[resource] [keycloak] Connect gravitee gateway to keycloak throught proxy

[aluneau]

Hi, I'm in trouble, since yesturday I try to connect my gravitee gateway with keycloak throught a proxy. I pass JAVA_OPTS=-Dhttp.proxyHost=proxy.net -Dhttp.proxyPort=3128 -Dhttps.proxyHost=proxy.net -Dhttps.proxyPort=3128 -Dhttp.nonProxyHosts=”selenium-hub|localhost” -Dhttps.nonProxyHosts=”selenium-hub|localhost” and it is set correctly.

Expected Behavior

Connect to my keycloak server

Current Behavior

11:47:36.833 [vert.x-eventloop-thread-5] [] ERROR i.g.r.o.k.OAuth2KeycloakResource - An error occurs while introspecting access token
--
  | io.netty.channel.ConnectTimeoutException: connection timed out: keycloak-server.fr/192.192.195.192:443
  | at io.netty.channel.nio.AbstractNioChannel$AbstractNioUnsafe$1.run(AbstractNioChannel.java:267)
  | at io.netty.util.concurrent.PromiseTask$RunnableAdapter.call(PromiseTask.java:38)
  | at io.netty.util.concurrent.ScheduledFutureTask.run(ScheduledFutureTask.java:125)
  | at io.netty.util.concurrent.AbstractEventExecutor.safeExecute(AbstractEventExecutor.java:163)
  | at io.netty.util.concurrent.SingleThreadEventExecutor.runAllTasks(SingleThreadEventExecutor.java:404)
  | at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:463)
  | at io.netty.util.concurrent.SingleThreadEventExecutor$5.run(SingleThreadEventExecutor.java:886)
  | at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30)
  | at java.lang.Thread.run(Thread.java:748)

Possible Solution

Find keycloak with local hostname (but it will not work because keycloak check the hostname) so the unique solution is to set correct proxy

Context

I'm trying to use Gravitee and Keycloak to protect a selenium-hub.
I'm sure that my proxy is working because I can access to keycloak with curl.

Your Environment

• Version used: 1.16.3
• Browser Name and version: Chrome 67
• Operating System and version: Openshift

Do you have an idea why gravitee does not seem to use the proxy settings? Is there something else that I could miss ?

[brasseld]

Hello Adrien,

Let's join other guys from Worldline at DevFest Lille, we have a talk about Gravitee.io and Keycloak and how to integrate them :)

[yinghe1]

hi, Brassely, very interested in Gravitee.io and Keycloak and how to integrate them talk. If you guys can publish English CC for the discussion, that will be awesome

[brasseld]

@yinghe1 we will provide a Keycloak adapter for Gravitee.io in next release (1.18) to integrate them in a magical way :)

Will try to write some doc to explain how it works.

[aluneau]

It's too bad that I saw that less than one hour ago ^^

I already saw your breizhcamp 2018 conference and i'm not too far from succeeding to use keycloak and gravitee just this little thing with proxies that I don't know how to solve :)

Also I think I will need to implement a plugin (for basic http authentification like: admin:admin@gravitee-gateway.com) I don't know if you have examples in order to achieve that.

[brasseld]

@bloudman Does it mean that you need both OAuth and Basic authentication for the same API ?

[aluneau]

I think I will need a basic authentification in order to connect a selenium client to gravitee gateway (because it is the only auth system that selenium allows me). Then gravitee gateway will contact the keycloak server to test credentials in order to know if the user is authorized or not. It's just an idea.

[aluneau]

For the moment i'm trying to do what you did at the breizhcamp conf and I think everything is ok for that except the connection between gravitee gateway and keycloak just to try and to get a little bit more familiarized with keycloak and gravitee.

[yinghe1]

@brasseld that is great news for keycloak adapter. will 1.18 release keycloak adapter cover the following?

1. oauth2 and basic auth for guarding api
2. oauth2 and basic auth for guarding dev portal

[brasseld]

The resource plugin is covering 1).

For 2), you should be able to configure the portal and access it with Keycloak authentication. See https://docs.gravitee.io/apim_installguide_authentication_keycloak.html

[aluneau]

I made a pull request : https://github.com/gravitee-io/gravitee-resource-oauth2-provider-keycloak/pull/1