Starting kopano/openid provider with debug loglevel

thommie · August 27, 2021, 1:03pm

What is the correct way to start the openid connector (kopano) with a higher loglevel for debugging? There is a

serveCmd.Flags().String("log-level", "info", "Log level (one of panic, fatal, error, warn, info or debug)")

but how can this be integrated in the container startup on UCS?

See https://github.com/Kopano-dev/konnect/blob/06a37fc55f813fb42c035e490fcdd703c68237bc/cmd/konnectd/serve.go#L101

fbartels · August 27, 2021, 3:21pm

you can set the loglevel through the configuration file. Its located (in the container and on the host afair) at /etc/kopano/konnectd.cfg .

thommie · August 30, 2021, 9:15am

Thanks for reply. Can I edit it directly, as there is a warning message

WARNING: this file is maintained by univention-directory-listener, manual changes will be overwritten

So I need to use a udm create … command ?

Bye, Thommie

fbartels · August 31, 2021, 6:23am

Ah yes, indeed. Looking at the code of the app at https://github.com/univention/openid-connect-provider/blob/02e492f22583197d0e01d70c4fbc304a7fbfa0b1/app/configure#L45-L60 it looks like these values are indeed best set through the ucr.

Something like this I would say (untested): ucr set oidc_konnectd_log_level=debug

thommie · September 18, 2021, 10:09am

Hm, I tested this but without success. No change for konnectd.cfg after a

ucr set oidc_konnectd_log_level=debug

I also tested

ucr set oidc/konnectd/log-level=debug

as we already have a similar oidc/konnectd/issuer_identifier object in the ucr which appears in the cfg file as

oidc_issuer_identifier=https://ucs-sso.netzwissen.de

But after both tests I see no changes in the cfg file ;-(.

Info: the standard syntax for the debug values is here:

github.com

Kopano-dev/konnect/blob/06a37fc55f813fb42c035e490fcdd703c68237bc/cmd/konnectd/serve.go#L101


	serveCmd.Flags().BoolVar(&cfg.Insecure, "insecure", false, "Disable TLS certificate and hostname validation")
	serveCmd.Flags().StringArrayVar(&cfg.TrustedProxy, "trusted-proxy", nil, "Trusted proxy IP or IP network (can be used multiple times)")
	serveCmd.Flags().StringArrayVar(&cfg.AllowScope, "allow-scope", nil, "Allow OAuth 2 scope (can be used multiple times, if not set default scopes are allowed)")
	serveCmd.Flags().BoolVar(&cfg.AllowClientGuests, "allow-client-guests", false, "Allow sign in of client controlled guest users")
	serveCmd.Flags().BoolVar(&cfg.AllowDynamicClientRegistration, "allow-dynamic-client-registration", false, "Allow dynamic OAuth2 client registration")
	serveCmd.Flags().Uint64Var(&cfg.AccessTokenDurationSeconds, "access-token-expiration", 60*10, "Expiration time of access tokens in seconds since generated")                                             // 10 Minutes.
	serveCmd.Flags().Uint64Var(&cfg.IDTokenDurationSeconds, "id-token-expiration", 60*60, "Expiration time of id tokens in seconds since generated")                                                         // 1 Hour.
	serveCmd.Flags().Uint64Var(&cfg.RefreshTokenDurationSeconds, "refresh-token-expiration", 60*60*24*365*3, "Expiration time of refresh tokens in seconds since generated")                                 // 3 Years.
	serveCmd.Flags().Uint64Var(&cfg.DyamicClientSecretDurationSeconds, "dynamic-client-secret-expiration", 0, "Expiration time of generated dynamic OAuth2 client client_secret in seconds since generated") // 0 by default -> does not expire.
	serveCmd.Flags().Bool("log-timestamp", true, "Prefix each log line with timestamp")
	serveCmd.Flags().String("log-level", "info", "Log level (one of panic, fatal, error, warn, info or debug)")
	serveCmd.Flags().Bool("with-pprof", false, "With pprof enabled")
	serveCmd.Flags().String("pprof-listen", "127.0.0.1:6060", "TCP listen address for pprof")
	serveCmd.Flags().Bool("with-metrics", false, "Enable metrics")
	serveCmd.Flags().String("metrics-listen", "127.0.0.1:6777", "TCP listen address for metrics")
	return serveCmd
}

func serve(cmd *cobra.Command, args []string) error {
	ctx := context.Background()

Do we really need an ucr object and not an udm object instead? Logically UCR makes sense because its a config for the whole container. I am only a bit puzzled because the cfg file header states “this file is maintained by univention-directory-listener” … ???

jlk · September 20, 2021, 11:16am

Hey thommie,

as the OpenID Connect Provider is indeed a Univention App the settings can be set via the univention-app command:

univention-app configure openid-connect-provider --set oidc/konnectd/log_level=debug

Best regards
Jan-Luca