search

strimzi / strimzi-kafka-oauth

OAuth2 support for Apache Kafka® to work with many OAuth2 authorization servers
Apache License 2.0
140 stars 89 forks source link

Kafka Server Startup Failure with Keycloak OAuth Server #233

Open zzhu158 opened 5 months ago

zzhu158 commented 5 months ago

I've encountered an issue when using compose-authz.yml with Keycloak OAuth server. The error message in the log shows that the POST request to get the OAuth token fails with a 404 status code: [2024-03-20 21:39:29,536] DEBUG loginWithClientSecret() - tokenEndpointUrl: http://keycloak:8080/auth/realms/kafka-authz/protocol/openid-connect/token, clientId: kafka, clientSecret: k*****, scope: null, audience: null, connectTimeout: 60, readTimeout: 60, retries: 0, retryPauseMillis: 0 (io.strimzi.kafka.oauth.common.OAuthAuthenticator) kafka | [2024-03-20 21:39:29,557] INFO Action failed on try no. 1 (io.strimzi.kafka.oauth.common.HttpUtil) kafka | io.strimzi.kafka.oauth.common.HttpException: POST request to http://keycloak:8080/auth/realms/kafka-authz/protocol/openid-connect/token failed with status 404: {"error":"Unable to find matching target resource method"} I checked to see if Keycloak was working properly, when clicking on the "Admin Console" it shows "Loading" but couldn't be completed. image Can someone please look into the Keycloak configuration?

Steps to reproduce 1.Go to examples/docker/kafka-oauth-strimzi/compose-authz.yml 2.run ``` docker-compose -f compose.yml -f keycloak/compose.yml -f keycloak-import/compose.yml -f kafka-oauth-strimzi/compose-authz.yml up --build

  1. Login to Keycloak, and clicking Keycloak Admin Console, it will show the issue
mstruk commented 5 months ago

Please, try to use Strimzi Kafka OAuth 0.15.0. There have been changes in the examples, the Keycloak version is now the latest or very recent, and keycloak-import is no longer there.

flo-kn commented 4 months ago

Had the same (got the same screen as in @zzhu158's screenshot).

  1. Following this one examples/docker/README.md

  2. Then this examples/docker/README.md#running-with-keycloak

      docker-compose -f compose.yml -f kafka-oauth-strimzi/compose.yml -f keycloak/compose.yml up --build

    Pretty sure I am using version 0.15.0 where ever possible.

What fixed it for me: Adjusting the hostname in the browser keycloak instead of localhost:

https://keycloak:8443/admin/master/console/ ✅

vs.

https://localhost:8443/admin/master/console/ ⛔️

mstruk commented 4 months ago

Thanks for the info. It's something that has been a problem with the updated version of Keycloak. I guess it needs to be clearly communicated in the examples README.