User is created but password couldn't be updated

[akulavasu]

Hi @santhosh-tg @gandham-santhosh ,

On hitting the POST request to User create Admin (/api/user/v1/create), we get the following error

Request body:

{
    "request": {
        "firstName": "SunbirdOrgAdmin",
        "lastName": "",
        "email": "[email protected]",
        "userName": "{{auth_username}}",
        "password": "{{auth_password}}",
        "emailVerified":true,
        "dob":"2001",
        "channel":"sunbird-xi",
        "roles": ["ORG_ADMIN", "CONTENT_CREATOR", "CONTENT_REVIEWER"]
    }
}

Response

{
    "id": "api.user.create",
    "ver": "v1",
    "ts": "2024-01-19 05:52:00:559+0000",
    "params": {
        "resmsgid": "0638543ee0b1643680fcf032b82e64d7",
        "msgid": "0638543ee0b1643680fcf032b82e64d7",
        "err": null,
        "status": "SUCCESS",
        "errmsg": null
    },
    "responseCode": "OK",
    "result": {
        "userId": "cce0eb7b-e2c1-4ac2-9024-36214ae35c25",
        "response": "SUCCESS",
        "err_msg": "User is created but password couldn't be updated.",
        "errors": []
    }
}

As mentioned in https://github.com/orgs/Sunbird-Ed/discussions/306 , we checked the following

1. Cassandra provider is available in user federation(Keycloak sunbird realm)

2. Channel is available in cassandra DB.

3. Player service --> Realm is set to sunbird in configmap but there is no key for SSO URL.

4. Set the below variables to false in player configmap
   sunbird_p1_reCaptcha_enabled: false
   sunbird_p2_reCaptcha_enabled: false
   sunbird_p3_reCaptcha_enabled: false

5. Verified all these variables are updated in private repo -
   core_vault_sunbird_sso_publickey
   adminutil_refresh_token_public_key_kid
   adminutil_refresh_token_secret_key

6. Assigned manage-users role to lms client

Please let us know what configuration is missing.

[gandham-santhosh]

@akulavasu were you not able to see this user in the system after it is created? Did you check if there are any errors seen on learner service? @AmiableAnil

[akulavasu]

@AmiableAnil - Yes, we can

[AmiableAnil]

@akulavasu we can connect here at 4:00PM

Microsoft Teams meeting
Join on your computer, mobile app or room device
Click here to join the meeting
Meeting ID: 446 030 820 79
Passcode: Gf8dKv
Download Teams | Join on the web
Learn More | Meeting options

[akulavasu]

Thanks for the call @AmiableAnil . As discussed, let's connect again to resolve the same.

Issues observed so far,

1. Temporary password not getting updated in keycloak.
2. After manually providing credential in keycloak and logging in portal shows Access denied and below error is logged in player service.

{"channel":"sunbird","env":"dev.dev.portal","level":"info","message":{"msg":"KONG_TOKEN :: request using existing token","originalUrl":"/resources?auth_callback=1&state=dd08127e-70af-47c1-8fad-174610f829f8&session_state=22ca50be-d5da-4daa-a34b-cba2906c200d&code=6871a73c-e71a-40f4-9f49-eb5d318571f7.22ca50be-d5da-4daa-a34b-cba2906c200d.8c12290d-d62f-48ce-913b-c93bf995ca59","route":"/resources","sessionId":"3ceXAZMnUU2lx5XjiceGDiXBueoeMQ6y"},"pdata":{"id":"dev.dev.portal","pid":"sunbird-portal-backend","ver":"6.0.0"},"timestamp":"2024-01-29 11:35:17"}
Error from postauth > getGrantFromCode {
  err: Error: unable to verify the first certificate
      at TLSSocket.onConnectSecure (node:_tls_wrap:1539:34)
      at TLSSocket.emit (node:events:513:28)
      at TLSSocket._finishInit (node:_tls_wrap:953:8)
      at TLSWrap.ssl.onhandshakedone (node:_tls_wrap:734:12) {
    code: 'UNABLE_TO_VERIFY_LEAF_SIGNATURE'
  },
  queryObj: {
    auth_callback: '1',
    state: 'dd08127e-70af-47c1-8fad-174610f829f8',
    session_state: '22ca50be-d5da-4daa-a34b-cba2906c200d',
    code: '6871a73c-e71a-40f4-9f49-eb5d318571f7.22ca50be-d5da-4daa-a34b-cba2906c200d.8c12290d-d62f-48ce-913b-c93bf995ca59'
  }
}
Could not obtain grant code: Error: unable to verify the first certificate

[akulavasu]

@santhosh-tg @gandham-santhosh @AmiableAnil , the second issue mentioned above (Unable to verify the first certificate) is resolved now after updating the certificate chain crt file along with the site certificate crt in the core_vault_proxy_site_crt variable under core/secrets.yml in private repo.

Once this was fixed, the keycloak password update also started working as expected.

Thanks