-role>
    <!-- End Form Runner authentication -->
    <session-config>
        <session-timeout>60</session-timeout>
    </session-config>

I have tried changing login-config to BASIC per WAR Configuration and Tomcat SAML Adapters . That does not change the behavior in either environment.

I am able to POST signed SAML objects to /orbeon/saml and I see KeyCloak attempting to validate the signatures and so on. This should prove that KeyCloak is listening and that my problem is somehow in the application or web.xml for the auth redirection.

Upvotes: 2

Views: 1634

Answers (1)

kayyagari
kayyagari

Reputation: 1892

Please check the version of KeyCloak adapters you are using. The adapters for version 7 of Tomcat differ from those for Tomcat versions 8 and 9.

If we compare the two adapter modules from KeyCloak for Tomcat 8,9 against the ones for Tomcat 7 we see that the module from Tomcat 7 does not override or implement FormAuthenticator.doAuthenticate. So if that module for Tomcat 7 is called from Tomcat 8 it will call the parents doAuthenticate method and attempt form-based authentication.

Upvotes: 2

Related Questions