flask application using flask_oidc with nginx reverse proxy in docker deployed on EC2 giving Not authorized error after authentication with keycloak

Question

I have the following setup:

1: Keycloak docker container running on an EC2 instance. (I have configured it temporarily to accept http connections)

2: My Flask applicatioń together with nginx reverse proxy running in docker on another EC2 instance.

I have created the realm and client on keycloak and configured the redirect uri.

I am able to get my flask application to reach the Keycloak instance for authentication.

I added from werkzeug.middleware.proxy_fix import ProxyFix and app.wsgi_app = ProxyFix(app.wsgi_app)to get the redirect_uri to work.

However, when the redirection happens, I get a 'Not authorized' error (i can also see 401 in nginx log).

I have set the OVERWRITE_REDIRECT_URI as OVERWRITE_REDIRECT_URI = 'https://authenticationdemo.mydomain/oidc_callback' I configured nginx to forward the https request with endpoint oidc_callback to my flask application route /oidc_callback (i do not implement my own callback).

    location /oidc_callback{
        proxy_pass http:/<flask_app_name_in_docker>:<port>/oidc_callback;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Host $host;
        proxy_redirect off;
    }

I am not able to solve this problem as I am not able to figure our where the callback is going wrong. I can see the log from nginx with GET /oidc_callback?state=<...somevalue..>&session_state=<...somevalue>&code=<..somevalue...> But after redirection this does not work.

I tried both by

1. using ip addresses in the redirect uri
2. domain name same as my certificates and configuring hosts file on the EC2 instance with keycloak to point to the correct ip address of the EC2 instance with flask application

Both are not working.

I am not able to figure out if something is going wrong in passing back the authentication information or is there some basic config wrong.

Can somebody please point to the correct approach?

I already looked up and tried information in other related questions:

Flask_oidc gives Errno 99 Cannot assign requested address when run in Docker container

flask-oidc-redirect-uri-value-being-overwritten-somewhere

flask-oidc-with-keycloak-oidc-callback-default-callback-not-working

(and read many other similar ones)

I am not looking for a custom callback. I just need the default callback behavior as it is without a reverse proxy.

Answer 1

Update: I figured out that the problem was due to the failing check for matching 'OIDC_VALID_ISSUER' in the function _is_id_token_valid(self,id_token) in flask_oidc. Putting port number in the url for issuer in client_secrets was causing the problem. Removing it solved the problem.