Error "Invalid bearer token" when client and server are on different sides of the firewall

1

Hi all,

I have my Keycloak server and app server behind a firewall. The web client (in browser) is in front of the firewall.

Because of the firewall, web client and app server talk to Keycloak using different addresses. Webclient sees Keyloak as “fw1”, while app server sees as “kc1”

Access token obtained by web client has issuer as “fw1”. When app server sends this token to Keycloak for authorization, Keycloak says “Invalid bearer token”.

How does Keycloak supposed to work in this situation? Can/should I turn off issuer validation?

Thanks in advance,
Huy.

2

Proper hostname configuration will be your friend, see docs about it. Depends on the distribution (Quarkus or Wildfly/Legacy) how you have to configure it.

3

Yes, thanks a lot, Niko, I set the frontendUrl in hostname spi in standalone.xml solved the issue.

Have a great day.

2 Likes