1

I'm trying to integrate keycloak with Grafana dashboards but when I'm trying to login on grafana via keycloak I'm receiving invalid redirect URL.

keycloack grafana settings

I've added the bellow config on grafana.ini

[auth.generic_oauth]
enabled = true
scopes = openid email profile
name = Keycloak
tls_skip_verify_insecure = true
allow_sign_up = true
client_id = grafana
client_secret = ba342011-3705-483c-8e04-7f95be561cd5
auth_url = http://192.168.101.223:8080/auth/realms/grafana/protocol/openid-connect/auth
token_url = http://192.168.101.223:8080/auth/realms/grafana/protocol/openid-connect/token
api_url = http://192.168.101.223:8080/auth/realms/grafana/protocol/openid-connect/userinfo

url_redirect invalid

Everytime when I am trying to login, this is redirecting to localhost:3000, but I didn't set up this on the keycloak. I found many cases on the google but no luck for my side.

2021-11-02 12:43:06,838 WARN  [org.keycloak.events] (default task-6) type=LOGIN_ERROR, realmId=grafana, clientId=grafana, userId=null, ipAddress=172.18.212.8, error=invalid_redirect_uri, redirect_uri=http://localhost:3000/login/generic_oauth

I want to mention that the Grafana and Keycloak are installed on the same server..

1 Answer 1

2

You have missed the doc https://grafana.com/docs/grafana/latest/auth/generic-oauth/:

You may have to set the root_url option of [server] for the callback URL to be correct. For example in case you are serving Grafana behind a proxy.

You didn't set root URL so incorrect redirect URL is generated http://localhost:3000/login/generic_oauth instead of domain/IP:port, which you have used in the browser. Fix that and it should be fine.

7
  • On grafana.ini I've already added the root_url option like : root_url = 0.0.0.0:3000 but didn't fix the problem Nov 2, 2021 at 19:40
  • @CiocoiuPetrisor root url config must match url in your browser, e.g. http://192.168.101.223:3000 - read URL where you see url_redirect invalid error and you will see which redirect URL was generated by Grafana - that must be that value, which you have configured in the Keycloak client configuration - redirect url
    – Jan Garaj
    Nov 2, 2021 at 19:48
  • I changed the config on keycloak : root_url: 192.168.197.220:3000/login/generic_oauth ; * Valid Redirect URIs : * , but I receive the same redirect : localhost:3000/login/… Nov 3, 2021 at 7:11
  • Please read doc grafana.com/docs/grafana/latest/administration/configuration/… you are still wrong value, in your case it should be root_url = http:// 192.168.197.220:3000/. It it root URL of Grafana config, not a Keycloak root url client config.
    – Jan Garaj
    Nov 3, 2021 at 9:07
  • 2
    Sorry, this is not a chat. You have had a problem with redirect url and that's solved. You should to accept answer and then eventually open new question with reproducible example about another issue. I recommend to read doc grafana.com/docs/grafana/latest/auth/generic-oauth first. root url config was mentioned there, so there will be also solution for many other related problems.
    – Jan Garaj
    Nov 3, 2021 at 9:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.