-
|
I have been using 26.1.4 inside docker with traefik no problem. I recently had to move to a k8s cluster and am now getting 401 errors on any requests using the admin api. Specifically, to get user information. I have tried this using the proxy settings, outside the cluster with https, inside the cluster (via a clusterIP service) using http. I have tried setting the hostname with backchannel dynamic, and all the settings that work locally via podman/docker. Recreate:
Error: I found this artical that has the issue with the same block of code: https://tech-talk.the-experts.nl/upgrading-to-keycloak-22-0-5-to-dependency-hell-and-back-68b75396563e I tried updating the container to 26.5.0-0 and still have the same issue. |
Beta Was this translation helpful? Give feedback.
Replies: 2 comments
-
|
When sending it pod -> service, I can get past the block of code if I use the token from my local keycloak instance configured just about the same. I can't see any logging in this block, but both versions are getting to the catch block here. protected AdminAuth authenticateRealmAdminRequest(HttpHeaders headers) {
String tokenString = AppAuthManager.extractAuthorizationHeaderToken(headers);
if (tokenString == null) throw new NotAuthorizedException("Bearer");
AccessToken token;
try {
JWSInput input = new JWSInput(tokenString);
token = input.readJsonContent(AccessToken.class);
} catch (JWSInputException e) {
throw new NotAuthorizedException("Bearer token format error");
}I am extreamly confused since I am using the same container, basically the same config. I am not accessing it through a proxy. I have set the hostname to be the service and access it within the cluster on http port 8080. I am also importing the same configuration on both for the Test realm. I tried the k8s token on the local keycloak and it fails at the same parsing code block. Kubernetes Config via env: KC_BOOTSTRAP_ADMIN_USERNAME: admin
KC_BOOTSTRAP_ADMIN_PASSWORD: admin
KC_HOSTNAME: https://<internally routable dns>
KC_HTTP_ENABLED: "true"
KC_HOSTNAME_BACKCHANNEL_DYNAMIC: "true"
KC_PROXY_HEADERS: xforwarded
KC_HOSTNAME_STRICT: "false"
KC_HOSTNAME_STRICT_HTTPS: "false"
KC_HOSTNAME_DEBUG: "true"
KC_HEALTH_ENABLED: "true"
KC_DB_URL_HOST: <db sts>
KC_DB_USERNAME: postgres
KC_DB_PASSWORD: admin
KC_DB: postgresDocker Compose Config via env: |
Beta Was this translation helpful? Give feedback.
-
|
Figured this out. Completely self inflicted with config management. envsubst does in fact try to resolve everything with a $ unless you give the cli options to not... |
Beta Was this translation helpful? Give feedback.
Figured this out. Completely self inflicted with config management. envsubst does in fact try to resolve everything with a $ unless you give the cli options to not...