0

I have the k8s cluster which ALB(ingress) --> (api service, keycload service) --> (api deployment, pod deployment).

I use authorize code authentication to Keycloak and get the access token. But when we call the api service with keycloak accesstoken as bearer header the api return 401 without any logs.

 cache-control: no-cache, no-store, max-age=0, must-revalidate 
 content-length: 0 
 date: Fri, 23 Oct 2020 11:35:42 GMT 
 expires: 0 
 pragma: no-cache 
 status: 401 
 strict-transport-security: max-age=31536000 ; includeSubDomains 
 vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers 
 x-content-type-options: nosniff 
 x-frame-options: DENY 
 x-xss-protection: 1; mode=block

I also portforward the pod and service to localhost and call it but it still not process.

curl -X GET "http://localhost:8080/auth/profile" -H "accept: application/json" -H "Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJmdlhrRlJVZHZmQ0Iwai00c2x3Vjhwelg5Q0dNT0hhUWMwY18xUkQ0ZkRzIn0.eyJleHAiOjE2MDM0NzUxMzUsImlhdCI6MTYwMzQ0MDI5OSwiYXV0aF90aW1lIjoxNjAzNDM5MTM1LCJqdGkiOiIxYzAxOTNiNi1hY2Q5LTQwY2ItODEwNC03YmQzMmZlYWQ3MWYiLCJpc3MiOiJodHRwczovL2tleWNsb2FrLnZhbGlkOC5waGFybWFjeXN0YXJzLmNvbS9hdXRoL3JlYWxtcy9tYXN0ZXIiLCJzdWIiOiI3ZGRkYWJlZC1iNDUxLTQwZDQtOGExYi1jZTM1MTA5OGNjMGUiLCJ0eXAiOiJCZWFyZXIiLCJhenAiOiJ2YWxpZDgiLCJzZXNzaW9uX3N0YXRlIjoiYzU1YTM0NjUtZWM1My00YTAxLThlYjgtOGQ3MDViYjk2MzI4IiwiYWNyIjoiMCIsImFsbG93ZWQtb3JpZ2lucyI6WyIqIl0sInJlc291cmNlX2FjY2VzcyI6eyJ2YWxpZDgiOnsicm9sZXMiOlsiTWVtYmVyIl19fSwic2NvcGUiOiJvcGVuaWQgZW1haWwiLCJlbWFpbF92ZXJpZmllZCI6ZmFsc2UsImVtYWlsIjoidmFuLmxlQHhwZXJjLmNvbSJ9.EOAhCVslwpgpNyGX17MYw4dKgpVAUwwmvgDW_qE6KIFLyCUjYjDSKhLlvuYGDQ6_LMgkujBIzDlFMp3lzAuFpfxmeCAggplxtDuheiumXVC4D-J3BLRzPxtl2zVRaWsglOTaE3V24PwHXpofSbSDAoqdTeOeqGYNV9dllHpv81L2odRKLQvKttL-TSDJnaE6ypL2yNL8aXmikTE7ZPK9cgz42MMY_qby75ihKIJU9s-GMONvqOyFwyk2z_A_mB9W3LfS1GT4DYgOMzXuaQFueDK8V0W3QwZIjHvsWYe23M1stkl_uBv66dSaCGg0I1lgts8t4HLvC71e16jwVnRCtA"

Can anyone tell me what is wrong with my setup. Any helps are appreciate.

PS: my api image is built on Spring boot stack with tomcat is embed web server.

Van Le
  • 1
  • if it's spring boot, I would expect you can increase the logging verbosity either via its logback configuration, or by setting `-DDEBUG=true`, or by putting `SPRING_APPLICATION_JSON={"logging":{"org.springframework":"DEBUG"}}` in the Pod's `env:`. Are you _sure_ the request is even reaching Spring (a lot of those headers look like nginx ones to me)? – mdaniel Oct 23 '20 at 16:01
  • hi @mdaniel the request does not reach Spring. It does not output any log event. – Van Le Oct 24 '20 at 10:33
  • I suspected; so in that case, you should remove the `springboot` tag and and the tag of the Ingress controller you are using in your cluster, because it is far more likely that it is seeing the `Authorization:` header and **it** is trying to validate the token, and rejecting due to its configuration – mdaniel Oct 24 '20 at 18:30

0 Answers0