scripts/dev-oidc.sh doesn't work well with keycloak as external-auth
- Dominant language
- No language data
- Stars
- 3
- Forks
- 0
- PR merge metrics
- No merged PRs in 30d
Description
`scripts/dev-oidc.sh` script starts coder with keycloak instance that could be used as an external auth but `external-auth/.*/callback` endpoints are not forwarded to api and hostname is not allowlisted by `site/vite.config.mts` proxy.
#### Reproduction:
1. Set `CODER_EXTERNAL_AUTH` variables to use keycloak:
```
export CODER_EXTERNAL_AUTH_0_TYPE="keycloak"
export CODER_EXTERNAL_AUTH_0_ID="keycloak"
export CODER_EXTERNAL_AUTH_0_CLIENT_ID="coder"
export CODER_EXTERNAL_AUTH_0_CLIENT_SECRET="coder"
export CODER_EXTERNAL_AUTH_0_AUTH_URL="http://127.0.0.1:9080/realms/coder/protocol/openid-connect/auth"
export CODER_EXTERNAL_AUTH_0_TOKEN_URL="http://127.0.0.1:9080/realms/coder/protocol/openid-connect/token"
export CODER_EXTERNAL_AUTH_0_REVOKE_URL="http://127.0.0.1:9080/realms/coder/protocol/openid-connect/revoke"
```
2. Run `scripts/dev-oidc.sh`
3. Logging into keycloak as external auth results in (where "pawel" == hostname):
```
Blocked request. This host ("pawel") is not allowed.
To allow this host, add "pawel" to `server.allowedHosts` in vite.config.js.
```
After extending allowed hosts to include hostname adding external auth causes redirect into 404.
#### What worked for me
Hardcoded hostname in `scripts/dev-oidc.sh` to "127.0.0.1" and added `/external-auth/.*/callback` as proxy-able in `site/vite.config.mts`.
diff below:
```
diff --git a/scripts/dev-oidc.sh b/scripts/dev-oidc.sh
index cf5a7e3c6..c82418ad1 100755
--- a/scripts/dev-oidc.sh
+++ b/scripts/dev-oidc.sh
@@ -86,7 +86,7 @@ timeout 60s bash -c 'until curl -s --fail http://localhost:9080/realms/coder/.we
wait $!
echo '== Starting Coder'
-hostname=$(hostname -f)
+hostname="127.0.0.1"
export CODER_OIDC_ISSUER_URL="http://${hostname}:9080/realms/coder"
export CODER_OIDC_CLIENT_ID=coder
export CODER_OIDC_CLIENT_SECRET=coder
diff --git a/site/vite.config.mts b/site/vite.config.mts
index d2da0a1a9..e2c29ba2f 100644
--- a/site/vite.config.mts
+++ b/site/vite.config.mts
@@ -80,7 +80,7 @@ export default defineConfig({
secure: process.env.NODE_ENV === "production",
rewrite: (path) => path.replace(/\/+/g, "/"),
},
- "/api": {
+ "^(/api|/external-auth/.*/callback)": {
ws: true,
changeOrigin: true,
target: process.env.CODER_HOST || "http://localhost:3000",
```
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.