We have a customer with a public network – let’s say company.com
They have an LB that redirects calls to our platform to an internal network, let’s call it internal.com
We are using KeyCloak’s login/forgot-password/… etc pages so the first call is to our main app this in turn redirects to KeyCloak for login, after the login the app calls an internal micro-service that is now trying to verify the JWT token with KeyCloak
But since it is on the internal network it uses the ISS in the JWT token which is https://keycloak.company.com and not https://keycloak.internal.com
If we try to fool it and setup the coredns inside K8s to redirect calls from https://keycloak.company.com to https://keycloak.internal.com it doesn’t work as we don’t have the SSL certificate of company.com but only internal.com
(The internal network doesn’t have access or knows the public network)

Ideas on how to resolve? SpringSecurity’s code checks the URL coming from the ISS
We are using SpringBoot3

We might be able to resolve the issue by having our own login/forgot-password etc. pages
And performing the authentication with KeyCloak internally only but we are trying to avoid this extra work. If we had the public network’s SSL certificate it would be great but we can’t have it.