oauth2 Integration with PingID in Kafka UI – Redirect Fails with NOT_FOUND Error

[ashokjkdream]

Hi All,

I’m trying to integrate OAuth2 using PingID with Kafka UI. The redirect is happening, but I'm encountering a signon/?error=NOT_FOUND response during login. Here's my current config. Could someone please review and let me know if anything is missing or incorrect?

Advance thanks for your help! 🙏

/signon/?error=
{
"id" : "xxxxxxxxxxxx",
"code" : "NOT_FOUND",
"message" : "The request could not be completed. The requested resource was not found."
}

Here's a snippet from the logs during the redirect and failure:

DEBUG [parallel-1] o.s.s.w.s.u.m.MediaTypeServerWebExchangeMatcher: Processing text/html
DEBUG [parallel-1] o.s.s.w.s.u.m.AndServerWebExchangeMatcher: All requestMatchers returned true
DEBUG [parallel-1] o.s.s.w.s.DefaultServerRedirectStrategy: Redirecting to '/oauth2/authorization/ping'
DEBUG [reactor-http-epoll-4] o.s.s.w.s.DefaultServerRedirectStrategy: Redirecting to 'https://xxxx.xx.com/as/authorize?response_type=code&client_id=xxxxxxxxxxxxxxx&scope=openid&state=xxx%3D&redirect_uri=https://xxxxxxxx.com/login/oauth2/code/ping&nonce=xxxxxxx'
...
DEBUG [reactor-http-epoll-5] o.s.s.w.s.u.m.PathPatternParserServerWebExchangeMatcher: Request 'GET /actuator/health' doesn't match 'null /login/oauth2/code/{registrationId}'

What might be causing the NOT_FOUND error after a successful redirect to /login/oauth2/code/ping?
Is there something I am missing in the Spring configuration or callback handling?

Kindly help me resolve this issue. Is there anything missing in my configuration?

yamlApplicationConfig:
  server:
    forward-headers-strategy: FRAMEWORK
  auth:
    type: OAUTH2
    oauth2:
      client:
        ping:
          clientId: xxxxxxxxx
          clientSecret: xxxxxxxx
          scope: openid
          client-name: pingid
          provider: ping
          redirect-uri: https://xx.com/login/oauth2/code/pingid
          authorization-grant-type: authorization_code
          issuer-uri: https://xxxxxx.com/as
          jwk-set-uri: https://xxxxxx.com/as/jwks
          user-name-attribute: sub
          custom-params:
            type: oauth
            roles-field: groups
            
  rbac:
    enabled: true
    roles:
      - name: "admin"
        clusters:
          - "*"
        subjects:
          - provider: oauth
            type: role
            value: "Admin"
        permissions:
          - resource: applicationconfig
            value: ".*"
            actions: all

[Haarolean]

Hi, where the /signon comes from? our app doesn't have such a path

[ashokjkdream]

Hi,

When I access the Kafka UI using the URL: https://kafka-ui.com/login

I’m taken to the login page (see attached image). When I click on pingid under Login with OAuth 2.0, it redirects to the PingID authorization endpoint, but then fails with a /signon/error page.

The redirection does not take me to the expected PingID login screen where I can enter my credentials. Instead, it fails during the OAuth flow.
I also enabled logs but couldn’t identify where the issue is occurring.

If I access https://kafka-ui.com/ without /login, it redirects to the PingID page and fails with a 'signon not found' error.

/signon/?error=
{
"id" : "xxxxxxxxxxxx",
"code" : "NOT_FOUND",
"message" : "The request could not be completed. The requested resource was not found."
}

The redirect URI https://xx.com/login/oauth2/code/pingid is configured on both the Kafka UI side and the PingID side.

[Haarolean]

Aight, I see. This error comes from your oidc provider, not k-ui. This is 99% a misconfiguration issue. I'm not familiar with that oidc provider, check that your client id / clientsecret are valid, that's usually the issue. Also check your oidc logs if that's a self-hosted solution, also browser's dev console' logs in network tab might help here.