<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">On 14/10/15 20:27, Rafael Coutinho
wrote:<br>
</div>
<blockquote
cite="mid:CANCuF9iYHFLC5=3EP546-LM2KbquAwPB7uO90e00+vbKuPEUDA@mail.gmail.com"
type="cite">
<div dir="ltr">Hi,
<div><br>
</div>
<div>I have an environment with an AngularJS app client, which
authenticates user and keeps its data, and a server app that
receive some requests for Webservices resources. </div>
<div>For some webservices I need, on the server side, to
translate the token into the user information. For that I use
the url:</div>
<div><br>
</div>
<div>auth/realms/MYREAL/protocol/openid-connect/userinfo <br>
</div>
<div><br>
</div>
<div>with the Authorization token.</div>
<div><br>
</div>
<div>The problem is that the server is behind a load balance and
access keycloak thru port 8080. While AngularJS access the
same server thru port 80.</div>
<div><br>
</div>
<div>Keycloak complains that the Token was issued from a
different url than I'm querying on the server side. Forcing me
to use the same hostname and port on the server and on the
client.</div>
<div><br>
</div>
<div>Is that correct? How will I deploy on a distribuited
environment?</div>
</div>
</blockquote>
We don't handle this scenario ideally. Feel free to create JIRA for
it. <br>
<br>
Currently the "iss" (issuer) field on accessToken is filled from the
URL of request to the auth-server, which in your case is something
like yourHost:80 . Then UserInfo endpoint always compare this value
with the uriInfo from current request, so it doesn't work when
requests to auth-server is send via yourHost:8080 .<br>
<br>
IMO it will be nice if accessToken can have more values for "iss"
field . Then we can have protocolMapper, which will be able to add
any configured values to "iss" field in accessToken in addition to
the "iss" from current request. The adapter/endpoint will reject
just if uriInfo doesn't match any of the "iss" values.<br>
<br>
As of now, I suggest to invoke UserInfo endpoint directly from your
AngularJS instead of from your webservice. The user info then needs
to be send to the webservices.<br>
<br>
Marek<br>
<br>
<blockquote
cite="mid:CANCuF9iYHFLC5=3EP546-LM2KbquAwPB7uO90e00+vbKuPEUDA@mail.gmail.com"
type="cite">
<div dir="ltr">
<div><br>
</div>
<div>ps. I'm using my own HTTP client to make that request to
userinfo. </div>
<div>ps2. I have added "auth-server-url-for-backend-requests"
however I don't see any difference.</div>
<div><br clear="all">
<div>
<div class="gmail_signature">Rafael Coutinho<br>
Software Engineer<br>
Professional profile: <a moz-do-not-send="true"
href="http://www.linkedin.com/in/rafaelcoutinho"
target="_blank">www.linkedin.com/in/rafaelcoutinho</a><br>
<br>
</div>
</div>
</div>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
keycloak-user mailing list
<a class="moz-txt-link-abbreviated" href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a>
<a class="moz-txt-link-freetext" href="https://lists.jboss.org/mailman/listinfo/keycloak-user">https://lists.jboss.org/mailman/listinfo/keycloak-user</a></pre>
</blockquote>
<br>
</body>
</html>