CAC Authentiction on newer versions of Keycloak (24+) not working, create-user.jar also broken.

[localhostDJT]

Hello,

I have recently set up an instance of STIG Manager with the following versions:

STIG-Manager: latest
Keycloak: 24.0.5, 25.0.4, 26.0.5
NGINX: 1.27.2

nginx.conf

events {
  worker_connections  4096;  ## Default: 1024
}
pid                                                         /var/cache/nginx/nginx.pid;
http {
            access_log                                /var/log/nginx/keycloak.access.log;
            error_log                                  /var/log/nginx/keycloak.error.log;

	server {
    		listen 			               8443			    ssl;
		#http2			               on;
    		server_name 		        example.lab www.example.lab redacted_host_IP;

                ssl_certificate                         /etc/nginx/example.lab.crt;
                ssl_certificate_key                 /etc/nginx/example.lab.key;

                root                                         /usr/share/nginx/html;
                client_max_body_size             100M;
                ssl_prefer_server_ciphers       on;
                ssl_client_certificate                /etc/nginx/dod-certs.pem;
                
                ssl_verify_client                        on;
                ssl_verify_depth                       4;

                error_log                                  /var/log/nginx/error.log debug;

                if ($return_unauthorized)       { return 496; }

                proxy_set_header                Host                               $host;
                proxy_set_header                X-Real-IP                       $remote_addr;
                proxy_set_header                X-Forwarded-For          $proxy_add_x_forwarded_for;
                proxy_set_header                X-Forwarded-Host        $host;
                proxy_set_header                X-Forwarded-Server      $host;
                proxy_set_header                X-Forwarded-Port          server_port;
                proxy_set_header                X-Forwarded-Proto       $scheme;

                proxy_read_timeout              300s;
                proxy_connect_timeout         75s;

                proxy_buffer_size                    128k;
                proxy_buffers                          4                                   256k;
                proxy_busy_buffers_size        256k;


            location / {
                autoindex              		on;
               ssi 				                on;
    	    }	

            location /stigman/ {
                proxy_pass                      http://stigman:54000/;
            }

	    location /kc/ {
	    	proxy_set_header 		Host 			      $host;
	    	proxy_set_header 		X-Real-IP 		      $remote_addr;
	    	proxy_set_header 		X-Forwarded-For 	       $proxy_add_x_forwarded_for;
    		proxy_set_header 		X-Forwarded-Host   	$host;
    		proxy_set_header 		X-Forwarded-Server 	$host;
    		proxy_set_header 		X-Forwarded-Port   	$server_port;
    		proxy_set_header 		X-Forwarded-Proto 	$scheme;
                proxy_set_header 		ssl-client-cert 	       $ssl_client_escaped_cert;


    		proxy_read_timeout 		300s;
    		proxy_connect_timeout        75s;

    		proxy_buffer_size   		128k;
    		proxy_buffers   		        4 			             256k;
    		proxy_busy_buffers_size   	256k;
		proxy_pass			        http://auth:8080/;
	    }
	
	   location /resources/ {
          	proxy_pass 			       http://auth:8080/resources/;
           	proxy_set_header 		Host 			        $host;
           	proxy_set_header 		X-Real-IP 		        $remote_addr;
           	proxy_set_header 		X-Forwarded-For 	        $proxy_add_x_forwarded_for;
           	proxy_set_header		        X-Forwarded-Host 	$host;
           	proxy_set_header 		X-Forwarded-Server 	$host;
           	proxy_set_header 		X-Forwarded-Port 	$server_port;
           	proxy_set_header 		X-Forwarded-Proto 	$scheme;
                proxy_set_header                  ssl-client-cert                 $ssl_client_escaped_cert;

        }

            location /js/ {
            	proxy_pass			       http://auth:8080/js/;
            	proxy_set_header 		Host 			       $host;
            	proxy_set_header 		X-Real-IP 		       $remote_addr;
            	proxy_set_header 		X-Forwarded-For 	       $proxy_add_x_forwarded_for;
            	proxy_set_header 		X-Forwarded-Host 	$host;
            	proxy_set_header 		X-Forwarded-Server	$host;
            	proxy_set_header 		X-Forwarded-Port 	$server_port;
           	proxy_set_header 		X-Forwarded-Proto 	$scheme;
                proxy_set_header                  ssl-client-cert                 $ssl_client_escaped_cert;

        }

    	    location /realms/ {
                 proxy_set_header                Host                                 $host;
       	 proxy_set_header                X-Real-IP                         $remote_addr;
       	 proxy_set_header                X-Forwarded-For            $proxy_add_x_forwarded_for;
       	 proxy_set_header                X-Forwarded-Host          $host;
       	 proxy_set_header                X-Forwarded-Server      $host;
       	 proxy_set_header                X-Forwarded-Port          $server_port;
       	 proxy_set_header                X-Forwarded-Proto       $scheme;
                 proxy_set_header                ssl-client-cert                 $ssl_client_escaped_cert;

       	 proxy_read_timeout              300s;
       	 proxy_connect_timeout        75s;
		
      		  proxy_buffer_size               128k;
      		  proxy_buffers                      4                                        256k;
       	  proxy_busy_buffers_size      256k;
       	  proxy_pass                      http://auth:8080/realms/;
            }
}
   # define which endpoints require mTLS
    map_hash_bucket_size 128;
    map $uri $secured_url {
        default false;
        "/kc/realms/stigman/protocol/openid-connect/auth" true;
    }

    map "$secured_url:$ssl_client_verify" $return_unauthorized {
            default 0;
            "true:FAILED" 1;
            "true:NONE" 1;
            "true:" 1;
    }
}

docker-compose.yml:

version: "3.7"

services:
  auth:
    container_name: auth
    image: docker.io/keycloak/keycloak:24.0.5
    command: start --import-realm --file=/opt/keycloak/data/import/realm-export-stigman.json
    environment:
      - KEYCLOAK_ADMIN=
      - KEYCLOAK_ADMIN_PASSWORD=
      - KC_PROXY=edge
      - KC_HOSTNAME_URL=https://example.lab:8443/
      - KC_HOSTNAME_ADMIN_URL=https://example.lab:8443/kc
      - KC_HOSTNAME_DEBUG=true
      - KC_PROXY_HEADERS=xforwarded
      - KC_HTTPS_CLIENT_AUTH=required
      - PROXY_ADDRESS_FORWARDING=true
        #- KC_HOSTNAME_STRICT=true
        #
      - KC_HTTPS_CERTIFICATE_FILE=/opt/keycloak/conf/truststores/example.lab.crt
      - KC_HTTPS_CERTIFICATE_KEY_FILE=/opt/keycloak/conf/truststores/example.lab.key
      # x.509 Certificate
      - KC_SPI_X509CERT_LOOKUP_PROVIDER=nginx
      - KC_SPI_X509CERT_LOOKUP_NGINX_SSL_CLIENT_CERT=SSL-CLIENT-CERT
    volumes:
      - ./keycloak/realm-export.json:/opt/keycloak/data/import/realm-export.json:z
      - ./certs/example.lab.crt:/opt/keycloak/conf/truststores/example.lab.crt:z
      - ./certs/example.lab.key:/opt/keycloak/conf/truststores/example.lab.key:z
      - ./certs/dod_CAs.pem:/opt/keycloak/conf/truststores/dod-certs.pem:z

      # Breaks keycloak with java errors
      #- /opt/containers/files/keycloak/create-x509-user.jar:/opt/keycloak/providers/create-x509-user.jar:z

  nginx:
    container_name: nginx
    image: docker.io/library/nginx:latest
    ports:
      - "8443:8443"
    volumes: 
      - ./certs/example.lab.crt:/etc/nginx/example.lab.crt:z
      - ./certs/example.lab.key:/etc/nginx/example.lab.key:z
      - ./nginx/keycloak.conf:/etc/nginx/nginx.conf:z
      - ./certs/dod_CAs.pem:/etc/nginx/dod-certs.pem:z

    depends_on: 
      - auth

  mysql:
    container_name: mysql
    image: docker.io/mysql/mysql-server
    command: --innodb-buffer-pool-size=512M --sort_buffer_size=64M 
    environment:
      - MYSQL_ROOT_PASSWORD=
      - MYSQL_USER=stigman
      - MYSQL_DATABASE=stigman
      - MYSQL_PASSWORD=
    ports: 
      - "3306:3306"
    volumes:
      - ./certs/example.lab.crt:/etc/ssl/certs/example.lab.crt:z
      - ./certs/example.lab.key:/etc/ssl/certs/example.lab.key:z
      - /opt/containers/certs/myCA.pem:/etc/ssl/certs/myCA.pem:z
      - ./mysql/tls.cnf:/etc/my.cnf:z
      - /opt/containers/files/mysql/mysql-data:/var/lib/mysql:z
      - ./mysql/init-user-perms.sql:/docker-entrypoint-initdb.d/init-user-perms.sql:z

  stigman:
    container_name: stigman
    image: docker.io/nuwcdivnpt/stig-manager:latest
    environment:
      - STIGMAN_DB_USER=stigman
      - STIGMAN_DB_PORT=3306
      - STIGMAN_DB_HOST=mysql
      - STIGMAN_DB_PASSWORD=
      - STIGMAN_CLIENT_OIDC_PROVIDER=https://example.lab:8443/realms/stigman
      - STIGMAN_OIDC_PROVIDER=http://auth:8080/realms/stigman
      - STIGMAN_LOG_LEVEL=4
      - STIGMAN_DB_TLS_CA_FILE=myCA.pem
      - STIGMAN_DB_TLS_CERT_FILE=example.lab.crt
      - STIGMAN_DB_TLS_KEY_FILE=example.lab.key
      - NODE_EXTRA_CA_CERTS=/tmp/myCA.pem
    volumes:
      - ./certs/myCA.pem:/home/node/tls/myCA.pem:z
      - ./certs/myCA.pem:/tmp/myCA.pem:z
      - ./certs/example.lab.crt:/home/node/tls/example.lab.crt:z
      - ./certs/example.lab.key:/home/node/tls/example.lab.key:z

    ports:
      - "54000:54000"
    init: true

I downloaded the latest DoD certificates from the cyber.mil website and followed their instructions to convert them in .PEM format to be used as a CA.pem (/certs/dod_CAs.pem) with openssl, and mounted the .pem file for NGINX to be used as the CA:
ssl_client_certificate /etc/nginx/dod-certs.pem;

I also created my own root Certificate Authority and signed my hosts certificates and referenced them in NGINX as well:

                ssl_certificate                         /etc/nginx/example.lab.crt;
                ssl_certificate_key                 /etc/nginx/example.lab.key;

The Keycloak import file I am using is from the stigman-auth orchestration uploaded for version 23.0.1 of Keycloak, but I do not believe it has any x.509 settings imported.

Current status:

1. I am able to use a username and password to log into Keycloak and configure a username and password for STIG Manager.
2. It does prompt me for my CAC and I am able to input my CAC PIN, but it goes straight to the username/password login page after putting in my CAC PIN. I hadn't noticed any errors until tonight, after much troubleshooting:

KC-SERVICES0091: Request is missing scope 'openid' so it's not treated as OIDC, but just pure OAuth2 request.

3. The create-user.jar file breaks, heres a snippit:

ERROR: Failed to run 'build' command.
ERROR: io.quarkus.builder.BuildException: Build failure: Build failed due to errors
	[error]: Build step org.keycloak.quarkus.deployment.KeycloakProcessor#configureKeycloakSessionFactory threw an exception: java.util.ServiceConfigurationError: org.keycloak.authentication.AuthenticatorFactory: Provider org.keycloak.authentication.authenticators.x509.CnsX509ClientCertificateAuthenticatorFactory could not be instantiated
	at java.base/java.util.ServiceLoader.fail(ServiceLoader.java:586)
	at java.base/java.util.ServiceLoader$ProviderImpl.newInstance(ServiceLoader.java:813)
	at java.base/java.util.ServiceLoader$ProviderImpl.get(ServiceLoader.java:729)
	at java.base/java.util.ServiceLoader$3.next(ServiceLoader.java:1403)
	at org.keycloak.provider.DefaultProviderLoader.load(DefaultProviderLoader.java:60)
	at org.keycloak.provider.ProviderManager.load(ProviderManager.java:93)
	at org.keycloak.quarkus.deployment.KeycloakProcessor.loadFactories(KeycloakProcessor.java:690)
	at org.keycloak.quarkus.deployment.KeycloakProcessor.configureKeycloakSessionFactory(KeycloakProcessor.java:398)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)
	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.base/java.lang.reflect.Method.invoke(Method.java:568)
	at io.quarkus.deployment.ExtensionLoader$3.execute(ExtensionLoader.java:849)
	at io.quarkus.builder.BuildContext.run(BuildContext.java:256)
	at org.jboss.threads.ContextHandler$1.runWith(ContextHandler.java:18)
	at org.jboss.threads.EnhancedQueueExecutor$Task.run(EnhancedQueueExecutor.java:2513)
	at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1538)
	at java.base/java.lang.Thread.run(Thread.java:840)
	at org.jboss.threads.JBossThread.run(JBossThread.java:501)
Caused by: java.lang.NoClassDefFoundError: javax/ws/rs/core/MultivaluedMap
	at org.keycloak.authentication.authenticators.x509.CnsX509ClientCertificateAuthenticatorFactory.<clinit>(CnsX509ClientCertificateAuthenticatorFactory.java:28)
	at java.base/jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
	at java.base/jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:77)
	at java.base/jdk.internal.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
	at java.base/java.lang.reflect.Constructor.newInstanceWithCaller(Constructor.java:499)
	at java.base/java.lang.reflect.Constructor.newInstance(Constructor.java:480)
	at java.base/java.util.ServiceLoader$ProviderImpl.newInstance(ServiceLoader.java:789)
	... 17 more
Caused by: java.lang.ClassNotFoundException: javax.ws.rs.core.MultivaluedMap
	at io.quarkus.bootstrap.classloading.QuarkusClassLoader.loadClass(QuarkusClassLoader.java:520)
	at io.quarkus.bootstrap.classloading.QuarkusClassLoader.loadClass(QuarkusClassLoader.java:468)
	at io.quarkus.bootstrap.classloading.QuarkusClassLoader.loadClass(QuarkusClassLoader.java:518)
	at io.quarkus.bootstrap.classloading.QuarkusClassLoader.loadClass(QuarkusClassLoader.java:468)
	... 24 more

ERROR: Build failure: Build failed due to errors
	[error]: Build step org.keycloak.quarkus.deployment.KeycloakProcessor#configureKeycloakSessionFactory threw an exception: java.util.ServiceConfigurationError: org.keycloak.authentication.AuthenticatorFactory: Provider org.keycloak.authentication.authenticators.x509.CnsX509ClientCertificateAuthenticatorFactory could not be instantiated
	at java.base/java.util.ServiceLoader.fail(ServiceLoader.java:586)
	at java.base/java.util.ServiceLoader$ProviderImpl.newInstance(ServiceLoader.java:813)
	at java.base/java.util.ServiceLoader$ProviderImpl.get(ServiceLoader.java:729)
	at java.base/java.util.ServiceLoader$3.next(ServiceLoader.java:1403)
	at org.keycloak.provider.DefaultProviderLoader.load(DefaultProviderLoader.java:60)
	at org.keycloak.provider.ProviderManager.load(ProviderManager.java:93)
	at org.keycloak.quarkus.deployment.KeycloakProcessor.loadFactories(KeycloakProcessor.java:690)
	at org.keycloak.quarkus.deployment.KeycloakProcessor.configureKeycloakSessionFactory(KeycloakProcessor.java:398)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)
	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.base/java.lang.reflect.Method.invoke(Method.java:568)
	at io.quarkus.deployment.ExtensionLoader$3.execute(ExtensionLoader.java:849)
	at io.quarkus.builder.BuildContext.run(BuildContext.java:256)
	at org.jboss.threads.ContextHandler$1.runWith(ContextHandler.java:18)
	at org.jboss.threads.EnhancedQueueExecutor$Task.run(EnhancedQueueExecutor.java:2513)
	at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1538)
	at java.base/java.lang.Thread.run(Thread.java:840)
	at org.jboss.threads.JBossThread.run(JBossThread.java:501)
Caused by: java.lang.NoClassDefFoundError: javax/ws/rs/core/MultivaluedMap
	at org.keycloak.authentication.authenticators.x509.CnsX509ClientCertificateAuthenticatorFactory.<clinit>(CnsX509ClientCertificateAuthenticatorFactory.java:28)
	at java.base/jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
	at java.base/jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:77)
	at java.base/jdk.internal.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
	at java.base/java.lang.reflect.Constructor.newInstanceWithCaller(Constructor.java:499)
	at java.base/java.lang.reflect.Constructor.newInstance(Constructor.java:480)
	at java.base/java.util.ServiceLoader$ProviderImpl.newInstance(ServiceLoader.java:789)
	... 17 more
Caused by: java.lang.ClassNotFoundException: javax.ws.rs.core.MultivaluedMap
	at io.quarkus.bootstrap.classloading.QuarkusClassLoader.loadClass(QuarkusClassLoader.java:520)
	at io.quarkus.bootstrap.classloading.QuarkusClassLoader.loadClass(QuarkusClassLoader.java:468)
	at io.quarkus.bootstrap.classloading.QuarkusClassLoader.loadClass(QuarkusClassLoader.java:518)
	at io.quarkus.bootstrap.classloading.QuarkusClassLoader.loadClass(QuarkusClassLoader.java:468)
	... 24 more

ERROR: org.keycloak.authentication.AuthenticatorFactory: Provider org.keycloak.authentication.authenticators.x509.CnsX509ClientCertificateAuthenticatorFactory could not be instantiated
ERROR: javax/ws/rs/core/MultivaluedMap
ERROR: javax.ws.rs.core.MultivaluedMap

My docker-compose.yml for Keycloak 26.0.5:

services:
  auth:
    container_name: auth
    image: docker.io/keycloak/keycloak:latest
    command: start --import-realm file=/opt/keycloak/data/import/realm-export.json
    environment:
      # Setup metrics
      - KC_HEALTH_ENABLED=true
      - KC_METRICS_ENABLED=true
      - KC_HOSTNAME_DEBUG=true
      # Setup EDGE proxy
      - KC_HTTP_ENABLED=true
      - KC_PROXY_HEADERS=xforwarded
      - KC_HTTPS_CLIENT_AUTH=request
      # Setup hostname and username
      - KC_HOSTNAME=https://example.lab:8443
      - KC_HOSTNAME_ADMIN=https://example.lab:8443/kc
      - KC_BOOTSTRAP_ADMIN_USERNAME=
      - KC_BOOTSTRAP_ADMIN_PASSWORD=
      # Setup HTTPS certificate/key
      - KC_HTTPS_CERTIFICATE_FILE=/opt/keycloak/conf/truststores/example.lab.crt
      - KC_HTTPS_CERTIFICATE_KEY_FILE=/opt/keycloak/conf/truststores/example.lab.key
      # Setup x.509 certificates
      - KC_SPI_X509CERT_LOOKUP_PROVIDER=nginx
      - KC_SPI_X509CERT_LOOKUP_NGINX_SSL_CLIENT_CERT=SSL-CLIENT-CERT

Not really seeing any errors after logging in.

[stigman] | {"date":"2024-11-26T01:58:54.318Z","level":3,"component":"static","type":"transaction","data":{"request":{"date":"2024-11-26T01:58:54.314Z","source":"::ffff:10.89.4.44","method":"GET","url":"/","headers":{"host":"example.lab","x-real-ip":"10.89.4.44","x-forwarded-for":"10.89.4.44","x-forwarded-host":"example.lab","x-forwarded-server":"example.lab","x-forwarded-port":"8443","x-forwarded-proto":"https","connection":"close","upgrade-insecure-requests":"1","user-agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36","accept":"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7","sec-ch-ua":"\"Google Chrome\";v=\"131\", \"Chromium\";v=\"131\", \"Not_A Brand\";v=\"24\"","sec-ch-ua-mobile":"?0","sec-ch-ua-platform":"\"Windows\"","sec-fetch-site":"none","sec-fetch-mode":"navigate","sec-fetch-user":"?1","sec-fetch-dest":"document","accept-encoding":"gzip, deflate, br, zstd","accept-language":"en-US,en;q=0.9","authorization":false},"body":{}},"response":{"date":"2024-11-26T01:58:54.317Z","status":200,"headers":{"x-powered-by":"Express","access-control-allow-origin":"*","accept-ranges":"bytes","cache-control":"public, max-age=0","last-modified":"Tue, 19 Nov 2024 18:26:54 GMT","etag":"W/\"392-19345ad6db0\"","content-type":"text/html; charset=UTF-8","content-length":914,"vary":"Accept-Encoding"},"responseBody":""},"operationStats":{"durationMs":3}}}
[stigman] | {"date":"2024-11-26T01:58:54.334Z","level":3,"component":"static","type":"transaction","data":{"request":{"date":"2024-11-26T01:58:54.333Z","source":"::ffff:10.89.4.44","method":"GET","url":"/css/init.css","headers":{"host":"example.lab","x-real-ip":"10.89.4.44","x-forwarded-for":"10.89.4.44","x-forwarded-host":"example.lab","x-forwarded-server":"example.lab","x-forwarded-port":"8443","x-forwarded-proto":"https","connection":"close","sec-ch-ua-platform":"\"Windows\"","user-agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36","sec-ch-ua":"\"Google Chrome\";v=\"131\", \"Chromium\";v=\"131\", \"Not_A Brand\";v=\"24\"","sec-ch-ua-mobile":"?0","accept":"text/css,*/*;q=0.1","sec-fetch-site":"same-origin","sec-fetch-mode":"no-cors","sec-fetch-dest":"style","referer":"https://example.lab:8443/stigman/","accept-encoding":"gzip, deflate, br, zstd","accept-language":"en-US,en;q=0.9","if-none-match":"W/\"325-19345ad6db0\"","if-modified-since":"Tue, 19 Nov 2024 18:26:54 GMT","authorization":false},"body":{}},"response":{"date":"2024-11-26T01:58:54.333Z","status":304,"headers":{"x-powered-by":"Express","access-control-allow-origin":"*","accept-ranges":"bytes","cache-control":"public, max-age=0","last-modified":"Tue, 19 Nov 2024 18:26:54 GMT","etag":"W/\"325-19345ad6db0\""},"responseBody":""},"operationStats":{"durationMs":0}}}
[stigman] | {"date":"2024-11-26T01:58:54.338Z","level":3,"component":"static","type":"transaction","data":{"request":{"date":"2024-11-26T01:58:54.337Z","source":"::ffff:10.89.4.44","method":"GET","url":"/js/Env.js","headers":{"host":"example.lab","x-real-ip":"10.89.4.44","x-forwarded-for":"10.89.4.44","x-forwarded-host":"example.lab","x-forwarded-server":"example.lab","x-forwarded-port":"8443","x-forwarded-proto":"https","connection":"close","sec-ch-ua-platform":"\"Windows\"","user-agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36","sec-ch-ua":"\"Google Chrome\";v=\"131\", \"Chromium\";v=\"131\", \"Not_A Brand\";v=\"24\"","sec-ch-ua-mobile":"?0","accept":"*/*","sec-fetch-site":"same-origin","sec-fetch-mode":"no-cors","sec-fetch-dest":"script","referer":"https://example.lab:8443/stigman/","accept-encoding":"gzip, deflate, br, zstd","accept-language":"en-US,en;q=0.9","authorization":false},"body":{}},"response":{"date":"2024-11-26T01:58:54.338Z","status":200,"headers":{"x-powered-by":"Express","access-control-allow-origin":"*","content-type":"application/javascript","vary":"Accept-Encoding","content-encoding":"gzip"},"responseBody":""},"operationStats":{"durationMs":1}}}
[stigman] | {"date":"2024-11-26T01:58:54.344Z","level":3,"component":"static","type":"transaction","data":{"request":{"date":"2024-11-26T01:58:54.343Z","source":"::ffff:10.89.4.44","method":"GET","url":"/js/init.js","headers":{"host":"example.lab","x-real-ip":"10.89.4.44","x-forwarded-for":"10.89.4.44","x-forwarded-host":"example.lab","x-forwarded-server":"example.lab","x-forwarded-port":"8443","x-forwarded-proto":"https","connection":"close","origin":"https://example.lab:8443","sec-ch-ua-platform":"\"Windows\"","user-agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36","sec-ch-ua":"\"Google Chrome\";v=\"131\", \"Chromium\";v=\"131\", \"Not_A Brand\";v=\"24\"","sec-ch-ua-mobile":"?0","accept":"*/*","sec-fetch-site":"same-origin","sec-fetch-mode":"cors","sec-fetch-dest":"script","referer":"https://example.lab:8443/stigman/","accept-encoding":"gzip, deflate, br, zstd","accept-language":"en-US,en;q=0.9","if-none-match":"W/\"9fb-19345ad6db0\"","if-modified-since":"Tue, 19 Nov 2024 18:26:54 GMT","authorization":false},"body":{}},"response":{"date":"2024-11-26T01:58:54.344Z","status":304,"headers":{"x-powered-by":"Express","access-control-allow-origin":"*","accept-ranges":"bytes","cache-control":"public, max-age=0","last-modified":"Tue, 19 Nov 2024 18:26:54 GMT","etag":"W/\"9fb-19345ad6db0\""},"responseBody":""},"operationStats":{"durationMs":1}}}
[stigman] | {"date":"2024-11-26T01:58:54.346Z","level":3,"component":"static","type":"transaction","data":{"request":{"date":"2024-11-26T01:58:54.345Z","source":"::ffff:10.89.4.44","method":"GET","url":"/img/shield-green-check.svg","headers":{"host":"example.lab","x-real-ip":"10.89.4.44","x-forwarded-for":"10.89.4.44","x-forwarded-host":"example.lab","x-forwarded-server":"example.lab","x-forwarded-port":"8443","x-forwarded-proto":"https","connection":"close","sec-ch-ua-platform":"\"Windows\"","user-agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36","sec-ch-ua":"\"Google Chrome\";v=\"131\", \"Chromium\";v=\"131\", \"Not_A Brand\";v=\"24\"","sec-ch-ua-mobile":"?0","accept":"image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8","sec-fetch-site":"same-origin","sec-fetch-mode":"no-cors","sec-fetch-dest":"image","referer":"https://example.lab:8443/stigman/","accept-encoding":"gzip, deflate, br, zstd","accept-language":"en-US,en;q=0.9","if-none-match":"W/\"810-19345ad6db0\"","if-modified-since":"Tue, 19 Nov 2024 18:26:54 GMT","authorization":false},"body":{}},"response":{"date":"2024-11-26T01:58:54.345Z","status":304,"headers":{"x-powered-by":"Express","access-control-allow-origin":"*","accept-ranges":"bytes","cache-control":"public, max-age=0","last-modified":"Tue, 19 Nov 2024 18:26:54 GMT","etag":"W/\"810-19345ad6db0\""},"responseBody":""},"operationStats":{"durationMs":0}}}
[stigman] | {"date":"2024-11-26T01:58:54.349Z","level":3,"component":"static","type":"transaction","data":{"request":{"date":"2024-11-26T01:58:54.348Z","source":"::ffff:10.89.4.44","method":"GET","url":"/img/loading.svg","headers":{"host":"example.lab","x-real-ip":"10.89.4.44","x-forwarded-for":"10.89.4.44","x-forwarded-host":"example.lab","x-forwarded-server":"example.lab","x-forwarded-port":"8443","x-forwarded-proto":"https","connection":"close","sec-ch-ua-platform":"\"Windows\"","user-agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36","sec-ch-ua":"\"Google Chrome\";v=\"131\", \"Chromium\";v=\"131\", \"Not_A Brand\";v=\"24\"","sec-ch-ua-mobile":"?0","accept":"image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8","sec-fetch-site":"same-origin","sec-fetch-mode":"no-cors","sec-fetch-dest":"image","referer":"https://example.lab:8443/stigman/css/init.css","accept-encoding":"gzip, deflate, br, zstd","accept-language":"en-US,en;q=0.9","if-none-match":"W/\"230-19345ad6db0\"","if-modified-since":"Tue, 19 Nov 2024 18:26:54 GMT","authorization":false},"body":{}},"response":{"date":"2024-11-26T01:58:54.348Z","status":304,"headers":{"x-powered-by":"Express","access-control-allow-origin":"*","accept-ranges":"bytes","cache-control":"public, max-age=0","last-modified":"Tue, 19 Nov 2024 18:26:54 GMT","etag":"W/\"230-19345ad6db0\""},"responseBody":""},"operationStats":{"durationMs":0}}}[stigman] | {"date":"2024-11-26T01:58:54.352Z","level":3,"component":"static","type":"transaction","data":{"request":{"date":"2024-11-26T01:58:54.351Z","source":"::ffff:10.89.4.44","method":"GET","url":"/js/resources.js","headers":{"host":"example.lab","x-real-ip":"10.89.4.44","x-forwarded-for":"10.89.4.44","x-forwarded-host":"example.lab","x-forwarded-server":"example.lab","x-forwarded-port":"8443","x-forwarded-proto":"https","connection":"close","origin":"https://example.lab:8443","sec-ch-ua-platform":"\"Windows\"","user-agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36","sec-ch-ua":"\"Google Chrome\";v=\"131\", \"Chromium\";v=\"131\", \"Not_A Brand\";v=\"24\"","sec-ch-ua-mobile":"?0","accept":"*/*","sec-fetch-site":"same-origin","sec-fetch-mode":"cors","sec-fetch-dest":"script","referer":"https://example.lab:8443/stigman/js/init.js","accept-encoding":"gzip, deflate, br, zstd","accept-language":"en-US,en;q=0.9","if-none-match":"W/\"256-19345ad6db0\"","if-modified-since":"Tue, 19 Nov 2024 18:26:54 GMT","authorization":false},"body":{}},"response":{"date":"2024-11-26T01:58:54.352Z","status":304,"headers":{"x-powered-by":"Express","access-control-allow-origin":"*","accept-ranges":"bytes","cache-control":"public, max-age=0","last-modified":"Tue, 19 Nov 2024 18:26:54 GMT","etag":"W/\"256-19345ad6db0\""},"responseBody":""},"operationStats":{"durationMs":1}}}
[stigman] | {"date":"2024-11-26T01:58:54.353Z","level":3,"component":"static","type":"transaction","data":{"request":{"date":"2024-11-26T01:58:54.353Z","source":"::ffff:10.89.4.44","method":"GET","url":"/js/modules/oidcProvider.js","headers":{"host":"example.lab","x-real-ip":"10.89.4.44","x-forwarded-for":"10.89.4.44","x-forwarded-host":"example.lab","x-forwarded-server":"example.lab","x-forwarded-port":"8443","x-forwarded-proto":"https","connection":"close","origin":"https://example.lab:8443","sec-ch-ua-platform":"\"Windows\"","user-agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36","sec-ch-ua":"\"Google Chrome\";v=\"131\", \"Chromium\";v=\"131\", \"Not_A Brand\";v=\"24\"","sec-ch-ua-mobile":"?0","accept":"*/*","sec-fetch-site":"same-origin","sec-fetch-mode":"cors","sec-fetch-dest":"script","referer":"https://example.lab:8443/stigman/js/init.js","accept-encoding":"gzip, deflate, br, zstd","accept-language":"en-US,en;q=0.9","if-none-match":"W/\"22d6-19345ad6db0\"","if-modified-since":"Tue, 19 Nov 2024 18:26:54 GMT","authorization":false},"body":{}},"response":{"date":"2024-11-26T01:58:54.353Z","status":304,"headers":{"x-powered-by":"Express","access-control-allow-origin":"*","accept-ranges":"bytes","cache-control":"public, max-age=0","last-modified":"Tue, 19 Nov 2024 18:26:54 GMT","etag":"W/\"22d6-19345ad6db0\""},"responseBody":""},"operationStats":{"durationMs":0}}}
[stigman] | {"date":"2024-11-26T01:58:55.937Z","level":3,"component":"static","type":"transaction","data":{"request":{"date":"2024-11-26T01:58:55.935Z","source":"::ffff:10.89.4.44","method":"GET","url":"/serviceWorker.js","headers":{"host":"example.lab","x-real-ip":"10.89.4.44","x-forwarded-for":"10.89.4.44","x-forwarded-host":"example.lab","x-forwarded-server":"example.lab","x-forwarded-port":"8443","x-forwarded-proto":"https","connection":"close","cache-control":"max-age=0","accept":"*/*","service-worker":"script","sec-fetch-site":"same-origin","sec-fetch-mode":"same-origin","sec-fetch-dest":"serviceworker","referer":"https://example.lab:8443/stigman/serviceWorker.js","user-agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36","accept-encoding":"gzip, deflate, br, zstd","accept-language":"en-US,en;q=0.9","authorization":false},"body":{}},"response":{"date":"2024-11-26T01:58:55.936Z","status":200,"headers":{"x-powered-by":"Express","access-control-allow-origin":"*","accept-ranges":"bytes","cache-control":"public, max-age=0","last-modified":"Tue, 19 Nov 2024 18:26:55 GMT","etag":"W/\"4e4-19345ad7198\"","content-type":"application/javascript; charset=UTF-8","vary":"Accept-Encoding","content-encoding":"gzip"},"responseBody":""},"operationStats":{"durationMs":1}}}

Any help is greatly appreciated!

Very respectfully

[localhostDJT]

After reviewing the stigman-auth github page, I saw the @csmig updated the realm-import file for Keycloak version 26.0.6 yesterday, I am no longer receiving this error when logging in:
KC-SERVICES0091: Request is missing scope 'openid' so it's not treated as OIDC, but just pure OAuth2 request.

No changes other than that.

[codwow]

Create-user.jar is from another repo separate from stig manager. I know they had an issue open for a while to support v20+ of keycloak lscorcia/keycloak-cns-authenticator#4.

[jace5869]

If we want CAC auth and not use this custom auth do we have to setup LDAP and a custom attribute mapper to get it working?

[codwow]

You don't have to setup LDAP to use cac authentication, for our deployment we decided to manual create users instead.

[jace5869]

We can't manually create all of our users.
I couldn't get the orch repo to create users that didn't exist.

So I setup leap and have people use their email instead. However people like SSO and using their pin so trying to figure out how to leverage the leap sync and attributes on the piv for login