{"action":"created","issue":{"url":"https://api.github.com/repos/daggerhart/openid-connect-generic/issues/53","repository_url":"https://api.github.com/repos/daggerhart/openid-connect-generic","labels_url":"https://api.github.com/repos/daggerhart/openid-connect-generic/issues/53/labels{/name}","comments_url":"https://api.github.com/repos/daggerhart/openid-connect-generic/issues/53/comments","events_url":"https://api.github.com/repos/daggerhart/openid-connect-generic/issues/53/events","html_url":"https://github.com/daggerhart/openid-connect-generic/issues/53","id":283889838,"number":53,"title":"Using with Keycloak: Config problems (missing documentation)","user":{"login":"ThomasWilhelmUR","id":10849623,"avatar_url":"https://avatars1.githubusercontent.com/u/10849623?v=4","gravatar_id":"","url":"https://api.github.com/users/ThomasWilhelmUR","html_url":"https://github.com/ThomasWilhelmUR","followers_url":"https://api.github.com/users/ThomasWilhelmUR/followers","following_url":"https://api.github.com/users/ThomasWilhelmUR/following{/other_user}","gists_url":"https://api.github.com/users/ThomasWilhelmUR/gists{/gist_id}","starred_url":"https://api.github.com/users/ThomasWilhelmUR/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ThomasWilhelmUR/subscriptions","organizations_url":"https://api.github.com/users/ThomasWilhelmUR/orgs","repos_url":"https://api.github.com/users/ThomasWilhelmUR/repos","events_url":"https://api.github.com/users/ThomasWilhelmUR/events{/privacy}","received_events_url":"https://api.github.com/users/ThomasWilhelmUR/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":5,"created_at":"2017-12-21T13:57:22Z","updated_at":"2017-12-21T16:31:29Z","closed_at":null,"author_association":"NONE","body":"This is probably not a bug but a config issue:\r\n\r\nI am trying to use Keycloak 3.4.1.Final as the IdP. In order to try it out I fired up a fresh wordpress install in docker and added a realm + client to the Keycloak installation. I used different ressources that I could find on this plugin to configure the client. \r\n\r\nIn order to reproduce use the provided setup and config. Go to the wordpress installation and create an accound / log in via the Keycloak interfce (redirects work). \r\n\r\nHere is a part of the config for the Keycloak realm:\r\n```\r\nname: wp-test-realm\r\nenabled: on\r\nuser registration: on\r\nemail as username: on\r\nedit username: off\r\nforgot password: on\r\nremember me: on\r\nverify email: off\r\nlogin with email: on\r\n```\r\n\r\nSome data for the Keycloak client config:\r\n```\r\nclient id: my-wordpress-client-id\r\nName: WP Client\r\nEnabled: on\r\n*Consent Required: off\r\nClient Protocol: openid-connect\r\nClient Template: -\r\nAccess Type: confidental\r\nStandard Flow Enabled: on\r\nImplicit Flow Enabled: off\r\nDirect Access Grants Enabled: off\r\nService Accounts Enabled: off\r\nAuthorization Enabled: off\r\nRoot URL: http.//localhost:8080/\r\nValid Redirect URIs: http://localhost:8080/*/*, http://localhost:8080/wp-admin/admin-ajax.php?action=openid-connect-authorize\r\nBase URL:\r\nAdmin URL:\r\nWeb Origins: http://localhost:8080/*\r\n*User Info Signed Response Algorithm: RS256\r\n*Request Object Signature Algorithm: RS256\r\n\r\n...\r\nClient Authenticator: Cliend Id and Secret\r\nSecret: ***\r\n\r\n...\r\nMappers:\r\nClient ID\r\nemail\r\nusername\r\nClient Host\r\nClient IP Address\r\nfamily name\r\nfull name\r\ngiven name\r\n\r\nScope:\r\ntested with Full Scope Allowed: on/off\r\nfor off the roles are (copied from Wordpress):\r\nadministrator\r\nauthor\r\ncontributor\r\neditor\r\nsubscriber \r\n\r\n```\r\n* here I tested the different possible values to no avail\r\n\r\nThis is the plugin config:\r\n```\r\nLogin Type: OpenID Connect Button \r\nClient ID: my-wordpress-client-id\r\nClient Secret Key: ***\r\nOpenID Scope: email preferred_username family_name given_name (had the scopes here too... no avail)\r\nLogin Endpoint URL: http://localhost:8089/auth/realms/wp-test-realm/protocol/openid-connect/auth\r\nUserinfo Endpoint URL: http://localhost:8089/auth/realms/wp-test-realm/protocol/openid-connect/userinfo\r\nToken Validation Endpoint URL: http://localhost:8089/auth/realms/wp-test-realm/protocol/openid-connect/token\r\nEnd Session Endpoint URL: http://localhost:8089/auth/realms/wp-test-realm/protocol/openid-connect/logout\r\nIdentity Key: preferred_username (tried \"sub\" too)\r\nDisable SSL Verify: yes\r\nNickname Key: preferred_username (tried \"sub\" too)\r\nEmail Formatting: {email}\r\nDisplay Name Formatting:{preferred_username}\r\nIdentify with User Name: no\r\nLink Existing Users: no\r\nRedirect Back to Origin Page: yes\r\nRedirect to the login screen session is expired: yes\r\nEnforce Privacy: yes (easier for testing)\r\nAlternate Redirect URI: no\r\nEnable Logging: yes\r\n```\r\nThe values for the endpoints can be found in the .well-known openid configuration of Keycloak, e.g.:\r\nhttp://localhost:8089/auth/realms/wp-test-realm/.well-known/openid-configuration \r\n\r\nThis is the error I keep getting:\r\n```\r\nobject(WP_Error)#7608 (2) {\r\n  [\"errors\"]=>\r\n  array(2) {\r\n    [\"http_request_failed\"]=>\r\n    array(1) {\r\n      [0]=>\r\n      string(74) \"cURL error 7: Failed to connect to localhost port 8089: Connection refused\"\r\n    }\r\n    [\"request_authentication_token\"]=>\r\n    array(1) {\r\n      [0]=>\r\n      string(40) \"Request for authentication token failed.\"\r\n    }\r\n  }\r\n  [\"error_data\"]=>\r\n  array(0) {\r\n  }\r\n}\r\n```\r\n\r\n```\r\nType: http_request_failed\r\nUser: 0\r\nURI: /wp-admin/admin-ajax.php?action=openid-connect-authorize&state=cdc3ca663b15e5838de9de0fdf415c5f&code=eyJhbGciOiJkaXIiLCJlbmMiOiJBMTI4Q0JDLUhTMjU2In0..-ME_w8mcBwpNSRDGY7e-5A.dmPn8pzuUJ5udHXZUfGJITpPv3K9uotf1Ti38W7UZMMIu26aRJT7FLtgK6zvRFhhC-lNl52a02OYnmYLnmCDZJBl8xaH884eiJUzogHPPt_oWNwa4YRGPQrwnrNeBBly0xwAk7MKU0lMim-9lLCTE9sA8H_jdcikcQR46FX9-SfHnZD_hHIYuLuH110te3JH1NZxi_6Dlv-kVYdtowd1KPSd69BkHxanrV_BF5MK-cVN5C60p3T6y3zEU_y7BYLq.EFmOpr5-9Taq5oI4N4NdOA\r\n```\r\n\r\nAre there experiences in setting up Keycloak with this plugin? Can anyone point to the (maybe even obvious) config problems? Will provide short docs, if successful.\r\n\r\nThanks in advance and happy holidays. "},"comment":{"url":"https://api.github.com/repos/daggerhart/openid-connect-generic/issues/comments/353395436","html_url":"https://github.com/daggerhart/openid-connect-generic/issues/53#issuecomment-353395436","issue_url":"https://api.github.com/repos/daggerhart/openid-connect-generic/issues/53","id":353395436,"user":{"login":"ThomasWilhelmUR","id":10849623,"avatar_url":"https://avatars1.githubusercontent.com/u/10849623?v=4","gravatar_id":"","url":"https://api.github.com/users/ThomasWilhelmUR","html_url":"https://github.com/ThomasWilhelmUR","followers_url":"https://api.github.com/users/ThomasWilhelmUR/followers","following_url":"https://api.github.com/users/ThomasWilhelmUR/following{/other_user}","gists_url":"https://api.github.com/users/ThomasWilhelmUR/gists{/gist_id}","starred_url":"https://api.github.com/users/ThomasWilhelmUR/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ThomasWilhelmUR/subscriptions","organizations_url":"https://api.github.com/users/ThomasWilhelmUR/orgs","repos_url":"https://api.github.com/users/ThomasWilhelmUR/repos","events_url":"https://api.github.com/users/ThomasWilhelmUR/events{/privacy}","received_events_url":"https://api.github.com/users/ThomasWilhelmUR/received_events","type":"User","site_admin":false},"created_at":"2017-12-21T16:31:29Z","updated_at":"2017-12-21T16:31:29Z","author_association":"NONE","body":"It's the other way round: internal 80 is mapped to the hosts (localhost) port 8080. I can reach Keycloak and Wordpress just fine using 8089 and 8080 respectively. \r\n\r\nIt seems like the wordpress plugin cannot reach Keycloak. It's not the client config, keys or anything within the plugin it seems. Will work on the docker part / try it using a different setup. Will get back to you, thanks for all the help."}}
{"actor":{"display_login":"ThomasWilhelmUR"}}