'Can't logout from Keycloak: localhost:80 connection refused

I have:

  • Keycloak running as Docker container (Image: jboss/keycloak:16.1.1)
  • Traefik running (Image: traefik:v2.6.0)
  • a small Realm called demo-realm with one client called demo-client, which is a JEE Application deployed on jboss/wildfly:17.0.1.Final and this WILDFLY Server has the Keycloak Adapter System configured as per documentation.

Traefik rules for Keycloak

"traefik.docker.network": network-kf-LOCAL
  "traefik.http.routers.keycloak.rule": Host(`keycloak.localhost`)
  "traefik.http.routers.keycloak.service": "keycloak-application"
  "traefik.http.services.keycloak-application.loadbalancer.server.port": "8080"

I set the KEYCLOAK_FRONTEND_URL for my Keycloak service in order to make redirect to login page work because frontend request url and backend url are not the same:

  KEYCLOAK_FRONTEND_URL: http://keycloak.localhost/auth

Deployment Configuration in standalone.xml of my client

<secure-deployment name="my-app.war">
        <realm>${env.KEYCLOAK_REALM}</realm>
        <auth-server-url>${env.KEYCLOAK_BASEURL_INTERN}</auth-server-url>
        <resource>${env.KEYCLOAK_CLIENT_ID}</resource>
        <ssl-required>external</ssl-required>
        <public-client>true</public-client>
        <principal-attribute>preferred_username</principal-attribute>
</secure-deployment>

Client Configuration inside Keycloak Admin Dashboard: enter image description here

Note that my client application is also running behind Traefik using the Rule

"traefik.http.routers.traefik.rule": Host(`localhost`) && PathPrefix(`demo`)

so I dont specify a port in the client configuration inside keycloak.

Redirect to Login Screen and authentication already works, so i can enter my credentials and I'm logged in. I just can't logout or end the session. If i try to destroy the session using both the Keycloak Administration Console or URL http://keycloak.localhost/auth/realms/demo-realm/protocol/openid-connect/logout the keycloak service logs the following:

15:22:10,893 INFO  [org.jboss.as] (Controller Boot Thread) WFLYSRV0051: Admin console listening on http://127.0.0.1:9990
2022-02-14T15:23:12.847092400Z 15:23:12,846 WARN  [org.keycloak.connections.httpclient.DefaultHttpClientFactory] (default task-1) TruststoreProvider is disabled
2022-02-14T15:23:12.963517200Z 15:23:12,960 WARN  [org.keycloak.connections.httpclient.DefaultHttpClientFactory] (default task-1) Connect to localhost:80 [localhost/127.0.0.1] failed: Connection refused (Connection refused): org.apache.http.conn.HttpHostConnectException: Connect to localhost:80 [localhost/127.0.0.1] failed: Connection refused (Connection refused)
......
2022-02-14T15:23:12.964548700Z Caused by: java.net.ConnectException: Connection refused (Connection refused)
......
2022-02-14T15:23:12.966559000Z 15:23:12,964 WARN  [org.keycloak.services] (default task-1) KC-SERVICES0057: Logout for client 'demo-client' failed: org.apache.http.conn.HttpHostConnectException: Connect to localhost:80 [localhost/127.0.0.1] failed: Connection refused (Connection refused)

Why It tries to reach localhost:80 ?? Keycloak runs on 8080. I cannot see any port 80 in the configuration of keycloak.



Sources

This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.

Source: Stack Overflow

Solution Source