My Spring Boot (Jhipster) app using Keycloak authentication is running great locally.
But it needs to run behind nginx and SSL certs on the linux box.
On the linux implementation, Jhipster seems to start normally, getting to load Liquibase for example, but then throws
org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'springSecurityFilterChain' defined in class path resource [org/springframework/security/config/annotation/web/configuration/WebSecurityConfiguration.class]: Bean instantiation via factory method failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [javax.servlet.Filter]: Factory method 'springSecurityFilterChain' threw exception; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'jwtDecoder' defined in class path resource [XXX/config/SecurityConfiguration.class]: Bean instantiation via factory method failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.springframework.security.oauth2.jwt.JwtDecoder]: Factory method 'jwtDecoder' threw exception; nested exception is java.lang.IllegalStateException: com.nimbusds.jose.RemoteKeySourceException: Couldn't retrieve remote JWK set: Connection refused (Connection refused)
at org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:658)
at org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:486)
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateUsingFactoryMethod(AbstractAutowireCapableBeanFactory.java:1352)
I have found many postings about "Couldn't retrieve remote JWK set" but they seem to be about timeout issues, not connection refused.
I believe JHipster must be getting through to Keycloak because if I change
SPRING_SECURITY_OAUTH2_CLIENT_PROVIDER_OIDC_ISSUER_URI
to something else it complains of the mismatch with where Keycloak really is.
In /etc/hosts is the following, although its presence changes nothing I notice
127.0.0.1 keycloak
SSL and nginx is a difference between the working local and the failing linux implementations.
The nginx sites-enabled/default has
server {
root /var/www/html;
index index.html index.htm index.nginx-debian.html;
server_name XXX; # managed by Certbot
location / {
proxy_pass http://localhost:9080 ;
}
listen [::]:443 ssl; # managed by Certbot
listen 443 ssl; # managed by Certbot
ssl_certificate XXX/fullchain.pem; # managed by Certbot
ssl_certificate_key XXX/privkey.pem; # managed by Certbot
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
}
server {
if ($host = XXX) {
return 301 https://$host$request_uri;
} # managed by Certbot
listen 80 ;
listen [::]:80 ;
server_name XXX;
return 404; # managed by Certbot
}