OAUTH2 with Keycloak

[bnoh123]

What is a valid value for this propery: SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_AUTH0_REDIRECT_URI ?

When I use Oauth2 it says I need to populate that value but I'm not sure what to put there. I've tried

 SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_AUTH0_REDIRECT_URI: https://my-kafka-url/login
 SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_AUTH0_REDIRECT_URI: https://my-kafka-url/login/oauth2

[Haarolean]

Hey, it should be like this:
redirect-uri: http://localhost:8080/login/oauth2/code/cognito

[bnoh123]

Thanks for replying so fast! Unfortunately, that still did not work for me. I'm currently trying to use Keycloak. When I navigate to the kafka-ui URL, I see a blank page and the browser tab says Please sign in. I can see the redirect to Keycloak to login if i comment out the redirect_uri property however the app complains in the logs that a redirectUri is required. Here are my settings so far:

      AUTH_TYPE: OAUTH2
      SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_AUTH0_CLIENTID: kafka-ui-dev
      SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_AUTH0_CLIENTSECRET: xxxx
      SPRING_SECURITY_OAUTH2_CLIENT_PROVIDER_AUTH0_AUTHORIZATION_URI: https://auth-url/auth/realms/realm/protocol/openid-connect/auth
      SPRING_SECURITY_OAUTH2_CLIENT_PROVIDER_AUTH0_TOKEN_URI: https://auth-url/auth/realms/realm/protocol/openid-connect/token
      SPRING_SECURITY_OAUTH2_CLIENT_PROVIDER_AUTH0_USER_INFO_URI: https://auth-url/auth/realms/realm/protocol/openid-connect/userinfo
      SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_AUTH0_REDIRECT_URI: https://kafka-url/login/oauth2/code/cognito
      SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_AUTH0_SCOPE: openid
      SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_AUTH0_AUTHORIZATION_GRANT_TYPE: implicit

[bnoh123]

using SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_AUTH0_REDIRECT_URI: https://kafka-url/login/oauth2/code/keycloak does not work =(

[bnoh123]

These are the values that worked for me when connecting to Keycloak using the helm chart to deploy to kubernetes.

Replace the following values with urs:

keycloak-url
kafka-ui-url
realm = ur keycloak realm
broker-url:port

// not required for SSO
schema-registry-url

What my override values for the helm chart looked like
I tried using keycloak as the auth code but it didnt seem to registr the client id correctly so i stuck with AUTH0.
The following variables also need to be set but are not listed below since they are secrets:

SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_AUTH0_CLIENTSECRET

// Only needed for SSL Kafka clusters
KAFKA_CLUSTERS_0_PROPERTIES_SSL_KEYSTORE_PASSWORD
KAFKA_CLUSTERS_0_PROPERTIES_SSL_TRUSTSTORE_PASSWORD


// Override values

envs:
  config:
      KAFKA_CLUSTERS_0_NAME: kafka-ui-client
      KAFKA_CLUSTERS_0_PROPERTIES_SECURITY_PROTOCOL: SSL
      KAFKA_CLUSTERS_0_BOOTSTRAPSERVERS: "broker-url:port,broker-2-url:port"
      KAFKA_CLUSTERS_0_ZOOKEEPER: zookeeper0:2181
      KAFKA_CLUSTERS_0_PROPERTIES_SSL_TRUSTSTORE_LOCATION: /kafka.truststore.jks
      KAFKA_CLUSTERS_0_PROPERTIES_SSL_KEYSTORE_LOCATION: /kafka.keystore.jks
      KAFKA_CLUSTERS_0_SCHEMA_REGISTRY: "https://schema-registry-url"
      AUTH_TYPE: OAUTH2
      SECURITY_BASIC_ENABLED: "true"
      SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_AUTH0_CLIENTID: kafka-ui-dev
      SPRING_SECURITY_OAUTH2_CLIENT_PROVIDER_AUTH0_AUTHORIZATION_URI: https://keycloak-url/auth/realms/realm/protocol/openid-connect/auth
      SPRING_SECURITY_OAUTH2_CLIENT_PROVIDER_AUTH0_TOKEN_URI: https://keycloak-url/auth/realms/realm/protocol/openid-connect/token
      SPRING_SECURITY_OAUTH2_CLIENT_PROVIDER_AUTH0_USER_INFO_URI: https://keycloak-url/auth/realms/realm/protocol/openid-connect/userinfo
      SPRING_SECURITY_OAUTH2_CLIENT_PROVIDER_AUTH0_USER_NAME_ATTRIBUTE: preferred_username
      SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_AUTH0_REDIRECT_URI: https://kafka-ui-url/login/oauth2/code/auth0
      SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_AUTH0_SCOPE: openid,email,groups,profile
      SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_AUTH0_AUTHORIZATION_GRANT_TYPE: "authorization_code"
      SPRING_SECURITY_OAUTH2_CLIENT_PROVIDER_AUTH0_JWK_SET_URI: https://keycloak-url/auth/realms/realm/protocol/openid-connect/certs

[Haarolean]

@bnoh123 hey, have you been able to get it working with keycloak? I've done a test setup locally and can share the config if you need it.

[Prasannavenkatesh2598]

could you please share me the redirect uri? i am usin keycloak and when the kafka ui is loading the issuer keycloak uri page, it shows redirect uri as invalid parameter

[Haarolean]

@Prasannavenkatesh2598 do you run in k8s? you can view the url in the browser's dev console's network tab, there might be a protocol mismatch (http/https).