Keycloak: user_not_found

Apps & App Center
1

So I installed keycloak via the App Center for SSO. I have a dokuwiki instance running outside of UCS which I configured to use keycloak and it works fine with the Administrator account.

However, I cannot login over keycloak with a normal user account. The keycloak logfile shows:

2024-01-08 15:59:35,975 WARN  [org.keycloak.events] (executor-thread-23) type=LOGIN_ERROR, realmId=e0e9f1b1-316e-4eba-86df-d3c7cd8d425e, clientId=dokuwiki, userId=189da369-da4e-405b-8d45-e40ea93ca1d6, ipAddress=192.168....., error=invalid_user_credentials, auth_method=openid-connect, auth_type=code, redirect_uri=http://...., code_id=eb65f9e1-998b-4a6e-bcbc-4d39dd6ceca1, username=philipp.ludwig
2024-01-09 08:37:59,838 WARN  [org.keycloak.events] (executor-thread-26) type=LOGIN_ERROR, realmId=e0e9f1b1-316e-4eba-86df-d3c7cd8d425e, clientId=dokuwiki, userId=null, ipAddress=192.168......, error=user_not_found, auth_method=openid-connect, auth_type=code, redirect_uri=http://....., code_id=a7cf924f-33a0-4bd7-8ee0-f452b741b09b, username=philipp.ludwig

Note that this unprivileged user philipp.ludwig exists in UCS and that I can login to the Portal without issues.

Do I need to create user accounts in keycloak for every UCS user? I thought that keycloak would fetch the user info via LDAP.

1 Like
2

Are you sure you are using the administrator account out of UCSā€™ ldap or is it Keycloakā€™s admin account?

The Keycloak realm ā€˜ucsā€™ points to a non-TLS port but is configured to use STARTTLS. Thereā€™s a (german) post about the error here: Error in Keycloak LDAP Query - TLS Problem to LDAP - #2 by hasechris92

If you didnā€™t change that (e.g. uncheck USE STARTTLS ) keycloak canā€™t get your users from Ldap.

3

Thanks for your reply. As I said, the UCS admin account works fine, but I was wondering about authenticating at keycloak with a non-admin UCS account.

Anyway, in the meantime I removed keycloak because I could not get it to work.

4

This will not help you much, because from UCS version 5.2 there is only Keycloak.

5

I just installed Keycloak on my UCS 5.0 primary and found myself with the same error message in the logs.

However, in contrast to philipp I did not try to login with a non admin user. My problem in fact is that a login attempt with the standard ā€œAdministratorā€ account after a fresh install fails with ā€œuser_not_foundā€ in the keycloak logs.

Only way to get into the admin console is via the hardwired ā€œadminā€ account.

6

Well, I solved my problem:

Though the system ā€œAdministratorā€ account (obviously) was part of the group ā€œDomain Adminsā€ the login worked after I removed him and readded the account the group.

No idea what was wrong hereā€¦