Invalid token issuer about node-openid-client

[mrik974]

The workaround was to leave it as-is. I mean, if the URL used by the browser is not the same URL the client is calling to validate the token, the keycloak server will refuse the validation.
I had to create a dummy DNS entry for my specific setup that allowed the client to have access to keycloak from the inside, but with the same domain name as the browsers have access to it from the outside.

[panva]

Hi @mrik974, what is the url for your discovery and it's returned content? What i'm trying to say - why not use discovery instead of manual setup to begin with. And second, it looks like you just need to set your issuer to the one that's being returned. Your auth endpoint is the one that needs to be on the public route, not your issuer.

[mrik974]

Hi, the URL for discovery is https://identity.myapp.com/auth/realms/master/.well-known/openid-configuration
It's returned content is

"issuer": "https://identity.myapp.com/auth/realms/master",
"authorization_endpoint": "https://identity.myapp.com/auth/realms/master/protocol/openid-connect/auth",
"token_endpoint": "https://identity.myapp.com/auth/realms/master/protocol/openid-connect/token",
"token_introspection_endpoint": "https://identity.myapp.com/auth/realms/master/protocol/openid-connect/token/introspect",
"userinfo_endpoint": "https://identity.myapp.com/auth/realms/master/protocol/openid-connect/userinfo",
"end_session_endpoint": "https://identity.myapp.com/auth/realms/master/protocol/openid-connect/logout",
"jwks_uri": "https://identity.myapp.com/auth/realms/master/protocol/openid-connect/certs",
"check_session_iframe": "https://identity.myapp.com/auth/realms/master/protocol/openid-connect/login-status-iframe.html",

But, as I said, my question is a tricky one.
The nodejs app I use is in the same internal Docker network, set up by Openshift. It can't access the keycloak server through the external URIs and must access it using an internal domain name. I can't override this setting. That's why I can't use auto discovery and set the URIs used by the app to http://keycloak-openshift:8080 instead of https://identity.myapp.com

The web browser can access the OpenID server using the external domain name (https://identity.myapp.com/auth/realms/master/protocol/openid-connect/auth)

[panva]

hang on a minute - the config you have is right - but the error comes from the OP, not client. What i mean the RP just throws what the OP returned at you.

[mrik974]

Oh, I get it now.
How does the OP know it's being called using it's internal domain name ?

[panva]

well the host http header ;) this seems to be an issue with keycloak or your setup, as you described it the configuration in the original post is the way i would do it.

[mrik974]

OK I really get it now, thank you for your time :)

[qinfanpeng]

OK I really get it now, thank you for your time :)

Hi, how did you workround your problem?