Manager stuck - Getting configuration ...

[wagner-robert]

I am just trying to get this up and running as an example on Windows 2022. Using AWS RDS, local latest Keycloak and working through errors. On connecting Edge to localhost:54000 I see STIG Manager Getting configuration .....
Keycloak is showing two User events - LOGIN_ERROR (invalid_request) and CODE_TO_TOKEN_ERROR (invalid_client_credentials).
I haven't been prompted for a login id. The documentation doesn't discuss the first time you try and connect - so I am guessing how to connect. Any ideas would be greatly appreciated. I have double-checked Keycloak and think it is setup correctly.

[StevenMcGann]

I have seen this issue. I've seen it in two situations so far. The first being stuck there and not being able to load. The way I ended up getting past this was to import the "NUWCDIVNPT/stig-manager-auth/import_realm.jason" This got me up and running. The second scenario is dashboard would hang at the "Getting configuration." but if I refreshed the page, it would then load. If you refresh the page does the dashboard load? When I had this issue, it is possible that it was resolved when I added "openid" to the STIG Manger configuration parameter "set STIGMAN_CLIENT-EXTRA-SCOPES" It was recommended to try that for a different error I was seeing but other than a "REFRESH_TOKEN_ERROR" my other errors have cleared up.

[wagner-robert]

I deleted the realm and imported the one mentioned, but no change. Refreshing doesn't change the result. Adding openid doesn't seem to change anything. Still getting the same "LOGIN_ERROR" and "CODE_TO_TOKEN_ERROR" in Keycloak. I am using Keycloak 24.0.3

[StevenMcGann]

What do you have set for "STIGMAN_OIDC_PROVIDER"? I had to change from the default of "http://localhost:8080/**auth**/realms/stigman" to "http://localhost:8080/realms/stigman"

FYI I'm no expert. I'm fumbling my way through trying to configure the server in a Windows environment as well.

[cd-rite]

Hi @wagner-robert Hmm, the first thing that should happen when you go to the STIGMan URL is a bit of the client loads, then you get redirected to your OIDC provider. When you say you don't get prompted for user Id, do you see ANY keycloak screen at all, or it just sits at "Getting configuration..." in STIGMan? (....But, you are seeing log entries in Keycloak showing a request being made?)

That CODE_TO_TOKEN_ERROR looks like it's related to your realm configuration. It may be requiring a client_secret, which would not be right for the browser client:
https://stackoverflow.com/questions/45860313/keycloak-code-to-token-error-after-user-is-authenticated

If you open your Browser devtools, do you see requests being made to the OIDC provider in the Network tab?

[wagner-robert]

It appears to get to Keycloak - If I disable the Stigman realm, I will get "Stig Manager Realm, We are sorry... Realm not enabled". Keycloak shows those two errors every time I click refresh - so I assume something is hitting KC. Looking at the Network tab I see -
http://localhost:8080/realms/stigman/protocol/openid-connect/auth?client_id=stig-manager.........
Status Code 302.
Response Header
http://localhost:54000/#error=invalid_scope&error_description=Invalid+scopes%3A_stig-manager.....
-This is sort of sounding like a typo somewhere in a config file...... Let me double check my configs

[wagner-robert]

Success - So it appears that I had it as: "set STIGMAN_CLIENT_EXTRA_SCOPES=offline_access,openid" and it really didn't like that. I am sure deleting and reimporting the JSON file also helped.
I changed this variable to just: "set STIGMAN_CLIENT_EXTRA_SCOPES=offline_access"
I am now provided a login screen - so I think I am on my way to success!

[cd-rite]

Ahhhh ok. I think those scopes need to be space-separated, which is not specified in the docs. I'll update the docs soon to mention that.