Dex client inside of kubernetes and RedirectURI conflicts

Getting advice
1

Hi. I have a Kubeflow setup in our K8s cluster and am attempting to configure the Dex portion of Kubeflow to use Keycloak as an OIDC provider and am having some issues with the redirection.

We have an Istio ingress set up so that we can connect to https ourcluster dot example dot com and it gets routed to the Dex login page where we can select the different authentication methods (like LDAP or Keycloak)

Inside of the Dex configuration, there is a RedirectURI option which seems to want/need to be set to: http-dex.auth.svc.cluster.local:5556/dex/callback

Inside of my Keycloak client configuration, I set the RedirectURI to this, and when I go to our https ourcluster dot example dot com URL, I am sent to the Keycloak login screen (good start), but when I log in, I can’t connect back properly to Dex because Keycloak uses the RedirectURI that we had which is an internal K8s entity. (for example: dex.auth.svc.cluster.local:5556/dex/callback?state=ybwtpb2jebjvi6akl6zzl45bo&session_state=f1896617-c415-4b5f-bb0c-241e8a21e70e&code=7b9fbed8-3a59-4da3-8530-f97b5edf8ea6.f1896617-c415-4b5f-bb0c-241e8a21e70e.828bc905-ffed-4aa0-ba13-c7e155944c8b).

If I replace the dex.auth.svc.cluster.local:5556 with https ourcluster dot example dot com and leave the rest there, it actually works and I’m logged into Keycloak.

I guess the question I have is, is there a way to have keycloak redirect to a different url on the way out without changing the redirectURI?

Or, has anyone actually gotten this kind of setup working?

Thanks.

2

I’ll also add that when I tried changing the RedirectURI in the Dex configuration to be our https ourcluster dot example dot com, Dex complained that the expected callback URL (the dex.auth internal one) doesn’t match the URL in the configuration (the https one)

So I don’t know what to do about that either.

3

Ok. I actually have this sorta working, although I’m not sure if I did it ‘right’ or not, but it functions.
In the dex configuration I overlooked an extra ‘issuer’ configuration option which was specifying that internal URL. I modified that, and also (for Kubeflow users) had to modify the oidc-authservice configuration to include our domain certs and point that to the external facing URL for Dex as well.

Now it’s kinda out of scope for Keycloak.

4

Hi,
I am currently struggeling with the exact same problem.

can you please post your kubeflow config mal and the changes to the oidc authservice?

Regard