OpaInfoFetcher missing/bad TLS config results in confusing error message
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 38/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Stale
- Tech stack
- kubernetes, rust
- Domain
- infrastructure, security
Research direction
No file or test is named; start by locating the OpaInfoFetcher access-token request and its TLS/error handling. Reproduce with the shown Keycloak configuration, then verify that missing or incorrect webPki trust produces an error that identifies the TLS problem rather than only the HTTP 405.
Written by the indexing model from the issue text.
Description
We moved from an on-prem Keycloak (16.0.1) to a managed keycloak (24.0.4) for a customer. It worked fine for basically all required products (Trino, Superset, Datahub etc.) but the OPA infofetcher was unhappy with just changing the endpoint and clientId / clientSecret.
user-info-fetcher 2024-12-05T11:52:15.473210Z WARN stackable_opa_user_info_fetcher: Error while processing request error=failed to get user information from Keycloak error.sources=[failed to get access_token, http response 405 for "https://foo.bar.de/realms/foobar/protocol/openid-connect/token" with response body "{\"error\":\"HTTP 405 Method Not Allowed\",\"error_description\":\"For more on this error consult the server log at the debug level.\"}"]
That was the error from the info fetcher. The get "access-token" call is 100% a POST HTTP call etc.
The managed Keycloak actually was complaining about (and receiving) a GET request.
This was very misleading, since the actual problem was missing the webPki trust.
userInfo:
backend:
keycloak:
hostname: "{{ .Values.keycloak }}"
clientCredentialsSecret: "opa-infofetcher-secret"
adminRealm: "foobar"
userRealm: "foobar"
tls:
verification:
server:
caCert:
webPki: {}
Since Trust/TLS this is a very common configuration mistake, i think the error messages should reflect this better.
Edit: Since this may depend on the (managed) keycloak server and setup, I did not check if i could reproduce this with other setups.
- Dominant language
- Rust
- Stars
- 21
- Forks
- 5
- Avg merge
- 12h 44m
- Merged PRs (30d)
- 11
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from stackabletech/opa-operator
-
type/bug
Difficulty 4/5 3-5 days Newbie friendliness 52/100
stackabletech/opa-operator#823 ·
-
Difficulty 5/5 Over a week Newbie friendliness 30/100
stackabletech/opa-operator#766 ·
-
Difficulty 4/5 3-5 days Newbie friendliness 35/100
stackabletech/opa-operator#733 ·
-
Difficulty 2/5 Half a day Newbie friendliness 50/100
stackabletech/opa-operator#724 ·
-
type/bug
Difficulty 5/5 Over a week Newbie friendliness 20/100
stackabletech/opa-operator#718 ·
All issues in stackabletech/opa-operator
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
Eynzof/Hermes-CN-Desktop#616 ·
-
bug rules
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
-
app bug
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
IronCoreLabs/ironcore-alloy#346 ·
-
good first issue
Difficulty 2/5 1-3 hours Newbie friendliness 65/100