Integration Error

Question

Integration Error

srinathganesh1 opened this issue 5 years ago · comments

Updated with latest status (removed some irreverent things):

modules/flowable-ui-modeler/flowable-ui-modeler-conf/src/main/java/org/flowable/ui/modeler/conf/SecurityConfiguration.java
(I was not able to directly replace the class name, since new class name had one extra parameter)

modules/flowable-ui-modeler/flowable-ui-modeler-app/src/main/resources/flowable-default.properties

User Permission

Service Account

I had to add view-users from the auto generated master-realm to do away with token error

Error after signin (there are no logs generated for this in flowable and keycloak)

André Camilo · Answer 1 · Mon Mar 23 2020 17:49:13 GMT+0800 (China Standard Time)

Your client setup in keycloak needs to have:

Service Accounts enabled
The view-users and view-groups scopes in both client scopes and service account scopes.

I can detail more what to do if you want.

Srinath Ganesh · Answer 2 · Tue Mar 24 2020 05:11:58 GMT+0800 (China Standard Time)

I tried setting the scope and service account, and a few more configs. It still didn't work. Updated original post (since 403 stopped coming somehow)

Do you have a sample demo project? or a sample configuration for keycloak

Srinath Ganesh · Answer 3 · Tue Mar 31 2020 02:21:42 GMT+0800 (China Standard Time)

Update: I made this change

and I am getting error

André Camilo · Answer 4 · Tue Mar 31 2020 18:22:45 GMT+0800 (China Standard Time)

Can you show me the logs from keycloak?

Srinath Ganesh · Answer 5 · Tue Mar 31 2020 19:08:25 GMT+0800 (China Standard Time)

Can you show me the logs from keycloak?

sure will post them.

Srinath Ganesh · Answer 6 · Tue Mar 31 2020 19:18:41 GMT+0800 (China Standard Time)

I will shortly update the original post will all my configuration again (instead of two comments)

Flowable Logs

2020-03-31 16:46:20.360  INFO 19732 --- [nio-8080-exec-5] o.a.c.c.C.[.[.[/flowable-modeler]        : Initializing Spring FrameworkServlet 'dispatcherServlet'
2020-03-31 16:46:20.360  INFO 19732 --- [nio-8080-exec-5] o.s.w.s.DispatcherServlet                : FrameworkServlet 'dispatcherServlet': initialization started
2020-03-31 16:46:20.408  INFO 19732 --- [nio-8080-exec-5] o.s.w.s.DispatcherServlet                : FrameworkServlet 'dispatcherServlet': initialization completed in 43 ms

Keycloak Logs: Nothing getting logged.

Srinath Ganesh · Answer 7 · Tue Mar 31 2020 19:48:44 GMT+0800 (China Standard Time)

I have updated original post with the latest configs #1 (comment)

André Camilo · Answer 8 · Wed Apr 01 2020 21:59:32 GMT+0800 (China Standard Time)

I'll make a sample project from https://github.com/flowable/flowable-engine/tree/master/modules/flowable-ui-modeler.

But it will take some time. Maybe next week. Sorry.

Srinath Ganesh · Answer 9 · Wed Apr 01 2020 22:16:37 GMT+0800 (China Standard Time)

I'll make a sample project from https://github.com/flowable/flowable-engine/tree/master/modules/flowable-ui-modeler.

But it will take some time. Maybe next week. Sorry.

Ok thank you. does my current configs looks fine?

André Camilo · Answer 10 · Wed Apr 01 2020 22:26:25 GMT+0800 (China Standard Time)

Yes, it looks fine. Maybe there's something missing in the SecurityConfiguration. But I need some time to test this.

Srinath Ganesh · Answer 11 · Wed Apr 01 2020 22:54:59 GMT+0800 (China Standard Time)

Yes, it looks fine. Maybe there's something missing in the SecurityConfiguration. But I need some time to test this.

Ok thanks

André Camilo · Answer 12 · Mon Apr 06 2020 22:50:57 GMT+0800 (China Standard Time)

@srinathganesh1 can you checkout this commit: premium-minds/flowable-keycloak-example@69dda8c

This example is working for flowable-ui-modeler.

Srinath Ganesh · Answer 13 · Mon Apr 06 2020 23:12:00 GMT+0800 (China Standard Time)

Thanks a lot. I will try it out.

…

On Mon, 6 Apr, 2020, 20:21 André Camilo, ***@***.***> wrote: @srinathganesh1 <https://github.com/srinathganesh1> can you checkout this commit: ***@***.*** <premium-minds/flowable-keycloak-example@69dda8c> This example is working for flowable-ui-modeler

Krishna · Answer 14 · Thu Aug 06 2020 20:29:32 GMT+0800 (China Standard Time)

@ajcamilo @srinathganesh1 Is this issue fixed?
I got the same issue - RESTEASY003210: Could not find resource for full path: http://localhost:8080/flowable-task

André Camilo · Answer 15 · Fri Aug 07 2020 02:00:07 GMT+0800 (China Standard Time)

@krishnakumar-ls I've only did the modifications in the project flowable-ui-modeler, but if you need for the other projects, just do the same changes from this commit: premium-minds/flowable-keycloak-example@69dda8c?

Krishna · Answer 16 · Fri Aug 07 2020 11:32:31 GMT+0800 (China Standard Time)

@ajcamilo I did the changes in flowable-task project as per this commit premium-minds/flowable-keycloak-example@69dda8c
But still I got the same issue(RESTEASY003210: Could not find resource for full path).

André Camilo · Answer 17 · Fri Aug 07 2020 17:16:37 GMT+0800 (China Standard Time)

I'll try to get some time in the weekend to check that out, ok?

Krishna · Answer 18 · Fri Aug 07 2020 17:19:46 GMT+0800 (China Standard Time)

@ajcamilo Sure.

André Camilo · Answer 19 · Mon Aug 10 2020 17:49:42 GMT+0800 (China Standard Time)

@krishnakumar-ls what is the version of flowable you are using?

Krishna · Answer 20 · Mon Aug 10 2020 19:10:12 GMT+0800 (China Standard Time)

@ajcamilo I'm using Flowable 6.5.0

Krishna · Answer 21 · Mon Aug 10 2020 19:17:06 GMT+0800 (China Standard Time)

@ajcamilo Got 404 error for the URL 'http://localhost:8080/flowable-task/' after redirect from keycloak auth server.

André Camilo · Answer 22 · Wed Aug 12 2020 21:36:40 GMT+0800 (China Standard Time)

Sorry for the delay @krishnakumar-ls

Checkout the new version of premium-minds/flowable-keycloak-example@9d1314a

Now flowable-task uses keycloak authentication.

Krishna · Answer 23 · Thu Aug 13 2020 19:22:36 GMT+0800 (China Standard Time)

@ajcamilo Thank you! I will try this checkout premium-minds/flowable-keycloak-example@9d1314a
Can you you share me the configuration changes in flowable-ui-*-app>src>main>docker>docker-compose.yml to build a flowable docker image.

André Camilo · Answer 24 · Fri Aug 14 2020 17:08:56 GMT+0800 (China Standard Time)

add the following to the environment part of the flowable app:

      - KEYCLOAK_URL=<url to keycloak>
      - KEYCLOAK_REALM=<keycloak realm>
      - KEYCLOAK_ISSUER-URL=<issuer url>
      - KEYCLOAK_CLIENT_CLIENT-ID=<client id>
      - KEYCLOAK_CLIENT_CLIENT-SECRET=<client secret>

Sanlisi · Answer 25 · Fri Oct 09 2020 16:28:30 GMT+0800 (China Standard Time)

@srinathganesh1 hi, have you solved your problem?

Sanlisi · Answer 26 · Fri Oct 09 2020 19:40:13 GMT+0800 (China Standard Time)

@ajcamilo hi, I have a problem , when I run flowable-ui-modeler project there is an error in the program,can you tell me the reason？ thank you .

Caused by: java.lang.ClassNotFoundException: com.premiumminds.flowable.conf.KeycloakProperties
at java.net.URLClassLoader.findClass(URLClassLoader.java:381) ~[?:1.8.0_161]
at java.lang.ClassLoader.loadClass(ClassLoader.java:424) ~[?:1.8.0_161]
at sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:338) ~[?:1.8.0_161]
at java.lang.ClassLoader.loadClass(ClassLoader.java:357) ~[?:1.8.0_161]
at org.springframework.boot.devtools.restart.classloader.RestartClassLoader.loadClass(RestartClassLoader.java:144) ~[spring-boot-devtools-2.2.2.RELEASE.jar:2.2.2.RELEASE]
at java.lang.ClassLoader.loadClass(ClassLoader.java:357) ~[?:1.8.0_161]
at java.lang.Class.getDeclaredMethods0(Native Method) ~[?:1.8.0_161]
at java.lang.Class.privateGetDeclaredMethods(Class.java:2701) ~[?:1.8.0_161]
at java.lang.Class.getDeclaredMethods(Class.java:1975) ~[?:1.8.0_161]
at org.springframework.util.ReflectionUtils.getDeclaredMethods(ReflectionUtils.java:463) ~[spring-core-5.2.2.RELEASE.jar:5.2.2.RELEASE]
... 26 more

Process finished with exit code 0

André Camilo · Answer 27 · Fri Oct 09 2020 23:25:36 GMT+0800 (China Standard Time)

@Sanlisi, did you check this out? https://github.com/premium-minds/flowable-keycloak-example

You can see this commit premium-minds/flowable-keycloak-example@69dda8c
It has all the changes needed to the flowable project for the modeler to work with keycloak.

Sanlisi · Answer 28 · Sat Oct 10 2020 10:13:43 GMT+0800 (China Standard Time)

@ajcamilo hi, yesterday’s problem has been solved, but when I access: "localhost:8888/flowable-modeler"，the following error occurred，

Whitelabel Error Page
This application has no explicit mapping for /error, so you are seeing this as a fallback.
Sat Oct 10 09:42:06 CST 2020
There was an unexpected error (type=Internal Server Error, status=500).
javax.ws.rs.ForbiddenException: HTTP 403 Forbidden
com.google.common.util.concurrent.UncheckedExecutionException: javax.ws.rs.ForbiddenException: HTTP 403 Forbidden
at com.google.common.cache.LocalCache$Segment.get(LocalCache.java:2051)
at com.google.common.cache.LocalCache.get(LocalCache.java:3951)
at com.google.common.cache.LocalCache.getOrLoad(LocalCache.java:3974)
at com.google.common.cache.LocalCache$LocalLoadingCache.get(LocalCache.java:4958)
at com.premiumminds.flowable.service.KeycloakServiceImpl.getUser(KeycloakServiceImpl.java:154)
at com.premiumminds.flowable.filter.AuthenticationHandler.authenticationCallbackHandler(AuthenticationHandler.java:115)
at com.premiumminds.flowable.filter.KeycloakCookieFilter.doFilterInternal(KeycloakCookieFilter.java:108)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:116)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
at org.springframework.security.web.header.HeaderWriterFilter.doHeadersAfter(HeaderWriterFilter.java:92)
at org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:77)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:105)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
at org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:56)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:215)
at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:178)
at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:358)
at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:271)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
at org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:100)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
at org.springframework.web.filter.FormContentFilter.doFilterInternal(FormContentFilter.java:93)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
at org.springframework.boot.actuate.metrics.web.servlet.WebMvcMetricsFilter.doFilterInternal(WebMvcMetricsFilter.java:108)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:201)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:202)
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96)
at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:526)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:139)
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92)
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74)
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:343)
at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:367)
at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65)
at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:860)
at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1591)
at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
at java.lang.Thread.run(Thread.java:748)
Caused by: javax.ws.rs.ForbiddenException: HTTP 403 Forbidden
at org.jboss.resteasy.client.jaxrs.internal.ClientInvocation.handleErrorStatus(ClientInvocation.java:223)
at org.jboss.resteasy.client.jaxrs.internal.ClientInvocation.extractResult(ClientInvocation.java:195)
at org.jboss.resteasy.client.jaxrs.internal.proxy.extractors.BodyEntityExtractor.extractEntity(BodyEntityExtractor.java:62)
at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientInvoker.invokeSync(ClientInvoker.java:151)
at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientInvoker.invoke(ClientInvoker.java:112)
at org.jboss.resteasy.client.jaxrs.internal.proxy.ClientProxy.invoke(ClientProxy.java:76)
at com.sun.proxy.$Proxy154.toRepresentation(Unknown Source)
at com.premiumminds.flowable.service.KeycloakServiceImpl$1.load(KeycloakServiceImpl.java:90)
at com.premiumminds.flowable.service.KeycloakServiceImpl$1.load(KeycloakServiceImpl.java:86)
at com.google.common.cache.LocalCache$LoadingValueReference.loadFuture(LocalCache.java:3529)
at com.google.common.cache.LocalCache$Segment.loadSync(LocalCache.java:2278)
at com.google.common.cache.LocalCache$Segment.lockedGetOrLoad(LocalCache.java:2155)
at com.google.common.cache.LocalCache$Segment.get(LocalCache.java:2045)
... 57 more

so , I have some questions:

can you give me some images of keycloak ui ?
What does mean of “The view-users and view-groups scopes in both client scopes and service account scopes.” ? and where to set up it ? ------
keycloak.client.scope = openid roles ------ Where to set up openid roles?

thank you.

Krishna · Answer 29 · Mon Oct 12 2020 12:18:14 GMT+0800 (China Standard Time)

@Sanlisi This exception is raised due to user permission issue. You have to add client service account roles by click client -> select 'Service Account Roles' tab -> Add client roles
& have to add client role mapping by click user -> select 'Role Mapping' -> add client roles

Sanlisi · Answer 30 · Mon Oct 12 2020 19:49:06 GMT+0800 (China Standard Time)

@krishnakumar-ls @ajcamilo Sorry, I tried your method, but it still doesn’t work，so can you give me a complete images of
keycloak ui ?
Currently my configuration is like this

Can you give me your email? thank you very much

André Camilo · Answer 31 · Mon Oct 12 2020 21:03:59 GMT+0800 (China Standard Time)

@Sanlisi the view-users and view-groups roles are from the client realm-management

Sanlisi · Answer 32 · Tue Oct 13 2020 11:43:46 GMT+0800 (China Standard Time)

@ajcamilo @srinathganesh1 hi , according to your prompt, yesterday’s problem has been solved, but I encountered a new problem，when I visit the page：http://localhost:8888/flowable-modeler, as if the page has been refreshing，Why is that？
Where does Kaycloak UI need to be configured? thank you very much。

Srinath Ganesh · Answer 33 · Tue Oct 13 2020 11:54:28 GMT+0800 (China Standard Time)

Sorry to jump the topic in a different direction (still related to keycloak SSO)

I have not personally tried it, but based on release notes it seems latest flowable has built in keycloak support

Ref: https://blog.flowable.org/2020/10/12/flowable-6-6-0-release/
Quote: "Support for OAuth2 authentication is added to the Flowable UI App, with Keycloak as an example implementation."

Sanlisi · Answer 34 · Wed Oct 14 2020 12:25:11 GMT+0800 (China Standard Time)

@srinathganesh1 @ajcamilo the problem has been solved，I use the 6.6 version，Ref: https://blog.flowable.org/2020/10/12/flowable-6-6-0-release/ ，thank you very much