unable to get oauth enabled with azure ad , #1172

hari819 · 2022-08-14T03:52:44Z

hari819
Aug 14, 2022

Hello ,

i am trying to enable oauth on akhq using azure ad in the latest version of akhq, i have followed the link https://akhq.io/docs/configuration/authentifications/oidc.html and made changes in the values.yaml files , but i am not even able to get the login page of azure ad , i can still see the tool is running without any authentication , it just lists all the kafka topics without asking for any login,

configuration:
  akhq:
    server:
      access-log:
        enabled: true
        name: org.akhq.log.access

##... and secret for connection information
existingSecrets: ""
# name of the existingSecret
secrets:
    micronaut:
      security:
        enabled: true
        oauth2:
          enabled: true
          clients:
            oauth:
              client-id: xxxx
              client-secret: xxxx
              scopes:
                - email
                - openid
                - groups
                - profile
              openid:
                issuer: xxxx
    security:
      oidc:
        enabled: true
        providers:
          azuread:
            label: "Login with Azure AD"
            username-field: email
            use-oidc-claim: true
    akhq:
      connections:
        kafka-cluster:
          properties:
            bootstrap.servers: "kafka-service:9092"
      logger:
        levels:
          org.akhq: TRACE
          io.micronaut: TRACE```


please can someone verify if i am missing something?  , i did a search in issues and discussions , could not make out what am i missing , i have enabled trace logs and the pod logs show,  

`__ __ _ _
| \/ (_) ___ _ __ ___ _ __ __ _ _ _| |_
| |\/| | |/ __| '__/ _ \| '_ \ / _` | | | | __|
| | | | | (__| | | (_) | | | | (_| | |_| | |_
|_| |_|_|\___|_| \___/|_| |_|\__,_|\__,_|\__|
Micronaut (v3.2.2)
2022-08-14 03:35:53,079 �[34mINFO �[0;39m �[35mmain �[0;39m �[36mi.m.c.e.DefaultEnvironment�[0;39m Established active environments: [k8s, cloud, secrets]
2022-08-14 03:35:53,939 �[31mWARN �[0;39m �[35mmain �[0;39m �[36mo.a.c.JwtSecurityWarning �[0;39m
2022-08-14 03:35:53,940 �[31mWARN �[0;39m �[35mmain �[0;39m �[36mo.a.c.JwtSecurityWarning �[0;39m ##############################################################
2022-08-14 03:35:53,940 �[31mWARN �[0;39m �[35mmain �[0;39m �[36mo.a.c.JwtSecurityWarning �[0;39m # SECURITY WARNING #
2022-08-14 03:35:53,940 �[31mWARN �[0;39m �[35mmain �[0;39m �[36mo.a.c.JwtSecurityWarning �[0;39m ##############################################################
2022-08-14 03:35:53,940 �[31mWARN �[0;39m �[35mmain �[0;39m �[36mo.a.c.JwtSecurityWarning �[0;39m
2022-08-14 03:35:53,940 �[31mWARN �[0;39m �[35mmain �[0;39m �[36mo.a.c.JwtSecurityWarning �[0;39m You still use the default jwt secret.
2022-08-14 03:35:53,940 �[31mWARN �[0;39m �[35mmain �[0;39m �[36mo.a.c.JwtSecurityWarning �[0;39m This known secret can be used to impersonate anyone.
2022-08-14 03:35:53,940 �[31mWARN �[0;39m �[35mmain �[0;39m �[36mo.a.c.JwtSecurityWarning �[0;39m Please change 'micronaut.security.token.jwt.signatures.secret.generator.secret' configuration, or ask your administrator to do it !
2022-08-14 03:35:53,940 �[31mWARN �[0;39m �[35mmain �[0;39m �[36mo.a.c.JwtSecurityWarning �[0;39m
2022-08-14 03:35:53,940 �[31mWARN �[0;39m �[35mmain �[0;39m �[36mo.a.c.JwtSecurityWarning �[0;39m ##############################################################
2022-08-14 03:35:53,940 �[31mWARN �[0;39m �[35mmain �[0;39m �[36mo.a.c.JwtSecurityWarning �[0;39m
2022-08-14 03:35:55,951 �[34mINFO �[0;39m �[35mmain �[0;39m �[36mi.m.runtime.Micronaut �[0;39m Startup completed in 6007ms. Server Running: http://akhq-6cb7598fdd-qh9p2:8080`

Thanks,

Answered by tchiotludo

Aug 15, 2022

@hari819

secrets:
  micronaut:
    security:
      enabled: true
      oauth2:
        enabled: true
        clients:
          oauth:
            client-id: xxxx
            client-secret: xxxx
            scopes:
              - email
              - openid
              - groups
              - profile
            openid:
              issuer: xxxx
  security:
    oidc:
      enabled: true
      providers:
        azuread:
          label: "Login with Azure AD"
          username-field: email
          use-oidc-claim: true

  akhq:
    connections:
      kafka-cluster:
        properties:
          bootstrap.servers: "kafka-service:9092"

    security:
      default-group: no-roles # d…

View full answer

hari819 · 2022-08-14T03:56:29Z

hari819
Aug 14, 2022
Author

configuration:
  akhq:
    server:
      access-log:
        enabled: true
        name: org.akhq.log.access

##... and secret for connection information
existingSecrets: ""
# name of the existingSecret
secrets:
    micronaut:
      security:
        enabled: true
        oauth2:
          enabled: true
          clients:
            oauth:
              client-id: xxxx
              client-secret: xxxx
              scopes:
                - email
                - openid
                - groups
                - profile
              openid:
                issuer: xxxx
    security:
      oidc:
        enabled: true
        providers:
          azuread:
            label: "Login with Azure AD"
            username-field: email
            use-oidc-claim: true
    akhq:
      connections:
        kafka-cluster:
          properties:
            bootstrap.servers: "kafka-service:9092"
      logger:
        levels:
          org.akhq: TRACE
          io.micronaut: TRACE ```

0 replies

hari819 · 2022-08-14T04:37:17Z

hari819
Aug 14, 2022
Author

i did not have any basic-auth enabled , so please could you let me know how do i first disable the UI without any login

0 replies

hari819 · 2022-08-14T14:19:42Z

hari819
Aug 14, 2022
Author

@tchiotludo , please could you provide some hints based on the shared configuration if i am missing something ,

0 replies

tchiotludo · 2022-08-15T18:51:41Z

tchiotludo
Aug 15, 2022
Maintainer

@hari819

secrets:
  micronaut:
    security:
      enabled: true
      oauth2:
        enabled: true
        clients:
          oauth:
            client-id: xxxx
            client-secret: xxxx
            scopes:
              - email
              - openid
              - groups
              - profile
            openid:
              issuer: xxxx
  security:
    oidc:
      enabled: true
      providers:
        azuread:
          label: "Login with Azure AD"
          username-field: email
          use-oidc-claim: true

  akhq:
    connections:
      kafka-cluster:
        properties:
          bootstrap.servers: "kafka-service:9092"

    security:
      default-group: no-roles # disabled the ui without login 
      oidc:
        enabled: true
        providers:
          azuread: # enable oidc in akhq 
            label: "Login with Azure AD"
            username-field: email
            use-oidc-claim: true
            groups-field: roles
            default-group: topic-reader

Mistake :

akhq.security.default-group: no-roles to disable the ui without login
you are putting the akhq configuration for oidc on the micronaut section

See :

0 replies

hari819 · 2022-08-15T21:37:14Z

hari819
Aug 15, 2022
Author

thankyou @tchiotludo , UI is now disable without login , i can see a login button "login with azure ad", but nothing happens when i click the button ,

| \/ (_) ___ _ __ ___ _ __ __ _ _ _| |_
| |\/| | |/ __| '__/ _ \| '_ \ / _` | | | | __|
| | | | | (__| | | (_) | | | | (_| | |_| | |_
|_| |_|_|\___|_| \___/|_| |_|\__,_|\__,_|\__|
Micronaut (v3.2.2)
2022-08-15 21:29:13,778 �[34mINFO �[0;39m �[35mmain �[0;39m �[36mi.m.c.e.DefaultEnvironment�[0;39m Established active environments: [k8s, cloud, secrets]
2022-08-15 21:29:14,835 �[31mWARN �[0;39m �[35mmain �[0;39m �[36mo.a.c.JwtSecurityWarning �[0;39m
2022-08-15 21:29:14,835 �[31mWARN �[0;39m �[35mmain �[0;39m �[36mo.a.c.JwtSecurityWarning �[0;39m ##############################################################
2022-08-15 21:29:14,835 �[31mWARN �[0;39m �[35mmain �[0;39m �[36mo.a.c.JwtSecurityWarning �[0;39m # SECURITY WARNING #
2022-08-15 21:29:14,835 �[31mWARN �[0;39m �[35mmain �[0;39m �[36mo.a.c.JwtSecurityWarning �[0;39m ##############################################################
2022-08-15 21:29:14,835 �[31mWARN �[0;39m �[35mmain �[0;39m �[36mo.a.c.JwtSecurityWarning �[0;39m
2022-08-15 21:29:14,835 �[31mWARN �[0;39m �[35mmain �[0;39m �[36mo.a.c.JwtSecurityWarning �[0;39m You still use the default jwt secret.
2022-08-15 21:29:14,835 �[31mWARN �[0;39m �[35mmain �[0;39m �[36mo.a.c.JwtSecurityWarning �[0;39m This known secret can be used to impersonate anyone.
2022-08-15 21:29:14,835 �[31mWARN �[0;39m �[35mmain �[0;39m �[36mo.a.c.JwtSecurityWarning �[0;39m Please change 'micronaut.security.token.jwt.signatures.secret.generator.secret' configuration, or ask your administrator to do it !
2022-08-15 21:29:14,835 �[31mWARN �[0;39m �[35mmain �[0;39m �[36mo.a.c.JwtSecurityWarning �[0;39m
2022-08-15 21:29:14,835 �[31mWARN �[0;39m �[35mmain �[0;39m �[36mo.a.c.JwtSecurityWarning �[0;39m ##############################################################
2022-08-15 21:29:14,835 �[31mWARN �[0;39m �[35mmain �[0;39m �[36mo.a.c.JwtSecurityWarning �[0;39m
2022-08-15 21:29:17,420 �[34mINFO �[0;39m �[35mmain �[0;39m �[36mi.m.runtime.Micronaut �[0;39m Startup completed in 4812ms. Server Running: http://akhq-698f4f6d6f-zfbhd:8080
2022-08-15 21:29:49,811 �[34mINFO �[0;39m �[35mpGroup-1-3�[0;39m �[36morg.akhq.log.access �[0;39m [Date: 2022-08-15T21:29:49.810761Z] [Duration: 0 ms] [Url: GET /ui/login] [Status: 200] [Ip: /10.225.1.107] [User: Anonymous]
2022-08-15 21:29:50,298 �[34mINFO �[0;39m �[35mpGroup-1-3�[0;39m �[36morg.akhq.log.access �[0;39m [Date: 2022-08-15T21:29:50.297838Z] [Duration: 0 ms] [Url: GET /ui/static/css/2.1e4ddb81.chunk.css] [Status: 200] [Ip: /10.225.1.107] [User: Anonymous]
2022-08-15 21:29:50,408 �[34mINFO �[0;39m �[35mpGroup-1-4�[0;39m �[36morg.akhq.log.access �[0;39m [Date: 2022-08-15T21:29:50.407714Z] [Duration: 0 ms] [Url: GET /ui/static/css/main.ae4160af.chunk.css] [Status: 200] [Ip: /10.225.1.107] [User: Anonymous]
2022-08-15 21:29:50,498 �[34mINFO �[0;39m �[35mpGroup-1-3�[0;39m �[36morg.akhq.log.access �[0;39m [Date: 2022-08-15T21:29:50.498529Z] [Duration: 0 ms] [Url: GET /ui/static/js/2.99281356.chunk.js] [Status: 200] [Ip: /10.225.1.107] [User: Anonymous]
2022-08-15 21:29:50,529 �[34mINFO �[0;39m �[35mpGroup-1-4�[0;39m �[36morg.akhq.log.access �[0;39m [Date: 2022-08-15T21:29:50.529352Z] [Duration: 0 ms] [Url: GET /ui/static/js/main.ac2796e7.chunk.js] [Status: 200] [Ip: /10.225.1.107] [User: Anonymous]
2022-08-15 21:29:50,983 �[34mINFO �[0;39m �[35mpGroup-1-3�[0;39m �[36morg.akhq.log.access �[0;39m [Date: 2022-08-15T21:29:50.953377Z] [Duration: 0 ms] [Url: GET /ui/favicon.ico] [Status: 200] [Ip: /10.225.1.107] [User: Anonymous]
2022-08-15 21:29:51,144 �[34mINFO �[0;39m �[35mr-thread-1�[0;39m �[36morg.akhq.log.access �[0;39m [Date: 2022-08-15T21:29:50.852817Z] [Duration: 291 ms] [Url: GET /api/auths] [Status: 200] [Ip: /10.225.1.107] [User: Anonymous]
2022-08-15 21:29:51,146 �[34mINFO �[0;39m �[35mr-thread-3�[0;39m �[36morg.akhq.log.access �[0;39m [Date: 2022-08-15T21:29:50.852781Z] [Duration: 293 ms] [Url: GET /api/me] [Status: 200] [Ip: /10.225.1.107] [User: Anonymous]
2022-08-15 21:29:51,464 �[34mINFO �[0;39m �[35mpGroup-1-4�[0;39m �[36morg.akhq.log.access �[0;39m [Date: 2022-08-15T21:29:51.463856Z] [Duration: 0 ms] [Url: GET /ui/manifest.json] [Status: 200] [Ip: /10.225.1.107] [User: Anonymous]
2022-08-15 21:29:51,587 �[34mINFO �[0;39m �[35mpGroup-1-4�[0;39m �[36morg.akhq.log.access �[0;39m [Date: 2022-08-15T21:29:51.587534Z] [Duration: 0 ms] [Url: GET /ui/static/media/logo.45903e1f.svg] [Status: 200] [Ip: /10.225.1.107] [User: Anonymous]
2022-08-15 21:29:51,611 �[34mINFO �[0;39m �[35mpGroup-1-3�[0;39m �[36morg.akhq.log.access �[0;39m [Date: 2022-08-15T21:29:51.611619Z] [Duration: 0 ms] [Url: GET /ui/static/media/icon.648ce9c8.svg] [Status: 200] [Ip: /10.225.1.107] [User: Anonymous]
2022-08-15 21:29:53,565 �[34mINFO �[0;39m �[35mpGroup-1-3�[0;39m �[36morg.akhq.log.access �[0;39m [Date: 2022-08-15T21:29:53.565497Z] [Duration: 0 ms] [Url: GET /ui/login] [Status: 200] [Ip: /10.225.1.107] [User: Anonymous]
2022-08-15 21:29:53,896 �[34mINFO �[0;39m �[35mr-thread-1�[0;39m �[36morg.akhq.log.access �[0;39m [Date: 2022-08-15T21:29:53.8945Z] [Duration: 1 ms] [Url: GET /api/me] [Status: 200] [Ip: /10.225.1.107] [User: Anonymous]
2022-08-15 21:29:53,900 �[34mINFO �[0;39m �[35mr-thread-1�[0;39m �[36morg.akhq.log.access �[0;39m [Date: 2022-08-15T21:29:53.899109Z] [Duration: 1 ms] [Url: GET /api/auths] [Status: 200] [Ip: /10.225.1.107] [User: Anonymous]```

i did add this header since my machine is under corporate proxy 
      server:
        host-resolution:
          host-header: Host
          protocol-header: X-Forwarded-Proto
but i cannot see anything happening on the click of the button, 

Thanks,

0 replies

tchiotludo · 2022-08-16T05:02:55Z

tchiotludo
Aug 16, 2022
Maintainer

Maybe you can share your chrome devtools screenshot please ? On the console and network tabs ? To see if there is an error on the JavaScript side ?

1 reply

hari819 Aug 16, 2022
Author

somehow i am unable to attach the screenshots at this time , github says something went really wrong , we cannot process that file when i try to drag the screenshot files,

but i can see a 307 code in the request headers,

Status Code: 307
Remote Address: 158.234.171.216:443
Referrer Policy: strict-origin-when-cross-origin

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

unable to get oauth enabled with azure ad , #1172

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Replies: 6 comments 1 reply

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

Select a reply

unable to get oauth enabled with azure ad , #1172

hari819 Aug 14, 2022

Replies: 6 comments · 1 reply

hari819 Aug 14, 2022 Author

hari819 Aug 14, 2022 Author

hari819 Aug 14, 2022 Author

tchiotludo Aug 15, 2022 Maintainer

hari819 Aug 15, 2022 Author

tchiotludo Aug 16, 2022 Maintainer

hari819 Aug 16, 2022 Author

hari819
Aug 14, 2022

Replies: 6 comments 1 reply

hari819
Aug 14, 2022
Author

hari819
Aug 14, 2022
Author

hari819
Aug 14, 2022
Author

tchiotludo
Aug 15, 2022
Maintainer

hari819
Aug 15, 2022
Author

tchiotludo
Aug 16, 2022
Maintainer

hari819 Aug 16, 2022
Author