Keycloak: Invalid token issuer when running as docker service

user_13601206 0
Viewed 5243

I have a problem:

WWW-Authenticate Bearer realm="test", error="invalid_token", error_description="Invalid token issuer. Expected 'http://keycloak:8080/auth/realms/test', but was 'http://localhost:8080/auth/realms/test'"

My settings:

application.yml

keycloak:
  realm: test
  resource: api
  auth-server-url: http://keycloak:8080/auth
  ssl-required: external
  autodetect-bearer-only: true
  cors: true
  principal-attribute: preferred_username
  credentials:
    secret: 2b553733-8d5f-4276-8ace-17112ac7ac20

docker-compose.yml

keycloak:
    image: jboss/keycloak:10.0.0
    environment:
      - KEYCLOAK_USER=admin
      - KEYCLOAK_PASSWORD=admin
    ports:
      - "8080:8080"
    networks:
      - net

Auth url: http://localhost:8080/auth/realms/test/protocol/openid-connect/auth Token url: http://localhost:8080/auth/realms/test/protocol/openid-connect/token

I understand why the problem exists, but I don`t understand how to fix it.

keycloak docker spring
2 Answers

Keycloak's Default Hostname Provider (https://www.keycloak.org/docs/latest/server_installation/#default-provider) has a property called frontendURL which should be set as the public URL on which Keycloak is exposed.

Setting frontendURL ensures that all front-channel URLs, like issuer, authorization_endpoint use the configured value as hostname in the URLs and back-channel URLs keep using hostname in the request.

user_15868240

I added 127.0.0.1 keycloak in hosts file and used http://keycloak:8080/auth/realms/*** url to get the token. Now the JWT token contained the issuer as keycloak instead of localhost. I verified the token using jwt.io website. This resolved the mismatch in token issuer.

user_45740910
Related