Repository navigation
AWS Fargate deployment with load balancer proxy is unable to connect to external identity providers
#38527
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Hi all,
I installed Keycloak in AWS Fargate behind a load balancer. Everything is working perfectly as long as the system works standalone, but I am unable to setup external identity providers: any internet connection that starts from Keycloak ends in a timeout.
The configuration is the following one:
Version: 26.1
Container built with:
kc.sh build --health-enabled true --metrics-enabled true --db postgres --features preview --metrics-enabled=trueContainer run with:
kc.sh start --optimized --proxy-headers=xforwardedEnvironment variables:
The container exposes ports 8443, 8080 and 9000.
ALB routes all TCP traffic from port 443 to 8443.
When I try to configure a remote IdP by entering its discovery endpoint in admin console, the following error appears in the container log:
ERROR [org.keycloak.services.error.KeycloakErrorHandler] (executor-thread-4) Uncaught server error: org.apache.http.conn.ConnectTimeoutException: Connect to ***:443 [***/x.x.x.x] failed: Connection timed outIf I configure an OIDC IdP manually, authentication fails at the last step when control is sent back to KeyCloak and it has to contact the IdP directly: same timeout error.
My hunch is that the issue is proxy relatade, but I have no idea how to fix it.
Thanks in advance for any suggestion.
All reactions