How to configure keycloak to work in Docker Compose together with other apps #15645

Danielku15 · 2022-11-23T12:03:11Z

Danielku15
Nov 23, 2022

Hi everyone.

My problem relates to the rather known issue of having a discrepancy between the hostname+port written in the Issuer of the openid-configuration and the hostname+port under which Keycloak is actually reachable. I hope someone can help me out on my problem.

I have an own API written in ASP.net core and it uses KeyCloak to perform authentication and authorization. My API loads the openid-configuration from the internal network. When using the Swagger UI to login into KeyCloak to obtain a token things start to fail because of different hostnames used by the API and the Browser. I tried to extend my software and use KC_HOSTNAME_URL to get this running but something is always wrong making either the tokens to be not considered valid or the browser failing to reach keycloak.

I startup both together using Docker Compose and link them together like:

version: "3.9"
services:
  idp:
    image: keycloak/keycloak:20.0.1
    environment:
      - KEYCLOAK_ADMIN=admin
      - KEYCLOAK_ADMIN_PASSWORD=admin
      - KC_HOSTNAME_URL=http://idp:8080/
    ports:
      - 18080:8080
    command: start-dev

  api: 
    image: api:1.0.0
    environment:
      - MetadataAddress=http://idp:8080/realms/master/.well-known/openid-configuration
      - PublicMetadataAddress=http://localhost:18080/realms/master/.well-known/openid-configuration
    ports:
      - "18081:80"

I use MetadataAddress so my API can fetch the details like issuer and keys to validate the received JWTs.
For now I use a basic PublicMetadataAddress which I pass to the browser (Swagger UI). Thiss will be improved this later.

But when I now try to login to the API through the Swagger UI, it takes the authorization_endpoint to redirect the browser and this URL is pointing to http://idp:8080/realms/master/protocol/openid-connect/auth making and this obviously fails. The host machine cannot reach "idp:8080".

Is it a bug that the authorization_endpoint is not taking the request hostname like token_endpoint or am I doing something wrong? It looks to me if the authorization_endpoint would also take the request hostname like the any other endpoints, the browser could reach it when performing logins, but also other services in the container network could use the endpoint when needed.

Has anyone successfully used Keycloak in such a setup where you have not a reverse proxy or something additionally in place to unify the traffic?

Note: This docker compose is meant for simple development and test environments and therefore we do not want to have too many services which agian add complexity to the system. We just want an API and KeyCloak as IdP bundled for easy starting.

Navigation Menu

Repository navigation

How to configure keycloak to work in Docker Compose together with other apps #15645

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Replies: 0 comments

Select a reply

Uh oh!

How to configure keycloak to work in Docker Compose together with other apps #15645

Uh oh!

Uh oh!

Danielku15 Nov 23, 2022

Replies: 0 comments

Danielku15
Nov 23, 2022