Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix che-server when used external oidc provider. #18563

Merged

Conversation

AndrienkoAleksandr
Copy link
Contributor

@AndrienkoAleksandr AndrienkoAleksandr commented Dec 8, 2020

@che-bot che-bot added status/code-review This issue has a pull request posted for it and is awaiting code review completion by the community. kind/task Internal things, technical debt, and to-do tasks to be performed. labels Dec 8, 2020
@dmytro-ndp
Copy link
Contributor

[crw-ci-test --rebuild]

@che-bot
Copy link
Contributor

che-bot commented Dec 9, 2020

✅ E2E Happy path tests succeed 🎉

See Details

Tested with Eclipse Che Multiuser User on K8S (minikube v1.1.1)

  • Use comment "[crw-ci-test]" to rerun happy path E2E test.
  • Use comment "[crw-ci-test --rebuild]" to re-build the images and rerun happy path E2E test.

@tolusha tolusha mentioned this pull request Dec 9, 2020
56 tasks
@ibuziuk
Copy link
Member

ibuziuk commented Dec 9, 2020

@nickboldt please, apply this PR before releasing 7.23.0 #18539

@ibuziuk ibuziuk mentioned this pull request Dec 9, 2020
12 tasks
Copy link
Member

@ibuziuk ibuziuk left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I believe some tests and refactoring would be really nice to have, Currently the process of assigning the userInfoEndpoint and jwksUriEndpoint is not straight forward

@skabashnyuk
Copy link
Contributor

Can we have a test for this change?

@AndrienkoAleksandr
Copy link
Contributor Author

AndrienkoAleksandr commented Dec 11, 2020

Code spitted and good covered by tests.

@che-bot
Copy link
Contributor

che-bot commented Dec 11, 2020

❌ E2E Happy path tests failed ❗

See Details

Tested with Eclipse Che Multiuser User on K8S (minikube v1.1.1)

  • Use comment "[crw-ci-test]" to rerun happy path E2E test.
  • Use comment "[crw-ci-test --rebuild]" to re-build the images and rerun happy path E2E test.

@che-bot
Copy link
Contributor

che-bot commented Dec 14, 2020

❌ E2E Happy path tests failed ❗

See Details

Tested with Eclipse Che Multiuser User on K8S (minikube v1.1.1)

  • Use comment "[crw-ci-test]" to rerun happy path E2E test.
  • Use comment "[crw-ci-test --rebuild]" to re-build the images and rerun happy path E2E test.

@che-bot
Copy link
Contributor

che-bot commented Dec 15, 2020

❌ E2E Happy path tests failed ❗

See Details

Tested with Eclipse Che Multiuser User on K8S (minikube v1.1.1)

  • Use comment "[crw-ci-test]" to rerun happy path E2E test.
  • Use comment "[crw-ci-test --rebuild]" to re-build the images and rerun happy path E2E test.

@che-bot
Copy link
Contributor

che-bot commented Dec 15, 2020

❌ E2E Happy path tests failed ❗

See Details

Tested with Eclipse Che Multiuser User on K8S (minikube v1.1.1)

  • Use comment "[crw-ci-test]" to rerun happy path E2E test.
  • Use comment "[crw-ci-test --rebuild]" to re-build the images and rerun happy path E2E test.

@ibuziuk
Copy link
Member

ibuziuk commented Dec 15, 2020

@AndrienkoAleksandr tried to verify the PR against Hosted Che but it fails for me on startup with the following error:

2020-12-15 11:14:53,412[ost-startStop-1]  [ERROR] [o.a.c.c.C.[.[localhost].[/api] 175]  - Exception sending context initialized event to listener instance of class [org.eclipse.che.inject.CheBootstrap]
com.google.inject.CreationException: Unable to create injector, see the following errors:

1) Could not find a suitable constructor in org.eclipse.che.multiuser.keycloak.server.OIDCInfoProvider. Classes must have either one (and only one) constructor annotated with @Inject or a zero-argument constructor that is not private.
  at org.eclipse.che.multiuser.keycloak.server.OIDCInfoProvider.class(OIDCInfoProvider.java:38)
  while locating org.eclipse.che.multiuser.keycloak.server.OIDCInfoProvider
    for the 12th parameter of org.eclipse.che.multiuser.keycloak.server.KeycloakSettings.<init>(KeycloakSettings.java:62)
  while locating org.eclipse.che.multiuser.keycloak.server.KeycloakSettings
    for the 1st parameter of org.eclipse.che.multiuser.keycloak.server.KeycloakConfigurationService.<init>(KeycloakConfigurationService.java:42)
  at org.eclipse.che.multiuser.keycloak.server.deploy.KeycloakModule.configure(KeycloakModule.java:38) (via modules: org.eclipse.che.api.deploy.WsMasterModule -> org.eclipse.che.multiuser.keycloak.server.deploy.KeycloakModule)

2) Could not find a suitable constructor in org.eclipse.che.multiuser.keycloak.server.OIDCInfoProvider. Classes must have either one (and only one) constructor annotated with @Inject or a zero-argument constructor that is not private.
  at org.eclipse.che.multiuser.keycloak.server.OIDCInfoProvider.class(OIDCInfoProvider.java:38)
  while locating org.eclipse.che.multiuser.keycloak.server.OIDCInfoProvider
    for the 12th parameter of org.eclipse.che.multiuser.keycloak.server.KeycloakSettings.<init>(KeycloakSettings.java:62)
  while locating org.eclipse.che.multiuser.keycloak.server.KeycloakSettings
    for the 4th parameter of org.eclipse.che.multiuser.keycloak.server.KeycloakUserRemover.<init>(KeycloakUserRemover.java:74)
  while locating org.eclipse.che.multiuser.keycloak.server.KeycloakUserRemover
    for field at org.eclipse.che.multiuser.keycloak.server.KeycloakUserRemover$RemoveUserListener.keycloakUserRemover(KeycloakUserRemover.java:175)
  at org.eclipse.che.multiuser.keycloak.server.deploy.KeycloakUserRemoverModule.configure(KeycloakUserRemoverModule.java:20) (via modules: org.eclipse.che.api.deploy.WsMasterModule -> org.eclipse.che.multiuser.keycloak.server.deploy.KeycloakUserRemoverModule)

3) Could not find a suitable constructor in org.eclipse.che.multiuser.keycloak.server.OIDCInfoProvider. Classes must have either one (and only one) constructor annotated with @Inject or a zero-argument constructor that is not private.
  at org.eclipse.che.multiuser.keycloak.server.OIDCInfoProvider.class(OIDCInfoProvider.java:38)
  while locating org.eclipse.che.multiuser.keycloak.server.OIDCInfoProvider
    for the 5th parameter of org.eclipse.che.multiuser.keycloak.server.KeycloakUserRemover.<init>(KeycloakUserRemover.java:74)
  while locating org.eclipse.che.multiuser.keycloak.server.KeycloakUserRemover
    for field at org.eclipse.che.multiuser.keycloak.server.KeycloakUserRemover$RemoveUserListener.keycloakUserRemover(KeycloakUserRemover.java:175)
  at org.eclipse.che.multiuser.keycloak.server.deploy.KeycloakUserRemoverModule.configure(KeycloakUserRemoverModule.java:20) (via modules: org.eclipse.che.api.deploy.WsMasterModule -> org.eclipse.che.multiuser.keycloak.server.deploy.KeycloakUserRemoverModule)

4) Could not find a suitable constructor in org.eclipse.che.multiuser.keycloak.server.OIDCInfoProvider. Classes must have either one (and only one) constructor annotated with @Inject or a zero-argument constructor that is not private.
  at org.eclipse.che.multiuser.keycloak.server.OIDCInfoProvider.class(OIDCInfoProvider.java:38)
  while locating org.eclipse.che.multiuser.keycloak.server.OIDCInfoProvider
    for the 12th parameter of org.eclipse.che.multiuser.keycloak.server.KeycloakSettings.<init>(KeycloakSettings.java:62)
  while locating org.eclipse.che.multiuser.keycloak.server.KeycloakSettings
    for the 2nd parameter of com.redhat.che.multitenant.Fabric8AuthServiceClient.<init>(Fabric8AuthServiceClient.java:72)
  at com.redhat.che.wsmaster.deploy.Fabric8WsMasterModule.configure(Fabric8WsMasterModule.java:38)

5) Could not find a suitable constructor in org.eclipse.che.multiuser.keycloak.server.OIDCInfoProvider. Classes must have either one (and only one) constructor annotated with @Inject or a zero-argument constructor that is not private.
  at org.eclipse.che.multiuser.keycloak.server.OIDCInfoProvider.class(OIDCInfoProvider.java:38)
  while locating org.eclipse.che.multiuser.keycloak.server.OIDCInfoProvider
    for the 3rd parameter of com.redhat.che.multitenant.Fabric8AuthServiceClient.<init>(Fabric8AuthServiceClient.java:72)
  at com.redhat.che.wsmaster.deploy.Fabric8WsMasterModule.configure(Fabric8WsMasterModule.java:38)

6) Could not find a suitable constructor in org.eclipse.che.multiuser.keycloak.server.OIDCInfoProvider. Classes must have either one (and only one) constructor annotated with @Inject or a zero-argument constructor that is not private.
  at org.eclipse.che.multiuser.keycloak.server.OIDCInfoProvider.class(OIDCInfoProvider.java:38)
  while locating org.eclipse.che.multiuser.keycloak.server.OIDCInfoProvider
    for the 12th parameter of org.eclipse.che.multiuser.keycloak.server.KeycloakSettings.<init>(KeycloakSettings.java:62)
  while locating org.eclipse.che.multiuser.keycloak.server.KeycloakSettings
    for the 2nd parameter of org.eclipse.che.workspace.infrastructure.openshift.multiuser.oauth.IdentityProviderConfigFactory.<init>(IdentityProviderConfigFactory.java:76)
  at org.eclipse.che.api.deploy.WsMasterModule.configureMultiUserMode(WsMasterModule.java:350)

7) Could not find a suitable constructor in org.eclipse.che.multiuser.keycloak.server.OIDCInfoProvider. Classes must have either one (and only one) constructor annotated with @Inject or a zero-argument constructor that is not private.
  at org.eclipse.che.multiuser.keycloak.server.OIDCInfoProvider.class(OIDCInfoProvider.java:38)
  while locating org.eclipse.che.multiuser.keycloak.server.OIDCInfoProvider
    for the 1st parameter of org.eclipse.che.multiuser.keycloak.server.KeycloakProfileRetriever.<init>(KeycloakProfileRetriever.java:39)
  while locating org.eclipse.che.multiuser.keycloak.server.KeycloakProfileRetriever
    for the 1st parameter of org.eclipse.che.multiuser.keycloak.server.dao.KeycloakProfileDao.<init>(KeycloakProfileDao.java:38)
  at org.eclipse.che.multiuser.keycloak.server.deploy.KeycloakModule.configure(KeycloakModule.java:40) (via modules: org.eclipse.che.api.deploy.WsMasterModule -> org.eclipse.che.multiuser.keycloak.server.deploy.KeycloakModule)

8) Could not find a suitable constructor in org.eclipse.che.multiuser.keycloak.server.OIDCInfoProvider. Classes must have either one (and only one) constructor annotated with @Inject or a zero-argument constructor that is not private.
  at org.eclipse.che.multiuser.keycloak.server.OIDCInfoProvider.class(OIDCInfoProvider.java:38)
  while locating org.eclipse.che.multiuser.keycloak.server.OIDCInfoProvider
    for the 1st parameter of org.eclipse.che.multiuser.keycloak.server.KeycloakJwkProvider.<init>(KeycloakJwkProvider.java:29)
  at org.eclipse.che.multiuser.keycloak.server.deploy.KeycloakModule.configure(KeycloakModule.java:41) (via modules: org.eclipse.che.api.deploy.WsMasterModule -> org.eclipse.che.multiuser.keycloak.server.deploy.KeycloakModule)

9) Could not find a suitable constructor in org.eclipse.che.multiuser.keycloak.server.OIDCInfoProvider. Classes must have either one (and only one) constructor annotated with @Inject or a zero-argument constructor that is not private.
  at org.eclipse.che.multiuser.keycloak.server.OIDCInfoProvider.class(OIDCInfoProvider.java:38)
  at org.eclipse.che.multiuser.keycloak.server.deploy.KeycloakModule.configure(KeycloakModule.java:43) (via modules: org.eclipse.che.api.deploy.WsMasterModule -> org.eclipse.che.multiuser.keycloak.server.deploy.KeycloakModule)

9 errors
	at com.google.inject.internal.Errors.throwCreationExceptionIfErrorsExist(Errors.java:543)
	at com.google.inject.internal.InternalInjectorCreator.initializeStatically(InternalInjectorCreator.java:159)
	at com.google.inject.internal.InternalInjectorCreator.build(InternalInjectorCreator.java:106)
	at com.google.inject.Guice.createInjector(Guice.java:87)
	at org.everrest.guice.servlet.EverrestGuiceContextListener.getInjector(EverrestGuiceContextListener.java:141)
	at com.google.inject.servlet.GuiceServletContextListener.contextInitialized(GuiceServletContextListener.java:45)
	at org.everrest.guice.servlet.EverrestGuiceContextListener.contextInitialized(EverrestGuiceContextListener.java:86)
	at org.apache.catalina.core.StandardContext.listenerStart(StandardContext.java:4689)
	at org.apache.catalina.core.StandardContext.startInternal(StandardContext.java:5155)
	at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:183)
	at org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:743)
	at org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:719)
	at org.apache.catalina.core.StandardHost.addChild(StandardHost.java:705)
	at org.apache.catalina.startup.HostConfig.deployWAR(HostConfig.java:970)
	at org.apache.catalina.startup.HostConfig$DeployWar.run(HostConfig.java:1840)
	at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:515)
	at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
	at java.base/java.lang.Thread.run(Thread.java:834)

Fixup applied on Hosted Che end - ibuziuk/rh-che@61841cb
image - quay.io/ibuziuk/che-server:oidc

@che-bot
Copy link
Contributor

che-bot commented Dec 15, 2020

✅ E2E Happy path tests succeed 🎉

See Details

Tested with Eclipse Che Multiuser User on K8S (minikube v1.1.1)

  • Use comment "[crw-ci-test]" to rerun happy path E2E test.
  • Use comment "[crw-ci-test --rebuild]" to re-build the images and rerun happy path E2E test.

Copy link
Member

@ibuziuk ibuziuk left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good job!
verified on che-dev with Hosted Che.
@AndrienkoAleksandr please cherry-pick to 7.23.x once merged

@che-bot
Copy link
Contributor

che-bot commented Dec 15, 2020

❌ E2E Happy path tests failed ❗

See Details

Tested with Eclipse Che Multiuser User on K8S (minikube v1.1.1)

  • Use comment "[crw-ci-test]" to rerun happy path E2E test.
  • Use comment "[crw-ci-test --rebuild]" to re-build the images and rerun happy path E2E test.

Signed-off-by: Oleksandr Andriienko <oandriie@redhat.com>
Signed-off-by: Oleksandr Andriienko <oandriie@redhat.com>
Signed-off-by: Oleksandr Andriienko <oandriie@redhat.com>
Signed-off-by: Oleksandr Andriienko <oandriie@redhat.com>
Signed-off-by: Oleksandr Andriienko <oandriie@redhat.com>
Signed-off-by: Oleksandr Andriienko <oandriie@redhat.com>
…ider injection way.

Signed-off-by: Oleksandr Andriienko <oandriie@redhat.com>
Signed-off-by: Oleksandr Andriienko <oandriie@redhat.com>
@@ -69,23 +69,22 @@ public KeycloakUserRemover(
@Nullable @Named("che.keycloak.cascade_user_removal_enabled") boolean userRemovalEnabled,
@Nullable @Named("che.keycloak.admin_username") String keycloakUser,
@Nullable @Named("che.keycloak.admin_password") String keycloakPassword,
KeycloakSettings keycloakSettings,
OIDCInfoProvider oidcInfoProvider,
@Nullable @Named(REALM_SETTING) String realm,
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

what is this new env var about and how is it documented?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's known property. But if realm is null on the hosted Che, then I think remove user feature will be broken when this feature is enabled... I see that realm is required for https://github.com/eclipse/che/blob/7.23.x/multiuser/keycloak/che-multiuser-keycloak-user-remover/src/main/java/org/eclipse/che/multiuser/keycloak/server/KeycloakUserRemover.java#L89. But maybe it's not an issue if hosted Che doesn't supports this feature at all.

@ibuziuk
Copy link
Member

ibuziuk commented Dec 16, 2020

@AndrienkoAleksandr tried the new version against Hosted Che and still theia is not loaded with the following error, but this does not look like related this PR:

vendors.536d8fc….js:365 
t {target: e, type: "error", message: "TIMEOUT", error: Error: TIMEOUT
    at e._handleTimeout (https://static.developers.redhat.com/che/theia_artifacts/ve…}
error: Error: TIMEOUT at e._handleTimeout (https://static.developers.redhat.com/che/theia_artifacts/vendors.536d8fc78a34456992cf.js:365:8016) at https://static.developers.redhat.com/che/theia_artifacts/vendors.536d8fc78a34456992cf.js:365:7896
message: "TIMEOUT"
target: e {_listeners: {…}, _retryCount: 4, _shouldReconnect: true, _connectLock: true, _binaryType: "blob", …}
type: "error"
__proto__: s

@azatsarynnyy
Copy link
Member

hmm.. for some reason che-theia is not loaded for me properly, but this does not look like related to this PR:

image

{target: e, type: "error", message: "TIMEOUT", error: Error: TIMEOUT
    at e._handleTimeout (https://static.developers.redhat.com/che/theia_artifacts/ve…}
error: Error: TIMEOUT at e._handleTimeout (https://static.developers.redhat.com/che/theia_artifacts/vendors.536d8fc78a34456992cf.js:365:8016) at https://static.developers.redhat.com/che/theia_artifacts/vendors.536d8fc78a34456992cf.js:365:7896
message: "TIMEOUT"

@azatsarynnyy any ideas?

I can't reproduce that neither with che-theia:latest nor with che-theia:next. Everything is loaded correctly for me, on Hosted Che.
Maybe, it was some temporary issue with https://static.developers.redhat.com.
If you're able to reproduce it constantly, please provide the corresponding steps. I could check then.

Signed-off-by: Oleksandr Andriienko <oandriie@redhat.com>
@AndrienkoAleksandr AndrienkoAleksandr force-pushed the fix_che_server_when_used_external_oidc_provider branch from aaa275e to 07b109d Compare December 16, 2020 11:17
@che-bot
Copy link
Contributor

che-bot commented Dec 16, 2020

❌ E2E Happy path tests failed ❗

See Details

Tested with Eclipse Che Multiuser User on K8S (minikube v1.1.1)

  • Use comment "[crw-ci-test]" to rerun happy path E2E test.
  • Use comment "[crw-ci-test --rebuild]" to re-build the images and rerun happy path E2E test.

test.sh Outdated Show resolved Hide resolved
Signed-off-by: Oleksandr Andriienko <oandriie@redhat.com>
@AndrienkoAleksandr
Copy link
Contributor Author

I can't reproduce that neither with che-theia:latest nor with che-theia:next. Everything is loaded correctly for me, on Hosted Che.

+1. I can't reproduce it on the crc (openshift 4) cluster too.

@che-bot
Copy link
Contributor

che-bot commented Dec 16, 2020

Test failed

❌ E2E Happy path tests failed ❗

See Details

Tested with Eclipse Che Multiuser User on K8S (minikube v1.1.1)

  • Use comment "[crw-ci-test]" to rerun happy path E2E test.
  • Use comment "[crw-ci-test --rebuild]" to re-build the images and rerun happy path E2E test.

@che-bot
Copy link
Contributor

che-bot commented Dec 16, 2020

❌ E2E Happy path tests failed ❗

See Details

Tested with Eclipse Che Multiuser User on K8S (minikube v1.1.1)

  • Use comment "[crw-ci-test]" to rerun happy path E2E test.
  • Use comment "[crw-ci-test --rebuild]" to re-build the images and rerun happy path E2E test.

@ibuziuk
Copy link
Member

ibuziuk commented Dec 16, 2020

+1. I can't reproduce it on the crc (openshift 4) cluster too.

yeah theia loading, is not related to this PR

@AndrienkoAleksandr
Copy link
Contributor Author

@skabashnyuk Could you review this pr, please?

@ibuziuk
Copy link
Member

ibuziuk commented Dec 16, 2020

@rhopp @dmytro-ndp folks looks like e2e pr-check is fairly unstable - https://codeready-workspaces-jenkins.rhev-ci-vms.eng.rdu2.redhat.com/job/Multiuser-Che-PR-check-E2E-Happy-path-tests-against-k8s/ how should we proceed? this change is needed to be backported to 7.23.x today

@dmytro-ndp
Copy link
Contributor

[crw-ci-test --rebuild]

@che-bot
Copy link
Contributor

che-bot commented Dec 16, 2020

✅ E2E Happy path tests succeed 🎉

See Details

Tested with Eclipse Che Multiuser User on K8S (minikube v1.1.1)

  • Use comment "[crw-ci-test]" to rerun happy path E2E test.
  • Use comment "[crw-ci-test --rebuild]" to re-build the images and rerun happy path E2E test.

@AndrienkoAleksandr AndrienkoAleksandr merged commit 7ee6ef3 into master Dec 16, 2020
@AndrienkoAleksandr AndrienkoAleksandr deleted the fix_che_server_when_used_external_oidc_provider branch December 16, 2020 16:02
@che-bot che-bot removed the status/code-review This issue has a pull request posted for it and is awaiting code review completion by the community. label Dec 16, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
kind/task Internal things, technical debt, and to-do tasks to be performed.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

7 participants