Skip to content

Commit a43db9b

Browse files
mstrukmstruk
authored
Fix Keycloak urls in example to work with recent versions of Keycloak (#250)
Signed-off-by: Marko Strukelj <[email protected]>
1 parent 7ca4e8f commit a43db9b

23 files changed

+75
-87
lines changed

‎README.md

+18-18
Original file line numberDiff line numberDiff line change
@@ -295,8 +295,8 @@ If your authorization server generates JWT tokens, and exposes the JWKS Endpoint
295295
since it does not require contacting the authorization server whenever a new Kafka client connects to the Kafka Broker.
296296

297297
Specify the following `oauth.*` properties:
298-
- `oauth.jwks.endpoint.uri` (e.g.: "https://localhost:8443/auth/realms/demo/protocol/openid-connect/certs")
299-
- `oauth.valid.issuer.uri` (e.g.: "https://localhost:8443/auth/realms/demo" - only access tokens issued by this issuer will be accepted)
298+
- `oauth.jwks.endpoint.uri` (e.g.: "https://localhost:8443/realms/demo/protocol/openid-connect/certs")
299+
- `oauth.valid.issuer.uri` (e.g.: "https://localhost:8443/realms/demo" - only access tokens issued by this issuer will be accepted)
300300

301301
Some authorization servers don't provide the `iss` claim. In that case you would not set `oauth.valid.issuer.uri`, and you would explicitly turn off issuer checking by setting the following option to `false`:
302302
- `oauth.check.issuer` (e.g. "false")
@@ -373,8 +373,8 @@ When your authorization server is configured to use opaque tokens (not JWT) or i
373373
This will result in Kafka Broker making a request to authorization server every time a new Kafka client connection is established.
374374

375375
Specify the following `oauth.*` properties:
376-
- `oauth.introspection.endpoint.uri` (e.g.: "https://localhost:8443/auth/realms/demo/protocol/openid-connect/token/introspect")
377-
- `oauth.valid.issuer.uri` (e.g.: "https://localhost:8443/auth/realms/demo" - only access tokens issued by this issuer will be accepted)
376+
- `oauth.introspection.endpoint.uri` (e.g.: "https://localhost:8443/realms/demo/protocol/openid-connect/token/introspect")
377+
- `oauth.valid.issuer.uri` (e.g.: "https://localhost:8443/realms/demo" - only access tokens issued by this issuer will be accepted)
378378
- `oauth.client.id` (e.g.: "kafka" - this is the OAuth2 client configuration id for the Kafka broker)
379379
- `oauth.client.secret` (e.g.: "kafka-secret")
380380

@@ -427,7 +427,7 @@ Otherwise, if the response contains `"client_id": "my-producer"` then the princi
427427
Sometimes the Introspection Endpoint does not provide any useful identifying information that we can use for the user id.
428428
In that case you can configure User Info Endpoint:
429429

430-
- `oauth.userinfo.endpoint.uri` (e.g.: "https://localhost:8443/auth/realms/demo/protocol/openid-connect/userinfo")
430+
- `oauth.userinfo.endpoint.uri` (e.g.: "https://localhost:8443/realms/demo/protocol/openid-connect/userinfo")
431431

432432
If the user id could not be extracted from Introspection Endpoint response, then the same rules (`oauth.username.claim`, `oauth.fallback.username.claim`, `oauth.fallback.username.prefix`) will be used to try extract the user id from User Info Endpoint response.
433433

@@ -529,7 +529,7 @@ When configuring the listener for `SASL/PLAIN` using `org.apache.kafka.common.se
529529

530530
There is an additional `oauth.*` option you can specify (it's optional):
531531

532-
- `oauth.token.endpoint.uri` (e.g.: "https://localhost:8443/auth/realms/demo/protocol/openid-connect/token")
532+
- `oauth.token.endpoint.uri` (e.g.: "https://localhost:8443/realms/demo/protocol/openid-connect/token")
533533

534534
If this option is not specified the listener treats the `username` parameter of the SASL/PLAIN authentication as the account name, and the `password` parameter as the raw access token which is passed to the validation as if SASL/OAUTHBEARER was used.
535535

@@ -558,7 +558,7 @@ All the Kafka brokers in the cluster should be configured with the same client I
558558
When you configure your listener to support OAuth, you can configure it to support OAUTHBEARER, but you can also configure it to support the OAuth over PLAIN as explained previously. PLAIN does not make much sense on the broker for inter-broker communication since OAUTHBEARER is supported. Therefore, it is best to only use OAUTHBEARER mechanism for inter-broker communication.
559559

560560
Specify the following `oauth.*` properties in `sasl.jaas.config` configuration:
561-
- `oauth.token.endpoint.uri` (e.g.: "https://localhost:8443/auth/realms/demo/protocol/openid-connect/token")
561+
- `oauth.token.endpoint.uri` (e.g.: "https://localhost:8443/realms/demo/protocol/openid-connect/token")
562562
- `oauth.client.id` (e.g.: "kafka" - this is the client configuration id for Kafka Broker)
563563
- `oauth.client.secret` (e.g.: "kafka-secret")
564564
- `oauth.username.claim` (e.g.: "preferred_username")
@@ -583,9 +583,9 @@ inter.broker.listener.name=REPLICATION
583583
listener.name.replication.oauthbearer.sasl.jaas.config=org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule required \
584584
oauth.client.id="kafka" \
585585
oauth.client.secret="kafka-secret" \
586-
oauth.token.endpoint.uri="http://sso:8080/auth/realms/demo/protocol/openid-connect/token" \
587-
oauth.valid.issuer.uri="http://sso:8080/auth/realms/demo" \
588-
oauth.jwks.endpoint.uri="http://sso:8080/auth/realms/demo/protocol/openid-connect/certs" \
586+
oauth.token.endpoint.uri="http://sso:8080/realms/demo/protocol/openid-connect/token" \
587+
oauth.valid.issuer.uri="http://sso:8080/realms/demo" \
588+
oauth.jwks.endpoint.uri="http://sso:8080/realms/demo/protocol/openid-connect/certs" \
589589
oauth.username.claim="preferred_username" ;
590590
591591
# Server-side-authentication handler
@@ -598,8 +598,8 @@ listener.name.replication.oauthbearer.sasl.login.callback.handler.class=io.strim
598598
# The EXTERNAL listener only needs server-side-authentication support because we don't use it for inter-broker communication:
599599
600600
listener.name.external.oauthbearer.sasl.jaas.config=org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule required \
601-
oauth.valid.issuer.uri="http://sso:8080/auth/realms/demo" \
602-
oauth.jwks.endpoint.uri="http://sso:8080/auth/realms/demo/protocol/openid-connect/certs" \
601+
oauth.valid.issuer.uri="http://sso:8080/realms/demo" \
602+
oauth.jwks.endpoint.uri="http://sso:8080/realms/demo/protocol/openid-connect/certs" \
603603
oauth.username.claim="preferred_username" \
604604
unsecuredLoginStringClaim_sub="unused" ;
605605
@@ -611,9 +611,9 @@ listener.name.external.oauthbearer.sasl.server.callback.handler.class=io.strimzi
611611
612612
# On EXTERNAL listener we may also want to support OAuth over PLAIN
613613
listener.name.external.plain.sasl.jaas.config=org.apache.kafka.common.security.plain.PlainLoginModule required \
614-
oauth.token.endpoint.uri="http://sso:8080/auth/realms/demo/protocol/openid-connect/token" \
615-
oauth.valid.issuer.uri="http://sso:8080/auth/realms/demo" \
616-
oauth.jwks.endpoint.uri="http://sso:8080/auth/realms/demo/protocol/openid-connect/certs" \
614+
oauth.token.endpoint.uri="http://sso:8080/realms/demo/protocol/openid-connect/token" \
615+
oauth.valid.issuer.uri="http://sso:8080/realms/demo" \
616+
oauth.jwks.endpoint.uri="http://sso:8080/realms/demo/protocol/openid-connect/certs" \
617617
oauth.username.claim="preferred_username" \
618618
unsecuredLoginStringClaim_sub="unused" ;
619619
@@ -707,7 +707,7 @@ You also need a properly configured OAuth authentication support, as described i
707707
All the configuration properties for KeycloakAuthorizer begin with a `strimzi.authorization.` prefix.
708708

709709
The token endpoint used by KeycloakAuthorizer has to be the same as the one used for OAuth authentication:
710-
- `strimzi.authorization.token.endpoint.uri` (e.g.: "https://localhost:8443/auth/realms/demo/protocol/openid-connect/token" - the endpoint used to exchange the access token for a list of grants)
710+
- `strimzi.authorization.token.endpoint.uri` (e.g.: "https://localhost:8443/realms/demo/protocol/openid-connect/token" - the endpoint used to exchange the access token for a list of grants)
711711
- `strimzi.authorization.client.id` (e.g.: "kafka" - the client representing a Kafka Broker which has Authorization Services enabled)
712712

713713
The authorizer will regularly reload the list of grants for active sessions. By default, it will do this once every minute.
@@ -1104,7 +1104,7 @@ sasl.mechanism=OAUTHBEARER
11041104
sasl.jaas.config=org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule required \
11051105
oauth.client.id="team-a-client" \
11061106
oauth.client.secret="team-a-client-secret" \
1107-
oauth.token.endpoint.uri="http://keycloak:8080/auth/realms/kafka-authz/protocol/openid-connect/token" ;
1107+
oauth.token.endpoint.uri="http://keycloak:8080/realms/kafka-authz/protocol/openid-connect/token" ;
11081108
sasl.login.callback.handler.class=io.strimzi.kafka.oauth.client.JaasClientOauthLoginCallbackHandler
11091109
```
11101110

@@ -1122,7 +1122,7 @@ And pass additional configuration as ENV vars:
11221122
```
11231123
export OAUTH_CLIENT_ID="team-a-client"
11241124
export OAUTH_CLIENT_SECRET="team-a-client-secret"
1125-
export OAUTH_TOKEN_ENDPOINT_URI="http://keycloak:8080/auth/realms/kafka-authz/protocol/openid-connect/token"
1125+
export OAUTH_TOKEN_ENDPOINT_URI="http://keycloak:8080/realms/kafka-authz/protocol/openid-connect/token"
11261126
```
11271127

11281128
Note that if you have JAAS config parameters with the same names (lowercase with dots) they would not take effect - ENV vars will override them.

‎examples/README-authz.md

+5-5
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@ When everything starts up without errors we should have one instance of `keycloa
4040

4141
## Using Keycloak Admin Console to Configure Authorization
4242

43-
You can login to the Admin Console by opening `http://localhost:8080/auth/admin` and using `admin` as both username, and a password.
43+
You can login to the Admin Console by opening `http://localhost:8080/admin` and using `admin` as both username, and a password.
4444

4545
For this example we are interested in the `kafka-authz` realm. Selecting the realm in the upper left drop-down list will open the realm.
4646

@@ -159,7 +159,7 @@ sasl.mechanism=OAUTHBEARER
159159
sasl.jaas.config=org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule required \
160160
oauth.client.id="team-a-client" \
161161
oauth.client.secret="team-a-client-secret" \
162-
oauth.token.endpoint.uri="http://keycloak:8080/auth/realms/kafka-authz/protocol/openid-connect/token" ;
162+
oauth.token.endpoint.uri="http://keycloak:8080/realms/kafka-authz/protocol/openid-connect/token" ;
163163
sasl.login.callback.handler.class=io.strimzi.kafka.oauth.client.JaasClientOauthLoginCallbackHandler
164164
EOF
165165
```
@@ -258,7 +258,7 @@ sasl.mechanism=OAUTHBEARER
258258
sasl.jaas.config=org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule required \
259259
oauth.client.id="team-b-client" \
260260
oauth.client.secret="team-b-client-secret" \
261-
oauth.token.endpoint.uri="http://keycloak:8080/auth/realms/kafka-authz/protocol/openid-connect/token" ;
261+
oauth.token.endpoint.uri="http://keycloak:8080/realms/kafka-authz/protocol/openid-connect/token" ;
262262
sasl.login.callback.handler.class=io.strimzi.kafka.oauth.client.JaasClientOauthLoginCallbackHandler
263263
EOF
264264
```
@@ -318,7 +318,7 @@ Let's create a configuration for user `bob` who has full ability to manage every
318318
First, `bob` will authenticate to Keycloak server with his username and password and get a refresh token.
319319

320320
```
321-
export TOKEN_ENDPOINT=http://keycloak:8080/auth/realms/kafka-authz/protocol/openid-connect/token
321+
export TOKEN_ENDPOINT=http://keycloak:8080/realms/kafka-authz/protocol/openid-connect/token
322322
REFRESH_TOKEN=$(./oauth.sh -q bob)
323323
```
324324

@@ -339,7 +339,7 @@ sasl.mechanism=OAUTHBEARER
339339
sasl.jaas.config=org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule required \
340340
oauth.refresh.token="$REFRESH_TOKEN" \
341341
oauth.client.id="kafka-cli" \
342-
oauth.token.endpoint.uri="http://keycloak:8080/auth/realms/kafka-authz/protocol/openid-connect/token" ;
342+
oauth.token.endpoint.uri="http://keycloak:8080/realms/kafka-authz/protocol/openid-connect/token" ;
343343
sasl.login.callback.handler.class=io.strimzi.kafka.oauth.client.JaasClientOauthLoginCallbackHandler
344344
EOF
345345
```

‎examples/README.md

+3-3
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,7 @@ When you authenticate as client application itself (`kafka-producer-client`), yo
6666
"exp":1567409778,
6767
"nbf":0,
6868
"iat":1567373778,
69-
"iss":"http://192.168.64.103:8080/auth/realms/demo",
69+
"iss":"http://192.168.64.103:8080/realms/demo",
7070
"sub":"f996fea8-0958-4e3a-8eee-3e61949e627b",
7171
"typ":"Bearer",
7272
"azp":"kafka-producer-client",
@@ -93,7 +93,7 @@ When authenticating as user `alice`, some roles will be added to the token, whic
9393
"exp":1567410424,
9494
"nbf":0,
9595
"iat":1567374424,
96-
"iss":"http://192.168.64.103:8080/auth/realms/demo",
96+
"iss":"http://192.168.64.103:8080/realms/demo",
9797
"aud":"kafka-broker",
9898
"sub":"062eb69a-8e18-4937-9b23-d6c158d43829",
9999
"typ":"Bearer",
@@ -124,7 +124,7 @@ When you authenticate as `kafka-consumer-client` you get access token that looks
124124
"exp":1599516353,
125125
"nbf":0,
126126
"iat":1567375553,
127-
"iss":"http://192.168.64.103:8080/auth/realms/demo",
127+
"iss":"http://192.168.64.103:8080/realms/demo",
128128
"aud":"kafka-broker",
129129
"sub":"89307c94-655f-424f-b709-f873fec63dcc",
130130
"typ":"Bearer",

‎examples/consumer/src/main/java/io/strimzi/examples/consumer/ExampleConsumer.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ public static void main(String[] args) {
4545

4646
final String keycloakHost = external.getValue("keycloak.host", "keycloak");
4747
final String realm = external.getValue("realm", "demo");
48-
final String tokenEndpointUri = "http://" + keycloakHost + ":8080/auth/realms/" + realm + "/protocol/openid-connect/token";
48+
final String tokenEndpointUri = "http://" + keycloakHost + ":8080/realms/" + realm + "/protocol/openid-connect/token";
4949

5050
// You can also configure token endpoint uri directly via 'oauth.token.endpoint.uri' system property,
5151
// or OAUTH_TOKEN_ENDPOINT_URI env variable

‎examples/docker/kafka-oauth-strimzi/compose-authz-kraft.yml

+4-4
Original file line numberDiff line numberDiff line change
@@ -64,12 +64,12 @@ services:
6464
# Authentication config
6565
OAUTH_CLIENT_ID: "kafka"
6666
OAUTH_CLIENT_SECRET: "kafka-secret"
67-
OAUTH_TOKEN_ENDPOINT_URI: "http://${KEYCLOAK_HOST:-keycloak}:8080/auth/realms/${REALM:-kafka-authz}/protocol/openid-connect/token"
67+
OAUTH_TOKEN_ENDPOINT_URI: "http://${KEYCLOAK_HOST:-keycloak}:8080/realms/${REALM:-kafka-authz}/protocol/openid-connect/token"
6868

6969
# Validation config
70-
OAUTH_VALID_ISSUER_URI: "http://${KEYCLOAK_HOST:-keycloak}:8080/auth/realms/${REALM:-kafka-authz}"
71-
OAUTH_JWKS_ENDPOINT_URI: "http://${KEYCLOAK_HOST:-keycloak}:8080/auth/realms/${REALM:-kafka-authz}/protocol/openid-connect/certs"
72-
#OAUTH_INTROSPECTION_ENDPOINT_URI: "http://${KEYCLOAK_HOST:-keycloak}:8080/auth/realms/${REALM:-kafka-authz}/protocol/openid-connect/token/introspect"
70+
OAUTH_VALID_ISSUER_URI: "http://${KEYCLOAK_HOST:-keycloak}:8080/realms/${REALM:-kafka-authz}"
71+
OAUTH_JWKS_ENDPOINT_URI: "http://${KEYCLOAK_HOST:-keycloak}:8080/realms/${REALM:-kafka-authz}/protocol/openid-connect/certs"
72+
#OAUTH_INTROSPECTION_ENDPOINT_URI: "http://${KEYCLOAK_HOST:-keycloak}:8080/realms/${REALM:-kafka-authz}/protocol/openid-connect/token/introspect"
7373

7474
# username extraction from JWT token claim
7575
OAUTH_USERNAME_CLAIM: preferred_username

‎examples/docker/kafka-oauth-strimzi/compose-authz.yml

+4-4
Original file line numberDiff line numberDiff line change
@@ -67,12 +67,12 @@ services:
6767
# Authentication config
6868
OAUTH_CLIENT_ID: "kafka"
6969
OAUTH_CLIENT_SECRET: "kafka-secret"
70-
OAUTH_TOKEN_ENDPOINT_URI: "http://${KEYCLOAK_HOST:-keycloak}:8080/auth/realms/${REALM:-kafka-authz}/protocol/openid-connect/token"
70+
OAUTH_TOKEN_ENDPOINT_URI: "http://${KEYCLOAK_HOST:-keycloak}:8080/realms/${REALM:-kafka-authz}/protocol/openid-connect/token"
7171

7272
# Validation config
73-
OAUTH_VALID_ISSUER_URI: "http://${KEYCLOAK_HOST:-keycloak}:8080/auth/realms/${REALM:-kafka-authz}"
74-
OAUTH_JWKS_ENDPOINT_URI: "http://${KEYCLOAK_HOST:-keycloak}:8080/auth/realms/${REALM:-kafka-authz}/protocol/openid-connect/certs"
75-
#OAUTH_INTROSPECTION_ENDPOINT_URI: "http://${KEYCLOAK_HOST:-keycloak}:8080/auth/realms/${REALM:-demo}/protocol/openid-connect/token/introspect"
73+
OAUTH_VALID_ISSUER_URI: "http://${KEYCLOAK_HOST:-keycloak}:8080/realms/${REALM:-kafka-authz}"
74+
OAUTH_JWKS_ENDPOINT_URI: "http://${KEYCLOAK_HOST:-keycloak}:8080/realms/${REALM:-kafka-authz}/protocol/openid-connect/certs"
75+
#OAUTH_INTROSPECTION_ENDPOINT_URI: "http://${KEYCLOAK_HOST:-keycloak}:8080/realms/${REALM:-demo}/protocol/openid-connect/token/introspect"
7676

7777
# username extraction from JWT token claim
7878
OAUTH_USERNAME_CLAIM: preferred_username

‎examples/docker/kafka-oauth-strimzi/compose-kraft.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,7 @@ services:
6969
# Validation config
7070
OAUTH_VALID_ISSUER_URI: "https://${KEYCLOAK_HOST:-keycloak}:8443/realms/${REALM:-demo}"
7171
OAUTH_JWKS_ENDPOINT_URI: "http://${KEYCLOAK_HOST:-keycloak}:8080/realms/${REALM:-demo}/protocol/openid-connect/certs"
72-
#OAUTH_INTROSPECTION_ENDPOINT_URI: "http://${KEYCLOAK_HOST:-keycloak}:8080/auth/realms/${REALM:-demo}/protocol/openid-connect/token/introspect"
72+
#OAUTH_INTROSPECTION_ENDPOINT_URI: "http://${KEYCLOAK_HOST:-keycloak}:8080/realms/${REALM:-demo}/protocol/openid-connect/token/introspect"
7373

7474

7575
# username extraction from JWT token claim

‎examples/docker/kafka-oauth-strimzi/compose-plain.yml

+4-4
Original file line numberDiff line numberDiff line change
@@ -70,12 +70,12 @@ services:
7070
# Authentication config
7171
OAUTH_CLIENT_ID: "kafka"
7272
OAUTH_CLIENT_SECRET: "kafka-secret"
73-
OAUTH_TOKEN_ENDPOINT_URI: "http://${KEYCLOAK_HOST:-keycloak}:8080/auth/realms/${REALM:-kafka-authz}/protocol/openid-connect/token"
73+
OAUTH_TOKEN_ENDPOINT_URI: "http://${KEYCLOAK_HOST:-keycloak}:8080/realms/${REALM:-kafka-authz}/protocol/openid-connect/token"
7474

7575
# Validation config
76-
OAUTH_VALID_ISSUER_URI: "http://${KEYCLOAK_HOST:-keycloak}:8080/auth/realms/${REALM:-kafka-authz}"
77-
OAUTH_JWKS_ENDPOINT_URI: "http://${KEYCLOAK_HOST:-keycloak}:8080/auth/realms/${REALM:-kafka-authz}/protocol/openid-connect/certs"
78-
#OAUTH_INTROSPECTION_ENDPOINT_URI: "http://${KEYCLOAK_HOST:-keycloak}:8080/auth/realms/${REALM:-demo}/protocol/openid-connect/token/introspect"
76+
OAUTH_VALID_ISSUER_URI: "http://${KEYCLOAK_HOST:-keycloak}:8080/realms/${REALM:-kafka-authz}"
77+
OAUTH_JWKS_ENDPOINT_URI: "http://${KEYCLOAK_HOST:-keycloak}:8080/realms/${REALM:-kafka-authz}/protocol/openid-connect/certs"
78+
#OAUTH_INTROSPECTION_ENDPOINT_URI: "http://${KEYCLOAK_HOST:-keycloak}:8080/realms/${REALM:-demo}/protocol/openid-connect/token/introspect"
7979

8080
# username extraction from JWT token claim
8181
OAUTH_USERNAME_CLAIM: preferred_username

‎examples/docker/kafka-oauth-strimzi/compose-ssl.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,7 @@ services:
5656
# Validation config
5757
OAUTH_JWKS_ENDPOINT_URI: "https://${KEYCLOAK_HOST:-keycloak}:8443/realms/${REALM:-demo}/protocol/openid-connect/certs"
5858
OAUTH_VALID_ISSUER_URI: "https://${KEYCLOAK_HOST:-keycloak}:8443/realms/${REALM:-demo}"
59-
#OAUTH_INTROSPECTION_ENDPOINT_URI: "https://${KEYCLOAK_HOST:-keycloak}:8443/auth/realms/${REALM:-demo}/protocol/openid-connect/token/introspect"
59+
#OAUTH_INTROSPECTION_ENDPOINT_URI: "https://${KEYCLOAK_HOST:-keycloak}:8443/realms/${REALM:-demo}/protocol/openid-connect/token/introspect"
6060

6161

6262
# username extraction from JWT token claim

‎examples/docker/kafka-oauth-strimzi/compose.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,7 @@ services:
5656
# Validation config
5757
OAUTH_VALID_ISSUER_URI: "https://${KEYCLOAK_HOST:-keycloak}:8443/realms/${REALM:-demo}"
5858
OAUTH_JWKS_ENDPOINT_URI: "http://${KEYCLOAK_HOST:-keycloak}:8080/realms/${REALM:-demo}/protocol/openid-connect/certs"
59-
#OAUTH_INTROSPECTION_ENDPOINT_URI: "http://${KEYCLOAK_HOST:-keycloak}:8080/auth/realms/${REALM:-demo}/protocol/openid-connect/token/introspect"
59+
#OAUTH_INTROSPECTION_ENDPOINT_URI: "http://${KEYCLOAK_HOST:-keycloak}:8080/realms/${REALM:-demo}/protocol/openid-connect/token/introspect"
6060

6161

6262
# username extraction from JWT token claim

‎examples/kubernetes/README.md

+3-3
Original file line numberDiff line numberDiff line change
@@ -90,7 +90,7 @@ e.g. `default` you can fix the script on the fly:
9090

9191
KEYCLOAK_HOST=$(minishift ip)
9292
KEYCLOAK_PORT=$(kubectl get svc | grep keycloak | awk -F '8080:' '{print $2}' | awk -F '/' '{print $1}')
93-
echo http://$KEYCLOAK_HOST:$KEYCLOAK_PORT/auth/admin
93+
echo http://$KEYCLOAK_HOST:$KEYCLOAK_PORT/admin
9494

9595
You can then open the printed URL and login with admin:admin.
9696

@@ -101,7 +101,7 @@ You can connect directly to Kubernetes Node IP using a NodePort port:
101101

102102
KEYCLOAK_HOST=$(minikube ip)
103103
KEYCLOAK_PORT=$(kubectl get svc | grep keycloak | awk -F '8080:' '{print $2}' | awk -F '/' '{print $1}')
104-
echo http://$KEYCLOAK_HOST:$KEYCLOAK_PORT/auth/admin
104+
echo http://$KEYCLOAK_HOST:$KEYCLOAK_PORT/admin
105105

106106
You can then open the printed URL and login with admin:admin.
107107

@@ -112,7 +112,7 @@ In order to connect to Keycloak Admin Console you have to create a TCP tunnel:
112112

113113
kubectl port-forward svc/keycloak 8080:8080
114114

115-
You can then open: http://localhost:8080/auth/admin and login with admin:admin.
115+
You can then open: http://localhost:8080/admin and login with admin:admin.
116116

117117

118118
### Importing example realms

0 commit comments

Comments
 (0)