"Connect your Github Account" fails to load Github repos, 403 Error in console, AFTER credentials are saved.

[Mbd06b]

Describe the bug

[UPDATE] ( After successfully saving Github OAuth Credentials in the Github prompt)
When clicking "Connect your Github account" in Add Projects to browse projects in Github. the pop-up flashes, the repositories fail to load, and che throws a 403 error in the console.
""Client [che-public] not authorized to retrieve tokens from identity provider [github]."},"status":403,"

Keycloak log: (kubectl logs pod/keycloak-c5b98d95f-lk2bt -n che)

(Same as Keycloak.log output below)

Keycloak Settings for Github Identity Provider

Some of the configurations look a little different from the documentation because I've been looking at some old closed issues trying to fix this one. See: #9399

Documentation on Github OAuth here... https://www.eclipse.org/che/docs/che-7/end-user-guide/configuring-github-oauth/
doesn't match what my keycloak instance looks like as seen above.
There is a "Mappers" tab. Is there missing configuration? I've tried some role mapping without success.

Che version

• latest
• nightly
• other: 7.17.0 (Multiuser)

Steps to reproduce

Expected behavior

Runtime

• [ x] kubernetes (microk8s) (include output of kubectl version)
  Client Version: version.Info{Major:"1", Minor:"18", GitVersion:"v1.18.8", GitCommit:"9f2892aab98fe339f3bd70e3c470144299398ace", GitTreeState:"clean", BuildDate:"2020-08-26T20:32:49Z", GoVersion:"go1.13.15", Compiler:"gc", Platform:"linux/amd64"}
  Server Version: version.Info{Major:"1", Minor:"16", GitVersion:"v1.16.15", GitCommit:"2adc8d7091e89b6e3ca8d048140618ec89b39369", GitTreeState:"clean", BuildDate:"2020-09-02T11:31:21Z", GoVersion:"go1.13.15", Compiler:"gc", Platform:"linux/amd64"}

Screenshots

Installation method

• chectl
  • provide a full command that was used to deploy Eclipse Che (including the output)
    (I don't know exactly, but I did use microk8s context, multiuser, tls, and helm)
  • provide an output of chectl version command
    chectl/7.17.0 linux-x64 node-v10.22.0
• OperatorHub
• I don't know

Environment

• my computer
  • Windows
  • [ x] Linux (Ubuntu 18 LTS)
  • macOS
• Cloud
  • Amazon
  • Azure
  • GCE
  • other (please specify)
• other: please specify

Eclipse Che Logs

logs from keycloak.log
^[[0m^[[33m03:47:19,928 WARN [org.keycloak.connections.httpclient.DefaultHttpClientFactory] (default task-2) Truststore is disabled ^[[0m^[[33m03:47:21,638 WARN [org.keycloak.events] (default task-2) type=IDENTITY_PROVIDER_RETRIEVE_TOKEN_ERROR, realmId=che, clientId=null, userId=null, ipAddress=127.0.0.1, error=Client [che-public] not authorized to retrieve tokens from identity provider [github]. ^[[0m^[[31m03:47:21,638 ERROR [org.keycloak.services.resources.IdentityBrokerService] (default task-2) Client [che-public] not authorized to retrieve tokens from identity provider [github]. ^[[0m^[[33m04:05:41,455 WARN [org.keycloak.events] (default task-2) type=REFRESH_TOKEN_ERROR, realmId=master, clientId=security-admin-console, userId=null, ipAddress=127.0.0.1, error=invalid_token, grant_type=refresh_token, client_auth_method=client-secret

Additional context

This is a multi-user installation.
I also added my Github OAuth client id, and secret to the configmap (as described for a single-user install) in an unsuccessful attempt to get things working.
The "Authorization Callback URL" in Github, is a copy/paste of the, Redirect URI in Keycloak as shown above..

[l0rd]

I am wondering if that is supposed to work as you are expecting @Mbd06b. One thing is an admin configuring github as an identity provider (let keycloak delegate users authentication to GitHub) and another thing is a user connecting to his GitHub account (authorizing Che to retrieve the GitHub repositories of a given user). What I mean is that you should be able to connect your GitHub account even without configuring GitHub as an identity provider.

Not sure who can help here:

@akurinnoy @olexii4 do you know if "connect to GitHub account" in the dashboard is supposed to work.
@vinokurig you have worked on GitHub tokens hence you may have an idea.

[sleshchenko]

What I mean is that you should be able to connect your GitHub account even without configuring GitHub as an identity provider.

I believe it's required to configure GitHub identity provider in any case.
I tried to configure identity provider and it works just fine without any custom configuration for Che Realm.
The only different that I did - default scope: repo,user,write:public_key
Then I faced #15718

@davidfestal Maybe you know about the configuration property that may lead to

Client [che-public] not authorized to retrieve tokens from identity provider [github].

?

[vinokurig]

I confirm that the GitHub authentication works fine except the loading time: #15718

[Mbd06b]

Nevermind...

I got prompt itself to appear on Firefox, and in an Incognito browser in Chrome after clearing cookies. I got too excited, closed, and now reopened the ticket.

The issue is definitely after the credentials have been saved in the browser. Clicking the button and the error are triggered, I expect when the client tries to query the repositories.

[Mbd06b]

@vinokurig

Could this be related ? #7899 (comment)
On this issue, the Authorization Callback URL for single User Eclipse Che 6.x is '/api/oauth/callback'

My console error is showing /api/oauth/:

should this be the Multiuser eclipse che callback?

Is there a "Mappers" config missing in the docs? I'm not seeing any documentation or much discussion on Mappers. https://www.eclipse.org/che/docs/che-7/end-user-guide/configuring-github-oauth/

[vinokurig]

@Mbd06b

Could this be related ? #7899 (comment)

I don't think so. The issue is related to Che 6.x

My console error is showing /api/oauth/:
should this be the Multiuser eclipse che callback?

The url in the error message points to the get token Che API request. Looks like this is the url of the failed request.

Is there a "Mappers" config missing in the docs? I'm not seeing any documentation or much discussion on Mappers.

It works for me without any mappers.

[che-bot]

Issues go stale after 180 days of inactivity. lifecycle/stale issues rot after an additional 7 days of inactivity and eventually close.

Mark the issue as fresh with /remove-lifecycle stale in a new comment.

If this issue is safe to close now please do so.

Moderators: Add lifecycle/frozen label to avoid stale mode.

[l0rd]

Closing as this functionalitly should be replaced by #17954 with the new dashboard