6

I'm trying to connect Django (3.2) with Keycloak (12.0.2) using mozilla-django-oidc (1.2.4).

I'm getting the redirection to keycloak when clicking on the Login button (which is using oidc_authentication_init view as per documentation), but after successful login I'm getting this error:

Exception Type: HTTPError at /oidc/callback/
Exception Value: 404 Client Error: Not Found for url: http://localhost:8080/auth/realms/mycorp/protocol/openid-connect/token

Relevant settings for django settings are:

settings.py

INSTALLED_APPS = [
    ...,
    'mozilla_django_oidc',
]
AUTHENTICATION_BACKENDS = (
    'django.contrib.auth.backends.ModelBackend',
    'mozilla_django_oidc.auth.OIDCAuthenticationBackend',
),

OIDC_AUTH_URI = 'http://localhost:8080/auth/realms/mycorp'
OIDC_CALLBACK_PUBLIC_URI = 'http://localhost'

LOGIN_REDIRECT_URL = OIDC_CALLBACK_PUBLIC_URI
LOGOUT_REDIRECT_URL = OIDC_AUTH_URI + '/protocol/openid-connect/logout?redirect_uri=' + OIDC_CALLBACK_PUBLIC_URI

OIDC_RP_CLIENT_ID = 'django'
OIDC_RP_CLIENT_SECRET = os.environ.get("OIDC_CLIENT_SECRET")
OIDC_RP_SCOPES = 'openid email profile'

# Keycloak-specific (as per http://KEYCLOAK_SERVER/auth/realms/REALM/.well-known/openid-configuration)
OIDC_OP_AUTHORIZATION_ENDPOINT = OIDC_AUTH_URI + '/protocol/openid-connect/auth'
OIDC_OP_TOKEN_ENDPOINT = OIDC_AUTH_URI + '/protocol/openid-connect/token'
OIDC_OP_USER_ENDPOINT = OIDC_AUTH_URI + '/protocol/openid-connect/userinfo'
OIDC_OP_JWKS_ENDPOINT = OIDC_AUTH_URI + '/protocol/openid-connect/certs'

urls.py

urlpatterns = [
    ...,
    path('oidc/', include('mozilla_django_oidc.urls')),
]

And detailed error:

HTTPError at /oidc/callback/
404 Client Error: Not Found for url: http://localhost:8080/auth/realms/mycorp/protocol/openid-connect/token
Request Method: GET
Request URL:    http://localhost/oidc/callback/?state=cBtEeSIHNNdsgMBUjPXkq2RwVSSpKsZF&session_state=a5b50fc0-0ec2-4def-8ec8-db1e4a95450f&code=864a2e21-75a7-42d8-8249-e9397be9b64b.a5b50fc0-0ec2-4def-8ec8-db1e4a95450f.2ec7cfbf-b5ee-4f9a-9d4b-012fdc0f9630
Django Version: 3.2
Exception Type: HTTPError
Exception Value:    
404 Client Error: Not Found for url: http://localhost:8080/auth/realms/mycorp/protocol/openid-connect/token
Exception Location: /usr/local/lib/python3.8/site-packages/requests/models.py, line 943, in raise_for_status
Python Executable:  /usr/local/bin/python
Python Version: 3.8.9
Python Path:    
['/home/maat/src',
 '/usr/local/bin',
 '/usr/local/lib/python38.zip',
 '/usr/local/lib/python3.8',
 '/usr/local/lib/python3.8/lib-dynload',
 '/usr/local/lib/python3.8/site-packages']
Server time:    Tue, 27 Apr 2021 19:08:01 +0200

Apparently everything is configured as explained in documentation, but I cannot see the point why it fails...

fernandezcuesta
  • 2,390
  • 1
  • 15
  • 32

1 Answers1

4

The 404 wasn't clear enough for me until I realised that the tests were running on docker-compose, so access to localhost wasn't the same as the host.

Running in host network mode or reaching keycloak by its domain name / host IP (see below 172.20.0.1 which is the docker network IP for the host) fixed it:

OIDC_AUTH_URI=http://172.20.0.1:8080/auth/realms/mycorp
OIDC_AUTHENTICATION_CALLBACK_URL=http://localhost/openid/callback
OIDC_CALLBACK_PUBLIC_URI=http://localhost/
fernandezcuesta
  • 2,390
  • 1
  • 15
  • 32
  • 4
    Could you post your docker-compose.yml (or just a part of it) for completeness of the answer purpose? I can also helps those who encountered the same problem, so they can have a full working example. – DevOps Craftsman Aug 13 '21 at 06:36