Enable debugging for user authentication issues

Enable debugging for platform-auth-service Liberty to get trace logs for debugging user authentication issues.

Enable debug logs by using oc commands

Complete these steps to enable debug logging of auth-idp container pods by using the command-line interface:

  1. Update the platform-auth-idp configmap. Then, save it.

     oc edit cm platform-auth-idp -n <your-common-services-namespace>

     LIBERTY_DEBUG_ENABLED: "false"   << true
 LOG_LEVEL_AUTHSVC: info    << debug
 LOG_LEVEL_IDMGMT: info     << debug
 LOG_LEVEL_IDPROVIDER: info  << debug

  2. Restart the auth-idp pod by deleting the pod.

     oc delete pod -l k8s-app=auth-idp -n <your-common-services-namespace>

  3. Wait for all 4 container pods to start.

     oc get pods -l k8s-app=auth-idp -n <your-common-services-namespace>

Enable debug logs by using the the OpenShift Container Platform console

Complete these steps to enable debug logging of auth-idp container pods by using the OpenShift Container Platform console:

  1. Log in to the OpenShift Container Platform console as a user with cluster administrator access.

  2. From the navigation menu, click Configuration > ConfigMaps.

  3. Search for platform-auth-idp.

  4. Click ... > Edit.

  5. Change the LOG_LEVEL_IDPROVIDER, LOG_LEVEL_AUTHSVC, LOG_LEVEL_IDMGMT parameter values to debug.

     LIBERTY_DEBUG_ENABLED: "false"     << true
 LOG_LEVEL_AUTHSVC: info            << debug
 LOG_LEVEL_IDMGMT: info             << debug
 LOG_LEVEL_IDPROVIDER: info         << debug

  6. Click Submit.

  7. From the navigation menu, click Workloads > Pods.

  8. Locate auth-idp and delete it.

  9. Click ... > Actions > Delete pod.

  10. Wait for some time. Then, check the status of the auth-idp pods on the Pods pane. The status of all the pods must show as 4/4 under the Ready field name.

Collect auth-idp pod logs and liberty container logs

After you enable debugging, re-create the issue and collect debug logs. Then, share all the auth-idp pod logs with the support team.

The following cat MG-IDP-log.sh script helps to collect the container and liberty logs of multiple auth-idp pods.

Note: Before you run the script, define the NAMESPACE environment variable with the namespace where you deployed foundational services.

#!/bin/bash
export NAMESPACE=ibm-common-services
export AUTHMGDIR=AuthidpLogs-$(date '+%y%b%dT%H-%M-%S')
mkdir -p $AUTHMGDIR
for pod in $(oc -n $NAMESPACE get pods -l component=auth-idp --no-headers -o custom-columns=name:.metadata.name); do
echo "===== $pod ====="
LIBDIR="$AUTHMGDIR/$pod/liberty"
sudo mkdir -p $LIBDIR
# Collect the liberty logs
echo "===== $pod collect liberty logs           ====="
oc -n $NAMESPACE cp $pod:/logs -c platform-auth-service $LIBDIR/logs
echo "===== $pod collect liberty configuration  ====="
oc -n $NAMESPACE cp $pod:/opt/ibm/wlp/usr/servers/defaultServer/ -c platform-auth-service $LIBDIR/defaultserver
#collect the idp container logs
echo "===== $pod collect container logs         ====="
oc get pods -l component=auth-idp -n $NAMESPACE -o go-template='{{range $i := .items}}{{range $c := $i.spec.containers}}{{println $i.metadata.name $c.name}}{{end}}{{end}}' > $AUTHMGDIR/$pod/container-list.txt
awk '{print "oc -n $NAMESPACE logs "$1" -c "$2"  -p > $AUTHMGDIR/$pod/"$1"_"$2"_previous.log && echo gathered previous logs of "$1"_"$2}' $AUTHMGDIR/$pod/container-list.txt | bash
awk '{print "oc -n $NAMESPACE logs "$1" -c "$2"   > $AUTHMGDIR/$pod/"$1"_"$2".log && echo gathered logs of "$1"_"$2}' $AUTHMGDIR/$pod/container-list.txt | bash
done
echo;echo
echo "===== tar czf $AUTHMGDIR.tgz $AUTHMGDIR  and send the file for analysis ----"
echo;echo

Send the logs to the support team

Complete these tasks after you collect the logs:

Note: When debug logging is enabled, excess logs are generated, which might affect the container resources. After you collect the debug logs, revert the log level values by editing the settings in the platform-auth-idp configmap. For the previous log level values, see parameter values.