Update keycloak from 6.0.1 to the latest version, 15.0.2

[tolusha]

Is your enhancement related to a problem? Please describe.

For the time being there multiple issues with Keycloak 6.0.1 related to Eclipse Che:

• Handling the new SameSite setting in Chrome in Eclipse Che #19547
• Cannot login into Che using Openshif OAuth when proxy with authentication is used #17681
• Deploying Eclipse Che on IPv6-only kubernetes cluster #19279
• It's not possible to get access token for CHE with oAuth on OCP 3.11 #18030
• Multiple vulnerabilities found in Keycloak image #19646
• Failed to make identity provider oauth callback: javax.net.ssl.SSLException: Connection reset #19653

Describe the solution you'd like

1. To try update and collect possible issues
2. Estimate them if it worth updating or wait until Keycloak won't be mandatory (5-6 month)

Release Notes text

Update keycloak from 6.0.1 to the latest version, 15.0.2

[l0rd]

cc @jenia90 this is something you brought to last community call. We plan to work on the upgrade of Keycloak image. Please create an issue for all the images that have security vulns and we will link this one to it.

[jenia90]

@l0rd thank you for opening the issue. It will take us couple of days since it's holidays here, but my colleagues and myself will open all of the relevant issues somewhere next week.

[jenia90]

Ref issue #19646 with a list of vulnerabilities that were found in che-keycloak image.

[cccs-tom]

I am very interested in this update, but I see it's been removed from all milestones at this time. Is this still on the roadmap, @tolusha?

[tolusha]

@cccs-tom
yes, It is still in the roadmap.
Unfortunately @AndrienkoAleksandr who is an expert in this field, currently is busy with another long lasting task

[cccs-tom]

Great, thanks for the update!

[AndrienkoAleksandr]

I tested keycloak 15.0.0 on the k8s platform(minikube) and my result: login/logout/ access to user profile works. Workspaces are starting and running, but ingress blocks che-theia editor page. I found that new keycloak sends plenty big header in the response and ingress block it:

2021/08/09 07:56:12 [error] 18582#18582: *3520556 upstream sent too big header while reading response header from upstream, client: 192.168.99.1, server: keycloak-eclipse-che.192.168.99.111.nip.io, request: "GET /auth/realms/che/protocol/openid-connect/auth?client_id=che-public&redirect_uri=https%3A%2F%2Fche-eclipse-che.192.168.99.111.nip.io%2F_app%2Floader.html%3FredirectUrl%3Dhttps%3A%2F%2Fserverkjz3u98u-jwtproxy-server-4402.192.168.99.111.nip.io%2F%26workspaceId%3Dworkspacevfbms22q4nf4eetc&state=5db1dbf2-af3d-45aa-9a5e-e5999be5e528&response_mode=fragment&response_type=code&scope=openid&nonce=cd5d9e34-b29e-453b-8073-1d73c35e81bf HTTP/2.0", upstream: "http://172.17.0.15:8080/auth/realms/che/protocol/openid-connect/auth?client_id=che-public&redirect_uri=https%3A%2F%2Fche-eclipse-che.192.168.99.111.nip.io%2F_app%2Floader.html%3FredirectUrl%3Dhttps%3A%2F%2Fserverkjz3u98u-jwtproxy-server-4402.192.168.99.111.nip.io%2F%26workspaceId%3Dworkspacevfbms22q4nf4eetc&state=5db1dbf2-af3d-45aa-9a5e-e5999be5e528&response_mode=fragment&response_type=code&scope=openid&nonce=cd5d9e34-b29e-453b-8073-1d73c35e81bf", host: "keycloak-eclipse-che.192.168.99.111.nip.io", referrer: "https://che-eclipse-che.192.168.99.111.nip.io/"

So user see error page "502 Bad Gateway nginx" instead of che-theia. It can be fixed creation custom ingress configmap and modification ingress controller deployment to use this custom configmap, but such variant doesn't satisfy us. I will contact with keycloak team and I will try investigate why it works fine good on the old keycloak and brings troubles with newer one.

[tolusha]

Just to inform.
We have completed all tests and ready to migrate to keycloak 15.0.2 (will be done approximately next week)

[jenia90]

Just to inform.
We have completed all tests and ready to migrate to keycloak 15.0.2 (will be done approximately next week)

This is great news! :)