ilmimris / apollofederation-keycloak-demo Goto Github PK

Hi,
Apollo Federation & Keycloack infos are sparse, so thanks for this repo ! 👍

I keep on getting stuck trying to access Playground

I am logging to the realm signin form after a successful redirect from computer1:4000/playground, but i am getting a 'Access Denied'

Logs at the gateway :
Could not obtain grant code: Error: Grant validation failed. Reason: invalid token (wrong audience)

My settings (computer1 being localhost, but i am using an internal domain name)

• Gateway on computer1:4000
• Microservice 1 on computer1:9999
• Keycloack server on othermachine;8180

I did follow your blog (waiting for part 3 and 4), the posts you did on keycloack-graphql-connect github and went through the code on you repo.

Client Settings

- Access Type : Confidential
- Standard Flow ON
- Implicit Flow ON
- Direct Access Grant ON
- Service Account ON
- Authorization ON

Root URL : http://computer1:4000
Valid Redirect URL : *
Base URL : /graphql 
Admin URL : empty
Web Origins : *

OIDC Json

{
  "realm": "app",
  "auth-server-url": "http://othermachine:8180/auth",
  "ssl-required": "external",
  "resource": "gateway",
  "verify-token-audience": true,
  "credentials": {
    "secret": "SECRET"
  },
  "use-resource-role-mappings": true,
  "confidential-port": 0,
  "policy-enforcer": {}
}

i tried with a simple git clone for you repo
I didn't succeed to launch the docker-compose or to import the realm-export.json.
Reading through the realm-export, i created manually the Realm/Client/ClientScope/Roles.

All services are independently fine, but the gateway stills throws an access denied after authentification

I tried your repo (https://github.com/ilmimris/keycloack-apollo-explore.git), works lit a charm with my settings (Keycloack server on 8180)

Do you have some hints for the access denied / wrong audience?

Thks