failure adding user in ldap when domain requires custom user_object_classes about ipa-tuura

[spoore1]

Attaching log from ipa-tuura here:

kc_user_not_added_to_ldap.log

[spoore1]

I will also note that if I do not use custom User Object Classes, the user is added to LDAP but, SSSD on the ipa-tuura system cannot resolve the user info because it does not contain the posixAccount object class.

[antoniotorresm]

Looks like ipa-tuura expects a list of objectclasses instead of a single string: https://github.com/freeipa/ipa-tuura/blob/main/src/ipa-tuura/domains/models.py#L82

We need to add further processing for it.

[justin-stephenson]

Looks like ipa-tuura expects a list of objectclasses instead of a single string: https://github.com/freeipa/ipa-tuura/blob/main/src/ipa-tuura/domains/models.py#L82

We need to add further processing for it.

Hi Antonio,

The Keycloak plugin was sending this data as a list originally, but it wasn't working so Scott and I thought to try sending it as a single string.

In that case Scott can you provide the logs/failure of the original issue with the user object classes sent as a list of strings/

[spoore1]

IIRC I never got good debug output from ipa-tuura that showed what we were looking for.

On the Keycloak side though, using the original version of the plugin, I see this:

Sep 28 15:30:00 keycloak.ipa.test kc.sh[45495]: 2023-09-28 15:30:00,882 INFO  [keycloak.scim_user_spi.Scim] (executor-thread-9) Sending GET request to http://bridge.ipa.test:8000/scim/v2/
Sep 28 15:30:00 keycloak.ipa.test kc.sh[45495]: 2023-09-28 15:30:00,929 INFO  [keycloak.scim_user_spi.Scim] (executor-thread-9) Sending DELETE request to http://bridge.ipa.test:8000/domains/v1/domain/1/
Sep 28 15:30:00 keycloak.ipa.test kc.sh[45495]: 2023-09-28 15:30:00,975 INFO  [keycloak.scim_user_spi.Scim] (executor-thread-9) Result is {"detail":"CSRF Failed: CSRF token missing."}
Sep 28 15:30:00 keycloak.ipa.test kc.sh[45495]: 2023-09-28 15:30:00,975 INFO  [keycloak.scim_user_spi.SCIMUserStorageProviderFactory] (executor-thread-9) Delete intgDomains Result is true
Sep 28 15:30:00 keycloak.ipa.test kc.sh[45495]: 2023-09-28 15:30:00,975 INFO  [keycloak.scim_user_spi.Scim] (executor-thread-9) Sending POST request to http://bridge.ipa.test:8000/domains/v1/domain/
Sep 28 15:30:01 keycloak.ipa.test kc.sh[45495]: 2023-09-28 15:30:01,020 INFO  [keycloak.scim_user_spi.Scim] (executor-thread-9) Result is {"user_object_classes":["Not a valid string."]}
Sep 28 15:30:01 keycloak.ipa.test kc.sh[45495]: 2023-09-28 15:30:01,021 INFO  [keycloak.scim_user_spi.SCIMUserStorageProviderFactory] (executor-thread-9) Add intgDomains Result is true

@antoniotorresm How can I enable debug logging on the ipa-tuura side to get more useful info?

[antoniotorresm]

Assuming you're using the ipa-tuura container, you can login into it:

podman exec -it bridge bash

and then get the service logs with systemctl status bridge-devel.

[spoore1]

I'm running quay.io/ftrivino/bridge-fedora-devel but, I don't see a bridge-devel service. I only see bridge:

● bridge.service - SCIMv2 Bridge Server
     Loaded: loaded (/etc/systemd/system/bridge.service; enabled; preset: disabled)
    Drop-In: /usr/lib/systemd/system/service.d
             └─10-timeout-abort.conf
     Active: active (running) since Fri 2023-09-29 00:09:41 CEST; 14h ago
   Main PID: 89 (python3)
      Tasks: 4 (limit: 307)
     Memory: 140.3M
        CPU: 14min 5.498s
     CGroup: /system.slice/bridge.service
             ├─ 89 /usr/bin/python3 /www/ipa-tuura/src/ipa-tuura/manage.py runserver 0.0.0.0:8000
             └─122 /usr/bin/python3 /www/ipa-tuura/src/ipa-tuura/manage.py runserver 0.0.0.0:8000

Sep 29 14:54:55 bridge.ipa.test python3[122]: GET
Sep 29 14:54:55 bridge.ipa.test python3[122]: BODY
Sep 29 14:54:55 bridge.ipa.test python3[122]: STATUS_CODE
Sep 29 14:54:55 bridge.ipa.test python3[122]: 501
Sep 29 14:54:55 bridge.ipa.test python3[122]: Not Implemented: /scim/v2/
Sep 29 14:54:55 bridge.ipa.test python3[122]: "GET /scim/v2/ HTTP/1.1" 501 0
Sep 29 14:54:55 bridge.ipa.test python3[122]: Forbidden: /domains/v1/domain/1/
Sep 29 14:54:55 bridge.ipa.test python3[122]: "DELETE /domains/v1/domain/1/ HTTP/1.1" 403 45
Sep 29 14:54:55 bridge.ipa.test python3[122]: Bad Request: /domains/v1/domain/
Sep 29 14:54:55 bridge.ipa.test python3[122]: "POST /domains/v1/domain/ HTTP/1.1" 400 47

Should I be using a different container now?