Argh - I'm hitting my head against the wall with gatekeeper

Securing applications
1

I’ve been trying for two weeks to get gatekeeper going. I’m hitting a number of troubles, but particularly these two:

  1. It says “connection reset by peer” when I try to access it at http://127.0.0.1:8080
    This doesn’t happen if I run it in the host operating system, but it does happen when I run it inside docker.
    I saw KEYCLOAK-11590 Add unprivileged user
    committed a couple days ago, and so I tried that, but it didn’t help.

  2. I’m also having trouble accessing gatekeeper from outside of the machine on which it is running.
    So, I run it in the host operating system instead of docker, and curl can access it at localhost.
    But, I get a ERR_CONNECTION_REFUSED trying to get at the machine through a browser.
    This is confusing, because if I run a simple “hello world” app then I can browse hello world just fine.

So I’ve tried gatekeeper 7.0.0 and 6.0.1 and have the same exact troubles.
I’ve tried downloading the .tar.gz as well as building the source myself.
I’ve tried alpine 3.8 and alpine 3.10
I’ve tried ubuntu:18.04
I’ve tried pulling my hair out.
I must be doing something simple and fundamentally wrong, but I can’t find it.
My goal is to run gatekeeper in kubernetes, but I can’t even get it running in docker.
Please help.

2

@jmuczynski could you please provide the detailed steps to reproduce the issues you described?

3

@abstractj I just figured out part of my problem yesterday, so I’m a few hours behind in posting. Thank you for your post and your interest in my troubles. For the permanent record, here’s what I did and what the solution was.

From the documentation here:
https://www.keycloak.org/docs/latest/securing_apps/index.html#_keycloak_generic_adapter
I picked up example configuration files, all of which were using
listen: 127.0.0.1:3000
So, I used configuration lines like
listen: 127.0.0.1:80
or
listen: 127.0.0.1:8080
And this resulted in the troubles I’ve described earlier.

But the break through arrived when I noticed that the golang hello world app, which didn’t have these bugs, was using “:8080” in its source code. So apparently golang wants :8080
After switching to
listen: :80
both the “connection reset by peer” and the ERR_CONNECTION_REFUSED were resolved.
So, this is fantastic.
I still have miles to go, but now I have a path to get Gatekeeper running in the cluster.

How do I submit fixes to the documentation?

Kind Regards,
Johnny

1 Like
4

Hi @jmuczynski, you can just refer to our documentation repository https://github.com/keycloak/keycloak-documentation. The Gatekeeper file is located here https://github.com/keycloak/keycloak-documentation/blob/master/securing_apps/topics/oidc/keycloak-gatekeeper.adoc