keycloak / keycloak-quickstarts

Apache License 2.0
1.99k stars 984 forks source link

Jboss 8: Required mechanism KEYCLOAK-SAML not available, even though keycloak-saml-adapter is installed #571

Closed glysbaysb closed 4 months ago

glysbaysb commented 4 months ago

Describe the bug

Hello,

when trying to deploy the Jakarta SAML Quickstart I get the following error:

{"WFLYCTL0080: Fehlgeschlagene Dienste" => {"jboss.deployment.unit.\"servlet-saml-service-provider.war\".undertow-deployment" => "java.lang.RuntimeException: java.lang.IllegalStateException: The required mechanism 'KEYCLOAK-SAML' is not available in mechanisms [BASIC, CLIENT_CERT, DIGEST, FORM] from the HttpAuthenticationFactory.
    Caused by: java.lang.RuntimeException: java.lang.IllegalStateException: The required mechanism 'KEYCLOAK-SAML' is not available in mechanisms [BASIC, CLIENT_CERT, DIGEST, FORM] from the HttpAuthenticationFactory.
    Caused by: java.lang.IllegalStateException: The required mechanism 'KEYCLOAK-SAML' is not available in mechanisms [BASIC, CLIENT_CERT, DIGEST, FORM] from the HttpAuthenticationFactory."}}

I have installed the saml-adapter in my jboss 8 and activated it

/extension=org.keycloak.keycloak-saml-adapter-subsystem:add()
/subsystem=keycloak-saml:add()

The HttpAuthenticationFactory is the original one. In the documentation I did not see that it is neccassary to add a custom Security Domain or Http Authentication Factory https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/8.0/pdf/using_single_sign-on_with_jboss_eap/red_hat_jboss_enterprise_application_platform-8.0-using_single_sign-on_with_jboss_eap-en-us.pdf

https://docs.wildfly.org/30/WildFly_Elytron_Security.html#Keycloak_SAML_Integration

Version

25

Expected behavior

No response

Actual behavior

No response

How to Reproduce?

No response

Anything else?

No response

glysbaysb commented 4 months ago

Part of the installation of the keycloak-saml subsystem is running a post installation script, which adds security domains, authentication factories and such. That was not documented so I had failed to do so. It also seems like the script has been deleted from the repositories? In general a unsatisfiying experience