Hi,
I am a newbie experimenting with using lua-resty-openidc in a docker-compose environment that uses Keycloak Community 6.0.1 server as the OpenID Connect provider. A quick overview of the issue is illustrated here.
I am using keycloak with lua-resty-openidc (nginx based module) to provide OpenID connect authentication and authorisation flow.
When I make a browser request from the docker host to an endpoint exposed in the openresty container the request url fails to redirect and display on the browser since keycloak server is not recognised on the docker host machine. For example:
http://keycloak:8080/auth/realms/myclient/protocol/openid-connect/auth?response_type=code&client_id=myclient&state=dbd8f19e9fceb1b350cba24de40126b7&redirect_uri=http%3A%2F%2FX.X.X.X%3A4200&nonce=b3eb4bd24e829e02fd7510da90f808cd&scope=openid%20email%20profile
If I copy and paste the request url and use curl from within the openresty container then the login page html is returned from the keycloak container as expected.
I have appended the docker-compose file, Dockerfile for openresty service and nginx configuration files below.
Has anybody experienced and resolved a similar issue, i.e. how to redirect to and display html from a container within a docker-compose environment?
Update
If I add keycloak and angular to /etc/hosts redirection works for keycloak and angular containers. Is this the recommended solution or are there better alternatives?
nginx:
worker_processes 1;
events {
worker_connections 128;
}
http {
include mime.types;
default_type application/octet-stream;
sendfile on;
keepalive_timeout 65;
lua_code_cache off;
lua_need_request_body on;
gzip on;
resolver 127.0.0.11 ipv6=off;
real_ip_header X-Forwarded-For;
real_ip_recursive on;
lua_shared_dict discovery 1m;
lua_shared_dict sessions 10m;
lua_package_path '~/lua/?.lua;;';
server {
listen 8081;
default_type plain/text;
location / {
content_by_lua '
ngx.say("Hello ", ngx.req.get_headers()["X-USER"])
';
}
}
server {
listen 80;
charset utf-8;
default_type text/html;
access_by_lua_block {
local opts = {
redirect_uri = "http://<ip addr>:4200",
discovery = "http://keycloak:8080/auth/realms/myclient/.well-known/openid-configuration",
client_id = "myclient",
client_secret = "secret",
ssl_verify = "no",
accept_none_alg = false,
accept_unsupported_alg = false,
renew_access_token_on_expiry = true,
access_token_expires_in = 3600,
revoke_tokens_on_logout = true,
}
local res, err = require("resty.openidc").authenticate(opts)
if err then
ngx.status = 500
ngx.say(err)
ngx.exit(ngx.HTTP_INTERNAL_SERVER_ERROR)
end
ngx.req.set_header("X-USER", res.id_token.sub)
}
expires 0;
add_header Cache-Control private;
location / {
default_type text/plain;
index index.html index.htm;
}
error_page 500 502 503 504 /50x.html;
location = /50x.html {
root html;
}
}
}
docker-compose:
version: "3.7"
networks:
auth-network:
ipam:
config:
- subnet: 172.22.0.0/16
services:
postgres:
container_name: postgres
image: postgres
environment:
POSTGRES_DB: keycloak
POSTGRES_USER: keycloak
POSTGRES_PASSWORD: password
ports:
- "5433:5432"
networks:
- auth-network
keycloak:
container_name: keycloak
image: jboss/keycloak
ports:
- "8080:8080"
- "8443:8443"
- "9990:9990"
links:
- api
- postgres
environment:
DB_ADDR: postgres
DB_DATABASE: keycloak
DB_PORT: 5432
DB_USER: keycloak
DB_SCHEMA: public
DB_PASSWORD: password
DB_VENDOR: "POSTGRES"
KEYCLOAK_USER: user
KEYCLOAK_PASSWORD: password
PROXY_ADDRESS_FORWARDING: "true"
command:
- "-b 0.0.0.0 \
-Dkeycloak.migration.action=import \
-Dkeycloak.migration.provider=dir \
-Dkeycloak.migration.strategy=IGNORE_EXISTING \
-Dkeycloak.migration.dir=/tmp"
volumes:
- ./data:/tmp
networks:
- auth-network
openresty:
build:
context: ./nginx
dockerfile: Dockerfile
container_name: resty
image: resty
links:
- keycloak
ports:
- "8090:80"
- "8081:8081"
- "8082:8082"
networks:
- auth-network
restart: always
volumes:
- "./nginx/conf/nginx.conf:/usr/local/openresty/nginx/conf/nginx.conf"
Dockerfile:
FROM openresty/openresty:xenial
# install dependencies
RUN ["luarocks", "install", "lua-resty-session"]
RUN ["luarocks", "install", "lua-resty-http"]
RUN ["luarocks", "install", "lua-resty-jwt"]
ADD lib/resty/openidc.lua /usr/local/openresty/lualib/resty/openidc.lua
EXPOSE 80
