I have 2 Keycloak servers running in a non-containerized setup. I have set up a LB on port 7777 that redirects to one of those two servers.

server {
ssl_session_timeout 1d;
ssl_session_cache shared:MozSSL:10m;  # about 40000 sessions
ssl_session_tickets off;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
ssl_prefer_server_ciphers off;
ssl_certificate /etc/openresty/tls/nginx.crt;
ssl_certificate_key /etc/openresty/tls/nginx.key;
ssl_dhparam /etc/openresty/tls/nginx_dhparams.pem;
listen       0.0.0.0:7777 ssl;
server_name  keycloak;

location / {
    proxy_pass https://keycloak_upstream;
    proxy_next_upstream     error timeout invalid_header http_500 http_502 http_503 http_504;
    proxy_set_header    Host $host;
    proxy_set_header    X-Real-IP   $remote_addr;
    proxy_set_header    X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header    Upgrade $http_upgrade;
    proxy_set_header    Connection  "upgrade";
    proxy_connect_timeout   2;
  }
}

For the requests coming to 443, this is how my access_by_lua_block looks like:

access_by_lua_block {
    local opts = {
        redirect_uri = "/redirect_uri",
        discovery = "https://IP_OF_LB:7777/realms/test-realm/.well-known/openid-configuration",
        client_id = "est_client",
        client_secret = "123123123123123",
        ssl_verify = "no",
        redirect_uri_scheme = "https",
        logout_path = "/logout",
        redirect_after_logout_uri = "https://ip:port/realms/test-realm/protocol/openid-connect/logout",
        redirect_after_logout_with_id_token_hint = false,
        session_contents = {id_token=true}
    }

and the upstream:

upstream keycloak_upstream {
server keycloak-test:8082 max_fails=2;
server keycloak-test2:8082 max_fails=2;
}

When using a non-LB setup, and discovery URL going directly to the single Keycloak server, everything works properly, there are no issues.

After adding the LB, I get redirected to the correct Keycloak server (the one that is running) but after a successful log-in, I don’t redirected to my application but a

ERR_INVALID_RESPONSE
403 Forbidden

response is given back to me.

I’m not sure what am I doing wrong. Is there an easier way to do what I’m trying to do? Is this a cookie/header issue? Could anyone point me in the right direction to at least try to debug this properly.