Unable to call nuxeo rest api from rest client when integrated with Keycloak authentication plugin

Ravindra_Nalavd — Fri, 14 Jun 2019 10:36:09 GMT

I wanted to integrate keycloak as authentication plugin for nuxeo platform both running on my local machine

Set up details

Nuxeo platform version: 10.10 (runs on tomcat 9)
/> Keycloak version: 6.0.1
/> keycloak tomcat adapter distribution: keycloak-tomcat8-adapter-dist

I followed the steps mentioned in link

Here, I built the nuxeo-platform-login-keycloak plugin for keycloak 6.0.1 version. On keycloak, I set up a auth client under newly created realm 'demo'

Client details available in client configuration

I created role as 'Members' and added admin role to it I created a user 'keycloakuser' and added to 'Members'.

When nuxeo ui is hit from browser, the authentication flow works fine. It redirects me to login page of keycloak, on valid credentials, it redirects me to nuxeo ui. The user created along with 'Members' group assigned to it.

Error Scenario

To call rest api from postman, I configured Oauth2 for authentication.

Auth url: http://localhost:8080/auth/realms/demo/protocol/openid-connect/auth

Token Url: http://localhost:8080/auth/realms/demo/protocol/openid-connect/token

Client: testclient

Client secret: *****

Scope: openid

I used access_token obtained using Oauth2 flow, to make API call as http://localhost:8190/nuxeo/api/v1/id/document_id. It is failing with

java.lang.ClassCastException: class org.apache.catalina.core.ApplicationHttpRequest cannot be cast to class org.apache.catalina.connector.RequestFacade (org.apache.catalina.core.ApplicationHttpRequest and org.apache.catalina.connector.RequestFacade are in unnamed module of loader java.net.URLClassLoader @39aeed2f)
    at org.nuxeo.ecm.platform.ui.web.keycloak.DeploymentResult.invokeOn(DeploymentResult.java:79) [nuxeo-platform-login-keycloak-10.10.jar:?]
    at org.nuxeo.ecm.platform.ui.web.keycloak.KeycloakAuthenticatorProvider.provide(KeycloakAuthenticatorProvider.java:56) [nuxeo-platform-login-keycloak-10.10.jar:?]
    at org.nuxeo.ecm.platform.ui.web.keycloak.KeycloakAuthenticationPlugin.handleRetrieveIdentity(KeycloakAuthenticationPlugin.java:113) [nuxeo-platform-login-keycloak-10.10.jar:?]
    at org.nuxeo.ecm.platform.ui.web.auth.NuxeoAuthenticationFilter.handleRetrieveIdentity(NuxeoAuthenticationFilter.java:1137) [nuxeo-platform-web-common-10.10.jar:?]
    at org.nuxeo.ecm.platform.ui.web.auth.NuxeoAuthenticationFilter.doFilterInternal(NuxeoAuthenticationFilter.java:548) [nuxeo-platform-web-common-10.10.jar:?]

Observation:

The API request call is not hitting the keycloak endpoint
I tried to print the reqqest type (actually the request wrapper type) in both scenarios. For browser request, it was org.apache.catalina.connector.RequestFacade and for api request it was org.apache.catalina.core.ApplicationHttpRequest which is not extending org.apache.catalina.connector.RequestFacade

Questions:

Does above behavior (mentioend in point 2) differ in tomcat versions earlier to tomcat 9?
Is the problem with compatibility issues with tomcat version and keycloak adapters jar version?

(crossposted on StackOverflow)

Re: Unable to call nuxeo rest api from rest client when integrated with Keycloak authentication plugin

Florent_Guillau — Mon, 17 Jun 2019 12:36:21 GMT

Are you building the 10.10 branch of nuxeo-platform-login-keycloak (which is needed because you're using Nuxeo 10.10) ?

Re: Unable to call nuxeo rest api from rest client when integrated with Keycloak authentication plugin

Ravindra_Nalavd — Tue, 18 Jun 2019 09:05:14 GMT

[Florent Guillaume](https

Re: Unable to call nuxeo rest api from rest client when integrated with Keycloak authentication plugin

Ravindra_Nalavd — Tue, 18 Jun 2019 12:29:23 GMT

the keycloak-tomcat8-adapter-dist is for tomcat 8. Will this work for tomcat 9 as well? As the distribution files are not available for tomcat 9

topic Re: Unable to call nuxeo rest api from rest client when integrated with Keycloak authentication plugin in Nuxeo Forum

Unable to call nuxeo rest api from rest client when integrated with Keycloak authentication plugin

Re: Unable to call nuxeo rest api from rest client when integrated with Keycloak authentication plugin

Re: Unable to call nuxeo rest api from rest client when integrated with Keycloak authentication plugin

Re: Unable to call nuxeo rest api from rest client when integrated with Keycloak authentication plugin