LDAP login OK, but AKHQ stays on the login page!

[adacaccia]

Hello,
in my setup (K8s on OCI, app 0.20, Helm chart 0.27 + freshly deployed Kafka cluster with Strimzi 0.28), I can't get to a landing page even after a successful login via LDAP.

Here the details:

• values.yaml for the Helm deploy

imagePullSecrets:
- name: deploykey

image:
  repository: ***/tchiotludo/akhq
  tag: "release-0.20.0" # uses Chart.AppVersion by default

# custom annotations (example: for prometheus)
annotations: {}
  #prometheus.io/scrape: 'true'
  #prometheus.io/port: '8080'
  #prometheus.io/path: '/prometheus'

podAnnotations: {}

# custom labels
labels: {}
  # custom.label: 'true'

podLabels: {}

## You can put directly your configuration here... or add java opts or any other env vars
extraEnv:
- name: MICRONAUT_CONFIG_FILES
  value: /app/application.yml

## Or you can also use configmap for the configuration...
configuration:
  akhq:
    endpoints:
      env:
        enabled: true
        sensitive: true
    server:
      access-log:
        enabled: true
        name: org.akhq.log.access
    security:
      default-group: no-roles
      groups:
        reader:
          roles: 
          - topic/read
        admin:
          roles: 
          - topic/read
          - topic/insert
          - topic/delete
          - topic/config/update
        no-roles:
          roles: []
      ldap:
        groups:
        - name: Developers
          groups:
          - reader
        - name: Administrator
          groups:
          - admin
    connections:
      local:
        properties:
          bootstrap.servers: "kafka-kafka-bootstrap:9092"
  micronaut:
    security:
      enabled: true
      ldap:
        default:
          enabled: true
          context:
            server: 'ldap://***:389'
            managerDn: ''
            managerPassword: ''
          search:
            base: "OU=People,DC=***,DC=local"
            attributes:
            - "cn"
          groups:
            enabled: true
            base: "OU=Group,DC=***,DC=local"
    endpoints:
      env:
        enabled: true
        sensitive: true

##... and secret for connection information
existingSecrets: ""
# name of the existingSecret
secrets: {}

kafkaSecrets: []
#Provide extra base64 encoded kubernetes secrets (keystore/truststore)

# Any extra volumes to define for the pod (like keystore/truststore)
extraVolumes: []

# Any extra volume mounts to define for the akhq container
extraVolumeMounts: []

# Specify ServiceAccount for pod
serviceAccountName: null
serviceAccount:
  create: false
  #annotations:
  #  eks.amazonaws.com/role-arn: arn:aws:iam::123456789000:role/iam-role-name-here

# Add your own init container or uncomment and modify the example.
initContainers: {}
#   create-keystore:
#     image: "openjdk:11-slim"
#     command: ['sh', '-c', 'keytool']
#     volumeMounts:
#      - mountPath: /tmp
#        name: certs

# Configure the Pod Security Context
# ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
securityContext: {}
  # runAsNonRoot: true
  # runAsUser: 1000

# Configure the Container Security Context
# ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
containerSecurityContext: {}
  # allowPrivilegeEscalation: false
  # privileged: false
  # capabilities:
  #   drop:
  #     - ALL
  # runAsNonRoot: true
  # runAsUser: 1001
  # readOnlyRootFilesystem: true

service:
  enabled: true
  type: ClusterIP
  port: 8080
  #httpNodePort: 32551
  labels: {}
  annotations:
    # cloud.google.com/load-balancer-type: "Internal"

ingress:
  enabled: true
  ingressClassName: ""
  annotations: {}
    # kubernetes.io/ingress.class: nginx
    # kubernetes.io/tls-acme: "true"
  paths:
    - /
  hosts:
    - akhq-devel.***
  tls: []
  #  - secretName: akhq-tls
  #    hosts:
  #      - akhq.demo.com

readinessProbe:
  prefix: "" # set same as `micronaut.server.context-path`

resources: {}
  # limits:
  #  cpu: 100m
  #  memory: 128Mi
  # requests:
  #  cpu: 100m
  #  memory: 128Mi

nodeSelector: {}

tolerations: []

affinity: {}

---

I also always do the 2 curl's to enable logging:

curl -i -X POST -H "Content-Type: application/json" \
       -d '{ "configuredLevel": "TRACE" }' \
       http://localhost:28081/loggers/io.micronaut.security

curl -i -X POST -H "Content-Type: application/json" \
       -d '{ "configuredLevel": "TRACE" }' \
       http://localhost:28081/loggers/org.akhq.configs

but I never happen to see any "io.micronaut.security" log line in the logs, anyway.

The app behaviour: port-forward port 8080, got to localhost:8080 with a browser, and it will correctly redirect me to /ui/login asking username and password.
I reply with my LDAP configured credentials (and it is a very simple development env LDAP server, anyway, with these two groups "Developers" and "Administrator" defined in there, and my account belongs to Administrator group); after a round-trip to the server, I get stuck on the same login page, but if I go and enable F12 tools, I can see a "me" struct like {"logged":true, user:"***"), and if I go to url /ui/local/settings I can see both the settings page, and my username on the blue top right "logout" button.

So LDAP authentication is definitely working, but it seems the user has no pre-defined landing page after login!

[tchiotludo]

since you use ldap group, do you have also created the ldap group in akhq akhq.security.groups (with good roles), I don't think so as I see