title: Keycloak OIDC and AWS ALBs
body: <p>Is there a way to get Keycloak to work as an OIDC Provider for AWS ALBs? </p>
  
  <p>I have tried and tried and I am just getting stuck with 500 Internal Server. </p>
  
  <p>I created a new confidential client and provided the ALB with the clientID and secret as well as the OIDC Urls. I read a few years back about an issue with Bearer vs bearer in the headers, but I couldn't validate that this was the issue, or that it is still an issue with ALBs. </p>
  
  <p>Any help is appreciated.</p>
  
  <p>EDIT: This is my configuration. I have adjusted the URLs to be generic. </p>
  
  <pre><code>AWS -
  Issuer: https://login.example.com/auth/realms/example
  Auth Endpoint: https://login.example.com/auth/realms/example/protocol/openid-connect/auth
  Token Endpoint: https://login.example.com/auth/realms/example/protocol/openid-connect/token
  User info Endpoint: https://login.example.com/auth/realms/example/protocol/openid-connect/userinfo
  Client ID: ExampleApp
  Client secret: supersecret
  </code></pre>
  
  <p><a href="https://i.stack.imgur.com/upnuA.png" rel="nofollow noreferrer">aws_oidc_settings</a></p>
  
  <pre><code>Keycloak -
  Client ID: ExampleApp
  Root URL: https://li.stagingweb.example.com
  Valid Redirect URIs: https://li.stagingweb.example.com/*
  Admin URL: https://li.stagingweb.example.com
  Web Origins: https://li.stagingweb.example.com/*
  </code></pre>
  
  <p><a href="https://i.stack.imgur.com/vNfQl.png" rel="nofollow noreferrer">keycloak_client_settings</a>
  <a href="https://i.stack.imgur.com/adaX0.png" rel="nofollow noreferrer">keycloak_cred_settings</a></p>
  
  <p>The response I get back from this configuration is just a 500 error. The Load Balancer logs report:</p>
  
  <pre><code>5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.122 Safari/537.36" ECDHE-RSA-AES128-GCM-SHA256 TLSv1.2 -"li.stagingweb.example.com" -1 2020-04-27T18:11:34.497000Z "authenticate" "-" "AuthTokenEpRequestFailed" "-" "-"
  </code></pre>
  
  <p>This is the request that gets the 500 error:</p>
  
  <pre><code>https://li.stagingweb.example.com/oauth2/idpresponse?state=PWISnbHmRCVpxmqyn%2FrKsHdJzbKFnfz5GxhnlCyVdnxRVV%2F9kvj7O0JCjQOuf1DNL08h821PorJGGa3%2F4fzFymulG8sS%2FxhLFQS5gNrpuQyCf9DCzrwFxkIbG3I2sHywK7%2FeDmfYUH6Rej%2FEJ4RQwdjpjm76Z1wycw%2FGjQIRxehaTqNtCS%2FdXhm2oag%2FBnY%2FkuMiB8Q%3D&amp;session_state=3a94a1d6-5e75-491b-a231-e4a1a469e5cb&amp;code=23364bac-92e9-4094-9dc3-19c15eb42e7c.3a94a1d6-5e75-491b-a231-e4a1a469e5cb.9723ee49-5bca-4ff6-8a13-f7539b0bc28c
  </code></pre>
  
  <p>Hopefully I didn't post any info I shouldn't have :) </p>