KeyCloak Example Implementation

[giannischou]

Hello,

I would like to ask if there is anyone who could provide me (in detail) the necessary steps in order to run the AppAuth demo with the KeyCloak as Identity Provider, on Android Studio (Java).

Thanks in advance!

[agologan]

1. Add a new client in KeyCloak (configure/clients)

• remember the Client ID you set as you'll need to configure AppAuth
• on your client add some Valid Redirect URIs e.g. myapp://auth

2. Edit auth_config.json in the demo app

  "client_id":  <previously set client ID>,
  "redirect_uri": "myapp://auth",
  "end_session_redirect_uri":"myapp://auth",
  "authorization_scope": "openid email profile",
  "discovery_uri": "https://<my_server>/auth/realms/<my_realm>/.well-known/openid-configuration",

And that should be it.

[giannischou]

Thanks for the quick response!

That's my auth_config.json

{
  "client_id": "oidc",
  "redirect_uri": "net.openid.appauthdemo://auth",
  "end_session_redirect_uri": "net.openid.appauthdemo://auth",
  "authorization_scope": "openid email profile",
  "discovery_uri": "https://192.168.1.3:8080/auth/realms/OIDC/.well-known/openid-configuration",
  "authorization_endpoint": "",
  "token_endpoint": "",
  "registration_endpoint": "",
  "userinfo_endpoint": "",
  "end_session_endpoint":"",
  "https_required": true
}

However, I got this error when running the emulator on Android Studio:

E/AppAuth: Network error when retrieving discovery document
    javax.net.ssl.SSLHandshakeException: Handshake failed
        at com.android.org.conscrypt.ConscryptFileDescriptorSocket.startHandshake(ConscryptFileDescriptorSocket.java:288)
        at com.android.okhttp.internal.io.RealConnection.connectTls(RealConnection.java:196)
        at com.android.okhttp.internal.io.RealConnection.connectSocket(RealConnection.java:153)
        at com.android.okhttp.internal.io.RealConnection.connect(RealConnection.java:116)
        at com.android.okhttp.internal.http.StreamAllocation.findConnection(StreamAllocation.java:186)
        at com.android.okhttp.internal.http.StreamAllocation.findHealthyConnection(StreamAllocation.java:128)
        at com.android.okhttp.internal.http.StreamAllocation.newStream(StreamAllocation.java:97)
        at com.android.okhttp.internal.http.HttpEngine.connect(HttpEngine.java:289)
        at com.android.okhttp.internal.http.HttpEngine.sendRequest(HttpEngine.java:232)
        at com.android.okhttp.internal.huc.HttpURLConnectionImpl.execute(HttpURLConnectionImpl.java:465)
        at com.android.okhttp.internal.huc.HttpURLConnectionImpl.connect(HttpURLConnectionImpl.java:131)
        at com.android.okhttp.internal.huc.DelegatingHttpsURLConnection.connect(DelegatingHttpsURLConnection.java:90)
        at com.android.okhttp.internal.huc.HttpsURLConnectionImpl.connect(HttpsURLConnectionImpl.java:30)
        at net.openid.appauth.AuthorizationServiceConfiguration$ConfigurationRetrievalAsyncTask.doInBackground(AuthorizationServiceConfiguration.java:383)
        at net.openid.appauth.AuthorizationServiceConfiguration$ConfigurationRetrievalAsyncTask.doInBackground(AuthorizationServiceConfiguration.java:358)
        at android.os.AsyncTask$3.call(AsyncTask.java:378)
        at java.util.concurrent.FutureTask.run(FutureTask.java:266)
        at android.os.AsyncTask$SerialExecutor$1.run(AsyncTask.java:289)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1167)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:641)
        at java.lang.Thread.run(Thread.java:919)
     Caused by: javax.net.ssl.SSLProtocolException: SSL handshake aborted: ssl=0xe5f92c08: Failure in SSL library, usually a protocol error
    error:100000f7:SSL routines:OPENSSL_internal:WRONG_VERSION_NUMBER (external/boringssl/src/ssl/tls_record.cc:242 0xd8277543:0x00000000)
        at com.android.org.conscrypt.NativeCrypto.SSL_do_handshake(Native Method)
        at com.android.org.conscrypt.NativeSsl.doHandshake(NativeSsl.java:387)
        at com.android.org.conscrypt.ConscryptFileDescriptorSocket.startHandshake(ConscryptFileDescriptorSocket.java:226)
        	... 20 more
D/EGL_emulation: eglMakeCurrent: 0xddf1a3c0: ver 3 0 (tinfo 0xddf0f910)
D/eglCodecCommon: setVertexArrayObject: set vao to 0 (0) 1 0
I/LoginActivity: Failed to retrieve discovery document
    AuthorizationException: {"type":0,"code":3,"errorDescription":"Network error"}
        at net.openid.appauth.AuthorizationServiceConfiguration$ConfigurationRetrievalAsyncTask.doInBackground(AuthorizationServiceConfiguration.java:393)
        at net.openid.appauth.AuthorizationServiceConfiguration$ConfigurationRetrievalAsyncTask.doInBackground(AuthorizationServiceConfiguration.java:358)
        at android.os.AsyncTask$3.call(AsyncTask.java:378)
        at java.util.concurrent.FutureTask.run(FutureTask.java:266)
        at android.os.AsyncTask$SerialExecutor$1.run(AsyncTask.java:289)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1167)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:641)
        at java.lang.Thread.run(Thread.java:919)
     Caused by: javax.net.ssl.SSLHandshakeException: Handshake failed
        at com.android.org.conscrypt.ConscryptFileDescriptorSocket.startHandshake(ConscryptFileDescriptorSocket.java:288)
        at com.android.okhttp.internal.io.RealConnection.connectTls(RealConnection.java:196)
        at com.android.okhttp.internal.io.RealConnection.connectSocket(RealConnection.java:153)
        at com.android.okhttp.internal.io.RealConnection.connect(RealConnection.java:116)
        at com.android.okhttp.internal.http.StreamAllocation.findConnection(StreamAllocation.java:186)
        at com.android.okhttp.internal.http.StreamAllocation.findHealthyConnection(StreamAllocation.java:128)
        at com.android.okhttp.internal.http.StreamAllocation.newStream(StreamAllocation.java:97)
        at com.android.okhttp.internal.http.HttpEngine.connect(HttpEngine.java:289)
        at com.android.okhttp.internal.http.HttpEngine.sendRequest(HttpEngine.java:232)
        at com.android.okhttp.internal.huc.HttpURLConnectionImpl.execute(HttpURLConnectionImpl.java:465)
        at com.android.okhttp.internal.huc.HttpURLConnectionImpl.connect(HttpURLConnectionImpl.java:131)
        at com.android.okhttp.internal.huc.DelegatingHttpsURLConnection.connect(DelegatingHttpsURLConnection.java:90)
        at com.android.okhttp.internal.huc.HttpsURLConnectionImpl.connect(HttpsURLConnectionImpl.java:30)
        at net.openid.appauth.AuthorizationServiceConfiguration$ConfigurationRetrievalAsyncTask.doInBackground(AuthorizationServiceConfiguration.java:383)
        at net.openid.appauth.AuthorizationServiceConfiguration$ConfigurationRetrievalAsyncTask.doInBackground(AuthorizationServiceConfiguration.java:358) 
        at android.os.AsyncTask$3.call(AsyncTask.java:378) 
        at java.util.concurrent.FutureTask.run(FutureTask.java:266) 
        at android.os.AsyncTask$SerialExecutor$1.run(AsyncTask.java:289) 
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1167) 
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:641) 
        at java.lang.Thread.run(Thread.java:919) 
     Caused by: javax.net.ssl.SSLProtocolException: SSL handshake aborted: ssl=0xe5f92c08: Failure in SSL library, usually a protocol error
    error:100000f7:SSL routines:OPENSSL_internal:WRONG_VERSION_NUMBER (external/boringssl/src/ssl/tls_record.cc:242 0xd8277543:0x00000000)
        at com.android.org.conscrypt.NativeCrypto.SSL_do_handshake(Native Method)
        at com.android.org.conscrypt.NativeSsl.doHandshake(NativeSsl.java:387)
        at com.android.org.conscrypt.ConscryptFileDescriptorSocket.startHandshake(ConscryptFileDescriptorSocket.java:226)
        	... 20 more
I/nid.appauthdem: Background young concurrent copying GC freed 9224(1168KB) AllocSpace objects, 7(268KB) LOS objects, 77% free, 1791KB/7935KB, paused 57us total 116.893ms

**Note: I changed my discovery_uri from http to https, because the was crashing instantly when trying to run on the emulator, and then I got the error above!

[giannischou]

I also tried to use all the other URIs needed, except the eiscovery_uri as it's shown below in a new auth_config.json:

{
  "client_id": "oidc",
  "redirect_uri": "net.openid.appauthdemo://auth",
  "end_session_redirect_uri": "net.openid.appauthdemo://auth",
  "authorization_scope": "openid email profile",
  "discovery_uri": "",
  "authorization_endpoint_uri": "http://192.168.1.3:8080/auth/realms/OIDC/protocol/openid-connect/auth",
  "token_endpoint_uri": "http://192.168.1.3:8080/auth/realms/OIDC/protocol/openid-connect/token",
  "registration_endpoint_uri": "http://192.168.1.3:8080/auth/realms/OIDC/clients-registrations/openid-connect",
  "user_info_endpoint_uri": "http://192.168.1.3:8080/auth/realms/OIDC/protocol/openid-connect/userinfo",
  "end_session_endpoint":"http://192.168.1.3:8080/auth/realms/OIDC/protocol/openid-connect/logout",
  "https_required": true
}

And I get the following error:

04/23 13:47:37: Launching 'app' on Pixel 3a API 29.
Install successfully finished in 730 ms.
$ adb shell am start -n "net.openid.appauthdemo/net.openid.appauthdemo.LoginActivity" -a android.intent.action.MAIN -c android.intent.category.LAUNCHER
Connected to process 18665 on device 'emulator-5554'.
Capturing and displaying logcat messages from application. This behavior can be disabled in the "Logcat output" section of the "Debugger" settings page.
D/libEGL: Emulator has host GPU support, qemu.gles is set to 1.
W/libc: Unable to set property "qemu.gles" to "1": connection failed; errno=13 (Permission denied)
W/RenderThread: type=1400 audit(0.0:182): avc: denied { write } for name="property_service" dev="tmpfs" ino=24 scontext=u:r:untrusted_app:s0:c161,c256,c512,c768 tcontext=u:object_r:property_socket:s0 tclass=sock_file permissive=0
D/libEGL: loaded /vendor/lib/egl/libEGL_emulation.so
D/libEGL: loaded /vendor/lib/egl/libGLESv1_CM_emulation.so
D/libEGL: loaded /vendor/lib/egl/libGLESv2_emulation.so
W/nid.appauthdem: Accessing hidden method Landroid/view/View;->computeFitSystemWindows(Landroid/graphics/Rect;Landroid/graphics/Rect;)Z (greylist, reflection, allowed)
    Accessing hidden method Landroid/view/ViewGroup;->makeOptionalFitsSystemWindows()V (greylist, reflection, allowed)
I/LoginActivity: Configuration change detected, discarding old state
I/LoginActivity: Initializing AppAuth
    Creating authorization service
I/LoginActivity: Creating auth config from res/raw/auth_config.json
I/LoginActivity: Using static client ID: oidc
D/HostConnection: HostConnection::get() New Host Connection established 0xddf56190, tid 18727
D/HostConnection: HostComposition ext ANDROID_EMU_CHECKSUM_HELPER_v1 ANDROID_EMU_native_sync_v2 ANDROID_EMU_native_sync_v3 ANDROID_EMU_native_sync_v4 ANDROID_EMU_dma_v1 ANDROID_EMU_direct_mem ANDROID_EMU_host_composition_v1 ANDROID_EMU_host_composition_v2 ANDROID_EMU_YUV420_888_to_NV21 ANDROID_EMU_YUV_Cache ANDROID_EMU_async_unmap_buffer GL_OES_EGL_image_external_essl3 GL_OES_vertex_array_object GL_KHR_texture_compression_astc_ldr ANDROID_EMU_host_side_tracing ANDROID_EMU_async_frame_commands ANDROID_EMU_gles_max_version_3_0 
W/OpenGLRenderer: Failed to choose config with EGL_SWAP_BEHAVIOR_PRESERVED, retrying without...
D/eglCodecCommon: setVertexArrayObject: set vao to 0 (0) 0 0
D/EGL_emulation: eglCreateContext: 0xddf1a3c0: maj 3 min 0 rcv 3
D/EGL_emulation: eglMakeCurrent: 0xddf1a3c0: ver 3 0 (tinfo 0xddf0f910)
W/Gralloc3: mapper 3.x is not supported
D/HostConnection: createUnique: call
    HostConnection::get() New Host Connection established 0xddf56550, tid 18727
D/HostConnection: HostComposition ext ANDROID_EMU_CHECKSUM_HELPER_v1 ANDROID_EMU_native_sync_v2 ANDROID_EMU_native_sync_v3 ANDROID_EMU_native_sync_v4 ANDROID_EMU_dma_v1 ANDROID_EMU_direct_mem ANDROID_EMU_host_composition_v1 ANDROID_EMU_host_composition_v2 ANDROID_EMU_YUV420_888_to_NV21 ANDROID_EMU_YUV_Cache ANDROID_EMU_async_unmap_buffer GL_OES_EGL_image_external_essl3 GL_OES_vertex_array_object GL_KHR_texture_compression_astc_ldr ANDROID_EMU_host_side_tracing ANDROID_EMU_async_frame_commands ANDROID_EMU_gles_max_version_3_0 
D/eglCodecCommon: allocate: Ask for block of size 0x1000
    allocate: ioctl allocate returned offset 0x3ffff4000 size 0x2000
D/EGL_emulation: eglMakeCurrent: 0xddf1a3c0: ver 3 0 (tinfo 0xddf0f910)
D/eglCodecCommon: setVertexArrayObject: set vao to 0 (0) 1 0
I/LoginActivity: Creating auth request for login hint: 
I/LoginActivity: Warming up browser instance for auth request
I/LoginActivity: Creating auth request for login hint: xoux
I/LoginActivity: Warming up browser instance for auth request
I/LoginActivity: Creating auth request for login hint: xoux66
I/LoginActivity: Warming up browser instance for auth request
W/ActivityThread: handleWindowVisibility: no activity for token android.os.BinderProxy@321e954
D/EGL_emulation: eglMakeCurrent: 0xddf1a3c0: ver 3 0 (tinfo 0xddf0f910)
D/EGL_emulation: eglMakeCurrent: 0xddf1a3c0: ver 3 0 (tinfo 0xddf0f910)
D/EGL_emulation: eglMakeCurrent: 0xddf1a3c0: ver 3 0 (tinfo 0xddf0f910)
D/EGL_emulation: eglMakeCurrent: 0xddf1a3c0: ver 3 0 (tinfo 0xddf0f910)
D/EGL_emulation: eglMakeCurrent: 0xddf1a3c0: ver 3 0 (tinfo 0xddf0f910)
W/ActivityThread: handleWindowVisibility: no activity for token android.os.BinderProxy@7c98531
D/EGL_emulation: eglMakeCurrent: 0xddf1a3c0: ver 3 0 (tinfo 0xddf0f910)
W/ActivityThread: handleWindowVisibility: no activity for token android.os.BinderProxy@fb7325
E/AndroidRuntime: FATAL EXCEPTION: AsyncTask #1
    Process: net.openid.appauthdemo, PID: 18665
    java.lang.RuntimeException: An error occurred while executing doInBackground()
        at android.os.AsyncTask$4.done(AsyncTask.java:399)
        at java.util.concurrent.FutureTask.finishCompletion(FutureTask.java:383)
        at java.util.concurrent.FutureTask.setException(FutureTask.java:252)
        at java.util.concurrent.FutureTask.run(FutureTask.java:271)
        at android.os.AsyncTask$SerialExecutor$1.run(AsyncTask.java:289)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1167)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:641)
        at java.lang.Thread.run(Thread.java:919)
     Caused by: java.lang.IllegalArgumentException: only https connections are permitted
        at net.openid.appauth.Preconditions.checkArgument(Preconditions.java:116)
        at net.openid.appauth.connectivity.DefaultConnectionBuilder.openConnection(DefaultConnectionBuilder.java:51)
        at net.openid.appauth.AuthorizationService$TokenRequestTask.doInBackground(AuthorizationService.java:597)
        at net.openid.appauth.AuthorizationService$TokenRequestTask.doInBackground(AuthorizationService.java:564)
        at android.os.AsyncTask$3.call(AsyncTask.java:378)
        at java.util.concurrent.FutureTask.run(FutureTask.java:266)
        at android.os.AsyncTask$SerialExecutor$1.run(AsyncTask.java:289) 
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1167) 
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:641) 
        at java.lang.Thread.run(Thread.java:919) 
I/Process: Sending signal. PID: 18665 SIG: 9

Which I believe, it has something to do with the Activity Token of the Demo!

Thanks in advance!

[agologan]

Your first log reads: javax.net.ssl.SSLHandshakeException: Handshake failed
Judging by your second config you don't support https in your environment so you should change your discovery URI to http.

The second log reads: java.lang.IllegalArgumentException: only https connections are permitted
You need to switch your config for testing to "https_required": false

If you're running a local test without SSL you'll also need to provide setSkipIssuerHttpsCheck - https://github.com/openid/AppAuth-Android#issues-with-id-token-validation

[giannischou]

Your first log reads: javax.net.ssl.SSLHandshakeException: Handshake failed
Judging by your second config you don't support https in your environment so you should change your discovery URI to http.

The second log reads: java.lang.IllegalArgumentException: only https connections are permitted
You need to switch your config for testing to "https_required": false

If you're running a local test without SSL you'll also need to provide setSkipIssuerHttpsCheck - https://github.com/openid/AppAuth-Android#issues-with-id-token-validation

Hello there again! I tried to set HTTPS/SSL for the Keycloak as it is written in its Documentation, but I could not get it done properly. Could you please provide me with some right guidelines in order to run Keycloak on HTTPS, so that I could finally complete the "discovery_uri" as it is supposed to be?

Thanks in advance!

[agologan]

I'm sorry but configuring SSL for your service is really outside the scope of this issue.
Please take it up with the KeyCloak team if you were trying to configure a keystore and their instructions are not working for you.
For a more complex topology please address it with your cloud or on-prem service provider.

[jorpaspr]

Just switching the config to "https_required": false won't be enough, as the DefaultConnectionBuilder will enforce HTTPS internally:

@NonNull
@Override
public HttpURLConnection openConnection(@NonNull Uri uri) throws IOException {
    Preconditions.checkNotNull(uri, "url must not be null");
    Preconditions.checkArgument(HTTPS_SCHEME.equals(uri.getScheme()),
            "only https connections are permitted");
    HttpURLConnection conn = (HttpURLConnection) new URL(uri.toString()).openConnection();
    conn.setConnectTimeout(CONNECTION_TIMEOUT_MS);
    conn.setReadTimeout(READ_TIMEOUT_MS);
    conn.setInstanceFollowRedirects(false);
    return conn;
}

You can use the ConnectionBuilderForTesting or copy DefaultConnectionBuilder and modify it with your own implementation. For the second error shown on the log you will need to remove this line:

Preconditions.checkArgument(HTTPS_SCHEME.equals(uri.getScheme()),
            "only https connections are permitted");

And pass it to the AuthorizationService constructor as part of the configuration:

new AuthorizationService(
    context,
    new AppAuthConfiguration.Builder().setConnectionBuilder(MyConnectionBuilder.INSTANCE).build()
)

[agologan]

@jorpaspr you are right in general but since we were talking about the sample app that already does this for you:
https://github.com/openid/AppAuth-Android/blob/master/app/java/net/openid/appauthdemo/Configuration.java#L178

[agologan]

Closing this as there has been no response from the OP in a reasonable amount of time. Assuming issue has been resolved. Feel free to open a new issue if you require further assistance 👍