Hello.
I am trying to secure a web app (service) via Keycloak using authorization code flow with Keycloak behind a gateway (C#).
Right now I am in a situation, where I can obtain authorization code via browser and I can obtain JWT access token via browser and via REST API call using the authorization code flow or client credentials flow.
What I am trying to acomplish, is getting the authorization code via my gateway. So in my gateway I have an endpoint, which calls /protocol/openid-connect/auth endpoint with all needed parameters (client_id, response_type, state, redirect_url). When I call this endpoint via browser, everything works just fine and I get the authorization code. When I try to call this via gateway, I use WebClient, to make a request, that downloads the HTML of the login form and display it in a browser.
Then when I click the submit button, Keycloak shows error page that says: “We are sorry… An error occurred, please login again through your application.”
When I check log in a Keycloak console, it says: “WARN [org.keycloak.events] (default task-25) type=LOGIN_ERROR, realmId=myRealm, clientId=null, userId=null, ipAddress=127.0.0.1, error=invalid_code”
In the settings of Keycloak, I set Web Origins to “*”.
I tried enabling OIDC CIBA Grant, OAuth 2.0 Device Authorization Grant, but to no avail.
The HTML code of the login form is identical whether I call it from browser or API, I did not find any encoding issues with the code.
Is my Keycloak set up incorrectly, or am I trying to do something, that is impossible to do?
Any help is greatly appreciated.