iss claim is not valid Keycloak

Question

I'm using Spring Boot, Angular and Keycloak are dockerized in own containers in same network.

The issuer-uri in spring-boot backend is http://keycloak:8080/realms/sales and the iss from decoded JWT token is http://localhost:8082/realms/sales.

Problem: My browser cannot use docker network hostnames. I have to use localhost to access keycloak.

I tried KEYCLOAK_FRONTEND_URL and other env variables, but did not fix my problem.

Anyone know how to make iss on both the same in this scenario?

Answer 1

This is a typical problem when moving from your pc - all localhost services - to dockerized environment.

The best and correct approach is to get a domain name for your keycloak instance and refer to the auth url as https://mykeycloak.something.com so the issuer is always this.

Another approach, but similar is to refer by the IP of the machine, so something like http://192.168.x.x:8082/realms/sales

EDIT: you should not go to production with a machine IP as issuer...