SVI/netbird
1
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-05-14 20:21:59 -04:00
Code Issues 3.0k Packages Projects Releases 10 Wiki Activity

Netbird not working with keycloak #965

New Issue
Closed
opened 2025-11-20 05:20:44 -05:00 by saavagebueno · 3 comments
saavagebueno commented 2025-11-20 05:20:44 -05:00
Owner
Copy Link

Originally created by @sparkycz1 on GitHub (Jun 11, 2024).

Describe the problem

Hello, fresh netbird with Keycloak install is not working. Thanks for any help.

To Reproduce
Just follow the documentation for a new installation of netbird with keycloak.

Expected behavior

To work.

Are you using NetBird Cloud?

self-hosted

NetBird version

0.27.10

Keycloak version

24.0.2

Logs

2024-06-11T08:39:48Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: unable to get https://kcl.XXX.cz/realms/netbird/users/count?, statusCode 404 2024-06-11T08:39:48Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid 2024-06-11T08:39:48Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 9299963: GET /api/users status 401

management.json
{ "Stuns": [ { "Proto": "udp", "URI": "stun:netbird.xxx.cz:3478", "Username": "", "Password": "" } ], "TURNConfig": { "TimeBasedCredentials": false, "CredentialsTTL": "12h0m0s", "Secret": "secret", "Turns": [ { "Proto": "udp", "URI": "turn:netbird.xxx.cz:3478", "Username": "self", "Password": "XXX" } ] }, "Signal": { "Proto": "http", "URI": "netbird.xxx.cz:10000", "Username": "", "Password": "" }, "Datadir": "/var/lib/netbird/", "DataStoreEncryptionKey": "XXX", "HttpConfig": { "LetsEncryptDomain": "", "CertFile": "/etc/letsencrypt/live/netbird.xxx.cz/fullchain.pem", "CertKey": "/etc/letsencrypt/live/netbird.xxx.cz/privkey.pem", "AuthAudience": "netbird-client", "AuthIssuer": "https://kcl.xxx.cz/realms/netbird", "AuthUserIDClaim": "", "AuthKeysLocation": "https://kcl.xxx.cz/realms/netbird/protocol/openid-connect/certs", "OIDCConfigEndpoint": "https://kcl.xxx.cz/realms/netbird/.well-known/openid-configuration", "IdpSignKeyRefreshEnabled": false }, "IdpManagerConfig": { "ManagerType": "keycloak", "ClientConfig": { "Issuer": "https://kcl.xxx.cz/realms/netbird", "TokenEndpoint": "https://kcl.xxx.cz/realms/netbird/protocol/openid-connect/token", "ClientID": "netbird-backend", "ClientSecret": "XXX", "GrantType": "client_credentials" }, "ExtraConfig": { "AdminEndpoint": "https://kcl.xxx.cz/realms/netbird" }, "Auth0ClientCredentials": null, "AzureClientCredentials": null, "KeycloakClientCredentials": null, "ZitadelClientCredentials": null }, "DeviceAuthorizationFlow": { "Provider": "none", "ProviderConfig": { "ClientID": "", "ClientSecret": "", "Domain": "", "Audience": "netbird-client", "TokenEndpoint": "https://kcl.xxx.cz/realms/netbird/protocol/openid-connect/token", "DeviceAuthEndpoint": "https://kcl.xxx.cz/realms/netbird/protocol/openid-connect/auth/device", "AuthorizationEndpoint": "", "Scope": "openid", "UseIDToken": false, "RedirectURLs": null } }, "PKCEAuthorizationFlow": { "ProviderConfig": { "ClientID": "netbird-client", "ClientSecret": "", "Domain": "", "Audience": "netbird-client", "TokenEndpoint": "https://kcl.xxx.cz/realms/netbird/protocol/openid-connect/token", "DeviceAuthEndpoint": "", "AuthorizationEndpoint": "https://kcl.xxx.cz/realms/netbird/protocol/openid-connect/auth", "Scope": "openid profile email offline_access api", "UseIDToken": false, "RedirectURLs": [ "http://localhost:53000" ] } }, "StoreConfig": { "Engine": "sqlite" }, "ReverseProxy": { "TrustedHTTPProxies": [], "TrustedHTTPProxiesCount": 0, "TrustedPeers": [ "0.0.0.0/0" ] } }

Originally created by @sparkycz1 on GitHub (Jun 11, 2024). **Describe the problem** Hello, fresh netbird with Keycloak install is not working. Thanks for any help. **To Reproduce** Just follow the documentation for a new installation of netbird with keycloak. **Expected behavior** To work. **Are you using NetBird Cloud?** self-hosted **NetBird version** `0.27.10` **Keycloak version** `24.0.2` **Logs** ` 2024-06-11T08:39:48Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: unable to get https://kcl.XXX.cz/realms/netbird/users/count?, statusCode 404 2024-06-11T08:39:48Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid 2024-06-11T08:39:48Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 9299963: GET /api/users status 401 ` **management.json** `{ "Stuns": [ { "Proto": "udp", "URI": "stun:netbird.xxx.cz:3478", "Username": "", "Password": "" } ], "TURNConfig": { "TimeBasedCredentials": false, "CredentialsTTL": "12h0m0s", "Secret": "secret", "Turns": [ { "Proto": "udp", "URI": "turn:netbird.xxx.cz:3478", "Username": "self", "Password": "XXX" } ] }, "Signal": { "Proto": "http", "URI": "netbird.xxx.cz:10000", "Username": "", "Password": "" }, "Datadir": "/var/lib/netbird/", "DataStoreEncryptionKey": "XXX", "HttpConfig": { "LetsEncryptDomain": "", "CertFile": "/etc/letsencrypt/live/netbird.xxx.cz/fullchain.pem", "CertKey": "/etc/letsencrypt/live/netbird.xxx.cz/privkey.pem", "AuthAudience": "netbird-client", "AuthIssuer": "https://kcl.xxx.cz/realms/netbird", "AuthUserIDClaim": "", "AuthKeysLocation": "https://kcl.xxx.cz/realms/netbird/protocol/openid-connect/certs", "OIDCConfigEndpoint": "https://kcl.xxx.cz/realms/netbird/.well-known/openid-configuration", "IdpSignKeyRefreshEnabled": false }, "IdpManagerConfig": { "ManagerType": "keycloak", "ClientConfig": { "Issuer": "https://kcl.xxx.cz/realms/netbird", "TokenEndpoint": "https://kcl.xxx.cz/realms/netbird/protocol/openid-connect/token", "ClientID": "netbird-backend", "ClientSecret": "XXX", "GrantType": "client_credentials" }, "ExtraConfig": { "AdminEndpoint": "https://kcl.xxx.cz/realms/netbird" }, "Auth0ClientCredentials": null, "AzureClientCredentials": null, "KeycloakClientCredentials": null, "ZitadelClientCredentials": null }, "DeviceAuthorizationFlow": { "Provider": "none", "ProviderConfig": { "ClientID": "", "ClientSecret": "", "Domain": "", "Audience": "netbird-client", "TokenEndpoint": "https://kcl.xxx.cz/realms/netbird/protocol/openid-connect/token", "DeviceAuthEndpoint": "https://kcl.xxx.cz/realms/netbird/protocol/openid-connect/auth/device", "AuthorizationEndpoint": "", "Scope": "openid", "UseIDToken": false, "RedirectURLs": null } }, "PKCEAuthorizationFlow": { "ProviderConfig": { "ClientID": "netbird-client", "ClientSecret": "", "Domain": "", "Audience": "netbird-client", "TokenEndpoint": "https://kcl.xxx.cz/realms/netbird/protocol/openid-connect/token", "DeviceAuthEndpoint": "", "AuthorizationEndpoint": "https://kcl.xxx.cz/realms/netbird/protocol/openid-connect/auth", "Scope": "openid profile email offline_access api", "UseIDToken": false, "RedirectURLs": [ "http://localhost:53000" ] } }, "StoreConfig": { "Engine": "sqlite" }, "ReverseProxy": { "TrustedHTTPProxies": [], "TrustedHTTPProxiesCount": 0, "TrustedPeers": [ "0.0.0.0/0" ] } }`
saavagebueno added the idpkeycloakself-hosting labels 2025-11-20 05:20:44 -05:00
saavagebueno commented 2025-11-20 05:20:45 -05:00
Author
Owner
Copy Link

@sparkycz1 commented on GitHub (Jun 13, 2024):

So, the problem was in AdminEndpoint. The right one is: https://kcl.xxx.cz/admin/realms/netbird
But after that another problem occured. When i log in with any account, i get to /peers and can not do anything.
2024-06-13T07:14:15Z INFO management/server/account.go:1374: refreshing cache for account cpjv74ae7hsc73cdg9s0 2024-06-13T07:14:16Z WARN management/server/account.go:1247: user c1017785-7ee5-4d2d-97ce-cc487b850419 not found in IDP 2024-06-13T07:14:16Z WARN management/server/account.go:1381: cache for account cpjv74ae7hsc73cdg9s0 reached maximum refresh attempts (2)

@sparkycz1 commented on GitHub (Jun 13, 2024): So, the problem was in AdminEndpoint. The right one is: https://kcl.xxx.cz/admin/realms/netbird But after that another problem occured. When i log in with any account, i get to /peers and can not do anything. `2024-06-13T07:14:15Z INFO management/server/account.go:1374: refreshing cache for account cpjv74ae7hsc73cdg9s0 2024-06-13T07:14:16Z WARN management/server/account.go:1247: user c1017785-7ee5-4d2d-97ce-cc487b850419 not found in IDP 2024-06-13T07:14:16Z WARN management/server/account.go:1381: cache for account cpjv74ae7hsc73cdg9s0 reached maximum refresh attempts (2)`
saavagebueno commented 2025-11-20 05:20:45 -05:00
Author
Owner
Copy Link

@sparkycz1 commented on GitHub (Jun 21, 2024):

So, i have deleted everything and started from scratch with latest version and it is now working 😄

@sparkycz1 commented on GitHub (Jun 21, 2024): So, i have deleted everything and started from scratch with latest version and it is now working :smile:
saavagebueno commented 2025-11-20 05:20:45 -05:00
Author
Owner
Copy Link

@sparkycz1 commented on GitHub (Jun 21, 2024):

Closing.

@sparkycz1 commented on GitHub (Jun 21, 2024): Closing.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
2021 Q4
2022 Q1
2022 Q1
accessibility
acl
agent
agent
Android
Android
api
authentik
automation
azure
battery-usage
bug
cache
client
client-ui
cloud
cloud-only
cloudflare
community
compatibility
config-idp
config-issue
connection
contribution
coturn
cross-vpn
dashboard
data-usage
distribution
dns
docker
documentation
duplicate
enhancement
enhancement
event-stream
feature-request
freebsd
getting-started
go
good first issue
gui
help wanted
home-assistant
idp
inconsistency
integration
integrations
ios
ipv6
jwt
k8s
keycloak
linux
login
macos
management-service
missing-docs
mobile
moved-internal
needs-review
netbird-ui
networking
new-platform
nginx
notification
okta
openwrt
packaging
peer-management
peer-management
peer-management
performance
postgres
posture-checks
psk
pull-request
Mirrored from GitHub Pull Request
 question
refactor
relay
release
rfc
routes
security
security-related
self-hosting
server
signal
sleep-issue
ssh
ssl
status
store
synology
system-compatibility-issue
test-suite
third-party-integration
triage
triage-needed
troubleshooting
UX
waiting-feedback
windows
wontfix
zitadel
No Label idp keycloak self-hosting
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
saavagebueno
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: SVI/netbird#965
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?