[keycloak-user] Keycloak not authorising access to app behind Keycloak security proxy
Hi all,
I have an app that isn't keycloak aware and have put the keycloak
security proxy in front of it however even with the most basic settings
I cannot succesfully authenticate to the page - it returns a 403 access
denies error and the keycloak proxy outputs this:
org.keycloak.adapters.OAuthRequestAuthenticator resolveCode
ERROR: failed to turn code into token
java.net.ConnectException: Connection refused (Connection refused)
Must admit I'm stumped, I thought with this config, any user with an
account that successfully logs in would get the app. I'm not using
roles or anything complicated (because I don't understand it yet) and
have been round the houses without success so any advice would be
greatly appreciated!
thanks,
Guy
----------------------------------------------
Here's some info about the environment:
----------------------------------------------
Both keycloak and the application are reverse proxied via NGINX, but
this works fine when I change the proxy config from "authenticate":true
to "permit": true.
DMZ:
2 X NGINX SERVERS (not clustered) one proxying keycloak and the other
proxyying the application <-- Proper headers set
----------------------------------------------
TRUST:
KEYCLOAK SERVER - Wildfly configured with
_<http-listener name="default" socket-binding="http"
redirect-socket="PROXY-HTTPS" PROXY-ADDRESS-FORWARDING="TRUE"/>
_and
_<socket-binding name="proxy-https" port="443"/> _
APPLICATION SERVER - Keycloak Security Proxy
1 {
2 "target-url": "http://1.2.3.4:80",
3 "bind-address": "5.6.7.8",
4 "http-port": "80",
5 "https-port": "443",
6 "keystore": "/opt/keycloak-proxy/KeyStore.jks",
7 "keystore-password": "password",
8 "key-password": "password",
9 "applications": [
10 {
11 "base-path": "/",
12 "error-page": "/error/denied.html",
13 "adapter-config": {
14 "realm": "realmname",
15 "resource": "clientname",
16 "realm-public-key": "publickey",
17 "auth-server-url":
"https://keycloak.tiberius.local/auth",
18 "ssl-required": "external",
19 "credentials": {
20 "secret": "secret"
21 }
22 }
23 ,
24 "constraints": [
25 {
26 "pattern": "/*",
27 "authenticate": "true"
28 }
29 ]
30
31 }