OIDC redirect not working on non-public backend #977

New Issue

tcassaert · 2021-09-13T12:19:52Z

tcassaert commented

2021-09-13 12:19:52 +00:00

I have the following setup:

The api is available on a private address, let's say backend.internal.example.com.
The frontend is available on vikunja.example.com.
I have OIDC enabled with Keycloak on keycloak.example.com.

When I access the frontend on for example cellular, where I cannot resolve backend.internal.example.com, there is no redirection happening to login with Keycloak.

When I access the frontend from home, it does redirect to Keycloak.

I've enabled CORS for all the URL's above.

Am I doing anything wrong?

Relevant sections config.yml:

---
auth:
  local:
    enabled: false
  openid:
    enabled: true
    providers:
      - name: Keycloak
        authurl: https://keycloak.example.com/auth/realms/******
        clientid: *******
        clientsecret: *********
cors:
  enable: true
  origins:
    - https://keycloak.example.com
    - https://vikunja.example.com
    - https://vikunja-backend.internal.example.com

I have the following setup: * The api is available on a private address, let's say backend.internal.example.com. * The frontend is available on vikunja.example.com. * I have OIDC enabled with Keycloak on keycloak.example.com. When I access the frontend on for example cellular, where I cannot resolve backend.internal.example.com, there is no redirection happening to login with Keycloak. When I access the frontend from home, it does redirect to Keycloak. I've enabled CORS for all the URL's above. Am I doing anything wrong? Relevant sections config.yml: ``` --- auth: local: enabled: false openid: enabled: true providers: - name: Keycloak authurl: https://keycloak.example.com/auth/realms/****** clientid: ******* clientsecret: ********* cors: enable: true origins: - https://keycloak.example.com - https://vikunja.example.com - https://vikunja-backend.internal.example.com ```

konrad commented

2021-09-13 13:05:03 +00:00

I'm wondering, how do you plan to use the api at all from the outside? All requests the frontend makes to the api happen in your browser, that means if your device cannot access the api it won't work at all - not only authentication.

tcassaert commented

2021-09-13 13:49:41 +00:00

Thanks for the fast response!

To be honest, I had not tried that, as I couldn't login with Keycloak.

So the api has to be publicly available for the frontend to work at all?

I just put it on a private URL as I thought that would be a little more secure, to not open up the API to the outside world, and the frontend can reach that internal backend URL anyways. I didn't realize all requests go via the browser.

Thanks for the fast response! To be honest, I had not tried that, as I couldn't login with Keycloak. So the api has to be publicly available for the frontend to work at all? I just put it on a private URL as I thought that would be a little more secure, to not open up the API to the outside world, and the frontend can reach that internal backend URL anyways. I didn't realize all requests go via the browser.

konrad commented

2021-09-21 19:31:00 +00:00

So the api has to be publicly available for the frontend to work at all?

Yes, the frontend is running completely in your browser and directly talking to the api in the browser. In theory, you can use the api with other frontends (no other ones exist yet) or with only the desktop app and not a hosted frontend.

Closing as this seems to be a hosting issue, feel free to reopen if that's not the case.

> So the api has to be publicly available for the frontend to work at all? Yes, the frontend is running completely in your browser and directly talking to the api in the browser. In theory, you can use the api with other frontends (no other ones exist yet) or with only the desktop app and not a hosted frontend. Closing as this seems to be a hosting issue, feel free to reopen if that's not the case.

konrad closed this issue

2021-09-21 19:31:00 +00:00

konrad referenced this issue from a commit

2024-02-07 14:00:29 +00:00

fix(deps): update dependency marked to v4.0.1 (#977)

Sign in to join this conversation.