title: Configuration for Quarkus and Keycloak on Docker
body: <p>I have the following setup:</p>
  <ul>
  <li>Keycloak running in docker, public interface mapped to 127.0.0.1:8180, internal keycloak-n:8080</li>
  <li>Quarkus running in docker, public interface mapped to 127.0.0.1:8080</li>
  <li>Both run in the same docker network and can communicate</li>
  <li>An external AutzClient (not in docker) that uses the token communicate with quarkus</li>
  </ul>
  <p>Everything works if client and quarkus are outside of Docker and communicate with keycloak via the same interface. As soon as quarkus is in docker, I can't get it to work.</p>
  <p>I've tried many changes so far. On keycloak I set the frontendUrl with <code>/subsystem=keycloak-server/spi=hostname/provider=default:write-attribute(name=properties.frontendUrl=&quot;http://127.0.0.1:8180/auth&quot;</code></p>
  <p>My current quarkus config (oidc part) looks like:</p>
  <pre><code># OIDC Configuration
  quarkus.oidc.auth-server-url=http://keycloak-n:8080/auth/realms/quarkus
  quarkus.oidc.client-id=backend-service
  quarkus.oidc.credentials.secret=85174256-b231-4385-9fa9-257dd0d27bf0
  quarkus.oidc.token.lifespan-grace=20
  quarkus.oidc.introspection-path=.well-known/openid-configuration
  quarkus.oidc.jwks-path=.well-known/jwks.json
  quarkus.oidc.token.issuer=http://127.0.0.1:8180/auth/realms/quarkus
  # Enable Policy Enforcement
  quarkus.keycloak.policy-enforcer.enable=true
  </code></pre>
  <p>If I remove the token issuer, I get from vertx a issuer validation failed. With the current configuration the initial auth works, but than I get a Connection refused (Connection refused) from PolicyEnforcer, because it tries to communicate with 127.0.0.1. Stacktrace is:</p>
  <pre><code>2020-08-03 05:43:27,933 DEBUG [org.apa.htt.imp.con.tsc.ConnPoolByRoute] (executor-thread-1) Releasing connection [{}-&gt;http://keycloak-n:8080][null]
  2020-08-03 05:43:27,933 DEBUG [org.apa.htt.imp.con.tsc.ConnPoolByRoute] (executor-thread-1) Pooling connection [{}-&gt;http://keycloak-n:8080][null]; keep alive indefinitely
  2020-08-03 05:43:27,933 DEBUG [org.apa.htt.imp.con.tsc.ConnPoolByRoute] (executor-thread-1) Notifying no-one, there are no waiting threads
  2020-08-03 05:43:27,944 DEBUG [org.apa.htt.imp.con.tsc.ThreadSafeClientConnManager] (executor-thread-1) Get connection: {}-&gt;http://127.0.0.1:8180, timeout = 0
  2020-08-03 05:43:27,944 DEBUG [org.apa.htt.imp.con.tsc.ConnPoolByRoute] (executor-thread-1) [{}-&gt;http://127.0.0.1:8180] total kept alive: 1, total issued: 0, total allocated: 1 out of 20
  2020-08-03 05:43:27,944 DEBUG [org.apa.htt.imp.con.tsc.ConnPoolByRoute] (executor-thread-1) No free connections [{}-&gt;http://127.0.0.1:8180][null]
  2020-08-03 05:43:27,944 DEBUG [org.apa.htt.imp.con.tsc.ConnPoolByRoute] (executor-thread-1) Available capacity: 20 out of 20 [{}-&gt;http://127.0.0.1:8180][null]
  2020-08-03 05:43:27,944 DEBUG [org.apa.htt.imp.con.tsc.ConnPoolByRoute] (executor-thread-1) Creating new connection [{}-&gt;http://127.0.0.1:8180]
  2020-08-03 05:43:27,944 DEBUG [org.apa.htt.imp.con.DefaultClientConnectionOperator] (executor-thread-1) Connecting to 127.0.0.1:8180
  2020-08-03 05:43:27,945 DEBUG [org.apa.htt.imp.con.DefaultClientConnection] (executor-thread-1) Connection org.apache.http.impl.conn.DefaultClientConnection@6ba49b73 closed
  2020-08-03 05:43:27,946 DEBUG [org.apa.htt.imp.con.DefaultClientConnection] (executor-thread-1) Connection org.apache.http.impl.conn.DefaultClientConnection@6ba49b73 shut down
  2020-08-03 05:43:27,946 DEBUG [org.apa.htt.imp.con.tsc.ThreadSafeClientConnManager] (executor-thread-1) Released connection is not reusable.
  2020-08-03 05:43:27,946 DEBUG [org.apa.htt.imp.con.tsc.ConnPoolByRoute] (executor-thread-1) Releasing connection [{}-&gt;http://127.0.0.1:8180][null]
  2020-08-03 05:43:27,946 DEBUG [org.apa.htt.imp.con.DefaultClientConnection] (executor-thread-1) Connection org.apache.http.impl.conn.DefaultClientConnection@6ba49b73 closed
  2020-08-03 05:43:27,946 DEBUG [org.apa.htt.imp.con.tsc.ConnPoolByRoute] (executor-thread-1) Notifying no-one, there are no waiting threads
  2020-08-03 05:43:27,947 ERROR [org.key.ada.aut.PolicyEnforcer] (executor-thread-1) Could not lazy load resource with path [/hello/find/1] from server: java.lang.RuntimeException: Could not find resource
          at org.keycloak.authorization.client.util.Throwables.retryAndWrapExceptionIfNecessary(Throwables.java:91)
          at org.keycloak.authorization.client.resource.ProtectedResource.find(ProtectedResource.java:232)
          at org.keycloak.authorization.client.resource.ProtectedResource.findByMatchingUri(ProtectedResource.java:291)
          at org.keycloak.adapters.authorization.PolicyEnforcer$PathConfigMatcher.matches(PolicyEnforcer.java:268)
          at org.keycloak.adapters.authorization.AbstractPolicyEnforcer.getPathConfig(AbstractPolicyEnforcer.java:351)
          at org.keycloak.adapters.authorization.AbstractPolicyEnforcer.authorize(AbstractPolicyEnforcer.java:72)
          at io.quarkus.keycloak.pep.runtime.KeycloakPolicyEnforcerAuthorizer.apply(KeycloakPolicyEnforcerAuthorizer.java:45)
          at io.quarkus.keycloak.pep.runtime.KeycloakPolicyEnforcerAuthorizer.apply(KeycloakPolicyEnforcerAuthorizer.java:29)
          at io.quarkus.vertx.http.runtime.security.HttpAuthorizer$1$1$1.run(HttpAuthorizer.java:68)
          at org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35)
          at org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:2046)
          at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1578)
          at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1452)
          at org.jboss.threads.DelegatingRunnable.run(DelegatingRunnable.java:29)
          at org.jboss.threads.ThreadLocalResettingRunnable.run(ThreadLocalResettingRunnable.java:29)
          at java.base/java.lang.Thread.run(Thread.java:834)
          at org.jboss.threads.JBossThread.run(JBossThread.java:479)
  Caused by: java.lang.RuntimeException: Error executing http method [GET]. Response : null
          at org.keycloak.authorization.client.util.HttpMethod.execute(HttpMethod.java:106)
          at org.keycloak.authorization.client.util.HttpMethodResponse$3.execute(HttpMethodResponse.java:68)
          at org.keycloak.authorization.client.resource.ProtectedResource$5.call(ProtectedResource.java:226)
          at org.keycloak.authorization.client.resource.ProtectedResource$5.call(ProtectedResource.java:222)
          at org.keycloak.authorization.client.resource.ProtectedResource.find(ProtectedResource.java:230)
          ... 15 more
  Caused by: java.net.ConnectException: Connection refused (Connection refused)
          at java.base/java.net.PlainSocketImpl.socketConnect(Native Method)
          at java.base/java.net.AbstractPlainSocketImpl.doConnect(AbstractPlainSocketImpl.java:399)
          at java.base/java.net.AbstractPlainSocketImpl.connectToAddress(AbstractPlainSocketImpl.java:242)
          at java.base/java.net.AbstractPlainSocketImpl.connect(AbstractPlainSocketImpl.java:224)
          at java.base/java.net.SocksSocketImpl.connect(SocksSocketImpl.java:403)
          at java.base/java.net.Socket.connect(Socket.java:609)
          at org.apache.http.conn.scheme.PlainSocketFactory.connectSocket(PlainSocketFactory.java:121)
          at org.apache.http.impl.conn.DefaultClientConnectionOperator.openConnection(DefaultClientConnectionOperator.java:180)
          at org.apache.http.impl.conn.AbstractPoolEntry.open(AbstractPoolEntry.java:144)
          at org.apache.http.impl.conn.AbstractPooledConnAdapter.open(AbstractPooledConnAdapter.java:134)
          at org.apache.http.impl.client.DefaultRequestDirector.tryConnect(DefaultRequestDirector.java:605)
          at org.apache.http.impl.client.DefaultRequestDirector.execute(DefaultRequestDirector.java:440)
          at org.apache.http.impl.client.AbstractHttpClient.doExecute(AbstractHttpClient.java:835)
          at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:83)
          at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:108)
          at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:56)
          at org.keycloak.authorization.client.util.HttpMethod.execute(HttpMethod.java:84)
          ... 19 more
  
  2020-08-03 05:43:27,951 DEBUG [org.key.ada.aut.AbstractPolicyEnforcer] (executor-thread-1) Checking permissions for path [http://127.0.0.1:8080/hello/find/1] with config [null].
  2020-08-03 05:43:27,951 DEBUG [org.key.ada.aut.AbstractPolicyEnforcer] (executor-thread-1) Could not find a configuration for path [/hello/find/1]
  </code></pre>
  <p>Is there any real example on how to configure such a scenario? I already tried to set the frontendUrl to the internal address, that actually works for the runtime, but the web frontend is no longer accessible.</p>
  <p><strong>UPDATE:</strong></p>
  <p>From front end code (abbreviated):</p>
  <pre><code>        java.io.InputStream stream = Thread.currentThread().getContextClassLoader()
                  .getResourceAsStream(&quot;META-INF/keycloak.json&quot;);
          auth=AuthzClient.create(stream);
          response = auth.obtainAccessToken(user, password);
          final String accessToken = response.getToken();
  ...
          requestContext.getHeaders().add(HttpHeaders.AUTHORIZATION, AUTH_HEADER_PREFIX + accessToken);
  ...
  
  </code></pre>
  <p>and config in keycloak.json is</p>
  <pre><code>{
    &quot;realm&quot;: &quot;quarkus&quot;,
    &quot;auth-server-url&quot;: &quot;http://localhost:8180/auth/&quot;,
    &quot;ssl-required&quot;: &quot;external&quot;,
    &quot;resource&quot;: &quot;backend-service&quot;,
    &quot;verify-token-audience&quot;: true,
    &quot;credentials&quot;: {
      &quot;secret&quot;: &quot;85174256-b231-4385-9fa9-257dd0d27bf0&quot;
    },
    &quot;confidential-port&quot;: 0,
    &quot;policy-enforcer&quot;: {}
  }
  </code></pre>
  <p>Many thanks</p>