Login with OAuth 2.0 - Azure - Invalid credentials Error

[stephaneuh]

Hello, we did the setup of the Azure AD OAuth 2.0 integration following this guide: https://github.com/provectus/kafka-ui/wiki/Set-up-OAuth2---SSO

But we get redirected to this page: https://kafka-ui/login?error

Login with OAuth 2.0
Invalid credentials
https://login.microsoftonline.com/xxxxxxxxxxx/v2.0

Any idea what could be the issue?
Thanks,

[Haarolean]

Hey, please share your config :) just obfuscate/remove the clientsecret

[stephaneuh]

Hello here is the conf:

    - name: kafka-ui
      image: kafka-ui:v0.4.0
      ports:
        - containerPort: 8080
          protocol: TCP
      env:
        - name: SPRING_PROFILE
          value: development
        - name: LOGGING_LEVEL_ROOT
          value: ERROR
        - name: KAFKA_CLUSTERS_0_NAME
          value: xxxxx
        - name: KAFKA_CLUSTERS_0_BOOTSTRAPSERVERS
          value: xxxxx.confluent.cloud:9092
        - name: KAFKA_CLUSTERS_0_PROPERTIES_SECURITY_PROTOCOL
          value: SASL_SSL
        - name: KAFKA_CLUSTERS_0_PROPERTIES_SASL_MECHANISM
          value: PLAIN
        - name: KAFKA_CLUSTERS_0_PROPERTIES_SASL_JAAS_CONFIG
          value: >-
            org.apache.kafka.common.security.plain.PlainLoginModule required
            username="xxxxxx"
            password="xxxxxx";
        - name: KAFKA_CLUSTERS_0_DISABLELOGDIRSCOLLECTION
          value: 'true'
        - name: KAFKA_CLUSTERS_0_READONLY
          value: 'true'
        - name: KAFKA_CLUSTERS_0_KAFKACONNECT_0_NAME
          value: kafka-connect-development
        - name: KAFKA_CLUSTERS_0_KAFKACONNECT_0_ADDRESS
          value: http://kafka-connect-development-service-1:8083
        - name: KAFKA_CLUSTERS_0_KAFKACONNECT_0_USERNAME
          value: xxxxx
        - name: KAFKA_CLUSTERS_0_KAFKACONNECT_0_PASSWORD
          value: xxxxx
        - name: KAFKA_CLUSTERS_0_SCHEMAREGISTRY
          value: https://xxxxxx.confluent.cloud
        - name: KAFKA_CLUSTERS_0_SCHEMAREGISTRYAUTH_USERNAME
          value: xxxxxx
        - name: KAFKA_CLUSTERS_0_SCHEMAREGISTRYAUTH_PASSWORD
          value: xxxxxxxxxxxxxx
        - name: AUTH_TYPE
          value: OAUTH2
        - name: AUTH_ENABLED
          value: 'true'
        - name: SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_AUTH0_CLIENTID
          value: xxxxxxx
        - name: SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_AUTH0_CLIENTSECRET
          value: xxxxxxx
        - name: SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_AUTH0_SCOPE
          value: https://graph.microsoft.com/User.Read
        - name: SPRING_SECURITY_OAUTH2_CLIENT_PROVIDER_AUTH0_ISSUER_URI
          value: >-
            https://login.microsoftonline.com/xxxxxxxxx/v2.0

[Haarolean]

@stephaneuh have you completed the last step?

Note that scope is created by default when Application registration is done in Azure portal. You'll need to update application registration manifest to include "accessTokenAcceptedVersion": 2

@bbratchiv hey, could you help us with this issue please? What else could @stephaneuh be missing?

[stephaneuh]

Yes, on the Azure AD side, we set "accessTokenAcceptedVersion": 2

Also the log is showing a connection error to graph.microsoft.com:
`WARN [reactor-http-epoll-1] r.n.h.c.HttpClientConnect: [52765137 - R:graph.microsoft.com/20.190.139.171:443] The connection observed an error

io.netty.channel.unix.Errors$NativeIoException: readAddress(..) failed: Connection reset by peer
o.s.s.w.s.a.AuthenticationWebFilter: Authentication failed: [invalid_user_info_response] An error occurred reading the UserInfo response: readAddress(..) failed: Connection reset by peer; nested exception is io.netty.channel.unix.Errors$NativeIoException: readAddress(..) failed: Connection reset by peer`

[stephaneuh]

The issue is now fixed, it was indeed related to Istio blockink traffic to graph.microsoft.com:443. It's working now, thanks.

[Haarolean]

Okay, nice