Validating keycloak bearer token on behalf of client

user_8675561 0
Viewed 927

I want to validate bearer tokens in an API, which are passed from a browser application. The API will validate the tokens against Keycloak by calling the ../userinfo endpoint and respond with the desired content if the check runs ok. Problem is that If I pass a bearer token from the browser, or any other app for that matter (e.g. postman), to the api and try to validate it - I get "401 Token verification failed".

The following works:

  1. Fetch token from Keycloak through Postman by using username and password.
  2. Fetch userinfo from Keycloak through Postman using the resulting bearer token.

OR

  1. Fetch token from Keycloak directly from the API by using username and password.
  2. Fetch userinfo from Keycloak from the API using the resulting bearer token.

The following does NOT work:

  1. Fetch token from Keycloak through Postman by using username and password.
  2. Send request to API, running in a docker container, containing the bearer token.
  3. API tries to fetch userinfo using the token = "401 Token verification failed"

Using same client_id and client_secret in all scenarios.

Is this a docker networking thing? Or is some Keycloak configuration necessary in order for the API to validate token "on behalf" of the client? Quite new to authorization flows.

keycloak docker oauth django python
1 Answers

Figured it out: I was calling Keycloak at different urls, localhost:8080 from postman and host.docker.internal:8080 from the api running in Docker. Turns out you have to call Keycloak at same URL from both ends. I switched to using my machines' ip in both cases and voila!

user_86755610
Related