Spring Boot Application not redirecting to Keycloak hosted on different server

Question

I have created a simple application which is authenticated by Keycloak server. I have tested the application and Keycloak server on same machine and the application runs fine and redirects me to the Keycloak for respective realm client authentication. Now I have reserved a separate server for my Keycloak (https://192.162.10.11:8443) and my Spring Boot is running on my localhost. But once I try to access the service, the app does not redirect me to Keycloak instead it given me Whitelable Error Page. Can someone please guide me what am I doing wrong. My complete code details are as below

Application.properties

server.port=8081
keycloak.realm= Myrealm
keycloak.auth-server-url= https://192.162.10.11:8443/auth
keycloak.ssl-required= external
keycloak.resource= backend-app
keycloak.public-client= true
keycloak.confidential-port= 0

** My keycloak is running on https://192.162.10.11:8443 and I have access to it through browser

Myrealm setttings from Keyclaok:

Link that I am accessing is http://localhost:8081/persons

This link was being authenticated when Keycloak was on same machine as the application

MainClass Code

package sb.keycloak;

import java.security.Principal;
import java.util.ArrayList;
import java.util.List;
import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.http.ResponseEntity;
import org.springframework.ui.Model;
import org.springframework.web.bind.annotation.CrossOrigin;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RequestMapping;


@SpringBootApplication
@RequestMapping
@CrossOrigin(allowCredentials="true")
public class SbKeycloakApplication {

  @GetMapping(path = "/persons")
  public ResponseEntity<List<Persons>> customers(final Principal principal, final Model model) {
    final var personas = new ArrayList<Persons>();
    personas.add(new Persons(1, "Person1"));
    personas.add(new Persons(2, "Person2"));
    return ResponseEntity.ok(personas);
  }

  public static void main(final String[] args) {
    SpringApplication.run(SbKeycloakApplication.class, args);
  }

}

ERROR SCREENSHOT

EDIT

I have also updated the IP of MyRealm to the correct IP (which is the IP where my Spring Boot Application is running from - my PC's IP) but still the same Whitelable error persists.

EDIT 2 (WHITELABEL ERROR ADDED AS TEXT BELOW)

Whitelabel Error Page
This application has no explicit mapping for /error, so you are seeing this as a fallback.

Fri Apr 24 10:53:33 PKT 2020
There was an unexpected error (type=Internal Server Error, status=500).
No message available
java.lang.NullPointerException
    at org.keycloak.adapters.OAuthRequestAuthenticator.getRedirectUri(OAuthRequestAuthenticator.java:175)
    at org.keycloak.adapters.OAuthRequestAuthenticator.loginRedirect(OAuthRequestAuthenticator.java:213)
    at org.keycloak.adapters.OAuthRequestAuthenticator.authenticate(OAuthRequestAuthenticator.java:275)
    at org.keycloak.adapters.RequestAuthenticator.authenticate(RequestAuthenticator.java:138)
    at org.keycloak.adapters.springsecurity.filter.KeycloakAuthenticationProcessingFilter.attemptAuthentication(KeycloakAuthenticationProcessingFilter.java:154)
    at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:212)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
    at org.keycloak.adapters.springsecurity.filter.KeycloakPreAuthActionsFilter.doFilter(KeycloakPreAuthActionsFilter.java:96)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
    at org.springframework.web.filter.CorsFilter.doFilterInternal(CorsFilter.java:96)
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
    at org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:74)
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
    at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:105)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
    at org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:56)
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
    at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:215)
    at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:178)
    at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:357)
    at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:270)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
    at org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:99)
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
    at org.springframework.web.filter.FormContentFilter.doFilterInternal(FormContentFilter.java:92)
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
    at org.springframework.web.filter.HiddenHttpMethodFilter.doFilterInternal(HiddenHttpMethodFilter.java:93)
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
    at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:200)
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
    at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:200)
    at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96)
    at org.keycloak.adapters.tomcat.AbstractAuthenticatedActionsValve.invoke(AbstractAuthenticatedActionsValve.java:67)
    at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:490)
    at org.keycloak.adapters.tomcat.AbstractKeycloakAuthenticatorValve.invoke(AbstractKeycloakAuthenticatorValve.java:181)
    at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:139)
    at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92)
    at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74)
    at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:343)
    at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:408)
    at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66)
    at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:836)
    at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1747)
    at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
    at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1130)
    at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:630)
    at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
    at java.base/java.lang.Thread.run(Thread.java:832)

COMPILER ERROR OUTPUT

 WARN 38292 --- [nio-8081-exec-2] o.keycloak.adapters.KeycloakDeployment   : Failed to load URLs from https://192.162.10.11:8443/auth/realms/Myrealm/.well-known/openid-configuration

Thanks for pointing out sir. I have also updated it to my PC's IP 192.162.10.15 (where spring boot is running from ) but still the same error persists. — Mirza Bilal, Apr 24 '20 at 05:15
check you can connect with your pc's 8081 port from keycloak server — GolamMazid Sajib, Apr 24 '20 at 05:28
Sir I tried. I can access the port 8081 and also disabled my firewall. But still the same error. I think I am doing something wrong in my application.properties or missing something there. Because in the error screenshot, you can see that the redirect only still hits the locahost (http://localhost:8081/sso/login) Whereas it should atleast redirect me to https://192.162.10.11:8443/(realm link) so that I may login. Any hints regarding this please? — Mirza Bilal, Apr 24 '20 at 05:38
add your whitelabel error page stack-trace error as text not image. — GolamMazid Sajib, Apr 24 '20 at 06:14
try one of these (not all together): 1- use simply "*" in valid redirect uris, 2-make the client secret and update your application.properties, 3-use KC without Spring Security — Ala Abid, Apr 24 '20 at 09:46
"This link was being authenticated when Keycloak was on same machine as the application" might be a CORS issue, try setting "keycloak.cors = true" in application.properties — Ala Abid, Apr 24 '20 at 09:50
@alabid Sir I have tried both suggestions, but still the same error shows. Also I have checked the output in the compiler, its shows this message : WARN 38292 --- [nio-8081-exec-2] o.keycloak.adapters.KeycloakDeployment : Failed to load URLs from https://192.162.10.11:8443/auth/realms/Myrealm/.well-known/openid-configuration — Mirza Bilal, Apr 25 '20 at 07:33
and are you able to access that same exact link from your browser? — Ala Abid, Apr 25 '20 at 19:37
Yes Sir I can access it in my browser. Tried both in Chrome and Firefox. — Mirza Bilal, Apr 25 '20 at 23:38

score 3 · Accepted Answer · answered Jun 03 '21 at 06:14

3

may check if it's related to certificate not trusted, which causes the "Failed to load URLs.." warning and in turn the NullPointerException in OAuthRequestAuthenticator.getRedirectUri()

answered Jun 03 '21 at 06:14

cipher883

46
3

That was exactly the issue – Mirza Bilal Oct 06 '21 at 05:41
2

what is the solution, please? – Ayoub Anbara Nov 11 '21 at 17:25

score 0 · Answer 2 · answered Apr 09 '21 at 20:23

The NullPointerException in the stacktrace points to the following line in OAuthRequestAuthenticator.

KeycloakUriBuilder redirectUriBuilder = deployment.getAuthUrl().clone()

Same problem happened to me when I failed to pass the application.properties values by environment variables when I containerized the Spring Boot application. The reason is probably keycloak.auth-server-url having a null value.

score 0 · Answer 3 · answered Nov 22 '21 at 07:09

When the Keycloak client adapter cannot make it's first call to the auth server, this pattern emerges in the logs:

java.lang.NullPointerException
        at org.keycloak.adapters.OAuthRequestAuthenticator.getRedirectUri(OAuthRequestAuthenticator.java:175)

This is a desperate cry for a better auth url. In my cases, the https communication was to blame for: port wasn't open, certificate wasn't trustable, etc.

Spring Boot Application not redirecting to Keycloak hosted on different server

3 Answers3