How debug/troubleshoot context deadline exceeded?

[patsevanton]

Hello! Thanks for terraform-provider-keycloak!

  # keycloak_group_memberships.sentry-access-group-memberships will be created
  + resource "keycloak_group_memberships" "sentry-access-group-memberships" {
      + group_id = "454e0afe-23c1-43a9-be6e-70b9e2fc62d5"
      + id       = (known after apply)
      + members  = [
            200 LINES
        ]
      + realm_id = "xxxxx"
    }

Plan: 1 to add, 0 to change, 0 to destroy.


│ Error: error sending request: Get "https://keycloak.corp/admin/realms/xxxx/users?username=xxxxxxxxx": context deadline exceeded
│ 
│   with keycloak_group_memberships.sentry-access-group-memberships,
│   on xxxx-client-sentry-mobile.tf line 48, in resource "keycloak_group_memberships" "sentry-access-group-memberships":
│   48: resource "keycloak_group_memberships" "sentry-access-group-memberships" {

keycloak from helm chart bitnami 22.2.6 with keycloak version 25.0.6

Code:

data "keycloak_realm" "master" {
  realm = "master"
}

resource "keycloak_ldap_user_federation" "ldap_xxxx_master" {
  enabled  = true
  name     = "xxxx-ad"
  realm_id = data.keycloak_realm.master.id

  bind_credential = data.vault_generic_secret.keycloak.data["Ad.bindCredential"]
  bind_dn         = data.vault_generic_secret.keycloak.data["Ad.bindDn"]

  changed_sync_period = 60 * 60 # 1h
  connection_timeout  = "30s"
  connection_url      = "ldaps://ycldap.corp.xxxxx.xxx:636"
  edit_mode           = "READ_ONLY"

  full_sync_period = -1
  import_enabled   = true

  pagination          = false
  batch_size_for_sync = 0
  priority            = 0
  rdn_ldap_attribute  = "cn"
  read_timeout        = "30s"

  search_scope                    = "SUBTREE"
  start_tls                       = false
  sync_registrations              = false
  trust_email                     = true
  use_password_modify_extended_op = false
  use_truststore_spi              = "ALWAYS"
  username_ldap_attribute         = "cn"
  users_dn                        = "dc=corp,dc=xxxx,dc=xxxx"

  user_object_classes = [
    "person", "organizationalPerson", "user"
  ]

  uuid_ldap_attribute      = "objectGUID"
  validate_password_policy = false
  vendor                   = "AD"

  cache {
    policy = "MAX_LIFESPAN"
  }
}


terraform {
  required_providers {
    keycloak = {
      source  = "mrparkers/keycloak"
      version = ">= 4.0.0"
    }
    vault = {
      source  = "hashicorp/vault"
      version = ">= 3.23.0"
    }
  }
  backend "http" {
    address        = "https://gitlab.corp/api/v4/projects/90/terraform/state/keycloak"
    lock_address   = "https://gitlab.corp/api/v4/projects/90/terraform/state/keycloak/lock"
    unlock_address = "https://gitlab.corp/api/v4/projects/90/terraform/state/keycloak/lock"
    username       = "gitlab-ci-token"
    # password      = not in configuration (You should export var on your PC (export TF_HTTP_PASSWORD=access_gitlab_token))
    lock_method   = "POST"
    unlock_method = "DELETE"
  }

}

provider "keycloak" {
  tls_insecure_skip_verify = true
  url                      = "https://keycloak.corp"
  client_timeout           = 60
}

provider "vault" {

}


variable "sentry_client_id" {
  type    = string
  default = "https://sentry-mobile.k8s.dev.corp/saml/metadata/sentry/"
}

variable "sentry_urls" {
  type    = list(string)
  default = ["https://sentry-mobile.k8s.dev.corp"]
}

variable "sentry_redirect_urls" {
  type    = list(string)
  default = ["*"]
}

variable "assertion_consumer_post_url" {
  type    = string
  default = "https://sentry-mobile.k8s.dev.corp/saml/acs/sentry/"
}

variable "logout_service_post_binding_url" {
  type    = string
  default = "https://sentry-mobile.k8s.dev.corp/saml/sls/sentry/"
}

resource "keycloak_group" "sentry-access-group" {
  realm_id = keycloak_realm.xxxx.id
  name     = "kc-sentry-mobile-access"
  attributes = {
    "sentry-mobile-access" = "true"
  }
}

resource "keycloak_group_memberships" "sentry-access-group-memberships" {
  realm_id = keycloak_realm.xxxx.id
  group_id = keycloak_group.sentry-access-group.id
  members  = local.sentry-mobile-access-members
}

resource "keycloak_authentication_flow" "sentry-authentication-flow" {
  realm_id = keycloak_realm.xxxx.id
  alias    = "sentry-authentication-flow"
}

resource "keycloak_authentication_execution" "sentry-authentication-flow-execution" {
  realm_id          = keycloak_realm.xxxx.id
  parent_flow_alias = keycloak_authentication_flow.sentry-authentication-flow.alias
  authenticator     = "auth-username-password-form"
  requirement       = "REQUIRED"
  depends_on        = [keycloak_authentication_flow.sentry-authentication-flow]
}

resource "keycloak_authentication_subflow" "sentry-authentication-subflow" {
  realm_id          = keycloak_realm.xxxx.id
  parent_flow_alias = keycloak_authentication_flow.sentry-authentication-flow.alias
  alias             = "sentry-authentication-subflow"
  provider_id       = "basic-flow"
  requirement       = "CONDITIONAL"
  depends_on        = [keycloak_authentication_execution.sentry-authentication-flow-execution]
}

resource "keycloak_authentication_execution" "sentry-access-condition" {
  realm_id          = keycloak_realm.xxxx.id
  parent_flow_alias = keycloak_authentication_subflow.sentry-authentication-subflow.alias
  authenticator     = "conditional-user-attribute"
  requirement       = "REQUIRED"
  depends_on        = [keycloak_authentication_execution.sentry-authentication-flow-execution]
}

resource "keycloak_authentication_execution_config" "sentry-access-condition-config" {
  realm_id     = keycloak_realm.xxxx.id
  execution_id = keycloak_authentication_execution.sentry-access-condition.id
  alias        = "sentry-access-condition"
  config = {
    "attribute_name"           = "sentry-mobile-access"
    "attribute_expected_value" = "true"
    "include_group_attributes" = "true"
    not                        = "true"
  }
  depends_on = [keycloak_authentication_execution.sentry-access-condition]
}

resource "keycloak_authentication_execution" "sentry-access-deny" {
  realm_id          = keycloak_realm.xxxx.id
  parent_flow_alias = keycloak_authentication_subflow.sentry-authentication-subflow.alias
  authenticator     = "deny-access-authenticator"
  requirement       = "REQUIRED"
  depends_on        = [keycloak_authentication_execution.sentry-access-condition]
}

resource "keycloak_authentication_execution_config" "sentry-access-deny-config" {
  realm_id     = keycloak_realm.xxxx.id
  execution_id = keycloak_authentication_execution.sentry-access-deny.id
  alias        = "sentry-access-deny"
  config = {
    denyErrorMessage = "xxxx"
  }
  depends_on = [keycloak_authentication_execution.sentry-access-deny]
}

resource "keycloak_saml_client" "name" {
  realm_id                        = keycloak_realm.xxxx.id
  client_id                       = var.sentry_client_id
  name                            = var.sentry_client_id
  base_url                        = var.sentry_urls[0]
  valid_redirect_uris             = var.sentry_redirect_urls
  sign_documents                  = true
  canonicalization_method         = "EXCLUSIVE"
  client_signature_required       = false
  signature_algorithm             = "RSA_SHA256"
  signature_key_name              = "NONE"
  name_id_format                  = "email"
  force_post_binding              = true
  include_authn_statement         = true
  assertion_consumer_post_url     = var.assertion_consumer_post_url
  logout_service_post_binding_url = var.logout_service_post_binding_url


  authentication_flow_binding_overrides {
    browser_id = keycloak_authentication_flow.sentry-authentication-flow.id
  }
  extra_config = {
    "nodeReRegistrationTimeout" = "-1"
  }
}


resource "keycloak_saml_user_property_protocol_mapper" "given-name" {
  realm_id                   = keycloak_realm.xxxx.id
  client_id                  = keycloak_saml_client.name.id
  name                       = "X500 givenName"
  user_property              = "firstName"
  friendly_name              = "givenName"
  saml_attribute_name        = "user_firstname"
  saml_attribute_name_format = "URI Reference"
}

resource "keycloak_saml_user_property_protocol_mapper" "email" {
  realm_id                   = keycloak_realm.xxxx.id
  client_id                  = keycloak_saml_client.name.id
  name                       = "X500 email"
  user_property              = "email"
  friendly_name              = "email"
  saml_attribute_name        = "user_email"
  saml_attribute_name_format = "URI Reference"
}

resource "keycloak_saml_user_property_protocol_mapper" "surname" {
  realm_id                   = keycloak_realm.xxxx.id
  client_id                  = keycloak_saml_client.name.id
  name                       = "X500 surname"
  user_property              = "lastName"
  friendly_name              = "surname"
  saml_attribute_name        = "user_surname"
  saml_attribute_name_format = "URI Reference"
}

[sschu]

It looks like reading the user times out. You could try to increase your client_timeoutto values higher than 60.

[patsevanton]

I will try. Thanks