oidc keycloak connector - unable to map claims to role for connector

[pankajpandey9]

Hi All,

I am getting error "unable to map claims to role for connector" while using keycloak for oidc connection. I did check the groups and roles in the keycloak and everything seems fine

Teleport image: quay.io/gravitational/teleport-ent:5.0 on Kubernetes RKE cluster
storage: etcd, session storage: IBM COS bucket (s3)

INFO [AUDIT] user.login attributes:map[acr:1 at_hash:psFchHF4DrJGRtYttXdBAQ aud:oidc_client auth_time:1.614857615e+09 azp:oidc_client email:<user.name>@<domain.name> email_verified:false exp:1.614857915e+09 family_name:*** given_name:*** group:[offline_access, uma_authorization, _admin, user] iat:1.614857615e+09 iss:https://keycloak.<domain.name>/auth/realms/skypad jti:41d054a4-3801-41e0-b789-4ea14fc5fcc4 name:* preferred_username:<user.name> session_state:18b71d33-47c1-4539-83b4-07da7643b2ef sub:76642bfb-9244-462f-a0fc-366a1e840ee7 typ:ID] code:T1001W ei:0 error:unable to map claims to role for connector: oidc event:user.login message:unable to map claims to role for connector: oidc method:oidc success:false time:2021-03-04T11:33:35.157Z uid:e3ea4039-016f-4619-a3c9-064e688279f8 user: events/emitter.go:318

[stevenGravy]

@pankajpandey9 what is your connector setting to map the group to teleport roles?

[webvictim]

@pankajpandey9 Can you turn the log level on your Teleport server up to DEBUG and try logging in again? You should then see the claims from Keycloak in the logs, so you can see what list of groups is being sent. This may help with mapping.

[pankajpandey9]

Thanks for the reply @webvictim
Since I am using pod therefore not sure how to add the debug mode while running the container. Please let me know in case there is an option to enable debug while creating the pod or even editing the deployment.

Also, in the logs I can see the groups that are being presented by keycloak

"group:[offline_access, uma_authorization, _admin, user] ". 

And I am trying to map the same with the teleport but Teleport always throws the role mapping error.

[webvictim]

You can use something like kubectl edit configmap/teleport to change the config file - you should be able to set severity: DEBUG in there. You'll need to relaunch the Teleport pod afterwards; something like kubectl rollout restart deploy/teleport (with the correct namespace/deployment name set in both cases)

[pankajpandey9]

@webvictim , I restarted the containers in DEBUG mode and here are the detailed logs from Auth container

DEBU [AUTH]      OIDC redirect URL: https://keycloak.rke.<domain>.internal/auth/realms/<domain>/protocol/openid-connect/auth?client_id=oidc_client&prompt=select_account&redirect_uri=https%3A%2F%2Fcloud-teleportlb-dal13-01.<domain>.internal%2Fv1%2Fwebapi%2Foidc%2Fcallback&response_type=code&scope=openid+email&state=443cd2eab038f7e12ab9b6084193436. auth/oidc.go:231
DEBU [AUTH]      Extracting OIDC claims from ID token. auth/oidc.go:551
DEBU [AUTH]      OIDC ID Token claims: map[acr:0 at_hash:akWcTbSnbJ-uOTP_dKxPXA aud:oidc_client auth_time:1.614926654e+09 azp:oidc_client email:pankaj.pandey@<domain>.internal email_verified:false exp:1.614927188e+09 family_name:pandey given_name:pankaj pandey group:[<domain>_admin, offline_access, uma_authorization, user] iat:1.614926888e+09 iss:https://keycloak.rke.<domain>.internal/auth/realms/<domain> jti:5af60819-75c5-4ae4-9750-d62a737b573 name:pankaj pandey pandey preferred_username:pankaj.pandey session_state:35fc1362-4eab-4900-b81e-929d3cfc0aa9 sub:a57b29f0-0326-4fbd-9ace-ad5aaca7dca0 typ:ID]. auth/oidc.go:791
DEBU [AUTH]      Fetching OIDC claims from UserInfo endpoint: "https://keycloak.rke.<domain>.internal/auth/realms/<domain>/protocol/openid-connect/userinfo". auth/oidc.go:593
DEBU [AUTH]      UserInfo claims: map[email:pankaj.pandey@<domain>.internal email_verified:false family_name:pandey given_name:pankaj pandey group:[<domain>_admin, offline_access, uma_authorization, user] name:pankaj pandey pandey preferred_username:pankaj.pandey sub:a57b29f0-0326-4fbd-9ace-ad5aaca7dca0]. auth/oidc.go:808
DEBU [AUTH]      OIDC claims: map[acr:0 at_hash:akWcTbSnbJ-uOTP_dKxPXA aud:oidc_client auth_time:1.614926654e+09 azp:oidc_client email:pankaj.pandey@<domain>.internal email_verified:false exp:1.614927188e+09 family_name:pandey given_name:pankaj pandey group:[<domain>_admin, offline_access, uma_authorization, user] iat:1.614926888e+09 iss:https://keycloak.rke.<domain>.internal/auth/realms/<domain> jti:5af60819-75c5-4ae4-9750-d62a737b573 name:pankaj pandey pandey preferred_username:pankaj.pandey session_state:35fc1362-4eab-4900-b81e-929d3cfc0aa sub:a57b29f0-0326-4fbd-9ace-ad5aaca7dca typ:ID]. auth/oidc.go:343
DEBU [AUTH]      OIDC user "pankaj.pandey@<domain>.internal" expires at: 2021-03-05 06:53:08 +0000 UTC. auth/oidc.go:359

DEBU [AUTH]      Applying 3 OIDC claims to roles mappings. auth/oidc.go:366
DEBU             Failed to match expression <domain>-admin, replace with: admins input: [<domain>_admin, offline_access, uma_authorization, user] error:no match found services/traits.go:99
DEBU             Failed to match expression <domain>_admin, replace with: admins input: [<domain>_admin, offline_access, uma_authorization, user] error:no match found services/traits.go:99
DEBU             Failed to match expression user, replace with: guest input: [<domain>_admin, offline_access, uma_authorization, user] error:no match found services/traits.go:99

INFO [AUDIT]     user.login attributes:map[acr:0 at_hash:akWcTbSnbJ-uOTP_dKxPXA aud:oidc_client auth_time:1.614926654e+09 azp:oidc_client email:pankaj.pandey@<domain>.internal email_verified:false exp:1.614927188e+09 family_name:pandey given_name:pankaj pandey group:[<domain>_admin, offline_access, uma_authorization, user] iat:1.614926888e+09 iss:https://keycloak.rke.<domain>.internal/auth/realms/<domain> jti:5af60819-75c5-4ae4-9750-d62a737b57 name:pankaj pandey pandey preferred_username:pankaj.pandey session_state:35fc1362-4eab-4900-b81e-929d3cfc0aa sub:a57b29f0-0326-4fbd-9ace-ad5aaca7dc typ:ID] code:T1001W ei:0 error:unable to map claims to role for connector: oidc event:user.login message:unable to map claims to role for connector: oidc method:oidc success:false time:2021-03-05T06:48:08.108Z uid:0847156c-b3ed-4a23-a6cf-a71a5f75891 user: events/emitter.go:318

[pankajpandey9]

@webvictim, @stevenGravy .. Thanks for the support!

After checking the KeyCloak setting by the one of the Team Member. It seems the issue was with the KeyCloak role mapping. After fixing KeyCloak the mapping seems to be fine.

[webvictim]

#5843 (reply in thread)