Keycloak not working before and after upgrade to UCS 5.2-2 errata150

UCS - Univention Corporate Server
1

Hi,

I am having some issues regarding keycloak, as part of the upgrade to UCS 5.2.2. I have read a lot of posts here and tried to follow their advice, with no luck.

Before upgrading UCS to UCS 5.2-2 errata150 I was told, that I need to switch to keycloak before doing so. As I could not get keycloak running, I decided to remove keycloak completely and postpone the keycloak setup, after upgrade to UCS 5.2-2.

Athough the upgrade was successfull, nothing changed. I have removed and reinstalled keycloak=26.2.5-ucs1 several times now without success.

2

Because of the #$% “new users are only allowed to post 2 links” protection I needed to split my post.

I studied the “Troubleshooting” section according to “Keycloak app troubleshooting”

In /var/log/univention/appcenter.log I see “Running 50keycloak.inst failed (exitcode: 2)”, although when I install keycloak via the app store, I do not see any failure message. During installation I just confirmed the defaults, as our univention setup is pretty vanilla. I can not see any other entries in the log, that show any failed steps.

3

The joinscript “50keycloak” fails like it failed before the upgrade to UCS 5.2.-2, as seen in /var/log/univention/join.log

Create ucs-sso-ng.dom.contoso.net (192.168.1.103) A record on 192.168.1.34
['kinit', '--password-file=/etc/machine.secret', 'ucs-8802$', 'nsupdate', '-v', '-g', '/tmp/tmprk9rh8q6'] failed with 1 (kinit: Password incorrect
)
failed to add A record for ucs-sso to 192.168.1.34
/usr/lib/univention-install/50keycloak.inst: FATAL: 
EXITCODE=2
23654d20-afdf-433b-9888-e8fbb03f1cd5
univention-join-hooks: looking for hook type "join/post-joinscripts" on ucs-8802.dom.contoso.net
4

I followed this guide “Problem:Keycloak - Installation of keycloak fails because - Invalid user credentials”, but this command failed

univention-keycloak --binduser "${keycloak_admin_user:-admin}" realms get

with this error message

keycloak.exceptions.KeycloakConnectionError: Can’t connect to server (HTTPSConnectionPool(host=‘ucs-sso-ng.dom.contoso.net’, port=443): Max retries exceeded with url: /realms/master/protocol/openid-connect/token (Caused by NewConnectionError(‘<urllib3.connection.HTTPSConnection object at 0x7fcb84673050>: Failed to establish a new connection: [Errno -2] Name or service not known’)))

5

This is no suprise to me, as I can not open the admin panel on ucs-sso-ng.dom.contoso.net/admin in my browser either, though it’s docker container is running fine, as far as I see in the output of “docker ps” command.

885a931d470f docker.software-univention.de/keycloak-keycloak:26.2.5-ucs1 “/opt/keycloak/bin/k
” About an hour ago Up About an hour (healthy) 0.0.0.0:7600->7600/tcp, :::7600->7600/tcp, 8080/tcp, 0.0.0.0:8180->8180/tcp, :::8180->8180/tcp, 8443/tcp keycloak

I have no idea what to do about this and appreciate any help.

6

I was now able to resolve the issue. :slight_smile:

As far as I remember, I could fix it by following the following steps:

During installation I used the credentials of the domain admin on the Windows server and now can thankfully access the keycloak admin panel. In the consequence the join to the domain by keycloak was also completed without any issues :slight_smile:

1 Like