'Can't logout from Keycloak: localhost:80 connection refused
I have:
- Keycloak running as Docker container (Image:
jboss/keycloak:16.1.1
) - Traefik running (Image:
traefik:v2.6.0
) - a small Realm called
demo-realm
with one client calleddemo-client
, which is a JEE Application deployed onjboss/wildfly:17.0.1.Final
and this WILDFLY Server has theKeycloak Adapter System
configured as per documentation.
Traefik rules for Keycloak
"traefik.docker.network": network-kf-LOCAL
"traefik.http.routers.keycloak.rule": Host(`keycloak.localhost`)
"traefik.http.routers.keycloak.service": "keycloak-application"
"traefik.http.services.keycloak-application.loadbalancer.server.port": "8080"
I set the KEYCLOAK_FRONTEND_URL
for my Keycloak service in order to make redirect to login page work because frontend request url and backend url are not the same:
KEYCLOAK_FRONTEND_URL: http://keycloak.localhost/auth
Deployment Configuration in standalone.xml
of my client
<secure-deployment name="my-app.war">
<realm>${env.KEYCLOAK_REALM}</realm>
<auth-server-url>${env.KEYCLOAK_BASEURL_INTERN}</auth-server-url>
<resource>${env.KEYCLOAK_CLIENT_ID}</resource>
<ssl-required>external</ssl-required>
<public-client>true</public-client>
<principal-attribute>preferred_username</principal-attribute>
</secure-deployment>
Client Configuration inside Keycloak Admin Dashboard:
Note that my client application is also running behind Traefik
using the Rule
"traefik.http.routers.traefik.rule": Host(`localhost`) && PathPrefix(`demo`)
so I dont specify a port in the client configuration inside keycloak.
Redirect to Login Screen and authentication already works, so i can enter my credentials and I'm logged in. I just can't logout or end the session.
If i try to destroy the session using both the Keycloak Administration Console or URL http://keycloak.localhost/auth/realms/demo-realm/protocol/openid-connect/logout
the keycloak service logs the following:
15:22:10,893 INFO [org.jboss.as] (Controller Boot Thread) WFLYSRV0051: Admin console listening on http://127.0.0.1:9990
2022-02-14T15:23:12.847092400Z 15:23:12,846 WARN [org.keycloak.connections.httpclient.DefaultHttpClientFactory] (default task-1) TruststoreProvider is disabled
2022-02-14T15:23:12.963517200Z 15:23:12,960 WARN [org.keycloak.connections.httpclient.DefaultHttpClientFactory] (default task-1) Connect to localhost:80 [localhost/127.0.0.1] failed: Connection refused (Connection refused): org.apache.http.conn.HttpHostConnectException: Connect to localhost:80 [localhost/127.0.0.1] failed: Connection refused (Connection refused)
......
2022-02-14T15:23:12.964548700Z Caused by: java.net.ConnectException: Connection refused (Connection refused)
......
2022-02-14T15:23:12.966559000Z 15:23:12,964 WARN [org.keycloak.services] (default task-1) KC-SERVICES0057: Logout for client 'demo-client' failed: org.apache.http.conn.HttpHostConnectException: Connect to localhost:80 [localhost/127.0.0.1] failed: Connection refused (Connection refused)
Why It tries to reach localhost:80
?? Keycloak runs on 8080
. I cannot see any port 80 in the configuration of keycloak.
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
Solution | Source |
---|