Could not get Keycloak's access token

[anon1a7d]

Versions

Jitsi: stable-8960-1
Keycloak: 23.0.4
Keycloak adapter: latest (v20241023)

---

I have set up keycloak-adapter as part of my overall jitsi docker compose. keycloak-adpater is leveraging the local network created (type: bridge) and using the internal hostname. e.g.

## Keycloak Adapter Settings
KEYCLOAK_ORIGIN=https://auth.xyz.org
KEYCLOAK_ORIGIN_INTERNAL=http://jitsi-web-1
KEYCLOAK_REALM=xyz
KEYCLOAK_CLIENT_ID=xyz-meet
JWT_APP_ID=xyz-meet
JWT_APP_SECRET=///MY_SECRET///
ALLOW_UNSECURE_CERT=true

I have the other variables set for Jitsi as defined in the dockerized setup (https://github.com/nordeck/jitsi-keycloak-adapter/blob/main/docs/setup-docker.md).

All the flows seem correct and in place, but I'm stuck in a loop now. When I try to create a meeting, I get redirected to keycloak's login screen. I auth no problems, but I get sent back to the Waiting for a moderator screen again and again and again.

Each time I also see this in the adapter log (DEBUG is true).

Could not get Keycloak's access token

DANGER: TLS certificate validation is disabled for all hostnames
KEYCLOAK_ORIGIN: https://auth.xyz.org
KEYCLOAK_ORIGIN_INTERNAL: http://jitsi-web-1
KEYCLOAK_REALM: xyz
KEYCLOAK_CLIENT_ID: xyz-meet
KEYCLOAK_MODE: query
JWT_ALG: HS256
JWT_HASH: SHA-256
JWT_APP_ID: xyz-meet
JWT_APP_SECRET: *** masked ***
JWT_EXP_SECOND: 3600
HOSTNAME: 0.0.0.0
PORT: 9000
DEBUG: true
Listening on http://0.0.0.0:9000/
oidcRedirectForCode prompt: none
oidcRedirectForCode host: meet.xyz.org
oidcRedirectForCode path: /ElaborateLoansScareSometimes
oidcRedirectForCode sanitized: /ElaborateLoansScareSometimes
oidcRedirectForCode search: 
oidcRedirectForCode hash: 
oidcRedirectForCode bundle: path=%2FElaborateLoansScareSometimes&search=&hash=
oidcRedirectForCode target: https://auth.xyz.org/realms/xyz/protocol/openid-connect/auth?client_id=xyz-meet&response_mode=query&response_type=code&scope=openid&prompt=none&redirect_uri=https://meet.xyz.org/static/oidc-adapter.html?path%3D%252FElaborateLoansScareSometimes%26search%3D%26hash%3D
oidcRedirectForCode prompt: login
oidcRedirectForCode host: meet.xyz.org
oidcRedirectForCode path: /ElaborateLoansScareSometimes
oidcRedirectForCode sanitized: /ElaborateLoansScareSometimes
oidcRedirectForCode search: 
oidcRedirectForCode hash: config.prejoinConfig.enabled=false
oidcRedirectForCode bundle: path=%2FElaborateLoansScareSometimes&search=&hash=config.prejoinConfig.enabled%3Dfalse
oidcRedirectForCode target: https://auth.xyz.org/realms/xyz/protocol/openid-connect/auth?client_id=xyz-meet&response_mode=query&response_type=code&scope=openid&prompt=login&redirect_uri=https://meet.xyz.org/static/oidc-adapter.html?path%3D%252FElaborateLoansScareSometimes%26search%3D%26hash%3Dconfig.prejoinConfig.enabled%253Dfalse
tokenize code: 6646069b-bddb-412b-b420-551066659cf1.c2868118-35f5-41d9-bfce-7f64db9b178d.cec5b733-849a-4b6e-b198-97e14773d104
getToken url: http://jitsi-web-1/realms/xyz/protocol/openid-connect/token
getToken redirectURI: https://meet.xyz.org/static/oidc-adapter.html?path=%2FElaborateLoansScareSometimes&search=&hash=config.prejoinConfig.enabled%3Dfalse
getToken data:
URLSearchParams {
  [Symbol(list)]: [
    [ "client_id", "xyz-meet" ],
    [ "grant_type", "authorization_code" ],
    [
      "redirect_uri",
      "https://meet.xyz.org/static/oidc-adapter.html?path=%2FElaborateLoansScareSometimes&search=&hash=config.prejoinConfig.enabled%3Dfalse"
    ],
    [
      "code",
      "6646069b-bddb-412b-b420-551066659cf1.c2868118-35f5-41d9-bfce-7f64db9b178d.cec5b733-849a-4b6e-b198-97e14773d104"
    ]
  ],
  [Symbol("url object")]: null,
  [Symbol("[[webidl.brand]]")]: Symbol("[[webidl.brand]]")
}
Could not get Keycloak's access token
tokenize code: null
getToken url: http://jitsi-web-1/realms/xyz/protocol/openid-connect/token
getToken redirectURI: https://meet.xyz.org/static/oidc-adapter.html?path=%2FElaborateLoansScareSometimes&search=&hash=config.prejoinConfig.enabled%3Dfalse
getToken data:
URLSearchParams {
  [Symbol(list)]: [
    [ "client_id", "xyz-meet" ],
    [ "grant_type", "authorization_code" ],
    [
      "redirect_uri",
      "https://meet.xyz.org/static/oidc-adapter.html?path=%2FElaborateLoansScareSometimes&search=&hash=config.prejoinConfig.enabled%3Dfalse"
    ],
    [ "code", "null" ]
  ],
  [Symbol("url object")]: null,
  [Symbol("[[webidl.brand]]")]: Symbol("[[webidl.brand]]")
}
Could not get Keycloak's access token

I feel like I'm missing something obvious. Any help would be appreciated. Thanks.

[emrahcom]

Could you try without setting KEYCLOAK_ORIGIN_INTERNAL?

[anon1a7d]

Well dang. That got it. I must have misunderstood the purpose of KEYCLOAK_ORIGIN_INTERNAL. Thank you.

I think initially I had it set up to where my keycloak-adapter node couldn't get to auth.xyz.org, so I went with KEYCLOAK_ORIGIN_INTERNAL since they are on the same internal docker subnet.