Error after login at keycloak not redirecting request to xwiki

Help / Discuss
#1

Hello! I have xwiki configured when ‘Login’ is clicked, which redirects me to Keycloak to login, then returns me to XWiki.
I’m currently trying to configure it but still getting the error and I don’t know where the problem is coming from, can anyone help me find a way to solve this so it can be after keycloak side login and back to xwiki.
image
here is the configuration in xwiki

oidc.xwikiprovider=http://10.27.196.228:8080/xwiki/oidc
oidc.endpoint.authorization=https://mcdev-keycloak.mcredit.com.vn/auth/realms/mobile-for-sale/protocol/openid-connect/auth
oidc.endpoint.token=https://mcdev-keycloak.mcredit.com.vn/auth/realms/mobile-for-sale/protocol/openid-connect/token
oidc.endpoint.userinfo=https://mcdev-keycloak.mcredit.com.vn/auth/realms/mobile-for-sale/protocol/openid-connect/userinfo
oidc.scope=openid,profile,email,address
oidc.endpoint.userinfo.method=GET
oidc.user.nameFormater=${oidc.user.preferredUsername._clean._lowerCase}
oidc.user.subjectFormater=${oidc.user.subject}

oidc.clientid=xwiki-client
oidc.secret=1662f514-a759-4617-a034-c52b6db1063e
oidc.endpoint.token.auth_method=client_secret_basic
oidc.skipped=false

here is the configuration in keycloak

{
 "clientId": "xwiki-client",
 "name": "xwiki-client",
 "rootUrl": "http://10.27.196.228:8080",
 "adminUrl": "http://10.27.196.228:8080",
 "baseUrl": "http://10.27.196.228:8080",
 "surrogateAuthRequired": false,
 "enabled": true,
 "alwaysDisplayInConsole": false,
 "clientAuthenticatorType": "client-secret",
 "redirectUris": [
  "http://10.27.196.228:8080/*"
 ],
 "webOrigins": [
  "http://10.27.196.228:8080"
 ],
 "notBefore": 0,
 "bearerOnly": false,
 "consentRequired": false,
 "standardFlowEnabled": true,
 "implicitFlowEnabled": true,
 "directAccessGrantsEnabled": true,
 "serviceAccountsEnabled": true,
 "authorizationServicesEnabled": true,
 "publicClient": false,
 "frontchannelLogout": false,
 "protocol": "openid-connect",
 "attributes": {
  "saml.assertion.signature": "false",
  "saml.force.post.binding": "false",
  "saml.multivalued.roles": "false",
  "saml.encrypt": "false",
  "saml.server.signature": "false",
  "saml.server.signature.keyinfo.ext": "false",
  "exclude.session.state.from.auth.response": "false",
  "saml_force_name_id_format": "false",
  "saml.client.signature": "false",
  "tls.client.certificate.bound.access.tokens": "false",
  "saml.authnstatement": "false",
  "display.on.consent.screen": "false",
  "saml.onetimeuse.condition": "false"
 },
 "authenticationFlowBindingOverrides": {},
 "fullScopeAllowed": false,
 "nodeReRegistrationTimeout": -1,
 "protocolMappers": [{
   "name": "Client Host",
   "protocol": "openid-connect",
   "protocolMapper": "oidc-usersessionmodel-note-mapper",
   "consentRequired": false,
   "config": {
    "user.session.note": "clientHost",
    "id.token.claim": "true",
    "access.token.claim": "true",
    "claim.name": "clientHost",
    "jsonType.label": "String"
   }
  },
  {
   "name": "Client IP Address",
   "protocol": "openid-connect",
   "protocolMapper": "oidc-usersessionmodel-note-mapper",
   "consentRequired": false,
   "config": {
    "user.session.note": "clientAddress",
    "id.token.claim": "true",
    "access.token.claim": "true",
    "claim.name": "clientAddress",
    "jsonType.label": "String"
   }
  },
  {
   "name": "address",
   "protocol": "openid-connect",
   "protocolMapper": "oidc-address-mapper",
   "consentRequired": false,
   "config": {
    "user.attribute.formatted": "formatted",
    "user.attribute.country": "country",
    "user.attribute.postal_code": "postal_code",
    "userinfo.token.claim": "true",
    "user.attribute.street": "street",
    "id.token.claim": "true",
    "user.attribute.region": "region",
    "access.token.claim": "true",
    "user.attribute.locality": "locality"
   }
  },
  {
   "name": "Client ID",
   "protocol": "openid-connect",
   "protocolMapper": "oidc-usersessionmodel-note-mapper",
   "consentRequired": false,
   "config": {
    "user.session.note": "clientId",
    "id.token.claim": "true",
    "access.token.claim": "true",
    "claim.name": "clientId",
    "jsonType.label": "String"
   }
  }
 ],
 "defaultClientScopes": [
  "web-origins",
  "role_list",
  "roles",
  "profile",
  "email"
 ],
 "optionalClientScopes": [
  "address",
  "phone",
  "offline_access",
  "microprofile-jwt"
 ],
 "access": {
  "view": true,
  "configure": true,
  "manage": true
 }
}
#2

The error suggests that XWiki got a timeout when it tried to access the userinfo endpoint.

#3

so now what should i do to fix this error. Hope you can give me a good solution.

#4

I have no idea what is the cause, can just tell you XWiki cannot reach the userinfo endpoint you indicated for some reason. Maybe you have some firewall that prevent it.