nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.

Alfresco ACS 6.1.2ga SSO Authentification with keycloak duplicating users

pedrohernandez

Hello Everybody and thanks in advance for your help.

We are implementing authentification with keycloak version keycloak: 4.8.3. Final, and we're having the issue that when logging in with any user, it enters in a loop while logging and it creates several duplicate users in alfresco, we wanted to know if this a known issue or maybe my configuration is wrong. find images below, also we're deploying the applications with docker, if you need futher information let me know. thanks:

PD: image shows how user Pedro is duplicated 2 times.

PD: Also it creates a folder for every duplicated user.

Docker configuration looks like this:

ADF configuration looks like this:

Bellow you can find attached alfresco logs while logging in and the alfresco-realm.json.

we followed this guide to configure our applications.

https://community.alfresco.com/people/gravitonian/blog/2018/07/17/getting-started-with-alfresco-identity-service-ea-keycloak

Again, Thanks for your time and help.

Regards,

Pedro.

alfresco-realm.json.zip

alfresco.log.zip

Find more posts tagged with

Alfresco Content Services

Comments

afaust

Interesting... it shouldn't actually be possible to create users with exactly the same name due to uniqueness constraints on the user name. I would bet this may not be a known issue (did you search JIRA for it?), since 6.1.2 GA is quite a new release and not a lot of people are using Alfresco with Keycloak yet, especially since Share does not support it for single sign-on purposes.

pedrohernandez

Axel, Thank you for your time.

I was looking in JIRA and couldn't find information, but first time using JIRA so I may have miss something. Some more information about the issue is that the logging is being made through ADF components, and when I logging it throw this exceptions on the logs:

INFO [security.person.PersonServiceImpl] [http-nio-8080-exec-9] Splitting 1 duplicate person objects. then again:

INFO [security.person.PersonServiceImpl] [http-nio-8080-exec-5] Splitting 2 duplicate person objects.

then:

[36malfresco_1 | [0m 2019-03-20 15:33:32,947 INFO [security.person.PersonServiceImpl] [http-nio-8080-exec-2] Splitting 2 duplicate person objects.
[36malfresco_1 | [0m 2019-03-20 15:33:32,974 INFO [security.person.PersonServiceImpl] [http-nio-8080-exec-9] Splitting 2 duplicate person objects.
[36malfresco_1 | [0m 2019-03-20 15:33:33,001 INFO [security.person.PersonServiceImpl] [http-nio-8080-exec-1] Splitting 2 duplicate person objects.

INFO [security.person.PersonServiceImpl] [http-nio-8080-exec-7] Splitting 2 duplicate person objects.
INFO [security.person.PersonServiceImpl] [http-nio-8080-exec-7] New person object: pedrodc7c953d-5366-482e-8ca6-ab0ca533f9d5
INFO [security.person.PersonServiceImpl] [http-nio-8080-exec-7] New person object: pedroc3454366-51e9-47f3-b6b9-88e5e8e75b2e
[security.person.PersonServiceImpl] [http-nio-8080-exec-7] Split 2 duplicate person objects.

afaust

Ahh... that split handling is a very specific segment of code where Alfresco internally sets a special flag to allow duplicate user IDs for the transaction in which they are created. Come to look at it, this specific code has been in Alfresco for a long time. It is triggered only when more than one person with the identical name already exists, so it is only responsible for any subsequent duplication but not for the very first one. Essentially, it can split person objects in every read-write transaction where a specific lookup API is called/invoked in Java.

pedrohernandez

So that means that the issue is currently happening during the login process that is making several calls to create the same user?, if so. maybe to correctly test this is to use https://github.com/Alfresco/alfresco-content-app, that to my knowledge is tested with ACS 6.1 and integration with keycloak was working fine?, if this test have the same results duplicating the users then maybe I can create an issue in JIRA.

Or maybe should I take another approach?, what do you think?

Thanks for your time.

Regards.