Keycloak Kubernetes 401 Unauthorized

2
votes

I have a keycloak server and a spring boot app running on Kubernetes cluster and I'm facing 2 scenarios the first one is working and the other one I'm getting 401 Unauthorized.

First scenario:

  • Enter a test container with kubectl exec command inside my k8s cluster and ask for a token with a curl POST request : http://keycloak-service-name:8080/auth/realms/lisa/protocol/openid-connect/token
  • I get a token
  • I send a request from postman using that token to the secured endpoint of my app and It's working, access is granted

Second scenario:

  • Ask for a token by sending a POST request to: http://keycloak-external-ip:port/auth/realms/lisa/protocol/openid-connect/token with the necessary parameters from postman
  • I receive an access token
  • I send a request from postman to the secured endpoint using that token of my app I get 401 unauthorized

The Keycloak is exposed using NodePort service.

The app is exposed using istio ingress gateway.

Keycloak server version:9.0.0.

keycloak version in spring boot app: 10.0.2

1
spring-bootkubernetesspring-securitykeycloakistio
Same here, a question was posted at Keycloak forum. – belgoros
Hi, can you add the following to your question?: 1. Details on the incoming request to the istio ingress gateway. 2. Details on the application behind the istio ingress gateway. 3. The logs of your istio ingress gateway. – Piotr Malec
this is a curl of the request I send through the istio gateway to test my app:curl --location --request GET 'gateway-external-ip/history/admin/v1/health' \ --header 'Cookie: JSESSIONID=2C40C674EA1A3D13BEC98313BB3D23C6; JSESSIONID=B1CF761DA1349D2AF40F7DB11FBB2503' \ --header 'Authorization: Bearer token' – Kamèl Romdhani
The issue is most likely related to JWT ISS checking failing for external call. It looks to me that it is configured based on local service/hostname. You can verify that by checking logs. Take a look at this github post to see how to view logs. – Piotr Malec

1 Answers

1
votes

Fixed this by changing the keycloak.auth-server-url value in the application.properties file. The keycloak deployment has 2 services, one of type clusterIP, the second is of type nodePort before keycloak.auth-server-url=http://keycloak-clusterIP-service-name:8080/auth after keycloak.auth-server-url=http://node-ip-adress:nodePort/auth