OIDC Provider Error

[wss29]

hi,
for use oauth2-proxy and keycloak, I follow steps

1. follow Keycloak.md install keycloak to create Realm, Client and ClientScope, my keycloak url is https:keycloak.example.com
   
2. install oauth2-proxy with the oauth2-proxy-config in theia-cloud

helm -n my-namespace install oauth2-proxy ./oauth2-proxy-7.12.7.tgz -f values.yaml

but the pod of oauth2-proxy has error when I use oauth2-proxy-config in theia-could

kubectl logs -f oauth2-proxy-5594bf7889-zw7qr -n my-namespace

[2025/03/25 08:59:32] [provider.go:55] Performing OIDC Discovery...
[2025/03/25 08:59:32] [main.go:59] ERROR: Failed to initialise OAuth2 Proxy: error initialising provider: could not create provider data: error building OIDC ProviderVerifier: could not get verifier builder: error while discovery OIDC configuration: failed to discover OIDC configuration: error performing request: Get "https://keycloak.example.com/realms/TheiaCloud/.well-known/openid-configuration": dial tcp: lookup keycloak.example.com on 10.96.0.10:53: no such host

when I access https://keycloak.example.com/realms/TheiaCloud/.well-known/openid-configuration on bowser I can get correct content

what is wrong with the oauth2-proxy-config in theia-cloud?

[jfaltermeier]

In Theia Cloud we automatically add the oauth2-proxy as a second container next to the app container in the session pods.

We are using the oauth2-proxy image from here:
https://quay.io/repository/oauth2-proxy/oauth2-proxy?tab=tags&tag=latest
https://github.com/oauth2-proxy/oauth2-proxy
The latest version there is 7.8.2.

I am not sure what you are testing or which version of oauth2-proxy you are using, since I could not find a 7.12.7 release.
But I think this might not be a Theia Cloud-specific question.

In general, the documentation for configuring oauth2-proxy with Keycloak can be found here:
https://oauth2-proxy.github.io/oauth2-proxy/configuration/providers/keycloak_oidc

Based on the error message you shared, lookup keycloak.example.com on 10.96.0.10:53: no such host, this looks like a DNS issue.
Maybe the DNS entries are missing inside your cluster?

[wss29]

hi @jfaltermeier
"Kubernetes uses CoreDNS internally for domain name resolution. I encountered an error because CoreDNS could not resolve my custom Keycloak URL 'keycloak.example.com'. To fix this, I added a hosts plugin to the CoreDNS ConfigMap, which resolved the issue."

[wss29]

hi @jfaltermeier
Although I successfully installed oauth2-proxy, I encountered problems when launching my app. Below are the detailed steps I followed during setup:

keycloak

I have successfully installed Keycloak and can now log in to Theia-cloud. My Keycloak instance is accessible at: https://keycloak.example.com/

keycloak setting

theia-cloud config

OAuth2-proxy

I used the following configuration in my oauth2-proxy.yaml file to install OAuth2-Proxy

oauth2-proxy.yaml

apiVersion: v1
kind: Service
metadata:
    name: oauth2-proxy
    namespace: my-namespace
spec:
    ports:
        - name: http
          port: 4180
          targetPort: 4180
    selector:
        app: oauth2-proxy
---
apiVersion: apps/v1
kind: Deployment
metadata:
    name: oauth2-proxy
    namespace: my-namespace
spec:
    replicas: 1
    selector:
        matchLabels:
            app: oauth2-proxy
    template:
        metadata:
            labels:
                app: oauth2-proxy
        spec:
            containers:
                - name: oauth2-proxy
                  image: quay.io/oauth2-proxy/oauth2-proxy:v7.8.1
                  args:
                      - --config
                      - /etc/oauth2-proxy/oauth2-proxy.cfg
                  ports:
                      - containerPort: 4180
                        name: http
                  volumeMounts:
                      - name: config
                        mountPath: /etc/oauth2-proxy
            volumes:
                - name: config
                  configMap:
                      name: oauth2-proxy-config

oauth2-proxy-config

The default oauth2-proxy configuration produces two errors when installing oauth2-proxy

error 1

kubectl logs -f oauth2-proxy-7458d8995d-ln6sr -n my-namespace
[2025/03/27 03:21:50] [main.go:42] ERROR: failed to convert config: error converting upstreams: could not parse upstream "http://127.0.0.1:placeholder-port/": parse "http://127.0.0.1:placeholder-port/": invalid port ":placeholder-port" after host

error 2

[2025/03/27 06:00:36] [main.go:53] invalid configuration:
missing setting for email validation: email-domain or authenticated-emails-file required.
use email-domain=\* to authorize all email addresses

I made two changes to successfully install oauth2-proxy:

1. Updated the upstreams from http://127.0.0.1:placeholder-port/ to http://127.0.0.1:3000/.

I'm not entirely sure why this worked, but it resolved the previous error.

2. Added email_domains=["*"] to allow any email domain for authentication.

Regarding the redirect_url, I'm unsure whether the 'placeholder' value affects the result.

I tried setting different values separately:

• redirect_url="https://placeholder/oauth2/callback"

• redirect_url="https://192.168.0.200.sslip.io/oauth2/callback"

However, clicking "Launch" always resulted in a timeout.

oauth2-proxy-config content

apiVersion: v1
data:
  oauth2-proxy.cfg: |
    # Provider config
    provider="keycloak-oidc"
    redirect_url="https://placeholder/oauth2/callback"                   // also use https://192.168.0.200.sslip.io/oauth2/callback
    oidc_issuer_url="https://keycloak.example.com/realms/TheiaCloud"
    ssl_insecure_skip_verify=true
    # Client config
    client_id="theia-cloud"
    client_secret="publicbutoauth2proxywantsasecret"
    cookie_secret="OQINaROshtE9TcZkNAm5Zs2Pv3xaWytBmc5W7sPX7ws="
    cookie_secure="false"
    #proxy_prefix=""
    # Upstream config
    http_address="0.0.0.0:5000"
    upstreams="http://127.0.0.1:3000/"                                          // change placeholder-port to 3000
    # Proxy Config
    #user_id_claim="preferred_username"
    skip_auth_routes=["/health.*"]
    skip_provider_button="true"
    reverse_proxy="true"
    email_domains=["*"]                                                                  // use email_domains
    cookie_domains=["192.168.0.200.sslip.io"]
    whitelist_domains=["192.168.0.200.sslip.io:*","keycloak.example.com:*",".google.com:*"]
    custom_templates_dir="/templates"
kind: ConfigMap
metadata:
  annotations:
    meta.helm.sh/release-name: my-theia-cloud
    meta.helm.sh/release-namespace: my-namespace
  creationTimestamp: "2025-03-27T03:17:37Z"
  labels:
    app.kubernetes.io/managed-by: Helm
  name: oauth2-proxy-config
  namespace: my-namespace
  resourceVersion: "969946"
  uid: 4ffccbf0-db17-4bca-931d-8de869bb8fc1

When I click the 'Launch My Theia' button, it always times out. To debug the issue, I modified the landing-page code slightly to log some information during launch. You can see the output on the right side of the following image.

Pod status

I tried checking the pod logs to identify any error messages

app session pod

kubectl logs -f session-wssyff-sunwise-ide12-9433dc3d1ad3-766cb6f548-78pkk -n my-namespace

oauth2-proxy pod

kubectl logs -f oauth2-proxy-7458d8995d-ff7tp -n my-namespace

service-deployment pod

kubectl logs -f service-deployment-8fffd9546-29pzq -n my-namespace

How should OAuth2-proxy be properly configured? I might have missed some steps in my setup. Currently, I can't launch my application - I only used an oauth2-proxy.yaml file for installation. I've reviewed the Keycloak OIDC and OAuth2-proxy documentation, perhaps it's the final step needed to make my application work with Theia-cloud. Could you please provide some guidance?

[wss29]

hi @jfaltermeier
I think I misunderstood the usage of Theia-Cloud. I thought I needed to install OAuth2 Proxy myself, but in fact, it's unnecessary—just installing Keycloak and configuring it is enough,
Now I can log in and launch my app, but there's still a small issue to note: the default imagePullPolicy for quay.io/oauth2-proxy/oauth2-proxy is set to Always. This isn't ideal because:

1. Network issues may prevent access to image website
2. It keeps pulling the image unnecessarily even though I've already downloaded and installed it in containerd
   Setting the default value to IfNotPresent would resolve this problem.
   I have post a discussion on 419