Manage enable OIDC-NG Push

[Domingos Gonçalves]

Hi,

We are trying to put OIDC-NG finally working but we are facing some issues on >Manage to perform the Push to OIDC-NG.

When pressing PUSH on Manage with OIDC-NG Enable we have some errors and the PUSH is not done with success.

The error on OIDC-NG log says "Sessions are not supported by the MongoDB cluster to which this client is connected"

OIDC-NG is connecting to the database with success using its specific user (confirm log-file in attach 03_mongodb_accepting_oidcng_connection.log)

Confirming the collections on MongoDB server created already by OIDC-NG.

[root@db-server ~]# mongo -u oidcngrw -p '<password>' --authenticationDatabase 'oidcng'

MongoDB shell version v3.4.23

connecting to: mongodb://127.0.0.1:27017

MongoDB server version: 3.4.23

> use oidcng

switched to db oidcng

> show collections

access_tokens

authorization_codes

clients

dbchangelog

mongobeelock

refresh_tokens

sequences

sessions

signing_keys

symmetric_keys

users

On Manage the log shows an error "org.springframework.web.client.HttpClientErrorException: 400", more info on log-file in attach 02_manage_error_pressing_push.log 

On OIDC-NG we can find a better message saying "com.mongodb.MongoClientException: Sessions are not supported by the MongoDB cluster to which this client is connected", for more details you can check the log-file in attach: 01_oidcng_error_after_manage_push.log 

I already tested the OIDC-NG to connect to a MongoDB 4.0.x to see if it's the MongoDB client driver, but I'm believe we still have to use the MongoDB 3.x driver version.

The impression I have is the OIDC-NG is not able to insert the data into the database, received from Manage API.

Any suggestion?

If need more info, just ask.

Best regards,

Domingos Gonçalves

[Bart Geesink]

Hi Domingos,

You need at least Mongo 3.6 for session support. In addition, you need to have a replica set. Please
refer to the Mongo documentation on how to configure a replicaset:
https://docs.mongodb.com/manual/administration/replica-set-deployment/

The current OpenConext-deploy Ansible scripts will install a Mongo 4.0 database with replication set
support.

Regards,
Bart

On 12/16/19 4:15 PM, Domingos Gonçalves wrote:
> Hi,
>

> We are trying to put *OIDC-NG* finally working but we are facing some issues on >Manage to perform
> the *Push* to *OIDC-NG*.
>
> When pressing *PUSH* on *Manage* with *OIDC-NG* Enable we have some errors and the PUSH is not done
> with success.
>
> The error on OIDC-NG log says "*Sessions are not supported by the MongoDB cluster to which this
> client is connected*"
>
> *OIDC-NG* is connecting to the database with success using its specific user (confirm log-file in
> attach */03_mongodb_accepting_oidcng_connection.log/*)
>
> Confirming the collections on *MongoDB* server created already by *OIDC-NG*.

>
> |
> [root@db-server ~]# mongo -u oidcngrw -p '<password>' --authenticationDatabase 'oidcng'
> MongoDB shell version v3.4.23
> connecting to: mongodb://127.0.0.1:27017
> MongoDB server version: 3.4.23
>> use oidcng
> switched to db oidcng
>> show collections
> access_tokens
> authorization_codes
> clients
> dbchangelog
> mongobeelock
> refresh_tokens
> sequences
> sessions
> signing_keys
> symmetric_keys
> users
> |
>
>

> On *Manage* the log shows an error "*org.springframework.web.client.HttpClientErrorException: 400*",
> more info on log-file in attach *02_manage_error_pressing_push.log* 
>
> On *OIDC-NG* we can find a better message saying "*com.mongodb.MongoClientException: Sessions are
> not supported by the MongoDB cluster to which this client is connected*", for more details you can
> check the log-file in attach: *01_oidcng_error_after_manage_push.log* 

>
> I already tested the OIDC-NG to connect to a MongoDB 4.0.x to see if it's the MongoDB client driver,
> but I'm believe we still have to use the MongoDB 3.x driver version.
>
> The impression I have is the OIDC-NG is not able to insert the data into the database, received from
> Manage API.
>
> Any suggestion?
>
> If need more info, just ask.
>
> Best regards,
>
> Domingos Gonçalves
>

> --
> OpenConext - Open For Collaboration
> ---
> You received this message because you are subscribed to the Google Groups "OpenConext Community" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to
> openconext+...@googlegroups.com <mailto:openconext+...@googlegroups.com>.
> To view this discussion on the web visit
> https://groups.google.com/d/msgid/openconext/5f04f4b0-6652-41a0-a3eb-322ae35e8cf6%40googlegroups.com
> <https://groups.google.com/d/msgid/openconext/5f04f4b0-6652-41a0-a3eb-322ae35e8cf6%40googlegroups.com?utm_medium=email&utm_source=footer>.

[Domingos Gonçalves]

Hello,

The MongoDB was configured to be on a ReplicationSet on DEV and QUA and updated the Mongo from 3.4 to 3.6 and finally to 4.0.14. I presume it's not compatible to the last MongoDB 4.3 version, am I right (https://groups.google.com/d/msg/openconext/BISGVeNlra8/b00Mz-IvAQAJ)?

At the end the PUSH on Manage works fine.

On Mongo collection we have the clients being filled:

rsRCTSaai-dev:PRIMARY> use oidcng
switched to db oidcng

rsRCTSaai-dev:PRIMARY> show collections

access_tokens
authorization_codes
clients
dbchangelog
mongobeelock
refresh_tokens
sequences
sessions
signing_keys
symmetric_keys
users

rsRCTSaai-dev:PRIMARY> db.clients.find()
{ "_id" : ObjectId("5dfa721eee69403d053c9904"), "clientId" : "oidc-playground", "name" : "https@//oidc-playground dev rctsaai.pt",... ,..., "accessTokenValidity" : 3600, "refreshTokenValidity" : 3600, "includeUnspecifiedNameID" : true, "_class" : "oidc.model.OpenIDClient" }
{ "_id" : ObjectId("5dfa721eee69403d053c9905"), "clientId" : "stats", "name" : "https@//stats dev rctsaai.pt", ..., ..., "accessTokenValidity" : 3600, "refreshTokenValidity" : 3600, "includeUnspecifiedNameID" : true, "_class" : "oidc.model.OpenIDClient" }

I believe we have Manage and OIDC-NG working fine between them. 

Now we want to put oidc-playground working but we still have some issues. We are still analyzing what's wrong.

Best regards,

> openc...@googlegroups.com <mailto:openconext+unsub...@googlegroups.com>.