Error Sorry, something went wrong.

[hakankazaz]

Hi,

I get the same error when using SAML with keycloak :

Error
Sorry, something went wrong.

Does anybody already solve this?

@simonbrowndotje

Thanks a lot Simon! appreciate this!

Unfortunately, now it gives me another error when redirects to /saml2/authenticate/default:

Logs:

[DEBUG] 2023-12-22 13:40:05.156 [http-nio-8080-exec-5] DispatcherServlet - GET "/dashboard", parameters={}

[DEBUG] 2023-12-22 13:40:05.156 [http-nio-8080-exec-5] RequestMappingHandlerMapping - Mapped to com.structurizr.onpremises.web.home.HomePageController#showAuthenticatedDashboard(String, int, int, ModelMap)

[DEBUG] 2023-12-22 13:40:05.157 [http-nio-8080-exec-5] AnonymousAuthenticationFilter - Set SecurityContextHolder to anonymous SecurityContext

[DEBUG] 2023-12-22 13:40:05.157 [http-nio-8080-exec-5] MethodSecurityInterceptor - Failed to authorize ReflectiveMethodInvocation: public java.lang.String com.structurizr.onpremises.web.home.HomePageController.showAuthenticatedDashboard(java.lang.String,int,int,org.springframework.ui.ModelMap); target is of class [com.structurizr.onpremises.web.home.HomePageController] with attributes [[authorize: 'isAuthenticated()', filter: 'null', filterTarget: 'null']]

[DEBUG] 2023-12-22 13:40:05.157 [http-nio-8080-exec-5] DispatcherServlet - Failed to complete request: org.springframework.security.access.AccessDeniedException: Access is denied

[DEBUG] 2023-12-22 13:40:05.158 [http-nio-8080-exec-5] HttpSessionRequestCache - Saved request https://structurizr.mydomain.com/dashboard?continue to session

[DEBUG] 2023-12-22 13:40:05.158 [http-nio-8080-exec-5] DelegatingAuthenticationEntryPoint - Trying to match using And [Not [RequestHeaderRequestMatcher [expectedHeaderName=X-Requested-With, expectedHeaderValue=XMLHttpRequest]], Not [And [Or [Ant [pattern='/login'], Ant [pattern='/favicon.ico']], And [Not [RequestHeaderRequestMatcher [expectedHeaderName=X-Requested-With, expectedHeaderValue=XMLHttpRequest]], MediaTypeRequestMatcher [contentNegotiationStrategy=org.springframework.web.accept.HeaderContentNegotiationStrategy@29ce1124, matchingMediaTypes=[application/xhtml+xml, image/*, text/html, text/plain], useEquals=false, ignoredMediaTypes=[*/*]]]]]]

[DEBUG] 2023-12-22 13:40:05.158 [http-nio-8080-exec-5] DelegatingAuthenticationEntryPoint - Match found! Executing org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint@49e4037a

[DEBUG] 2023-12-22 13:40:05.158 [http-nio-8080-exec-5] DefaultRedirectStrategy - Redirecting to https://structurizr.mydomain.com/saml2/authenticate/default

[DEBUG] 2023-12-22 13:40:05.189 [http-nio-8080-exec-7] FilterChainProxy - Securing GET /saml2/authenticate/default

[DEBUG] 2023-12-22 13:40:05.191 [http-nio-8080-exec-7] DispatcherServlet - "ERROR" dispatch for GET "/500", parameters={}

[DEBUG] 2023-12-22 13:40:05.191 [http-nio-8080-exec-7] RequestMappingHandlerMapping - Mapped to com.structurizr.onpremises.web.error.Http500Controller#showErrorPage(ModelMap)

[DEBUG] 2023-12-22 13:40:05.192 [http-nio-8080-exec-7] JstlView - View name '500', model {structurizrConfiguration=com.structurizr.onpremises.util.Configuration@6054d5ed, scriptNonce=NjA0NzJmNjEtYTUzNy00MTk1LTg3ZDQtOWU5OTQyYjhjMzFm, timeZone=Etc/UTC, showHeader=true, showFooter=true, version=com.structurizr.onpremises.util.Version@1bdbda8d, authenticated=false, user=null, searchEnabled=true, pageTitle=Structurizr - 500, org.springframework.validation.BindingResult.structurizrConfiguration=org.springframework.validation.BeanPropertyBindingResult: 0 errors, org.springframework.validation.BindingResult.version=org.springframework.validation.BeanPropertyBindingResult: 0 errors}

[DEBUG] 2023-12-22 13:40:05.193 [http-nio-8080-exec-7] JstlView - Forwarding to [/WEB-INF/views/500.jsp]

[DEBUG] 2023-12-22 13:40:05.197 [http-nio-8080-exec-7] DispatcherServlet - Exiting from "ERROR" dispatch, status 500

structurizr.properties:

structurizr.feature.ui.dslEditor=true

structurizr.url=https://structurizr.mydomain.com

structurizr.admin=structurizr

structurizr.data=aws-s3

structurizr.authentication=saml

structurizr.saml.metadata=https://keycloak.mydomain.com/auth/realms/services/protocol/saml/descriptor

structurizr.saml.entityId=structurizr

structurizr.saml.signing.certificate=mydomain.com.cer

structirizr.saml.signing.privateKey=mydomain.com.key

aws-s3.accessKeyId=***********

aws-s3.secretAccessKey=*****************

aws-s3.bucketName=structurizr

aws-s3.endpoint=https://blobstorage.mydomain.com:9000

aws-s3.pathStyleAccess=true

Everything is configured according to the instruction. Although, maybe I've missed something...

Originally posted by @borismus-hawk in #86

[hakankazaz]

I solved the issue.
To help those who may have similar problem, I share the basic working configuration here for both strcuturizr and keycloak.

+---+

structurizr is running at http://localhost:8080/
keycloak is running at http://localhost:8280/

+----+
"structurizer.properties" file :

normal usage

structurizr.url=http://localhost:8080
structurizr.feature.ui.dslEditor=true

saml - keycloak is at http://localhost:8280/

structurizr.authentication=saml
structurizr.saml.registrationId=structurizr
structurizr.saml.entityId=structurizr
structurizr.saml.metadata=http://localhost:8280/realms/structurizr/protocol/saml/descriptor
structurizr.saml.attribute.username=email
structurizr.saml.signing.certificate=rp-certificate.crt
structurizr.saml.signing.privateKey=rp-private.key

+----+

keycloak has "structurizr" realm and a client , named as "stucturizr" , has configuration exported here , you may directly import :

{
"clientId": "structurizr",
"name": "structurizr",
"description": "",
"rootUrl": "",
"adminUrl": "http://localhost:8080",
"baseUrl": "",
"surrogateAuthRequired": false,
"enabled": true,
"alwaysDisplayInConsole": false,
"clientAuthenticatorType": "client-secret",
"redirectUris": [
"http://localhost:8080/"
],
"webOrigins": [
"http://localhost:8080"
],
"notBefore": 0,
"bearerOnly": false,
"consentRequired": false,
"standardFlowEnabled": true,
"implicitFlowEnabled": false,
"directAccessGrantsEnabled": true,
"serviceAccountsEnabled": false,
"publicClient": true,
"frontchannelLogout": true,
"protocol": "saml",
"attributes": {
"saml.assertion.signature": "true",
"saml.force.post.binding": "true",
"saml.encrypt": "false",
"post.logout.redirect.uris": "http://localhost:8080/",
"saml.server.signature": "true",
"saml.server.signature.keyinfo.ext": "false",
"realm_client": "false",
"saml.signing.certificate": "MIICpTCCAY0CBgGUonu2yTANBgkqhkiG9w0BAQsFADAWMRQwEgYDVQQDDAtzdHJ1Y3R1cml6cjAeFw0yNTAxMjYxMTU4MjRaFw0zNTAxMjYxMjAwMDRaMBYxFDASBgNVBAMMC3N0cnVjdHVyaXpyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAs0fcQD7pYdG9VhOSf5WoAbRFPTelpnktbCZkDTR24D/CIxuGyclUGnuCf1bp0GsbImEuTauE3FNt96qfZQu6+URmHZDAXBn4CashQ17pNa1l37TWYPyGd6IDfMg+7pOlkuulLBdRnOmBBopRB+pmDaKZqIj2fg1cDldBMcbzTqcc5zDRfHTEKVoYf52zrJAmN5O1gNWYEaLJowYdrGUuBc8xVz3YTXcPBM3HPwEq2RJ9r3EK1inFsCpJpEF4/wNUqvJrh25lWwvp4ZSmsCK7s35hkog9w7KjWETL5NJ59tGPLHOttK8Sw4BNevwJLqS3vpbi+CC1sKtjwfI5Z3yzTwIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQBMeC1jS2qnIY2M8+dtfYoCCPUUxXYmV218w7g5roqxrfoWfQmpUeORuoG4PhgDM4YQIJIRrKW1nhr5AhAfBbry58TRwoYFCJfEX6+VIlmz1HGkEB+uE9X6lzmnjhRVvpIYNMLPP4DADm0Al4LOsbk286432F5qshjXT1+h6VPe1I+xjhdc3zgOeT0Mzg0nHOtFVPbGmXqZDIhkYuKJGCE6dV/CgDbCogXLz0JCDBo1rDtFoJA6daRf6AyPjyho7e6cmPuj3gMGvn3+cJWkCsFLeCoc1Du66reAWXCenMblh38U0QmC9m6EYhh1D1JTLdKckT/73TUqpWj22ddR+k62",
"saml.artifact.binding.identifier": "fhKdraHlpvGuKZjvZZZGSn/R49A=",
"saml.artifact.binding": "false",
"saml.signature.algorithm": "RSA_SHA256",
"saml_force_name_id_format": "false",
"saml.client.signature": "false",
"saml.authnstatement": "true",
"display.on.consent.screen": "false",
"saml_name_id_format": "username",
"saml.signing.private.key": "MIIEogIBAAKCAQEAs0fcQD7pYdG9VhOSf5WoAbRFPTelpnktbCZkDTR24D/CIxuGyclUGnuCf1bp0GsbImEuTauE3FNt96qfZQu6+URmHZDAXBn4CashQ17pNa1l37TWYPyGd6IDfMg+7pOlkuulLBdRnOmBBopRB+pmDaKZqIj2fg1cDldBMcbzTqcc5zDRfHTEKVoYf52zrJAmN5O1gNWYEaLJowYdrGUuBc8xVz3YTXcPBM3HPwEq2RJ9r3EK1inFsCpJpEF4/wNUqvJrh25lWwvp4ZSmsCK7s35hkog9w7KjWETL5NJ59tGPLHOttK8Sw4BNevwJLqS3vpbi+CC1sKtjwfI5Z3yzTwIDAQABAoIBAAVYC4MovOkrCNNDgxblfZwLZRL1kSz8qLN0E4BnQ3HcxKsqO2LRav3dF583FoIdZzInpmsvRScSH5GF1vl6l4itlsOj2HAGYCPdo4CwGBB/Ci3YZJmAfXucazExgNq4sPNHreU6Drc4KJ3qyo6LWJ5obd8dsgdA27Ebvbg/n2oFOU+8D1ZKnrld81V3UzZR1ZN6InhDZvEoUZJb4JapMGGizM5q+mZ8Cw9HIb3BRQKJERRsV0Kf6lpAGKIGTuPqjXxtHgy4RpvblrO1KdeIiqtx/eBArHfIKQh9MDnesoDgH98CgXndziMo8D/x/N/xWLZbSNZ/NwDMaKIkvijsHDECgYEA9Hc6pLNx1kFN9bVvgJqEuTRCLoqFCNVnCRFAnHToyBU3aPIAL2XwWZ+VgymuIpF126ZhnI/gfcSlkAWsf2mOyEqex+HP7dzgmPSZgThk7WQskrv8qhumx2cW6jhjZ5JKi1ROGk+/fyc6sPpmMhzL/+mqVVrLNkZK6uokxyosZT8CgYEAu71Lzf4Gh/Qld5aG9dpHMmTrtfSxgdxWpv31FObKTM1Ag17p0EnzJN/J/M8ELEcT3teqgCq+TwpSOMjaLcbNR6Uc3WT4Yym/yMtzYBXdXJAZ39eWSzF/ZrN+HppLP0RF6v5MK8DDSENYwYnLANE2IligY7VPAsnKXefwALs23fECgYAkyI/dWlbFmzvkvbESU62mxFM094i+5IVFWwAyynCAMpkMxGT8vMTmZ1myy6G099gY/bbwPMHVirIysnfbEAH45ylu/+4uZy6wNRWn2Nlu0sTWK00AN3rnw/4xrdxfKCbpQf0ifl9c/YUaPgMEhUq4resAPtIWz4rUP/jasuDNNwKBgHBWKbjd6qyJM64mPSV5cia+aqia/Wg2HweXaIIUQzLHknXJYmEHDt2epy+F8/pGoaYzKEu+x9dl1qMx1BOWJJldPDNhypsTjTWqP6RcEPPlKgZd6wmdWZ1rg+jt7F60DJ47gfqgQnnICqDsQbOAfEL7AyYGhHunoValhV/6pi8RAoGAOuthMKLC5Q5m7Q4lbgtwKJDb52HypauVi/YDFDsnBwyESUdifMsXwT5AMkNzyUCgCLKu5QoMBJRj4+PMmOxZZUGBWoZKJAyz1dLpZeaBYIWSWlv/a4W6YiyFe1kdI3J8lFxkdERxdqICrGQmbv1HxC/Iur9vyTLSCVCAMOjGRLQ=",
"saml.allow.ecp.flow": "false",
"saml_signature_canonicalization_method": "http://www.w3.org/2001/10/xml-exc-c14n#",
"saml.onetimeuse.condition": "false",
"saml.server.signature.keyinfo.xmlSigKeyInfoKeyNameTransformer": "NONE"
},
"authenticationFlowBindingOverrides": {},
"fullScopeAllowed": true,
"nodeReRegistrationTimeout": -1,
"protocolMappers": [
{
"name": "username",
"protocol": "saml",
"protocolMapper": "saml-user-attribute-mapper",
"consentRequired": false,
"config": {
"attribute.nameformat": "Basic",
"user.attribute": "email",
"aggregate.attrs": "false",
"friendly.name": "Email Address",
"attribute.name": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"
}
}
],
"defaultClientScopes": [
"saml_organization",
"role_list"
],
"optionalClientScopes": [],
"access": {
"view": true,
"configure": true,
"manage": true
}
}