OIDC authentication not working?

[werwuifi]

I am currently running Flipt version 1.25.0 within a Docker container, exposed on port 18080. I have attempted to configure Keycloak as an OIDC provider. However, when I access the application at 'localhost:18080', I am immediately presented with the UI, bypassing any authentication process. My initial expectation was that I would be redirected to a login page as a part of the authentication flow.

Here's my config:

authentication:
  required: true
  methods:
    oidc:
      enabled: true
      providers:
        keycloak:
          issuer_url: http://localhost:9080/realms/myrealm
          client_id: myclient
          client_secret: mysecret
          redirect_address: http://localhost:18080/
          scopes:
            - email
            - profile

[GeorgeMac]

That is very disconcerting to hear @werwuifi !
Let me boot it up and see if I can reproduce that.

[GeorgeMac]

I checked and the client that hits this endpoint is not doing any retries.
We could definitely improve that, though I would also expected restart: always to eventually work too.

[GeorgeMac]

Im being dense; this isn't happening on Flipt startup is it. This is when you attempt to login?
Ignore me haha.

[werwuifi]

Sorry for being unclear :) Yes, the error occurs when I click the login button, all containers start as expected.

[GeorgeMac]

Sorry for the slow reply @werwuifi !

I finally got around to having a play with Flipt and Keycloak and got them working together with the following setup.
Docker compose:

version: "3"

services:
  keycloak:
    image: quay.io/keycloak/keycloak:22.0.4
    command: start-dev
    ports:
      - "8080:8080"
    environment:
      KEYCLOAK_ADMIN: admin
      KEYCLOAK_ADMIN_PASSWORD: admin
    networks:
      - flipt_network

  flipt:
    image: flipt/flipt:latest
    command: ["./flipt", "--force-migrate"]
    ports:
      - "8081:8080"
    volumes:
      - ./config.yaml:/etc/flipt/config/default.yml
    environment:
      - FLIPT_META_TELEMETRY_ENABLED=false
    networks:
      - flipt_network
    restart: always

networks:
  flipt_network:

Flipt configuration:

log:
  level: DEBUG

db:
  url: file:/var/opt/flipt/flipt.db

authentication:
  required: true
  session:
    domain: "localhost:8081"
    secure: false
    csrf:
      key: "abcdef1234567890"
  methods:
    token:
      enabled: true
      cleanup:
         interval: 2h
         grace_period: 48h
    oidc:
      enabled: true
      providers:
        keycloak:
          issuer_url: "http://keycloak:8080/realms/myrealm"
          client_id: "clientid"
          client_secret: "clientsecret"
          redirect_address: "http://localhost:8081"
      cleanup:
         interval: 2h
         grace_period: 48h

I created a realm myrealm and a client clientid and a user to experiment with.
One thing I had to do, to glue it altogether, was to add keyclock to my /etc/hosts:

127.0.0.1 keycloak

(we have to do this in our dex guide too)
Just so that when Flipt redirected my browser it would address it appropriately.

This seemed to work though. I've managed to sign in with a keycloak created user.

[werwuifi]

Thank you very much! I overlooked the configuration related to the /etc/hosts file. Now all is working as expected. Thanks a lot!

[GeorgeMac]

Ahh epic! Thats great to hear. Thanks for bringing it up, this could be a good one for us to add as a guide / example going forward.

[markphelps]

Will add keycloak to list of supported providers in the docs. Thanks @GeorgeMac and @werwuifi