Issue with application in docker settings

Securing applications
,
1

My application based on microservices were working fine working on just localhost untill trying to set it up on docker-compose.
I’ve got issue on API Gateway side. I’ve figured that authorization-uri has to be on localhost since it goes from outside of docker network.
token-uri and user-info-uri are going from gateway to keycloak and need to call keycloak by its dns name. clientId and userId null in the error. I’ve tried to change user-id to user_Id, but doesnt change anything.
Any ideas what could be wrong? Any help would be appreciated.

19:09:20,616 WARN  [org.keycloak.events] (default task-2) type=USER_INFO_REQUEST_ERROR, realmId=cinema, clientId=null, userId=null, ipAddress=172.21.0.9, error=invalid_token, auth_method=validate_access_token

spring:
  application:
    name: Gateway
  config:
    import: optional:configserver:http://${ConfigService:configserver}:8888
  cloud:
    gateway:
      discovery:
        locator:
          enabled: true
      default-filters:
        - TokenRelay
  security:
    oauth2:
      client:
        provider:
          keycloak-spring-gateway-client:
            token-uri: http://${KEYCLOAK:localhost}:8080/auth/realms/${app.config.keycloak.realm}/protocol/openid-connect/token
            authorization-uri: http://localhost:28080/auth/realms/${app.config.keycloak.realm}/protocol/openid-connect/auth
            user-name-attribute: preferred_username
            user-info-uri: http://${KEYCLOAK:localhost}:8080/auth/realms/${app.config.keycloak.realm}/protocol/openid-connect/userinfo
            jwk-set-uri: http://${KEYCLOAK:localhost}:8080/auth/realms/${app.config.keycloak.realm}/protocol/openid-connect/certs
            user-info-authentication-method: header
        registration:

          keycloak-spring-gateway-client:
            provider: keycloak-spring-gateway-client
            client-id: gateway
            client-secret: ${GATEWAY_SECRET:PxY64IIOcSCUgZDWRdt2rHf8SL41xdX5}
            authorization-grant-type: authorization_code
            redirect-uri: http://localhost:8890/login/oauth2/code/keycloak
            scope: openid
      resourceserver:
        jwt:
          jwk-set-uri: ${app.config.keycloak.url}/realms/${app.config.keycloak.realm}/protocol/openid-connect/certs
2

Hi.
I have same error.
Could you solve?

3

So after many tries I managed to fix my issue. I will first describe my problem. My issue was that everything was working as intended during testing in my localhost, but it wasn’t working when using docker (docker compose).

What I did to understand the problem (and this is what I should have done from the very beginning) was to update my environment variables in docker compose file with "LOGGING_LEVEL_ORG_SPRINGFRAMEWORK_SECURITY=TRACE" which sets the property logging…level.org.springframework.security to DEBUG. You can also do this in your YAML configuration or your properties file. Then in the logs I saw this line Authentication failed: [invalid_id_token] The ID Token contains invalid claims: {iat=2024-08-19T12:38:06Z}
With that I noticed that the date was wrong inside the Docker container, so I mounted the Host’s /etc/localtime to the container. This might differ depending on the platform, I was using CentOS Stream 9.

Then after restarting the container it worked. The problem was the the Token that was being generated was never valid, since it was always being created after the date I was trying to validate it.

Hope this helps people in the future

P.S: Dont forget to remove the log level after your tests