Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Keycloak OIDC integration

Aperta
  • Qualcosa non va?
#352 4 commenti 0 reazioni 0 assegnatari Vedi su GitHub

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
25/100
Tipo di issue
Bug
Chiarezza
Da chiarire
Stato di attività
Ferma
Stack tecnologico
javascript
Ambito
api, authentication

Direzione di ricerca

Inizia riproducendo il flusso 401 con i file forniti docker-compose.yml e rest-api-service-config.json, quindi esamina scripts/configureKeycloak.js e la configurazione dell’autenticazione della REST API. Confronta le impostazioni configurate di redirect OIDC, issuer, client e utente con i log della richiesta e del server; il lavoro è completato quando un login Keycloak valido restituisce una sessione Workbench autenticata.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Hi Team,
I am working on the Keycloak OIDC Integration + ATT&CK Workbench Frontend/RestAPI. Unfortunately, I still get "401 Unauthorized" after Keyclock redirects back to the application after authentication.
The testing flow:

  1. I open the Workbench webpage and click on the Login button. I also see the "Register" button.
  2. It redirects to the Keycloak login page. I enter valid credentials.
  3. It redirects back to the workbench webpage with 401 Unauthorized.

Here is my setup / some listings attached:

[root@vps15 attack-workbench-frontend-2.1.0]# cat docker-compose.yml
version: "3.9"
services:
frontend:
container_name: attack-workbench-frontend
image: front-xxx
build: .
depends_on:
- rest-api
ports:
- "82:80"
volumes:
- ./docker-compose-resources/nginx/nginx.conf:/etc/nginx/nginx.conf:ro

rest-api:
container_name: attack-workbench-rest-api
build: ../attack-workbench-rest-api
image: rest-xxx
depends_on:
- mongodb
ports:
- "3000:3000"
volumes:
- ./docker-compose-resources/rest-api/rest-api-service-config.json:/usr/src/app/resources/rest-api-service-config.json:ro
environment:
- DATABASE_URL=mongodb://attack-workbench-database/attack-workspace
- SERVICE_ACCOUNT_APIKEY_ENABLE=true
- JSON_CONFIG_PATH=./resources/rest-api-service-config.json
- WORKBENCH_HOST=http://attack-workbench-rest-api
- WORKBENCH_AUTHN_SERVICE_NAME=collection-manager
- AUTHN_MECHANISM=oidc
- ENABLE_CORS_ANY_ORIGIN=false
- AUTHN_OIDC_CLIENT_ID=workbench
- AUTHN_OIDC_CLIENT_SECRET=Y2lnS0XXXXXXXX6397WzXr9a1
- AUTHN_OIDC_ISSUER_URL=https://vps14.domain.com.pl/realms/edrmetry/.well-known/openid-configuration
- AUTHN_OIDC_REDIRECT_ORIGIN=https://vps15.domain.com
- LOG_LEVEL=debug
- SERVICE_ACCOUNT_OIDC_ENABLE=true
- WB_REST_SERVICE_ACCOUNT_CHALLENGE_APIKEY_ENABLE=true

mongodb:
container_name: attack-workbench-database
image: mongo
volumes:
- db-data:/data/db
ports:
- "27017:27017"

volumes:
db-data:

[root@vps15 attack-workbench-frontend-2.1.0]# cat docker-compose-resources/rest-api/rest-api-service-config.json
{
"serviceAuthn": {
"oidcClientCredentials": {
"enable": true,
"clients": [
{
"clientId": "workbench",
"serviceRole": "collection-manager"
}
]
}
}
}

[root@vps15 attack-workbench-frontend-2.1.0]# docker compose up
....
attack-workbench-rest-api | 2024-08-14T10:05:15.447Z [INFO] ATT&CK Workbench REST API app starting
attack-workbench-rest-api | 2024-08-14T10:05:15.448Z [INFO] Configuring the app
attack-workbench-rest-api | 2024-08-14T10:05:15.448Z [INFO] Starting express
attack-workbench-rest-api | 2024-08-14T10:05:15.872Z [INFO] CORS is not enabled
attack-workbench-rest-api | 2024-08-14T10:05:15.907Z [INFO] Enabling HTTP request logging
attack-workbench-rest-api | 2024-08-14T10:05:15.913Z [INFO] Enabling Swagger UI
attack-workbench-rest-api | 2024-08-14T10:05:16.638Z [INFO] Configuring static routes
attack-workbench-rest-api | 2024-08-14T10:05:17.683Z [INFO] Configured authentication mechanism: oidc
attack-workbench-rest-api | 2024-08-14T10:05:17.685Z [INFO] Configured authentication mechanism: bearer
attack-workbench-rest-api | 2024-08-14T10:05:17.685Z [INFO] Enabled service authentication: client credentials
attack-workbench-rest-api | 2024-08-14T10:05:17.685Z [INFO] Enabled service authentication: challenge apikey
attack-workbench-rest-api | 2024-08-14T10:05:17.685Z [INFO] Configuring REST API routes
attack-workbench-rest-api | 2024-08-14T10:05:18.071Z [INFO] Starting the scheduler
attack-workbench-rest-api | 2024-08-14T10:05:18.071Z [INFO] Starting the HTTP server...
attack-workbench-rest-api | 2024-08-14T10:05:18.079Z [INFO] Listening at http://:::3000
attack-workbench-rest-api | 2024-08-14T10:05:18.079Z [INFO] ATT&CK Workbench REST API start up complete

Keycloak realm has been created with support for OpenID. The Client has been created with Standard Authentication flow. Client authentication is on. Some users like [email protected] have been added to the Keycloak.

I even modified the scripts/configureKeycloak.js for adding local users to the workbench database => I thought it would lead me to some clue => no luck.

What am I missing? Do you have any idea? Any little hint will be appreciated.
Thanks!

Lingua principale
JavaScript
Stelle
56
Fork
18
Merge medio
21h 30m
PR unite (30g)
8

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di mitre-attack/attack-workbench-rest-api

Tutte le issue di mitre-attack/attack-workbench-rest-api

Issue simili

Altre issue su JavaScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.