Broken redirect after Azure SSO integration

[korede-ola]

Appears to be a unique issue since i'm not seeing any similar issues raised.

After registering vectr in AAD and completing the SSO claims mapping, sign in attempts now redirect to
https://<VECTR_DOMAIN>/sra-purpletools-webui/app/#/ with a vectr logo in the middle but "Failed with status code 404" right under.

Similar image as issue #171 except that it worked prior to setting up SSO.
This is a RHEL

[SRAPSpencer]

When does the 404 occur? On login attempt or on loading login page?

We currently have an open issue #159 If the VECTR instance can't load the Metadata URL or other URLs necessary for SSO Auth completely breaks and fails to load. Sounds like it could be this issue. Can you check your container logs for errors and network connectivity?

[korede-ola]

The 404 occurs whenever I attempt to reach https://<VECTR_DOMAIN> which autoredirects to https://<VECTR_DOMAIN>/sra-purpletools-webui/app/#/

Data in .env all comply with points raised in issues 159. However, reset the initial values for VECTR_DATA_KEY and APP_Name they were non-alphanumeric and something outside Vectr respectively.

Will rebuilding then restarting the docker instances after modifying the env creds rule out any issue in the .env file?

[SRAPSpencer]

VECTR_DATA_KEY can't be changed after initial setup. Changing this will void the instances ability to read the database.

The APP_Name issue is still outstanding and will hopefully be fixed in the next release.

If you've got no data in the instance you care about the best method is to blow away your volumes, reset your .env to as many defaults as you can and reenroll your SSO application. If it still works we can eliminate the potential networking aspect.

[korede-ola]

This is a fresh install so there are no holdbacks regarding the overhaul.
Might be missing the step/command syntax to make this work without impacting existing apps on the host if that is something you can put me in the right direction with, assuming I want to undo and redo

[SRAPSpencer]

Do you have other docker containers running on the host?

docker-compose down

Should tear down the containers then you'll need to remove the volumes as they persist. If it's not attached a prune should suffice.

docker volume prune

If you do have other workloads on the host I wouldn't recommend using a prune as you might remove data from other containers not currently running. You'd have to remove the VECTR ones manually.

[korede-ola]

Prune - That fixed persistence issue for the containers.
Now defaulted to the original issue very similar to #159 where configuring Azure AD provider gets stuck at claims mapping with a generic "Uh oh, something didn't go right. Please try again. If the error persists, please open an issue on GitHub"
My VECTR_DATA_KEY is set and APP_NAME is reverted to VECTR

[SRAPSpencer]

If everything is defaulted and you're still encountering an issue during enrollment it likely means there's a networking issue trying to communicate with the SSO provider. I'd check the container logs, resources here https://docs.docker.com/engine/reference/commandline/logs/

We've got a release due out in the new few weeks to make some improvements in this area and may provide an easier troubleshooting experience if you still experience issues.

It doesn't appear to be a bug from the info we have, so our ability to provide SSO support for community users is limited. If you find anything of note in your container logs feel free to post it here.

[korede-ola]

Running the docker logs --follow command for realtime outputs, this continue print even when JWT (JWS_KEY) is confirmed

[doodleincode]

@oakey1 it's a bit difficult to tell what's going on with the standard logging. In your .env file, can you set VECTR_CONTAINER_LOG_LEVEL to DEBUG. If you can provide the full log from when you try to log into SSO to when you get the 404 that would be great (redacting any sensitive data).

Where you able to setup SSO after rebuilding the containers? At which point do you get the 404 now? Does it occur after you initiate SSO from the VECTR login page or does it happen after you've logged into your identity provider and when it redirects back to VECTR?

[SRAPSpencer]

@oakey1 the 8.3.0 release is out with several auth and SSO improvements. I'd give it a try with this new build.

[korede-ola]

After updating to 8.3.0 and giving the Azure AD IDP option a shot, currently seeing a different error referencing how Host:login.mircrosoftonline.com is unreachable for claims mapping

[SRAPSpencer]

There's either a typo in the URL field or there's a networking issue. Firewalls, limited egress, hard to say. It can't communicate with Azure.

[korede-ola]

There's either a typo in the URL field or there's a networking issue. Firewalls, limited egress, hard to say. It can't communicate with Azure.

Yet to find a smoking gun but here's a sanitized full stacktrace incase something jumps out:

2022-03-23 12:28:56,840 DEBUG [org.apache.commons.beanutils.converters.StringConverter] - Converting 'com.sra.auth.model.enums.AuthnProtocol' value 'AZURE_AD_OIDC' to type 'String'
2022-03-23 12:28:56,840 DEBUG [org.apache.commons.beanutils.converters.StringConverter] - Converting 'com.sra.auth.model.enums.AuthnProtocol' value 'AZURE_AD_OIDC' to type 'String'
2022-03-23 12:28:56,842 DEBUG [org.apache.commons.beanutils.converters.StringConverter] - Converting 'com.sra.auth.model.enums.AuthnProtocol' value 'AZURE_AD_OIDC' to type 'String'
2022-03-23 12:28:56,842 DEBUG [org.apache.commons.beanutils.converters.StringConverter] - Converting 'String' value 'tenant_id' to type 'String'
2022-03-23 12:28:56,842 DEBUG [org.apache.commons.beanutils.converters.StringConverter] - Converting 'String' value 'app_id' to type 'String'
2022-03-23 12:28:56,842 DEBUG [org.apache.commons.beanutils.converters.StringConverter] - Converting 'String' value 'sec' to type 'String'
2022-03-23 12:29:16,862 ERROR [com.sra.auth.web.service.IdentityProviderService] - Unable to add provider: Vectr_SSO
2022-03-23 12:29:16,862 DEBUG [com.sra.auth.web.service.IdentityProviderService] - exception
org.pac4j.core.exception.TechnicalException: java.net.UnknownHostException: login.microsoftonline.com
at org.pac4j.oidc.config.OidcConfiguration.internalInit(OidcConfiguration.java:164) ~[pac4j-oidc-4.5.4.jar:?]
at org.pac4j.oidc.config.AzureAdOidcConfiguration.internalInit(AzureAdOidcConfiguration.java:49) ~[pac4j-oidc-4.5.4.jar:?]
at org.pac4j.core.util.InitializableObject.init(InitializableObject.java:20) ~[pac4j-core-4.5.4.jar:?]
at org.pac4j.oidc.config.OidcConfiguration.findProviderMetadata(OidcConfiguration.java:177) ~[pac4j-oidc-4.5.4.jar:?]
at org.pac4j.oidc.credentials.authenticator.OidcAuthenticator.(OidcAuthenticator.java:64) ~[pac4j-oidc-4.5.4.jar:?]
at com.sra.auth.pac4j.oidc.authenticator.AzureAdOidcAuthenticator.(AzureAdOidcAuthenticator.java:28) ~[sra-auth-pac4j-3.3.0.jar:?]
at com.sra.auth.web.service.configurator.impl.AzureAdClientConfigurator.configure(AzureAdClientConfigurator.java:48) ~[classes/:?]
at com.sra.auth.web.service.IdentityProviderService.configurePac4jClient(IdentityProviderService.java:280) ~[classes/:?]
at com.sra.auth.web.service.IdentityProviderService.validateClientConfiguration(IdentityProviderService.java:107) ~[classes/:?]
at com.sra.auth.web.api.v1.resources.IdentityProviderResource.addProvider(IdentityProviderResource.java:192) ~[classes/:?]
at jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[?:?]
at jdk.internal.reflect.NativeMethodAccessorImpl.invoke(Unknown Source) ~[?:?]
at jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source) ~[?:?]
at java.lang.reflect.Method.invoke(Unknown Source) ~[?:?]
at org.springframework.web.method.support.InvocableHandlerMethod.doInvoke(InvocableHandlerMethod.java:205) ~[spring-web-5.3.13.jar:5.3.13]
at org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:150) ~[spring-web-5.3.13.jar:5.3.13]
at org.springframework.web.servlet.mvc.method.annotation.ServletInvocableHandlerMethod.invokeAndHandle(ServletInvocableHandlerMethod.java:117) ~[spring-webmvc-5.3.13.jar:5.3.13]
at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.invokeHandlerMethod(RequestMappingHandlerAdapter.java:895) ~[spring-webmvc-5.3.13.jar:5.3.13]
at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.handleInternal(RequestMappingHandlerAdapter.java:808) ~[spring-webmvc-5.3.13.jar:5.3.13]
at org.springframework.web.servlet.mvc.method.AbstractHandlerMethodAdapter.handle(AbstractHandlerMethodAdapter.java:87) ~[spring-webmvc-5.3.13.jar:5.3.13]
at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:1067) ~[spring-webmvc-5.3.13.jar:5.3.13]
at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:963) ~[spring-webmvc-5.3.13.jar:5.3.13]
at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:1006) ~[spring-webmvc-5.3.13.jar:5.3.13]
at org.springframework.web.servlet.FrameworkServlet.doPost(FrameworkServlet.java:909) ~[spring-webmvc-5.3.13.jar:5.3.13]
at javax.servlet.http.HttpServlet.service(HttpServlet.java:681) ~[servlet-api.jar:4.0.FR]
at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:883) ~[spring-webmvc-5.3.13.jar:5.3.13]
at javax.servlet.http.HttpServlet.service(HttpServlet.java:764) ~[servlet-api.jar:4.0.FR]
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:227) ~[catalina.jar:9.0.59]
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162) ~[catalina.jar:9.0.59]
at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:53) ~[tomcat-websocket.jar:9.0.59]
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189) ~[catalina.jar:9.0.59]
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162) ~[catalina.jar:9.0.59]
at com.sra.purpletools.servlet.filters.CacheControlFilter.doFilter(CacheControlFilter.java:42) ~[sra-purpletools-servlet.jar:?]
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189) ~[catalina.jar:9.0.59]
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162) ~[catalina.jar:9.0.59]
at org.apache.catalina.filters.HttpHeaderSecurityFilter.doFilter(HttpHeaderSecurityFilter.java:126) ~[catalina.jar:9.0.59]
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189) ~[catalina.jar:9.0.59]
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162) ~[catalina.jar:9.0.59]
at com.sra.auth.web.filters.GenericRequestFilter.doFilterInternal(GenericRequestFilter.java:33) ~[classes/:?]
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119) ~[spring-web-5.3.13.jar:5.3.13]
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189) ~[catalina.jar:9.0.59]
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162) ~[catalina.jar:9.0.59]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:327) ~[spring-security-web-5.6.0.jar:5.6.0]
at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:122) ~[spring-security-web-5.6.0.jar:5.6.0]
at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:116) ~[spring-security-web-5.6.0.jar:5.6.0]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336) ~[spring-security-web-5.6.0.jar:5.6.0]
at org.springframework.security.web.session.SessionManagementFilter.doFilter(SessionManagementFilter.java:126) ~[spring-security-web-5.6.0.jar:5.6.0]
at org.springframework.security.web.session.SessionManagementFilter.doFilter(SessionManagementFilter.java:81) ~[spring-security-web-5.6.0.jar:5.6.0]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336) ~[spring-security-web-5.6.0.jar:5.6.0]
at org.springframework.security.web.authentication.AnonymousAuthenticationFilter.doFilter(AnonymousAuthenticationFilter.java:109) ~[spring-security-web-5.6.0.jar:5.6.0]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336) ~[spring-security-web-5.6.0.jar:5.6.0]
at org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter.doFilter(SecurityContextHolderAwareRequestFilter.java:149) ~[spring-security-web-5.6.0.jar:5.6.0]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336) ~[spring-security-web-5.6.0.jar:5.6.0]
at org.springframework.security.web.savedrequest.RequestCacheAwareFilter.doFilter(RequestCacheAwareFilter.java:63) ~[spring-security-web-5.6.0.jar:5.6.0]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336) ~[spring-security-web-5.6.0.jar:5.6.0]
at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:103) ~[spring-security-web-5.6.0.jar:5.6.0]
at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:89) ~[spring-security-web-5.6.0.jar:5.6.0]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336) ~[spring-security-web-5.6.0.jar:5.6.0]
at org.springframework.security.web.csrf.CsrfFilter.doFilterInternal(CsrfFilter.java:117) ~[spring-security-web-5.6.0.jar:5.6.0]
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119) ~[spring-web-5.3.13.jar:5.3.13]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336) ~[spring-security-web-5.6.0.jar:5.6.0]
at org.springframework.security.web.header.HeaderWriterFilter.doHeadersAfter(HeaderWriterFilter.java:90) ~[spring-security-web-5.6.0.jar:5.6.0]
at org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:75) ~[spring-security-web-5.6.0.jar:5.6.0]
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119) ~[spring-web-5.3.13.jar:5.3.13]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336) ~[spring-security-web-5.6.0.jar:5.6.0]
at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:110) ~[spring-security-web-5.6.0.jar:5.6.0]
at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:80) ~[spring-security-web-5.6.0.jar:5.6.0]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336) ~[spring-security-web-5.6.0.jar:5.6.0]
at org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:55) ~[spring-security-web-5.6.0.jar:5.6.0]
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119) ~[spring-web-5.3.13.jar:5.3.13]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336) ~[spring-security-web-5.6.0.jar:5.6.0]
at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:211) ~[spring-security-web-5.6.0.jar:5.6.0]
at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:183) ~[spring-security-web-5.6.0.jar:5.6.0]
at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:358) ~[spring-web-5.3.13.jar:5.3.13]
at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:271) ~[spring-web-5.3.13.jar:5.3.13]
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189) ~[catalina.jar:9.0.59]
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162) ~[catalina.jar:9.0.59]
at org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:100) ~[spring-web-5.3.13.jar:5.3.13]
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119) ~[spring-web-5.3.13.jar:5.3.13]
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189) ~[catalina.jar:9.0.59]
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162) ~[catalina.jar:9.0.59]
at org.springframework.web.filter.FormContentFilter.doFilterInternal(FormContentFilter.java:93) ~[spring-web-5.3.13.jar:5.3.13]
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119) ~[spring-web-5.3.13.jar:5.3.13]
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189) ~[catalina.jar:9.0.59]
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162) ~[catalina.jar:9.0.59]
at org.springframework.boot.web.servlet.support.ErrorPageFilter.doFilter(ErrorPageFilter.java:126) ~[spring-boot-2.4.13.jar:2.4.13]
at org.springframework.boot.web.servlet.support.ErrorPageFilter.access$000(ErrorPageFilter.java:64) ~[spring-boot-2.4.13.jar:2.4.13]
at org.springframework.boot.web.servlet.support.ErrorPageFilter$1.doFilterInternal(ErrorPageFilter.java:101) ~[spring-boot-2.4.13.jar:2.4.13]
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119) ~[spring-web-5.3.13.jar:5.3.13]
at org.springframework.boot.web.servlet.support.ErrorPageFilter.doFilter(ErrorPageFilter.java:119) ~[spring-boot-2.4.13.jar:2.4.13]
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189) ~[catalina.jar:9.0.59]
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162) ~[catalina.jar:9.0.59]
at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:201) ~[spring-web-5.3.13.jar:5.3.13]
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119) ~[spring-web-5.3.13.jar:5.3.13]
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189) ~[catalina.jar:9.0.59]
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162) ~[catalina.jar:9.0.59]
at org.apache.logging.log4j.web.Log4jServletFilter.doFilter(Log4jServletFilter.java:71) ~[log4j-web-2.17.1.jar:2.17.1]
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189) ~[catalina.jar:9.0.59]
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162) ~[catalina.jar:9.0.59]
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:197) ~[catalina.jar:9.0.59]
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:97) ~[catalina.jar:9.0.59]
at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:541) ~[catalina.jar:9.0.59]
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:135) ~[catalina.jar:9.0.59]
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92) ~[catalina.jar:9.0.59]
at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:687) ~[catalina.jar:9.0.59]
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:78) ~[catalina.jar:9.0.59]
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:359) ~[catalina.jar:9.0.59]
at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:399) ~[tomcat-coyote.jar:9.0.59]
at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65) ~[tomcat-coyote.jar:9.0.59]
at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:889) ~[tomcat-coyote.jar:9.0.59]
at org.apache.tomcat.util.net.AprEndpoint$SocketProcessor.doRun(AprEndpoint.java:2138) ~[tomcat-coyote.jar:9.0.59]
at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49) ~[tomcat-coyote.jar:9.0.59]
at org.apache.tomcat.util.threads.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1191) ~[tomcat-util.jar:9.0.59]
at org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:659) ~[tomcat-util.jar:9.0.59]
at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) ~[tomcat-util.jar:9.0.59]
at java.lang.Thread.run(Unknown Source) [?:?]
Caused by: java.net.UnknownHostException: login.microsoftonline.com
at java.net.AbstractPlainSocketImpl.connect(Unknown Source) ~[?:?]
at java.net.SocksSocketImpl.connect(Unknown Source) ~[?:?]
at java.net.Socket.connect(Unknown Source) ~[?:?]
at sun.security.ssl.SSLSocketImpl.connect(Unknown Source) ~[?:?]
at sun.net.NetworkClient.doConnect(Unknown Source) ~[?:?]
at sun.net.www.http.HttpClient.openServer(Unknown Source) ~[?:?]
at sun.net.www.http.HttpClient.openServer(Unknown Source) ~[?:?]
at sun.net.www.protocol.https.HttpsClient.(Unknown Source) ~[?:?]
at sun.net.www.protocol.https.HttpsClient.New(Unknown Source) ~[?:?]
at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.getNewHttpClient(Unknown Source) ~[?:?]
at sun.net.www.protocol.http.HttpURLConnection.plainConnect0(Unknown Source) ~[?:?]
at sun.net.www.protocol.http.HttpURLConnection.plainConnect(Unknown Source) ~[?:?]
at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(Unknown Source) ~[?:?]
at sun.net.www.protocol.http.HttpURLConnection.getInputStream0(Unknown Source) ~[?:?]
at sun.net.www.protocol.http.HttpURLConnection.getInputStream(Unknown Source) ~[?:?]
at sun.net.www.protocol.https.HttpsURLConnectionImpl.getInputStream(Unknown Source) ~[?:?]
at com.nimbusds.jose.util.DefaultResourceRetriever.getInputStream(DefaultResourceRetriever.java:259) ~[nimbus-jose-jwt-8.23.jar:8.23]
at com.nimbusds.jose.util.DefaultResourceRetriever.retrieveResource(DefaultResourceRetriever.java:211) ~[nimbus-jose-jwt-8.23.jar:8.23]
at org.pac4j.oidc.config.OidcConfiguration.internalInit(OidcConfiguration.java:161) ~[pac4j-oidc-4.5.4.jar:?]
... 115 more
2022-03-23 12:29:16,863 DEBUG [org.springframework.web.servlet.mvc.method.annotation.ExceptionHandlerExceptionResolver] - Using @ExceptionHandler com.sra.auth.web.handlers.ApiResponseExceptionHandler#handleHttpClientErrorException(HttpClientErrorException, HttpServletResponse)
2022-03-23 12:29:16,864 DEBUG [org.springframework.web.servlet.mvc.method.annotation.RequestResponseBodyMethodProcessor] - Using 'application/json', given [application/json, text/plain, /] and supported [application/json, application/+json, application/json, application/+json]
2022-03-23 12:29:16,864 DEBUG [org.springframework.web.servlet.mvc.method.annotation.RequestResponseBodyMethodProcessor] - Writing [com.sra.auth.web.api.v1.responses.BaseResponse@5383c32a]
2022-03-23 12:29:16,864 DEBUG [org.springframework.security.web.context.HttpSessionSecurityContextRepository] - Did not store anonymous SecurityContext
2022-03-23 12:29:16,864 DEBUG [org.springframework.web.servlet.mvc.method.annotation.ExceptionHandlerExceptionResolver] - Resolved [org.springframework.web.client.HttpClientErrorException: 400 Unable to find host: login.microsoftonline.com. Make sure your VECTR instance can reach this host.]
2022-03-23 12:29:16,864 DEBUG [org.springframework.web.servlet.DispatcherServlet] - Completed 400 BAD_REQUEST
2022-03-23 12:29:16,864 DEBUG [org.springframework.security.web.context.HttpSessionSecurityContextRepository] - Did not store anonymous SecurityContext
2022-03-23 12:29:16,864 DEBUG [org.springframework.security.web.context.SecurityContextPersistenceFilter] - Cleared SecurityContextHolder to complete request

Also getting failure audit logs at inconsistent time intervals in Azure AD with error code 90094.
Error keeps firing even after admin consent is granted on the app in AAD

[SRAPSpencer]

Near the bottom looks pretty smoking gun to me.

2022-03-23 12:29:16,864 DEBUG [org.springframework.web.servlet.mvc.method.annotation.ExceptionHandlerExceptionResolver] - Resolved [org.springframework.web.client.HttpClientErrorException: 400 Unable to find host: login.microsoftonline.com. Make sure your VECTR instance can reach this host.]

It's DNS, it can't resolve login.microsoftonline.com

[doodleincode]

@oakey1 Could be a DNS issue as @SRAPSpencer mentioned. Are you using a proxy to connect to the outside? If yes, you'll need to configure the JVM proxy. See #163

Separate note, the stack trace appears that you are having issues adding the SSO provider in VECTR, however, you also mention that you are trying to log into VECTR via SSO. Are you trying to access VECTR from Azure AD (i.e. IdP initiated flow)? If yes, two issues with that:

1. If SSO setup in VECTR failed, you can't use SSO regardless if you made the app registration in AAD. You need to setup SSO in VECTR in order for both ends to work.
2. VECTR doesn't support IdP initiated flow when using OIDC. If you want to be able to log into VECTR from the apps menu in M365, you should use SAML2.

[korede-ola]

Following up on this since the issue persists.

A few tests we ran didn't point to any issue around DNS: curl -k -L https://login.microsoftonline.com/ on the host resolves the
content behind the scenes as expected.

We are not using any proxies on this box.

The stack trace provided is the event generated while attempting to integrate SSO with Vectr using Azure AD. Azure portal is setup but but clearly the Vectr instances cannot reach the AAD portal as no Sign-in failures under usage and insights are getting logged.

How can we have these connections spot-checked?

[SRAPSpencer]

@oakey1 I'm not sure we have anything else to recommend. If you'd like we can jump on a quick call to go over the situation to ensure everything on the VECTR end is working correctly.

Email us at vectrops@securityriskadvisors.com so we can set something up.

[SRAPSpencer]

Issue was underlying networking issue with RHEL + Docker. Not specific to VECTR.

Similar issues.

https://forums.centos.org/viewtopic.php?t=74270

docker/for-linux#957