Repository navigation
Keycloak 22 – Issuer URL Configuration with Kubernetes Internal Service #41858
Replies: 1 comment 13 replies
|
Hello @shawkins, Can you please provide some guidance. |
|
For version 22 that stack would indicate that it is finding the bearer token, but that either the token is not valid or your user does not have admin access. |
|
Hi @shawkins As per my investigation, Token is valid and Keycloak user also does have right access. NOTE: If I set the hostname-url as public url, then i won't see this 401 error and able to load the clients, user information and further things as expected. But, as you know the only drawback with setting hostname-url here is I don't get issuer URL as Kubernetes internal service URL. |
|
Hello @shawkins, Why here is validating with Keycloak public URL ?
|
|
Yeah @shawkins, I was excited and curious about why all previous requests were successfully authenticated until login. It looks like i'm back to the starting place. Do you think, to handle our scenarios we have better approaches in the later version of the keycloak ? |
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Hi team,
We are upgrading from Keycloak 18 (Wildfly) to Keycloak 22 (Quarkus). Our Keycloak is deployed in a Kubernetes cluster, behind Nginx and Zuul API Gateway.
In Keycloak 18, the issuer claim in tokens we get as Kubernetes internal service URL, and we want to maintain the same behavior after upgrading.
Current behavior:
Using the following configuration, Keycloak Admin Console and realms load fine, but the issuer URL is not the Kubernetes internal service URL:
/opt/keycloak/keycloak/bin/kc.sh start \ --optimized \ --hostname-url=https://keycloak.unstable.com/auth \ --hostname-strict=false \ --https-port=8000 \ --hostname-port=8000 \ --proxy=edge \ --hostname-admin-url=https://keycloak.unstable.com/auth \ --http-enabled=true \ --https-certificate-file=service.crt \ --https-certificate-key-file=service.key \ --import-realm \ --log="console,file" &When changing the --hostname-url to our internal service URL, the issuer claim is correct, but the Admin Console never loads and attached issue we get:
--hostname-url=https://keycloak.svc.ny2np2.local:8000/authCould you please advise on the correct hostname and proxy configuration so that:
The issuer claim uses the Kubernetes internal service URL.
The Admin Console loads successfully through the gateway.
All reactions