happy-morning-85531
02/23/2022, 12:25 PMincalculable-city-41629
02/23/2022, 12:46 PMhappy-morning-85531
02/23/2022, 12:48 PMincalculable-city-41629
02/23/2022, 1:59 PMhappy-morning-85531
02/23/2022, 2:00 PMincalculable-city-41629
02/23/2022, 2:00 PMhappy-morning-85531
02/23/2022, 2:02 PMconfig:
courier:
smtp: {}
#template_override_path: /conf/courier-templates
identity:
default_schema_url: file:///etc/config/identity.company_employees.schema.json
serve:
public:
base_url: <http://kratos-public:80>
port: 4433
admin:
base_url: <http://kratos-admin:80>
port: 4434
selfservice:
default_browser_return_url: <https://dashboard.dev.company.com/>
whitelisted_return_urls:
- <https://dashboard.dev.company.com>
methods:
password:
enabled: true
flows:
error:
ui_url: <https://dashboard.dev.company.com/error>
settings:
ui_url: <https://dashboard.dev.company.com/settings>
privileged_session_max_age: 15m
recovery:
enabled: true
ui_url: <https://dashboard.dev.company.com/recovery>
verification:
enabled: true
ui_url: <https://dashboard.dev.company.com/verification>
after:
default_browser_return_url: <https://dashboard.dev.company.com/>
logout:
after:
default_browser_return_url: <https://dashboard.dev.company.com/login>
login:
ui_url: <https://dashboard.dev.company.com/login>
lifespan: 10m
registration:
lifespan: 10m
ui_url: <https://dashboard.dev.company.com/registration>
after:
password:
hooks:
- hook: session
secrets: {}
incalculable-city-41629
02/23/2022, 2:14 PMhappy-morning-85531
02/23/2022, 2:15 PMincalculable-city-41629
02/23/2022, 2:17 PMhappy-morning-85531
02/23/2022, 3:02 PMflowId=$(curl -s -X GET -H "Accept: application/json" <https://accounts.dev.example.com/self-service/registration/api> | jq -r '.id')
and
curl -s -X GET -H "Accept: application/json" <https://accounts.dev.example.com/self-service/registration/flows>\?id\=$flowId | jq
<https://accounts.dev.example.com/self-service/login/browser?aal=&refresh=&return_to=>
returns with endless redirect<https://accounts.dev.company.se/self-service/registration/browser?return_to=>
also results in endless redirect• ORY Kratos and the application need to share the same DNS-name in order to be able to communicate with cookies. That's not how things are working out-of-the-box in Knative where each service gets its own DNS-name.Maybe this is the issue?
time=2022-02-23T15:12:00Z level=error msg=An error occurred while handling a request audience=application error=map[debug: details:map[docs:<https://www.ory.sh/kratos/docs/debug/csrf> hint:The anti-CSRF cookie was found but the CSRF token was not included in the HTTP request body (csrf_token) nor in the HTTP Header (X-CSRF-Token). reject_reason:The HTTP Cookie Header was set and a CSRF token was sent but they do not match. We recommend deleting all cookies for this domain and retrying the flow.] message:the request was rejected to protect you from Cross-Site-Request-Forgery reason:The request was rejected to protect you from Cross-Site-Request-Forgery (CSRF) which could cause account takeover, leaking personal information, and other serious security issues. status:Forbidden status_code:403] http_request=map[headers:map[accept:application/json, text/plain, */* user-agent:axios/0.21.4 x-b3-parentspanid:07a74f5993647eef x-b3-sampled:0 x-b3-spanid:58f6bfef170f377c x-b3-traceid:1689ef216248e17a07a74f5993647eef x-envoy-attempt-count:1 x-forwarded-client-cert:By=<spiffe://cluster.local/ns/ory/sa/kratos-ksa;Hash=5e07920ae90f22a5065e91e2f81ee4bc04cde28c0b8d753ed5f6669ec6571dd3;Subject=>"";URI=<spiffe://cluster.local/ns/ory/sa/default> x-forwarded-proto:http x-request-id:5dac89b8-6b41-4c62-8dd1-e4081fd5792c] host:kratos-public method:GET path:/self-service/registration/flows query:Value is sensitive and has been redacted. To see the value set config key "log.leak_sensitive_values = true" or environment variable "LOG_LEAK_SENSITIVE_VALUES=true". remote:127.0.0.6:60649 scheme:http] http_response=map[status_code:403] service_name=Ory Kratos service_version=v0.8.0-alpha.3
incalculable-city-41629
02/23/2022, 4:06 PMsession:
cookie:
domain: <your.domain>
persistent: true
happy-morning-85531
02/23/2022, 4:08 PMincalculable-city-41629
02/23/2022, 4:09 PMhappy-morning-85531
02/23/2022, 4:10 PMincalculable-city-41629
02/23/2022, 4:10 PMhappy-morning-85531
02/23/2022, 4:11 PMincalculable-city-41629
02/23/2022, 4:11 PMserve:
public:
cors:
enabled: false
base_url: <http://kratos-public:80>
port: 4433
the port part does not sound good to me
can you try
base_url: <http://kratos-public:4433>
happy-morning-85531
02/23/2022, 4:16 PMincalculable-city-41629
02/23/2022, 4:16 PMhappy-morning-85531
02/23/2022, 4:16 PMspec:
ports:
- name: http
port: 80
protocol: TCP
targetPort: http-public
incalculable-city-41629
02/23/2022, 4:16 PMhappy-morning-85531
02/23/2022, 4:18 PMserve:
public:
base_url: <http://kratos-public>
admin:
base_url: <http://kratos-admin>
incalculable-city-41629
02/23/2022, 4:18 PMhappy-morning-85531
02/23/2022, 4:19 PMincalculable-city-41629
02/23/2022, 4:19 PMhappy-morning-85531
02/23/2022, 4:20 PMincalculable-city-41629
02/23/2022, 4:20 PMhappy-morning-85531
02/23/2022, 4:21 PMimage:
repository: oryd/kratos
tag: v0.8.0-alpha.3
and
image: oryd/kratos-selfservice-ui-node:v0.8.0-alpha.3
incalculable-city-41629
02/23/2022, 4:22 PMhappy-morning-85531
02/23/2022, 4:23 PMincalculable-city-41629
02/23/2022, 4:23 PMhappy-morning-85531
02/23/2022, 4:23 PMincalculable-city-41629
02/23/2022, 4:24 PMhappy-morning-85531
02/23/2022, 4:26 PMtime=2022-02-23T16:25:37Z level=warning msg=The config has no version specified. Add the version to improve your development experience. audience=application service_name=Ory Kratos service_version=v0.8.0-alpha.3
time=2022-02-23T16:25:37Z level=info msg=Software quality assurance features are enabled. Learn more at: <https://www.ory.sh/docs/ecosystem/sqa> audience=application service_name=Ory Kratos service_version=v0.8.0-alpha.3
time=2022-02-23T16:25:37Z level=info msg=TLS has not been configured for admin, skipping audience=application service_name=Ory Kratos service_version=v0.8.0-alpha.3
time=2022-02-23T16:25:37Z level=info msg=Starting the admin httpd on: 0.0.0.0:80 audience=application service_name=Ory Kratos service_version=v0.8.0-alpha.3
time=2022-02-23T16:25:37Z level=info msg=TLS has not been configured for public, skipping audience=application service_name=Ory Kratos service_version=v0.8.0-alpha.3
time=2022-02-23T16:25:37Z level=info msg=Starting the public httpd on: 0.0.0.0:80 audience=application service_name=Ory Kratos service_version=v0.8.0-alpha.3
time=2022-02-23T16:25:37Z level=fatal msg=Failed to gracefully shutdown admin httpd: listen tcp 0.0.0.0:80: bind: permission denied audience=application service_name=Ory Kratos service_version=v0.8.0-alpha.3
incalculable-city-41629
02/23/2022, 4:27 PMhappy-morning-85531
02/23/2022, 4:27 PMincalculable-city-41629
02/23/2022, 4:28 PMhappy-morning-85531
02/23/2022, 4:30 PMapiVersion: v1
kind: Service
metadata:
name: kratos-admin-test
namespace: ory
labels:
<http://app.kubernetes.io/component|app.kubernetes.io/component>: admin
<http://app.kubernetes.io/name|app.kubernetes.io/name>: kratos
<http://helm.sh/chart|helm.sh/chart>: kratos-0.21.8
<http://app.kubernetes.io/instance|app.kubernetes.io/instance>: ory
<http://app.kubernetes.io/version|app.kubernetes.io/version>: "v0.8.0-alpha.3"
spec:
type: ClusterIP
ports:
- port: 80
targetPort: 4434
protocol: TCP
name: http
selector:
<http://app.kubernetes.io/name|app.kubernetes.io/name>: kratos
<http://app.kubernetes.io/instance|app.kubernetes.io/instance>: ory
---
# Source: ory/charts/kratos/templates/service-public.yaml
apiVersion: v1
kind: Service
metadata:
name: kratos-public-test
namespace: ory
labels:
<http://app.kubernetes.io/component|app.kubernetes.io/component>: public
<http://app.kubernetes.io/name|app.kubernetes.io/name>: kratos
<http://helm.sh/chart|helm.sh/chart>: kratos-0.21.8
<http://app.kubernetes.io/instance|app.kubernetes.io/instance>: ory
<http://app.kubernetes.io/version|app.kubernetes.io/version>: "v0.8.0-alpha.3"
spec:
type: ClusterIP
ports:
- port: 80
targetPort: 4433
protocol: TCP
name: http
selector:
<http://app.kubernetes.io/name|app.kubernetes.io/name>: kratos
<http://app.kubernetes.io/instance|app.kubernetes.io/instance>: ory
incalculable-city-41629
02/23/2022, 4:32 PMhappy-morning-85531
02/23/2022, 4:32 PMincalculable-city-41629
02/23/2022, 4:32 PMhappy-morning-85531
02/23/2022, 4:32 PMaudience=application service_name=Ory Kratos service_version=v0.8.0-alpha.3
time=2022-02-23T16:32:30Z level=warning msg=The config has no version specified. Add the version to improve your development experience. audience=application service_name=Ory Kratos service_version=v0.8.0-alpha.3
time=2022-02-23T16:32:30Z level=info msg=Software quality assurance features are enabled. Learn more at: <https://www.ory.sh/docs/ecosystem/sqa> audience=application service_name=Ory Kratos service_version=v0.8.0-alpha.3
time=2022-02-23T16:32:30Z level=info msg=TLS has not been configured for admin, skipping audience=application service_name=Ory Kratos service_version=v0.8.0-alpha.3
time=2022-02-23T16:32:30Z level=info msg=Starting the admin httpd on: 0.0.0.0:4434 audience=application service_name=Ory Kratos service_version=v0.8.0-alpha.3
time=2022-02-23T16:32:30Z level=info msg=TLS has not been configured for public, skipping audience=application service_name=Ory Kratos service_version=v0.8.0-alpha.3
time=2022-02-23T16:32:30Z level=info msg=Starting the public httpd on: 0.0.0.0:4433 audience=application service_name=Ory Kratos service_version=v0.8.0-alpha.3
incalculable-city-41629
02/23/2022, 4:32 PMhappy-morning-85531
02/23/2022, 4:33 PMincalculable-city-41629
02/23/2022, 4:33 PMhappy-morning-85531
02/23/2022, 4:34 PMincalculable-city-41629
02/23/2022, 4:35 PMhappy-morning-85531
02/23/2022, 4:36 PMincalculable-city-41629
02/23/2022, 4:37 PMbase_url:
happy-morning-85531
02/23/2022, 4:39 PMincalculable-city-41629
02/23/2022, 4:39 PMhappy-morning-85531
02/23/2022, 4:41 PMincalculable-city-41629
02/23/2022, 4:41 PMhappy-morning-85531
02/23/2022, 4:42 PMincalculable-city-41629
02/23/2022, 4:43 PMhappy-morning-85531
02/23/2022, 4:45 PM<https://accounts.dev.example.com/self-service/login/browser?aal=&refresh=&return_to=>
and <https://dashboard.dev.example.com/login?flow=154b99ba-32ae-4fbc-9e96-5b40fe409bb2>
incalculable-city-41629
02/23/2022, 6:01 PMhappy-morning-85531
02/23/2022, 6:02 PM