mozilla-django-oidc with keycloak on django 3 - django

Question

I'm trying to connect Django (3.2) with Keycloak (12.0.2) using mozilla-django-oidc (1.2.4).
I'm getting the redirection to keycloak when clicking on the Login button (which is using oidc_authentication_init view as per documentation), but after successful login I'm getting this error:
Exception Type: HTTPError at /oidc/callback/
Exception Value: 404 Client Error: Not Found for url: http://localhost:8080/auth/realms/mycorp/protocol/openid-connect/token
Relevant settings for django settings are:
settings.py
INSTALLED_APPS = [
...,
'mozilla_django_oidc',
]
AUTHENTICATION_BACKENDS = (
'django.contrib.auth.backends.ModelBackend',
'mozilla_django_oidc.auth.OIDCAuthenticationBackend',
),
OIDC_AUTH_URI = 'http://localhost:8080/auth/realms/mycorp'
OIDC_CALLBACK_PUBLIC_URI = 'http://localhost'
LOGIN_REDIRECT_URL = OIDC_CALLBACK_PUBLIC_URI
LOGOUT_REDIRECT_URL = OIDC_AUTH_URI + '/protocol/openid-connect/logout?redirect_uri=' + OIDC_CALLBACK_PUBLIC_URI
OIDC_RP_CLIENT_ID = 'django'
OIDC_RP_CLIENT_SECRET = os.environ.get("OIDC_CLIENT_SECRET")
OIDC_RP_SCOPES = 'openid email profile'
# Keycloak-specific (as per http://KEYCLOAK_SERVER/auth/realms/REALM/.well-known/openid-configuration)
OIDC_OP_AUTHORIZATION_ENDPOINT = OIDC_AUTH_URI + '/protocol/openid-connect/auth'
OIDC_OP_TOKEN_ENDPOINT = OIDC_AUTH_URI + '/protocol/openid-connect/token'
OIDC_OP_USER_ENDPOINT = OIDC_AUTH_URI + '/protocol/openid-connect/userinfo'
OIDC_OP_JWKS_ENDPOINT = OIDC_AUTH_URI + '/protocol/openid-connect/certs'
urls.py
urlpatterns = [
...,
path('oidc/', include('mozilla_django_oidc.urls')),
]
And detailed error:
HTTPError at /oidc/callback/
404 Client Error: Not Found for url: http://localhost:8080/auth/realms/mycorp/protocol/openid-connect/token
Request Method: GET
Request URL: http://localhost/oidc/callback/?state=cBtEeSIHNNdsgMBUjPXkq2RwVSSpKsZF&session_state=a5b50fc0-0ec2-4def-8ec8-db1e4a95450f&code=864a2e21-75a7-42d8-8249-e9397be9b64b.a5b50fc0-0ec2-4def-8ec8-db1e4a95450f.2ec7cfbf-b5ee-4f9a-9d4b-012fdc0f9630
Django Version: 3.2
Exception Type: HTTPError
Exception Value:
404 Client Error: Not Found for url: http://localhost:8080/auth/realms/mycorp/protocol/openid-connect/token
Exception Location: /usr/local/lib/python3.8/site-packages/requests/models.py, line 943, in raise_for_status
Python Executable: /usr/local/bin/python
Python Version: 3.8.9
Python Path:
['/home/maat/src',
'/usr/local/bin',
'/usr/local/lib/python38.zip',
'/usr/local/lib/python3.8',
'/usr/local/lib/python3.8/lib-dynload',
'/usr/local/lib/python3.8/site-packages']
Server time: Tue, 27 Apr 2021 19:08:01 +0200
Apparently everything is configured as explained in documentation, but I cannot see the point why it fails...

Answer 1

The 404 wasn't clear enough for me until I realised that the tests were running on docker-compose, so access to localhost wasn't the same as the host.
Running in host network mode or reaching keycloak by its domain name / host IP (see below 172.20.0.1 which is the docker network IP for the host) fixed it:
OIDC_AUTH_URI=http://172.20.0.1:8080/auth/realms/mycorp
OIDC_AUTHENTICATION_CALLBACK_URL=http://localhost/openid/callback
OIDC_CALLBACK_PUBLIC_URI=http://localhost/