Facing issue with redirected uri

[SarvaniVarma]

When accessing the application I get the following error:

The redirected uri in keycloak is:
http://apicurio-0-2-15-gitlab-apicurio.haproxy.project.example.com
but when i checked the logs of keycloak the redirected uri is:

WARN [org.keycloak.events] (default task-45) type=LOGIN_ERROR, realmId=apicurio, clientId=apicurio-studio, userId=null, ipAddress=10.125.176.50, error=invalid_redirect_uri, redirect_uri=http://apicurio-0-2-15-gitlab-apicurio.haproxy.project.example.com:80/studio/

By default it is taking port as 80, but my application route does not need a port, it is accessed with route only(http://apicurio-0-2-15-gitlab-apicurio.haproxy.project.example.com).

Could you please help me out.

[EricWittmann]

The URI that is checked by Keycloak is passed to it by the application (in this case Apicurio). The first step the app takes when the user is not yet authenticated, is to redirect the browser to Keycloak. When it does this, it passes whatever URL was used to access the application as part of the request to Keycloak. So my guess is that when you are accessing Apicurio, somehow you have the port number in the URL.

Perhaps haproxy is adding the port? Or perhaps in your browser you simply have the port as part of the URL? It's hard to say without more information.

Of course, you can also simply add http://apicurio-0-2-15-gitlab-apicurio.haproxy.project.example.com:80/* to the list of acceptable redirect URIs in the Keycloak console.

[SarvaniVarma]

I have changed the keycloak redirected uri to http://apicurio-0-2-15-gitlab-apicurio.haproxy.project.example.com:80/*
Now it gets redirected to keycloak page, but after login I get Forbidden error, When I checked apicurio logs the error is:

12:02:48,597 ERROR [org.keycloak.adapters.OAuthRequestAuthenticator] (default task-43) failed to turn code into token
12:02:48,597 ERROR [org.keycloak.adapters.OAuthRequestAuthenticator] (default task-43) status from server: 400
12:02:48,597 ERROR [org.keycloak.adapters.OAuthRequestAuthenticator] (default task-43) {"error":"invalid_grant","error_description":"Incorrect redirect_uri"}

[EricWittmann]

This sounds like the same error @gigaga had when using a proxy. Perhaps have a look at #356 ?

[EricWittmann]

I'm thinking specifically this comment: #356 (comment)

[SarvaniVarma]

I have changed the keycloak redirected uri to http://apicurio-0-2-15-gitlab-apicurio.haproxy.project.example.com:80/*
and changed the version of keycloak in pom.xml but i get the same error:

ERROR [org.keycloak.adapters.OAuthRequestAuthenticator] (default task-43) failed to turn code into token
ERROR [org.keycloak.adapters.OAuthRequestAuthenticator] (default task-43) status from server: 400
ERROR [org.keycloak.adapters.OAuthRequestAuthenticator] (default task-43) {"error":"invalid_grant","error_description":"Incorrect redirect_uri"}

[SarvaniVarma]

I think the problem is with the redirected uri, as we added 80 port in keycloak.
My scenario is that I have build a docker image with apicurio quickstart with changes made and the image is working fine, when I am trying to deploy it on openshift I am facing this forbidden error.
Could you please help.

[EricWittmann]

Did you try what @gigaga suggested?

In standalone-apicurio.xml, for http-listener node, if I change proxy-address-forwarding="true" to false, it's work...!

[EricWittmann]

If that doesn't work, you'll need to provide some details about your OpenShift environment and the various configuration settings you're using. E.g. the system properties you have in standalone-apicurio.xml, the keycloak realm settings, and any other standalone-apicurio.xml changes you may have made.

Finally, if you're interested in running Apicurio in OpenShift, I might suggest you try this:

https://github.com/Apicurio/apicurio-studio/blob/master/distro/openshift/apicurio-template.yml

It's the official Apicurio openshift template, and it's what we use to run the studio.apicur.io instance (with a few minor changes such as running postgresql in AWS).

[EricWittmann]

Any progress or updates on this?

[SarvaniVarma]

After changing proxy-address-forwarding="true" to false, it's work, I was able to deploy on openshift.

[EricWittmann]

Great!