Token errors with WebSockets and other backend calls
by Juraci Paixão Kröhling
All,
I've seen some problems lately that are hard to debug and may cause you
to waste valuable time.
In short, if you face "strange" issues related to authentication,
specially when trying features that make use of WebSockets (ie: add
deployment), make sure you are accessing the web UI via 127.0.0.1 , and
not localhost .
In case you are interested in the details, keep reading.
Upon login, Keycloak issues a token for the client, taking the auth
server host into consideration (as the "issuer authority"). If you use
localhost, then that's the hostname that Keycloak will use inside the
token. This value is later used to validate the incoming token. Ideally,
all the hostnames would be a match, and that's usually the case if you
use the "-b" switch when starting Wildfly. But if you don't specify, we
fall back to 127.0.0.1 [1] , causing the "backend call" to be 127.0.0.1,
while the "frontend call" came via localhost.
I have a couple of ideas on how to solve this in our side, but until a
fix is done, tested and merged, please use 127.0.0.1 on the UI.
1 - http://git.io/vnJfx
- Juca.