Grafana generic oauth with keycloak

Grafana
1

I have the following configuration in my grafana.ini

#################################### Generic OAuth ##########################
    [auth.generic_oauth]
    enabled =true
    allow_sign_up = true

    #tls_client_cert = /etc/certs/fc340df001078e0e.crt
    #tls_client_key = /etc/certs/lab.c-cor.com.key
    #tls_client_ca = /etc/certs/gd_bundle-g2-g1.crt

    # This is the Grafana client secret in the credentials tab in Keycloak.
    client_id = grafana
    client_secret = secret

    auth_url = https://my.keycloak.domain:31443/auth/realms/TEST/protocol/openid-connect/auth
    token_url = https://my.keycloak.domain:31443/auth/realms/TEST/protocol/openid-connect/token
    api_url = https://my.keycloak.domain:31443/auth/realms/TEST/protocol/openid-connect/userinfo

There are 3 scenarios which I tested

  1. Provide ips instead of domain names for keycloak endpoints, uncomment the tls cert, key and ca lines
    works perfectly well

  2. Provide ips instead of domain names for keycloak endpoints, comment the tls cert, key and ca lines
    works perfectly well

  3. Provide domain names for keycloak endpoints, comment the tls cert, key and ca lines
    Fails with following error -
    Post https://my.keycloak.domain:31443/auth/realms/MDC/protocol/openid-connect/token: x509: certificate is valid for localhost, not my.keycloak.domain"

  4. Provide domain names for keycloak endpoints, uncomment the tls cert, key and ca lines
    Fails with following error -
    Post https://my.keycloak.domain:31443/auth/realms/MDC/protocol/openid-connect/token: x509: certificate is valid for localhost, not my.keycloak.domain"

I am not sure why this is happening, any help is appreciated.

1 Like
2

Your Keycloak needs to use proper TLS certificate created for a domain (Common name - CN): my.keycloak.domain. That is only one option for secure TLS. Currently, TLS is not able to verify TLS connection, because your Keycloak uses localhost certificate.

You are mixing mutual TLS settings (tls_client_*), but you don’t have mutual TLS configured in the Keycloak. You don’t need these settings.

Summary, you need this option:
5.) Provide domain names for keycloak endpoints + configure Keycloak and use TLS cert generated for CN= my.keycloak.domain.