I am working on a project with a couple of micro-services(spring boot multi-module project).
I have a api-gateway microservice and it has the below setting for security which uses keycloak
spring:
application:
name: api-gateway
security:
oauth2:
resourceserver:
jwt:
issuer-uri: http://keycloak:8080/realms/my-realm
I have dockerized (docker-compose.yml) the whole project and below are the code samples for the api-gateway and keycloak
services:
keycloak:
container_name: keycloak
image: quay.io/keycloak/keycloak:21.1
command:
- start-dev
env_file:
- app/dev/keycloak.dev.env
ports:
- "8890:8080"
depends_on:
postgres:
condition: service_healthy
networks:
- keycloak-network
apigw:
container_name: apigw
image: ssomlk/api-gateway:latest
ports:
- "8081:8081"
environment:
- SPRING_PROFILES_ACTIVE=docker
networks:
- keycloak-network
networks:
keycloak-network:
driver: bridge
I have created a realm, a client with service user roles activated in keycloak.
When I spin up the containers (apigw and keycloak) there are no errors. I use postman to invoke an endpoint. For authorization in postman I use the grant type ‘Client Credentials’ and client id and the client secret created.
Access token url looks something like below
http://localhost:8890/realms/my-realm/protocol/openid-connect/token
I get the token and when I invoke the end point (token attached) localhost:8081/api/monks/1
I get the 401 unauthorized error
Bearer error="invalid_token", error_description="The iss claim is not valid", error_uri="https://tools.ietf.org/html/rfc6750#section-3.1"
I think the error is due to the mismatch of iss because my access token url sent via postman is different to issuer-uri
access token url -> http://localhost:8890/realms/project-sri-kalyani-yogashrama/protocol/openid-connect/token
issuer-uri -> http://keycloak:8080/realms/my-realm
I have run the implementation by just running via IDE (IntelliJ IDEA) and this works. But the problem is when I containerize them only.
Could someone help me please?