Zammad sends many GET requests to keycloak

[saz]

Infos:

• Used Zammad version: 6.2.0
• Used Zammad installation type: source
• Operating system: Ubuntu Focal
• Browser + version: N/A

Expected behavior:

• Zammad sends only required requests to Keycloak

Actual behavior:

• I’m seeing a huge number of GET requests to https://keycloak.example.com/realms/realm/protocol/saml
  All of them are resulting in a “400 Bad Request”.

As those are GET requests, there’s no additional payload and no URL params set.

I’m not sure, if this is a bug or just a configuration issue, although there’s not much to configure to get SAML working.

Steps to reproduce the behavior:

• No idea, maybe setting up SAML with Keycloak is already enough?

[MrGeneration]

Make sure that these callback URLs are actually correct and fitting.
To me at least it looks faulty - the documentation should have you covered:
https://admin-docs.zammad.org/en/latest/settings/security/third-party/saml.html

[pluhmen]

Same here, I double checked the config and according to the mentioned documentation the very same saml endpoint should be configured that in return results in a lot of 400 GET errors.

[saz]

I’ve followed the docs.

Keycloak reports the following error:

Mar 11 14:42:27 keycloak1 keycloak[2145921]: 2024-03-11 14:42:27,650 WARN  [org.keycloak.events] (executor-thread-569) type="LOGIN_ERROR", realmId="8b4fce40-843b-44d5-8d47-ecbd16ad6efc", clientId="null", userId="null", ipAddress="<removed>", error="saml_token_not_found"

I’ve added the keycloak client via the XML config retrieved from zammad.

Maybe the Client ID https://zammad.example.com/auth/saml/metadata is wrong? But that’s what can be found within the XML

[tschaefer]

This seems to be the overeager TLS verification check request during the initialization phase of the SAML client. We removed the check last week.

[saz]

Looks like the issue has been resolved for me.