Token audience doesn't match domain. #15931

alplunge · 2022-12-09T15:37:25Z

alplunge
Dec 9, 2022

Hi,

Can you please advice how to over come this hurdle

I have my local docker network setup, using Signed JWT as authentication type. Also I have in Use JWKS URL. This is were if fails when running on local machine docker network, I get this error

{
    "message": "failed to get from node cache: response indicates failure, status=400, body={"error":"invalid_client","error_description":"Client authentication with signed JWT failed: Token audience doesn't match domain. Expected audiences are any of [http: //localhost:8088/auth/realms/demo_tenant, http://localhost:8088/auth/realms/demo_tenant/protocol/openid-connect/token, http://localhost:8088/auth/realms/demo_tenant/protocol/openid-connect/ext/par/request, http://localhost:8088/auth/realms/demo_tenant/protocol/openid-connect/ext/ciba/auth] but audience from token is '[http://host.docker.internal:8088/auth/realms/demo_tenant/protocol/openid-connect/token]'"}"
    }

I cannot use localhost, as container communication is not possible. But when using host.docker.internal, it fails here

if (!token.hasAnyAudience(expectedAudiences)) {
    throw new RuntimeException("Token audience doesn't match domain. Expected audiences are any of " + expectedAudiences
            + " but audience from token is '" + Arrays.asList(token.getAudience()) + "'");
}

keycloak apllication in docker see itself as local

private List<String> getExpectedAudiences(ClientAuthenticationFlowContext context, RealmModel realm) {
    String issuerUrl = Urls.realmIssuer(context.getUriInfo().getBaseUri(), realm.getName());
    String tokenUrl = OIDCLoginProtocolService.tokenUrl(context.getUriInfo().getBaseUriBuilder()).build(realm.getName()).toString();
    String parEndpointUrl = ParEndpoint.parUrl(context.getUriInfo().getBaseUriBuilder()).build(realm.getName()).toString();
    List<String> expectedAudiences = new ArrayList<>(Arrays.asList(issuerUrl, tokenUrl, parEndpointUrl));
    String backchannelAuthenticationUrl = CibaGrantType.authorizationUrl(context.getUriInfo().getBaseUriBuilder()).build(realm.getName()).toString();
    expectedAudiences.add(backchannelAuthenticationUrl);

but token received from kong is using docker.network
so it will never match...

I have tried combinations like

ENV KC_HOSTNAME=host.docker.internal
ENV KC_HOSTNAME_STRICT_BACKCHANNEL=true

no use... leaving just

ENV KC_HOSTNAME_STRICT_BACKCHANNEL=true

alignes server uri ti localhost, hence in docker environment it will fail to connect ...

Any suggestions please?

Navigation Menu

Repository navigation

Token audience doesn't match domain. #15931

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Replies: 0 comments

Select a reply

Uh oh!

Token audience doesn't match domain. #15931

Uh oh!

Uh oh!

alplunge Dec 9, 2022

Replies: 0 comments

alplunge
Dec 9, 2022