Skip to content

fix: use containeraddress for jwk-set-uri #886

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 1 commit into from
Closed

fix: use containeraddress for jwk-set-uri #886

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions shogun-config/src/main/resources/application-base.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -91,7 +91,7 @@ spring:
resourceserver:
jwt:
issuer-uri: https://${KEYCLOAK_HOST:shogun-keycloak}/auth/realms/SHOGun
jwk-set-uri: https://${KEYCLOAK_HOST:shogun-keycloak}/auth/realms/SHOGun/protocol/openid-connect/certs
jwk-set-uri: http://shogun-keycloak:8080/auth/realms/SHOGun/protocol/openid-connect/certs
Copy link
Member

@dnlkoch dnlkoch Jun 28, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not sure why this is needed, but removing the environment variable KEYCLOAK_HOST entirely seems not to be the right way to me.

Copy link
Member

@simonseyock simonseyock Jul 1, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The problem is that spring is accessing the jwk-set-uri to autoconfigure itself and retrieve some certificates from keycloak. If the KEYCLOAK_HOST is used, this only works if the KEYCLOAK_HOST is accessible from inside the container.

Using the container address and removing the KEYCLOAK_HOST here seems to be the solution, as this should be working in any environment.

The documentation is not exhaustive in that regard, but I understand it this way:

  • The issuer-url is used to check the issuer field in the jwt. If jwk-set-uri is not set, this is also used to autoconfigure and retrieve the certificates.
  • The jwk-set-uri is used instead for the requests if set

https://docs.spring.io/spring-security/reference/reactive/oauth2/resource-server/jwt.html#webflux-oauth2resourceserver-jwt-jwkseturi

graphql:
schema:
locations: classpath*:graphql/**/
Expand All @@ -112,7 +112,7 @@ keycloak:
client-id: shogun-boot
principal-attribute: preferred_username
disableHostnameVerification: true
internal-server-url: shogun-keycloak
internal-server-url: "shogun-keycloak:8080"
extract-roles-from-resource: true
extract-roles-from-realm: false

Expand Down