<div dir="ltr">I think that's pretty self explanatory. Token is issued by '<a href="http://slaveKCInstance.ourcompanyname.com:8230">http://slaveKCInstance.ourcompanyname.com:8230</a>', while the adapter is expecting '<a href="http://masterKCInstance.ourcompanyname.com:8230">http://masterKCInstance.ourcompanyname.com:8230</a>'. You need a load balancer in front of your nodes so the applications talk to "https//<a href="http://kc.ourcompany.com">kc.ourcompany.com</a>".</div><div class="gmail_extra"><br><div class="gmail_quote">On 22 September 2016 at 23:04, <a href="mailto:i.pop@centurylink.net">i.pop@centurylink.net</a> <span dir="ltr"><<a href="mailto:i.pop@centurylink.net" target="_blank">i.pop@centurylink.net</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div style="font-family:times new roman,new york,times,serif;font-size:12pt;color:#000000"><div style="color:rgb(0,0,0);font-family:"times new roman","new york",times,serif;font-size:12pt">Additional info to make my case cleared. This is what I get from my targeted microservice process log:</div><div><div><font face="times new roman, new york, times, serif">org.keycloak.common.<wbr>VerificationException: Token audience doesn't match domain. Token issuer is</font></div><div><font face="times new roman, new york, times, serif"> <a href="http://slaveKCInstance.ourcompanyname.com:8230/auth/realms/SearchMicroservices" target="_blank">http://slaveKCInstance.<wbr>ourcompanyname.com:8230/auth/<wbr>realms/SearchMicroservices</a>, </font></div><div><font face="times new roman, new york, times, serif">but URL from configuration is <a href="http://masterKCInstance.ourcompanyname.com:8230/auth/realms/SearchMicroservices" target="_blank">http://masterKCInstance.<wbr>ourcompanyname.com:8230/auth/<wbr>realms/SearchMicroservices</a></font></div><div><font face="times new roman, new york, times, serif"><span style="white-space:pre-wrap"> </span>at org.keycloak.RSATokenVerifier.<wbr>verifyToken(RSATokenVerifier.<wbr>java:49)</font></div><div><font face="times new roman, new york, times, serif"><span style="white-space:pre-wrap"> </span>at org.keycloak.RSATokenVerifier.<wbr>verifyToken(RSATokenVerifier.<wbr>java:35)</font></div><div><font face="times new roman, new york, times, serif"><span style="white-space:pre-wrap"> </span>at org.keycloak.adapters.<wbr>BearerTokenRequestAuthenticato<wbr>r.authenticateToken(<wbr>BearerTokenRequestAuthenticato<wbr>r.java:87)</font></div><div><font face="times new roman, new york, times, serif"><span style="white-space:pre-wrap"> </span>at org.keycloak.adapters.<wbr>BearerTokenRequestAuthenticato<wbr>r.authenticate(<wbr>BearerTokenRequestAuthenticato<wbr>r.java:82)</font></div><div><font face="times new roman, new york, times, serif"><span style="white-space:pre-wrap"> </span>at org.keycloak.adapters.<wbr>RequestAuthenticator.<wbr>authenticate(<wbr>RequestAuthenticator.java:65)</font></div><div><font face="times new roman, new york, times, serif"><span style="white-space:pre-wrap"> </span>at org.keycloak.adapters.<wbr>springsecurity.filter.<wbr>KeycloakAuthenticationProcessi<wbr>ngFilter.<wbr>attemptAuthentication(<wbr>KeycloakAuthenticationProcessi<wbr>ngFilter.java:137)</font></div><div><font face="times new roman, new york, times, serif"><span style="white-space:pre-wrap"> </span>at org.springframework.security.<wbr>web.authentication.<wbr>AbstractAuthenticationProcessi<wbr>ngFilter.doFilter(<wbr>AbstractAuthenticationProcessi<wbr>ngFilter.java:217)</font></div></div><div style="color:rgb(0,0,0);font-family:"times new roman","new york",times,serif;font-size:12pt"><br></div><div style="color:rgb(0,0,0);font-family:"times new roman","new york",times,serif;font-size:12pt">Do I need to change the configuration of my SecurityConfig class(<span style="font-size:12pt"> which has the current implementation as public class SecurityConfig extends KeycloakWebSecurityConfigurerA<wbr>dapter)?</span></div><div style="color:rgb(0,0,0);font-family:"times new roman","new york",times,serif;font-size:12pt">Thanks,</div><div style="color:rgb(0,0,0);font-family:"times new roman","new york",times,serif;font-size:12pt">ioan</div><br><hr style="color:rgb(0,0,0);font-family:"times new roman","new york",times,serif;font-size:12pt"><div style="color:rgb(0,0,0);font-family:Helvetica,Arial,sans-serif;font-size:12pt;font-weight:normal;font-style:normal;text-decoration:none"><b>From: </b>"i pop" <<a href="mailto:i.pop@centurylink.net" target="_blank">i.pop@centurylink.net</a>><br><b>To: </b><a href="mailto:stian@redhat.com" target="_blank">stian@redhat.com</a><br><b>Cc: </b>"keycloak-user" <<a href="mailto:keycloak-user@lists.jboss.org" target="_blank">keycloak-user@lists.jboss.org</a><wbr>><br><b>Sent: </b>Thursday, September 22, 2016 1:45:55 PM<div><div class="h5"><br><b>Subject: </b>Re: [keycloak-user] Setting up a Keycloak Domain Cluster<br><br><div style="font-family:times new roman,new york,times,serif;font-size:12pt;color:#000000"><br><font face="times new roman, new york, times, serif"><span style="font-size:12pt">Thank you Stian for your message. I have gotten the cluster working in the domain mode(just two nodes: master&slave):</span></font><div><font face="times new roman, new york, times, serif">MASTER NODE LOG:<br></font><div><div><font face="times new roman, new york, times, serif">[Server:server-one] 12:33:37,761 INFO [org.infinispan.remoting.<wbr>transport.jgroups.<wbr>JGroupsTransport] (Incoming-2,ee,master:server-<wbr>one) ISPN000094: Received new cluster view for channel server: [master:server-one|1] (2) [master:server-one, slave1:server-two]</font></div><div><div style="color:rgb(0,0,0);font-family:"times new roman","new york",times,serif;font-size:12pt">[Server:server-one] 12:33:38,411 INFO [org.infinispan.CLUSTER] (remote-thread--p8-t6) ISPN000310: Starting cluster-wide rebalance for cache realms, topology CacheTopology{id=1, rebalanceId=1, currentCH=<wbr>ReplicatedConsistentHash{ns = 60, owners = (1)[master:server-one: 60]}, pendingCH=<wbr>ReplicatedConsistentHash{ns = 60, owners = (2)[master:server-one: 30, slave1:server-two: 30]}, unionCH=null, actualMembers=[master:server-<wbr>one, slave1:server-two]}</div><div style="color:rgb(0,0,0);font-family:"times new roman","new york",times,serif;font-size:12pt">[Server:server-one] 12:33:38,419 INFO [org.infinispan.CLUSTER] (remote-thread--p8-t4) ISPN000336: Finished cluster-wide rebalance for cache users, topology id = 1</div><div style="color:rgb(0,0,0);font-family:"times new roman","new york",times,serif;font-size:12pt"></div><div style="color:rgb(0,0,0);font-family:"times new roman","new york",times,serif;font-size:12pt"><span style="font-size:medium">SLAVE NODE LOG:</span></div><div><div><font face="times new roman, new york, times, serif">[Server:server-two] 12:33:38,179 INFO [org.infinispan.remoting.<wbr>transport.jgroups.<wbr>JGroupsTransport] (MSC service thread 1-6) ISPN000094: Received new cluster view for channel server: [master:server-one|1] (2) [master:server-one, slave1:server-two]</font></div><div style="color:rgb(0,0,0);font-family:"times new roman","new york",times,serif;font-size:medium"></div></div></div><div style="color:rgb(0,0,0);font-family:"times new roman","new york",times,serif;font-size:medium">THE ISSUE IS NOW how to test this working cluster.It looks like the the content of the Keycloak string pattern generated by the master's Keycloak instance( and added to each microservice's keycloak.json file) HAS NOT CHANGED : I still get the same "auth-server-url" info as before when I had was not working cluster; no reference to the the other node members of the working cluster :</div><div><div style="color:rgb(0,0,0);font-family:"times new roman","new york",times,serif;font-size:medium">{</div><div style="color:rgb(0,0,0);font-family:"times new roman","new york",times,serif;font-size:medium"> "realm": "SearchMicroservices",</div><div style="color:rgb(0,0,0);font-family:"times new roman","new york",times,serif;font-size:medium"> "realm-public-key": "<wbr>MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ<wbr>8AMIIBCgKCAQEAh",</div><div style="color:rgb(0,0,0);font-family:"times new roman","new york",times,serif;font-size:medium"> "auth-server-url": "<a href="http://masterKCInstance.ourcompanyname.com:8230/auth" target="_blank">http://masterKCInstance.<wbr>ourcompanyname.com:8230/auth</a>",</div><div style="color:rgb(0,0,0);font-family:"times new roman","new york",times,serif;font-size:medium"> "ssl-required": "external",</div><div style="color:rgb(0,0,0);font-family:"times new roman","new york",times,serif;font-size:medium"> "resource": "LDAPSearch-Microservice",</div><div style="color:rgb(0,0,0);font-family:"times new roman","new york",times,serif;font-size:medium"> "credentials": {</div><div style="color:rgb(0,0,0);font-family:"times new roman","new york",times,serif;font-size:medium"> "secret": "235b2960-1b6f-48bd-a5c4-<wbr>069b5fc5cc16"</div><div style="color:rgb(0,0,0);font-family:"times new roman","new york",times,serif;font-size:medium"> },</div><div style="color:rgb(0,0,0);font-family:"times new roman","new york",times,serif;font-size:medium"> "use-resource-role-mappings": true</div><div style="color:rgb(0,0,0);font-family:"times new roman","new york",times,serif;font-size:medium">}</div><div style="color:rgb(0,0,0);font-family:"times new roman","new york",times,serif;font-size:medium"><br></div><div style="color:rgb(0,0,0);font-family:"times new roman","new york",times,serif;font-size:medium">If I stop the Keycloak instance running on the master node(from the WildFly management interface) and, I send a client search request message to one of my running application registered in the realm as clients, I was expecting the request to be be redirected by the load-balancer to the running state slave Keycloak instance (node: "<a href="http://slaveKCInstance.ourcompanyname.com:8230/auth" target="_blank">http://slaveKCInstance.<wbr>ourcompanyname.com:8230/auth</a>")<wbr>; get a valid access_token from it ,then my client request message(along with generated bearer token) sent to my targeted resource should get a a response message. It does not happen like this.What I get is this :</div><div><font face="times new roman, new york, times, serif">{"path":"\/v1\/ldap\/<wbr>DBResource\/resourceName","<wbr>error":"Unauthorized","<wbr>message":"Unable to authenticate bearer token","timestamp":<wbr>1474566606034,"status":401}</font></div></div><div><font face="times new roman, new york, times, serif"></font></div><div><font face="times new roman, new york, times, serif">The same outcome as described in my initial message sent to you. Can you please tell me what is wrong in my testing procedure?</font></div><div><font face="times new roman, new york, times, serif">Thanks,</font></div><div><font face="times new roman, new york, times, serif">Ioan</font></div><div style="color:rgb(0,0,0);font-family:"times new roman","new york",times,serif;font-size:medium"> </div><hr style="color:rgb(0,0,0);font-family:"times new roman","new york",times,serif;font-size:12pt"><div style="color:rgb(0,0,0);font-family:Helvetica,Arial,sans-serif;font-size:12pt;font-weight:normal;font-style:normal;text-decoration:none"><b>From: </b>"Stian Thorgersen" <<a href="mailto:sthorger@redhat.com" target="_blank">sthorger@redhat.com</a>><br><b>To: </b>"i pop" <<a href="mailto:i.pop@centurylink.net" target="_blank">i.pop@centurylink.net</a>><br><b>Cc: </b>"keycloak-user" <<a href="mailto:keycloak-user@lists.jboss.org" target="_blank">keycloak-user@lists.jboss.org</a><wbr>><br><b>Sent: </b>Tuesday, September 20, 2016 3:03:09 AM<br><b>Subject: </b>Re: [keycloak-user] Setting up a Keycloak Domain Cluster<br><br><div dir="ltr">Doesn't sound like you have working clustering setup. Please take a look at <a href="https://keycloak.gitbooks.io/server-installation-and-configuration/content/topics/clustering.html" target="_blank">https://keycloak.gitbooks.<wbr>io/server-installation-and-<wbr>configuration/content/topics/<wbr>clustering.html</a>.</div><div class="gmail_extra"><br><div class="gmail_quote">On 18 September 2016 at 04:15, <a href="mailto:i.pop@centurylink.net" target="_blank">i.pop@centurylink.net</a> <span dir="ltr"><<a href="mailto:i.pop@centurylink.net" target="_blank">i.pop@centurylink.net</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div style="font-family:times new roman,new york,times,serif;font-size:12pt;color:#000000">Hi ,<div>I work on POC to use Keycloak to secure a set of microservices( java written SpringBooth&gradle projects).</div><div>I use Keycloak-2.1.0.Final release installed on 3 different VMs(master running on VM1, slave1 on VM2, slave2 on VM2). <span style="font-size:12pt">On a 4th VM I have installed a shared (MySql) db to replace the embedded H2 db.</span></div><div><span style="font-size:12pt">I have configured a Keycloak Domain Mode cluster using keycloak documentation "Server Installation and Configuration Guide".</span></div><div></div><div>1. I have logged on the master keycloak server and configured my new Realm that has my microservice processes as clients.I have added roles,users,groups, etc., The realm configuration of the master keycloak instance got replicated on the slave instances ( I can see the cluster running when loging-on WildFly Management Interface).</div><div>2. I have added to all microservice java projects the keycloak securing code: </div><div> 2.1 Created a keycloak.json file who's content was generated my the MASTER keycloak server(Client's "Installation" utility)</div><div> 2.2 Added to the project's Application class a system property, to target the keycloak.json file generated by the MASTER keycloak instance:<span style="font-size:12pt">System.setProperty("<wbr>keycloak.configurationFile", "classpath:keycloak.json");</span></div><div> 2.3 Created a new config's package class : public class SecurityConfig extends KeycloakWebSecurityConfigurerA<wbr>dapter</div><div> 2.4 Added to the build.gradle file keycloak spring security adapter compilation : </div><div> compile group: 'org.keycloak', name:'keycloak-spring-<wbr>security-adapter',version:'2.<wbr>1.0.Final</div><div> Note. I have compared the content of the json format code generated by the Client "Installation" utility of the slave instances against master instance and, THE ONLY DIFFERENCE is the<b> "auth-server-url"</b> line (having the specific node URL address) </div><div>3. Now, I want to do the test of accessing particular resources of my microservice applications(additional info: I did not implemented any load-balancer in front of the keycloak cluster): </div><div> I have created a simple java program that uses a Basic Authorization procedure to get an access token, and then use this token to sent request messages to my microservice application and get the expected response messages.</div><div> - When I use the MASTER's instance authorization endpoint to get an access token, I get the expected response message( because, I presume, my microservice application attached keycloak.json file has HARDCODED content generated by the MASTER's instance & containing MASTERS's authorization endpoint).</div><div> - When I use either-one SLAVE keycloak instance authorization&token generation endpoint to generate an access token, my request fails with a 401 error:<span style="font-size:12pt">"Unable to authenticate bearer token"</span></div><div>I believe or feel, I use a wrong approach to solve my problem. My microservice applications (at this time) DO NOT KNOW anything, whether I use a domain mode cluster or, a simple standalone keycloak instanceattached keycloak.json file has ONLY one keycloak instance (<span style="font-size:12pt">MASTER's</span><span style="font-size:12pt"> )</span><span style="font-size:12pt"> "auth-server-url" info ).</span></div><div>Here, I need your help to enlighten me. Is there another approach to handle my problem? It should, otherwise why writing about Domain Mode in Keycloak Release documentation. Unfortunately, I have not found (yet ) detailed info on how to configure a Keycloak Domain Cluster and how to do test simulations with it. I would appreciate any help on this issue.</div><div>Thanks,</div><div>Ioan </div><div> </div><div> </div></div></div><br>______________________________<wbr>_________________<br>
keycloak-user mailing list<br>
<a href="mailto:keycloak-user@lists.jboss.org" target="_blank">keycloak-user@lists.jboss.org</a><br>
<a href="https://lists.jboss.org/mailman/listinfo/keycloak-user" rel="noreferrer" target="_blank">https://lists.jboss.org/<wbr>mailman/listinfo/keycloak-user</a><br></blockquote></div><br></div>
</div><br></div></div></div><br>______________________________<wbr>_________________<br>keycloak-user mailing list<br><a href="mailto:keycloak-user@lists.jboss.org" target="_blank">keycloak-user@lists.jboss.org</a><br><a href="https://lists.jboss.org/mailman/listinfo/keycloak-user" target="_blank">https://lists.jboss.org/<wbr>mailman/listinfo/keycloak-user</a></div></div></div><br></div></div></blockquote></div><br></div>