keycloak-backend alpha plugin doesn't seem to be working #1796
Comments
|
Hi @airedwin , Thanks for reporting this issue. Can you please clarify:
That will help us better understand and scope this issue. Thanks. |
|
backstage version 1.27.0 using the alpha backend, this was defaulted through their create-app i followed the directions at https://janus-idp.io/plugins/keycloak/#new-backend-configuration i expect to see the scheduler running in the logs and for my keycloak users to be imported into the catalog |
|
any update on this? is there something that i am doing wrong? |
|
@Zaperex Can you please help answer this? Thanks. |
|
@airedwin I'm going to need a bit more information.
I tested using your configuration of using:
"resolutions": {
"@backstage/backend-app-api": "0.7.5",
"@backstage/backend-dynamic-feature-service": "0.2.10"
},Do you see a log containing the following that indicates the keycloak backend task worker started? 2024-06-21T15:01:16.718Z catalog info Task worker starting: KeycloakOrgEntityProvider:default:refresh, {"version":2,"cadence":"PT30M","initialDelayDuration":"PT15S","timeoutAfterDuration":"PT3M"} task=KeycloakOrgEntityProvider:default:refreshA successful sync would log out something similar to: 2024-06-21T15:01:31.722Z catalog info Reading Keycloak users and groups class=KeycloakOrgEntityProvider taskId=KeycloakOrgEntityProvider:default:refresh taskInstanceId=94a7f8ba-4414-4173-bdfd-ae325c6217a6
2024-06-21T15:01:31.778Z catalog info Read 5 Keycloak users and 4 Keycloak groups in 0.1 seconds. Committing... class=KeycloakOrgEntityProvider taskId=KeycloakOrgEntityProvider:default:refresh taskInstanceId=94a7f8ba-4414-4173-bdfd-ae325c6217a6
2024-06-21T15:01:31.783Z catalog info Committed 5 Keycloak users and 4 Keycloak groups in 0.0 seconds. class=KeycloakOrgEntityProvider taskId=KeycloakOrgEntityProvider:default:refresh taskInstanceId=94a7f8ba-4414-4173-bdfd-ae325c6217a6When I tested with Do you have any additional logs related to the keycloak backend appear? Having those would help debug your issue. Also can you check if you have your keycloak instance setup correctly?
|
I will give this a try, i think the only difference between yours and mine is the resolutions? |
|
My start up logs are |
|
my packages/backend/src/index.ts is |
|
I assume that is how I "install" the plugin? |
|
your |
|
It seems like I don't have those tables in my database, I'm using an AWS RDS instance, with a single database with multiple schemas |
|
Hmm that most likely indicates that the keycloak backend did not start up at all. |
|
I built in docker with this dockerfile |
|
and i'm using a helm chart from https://github.com/backstage/charts i slightly customized it to not deploy the in cluster postgresql container, but instead to use environment values for the RDS |
|
I see, can I ask if you had the same issue when running it locally? |
|
sorry did not mean to close it |
|
i have not tried running it locally |
|
Can you try running it locally to verify that it doesn't work there as well? It should also make this debugging process faster so we can see where the issue stems from. |
|
ok let me set up a local db |
|
interesting, it worked locally with same docker image {"level":"info","message":"Task worker starting: KeycloakOrgEntityProvider:default:refresh, {"version":2,"cadence":"PT30M","initialDelayDuration":"PT15S","timeoutAfterDuration":"PT3M"}","plugin":"catalog","service":"backstage","task":"KeycloakOrgEntityProvider:default:refresh"} |
|
hmm that's very weird, if you try to run that image with the helm chart, it doesn't start the keycloak plugin? Can you try redeploying your helm chart with the same image you used locally? |
ya, that's what it seems like... makes no sense lol |
|
docker push backstage:latest |
|
i just repushed the image, it's the same |
|
You changed the image field of the helm chart to refer to your image right? |
yes spec: |
|
i ran locally with docker run -e POSTGRES_HOST=host.docker.internal -e POSTGRES_PORT=5432 -e POSTGRES_DATABASE=backstage -e POSTGRES_USER=postgres -e POSTGRES_PASSWORD="" -e KEYCLOAK_CLIENTSECRET=mysecret -e APP_CONFIG_app_baseUrl=https://backstage-dev -e APP_CONFIG_backend_baseUrl=https://backstage-dev backstage:latest |
|
I don't think image:
registry: <your registry>
repository: <your repository>/backstage
tag: latestCan you perhaps inspect your backstage deployment pods to verify what the image being used is? I suspect it's just using the defaults. |
sorry, i redacted my private repo, but ya, i have the repo in there, it's like repo.com/library/backstage:latest |
|
ya, it's definitely on the server
|
|
Oh wait, can I ask where you're adding your keycloak backend configurations? I was able to "replicate" your logs by deleting my |
|
You would either need to inline your configurations in the appConfig:
catalog:
providers:
keycloakOrg:
default:
baseUrl: http://localhost:8080
realm: backstage
loginRealm: backstage
clientId: backstage
clientSecret: <client-secret>
schedule:
frequency:
minutes: 30
timeout:
minutes: 3
initialDelay:
seconds: 15Alternatively, you can create a extraAppConfig:
- configMapRef: app-config-custom
filename: custom-app-config.yamlThen add the config map with your configurations, change the values to fit your needs kind: ConfigMap
apiVersion: v1
metadata:
name: app-config-custom
data:
custom-app-config.yaml: |
catalog:
providers:
keycloakOrg:
default:
baseUrl: http://localhost:8080
realm: backstage
loginRealm: backstage
clientId: backstage
clientSecret: <client-secret>
schedule:
frequency:
minutes: 30
timeout:
minutes: 3
initialDelay:
seconds: 15 |
|
i'm pretty sure i did all that |
unless this isn't the file that is being used |
|
ah you misconfigured it in your catalog:
import:
entityFilename: catalog-info.yaml
pullRequestBranchName: backstage-integration
keycloakOrg:
default:
baseUrl: https://keycloak-dev/auth
clientId: backstage-confidential
clientSecret: ${KEYCLOAK_CLIENTSECRET}
loginRealm: realm
realm: realm
schedule:
frequency:
minutes: 30
initialDelay:
seconds: 15
timeout:
minutes: 3instead of doing |
|
i just noticed that too, i think it's in my helm somewhere that is missing an indentation lol, thanks! |
|
let me know if it works, if it does I'll close the issue. |
|
it's working, i think we should delete this, user error lol |
|
@Zaperex I got this working but it doesn't seem like the provider can match up an identity with a user in the catalog. I assume it's a resolver issue? I'm using: should I be using something different? the users are imported correctly this is the error i'm getting in the log it looks like it's querying on the keycloak id which is in metadata.annotations.keycloak.org/id, do i need to write a custom resolver for this? |
|
this was the data put into the catalog by your plugin |
|
Hmm that's weird, it seems the issue on your end is that the This may require configuring your keycloak instance or proxy to return the correct |
|
Ya,.I think so too, thanks. I'm using the default oauth2proxy sidecar for backstage as part of their helm chart, I'll see if I can configure that forwarded header |
|
Actually, I think that is correct, the user header is id and there is a preferred-username header that is the username... would it make sense to change your plugin to put the id in the catalog name field? |
|
Or maybe it's a keycloak client config of what to put in the user claim |
|
There is also the option of installing a transformer module to set the name of the entity to the id instead of the username. |
Thanks, is there any documentation on how to build the entity to return? |
|
I'm not sure if i'm doing this right, but i created a custom module for the usertransformer and i'm getting an error I'm assuming the module isn't imported right and i imported it like this |
|
Updating fixed it |
Hi, I add this to my backstage deployment following the directions for adding it to the new backstage backend
I'm still unable to login since it can't find my user identify in the catalog, i'm assuming this plugin automatically syncs, which I don't see happening during start up
Loading config from MergedConfigSource{FileConfigSource{path="/app/app-config-from-configmap.yaml"}, EnvConfigSource{count=4}} 55 {"level":"info","message":"Found 1 new secrets in config that will be redacted","service":"backstage"} 54 {"level":"info","message":"Listening on :7007","service":"rootHttpRouter"} 53 {"level":"info","message":"Plugin initialization started: 'app', 'proxy', 'scaffolder', 'techdocs', 'auth', 'catalog', 'permission', 'search'","service":"backstage","type":"initialization"} 52 {"level":"info","message":"Serving static app content from /app/packages/app/dist","plugin":"app","service":"backstage"} 51 {"level":"info","message":"Starting scaffolder with the following actions enabled fetch:plain, fetch:plain:file, fetch:template, debug:log, debug:wait, catalog:register, catalog:fetch, catalog:write, fs:delete, fs:rename","plugin":"scaffolder","service":"backstage"} 50 {"level":"info","message":"Creating Local publisher for TechDocs","plugin":"techdocs","service":"backstage"} 49 {"level":"info","message":"Configuring \"database\" as KeyStore provider","plugin":"auth","service":"backstage"} 48 {"level":"info","message":"Performing database migration","plugin":"catalog","service":"backstage"} 47 {"level":"info","message":"Configuring auth provider: oauth2Proxy","plugin":"auth","service":"backstage"} 46 {"entry":"main","level":"info","message":"Injecting env config into module-backstage.686b5ec2.js","plugin":"app","service":"backstage"} 45 {"level":"info","message":"Added DefaultCatalogCollatorFactory collator factory for type software-catalog","plugin":"search","service":"backstage"} 44 {"level":"info","message":"Added DefaultTechDocsCollatorFactory collator factory for type techdocs","plugin":"search","service":"backstage"} 43 {"level":"warn","message":"Permission backend started with permissions disabled. Enable permissions by setting permission.enabled=true.","plugin":"permission","service":"backstage"} 42 {"level":"info","message":"Storing 291 updated assets and 0 new assets","plugin":"app","service":"backstage"} 41 {"level":"info","message":"Starting all scheduled search tasks.","plugin":"search","service":"backstage"} 40 {"level":"info","message":"Plugin initialization complete, newly initialized: 'proxy', 'scaffolder', 'techdocs', 'auth', 'catalog', 'search', 'permission', 'app'","service":"backstage","type":"initialization"} 39 {"level":"info","message":"Task worker starting: search_index_software_catalog, {\"version\":2,\"cadence\":\"PT10M\",\"initialDelayDuration\":\"PT3S\",\"timeoutAfterDuration\":\"PT15M\"}","plugin":"search","service":"backstage","task":"search_index_software_catalog"} 38 {"level":"info","message":"Task worker startinThe text was updated successfully, but these errors were encountered: