Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-63162

jenkins keycloak infinite loop with PKI certificate path error under kubernetes

    XMLWordPrintable

Details

    • Task
    • Resolution: Unresolved
    • Minor
    • keycloak-plugin
    • None
    • Test

    Description

      I have kubernetes cluster in which we have jenkins with ingress controller for ssl termination which works fine.  Once I integrate with key cloak, it is going into infinite loop and got below jenkins in pod log.  It seems ca cert issue in Jenkins.  How to update ca cert in ingress controller or in Jenkins.  Kindly advice. 

      2020-07-22 12:04:46.516+0000 [id=57] SEVERE o.j.p.KeycloakSecurityRealm#doFinishLogin: Authentication Exception
      sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
      at sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:141)
      at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:126)
      at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:280)
      at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:445)
      Caused: sun.security.validator.ValidatorException: PKIX path building failed
      at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:450)
      at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:317)
      at sun.security.validator.Validator.validate(Validator.java:262)
      at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:330)
      at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:237)
      at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:132)
      at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1621)
      Caused: javax.net.ssl.SSLHandshakeException
      at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)
      at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1946)
      at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:316)
      at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:310)
      at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1639)
      at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:223)
      at sun.security.ssl.Handshaker.processLoop(Handshaker.java:1037)
      at sun.security.ssl.Handshaker.process_record(Handshaker.java:965)
      at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1064)
      at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1367)
      at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1395)
      at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1379)
      at org.apache.http.conn.ssl.SSLSocketFactory.connectSocket(SSLSocketFactory.java:553)
      at org.keycloak.adapters.SniSSLSocketFactory.connectSocket(SniSSLSocketFactory.java:109)
      at org.apache.http.conn.ssl.SSLSocketFactory.connectSocket(SSLSocketFactory.java:412)
      at org.apache.http.impl.conn.DefaultClientConnectionOperator.openConnection(DefaultClientConnectionOperator.java:179)
      at org.apache.http.impl.conn.AbstractPoolEntry.open(AbstractPoolEntry.java:144)
      at org.apache.http.impl.conn.AbstractPooledConnAdapter.open(AbstractPooledConnAdapter.java:134)
      at org.apache.http.impl.client.DefaultRequestDirector.tryConnect(DefaultRequestDirector.java:612)
      at org.apache.http.impl.client.DefaultRequestDirector.execute(DefaultRequestDirector.java:447)
      at org.apache.http.impl.client.AbstractHttpClient.doExecute(AbstractHttpClient.java:884)
      at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:82)
      at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:107)
      at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:55)
      at org.keycloak.adapters.ServerRequest.invokeAccessCodeToToken(ServerRequest.java:111)
      at org.jenkinsci.plugins.KeycloakSecurityRealm.doFinishLogin(KeycloakSecurityRealm.java:227)
      at java.lang.invoke.MethodHandle.invokeWithArguments(MethodHandle.java:627)
      at org.kohsuke.stapler.Function$MethodFunction.invoke(Function.java:396)
      at org.kohsuke.stapler.Function$InstanceFunction.invoke(Function.java:408)
      at org.kohsuke.stapler.Function.bindAndInvoke(Function.java:212)
      at org.kohsuke.stapler.Function.bindAndInvokeAndServeResponse(Function.java:145)
      at org.kohsuke.stapler.MetaClass$11.doDispatch(MetaClass.java:535)
      at org.kohsuke.stapler.NameBasedDispatcher.dispatch(NameBasedDispatcher.java:58)
      at org.kohsuke.stapler.Stapler.tryInvoke(Stapler.java:747)
      at org.kohsuke.stapler.Stapler.invoke(Stapler.java:878)
      at org.kohsuke.stapler.MetaClass$2.doDispatch(MetaClass.java:219)
      at org.kohsuke.stapler.NameBasedDispatcher.dispatch(NameBasedDispatcher.java:58)
      at org.kohsuke.stapler.Stapler.tryInvoke(Stapler.java:747)
      at org.kohsuke.stapler.Stapler.invoke(Stapler.java:878)
      at org.kohsuke.stapler.Stapler.invoke(Stapler.java:676)
      at org.kohsuke.stapler.Stapler.service(Stapler.java:238)
      at javax.servlet.http.HttpServlet.service(HttpServlet.java:790)
      at org.eclipse.jetty.servlet.ServletHolder.handle(ServletHolder.java:755)
      at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1617)
      at hudson.util.PluginServletFilter$1.doFilter(PluginServletFilter.java:154)
      at org.jenkinsci.plugins.RefreshFilter.doFilter(RefreshFilter.java:96)
      at hudson.util.PluginServletFilter$1.doFilter(PluginServletFilter.java:151)
      at jenkins.security.ResourceDomainFilter.doFilter(ResourceDomainFilter.java:76)
      at hudson.util.PluginServletFilter$1.doFilter(PluginServletFilter.java:151)
      at jenkins.telemetry.impl.UserLanguages$AcceptLanguageFilter.doFilter(UserLanguages.java:128)
      at hudson.util.PluginServletFilter$1.doFilter(PluginServletFilter.java:151)
      at hudson.util.PluginServletFilter.doFilter(PluginServletFilter.java:157)
      at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1604)
      at hudson.security.csrf.CrumbFilter.doFilter(CrumbFilter.java:159)
      at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1604)
      at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:84)
      at hudson.security.UnwrapSecurityExceptionFilter.doFilter(UnwrapSecurityExceptionFilter.java:51)
      at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
      at jenkins.security.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:119)
      at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
      at org.acegisecurity.providers.anonymous.AnonymousProcessingFilter.doFilter(AnonymousProcessingFilter.java:125)
      at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
      at org.acegisecurity.ui.rememberme.RememberMeProcessingFilter.doFilter(RememberMeProcessingFilter.java:135)
      at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
      at org.acegisecurity.ui.AbstractProcessingFilter.doFilter(AbstractProcessingFilter.java:271)
      at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
      at jenkins.security.BasicHeaderProcessor.doFilter(BasicHeaderProcessor.java:93)
      at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
      at org.acegisecurity.context.HttpSessionContextIntegrationFilter.doFilter(HttpSessionContextIntegrationFilter.java:249)
      at hudson.security.HttpSessionContextIntegrationFilter2.doFilter(HttpSessionContextIntegrationFilter2.java:67)
      at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
      at hudson.security.ChainedServletFilter.doFilter(ChainedServletFilter.java:90)
      at hudson.security.HudsonFilter.doFilter(HudsonFilter.java:171)
      at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1604)
      at org.kohsuke.stapler.compression.CompressionFilter.doFilter(CompressionFilter.java:49)
      at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1604)
      at hudson.util.CharacterEncodingFilter.doFilter(CharacterEncodingFilter.java:82)
      at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1604)
      at org.kohsuke.stapler.DiagnosticThreadNameFilter.doFilter(DiagnosticThreadNameFilter.java:30)
      at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1604)
      at jenkins.security.SuspiciousRequestFilter.doFilter(SuspiciousRequestFilter.java:36)
      at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1604)
      at org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:545)
      at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:143)
      at org.eclipse.jetty.security.SecurityHandler.handle(SecurityHandler.java:566)
      at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:127)
      at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:235)
      at org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:1610)
      at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:233)
      at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1300)
      at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:188)
      at org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:485)
      at org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:1580)
      at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:186)
      at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1215)
      at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:141)
      at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:127)
      at org.eclipse.jetty.server.Server.handle(Server.java:500)
      at org.eclipse.jetty.server.HttpChannel.lambda$handle$1(HttpChannel.java:383)
      at org.eclipse.jetty.server.HttpChannel.dispatch(HttpChannel.java:547)
      at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:375)
      at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:273)
      at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:311)
      at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:103)
      at org.eclipse.jetty.io.ChannelEndPoint$2.run(ChannelEndPoint.java:117)
      at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:806)
      at org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.run(QueuedThreadPool.java:938)

      Attachments

        Activity

          People

            devlauer D. Lauer
            elangovanse Selvam Elangovan
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

            Dates

              Created:
              Updated: