Netbird doesn&#39;t work with Keycloak with LDAPS for Account Delegation #1024

@bcmmbaga commented on GitHub (Jun 27, 2024):

Hello @bcmmbaga, here are the logs.

management-1 | 2024-06-27T14:34:55Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: Post "https://sso.example.com/realms/netbird/protocol/openid-connect/token": context deadline exceeded (Client.Timeout exceeded while awaiting headers) management-1 | 2024-06-27T14:34:55Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-06-27T14:34:55Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 1008626266: GET /api/users status 401 management-1 | 2024-06-27T14:35:05Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: Post "https://sso.example.com/realms/netbird/protocol/openid-connect/token": context deadline exceeded (Client.Timeout exceeded while awaiting headers) management-1 | 2024-06-27T14:35:05Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-06-27T14:35:05Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 3682479814: GET /api/users status 401 management-1 | 2024-06-27T14:35:15Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: Post "https://sso.example.com/realms/netbird/protocol/openid-connect/token": context deadline exceeded (Client.Timeout exceeded while awaiting headers) management-1 | 2024-06-27T14:35:15Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-06-27T14:35:15Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 2881042402: GET /api/users status 401

There are missing initial logs when starting the management. Can you restart the management, and then share the logs afterwards?

@bcmmbaga commented on GitHub (Jun 27, 2024): > Hello @bcmmbaga, here are the logs. > > `management-1 | 2024-06-27T14:34:55Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: Post "https://sso.example.com/realms/netbird/protocol/openid-connect/token": context deadline exceeded (Client.Timeout exceeded while awaiting headers) management-1 | 2024-06-27T14:34:55Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-06-27T14:34:55Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 1008626266: GET /api/users status 401 management-1 | 2024-06-27T14:35:05Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: Post "https://sso.example.com/realms/netbird/protocol/openid-connect/token": context deadline exceeded (Client.Timeout exceeded while awaiting headers) management-1 | 2024-06-27T14:35:05Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-06-27T14:35:05Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 3682479814: GET /api/users status 401 management-1 | 2024-06-27T14:35:15Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: Post "https://sso.example.com/realms/netbird/protocol/openid-connect/token": context deadline exceeded (Client.Timeout exceeded while awaiting headers) management-1 | 2024-06-27T14:35:15Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-06-27T14:35:15Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 2881042402: GET /api/users status 401` There are missing initial logs when starting the management. Can you restart the management, and then share the logs afterwards?

saavagebueno commented

@michelangelo136 commented on GitHub (Jun 28, 2024):

I restarted the management service, these is the log, the fqdn and the realm have been redacted replaced by redacted.

management-1 | 2024-06-28T12:13:23Z INFO management/cmd/management.go:455: loading OIDC configuration from the provided IDP configuration endpoint https://sso.example.com/realms/example/.well-known/openid-configuration management-1 | 2024-06-28T12:13:23Z INFO management/cmd/management.go:460: loaded OIDC configuration from the provided IDP configuration endpoint: https://sso.example.com/realms/example/.well-known/openid-configuration management-1 | 2024-06-28T12:13:23Z INFO management/cmd/management.go:462: overriding HttpConfig.AuthIssuer with a new value https://sso.example.com/realms/example, previously configured value: https://sso.example.com/realms/example management-1 | 2024-06-28T12:13:23Z INFO management/cmd/management.go:466: overriding HttpConfig.AuthKeysLocation (JWT certs) with a new value https://sso.example.com/realms/example/protocol/openid-connect/certs, previously configured value: https://sso.example.com/realms/example/protocol/openid-connect/certs management-1 | 2024-06-28T12:13:23Z INFO management/cmd/management.go:492: overriding PKCEAuthorizationFlow.TokenEndpoint with a new value: https://sso.example.com/realms/example/protocol/openid-connect/token, previously configured value: https://sso.example.com/realms/example/protocol/openid-connect/token management-1 | 2024-06-28T12:13:23Z INFO management/cmd/management.go:495: overriding PKCEAuthorizationFlow.AuthorizationEndpoint with a new value: https://sso.example.com/realms/example/protocol/openid-connect/auth, previously configured value: https://sso.example.com/realms/example/protocol/openid-connect/auth management-1 | 2024-06-28T12:13:23Z INFO management/server/telemetry/app_metrics.go:177: enabled application metrics and exposing on http://0.0.0.0:8081 management-1 | 2024-06-28T12:13:23Z INFO management/server/store.go:128: using SQLite store engine management-1 | 2024-06-28T12:13:23Z INFO management/server/migration/migration.go:130: No records in table peers, no migration needed management-1 | 2024-06-28T12:13:23Z INFO management/server/migration/migration.go:130: No records in table peers, no migration needed management-1 | 2024-06-28T12:13:23Z INFO management/cmd/management.go:173: geo location service has been initialized from /var/lib/netbird/ management-1 | 2024-06-28T12:13:23Z INFO management/server/account.go:902: single account mode enabled, accounts number 1 management-1 | 2024-06-28T12:13:23Z INFO management/cmd/management.go:292: running gRPC backward compatibility server: [::]:33073 management-1 | 2024-06-28T12:13:23Z INFO management/cmd/management.go:324: management server version 0.28.3 management-1 | 2024-06-28T12:13:23Z INFO management/cmd/management.go:325: running HTTP server and gRPC server on the same port: [::]:443 management-1 | 2024-06-28T12:13:33Z WARN management/server/account.go:942: failed warming up cache due to error: context deadline exceeded (Client.Timeout or context cancellation while reading body) management-1 | 2024-06-28T12:13:34Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: unexpected EOF management-1 | 2024-06-28T12:13:34Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-06-28T12:13:34Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 2969496814: GET /api/users status 401 management-1 | 2024-06-28T12:13:44Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: context deadline exceeded (Client.Timeout or context cancellation while reading body) management-1 | 2024-06-28T12:13:44Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-06-28T12:13:44Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 1617532156: GET /api/groups status 401 management-1 | 2024-06-28T12:13:45Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: Get "https://sso-admin.example.com:443/admin/realms/example/users?max=162": unexpected EOF management-1 | 2024-06-28T12:13:45Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-06-28T12:13:45Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 994037172: GET /api/peers status 401 management-1 | 2024-06-28T12:13:55Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: context deadline exceeded (Client.Timeout or context cancellation while reading body) management-1 | 2024-06-28T12:13:55Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-06-28T12:13:55Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 1110047656: GET /api/users status 401 management-1 | 2024-06-28T12:14:20Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: context deadline exceeded (Client.Timeout or context cancellation while reading body) management-1 | 2024-06-28T12:14:20Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-06-28T12:14:20Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 1610098238: GET /api/users status 401 management-1 | 2024-06-28T12:14:31Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: context deadline exceeded (Client.Timeout or context cancellation while reading body) management-1 | 2024-06-28T12:14:31Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-06-28T12:14:31Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 1748801382: GET /api/users status 401 management-1 | 2024-06-28T12:14:41Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: context deadline exceeded (Client.Timeout or context cancellation while reading body) management-1 | 2024-06-28T12:14:41Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-06-28T12:14:41Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 884359798: GET /api/users status 401 management-1 | 2024-06-28T12:14:52Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: context deadline exceeded (Client.Timeout or context cancellation while reading body) management-1 | 2024-06-28T12:14:52Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-06-28T12:14:52Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 1147169547: GET /api/users status 401 management-1 | 2024-06-28T12:15:08Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: context deadline exceeded (Client.Timeout or context cancellation while reading body) management-1 | 2024-06-28T12:15:08Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-06-28T12:15:08Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 2964505694: GET /api/users status 401 management-1 | 2024-06-28T12:15:18Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: context deadline exceeded (Client.Timeout or context cancellation while reading body) management-1 | 2024-06-28T12:15:18Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-06-28T12:15:18Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 2747264743: GET /api/users status 401 management-1 | 2024-06-28T12:15:19Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: Get "https://sso-admin.example.com:443/admin/realms/example/users/count?": unexpected EOF management-1 | 2024-06-28T12:15:19Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-06-28T12:15:19Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 3841999307: GET /api/users status 401 management-1 | 2024-06-28T12:15:30Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: context deadline exceeded (Client.Timeout or context cancellation while reading body) management-1 | 2024-06-28T12:15:30Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-06-28T12:15:30Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 3284690800: GET /api/users status 401 management-1 | 2024-06-28T12:15:31Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: Get "https://sso-admin.example.com:443/admin/realms/example/users?max=162": unexpected EOF management-1 | 2024-06-28T12:15:31Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-06-28T12:15:31Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 620562561: GET /api/users status 401 management-1 | 2024-06-28T12:15:42Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: context deadline exceeded (Client.Timeout or context cancellation while reading body) management-1 | 2024-06-28T12:15:42Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-06-28T12:15:42Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 3594267140: GET /api/users status 401 management-1 | 2024-06-28T12:15:53Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: context deadline exceeded (Client.Timeout or context cancellation while reading body) management-1 | 2024-06-28T12:16:04Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: context deadline exceeded (Client.Timeout or context cancellation while reading body) management-1 | 2024-06-28T12:16:04Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-06-28T12:16:04Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 1882557009: GET /api/users status 401 management-1 | 2024-06-28T12:16:19Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: context deadline exceeded (Client.Timeout or context cancellation while reading body) management-1 | 2024-06-28T12:16:19Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-06-28T12:16:19Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 701924560: GET /api/users status 401

@michelangelo136 commented on GitHub (Jun 28, 2024): I restarted the management service, these is the log, the fqdn and the realm have been redacted replaced by redacted. `management-1 | 2024-06-28T12:13:23Z INFO management/cmd/management.go:455: loading OIDC configuration from the provided IDP configuration endpoint https://sso.example.com/realms/example/.well-known/openid-configuration management-1 | 2024-06-28T12:13:23Z INFO management/cmd/management.go:460: loaded OIDC configuration from the provided IDP configuration endpoint: https://sso.example.com/realms/example/.well-known/openid-configuration management-1 | 2024-06-28T12:13:23Z INFO management/cmd/management.go:462: overriding HttpConfig.AuthIssuer with a new value https://sso.example.com/realms/example, previously configured value: https://sso.example.com/realms/example management-1 | 2024-06-28T12:13:23Z INFO management/cmd/management.go:466: overriding HttpConfig.AuthKeysLocation (JWT certs) with a new value https://sso.example.com/realms/example/protocol/openid-connect/certs, previously configured value: https://sso.example.com/realms/example/protocol/openid-connect/certs management-1 | 2024-06-28T12:13:23Z INFO management/cmd/management.go:492: overriding PKCEAuthorizationFlow.TokenEndpoint with a new value: https://sso.example.com/realms/example/protocol/openid-connect/token, previously configured value: https://sso.example.com/realms/example/protocol/openid-connect/token management-1 | 2024-06-28T12:13:23Z INFO management/cmd/management.go:495: overriding PKCEAuthorizationFlow.AuthorizationEndpoint with a new value: https://sso.example.com/realms/example/protocol/openid-connect/auth, previously configured value: https://sso.example.com/realms/example/protocol/openid-connect/auth management-1 | 2024-06-28T12:13:23Z INFO management/server/telemetry/app_metrics.go:177: enabled application metrics and exposing on http://0.0.0.0:8081 management-1 | 2024-06-28T12:13:23Z INFO management/server/store.go:128: using SQLite store engine management-1 | 2024-06-28T12:13:23Z INFO management/server/migration/migration.go:130: No records in table peers, no migration needed management-1 | 2024-06-28T12:13:23Z INFO management/server/migration/migration.go:130: No records in table peers, no migration needed management-1 | 2024-06-28T12:13:23Z INFO management/cmd/management.go:173: geo location service has been initialized from /var/lib/netbird/ management-1 | 2024-06-28T12:13:23Z INFO management/server/account.go:902: single account mode enabled, accounts number 1 management-1 | 2024-06-28T12:13:23Z INFO management/cmd/management.go:292: running gRPC backward compatibility server: [::]:33073 management-1 | 2024-06-28T12:13:23Z INFO management/cmd/management.go:324: management server version 0.28.3 management-1 | 2024-06-28T12:13:23Z INFO management/cmd/management.go:325: running HTTP server and gRPC server on the same port: [::]:443 management-1 | 2024-06-28T12:13:33Z WARN management/server/account.go:942: failed warming up cache due to error: context deadline exceeded (Client.Timeout or context cancellation while reading body) management-1 | 2024-06-28T12:13:34Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: unexpected EOF management-1 | 2024-06-28T12:13:34Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-06-28T12:13:34Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 2969496814: GET /api/users status 401 management-1 | 2024-06-28T12:13:44Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: context deadline exceeded (Client.Timeout or context cancellation while reading body) management-1 | 2024-06-28T12:13:44Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-06-28T12:13:44Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 1617532156: GET /api/groups status 401 management-1 | 2024-06-28T12:13:45Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: Get "https://sso-admin.example.com:443/admin/realms/example/users?max=162": unexpected EOF management-1 | 2024-06-28T12:13:45Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-06-28T12:13:45Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 994037172: GET /api/peers status 401 management-1 | 2024-06-28T12:13:55Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: context deadline exceeded (Client.Timeout or context cancellation while reading body) management-1 | 2024-06-28T12:13:55Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-06-28T12:13:55Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 1110047656: GET /api/users status 401 management-1 | 2024-06-28T12:14:20Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: context deadline exceeded (Client.Timeout or context cancellation while reading body) management-1 | 2024-06-28T12:14:20Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-06-28T12:14:20Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 1610098238: GET /api/users status 401 management-1 | 2024-06-28T12:14:31Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: context deadline exceeded (Client.Timeout or context cancellation while reading body) management-1 | 2024-06-28T12:14:31Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-06-28T12:14:31Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 1748801382: GET /api/users status 401 management-1 | 2024-06-28T12:14:41Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: context deadline exceeded (Client.Timeout or context cancellation while reading body) management-1 | 2024-06-28T12:14:41Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-06-28T12:14:41Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 884359798: GET /api/users status 401 management-1 | 2024-06-28T12:14:52Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: context deadline exceeded (Client.Timeout or context cancellation while reading body) management-1 | 2024-06-28T12:14:52Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-06-28T12:14:52Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 1147169547: GET /api/users status 401 management-1 | 2024-06-28T12:15:08Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: context deadline exceeded (Client.Timeout or context cancellation while reading body) management-1 | 2024-06-28T12:15:08Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-06-28T12:15:08Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 2964505694: GET /api/users status 401 management-1 | 2024-06-28T12:15:18Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: context deadline exceeded (Client.Timeout or context cancellation while reading body) management-1 | 2024-06-28T12:15:18Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-06-28T12:15:18Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 2747264743: GET /api/users status 401 management-1 | 2024-06-28T12:15:19Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: Get "https://sso-admin.example.com:443/admin/realms/example/users/count?": unexpected EOF management-1 | 2024-06-28T12:15:19Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-06-28T12:15:19Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 3841999307: GET /api/users status 401 management-1 | 2024-06-28T12:15:30Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: context deadline exceeded (Client.Timeout or context cancellation while reading body) management-1 | 2024-06-28T12:15:30Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-06-28T12:15:30Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 3284690800: GET /api/users status 401 management-1 | 2024-06-28T12:15:31Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: Get "https://sso-admin.example.com:443/admin/realms/example/users?max=162": unexpected EOF management-1 | 2024-06-28T12:15:31Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-06-28T12:15:31Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 620562561: GET /api/users status 401 management-1 | 2024-06-28T12:15:42Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: context deadline exceeded (Client.Timeout or context cancellation while reading body) management-1 | 2024-06-28T12:15:42Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-06-28T12:15:42Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 3594267140: GET /api/users status 401 management-1 | 2024-06-28T12:15:53Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: context deadline exceeded (Client.Timeout or context cancellation while reading body) management-1 | 2024-06-28T12:16:04Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: context deadline exceeded (Client.Timeout or context cancellation while reading body) management-1 | 2024-06-28T12:16:04Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-06-28T12:16:04Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 1882557009: GET /api/users status 401 management-1 | 2024-06-28T12:16:19Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: context deadline exceeded (Client.Timeout or context cancellation while reading body) management-1 | 2024-06-28T12:16:19Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-06-28T12:16:19Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 701924560: GET /api/users status 401`

saavagebueno commented

@michelangelo136 commented on GitHub (Jul 1, 2024):

Hello @bcmmbaga, will you need other logs from the system or something from the management file?

@michelangelo136 commented on GitHub (Jul 1, 2024): Hello @bcmmbaga, will you need other logs from the system or something from the management file?

saavagebueno commented

@bcmmbaga commented on GitHub (Jul 1, 2024):

@michelangelo136 There is an issue with the Keycloak LDAP federator becoming slow, causing timeouts when starting the management as we fetch the user list from Keycloak. Could you take a look at https://github.com/keycloak/keycloak/issues/10005? Also, please consider upgrading Keycloak and retesting to see if the issue has been resolved from their side.

@bcmmbaga commented on GitHub (Jul 1, 2024): @michelangelo136 There is an issue with the Keycloak LDAP federator becoming slow, causing timeouts when starting the management as we fetch the user list from Keycloak. Could you take a look at https://github.com/keycloak/keycloak/issues/10005? Also, please consider upgrading Keycloak and retesting to see if the issue has been resolved from their side.

saavagebueno commented

@michelangelo136 commented on GitHub (Jul 2, 2024):

With the latest Keycloak version the problem still persists.

@michelangelo136 commented on GitHub (Jul 2, 2024): With the latest Keycloak version the problem still persists.

saavagebueno commented

@relay2334 commented on GitHub (Jul 26, 2024):

Seeing the same issue still. Any recommendations?

@relay2334 commented on GitHub (Jul 26, 2024): Seeing the same issue still. Any recommendations?

saavagebueno commented

@Marcus1Pierce commented on GitHub (Jul 26, 2024):

@relay2334 Try this comment https://github.com/netbirdio/netbird/issues/2142#issuecomment-2209552043

@Marcus1Pierce commented on GitHub (Jul 26, 2024): @relay2334 Try this comment https://github.com/netbirdio/netbird/issues/2142#issuecomment-2209552043

saavagebueno commented

@relay2334 commented on GitHub (Jul 29, 2024):

Unfortunately, no luck. Looks like its the Keycloak LDAP Issue

@relay2334 commented on GitHub (Jul 29, 2024): Unfortunately, no luck. Looks like its the Keycloak LDAP Issue

saavagebueno commented

@paulDashkevich commented on GitHub (Aug 11, 2024):

@michelangelo136 hi
Initially, netbird didn't work for me with LDAPS federation. Solving for me is in the netbird kk-client settings (client and backend) I turned off the function:
Clients > netbird backend (and 2nd netbird-client) > Client scopes > netbird-backend-dedicated (and 2nd netbird-client-dedicated) > Scope ON > switch to OFF

After restart services of netbird - everything happened again: (

@paulDashkevich commented on GitHub (Aug 11, 2024): @michelangelo136 hi Initially, netbird didn't work for me with LDAPS federation. Solving for me is in the netbird kk-client settings (client and backend) I turned off the function: `Clients > netbird backend (and 2nd netbird-client) > Client scopes > netbird-backend-dedicated (and 2nd netbird-client-dedicated) > Scope ON > switch to OFF` <img width="535" alt="image" src="https://github.com/user-attachments/assets/89a442d5-a4c4-435a-83d4-c06da0c62ddc"> After restart services of netbird - everything happened again : (

saavagebueno commented

@michelangelo136 commented on GitHub (Aug 11, 2024):

I followed a method mentioned above making an inter-realm authentication and having a separate netbird realm that authenticates on the primary one, I will try your method in the upcoming week, it will hopefully work nicely and won't cause an outage, hopefully this will help streamline the user authentication process.

Thanks for sharing!

@michelangelo136 commented on GitHub (Aug 11, 2024): I followed a method mentioned above making an inter-realm authentication and having a separate netbird realm that authenticates on the primary one, I will try your method in the upcoming week, it will hopefully work nicely and won't cause an outage, hopefully this will help streamline the user authentication process. Thanks for sharing!

saavagebueno commented

@cmacheret commented on GitHub (Aug 16, 2024):

@michelangelo136 Thanks your sharing. How did you make the "inter-realm" authentication work?
Let's say you have Realm A with LDAP and Realm B (without LDAP) for Netbird ? Did you configure in Realm B an "identity provider" of type "Keycloak OpenID" that points to Realm A or did you use another way?

@cmacheret commented on GitHub (Aug 16, 2024): @michelangelo136 Thanks your sharing. How did you make the "inter-realm" authentication work? Let's say you have Realm A with LDAP and Realm B (without LDAP) for Netbird ? Did you configure in Realm B an "identity provider" of type "Keycloak OpenID" that points to Realm A or did you use another way?

saavagebueno commented

@michelangelo136 commented on GitHub (Aug 16, 2024):

@cmacheret yes that's how I did it, effectively the netbird realm authenticates using open id connect to the main realm.

I can look up the config on Monday and post it here as a lot of things are undocumented and you need to find how they work through trial and error.

@michelangelo136 commented on GitHub (Aug 16, 2024): @cmacheret yes that's how I did it, effectively the netbird realm authenticates using open id connect to the main realm. I can look up the config on Monday and post it here as a lot of things are undocumented and you need to find how they work through trial and error.

saavagebueno commented

@cmacheret commented on GitHub (Aug 17, 2024):

@michelangelo136 that would be great, thanks

@cmacheret commented on GitHub (Aug 17, 2024): @michelangelo136 that would be great, thanks

saavagebueno commented

@cmacheret commented on GitHub (Aug 21, 2024):

@michelangelo136 Hi, any chance you had time to check your config? It would be really great if you could share it. Thanks in advance!

@cmacheret commented on GitHub (Aug 21, 2024): @michelangelo136 Hi, any chance you had time to check your config? It would be really great if you could share it. Thanks in advance!

saavagebueno commented

@michelangelo136 commented on GitHub (Aug 28, 2024):

Hi @cmacheret, sorry for the delay, quite a lot of stuff lately, in the Netbird Realm you need to go to Identity Providers and create a new Keycloak OpenID provider

Alias = Your provider name (write anything you want here)
Under the OpenID Connection Settings populate the metadata URLs based on the https://keycloak.example.com/realms/example-realm/.well-known/openid-configuration contents (replace keycloak, example and example-realm with your own values)

Then set the following
Client authentication: Client secret sent as post
Client ID: "The client ID that you will create in your keycloak-example/prod realm"
Client Secret: "The secret taken from the client you created in your prod realm"
Client Assertion Signature Algorithm: "By default is ES256"
Send 'id_token_hint' in logout requests: On

Leave all of the other option to the "off" state.

Then, in your prod Realm create a new OpenID client and give it a name of your choice.
Client ID: Anything you would like
Root URL: Your keycloak - Netbird realm url, eg: https://keycloak.example.com/realms/netbird
Valid redirect URIs: You need to set the following values:

https://keycloak.example.com/*
https://keycloak.example.com/realms/netbird/broker/your-Client-ID/endpoint
Web Origins: +
Client Authentication: On
Authentication Flow: Standard Flow, Direct Access grants

Then go to the Credentials Tab and set the Client Authenticator to "Client ID and Secret" and use generated secret to populate the Client Secret for the Identity Provider in the netbird Realm.

That should be what I did and it worked, hopefully, it work for you as well.

@michelangelo136 commented on GitHub (Aug 28, 2024): Hi @cmacheret, sorry for the delay, quite a lot of stuff lately, in the Netbird Realm you need to go to **Identity Providers** and create a new **Keycloak OpenID provider** **Alias** = Your provider name (write anything you want here) Under the **OpenID Connection Settings** populate the metadata URLs based on the https://keycloak.example.com/realms/example-realm/.well-known/openid-configuration contents (replace keycloak, example and example-realm with your own values) Then set the following **Client authentication:** Client secret sent as post **Client ID:** "The client ID that you will create in your keycloak-example/prod realm" **Client Secret:** "The secret taken from the client you created in your prod realm" **Client Assertion Signature Algorithm:** "By default is ES256" **Send 'id_token_hint' in logout requests:** On Leave all of the other option to the "off" state. Then, in your prod Realm create a new OpenID client and give it a name of your choice. **Client ID:** Anything you would like **Root URL:** Your keycloak - Netbird realm url, eg: https://keycloak.example.com/realms/netbird **Valid redirect URIs:** You need to set the following values: - https://keycloak.example.com/* - https://keycloak.example.com/realms/netbird/broker/your-Client-ID/endpoint **Web Origins:** + **Client Authentication:** On **Authentication Flow:** Standard Flow, Direct Access grants Then go to the **Credentials** Tab and set the **Client Authenticator** to "Client ID and Secret" and use generated secret to populate the Client Secret for the Identity Provider in the netbird Realm. --- That should be what I did and it worked, hopefully, it work for you as well.

saavagebueno commented

@cmacheret commented on GitHub (Aug 29, 2024):

Thanks a lot @michelangelo136

@cmacheret commented on GitHub (Aug 29, 2024): Thanks a lot @michelangelo136

saavagebueno commented

@nazarewk commented on GitHub (Apr 28, 2025):

Hello @michelangelo136,

We're currently reviewing our open issues and would like to verify if this problem still exists in the latest NetBird version.

Could you please confirm if the issue is still there?

We may close this issue temporarily if we don't hear back from you within 2 weeks, but feel free to reopen it with updated information.

Thanks for your contribution to improving the project!

@nazarewk commented on GitHub (Apr 28, 2025): Hello @michelangelo136, We're currently reviewing our open issues and would like to verify if this problem still exists in the [latest NetBird version](https://github.com/netbirdio/netbird/releases). Could you please confirm if the issue is still there? We may close this issue temporarily if we don't hear back from you within **2 weeks**, but feel free to reopen it with updated information. Thanks for your contribution to improving the project!

saavagebueno commented

@michelangelo136 commented on GitHub (Apr 28, 2025):

Hello @nazarewk,
Unfortunately I don't have a test Netbird environment available in order to test it.

@cmacheret I'm tagging you in the off chance that you have a test environment available and you can test it.

@michelangelo136 commented on GitHub (Apr 28, 2025): Hello @nazarewk, Unfortunately I don't have a test Netbird environment available in order to test it. @cmacheret I'm tagging you in the off chance that you have a test environment available and you can test it.

saavagebueno commented