[SOLVED] Keycloak OpenID Configuration - Failed to contact token endpoint: Request failed

[vnick_coty]

Hello, everyone,
I'm attempting to get my PVE environments (version 9.2.5) configured with OpenID authentication to a Keycloak SSO server (26.7.0), and am running into errors during authentication. Hopefully someone can point out where I've gone wrong.

After configuring the OpenID realm, when I try to log in, I receive the following error in the browser:


and, if I look at the journalctl output, I see the following:
Jul 31 09:12:48 pxnode01 pvedaemon[3269733]: openid authentication failure; rhost=::ffff:1.2.3.4 msg=Failed to contact token endpoint: Request failed

Looking at the logs on the Keycloak side, I see a successful login noted for the user/realm.

Based on plenty of Internet searching and reading in these forums and others, I've tried or verified the following items:

• CA certificate for the SSO server has been installed into the /usr/local/share/ca-certificates folder and update-ca-certificates run to refresh the store. "openssl s_client -connect keycloak.server.com:443" is successful from the ProxMox shell session.
• Several sites mentioned needing to set the Signature Algorithms for the ProxMox client in Keycloak to RS256. I did this, and even tried regenerating the client secret in KeyCloak and reconfiguring in ProxMox, to no avail.
• Verified that both Authentication and Client Authorization are enabled for the application in Keycloak, and tried enabling both Standard and Implicit flow.
• Verified that the Issuer URL is correct for the version of Keycloak that i'm running (drops the /auth/ portion of the URL).
• Verified that Redirect URIs are configured correctly in Keycloak.

Any hints on what else to check, or additional logging/debugging that could be enabled to help track this down would be appreciated. Interestingly I was able to configure OpenID in GDM without any issue at all, so not sure why PVE is being so difficult about this.

Thanks!
-Nick

 

[Moayad]

Hi,

please post the output of `pveversion -v` and the matching keycloak log line from the same timestamp.

 

[vnick_coty]

Thanks for the reply @Moayad. I did finally figure out what was missing in my configuration. Apparently the default client that I was creating on the Keycloak side was not providing the "username" claim that ProxMox was expecting. In Keycloak, I had to go to the Client Scopes -> pve-dedicated section and add a "User Property" mapper to pass the "username" through as a claim. As soon as I added this mapper it started working.

It's unclear to me why GDM worked fine without this addition, but PVE requires it, but, that's what seems to work.

The following Github Gist led me in the right direction (which actually references another PVE forum post):
https://gist.github.com/jakoberpf/d6f519459f7dad3b30f509facdc22445

(At the bottom, the "Client Mapper" configuration section was the hint...)

Now i just have to get groups working properly...

 

[Moayad]

Glad to hear that you solved the issue yourself! good catch and thank you for posting the fix.

I will go ahead and set your thread as [SOLVED] to help other people who have similar issue.

Have a nice weekend.