Keycloak login issue - incorrect /_token call to non-existent backend server

[Jernej Vodopivec]

Hi,

after successful login on Keycloak webpage the user is not redirected to real backend service.

The event log shows request to non-existent backend server (127.0.0.1) using malformed scheme (HTTPS with port 80).

https://127.0.0.1:80/auth/realms/master/protocol/openid-connect/token"<https://127.0.0.1:80/auth/realms/master/protocol/openid-connect/token>



I've published two sites via Nginx:


1. Application: https://app.domain.com

Application is running on backend IIS server https://appbackend.domain.com


NGINX Virtual host config:

a) Headers set:

proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Host $host;
proxy_set_header Forwarded "$proxy_add_forwarded;proto=$scheme";
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Referer $http_referer;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-Port $server_port;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";


b) Keycloak part

include conf.d/openid_connect.server_conf;
set $oidc_authz_endpoint "https://keycloak.domain.com/auth/realms/master/protocol/openid-connect/auth";
set $oidc_token_endpoint "https://keycloak.domain.com/auth/realms/master/protocol/openid-connect/token";
set $oidc_client         "NGINX-Plus";
set $oidc_client_secret  "acdce7.......7460";
set $oidc_jwt_keyfile    "https://keycloak.domain.com/auth/realms/master/protocol/openid-connect/certs";
set $oidc_hmac_key       "38...asfumg3";


c) location part

auth_jwt "" token=$session_jwt;
error_page 401 = @do_oidc_flow;
auth_jwt_key_request /_jwks_uri;

proxy_set_header username $jwt_claim_sub;
proxy_pass      https://appbackend.domain.com;



2. Keycloak: https://keycloak.domain.com

Keycloak is running as a docker on separated virtual machine keycloak1.domain.com.

Port redirection:

- tcp/80 -> tcp/8080

- tcp/443 -> tcp/8443

SSL certificate is installed and activated.


1. Headers set:
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Host $host;
proxy_set_header Forwarded "$proxy_add_forwarded;proto=$scheme";
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Referer $http_referer;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-Port $server_port;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";


2. Backend

proxy_pass      https://keycloak1.domain.com;<https://keycloak1.domain.com>

## Same issue if HTTP is user instead of HTTPS


3. Client configuration - admin part

Valid Redirect URIs: https://app.domain.com:443/_codexch


NGINX logs

 /var/log/nginx/app.domain.com-access.log <==
remote_addr=184.55.14.22 - remote_user=- time_local=[17/Oct/2021:09:06:17 +0200] request="GET / HTTP/2.0" status=302 body_bytes_sent=145 http_referer="-" http_user_agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:93.0) Gecko/20100101 Firefox/93.0" http_x_forwarded_for="-" request_time=0.002 upstream_connect_time="-" upstream_header_time="-" upstream_response_time="-" server_name=app.domain.com uri="/"


==> /var/log/nginx/keycloak.domain.com-access.log <==
remote_addr=184.55.14.22 - remote_user=- time_local=[17/Oct/2021:09:06:17 +0200] request="GET /auth/realms/master/protocol/openid-connect/auth?response_type=code&scope=openid+profile+email+offline_access&client_id=NGINX-Plus&redirect_uri=https://app.domain.com:443/_codexch&nonce=5--Pw-iCkTs1hR-3V6wgLkd2vZNC0ys0NM9fRR4D1c8&state=0 HTTP/2.0" status=302 body_bytes_sent=0 http_referer="-" http_user_agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:93.0) Gecko/20100101 Firefox/93.0" http_x_forwarded_for="-" request_time=0.032 upstream_connect_time="0.020" upstream_header_time="0.032" upstream_response_time="0.032" server_name=keycloak.domain.com uri="/auth/realms/master/protocol/openid-connect/auth"
1c8&state=0 HTTP/2.0", status=302, waf_policy=Complete_OWASP_Top_Ten, waf_request_id=13388773729652827719, waf_action=PASSED, waf_action_reason=SECURITY_WAF_OK

==> /var/log/nginx/app.domain.com-error.log <==
2021/10/17 09:06:18 [error] 3352262#3352262: *406 connect() failed (111: Connection refused) while connecting to upstream, client: 184.55.14.22, server: app.domain.com, request: "GET /_codexch?state=0&session_state=0b783755-9b00-4b0f-9e63-1a047680272c&code=07ce9447-19a7-443f-abfb-54e92819a34a.0b783755-9b00-4b0f-9e63-1a047680272c.98d80b2d-9f0d-482a-bdfd-b680834bb9bc HTTP/2.0", subrequest: "/_token", upstream: "https://127.0.0.1:80/auth/realms/master/protocol/openid-connect/token", host: "app.domain.com"


Any help would be really appreciated.


Regards,


Jernej





-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx/attachments/20211017/93d1416b/attachment.htm>