Gerrit using Keycloak to authentication.

[Thiago Faria Souza]

Hi, I'm beginner in use of Gerrit and Keycloak. I did the follow deployed:
Two VMs, in one, i deployed the docker where I run keycloak.
I used a docker compose file, this it is attached in this post.  
In other VM, I deployed a Gerrit with this command.
"  docker run -ti  --name gerrit -p 8080:8080 -p 8081:8081 -p 29418:29418 -v gerrit-var-etc:/var/gerrit/etc gerritcodereview/gerrit:3.10.0".

I followed this link to do the gerrit deployed for authenticate on keycloak.
https://gerrit.googlesource.com/plugins/saml/+/HEAD/keycloak/README.md
Well, I modified the configuration at the gerrit.config for IPs that the server keycloak.
When I restart the contanner, this don't up. 
But in logs show me many errors. 
I don't understande theys. 

[2024-08-01T17:56:03.419Z] [main] INFO  org.eclipse.jetty.util.log : Logging initialized @10962ms to org.eclipse.jetty.util.log.Slf4jLog
[2024-08-01T17:56:03.656Z] [main] ERROR com.google.gerrit.pgm.Daemon : Unable to start daemon
com.google.inject.CreationException: Unable to create injector, see the following errors:

1) [Guice/ErrorInjectingConstructor]: IllegalArgumentException: Unable to instantiate front-end HTTP Filter SamlWebFilter
  at JettyServer.<init>(JettyServer.java:218)
  at JettyModule.configure(JettyModule.java:31)
  while locating JettyServer

Learn more:
  https://github.com/google/guice/wiki/ERROR_INJECTING_CONSTRUCTOR
Caused by: IllegalArgumentException: Unable to instantiate front-end HTTP Filter SamlWebFilter
        at JettyServer.makeContext(JettyServer.java:562)
        at JettyServer.makeContext(JettyServer.java:504)
        at JettyServer.<init>(JettyServer.java:258)
        at JettyServer$$FastClassByGuice$$42adbd3d.GUICE$TRAMPOLINE(<generated>)
        at JettyServer$$FastClassByGuice$$42adbd3d.apply(<generated>)
        at DefaultConstructionProxyFactory$FastClassProxy.newInstance(DefaultConstructionProxyFactory.java:82)
        at ConstructorInjector.provision(ConstructorInjector.java:114)
        at ConstructorInjector.construct(ConstructorInjector.java:91)
        at ConstructorBindingImpl$Factory.get(ConstructorBindingImpl.java:300)
        at ProviderToInternalFactoryAdapter.get(ProviderToInternalFactoryAdapter.java:40)
        at SingletonScope$1.get(SingletonScope.java:169)
        at InternalFactoryToProviderAdapter.get(InternalFactoryToProviderAdapter.java:45)
        at InternalInjectorCreator.loadEagerSingletons(InternalInjectorCreator.java:213)
        at InternalInjectorCreator.injectDynamically(InternalInjectorCreator.java:186)
        at InternalInjectorCreator.build(InternalInjectorCreator.java:113)
        at InjectorImpl.createChildInjector(InjectorImpl.java:240)
        at Daemon.createHttpdInjector(Daemon.java:684)
        at Daemon.initHttpd(Daemon.java:635)
        at Daemon.start(Daemon.java:404)
        at Daemon.run(Daemon.java:300)
        at AbstractProgram.main(AbstractProgram.java:62)
        at java.base/NativeMethodAccessorImpl.invoke0(Native Method)
        at java.base/NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)
        at java.base/DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.base/Method.invoke(Method.java:568)
        at GerritLauncher.invokeProgram(GerritLauncher.java:251)
        at GerritLauncher.mainImpl(GerritLauncher.java:147)
        at GerritLauncher.main(GerritLauncher.java:92)
        at Main.main(Main.java:30)
Caused by: ConfigurationException: Guice configuration errors:

1) [Guice/MissingImplementation]: No implementation for Set<String> annotated with @AuthHeaders() was bound.

Requested by:
1  : SamlWebFilter.<init>(SamlWebFilter.java:92)
      \_ for 5th parameter authHeaders
     while locating SamlWebFilter

Learn more:
  https://github.com/google/guice/wiki/MISSING_IMPLEMENTATION

1 error

======================
Full classname legend:
======================
AuthHeaders:   "com.googlesource.gerrit.plugins.saml.AuthHeaders"
SamlWebFilter: "com.googlesource.gerrit.plugins.saml.SamlWebFilter"
========================
End of classname legend:
========================

        at InjectorImpl.getProvider(InjectorImpl.java:1174)
        at InjectorImpl.getProvider(InjectorImpl.java:1134)
        at InjectorImpl.getInstance(InjectorImpl.java:1186)
        at JettyServer.makeContext(JettyServer.java:546)
        ... 28 more

2) [Guice/ErrorInjectingConstructor]: IllegalArgumentException: Unable to instantiate front-end HTTP Filter SamlWebFilter
  at JettyServer.<init>(JettyServer.java:218)
  at JettyModule.configure(JettyModule.java:31)
  at JettyMetrics.<init>(JettyMetrics.java:29)
      \_ for 1st parameter jetty
  at JettyModule.configure(JettyModule.java:34)
  while locating JettyMetrics

Learn more:
  https://github.com/google/guice/wiki/ERROR_INJECTING_CONSTRUCTOR
Caused by: IllegalArgumentException: Unable to instantiate front-end HTTP Filter SamlWebFilter
        at JettyServer.makeContext(JettyServer.java:562)
        at JettyServer.makeContext(JettyServer.java:504)
        at JettyServer.<init>(JettyServer.java:258)
        at JettyServer$$FastClassByGuice$$42adbd3d.GUICE$TRAMPOLINE(<generated>)
        at JettyServer$$FastClassByGuice$$42adbd3d.apply(<generated>)
        at DefaultConstructionProxyFactory$FastClassProxy.newInstance(DefaultConstructionProxyFactory.java:82)
        at ConstructorInjector.provision(ConstructorInjector.java:114)
        at ConstructorInjector.construct(ConstructorInjector.java:91)
        at ConstructorBindingImpl$Factory.get(ConstructorBindingImpl.java:300)
        at ProviderToInternalFactoryAdapter.get(ProviderToInternalFactoryAdapter.java:40)
        at SingletonScope$1.get(SingletonScope.java:169)
        at InternalFactoryToProviderAdapter.get(InternalFactoryToProviderAdapter.java:45)
        at SingleParameterInjector.inject(SingleParameterInjector.java:40)
        at SingleParameterInjector.getAll(SingleParameterInjector.java:60)
        at ConstructorInjector.provision(ConstructorInjector.java:113)
        at ConstructorInjector.construct(ConstructorInjector.java:91)
        at ConstructorBindingImpl$Factory.get(ConstructorBindingImpl.java:300)
        at ProviderToInternalFactoryAdapter.get(ProviderToInternalFactoryAdapter.java:40)
        at SingletonScope$1.get(SingletonScope.java:169)
        at InternalFactoryToProviderAdapter.get(InternalFactoryToProviderAdapter.java:45)
        at InternalInjectorCreator.loadEagerSingletons(InternalInjectorCreator.java:213)
        at InternalInjectorCreator.injectDynamically(InternalInjectorCreator.java:186)
        at InternalInjectorCreator.build(InternalInjectorCreator.java:113)
        at InjectorImpl.createChildInjector(InjectorImpl.java:240)
        at Daemon.createHttpdInjector(Daemon.java:684)
        at Daemon.initHttpd(Daemon.java:635)
        at Daemon.start(Daemon.java:404)
        at Daemon.run(Daemon.java:300)
        at AbstractProgram.main(AbstractProgram.java:62)
        at java.base/NativeMethodAccessorImpl.invoke0(Native Method)
        at java.base/NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)
        at java.base/DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.base/Method.invoke(Method.java:568)
        at GerritLauncher.invokeProgram(GerritLauncher.java:251)
        at GerritLauncher.mainImpl(GerritLauncher.java:147)
        at GerritLauncher.main(GerritLauncher.java:92)
        at Main.main(Main.java:30)
Caused by: ConfigurationException: Guice configuration errors:

1) [Guice/MissingImplementation]: No implementation for Set<String> annotated with @AuthHeaders() was bound.

Requested by:
1  : SamlWebFilter.<init>(SamlWebFilter.java:92)
      \_ for 5th parameter authHeaders
     while locating SamlWebFilter

Learn more:
  https://github.com/google/guice/wiki/MISSING_IMPLEMENTATION

1 error

======================
Full classname legend:
======================
AuthHeaders:   "com.googlesource.gerrit.plugins.saml.AuthHeaders"
SamlWebFilter: "com.googlesource.gerrit.plugins.saml.SamlWebFilter"
========================
End of classname legend:
========================

        at InjectorImpl.getProvider(InjectorImpl.java:1174)
        at InjectorImpl.getProvider(InjectorImpl.java:1134)
        at InjectorImpl.getInstance(InjectorImpl.java:1186)
        at JettyServer.makeContext(JettyServer.java:546)
        ... 36 more

2 errors

======================
Full classname legend:
======================
AbstractProgram:                                "com.google.gerrit.pgm.util.AbstractProgram"
ConfigurationException:                         "com.google.inject.ConfigurationException"
ConstructorBindingImpl$Factory:                 "com.google.inject.internal.ConstructorBindingImpl$Factory"
ConstructorInjector:                            "com.google.inject.internal.ConstructorInjector"
Daemon:                                         "com.google.gerrit.pgm.Daemon"
DefaultConstructionProxyFactory$FastClassProxy: "com.google.inject.internal.DefaultConstructionProxyFactory$FastClassProxy"
DelegatingMethodAccessorImpl:                   "jdk.internal.reflect.DelegatingMethodAccessorImpl"
GerritLauncher:                                 "com.google.gerrit.launcher.GerritLauncher"
InjectorImpl:                                   "com.google.inject.internal.InjectorImpl"
InternalFactoryToProviderAdapter:               "com.google.inject.internal.InternalFactoryToProviderAdapter"
InternalInjectorCreator:                        "com.google.inject.internal.InternalInjectorCreator"
JettyMetrics:                                   "com.google.gerrit.pgm.http.jetty.JettyMetrics"
JettyModule:                                    "com.google.gerrit.pgm.http.jetty.JettyModule"
JettyServer:                                    "com.google.gerrit.pgm.http.jetty.JettyServer"
JettyServer$$FastClassByGuice$$42adbd3d:        "com.google.gerrit.pgm.http.jetty.JettyServer$$FastClassByGuice$$42adbd3d"
Method:                                         "java.lang.reflect.Method"
NativeMethodAccessorImpl:                       "jdk.internal.reflect.NativeMethodAccessorImpl"
ProviderToInternalFactoryAdapter:               "com.google.inject.internal.ProviderToInternalFactoryAdapter"
SamlWebFilter:                                  "com.googlesource.gerrit.plugins.saml.SamlWebFilter"
SingleParameterInjector:                        "com.google.inject.internal.SingleParameterInjector"
SingletonScope$1:                               "com.google.inject.internal.SingletonScope$1"
========================
End of classname legend:
========================

        at com.google.inject.internal.Errors.throwCreationExceptionIfErrorsExist(Errors.java:589)
        at com.google.inject.internal.InternalInjectorCreator.injectDynamically(InternalInjectorCreator.java:190)
        at com.google.inject.internal.InternalInjectorCreator.build(InternalInjectorCreator.java:113)
        at com.google.inject.internal.InjectorImpl.createChildInjector(InjectorImpl.java:240)
        at com.google.gerrit.pgm.Daemon.createHttpdInjector(Daemon.java:684)
        at com.google.gerrit.pgm.Daemon.initHttpd(Daemon.java:635)
        at com.google.gerrit.pgm.Daemon.start(Daemon.java:404)
        at com.google.gerrit.pgm.Daemon.run(Daemon.java:300)
        at com.google.gerrit.pgm.util.AbstractProgram.main(AbstractProgram.java:62)
        at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)
        at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.base/java.lang.reflect.Method.invoke(Method.java:568)
        at com.google.gerrit.launcher.GerritLauncher.invokeProgram(GerritLauncher.java:251)
        at com.google.gerrit.launcher.GerritLauncher.mainImpl(GerritLauncher.java:147)
        at com.google.gerrit.launcher.GerritLauncher.main(GerritLauncher.java:92)
        at Main.main(Main.java:30)

Can sameone helpe me for this?
Sorry my english, because it is building. 
 

[Ben Rohlfs]

That is indeed weird. I would expect that this method provides the "Set<String> annotated with @AuthHeaders()": https://cs.opensource.google/gerrit/gerrit/plugins/saml/+/master:src/main/java/com/googlesource/gerrit/plugins/saml/Module.java;l=40;drc=225e59ceeb096d5f335e03217af5925fad07b181

Sasa, do you have an idea as the last one touching that code?

-Ben

--
--
To unsubscribe, email repo-discuss...@googlegroups.com
More info at http://groups.google.com/group/repo-discuss?hl=en

---
You received this message because you are subscribed to the Google Groups "Repo and Gerrit Discussion" group.
To unsubscribe from this group and stop receiving emails from it, send an email to repo-discuss...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/repo-discuss/a1b207d1-0b9b-484c-986b-633a57312064n%40googlegroups.com.

[Thiago Faria Souza]

Hi, Ben. 
Thanks to answer my post.
I can put here my gerrit.config and my keycloak realm modificate that imported, if this help.
Becouse I think that I maked  mistakes at configuration.

I have I ask. 
In this part of the gerrit.config

[auth] 

 type = HTTP 

 logoutUrl = http://localhost:8080/auth/realms/master/protocol/openid-connect/logout 

 httpHeader = X-SAML-UserName 

 httpEmailHeader = X-SAML-EmailHeader 

 httpExternalIdHeader = X-SAML-ExternalId

In the fields, httpHeader, httpEmailHeader and httpExternalIdHeader. Do I need to change these fields to the user jdoe and put the email in httpEmailHeader field?
Becouse I didn't change this part of gerrit.config.  

[Matthias Sohn]

On Fri, Aug 2, 2024 at 2:20 PM Thiago Faria Souza <thiagofaria...@gmail.com> wrote:

Hi, Ben. 
Thanks to answer my post.
I can put here my gerrit.config and my keycloak realm modificate that imported, if this help.
Becouse I think that I maked  mistakes at configuration.

I have I ask. 
In this part of the gerrit.config

[auth] 

 type = HTTP 

 logoutUrl = http://localhost:8080/auth/realms/master/protocol/openid-connect/logout 

 httpHeader = X-SAML-UserName 

 httpEmailHeader = X-SAML-EmailHeader 

 httpExternalIdHeader = X-SAML-ExternalId

the gerrit.config options you posted are unreadable since the text boxes are overlapping each other

 

To view this discussion on the web visit https://groups.google.com/d/msgid/repo-discuss/a48199b8-3519-4bfc-95a8-91333872f8d3n%40googlegroups.com.

[Thiago Faria Souza]

Thank's for warn me Matthias.
Sorry about that. 
I will rewrite it.

[Thiago Faria Souza]

Hi, Ben. 
Thanks to answer my post.
I can put here my gerrit.config and my keycloak realm modificate that imported, if this help.
Becouse I think that I maked  mistakes at configuration.

I have I ask. 
In this part of the gerrit.config

[auth]
    type = HTTP
    logoutUrl = http://localhost:8080/auth/realms/master/protocol/openid-connect/logout
    httpHeader = X-SAML-UserName
    httpEmailHeader = X-SAML-EmailHeader
    httpExternalIdHeader = X-SAML-ExternalId

In the fields, httpHeader, httpEmailHeader and httpExternalIdHeader. Do I need to change these fields to the user jdoe and put the email in httpEmailHeader field?
Becouse I didn't change this part of gerrit.config.  

On Thursday, August 1, 2024 at 5:23:33 PM UTC-3 Ben Rohlfs wrote:

[Thiago Faria Souza]

Well, I will describe the envoriment and put all configuration here, becouse I think that this can help for find the problem. 

In my environment the keycloak have the IP 192.168.1.10, and the gerrit have IP 192.168.1.20.
I import the Realm file that I attachment here. The file name is keycloak-gerrit-export-modificate.json.

In the Gerrit, I installed the plugin saml.jar, I get the it in this link. https://gerrit-ci.gerritforge.com/job/plugin-saml-bazel-stable-3.8/lastSuccessfulBuild/artifact/bazel-bin/plugins/saml/saml.jar
After these process, I inserted the configuration in gerrit.config. The gerrit.config file is attached.

When I restart a Gerrit container, the error the error happens.

[Matthias Sohn]

On Fri, Aug 2, 2024 at 7:42 PM Thiago Faria Souza <thiagofaria...@gmail.com> wrote:

Well, I will describe the envoriment and put all configuration here, becouse I think that this can help for find the problem. 

In my environment the keycloak have the IP 192.168.1.10, and the gerrit have IP 192.168.1.20.
I import the Realm file that I attachment here. The file name is keycloak-gerrit-export-modificate.json.

In the Gerrit, I installed the plugin saml.jar, I get the it in this link. https://gerrit-ci.gerritforge.com/job/plugin-saml-bazel-stable-3.8/lastSuccessfulBuild/artifact/bazel-bin/plugins/saml/saml.jar
After these process, I inserted the configuration in gerrit.config. The gerrit.config file is attached.

When I restart a Gerrit container, the error the error happens.

• Please avoid top posting on this list, we prefer interleaved posting style [1], which simplifies following the conversation.
• Which version of the saml plugin do you use ?
• Did you install it in the $gerrit_site/lib/  folder ?
• You didn't configure gerrit core to install the module as described in [2]
• you have configured http.type twice (DEVELOPMENT_BECOME_ANY_ACCOUNT and HTTP) in gerrit.config, instead it should be set to HTTP, see [3]
  

[1] https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

[2] https://gerrit.googlesource.com/plugins/saml/+/refs/heads/master#configure-gerrit-to-use-the-saml-filter

[3] https://gerrit.googlesource.com/plugins/saml/+/refs/heads/master#configure-http-authentication-for-gerrit

To view this discussion on the web visit https://groups.google.com/d/msgid/repo-discuss/7d6b27df-5eaa-47f1-8483-6b5b3e37f861n%40googlegroups.com.

[Thiago Faria Souza]

Hi Matthias. 

Regarding your questions, here are the answers.

Which version of the saml do you use?[1]

• Which version of the saml plugin do you use ?[1]

• Did you install it in the $gerrit_site/lib/  folder ?
• You didn't configure gerrit core to install the module as described in [2]
• you have configured http.type twice (DEVELOPMENT_BECOME_ANY_ACCOUNT and HTTP) in gerrit.config, instead it should be set to HTTP, see [3]

[1] I use the version 3.8.

[2] Yes, i do.

 

[3]OK. You have right.
In the Gerrit docker container. Where I make this step? 
I try  this step few time ago, but I was lost.

[4] Now, I correct this inssue. 

Thanks for helping me.

[Björn Pedersen]

Thiago Faria Souza schrieb am Montag, 5. August 2024 um 22:44:02 UTC+2:

Hi Matthias. 

Regarding your questions, here are the answers.

Which version of the saml do you use?[1]

• Which version of the saml plugin do you use ?[1]

• Did you install it in the $gerrit_site/lib/  folder ?
• You didn't configure gerrit core to install the module as described in [2]
• you have configured http.type twice (DEVELOPMENT_BECOME_ANY_ACCOUNT and HTTP) in gerrit.config, instead it should be set to HTTP, see [3]

[1] I use the version 3.8.

This won't work with a 3.10 gerrit instance , use the master  version [1]

[1] https://gerrit-ci.gerritforge.com/job/plugin-saml-bazel-master/lastSuccessfulBuild/artifact/bazel-bin/plugins/saml/saml.jar

[Thiago Faria Souza]

Hi Pedersen,
 I maked this steps now, but I keep with the problem.
I changed the file saml.jar version 3.8 to master at the directory "/var/gerrit/lib" [1]
After, as Matthias indicate, I  performed the commands : 

cd /var/gerrit/plugins
rm external_plugin_deps.bzl
ln -s @PLUGIN@/external_plugin_deps.bzl . [2]

And finally, I restarded the gerrit docker containner. [3]

When I checking de logs, show the same error. 

[Thiago Faria Souza]

I Informed the second step  with a mistake. [2]

I performed this way the command:

ln -s saml/external_plugin_deps.bzl .

[Björn Pedersen]

Thiago Faria Souza schrieb am Mittwoch, 7. August 2024 um 20:59:43 UTC+2:

I Informed the second step  with a mistake. [2]

I performed this way the command:

ln -s saml/external_plugin_deps.bzl .

  

The instructions for the .bzl where meant tif you want to build the plugin from the source (see the gerrit developer docs  on how that is done details).

So that does not help with install in docker.

[Thiago Faria Souza]

Hi Pedersen.
I deployed the Gerrit in  a Ubuntu container.
In this, I installed the Gerrit as a standalone.
I deployed all dependencies on VM.
But, the same problem occurs, this I make the saml configuration

[Thiago Faria Souza]

Hi Everyone. 
I managed together with a workmate to solution the question about the plugin. 
It is needed to add this line on gerrit.config[1]

But now, the issue it is the authenticaiton.

For the test, in my house, deploy the  Keycloak and gerrit, same as the environment in the example.[2] i import the realm, 

When i do the aothentication, the redirect is worng.

The gerrit config I maked this way [3]

When I access the gerrit, this screen show for me. [4]

The image Keycloak's Client Saml2Client settings.[5] 

[1] [gerrit]

                 installModule = com.googlesource.gerrit.plugins.saml.Module

[2] https://gerrit.googlesource.com/plugins/saml/+/HEAD/keycloak/README.md

[3] attached gerrit.config

[4]

 

[5]

 
Well, if someone can help me I thank's.

[Thiago Faria Souza]

Hi. 

In configuration at Client SAML2Client on Keycloak be correct?[1]

Becouse, now when I do the login, show me the error.[2]

[1]

 
[2] 

[Thiago Faria Souza]

Hi Everybudy. 

For finish this discussion, I will inform about the solution that  I managed to resolve the issue.

I created a tutorial on GitHub to expleain as I did. 

 https://github.com/ThiagoCits/Gerrit_on_docker_SAML_Kecloak/blob/main/README.md

Thank's the all to answered my questions.