last day (15 days later) » 

4:07 PM
0
A: Configuring keycloak as IDP in another keycloak

dreamcrash keycloak2_1 | 08:21:17,079 TRACE [org.keycloak.events] (default task-10) type=CODE_TO_TOKEN_ERROR, realmId=master, clientId=idp-client, userId=null, ipAddress=127.0.0.1, error=invalid_client_credentials, grant_type=authorization_code, requestUri=http://localhost:8080/auth/realms/master/protocol...

 
I am fetching client secret from here - i.imgur.com/Rb4ONf0.png . Is this correct ?
 
It is actually correct.
 
Is there any other configuration I am missing ?
 
@GeorgeJPadayatti I will have a look after lunch
@GeorgeJPadayatti this might sound stupid but can you try with a client ID idp_client instead of idp-client?
 
It doesn't work.
Error type in the terminal is CODE_TO_TOKEN error. So does this mean Authorization code was successfully retrieved but access token couldn't be fetched for the given code ?
Am I missing something in the client configuration ?
Any idea if this is related to cookies or something ?
 
4:20 PM
I have no idea but I you want
I can tried to reproduce locally
each keycloak instances is a docker container?
For now can you test what happen if for that clientID you have the redirectUris=*
 
4:35 PM
Thanks. Yes both keycloak instances are docker containers. It would be helpful if you can test locally.
````
 
Can you try to see "For now can you test what happen if for that clientID you have the redirectUris=*"
 
Yes I can.
It throws the same error.
 
can you give me the docker command that spaws the keycloak
instance
 
This is my test environment
You can run this by executing docker-compose up
 
in the meantime stackoverflow.com/questions/45860313/… have a look at this
to see if it is the same issue
 
4:44 PM
This is a similar candidate. But the given solutions is not applicable for me.
 
I have the two instances
running
What will be the setup Keycloak 1 --> Keycloak 2?
the user goes to login 1 have a page to login in keycloak 2?
 
User goes to keycloak2 login page to login using keycloak1 credentials
Basically in keycloak1, we have to create an openid client
And in keycloak2, add keycloak1 as identity provider.
 
yes I have done this setup before
but was using keycloak identity providing against it self
 
the user exists in which keycloak 1 or 2?
 
Is this the right redirect_uri ?
The user exists in keycloak1.
This user's credentials is then used to login to keycloak2
 
So user is on the DB of Keycloak 1
 
Users goes to the Keycloak login page 2
selects
Keycloak 1
logins there
and you want to redirect him back
 
5:02 PM
Yes
 
to the Keycloak 2
 
Like this.
 
does the user click on the left or on the right to login ?
 
right. He clicks on oidc, to get redirected to keycloak1 login page.
 
Yep that is exact the setup that I have
then when the user successfully logins in
he gets back to keycloak 2 right?
 
5:06 PM
Yep.
 
I am starting my kubernetes with my setup to compare
and see the differences
this will take 30 minutes or so
 
Does your setup involve two keycloak as well ?
@dreamcrash tnx.
 
Involves but with the difference that its
the same keycloak
against it self
different realms
 
 
2 hours later…
6:57 PM
as a IDP maybe it is most appropriate to use keycloak-oidc instead of OIDC
on my setup I have localhost:8081* and
web Origins +
 
7:10 PM
I am getting Invalid parameter: redirect_uri
with your setup
 

last day (15 days later) »