0

My Spring Boot (Jhipster) app using Keycloak authentication is running great locally.

But it needs to run behind nginx and SSL certs on the linux box.

On the linux implementation, Jhipster seems to start normally, getting to load Liquibase for example, but then throws

org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'springSecurityFilterChain' defined in class path resource [org/springframework/security/config/annotation/web/configuration/WebSecurityConfiguration.class]: Bean instantiation via factory method failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [javax.servlet.Filter]: Factory method 'springSecurityFilterChain' threw exception; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'jwtDecoder' defined in class path resource [XXX/config/SecurityConfiguration.class]: Bean instantiation via factory method failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.springframework.security.oauth2.jwt.JwtDecoder]: Factory method 'jwtDecoder' threw exception; nested exception is java.lang.IllegalStateException: com.nimbusds.jose.RemoteKeySourceException: Couldn't retrieve remote JWK set: Connection refused (Connection refused)
at org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:658)
at org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:486)
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateUsingFactoryMethod(AbstractAutowireCapableBeanFactory.java:1352)

I have found many postings about "Couldn't retrieve remote JWK set" but they seem to be about timeout issues, not connection refused.

I believe JHipster must be getting through to Keycloak because if I change

SPRING_SECURITY_OAUTH2_CLIENT_PROVIDER_OIDC_ISSUER_URI 

to something else it complains of the mismatch with where Keycloak really is.

In /etc/hosts is the following, although its presence changes nothing I notice

127.0.0.1 keycloak

SSL and nginx is a difference between the working local and the failing linux implementations.

The nginx sites-enabled/default has

server {
    root /var/www/html;
    index index.html index.htm index.nginx-debian.html;
    server_name XXX; # managed by Certbot
    location / {
            proxy_pass http://localhost:9080 ;
    }
    listen [::]:443 ssl; # managed by Certbot
    listen 443 ssl; # managed by Certbot
    ssl_certificate XXX/fullchain.pem; # managed by Certbot
    ssl_certificate_key XXX/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
}
server {
    if ($host = XXX) {
         return 301 https://$host$request_uri;
    } # managed by Certbot
    listen 80 ;
    listen [::]:80 ;
    server_name XXX;
    return 404; # managed by Certbot
}

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.