search

oktadev / okta-aws-cli-assume-role

Okta AWS CLI Assume Role Tool
Apache License 2.0
338 stars 177 forks source link

Error initializing QuantumRenderer: no suitable pipeline found #341

Open berridgd opened 5 years ago

berridgd commented 5 years ago

Describe the bug Run the command okta-aws and it immediately errors...

Error initializing QuantumRenderer: no suitable pipeline found java.lang.RuntimeException: java.lang.RuntimeException: Error initializing QuantumRenderer: no suitable pipeline found

To Reproduce

  1. Install okta-aws-cli-assume-role in powershell
  2. Run aws-okta in powershell
trias702 commented 5 years ago

I have the exact same issue as of latest install on Sept 4, 2019

jeremyplichtafc commented 5 years ago

Are you both seeing this on Windows? Also can you let me know the version of Java you are using as well?

berridgd commented 5 years ago

@jeremyplichtafc I am using Windows 10. My java version is 11.0.4.

trias702 commented 5 years ago

Yes, Windows 10 1607 x64.

I followed all instructions as specified here: https://github.com/oktadeveloper/okta-aws-cli-assume-role

The install via PS worked exactly as expected, and upon starting up PS, I am successfully loading the functions in %USERPROFILE%\Documents\WindowsPowerShell, so I can use the okta-aws command.

However, running that command gives me the error specified. This error is being caused because my system does not have any JavaFX libraries, and because your okta-aws app does not have any of the JavaFX libs/mods bundled with it, which is probably due to a misconfigured pom.xml with Maven.

I am running the following JDK: AdoptOpenJDK\jdk-11.0.4.11-hotspot

This JDK does NOT come with any JavaFX libs or classes.

For Windows, JavaFX installation into an existing JDK is not possible, so you will need to please provide explicit instructions on how a Windows user can utilise JavaFX to fix this error. Simply dropping the JavaFX bin and lib files into the JDK directory does not work, that leads to a different error:

java.lang.ClassNotFoundException: com.sun.glass.ui.win.WinPlatformFactory not found

trias702 commented 5 years ago

An update:

If I download and use the Liberica JDK 11.0.4 which has JavaFX prepackaged inside, then it works fine.

However, something is still broken because now when I run my okta-aws command:

okta-aws <server name> sts get-caller-identity

I get the following screen, which shows no textboxes to type anything into them:

image

trias702 commented 5 years ago

Some more observations from my end:

It appears that the okta-aws-cli.jar window is blank in my situation because it cannot seem to load the AWS MFA website which I have specified in my OKTA_AWS_APP_URL in my config file. If I place that same url into my browser, it does display it correctly.

If I change the OKTA_AWS_APP_URL to something like "https://www.google.com" it loads and displays it correctly.

So I'm really close to getting this thing working on Windows 10, but am just not sure why the aws-cli.jar is not able to load in my particular AWS MFA website. Does the .jar make any external calls to python in any way?

jeremyplichtafc commented 5 years ago

The only python call I am aware of it making is to the aws cli.

When my org is using this we have issues with some forms of Google MFA working when logging into okta. We were able to get that to work by adding the following jvm flag -Dsun.net.http.allowRestrictedHeaders=true ... not sure if you are running into something similar

trias702 commented 5 years ago

Thanks for the suggestion, but it sadly didn't work. I think it may still be some kind of a problem with the JavaFX, perhaps something is missing or not configured which is preventing the Google MFA via AWS website from showing correctly in the frame.

I'm going to give up for now, but if anyone is able to resolve this for Windows 10, I would be very happy to hear how they did it.

For anyone who wants to duplicate my env, I'm using the following JDK + JavaFX combo: https://bell-sw.com/pages/java-11.0.4/

ashleyheath commented 5 years ago

Am suffering similarly with JavaFX errors on Windows after trying to upgrade the okta-aws cli.

Made some progress by amending %HomePath%\Documents\WindowsPowerShell\Microsoft.PowerShell_profile to include

--module-path=$Env:PATH_TO_FX --add-modules=javafx.base,javafx.graphics,javafx.controls,javafx.web,javafx.fxml

in the command for Invoke-Java.

With that in place the next stumbling block was a module access problem due to src\main\java\com\okta\tools\authentication\CookieManager.java using com.sun.webkit.network.CookieManager (which is not exported by the containing module). Swapping that out for the standard java.net.CookieManager gets as far as the browser window launching and partially loading the Okta login page - but just the background, not the actual form.

That's as far as I've gotten so far. If anyone has any suggestions for debugging that they'd be much appreciated.

trias702 commented 5 years ago

@ashleyheath

The problem with the blank background Okta login page is due to an actual bug in JavaFX:

https://github.com/javafxports/openjdk-jfx/issues/230

It was fixed back in March, 2019: https://github.com/javafxports/openjdk-jfx/pull/392

However, it's only fixed in JavaFX 13 distributions which were compiled after March 2019.

If you switch to this later version of JavaFX, you will see the issue go away. I used the latest JavaFX 13 and slipstreamed it into the OpenJDK 12.0.2 using the instructions here (Custom JDK+JavaFX image): https://openjfx.io/openjfx-docs/#modular

If you then make that your system's default java dir, then okta-cli will work correctly, you will no longer display a blank background.

ashleyheath commented 5 years ago

Thanks @trias702! That solves the blank form problem. Now appear to be stuck in an infinite loop of logging in and getting redirected to the log in page but it's progress 😅 I'll keep looking into it.

wmatson commented 5 years ago

I have the same issue with the latest install on October 25th

Windows 10, Java version: openjdk 12.0.1

pkelseyaco commented 4 years ago

I have hit this same issue on my CentOS Linux release 7.3.1611 VM with okta -> AWS and google MFA. I've pulled the latest versions: JVM: openjdk full version "13.0.1+9" JMODS: javafx-jmods-11.0.2 JavaFX SDK: javafx-sdk-11.0.2

I had to edit ~/.okta/bin/withokta and added a few arguments to reference the JavaFX files

export PATH_TOFX=/my/path/to_/javafx-sdk-11.0.2/lib

--module-path $PATH_TO_FX \ --add-modules=javafx.base,javafx.graphics,javafx.controls,javafx.web,javafx.fxml \

to the java command and I now get as far as the CookieManager problem @ashleyheath reports - Short of swapping out the CookieManager, recompiling, etc is there any other config actions to take, like somehow presenting the MFA prompt in the console like for the okta creds with OKTA_BROWSER_AUTH=false?

AlesMihelcic commented 4 years ago

@pkelseyaco I was having the same issues on Ubuntu 18.04 and managed to resolve it.

I've pulled the latest versions JVM: openjdk 13.0.1 JavaFX SDK: javafx-sdk-13.0.1

I've pulled and rebuilt the jar by modifying openjfx.version to 13.0.1. Then I've just just added your commands:

export PATH_TO_FX=/my/path/to/javafx-sdk-11.0.2/lib --module-path $PATH_TO_FX

I've dropped the second part for --add-modules and it started working after that.

beaudryj commented 4 years ago

@AlesMihelcic's suggested solution works on windows. I actually also removed --module-path and --add-modules and it runs great on windows now!

@jeremyplichtafc could you please update Master to compile with openjfx.version 13.0.1 and bump to openjdk 13?

sowiecki commented 4 years ago

For anyone who wants to duplicate my env, I'm using the following JDK + JavaFX combo: https://bell-sw.com/pages/java-11.0.4/

I'm fairly certain that using the version from that link resolved this issue on my previous Mac laptop.

I'm now on a Surface running WSL2, and with that version I get the blank white "Connecting to AWS" window posted elsewhere. Most other Java versions don't even get that far. However, I was able to finally get it working using this specific version: https://download.bell-sw.com/java/13.0.1/bellsoft-jdk13.0.1-linux-amd64.deb

ghost commented 4 years ago

Similar situation here. I tried a number of versions of JDK, OpenJDK, etc. Trying to import javafx on windows gave the errors @trias702 described. @beaudryj can you expand upon what you did to get this working on windows? Attempting to modify openjfx.version to 13.0.1 didn't work for me.

Edit: Finally got it working! Used the specific java version listed above. Windows users can get it here: http://download.bell-sw.com/java/13.0.1/bellsoft-jdk13.0.1-windows-amd64.msi

candrews commented 4 years ago

FYI, when running with java --module-path /usr/lib/jvm/openjfx --add-modules=javafx.base,javafx.graphics,javafx.controls,javafx.web,javafx.fxml on Fedora 33, it fails with:

java.lang.UnsatisfiedLinkError: no jfxwebkit in java.library.path

I've reported this issue to Fedora at https://bugzilla.redhat.com/show_bug.cgi?id=1866442

This same bug also exists in Ubuntu, reported at https://bugs.launchpad.net/ubuntu/+source/openjfx/+bug/1877000