I'm stuck on an issue that is preventing me from integrating KeyCloak (12.0.2) into Apache Zeppelin (0.8.0). I have a 'standard' KeyCloak client configured as confidential with no other specific config.
I've then modified the Zeppelin shiro.ini file with the following.
[main]
sessionManager = org.apache.shiro.web.session.mgt.DefaultWebSessionManager
securityManager.sessionManager = $sessionManager
securityManager.sessionManager.globalSessionTimeout = 86400000
oidcConfig = org.pac4j.oidc.config.OidcConfiguration
oidcConfig.discoveryURI = http://keycloak.local.com/auth/realms/apps/.well-known/openid-configuration
oidcConfig.clientId = zeppelin
oidcConfig.secret = 2b1a79d1-b09b-47f1-83d1-2eaecd96223e
oidcConfig.clientAuthenticationMethodAsString = client_secret_basic
oidcClient = org.pac4j.oidc.client.OidcClient
oidcClient.configuration = $oidcConfig
clients = org.pac4j.core.client.Clients
clients.callbackUrl = http://localhost:8080/api/callback
clients.clients = $oidcClient
requireRoleAdmin = org.pac4j.core.authorization.authorizer.RequireAnyRoleAuthorizer
requireRoleAdmin.elements = zeppelin
config = org.pac4j.core.config.Config
config.clients = $clients
config.authorizers = admin:$requireRoleAdmin
pac4jRealm = io.buji.pac4j.realm.Pac4jRealm
pac4jSubjectFactory = io.buji.pac4j.subject.Pac4jSubjectFactory
securityManager.subjectFactory = $pac4jSubjectFactory
oidcSecurityFilter = io.buji.pac4j.filter.SecurityFilter
oidcSecurityFilter.config = $config
oidcSecurityFilter.clients = oidcClient
callbackFilter = io.buji.pac4j.filter.CallbackFilter
callbackFilter.defaultUrl = http://localhost:8080/
callbackFilter.config = $config
[urls]
/api/version = anon
/api/callback = callbackFilter
/** = oidcSecurityFilter
When I hit the zeppelin URL I am redirected to KeyCloak for authentication as expected. When I login (successfully; as I can see in the DEBUG logs that i am issued an access_token), I get the following error:
javax.servlet.ServletException: Filtered request failed.
at org.apache.shiro.web.servlet.AbstractShiroFilter.doFilterInternal(AbstractShiroFilter.java:384)
at org.apache.shiro.web.servlet.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:125)
at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1652)
at org.apache.zeppelin.server.CorsFilter.doFilter(CorsFilter.java:72)
at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1652)
at org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:585)
at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:143)
at org.eclipse.jetty.security.SecurityHandler.handle(SecurityHandler.java:577)
at org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:223)
at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1127)
at org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:515)
at org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:185)
at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1061)
at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:141)
at org.eclipse.jetty.server.handler.ContextHandlerCollection.handle(ContextHandlerCollection.java:215)
at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:97)
at org.eclipse.jetty.server.Server.handle(Server.java:499)
at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:311)
at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:257)
at org.eclipse.jetty.io.AbstractConnection$2.run(AbstractConnection.java:544)
at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:635)
at org.eclipse.jetty.util.thread.QueuedThreadPool$3.run(QueuedThreadPool.java:555)
at java.base/java.lang.Thread.run(Thread.java:835)
Caused by: org.pac4j.core.exception.TechnicalException: com.nimbusds.jose.proc.BadJOSEException: Signed JWT rejected: Another algorithm expected, or no matching key(s) found
at org.pac4j.oidc.profile.creator.OidcProfileCreator.create(OidcProfileCreator.java:183)
at org.pac4j.oidc.profile.creator.OidcProfileCreator.create(OidcProfileCreator.java:46)
at org.pac4j.core.client.BaseClient.retrieveUserProfile(BaseClient.java:112)
at org.pac4j.core.client.BaseClient.getUserProfile(BaseClient.java:91)
at org.pac4j.core.engine.DefaultCallbackLogic.perform(DefaultCallbackLogic.java:94)
at io.buji.pac4j.filter.CallbackFilter.doFilter(CallbackFilter.java:75)
at org.apache.shiro.web.servlet.ProxiedFilterChain.doFilter(ProxiedFilterChain.java:66)
at org.apache.shiro.web.servlet.AbstractShiroFilter.executeChain(AbstractShiroFilter.java:449)
at org.apache.shiro.web.servlet.AbstractShiroFilter$1.call(AbstractShiroFilter.java:365)
at org.apache.shiro.subject.support.SubjectCallable.doCall(SubjectCallable.java:90)
at org.apache.shiro.subject.support.SubjectCallable.call(SubjectCallable.java:83)
at org.apache.shiro.subject.support.DelegatingSubject.execute(DelegatingSubject.java:387)
at org.apache.shiro.web.servlet.AbstractShiroFilter.doFilterInternal(AbstractShiroFilter.java:362)
... 22 more
Caused by: com.nimbusds.jose.proc.BadJOSEException: Signed JWT rejected: Another algorithm expected, or no matching key(s) found
at com.nimbusds.jwt.proc.DefaultJWTProcessor.<clinit>(DefaultJWTProcessor.java:100)
at com.nimbusds.openid.connect.sdk.validators.IDTokenValidator.validate(IDTokenValidator.java:390)
at com.nimbusds.openid.connect.sdk.validators.IDTokenValidator.validate(IDTokenValidator.java:329)
at org.pac4j.oidc.profile.creator.OidcProfileCreator.create(OidcProfileCreator.java:139)
In the logs, the preferred JWS algorithm is set to null, so the application defaults to using PS384.
WARN [2021-03-03 09:42:19,504] ({qtp1739876329-19 - /api/callback?client_name=OidcClient&state=YWLPr5nFIz5ZNAKT879ksY2lEcPC9yYL3wW6q50sR-4&session_state=9b3cc3f6-ebf4-4da9-bbcd-03306fc83e64&code=edaf05bb-ef0d-4e70-9571-31949e1069ae.9b3cc3f6-ebf4-4da9-bbcd-03306fc83e64.a9b4ff2f-8569-44b5-a888-f555ec1ed792} OidcProfileCreator.java[internalInit]:75) - Preferred JWS algorithm: null not available. Defaulting to: PS384
To get around the above, I can modify the client an set Access Token Signature Algorithm, ID Token Signature Algorithm and the Request Object Signature Algorithm properties under Fine Grain OpenID Connect Configuration to use PS384. This seems to bypass the above problem but leaves me with the following when I try to log in to Zeppelin again:
javax.servlet.ServletException: Filtered request failed.
at org.apache.shiro.web.servlet.AbstractShiroFilter.doFilterInternal(AbstractShiroFilter.java:384)
at org.apache.shiro.web.servlet.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:125)
at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1652)
at org.apache.zeppelin.server.CorsFilter.doFilter(CorsFilter.java:72)
at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1652)
at org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:585)
at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:143)
at org.eclipse.jetty.security.SecurityHandler.handle(SecurityHandler.java:577)
at org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:223)
at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1127)
at org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:515)
at org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:185)
at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1061)
at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:141)
at org.eclipse.jetty.server.handler.ContextHandlerCollection.handle(ContextHandlerCollection.java:215)
at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:97)
at org.eclipse.jetty.server.Server.handle(Server.java:499)
at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:311)
at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:257)
at org.eclipse.jetty.io.AbstractConnection$2.run(AbstractConnection.java:544)
at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:635)
at org.eclipse.jetty.util.thread.QueuedThreadPool$3.run(QueuedThreadPool.java:555)
at java.base/java.lang.Thread.run(Thread.java:835)
Caused by: org.pac4j.core.exception.TechnicalException: com.nimbusds.jose.JOSEException: Unsupported RSASSA algorithm: SHA384withRSAandMGF1 Signature not available
at org.pac4j.oidc.profile.creator.OidcProfileCreator.create(OidcProfileCreator.java:183)
at org.pac4j.oidc.profile.creator.OidcProfileCreator.create(OidcProfileCreator.java:46)
at org.pac4j.core.client.BaseClient.retrieveUserProfile(BaseClient.java:112)
at org.pac4j.core.client.BaseClient.getUserProfile(BaseClient.java:91)
at org.pac4j.core.engine.DefaultCallbackLogic.perform(DefaultCallbackLogic.java:94)
at io.buji.pac4j.filter.CallbackFilter.doFilter(CallbackFilter.java:75)
at org.apache.shiro.web.servlet.ProxiedFilterChain.doFilter(ProxiedFilterChain.java:66)
at org.apache.shiro.web.servlet.AbstractShiroFilter.executeChain(AbstractShiroFilter.java:449)
at org.apache.shiro.web.servlet.AbstractShiroFilter$1.call(AbstractShiroFilter.java:365)
at org.apache.shiro.subject.support.SubjectCallable.doCall(SubjectCallable.java:90)
at org.apache.shiro.subject.support.SubjectCallable.call(SubjectCallable.java:83)
at org.apache.shiro.subject.support.DelegatingSubject.execute(DelegatingSubject.java:387)
at org.apache.shiro.web.servlet.AbstractShiroFilter.doFilterInternal(AbstractShiroFilter.java:362)
... 22 more
Caused by: com.nimbusds.jose.JOSEException: Unsupported RSASSA algorithm: SHA384withRSAandMGF1 Signature not available
at com.nimbusds.jose.crypto.RSASSA.getSignerAndVerifier(RSASSA.java:92)
at com.nimbusds.jose.crypto.RSASSAVerifier.verify(RSASSAVerifier.java:156)
at com.nimbusds.jose.JWSObject.verify(JWSObject.java:353)
at com.nimbusds.jwt.proc.DefaultJWTProcessor.process(DefaultJWTProcessor.java:339)
at com.nimbusds.openid.connect.sdk.validators.IDTokenValidator.validate(IDTokenValidator.java:393)
at com.nimbusds.openid.connect.sdk.validators.IDTokenValidator.validate(IDTokenValidator.java:329)
at org.pac4j.oidc.profile.creator.OidcProfileCreator.create(OidcProfileCreator.java:139)
... 34 more
Caused by: java.security.NoSuchAlgorithmException: SHA384withRSAandMGF1 Signature not available
at java.base/java.security.Signature.getInstance(Signature.java:237)
at com.nimbusds.jose.crypto.RSASSA.getSignerAndVerifier(RSASSA.java:89)
... 40 more
Is there anyway I can get this to use a more common algorithm like RS256. How would I configure this in shiro.ini or is there a way to force this in KeyCloak? If I can't do that, how do I make the SHA384withRSAandMGF1 algorithm available?
Regards,
RR