Successful Oauth Login Immediately Redirects

[nullmonk]

After successfully getting a login from an OAuth2 authentication server, the security plugin is immediately issuing a redirect back to login. This prevents the user from ever seeing pages despite having a valid AUTHP_SESSION_ID

caddy-1  | {"level":"debug","ts":1706948842.724188,"logger":"security","msg":"decoded claims from OAuth 2.0 authorization server access token","request_id":"cd00a88e-52c4-4cde-80b4-dc27028ffe32","claims":{"email":"[email protected]","exp":1706948902,"iat":1706948842,"iss":"https://keycloak.localhost/realms/master","jti":"3fd3becd-e86d-4f4c-9715-771f7178704e","sub":"5dec20e6-fd69-4e85-bb8a-7d5e84897fc6"}}
caddy-1  | {"level":"info","ts":1706948842.724215,"logger":"security","msg":"Successful login","session_id":"svxpPgaTQRaqpQE4c2qcBU1EXmusMmR2wbIs","request_id":"cd00a88e-52c4-4cde-80b4-dc27028ffe32","auth_method":"oauth2","auth_realm":"keycloak","user":{"email":"[email protected]","exp":1706948902,"iat":1706948842,"iss":"https://keycloak.localhost/realms/master","jti":"3fd3becd-e86d-4f4c-9715-771f7178704e","sub":"5dec20e6-fd69-4e85-bb8a-7d5e84897fc6"}}
caddy-1  | {"level":"debug","ts":1706948842.724238,"logger":"security","msg":"user transformation ended","session_id":"svxpPgaTQRaqpQE4c2qcBU1EXmusMmR2wbIs","request_id":"cd00a88e-52c4-4cde-80b4-dc27028ffe32","user":{"addr":"172.18.0.1","email":"[email protected]","exp":1706952442,"iat":1706948842,"iss":"https://auth.localhost/oauth2/keycloak/","jti":"svxpPgaTQRaqpQE4c2qcBU1EXmusMmR2wbIs","nbf":1706948782000,"origin":"keycloak","realm":"keycloak","roles":["authp/user"],"sub":"5dec20e6-fd69-4e85-bb8a-7d5e84897fc6"}}
caddy-1  | {"level":"info","ts":1706948842.7243025,"logger":"security","msg":"Successful login","session_id":"svxpPgaTQRaqpQE4c2qcBU1EXmusMmR2wbIs","request_id":"cd00a88e-52c4-4cde-80b4-dc27028ffe32","backend":{"name":"keycloak","realm":"keycloak","method":"oauth"},"user":{"addr":"172.18.0.1","email":"[email protected]","exp":1706952442,"iat":1706948842,"iss":"https://auth.localhost/oauth2/keycloak/","jti":"svxpPgaTQRaqpQE4c2qcBU1EXmusMmR2wbIs","nbf":1706948782000,"origin":"keycloak","realm":"keycloak","roles":["authp/user"],"sub":"5dec20e6-fd69-4e85-bb8a-7d5e84897fc6"}}
caddy-1  | {"level":"debug","ts":1706948842.7278128,"logger":"security","msg":"Redirect served","session_id":"xotKDNpvd5QpjsnGgkylffEt3oY3ADNJarnhebO","request_id":"b8be8999-7b36-4436-bc90-d9b5152ca198","redirect_url":"https://auth.localhost/login","status_code":302}

{
	debug
	order authenticate before respond
	order authorize before basicauth
	security {
		oauth identity provider keycloak {
			driver generic
			realm keycloak
			client_id caddy
			client_secret 0ke2N2HmGSyaXCBHQErO1SqKHHY7b6fR
			scopes openid profile email
			metadata_url http://keycloak:8080/realms/master/.well-known/openid-configuration
            delay_start 2
		}

		authentication portal myportal {
			crypto default token lifetime 3600
			crypto key sign-verify secretsecret
			enable identity provider keycloak
			cookie domain localhost
			ui {
				links {
					"My Identity" "/whoami" icon "las la-user"
				}
			}
			transform user {
				match origin keycloak
				action add role authp/user
			}
		}

		authorization policy mypolicy {
			set auth url https://auth.localhost/
			allow roles authp/admin authp/user
			crypto key verify secretsecret
		}
	}
}

keycloak.localhost {
    reverse_proxy http://keycloak:8080
}

auth.localhost {
	authenticate with myportal
}

localhost {
    authorize with mypolicy
    respond "Hello World"
}

version: "3"
services:
  keycloak:
    ports:
      - 8080:8080
    environment:
      - KEYCLOAK_ADMIN=admin
      - KEYCLOAK_ADMIN_PASSWORD=admin
      - PROXY_ADDRESS_FORWARDING=true
      - KC_PROXY=edge
      - KC_HOSTNAME_URL=https://keycloak.localhost/
    image: quay.io/keycloak/keycloak:23.0.6
    command: start-dev
  caddy:
    image: ghcr.io/authp/authp:beta
    ports:
      - 443:443
    volumes:
      - ./caddy/:/etc/caddy/

[greenpau]

@micahjmartin , that may happen when you use http.

[greenpau]

Also, read up on delayed start in the docs. You may want to add that directive.

[greenpau]

If you do use http, please see cookie insecure directive.

[nullmonk]

@micahjmartin , that may happen when you use http.

There shouldnt be any http requests, setting KC_HOSTNAME_URL overrides all the URLs in openid-configuration to be HTTPS, which are then passed to the browser. I can confirm too that the browser is using HTTPS when it is hitting both keycloak and caddy. The only reason metadata_url is hitting the private route is because the certificates are self-signed by caddy and the client used to collect the metadata_url does not trust the caddy certificate.

Also, read up on delayed start in the docs. You may want to add that directive.

I have a delay_start 2 in my Caddyfile above, sorry the indentation was messed up