[Automation Suite] [Troubleshooting] How To Debug Login Issues

[system]

How to debug login issues

Issue Description
This article is for debugging login issues for Automation Suite. It will help you diagnose the problem and locate the errors that are most relevant to the problem.

Background
The platform has a service called 'Identity' that is primarily responsible for managing Authentication and Authorization for users. If you would like more details about the protocol you can read this documentation: https://openid.net/developers/how-connect-works/

Diagnostic Steps

1. Check the well-known endpoints. The well-known endpoint is used in the protocol as a configuration endpoint for clients during authentication. It is also used as a quick health check for the Identity service. Go to https://<FQDN>/identity_/.well-known/openid-configuration and make sure a json string is rendered. Here is an example of what this would look like:

2. If any errors pop up or it is not displayed, this means there is a problem with the Identity service.
   To check the logs you can run the following command from the linux terminal:
   # kubectl -n uipath logs deploy/identity-service-api
   
3. If that page loads, next try and get a HAR trace in Chrome browser by navigating to three dots > More Tools > Developer Tools.
   Navigate to the Network tab, look at Request URL and you will see similar kinds of headers.

4. Look at the URL path. In this case, it is api/AuthenticationInformation/kapilkb.
5. Login to terminal and search for the above parameter in istio-system logs. Run the following command:-
   # for pod in $(kubectl -n istio-system get pods -l app.kubernetes.io/instance=gateway | awk '{print $1}' | grep -v NAME); do kubectl -n istio-system logs $pod | grep api/AuthenticationInformation/kapilkb | jq; done
6. Trace the 503 request. Note down that it is coming from identity-service-api service.

7. Use the upstream_cluster to check the corresponding service.
   # kubectl -n uipath get svc identity-service-api

8. Check for identity-service-api service in yaml output and note down its selector. In this case, the selector is app.kubernetes.io/name: identity-service-api.
   # kubectl -n uipath get svc identity-service-api -o yaml

9. Check for pods corresponding the label app.kuberenetes.io/name: identity-service-api.
   # kubectl -n uipath get pods -l app.kubernetes.io/name=identity-service-api

10. Check the logs for identity-service-api pod and trace exceptions related to location and identity service.
    # kubectl -n uipath logs identity-service-api-5df469c4ff-zqd85