Comments (8)
The workaround was to leave it as-is. I mean, if the URL used by the browser is not the same URL the client is calling to validate the token, the keycloak server will refuse the validation.
I had to create a dummy DNS entry for my specific setup that allowed the client to have access to keycloak from the inside, but with the same domain name as the browsers have access to it from the outside.
from node-openid-client.
Hi @mrik974, what is the url for your discovery and it's returned content? What i'm trying to say - why not use discovery instead of manual setup to begin with. And second, it looks like you just need to set your issuer to the one that's being returned. Your auth endpoint is the one that needs to be on the public route, not your issuer.
from node-openid-client.
Hi, the URL for discovery is https://identity.myapp.com/auth/realms/master/.well-known/openid-configuration
It's returned content is
"issuer": "https://identity.myapp.com/auth/realms/master",
"authorization_endpoint": "https://identity.myapp.com/auth/realms/master/protocol/openid-connect/auth",
"token_endpoint": "https://identity.myapp.com/auth/realms/master/protocol/openid-connect/token",
"token_introspection_endpoint": "https://identity.myapp.com/auth/realms/master/protocol/openid-connect/token/introspect",
"userinfo_endpoint": "https://identity.myapp.com/auth/realms/master/protocol/openid-connect/userinfo",
"end_session_endpoint": "https://identity.myapp.com/auth/realms/master/protocol/openid-connect/logout",
"jwks_uri": "https://identity.myapp.com/auth/realms/master/protocol/openid-connect/certs",
"check_session_iframe": "https://identity.myapp.com/auth/realms/master/protocol/openid-connect/login-status-iframe.html",
But, as I said, my question is a tricky one.
The nodejs app I use is in the same internal Docker network, set up by Openshift. It can't access the keycloak server through the external URIs and must access it using an internal domain name. I can't override this setting. That's why I can't use auto discovery and set the URIs used by the app to http://keycloak-openshift:8080
instead of https://identity.myapp.com
The web browser can access the OpenID server using the external domain name (https://identity.myapp.com/auth/realms/master/protocol/openid-connect/auth
)
from node-openid-client.
hang on a minute - the config you have is right - but the error comes from the OP, not client. What i mean the RP just throws what the OP returned at you.
from node-openid-client.
Oh, I get it now.
How does the OP know it's being called using it's internal domain name ?
from node-openid-client.
well the host http header ;) this seems to be an issue with keycloak or your setup, as you described it the configuration in the original post is the way i would do it.
from node-openid-client.
OK I really get it now, thank you for your time :)
from node-openid-client.
OK I really get it now, thank you for your time :)
Hi, how did you workround your problem?
from node-openid-client.
Related Issues (20)
- Always return an error saying please use an absolute URL HOT 1
- Low-level errors during `Issuer.discover()` cause error without stack trace
- OAuth 2.0 Device Authorization Grant (Device Flow) - poll without PKCE HOT 3
- Type checking httpOptions and rejectUnauthorized
- RPError thrown when IdToken JWE Header enc is blank HOT 2
- client won't run under `edge` runtime HOT 1
- Support setting client_secret to an empty string when using client_secret_basic or client_secret_post HOT 1
- Cannot assign to read only property 'dpopProof' of object '#<Client>' HOT 2
- Unsuccessful Callback to Unknow client side error HOT 10
- isKeyObject check fails in Bun HOT 5
- Scope delimiter replace problem HOT 2
- Multiple authenticate requests from the same session causes state mismatch HOT 1
- Can't authenticate when the server advertises authorization_response_iss_parameter_supported HOT 2
- Requests made without Accept-Encoding header HOT 1
- "cty" should not be included in jwks query HOT 2
- URL is not a constructor at Issuer.request HOT 1
- Application and Identity manger on different domains HOT 1
- Support other status code than 200 HOT 4
- Unable to use private_key_jwt auth method with Azure.
- Audience matching doesn't work as intended HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from node-openid-client.