sameersbn / sameersbn/docker-gitlab

Error when integrating Keycloak as a IDP as per https://github.com/sameersbn/docker-gitlab/blob/master/docs/keycloak-idp.md

Open
#2,282 9 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Shell
Stars
8.1k
Forks
2.1k
Avg merge
17h 47m
Merged PRs (30d)
7

Description

@BartJoris for sameersbn/gitlab:13.3.4 and following https://github.com/sameersbn/docker-gitlab/blob/master/docs/keycloak-idp.md guidance I am seeing the following error on start up. This occurs as soon as I add the OUTH2_GENERIC_APP_ID:

Missing Rails.application.secrets.openid_connect_signing_key for production environment. The secret will be generated and stored in config/secrets.yml.
2021-01-06 17:08:57,103 INFO exited: sidekiq (exit status 1; not expected)
2021-01-06 17:08:57,430 INFO spawned: 'sidekiq' with pid 787
2021-01-06 17:08:57,470 INFO exited: puma (exit status 1; not expected)
2021-01-06 17:08:58,473 INFO spawned: 'puma' with pid 788
2021-01-06 17:08:58,474 INFO success: sidekiq entered RUNNING state, process has stayed up for > than 1 seconds (startsecs)
2021-01-06 17:08:59,475 INFO success: puma entered RUNNING state, process has stayed up for > than 1 seconds (startsecs)
rake aborted!
ArgumentError: Missing :action key on routes definition, please check your routes.
/home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/actionpack-6.0.3.1/lib/action_dispatch/routing/mapper.rb:337:in `check_part'
/home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/actionpack-6.0.3.1/lib/action_dispatch/routing/mapper.rb:326:in `check_controller_and_action'
/home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/actionpack-6.0.3.1/lib/action_dispatch/routing/mapper.rb:262:in `normalize_options!'
/home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/actionpack-6.0.3.1/lib/action_dispatch/routing/mapper.rb:131:in `initialize'
/home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/actionpack-6.0.3.1/lib/action_dispatch/routing/mapper.rb:83:in `new'
/home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/actionpack-6.0.3.1/lib/action_dispatch/routing/mapper.rb:83:in `build'
/home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/actionpack-6.0.3.1/lib/action_dispatch/routing/mapper.rb:1955:in `add_route'
/home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/actionpack-6.0.3.1/lib/action_dispatch/routing/mapper.rb:1927:in `decomposed_match'
/home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/actionpack-6.0.3.1/lib/action_dispatch/routing/mapper.rb:1891:in `block in map_match'
/home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/actionpack-6.0.3.1/lib/action_dispatch/routing/mapper.rb:1885:in `each'
/home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/actionpack-6.0.3.1/lib/action_dispatch/routing/mapper.rb:1885:in `map_match'
/home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/actionpack-6.0.3.1/lib/action_dispatch/routing/mapper.rb:1633:in `match'
/home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/devise-4.7.1/lib/devise/rails/routes.rb:452:in `block in devise_omniauth_callback'
/home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/devise-4.7.1/lib/devise/rails/routes.rb:446:in `each'
/home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/devise-4.7.1/lib/devise/rails/routes.rb:446:in `devise_omniauth_callback'
/home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/devise-4.7.1/lib/devise/rails/routes.rb:268:in `block (4 levels) in devise_for'
/home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/devise-4.7.1/lib/devise/rails/routes.rb:268:in `each'
/home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/devise-4.7.1/lib/devise/rails/routes.rb:268:in `block (3 levels) in devise_for'
/home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/devise-4.7.1/lib/devise/rails/routes.rb:472:in `with_devise_exclusive_scope'
/home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/devise-4.7.1/lib/devise/rails/routes.rb:267:in `block (2 levels) in devise_for'
/home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/devise-4.7.1/lib/devise/rails/routes.rb:370:in `block in devise_scope'
/home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/actionpack-6.0.3.1/lib/action_dispatch/routing/mapper.rb:1016:in `block in constraints'
/home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/actionpack-6.0.3.1/lib/action_dispatch/routing/mapper.rb:887:in `scope'
/home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/actionpack-6.0.3.1/lib/action_dispatch/routing/mapper.rb:1016:in `constraints'
/home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/devise-4.7.1/lib/devise/rails/routes.rb:369:in `devise_scope'
/home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/devise-4.7.1/lib/devise/rails/routes.rb:266:in `block in devise_for'
/home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/devise-4.7.1/lib/devise/rails/routes.rb:242:in `each'
/home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/devise-4.7.1/lib/devise/rails/routes.rb:242:in `devise_for'
(eval):21:in `draw_route'
/home/git/gitlab/lib/gitlab/patch/draw_route.rb:30:in `instance_eval'
/home/git/gitlab/lib/gitlab/patch/draw_route.rb:30:in `draw_route'
/home/git/gitlab/lib/gitlab/patch/draw_route.rb:17:in `draw_ce'
/home/git/gitlab/lib/gitlab/patch/draw_route.rb:11:in `draw'
/home/git/gitlab/config/routes.rb:271:in `block in <top (required)>'
/home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/actionpack-6.0.3.1/lib/action_dispatch/routing/route_set.rb:426:in `instance_exec'
/home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/actionpack-6.0.3.1/lib/action_dispatch/routing/route_set.rb:426:in `eval_block'
/home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/actionpack-6.0.3.1/lib/action_dispatch/routing/route_set.rb:408:in `draw'
/home/git/gitlab/config/routes.rb:5:in `<top (required)>'
/home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/activesupport-6.0.3.1/lib/active_support/dependencies.rb:318:in `load'
/home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/activesupport-6.0.3.1/lib/active_support/dependencies.rb:318:in `block in load'
/home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/activesupport-6.0.3.1/lib/active_support/dependencies.rb:291:in `load_dependency'
/home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/activesupport-6.0.3.1/lib/active_support/dependencies.rb:318:in `load'
/home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/railties-6.0.3.1/lib/rails/application/routes_reloader.rb:40:in `block in load_paths'
/home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/railties-6.0.3.1/lib/rails/application/routes_reloader.rb:40:in `each'
/home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/railties-6.0.3.1/lib/rails/application/routes_reloader.rb:40:in `load_paths'
/home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/railties-6.0.3.1/lib/rails/application/routes_reloader.rb:20:in `reload!'
/home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/railties-6.0.3.1/lib/rails/application.rb:169:in `reload_routes!'
/home/git/gitlab/config/application.rb:319:in `block in <class:Application>'
/home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/activesupport-6.0.3.1/lib/active_support/lazy_load_hooks.rb:68:in `block in execute_hook'
/home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/activesupport-6.0.3.1/lib/active_support/lazy_load_hooks.rb:61:in `with_execution_control'
/home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/activesupport-6.0.3.1/lib/active_support/lazy_load_hooks.rb:66:in `execute_hook'
/home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/activesupport-6.0.3.1/lib/active_support/lazy_load_hooks.rb:52:in `block in run_load_hooks'
/home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/activesupport-6.0.3.1/lib/active_support/lazy_load_hooks.rb:51:in `each'
/home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/activesupport-6.0.3.1/lib/active_support/lazy_load_hooks.rb:51:in `run_load_hooks'
/home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/railties-6.0.3.1/lib/rails/application/finisher.rb:129:in `block in <module:Finisher>'
/home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/railties-6.0.3.1/lib/rails/initializable.rb:32:in `instance_exec'
/home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/railties-6.0.3.1/lib/rails/initializable.rb:32:in `run'
/home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/railties-6.0.3.1/lib/rails/initializable.rb:61:in `block in run_initializers'
/home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/railties-6.0.3.1/lib/rails/initializable.rb:60:in `run_initializers'
/home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/railties-6.0.3.1/lib/rails/application.rb:363:in `initialize!'
/home/git/gitlab/config/environment.rb:5:in `<top (required)>'
/home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/activesupport-6.0.3.1/lib/active_support/dependencies.rb:324:in `require'
/home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/activesupport-6.0.3.1/lib/active_support/dependencies.rb:324:in `block in require'
/home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/activesupport-6.0.3.1/lib/active_support/dependencies.rb:291:in `load_dependency'
/home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/activesupport-6.0.3.1/lib/active_support/dependencies.rb:324:in `require'
/home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/railties-6.0.3.1/lib/rails/application.rb:339:in `require_environment!'
/home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/railties-6.0.3.1/lib/rails/application.rb:523:in `block in run_tasks_blocks'
/home/git/gitlab/vendor/bundle/ruby/2.6.0/gems/rake-12.3.3/exe/rake:27:in `<top (required)>'
Tasks: TOP => gitlab:setup => gitlab_environment => environment
(See full trace by running task with --trace)

I am providing

        - name: OAUTH_ENABLED
          value: "true"
        - name: OAUTH_AUTO_SIGN_IN_WITH_PROVIDER
          value: "Keycloak"
        - name: OAUTH_ALLOW_SSO
          value: "Keycloak"
        - name: OAUTH_BLOCK_AUTO_CREATED_USERS
          value: "false"
        - name: OAUTH_AUTO_LINK_LDAP_USER
          value: "false"
        - name: OAUTH_AUTO_LINK_SAML_USER
          value: "false"
        - name: OAUTH_EXTERNAL_PROVIDERS
          value: "Keycloak"
          
        - name: OAUTH2_GENERIC_APP_ID
          value: "gitlab_client_id_in_keycloak"
        - name: OAUTH2_GENERIC_APP_SECRET
          value: "secret out of keycloak for client"
        - name: OAUTH2_GENERIC_CLIENT_SITE
          value: "https://keycloak.example.com"
        - name: OAUTH2_GENERIC_CLIENT_USER_INFO_URL
          value: "https://keycloak.example.com/auth/realms/example.com/protocol/openid-connect/userinfo"
        - name: OAUTH2_GENERIC_CLIENT_AUTHORIZE_URL
          value: "https://keycloak.example.com/auth/realms/example.com/protocol/openid-connect/auth"
        - name: OAUTH2_GENERIC_CLIENT_TOKEN_URL
          value: "https://keycloak.example.com/auth/realms/example.com/protocol/openid-connect/token"
        - name: OAUTH2_GENERIC_CLIENT_END_SESSION_ENDPOINT
          value: "https://keycloak.example.com/auth/realms/example.com/protocol/openid-connect/logout"

Does a referenced docker-compose exist for what the document describes? Is it an additional configuration item? Something breaking in this release?

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Compare docs/keycloak-idp.md with the supplied OAuth environment variables, then trace startup through config/routes.rb and lib/gitlab/patch/draw_route.rb. Reproduce the failure with OAUTH2_GENERIC_APP_ID enabled and determine whether the documentation or this release's route configuration is responsible. Done means the documented Keycloak setup starts without the reported route error, with the required configuration documented.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, shell
Domain
authentication, devops
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.