Keycloak invalid redirect uri with Couchbase Sync Gateway OpenID Connect Nginx

Question

I am having trouble hooking up OpenID Connect between a Keycloak server and Couchbase Sync Gateway. My setup is as follows: I have an nginx that is providing SSL termination and reverse proxy to Keycloak and Sync Gateway. So my keycloak authentication address is like:

https://auth.domain.com

And my Sync Gateway bucket is at:

https://sg.domain.com/sync_gateway

I have setup a confidential client in keycloak with Authorization Code and the redirect url for it is:

https://sg.domain.com/sync_gateway/_oidc_callback

I am using the built in OpenIDConnectAuthenticator in Couchbase Lite for .NET. When my app takes a user to the Keycloak login page, I am getting:

Invalid parameter: redirect_uri

The login url that is being passed passed to my app is:

https://auth.domain.com/auth/realms/realm/protocol/openid-connect/auth?access_type=offline&client_id=couchbase-sync-gateway&prompt=consent&redirect_uri=http%3A%2F%2Fsg.domain.com%2Fsync_gateway%2F_oidc_callback&response_type=code&scope=openid+email&state=

in which I can see that the redirect_uri is http. It should be https.

My Sync Gateway config is:

{
  "log": ["*"],
  "databases": {
    "sync_gateway": {
      "server": "http://cbserver:8091",
      "bucket": "sync_gateway",
      "users": { "GUEST": { "disabled": true, "admin_channels": ["*"] } },
      "oidc": {
        "providers": {
          "keycloakauthcode": {
            "issuer":"https://auth.domain.com/auth/realms/realm",
            "client_id":"couchbase-sync-gateway",
            "validation_key":"myclientid",
            "register":true
          }
        }
      }
    }
  }
}

My nginx config is:

events {
    worker_connections 768;
    multi_accept on;
}
http {
    proxy_buffer_size 128k;
    proxy_buffers 4 256k;
    proxy_busy_buffers_size 256k;
    large_client_header_buffers  4 32k;        

    upstream auth_backend { 
        server server1:port1;
    }
    upstream cb_sync_gateway { 
        server server2:port2;
    }
    server { # AUTH 

        listen 443 ssl;
        server_name auth.domain.com;

        ssl on;
        ssl_certificate /local/ssl/domain_com.crt;
        ssl_certificate_key /local/ssl/domain_com.key;

        add_header Content-Security-Policy upgrade-insecure-requests;

        location / {
            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto https;

            proxy_pass       http://auth_backend;
        }
    }

    server {
        listen 443 ssl;
        server_name sg.domain.com;

        ssl on;
        ssl_certificate /local/ssl/domain_com.crt;
        ssl_certificate_key /local/ssl/domain_com.key;

        add_header Content-Security-Policy upgrade-insecure-requests;

        location / {
            proxy_http_version 1.1;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto https;

            proxy_pass       http://cb_sync_gateway;
        }
    }
}

Keycloak standalone-ha.xml has proxy setup as per: https://github.com/ak1394/keycloak-dockerfiles

I'm not sure if this is to do with the nginx setup or the keycloak setup.

Any ideas?

Answer 1

I was able to fix this; probably not in the best way but it is working for now. I needed to also set in nginx config:

proxy_redirect http:// https://

and in Keycloak, put the following valid redirect urls:

http://sg.domain.com/sync_gateway/_oidc_callback

If anyone finds a way to do this without having the insecure valid redirect I would be very keen to know as I know this is not recommended.

EDIT:

I have posted in Couchbase Forums and it seems like it could be a bug in Couchbase Mobile (Coucbase Lite or Sync Gateway). They have filed a ticket in Couchbase Lite for .NET.