<p>I have referred a sample hello-world flask app integrated with key-cloak login from <a href="https://gist.github.com/thomasdarimont/145dc9aa857b831ff2eff221b79d179a" rel="noreferrer">https://gist.github.com/thomasdarimont/145dc9aa857b831ff2eff221b79d179a</a></p>
<p>My client-secrets.json is as follows:</p>
<pre><code>{
    &quot;web&quot;: {
        &quot;issuer&quot;: &quot;https://keycloak-keycloak.router.default.svc.cluster.local.167.254.224.26.nip.io/auth/realms/myrealm&quot;,
        &quot;auth_uri&quot;: &quot;https://keycloak-keycloak.router.default.svc.cluster.local.167.254.224.26.nip.io/auth/realms/myrealm/protocol/openid-connect/auth&quot;,
        &quot;client_id&quot;: &quot;myclient&quot;,
        &quot;client_secret&quot;: &quot;****&quot;,
        &quot;redirect_uris&quot;: [
            &quot;https://167.254.224.26:30397/*&quot;
        ],
        &quot;userinfo_uri&quot;: &quot;https://keycloak-keycloak.router.default.svc.cluster.local.167.254.224.26.nip.io/auth/realms/myrealm/protocol/openid-connect/userinfo&quot;,
        &quot;token_uri&quot;: &quot;https://keycloak-keycloak.router.default.svc.cluster.local.167.254.224.26.nip.io/auth/realms/myrealm/protocol/openid-connect/token&quot;,
        &quot;token_introspection_uri&quot;: &quot;https://keycloak-keycloak.router.default.svc.cluster.local.167.254.224.26.nip.io/auth/realms/myrealm/protocol/openid-connect/token/introspect&quot;
    }
}

</code></pre>
<p>When I run <code>python app.py</code> it runs successfully but once I browse the app url and click on login, it takes me to keycloack login page, after I enter my credentials I get the following error</p>
<pre><code>Traceback (most recent call last):
  File &quot;/usr/local/lib/python3.7/site-packages/flask/app.py&quot;, line 2309, in __call__
    return self.wsgi_app(environ, start_response)
  File &quot;/usr/local/lib/python3.7/site-packages/flask/app.py&quot;, line 2295, in wsgi_app
    response = self.handle_exception(e)
  File &quot;/usr/local/lib/python3.7/site-packages/flask/app.py&quot;, line 1741, in handle_exception
    reraise(exc_type, exc_value, tb)
  File &quot;/usr/local/lib/python3.7/site-packages/flask/_compat.py&quot;, line 35, in reraise
    raise value
  File &quot;/usr/local/lib/python3.7/site-packages/flask/app.py&quot;, line 2292, in wsgi_app
    response = self.full_dispatch_request()
  File &quot;/usr/local/lib/python3.7/site-packages/flask/app.py&quot;, line 1815, in full_dispatch_request
    rv = self.handle_user_exception(e)
  File &quot;/usr/local/lib/python3.7/site-packages/flask/app.py&quot;, line 1718, in handle_user_exception
    reraise(exc_type, exc_value, tb)
  File &quot;/usr/local/lib/python3.7/site-packages/flask/_compat.py&quot;, line 35, in reraise
    raise value
  File &quot;/usr/local/lib/python3.7/site-packages/flask/app.py&quot;, line 1813, in full_dispatch_request
    rv = self.dispatch_request()
  File &quot;/usr/local/lib/python3.7/site-packages/flask/app.py&quot;, line 1799, in dispatch_request
    return self.view_functions[rule.endpoint](**req.view_args)
  File &quot;/usr/local/lib/python3.7/site-packages/flask_oidc/__init__.py&quot;, line 657, in _oidc_callback
    plainreturn, data = self._process_callback('destination')
  File &quot;/usr/local/lib/python3.7/site-packages/flask_oidc/__init__.py&quot;, line 689, in _process_callback
    credentials = flow.step2_exchange(code)
  File &quot;/usr/local/lib/python3.7/site-packages/oauth2client/_helpers.py&quot;, line 133, in positional_wrapper
    return wrapped(*args, **kwargs)
  File &quot;/usr/local/lib/python3.7/site-packages/oauth2client/client.py&quot;, line 2054, in step2_exchange
    http, self.token_uri, method='POST', body=body, headers=headers)
  File &quot;/usr/local/lib/python3.7/site-packages/oauth2client/transport.py&quot;, line 282, in request
    connection_type=connection_type)
  File &quot;/usr/local/lib/python3.7/site-packages/httplib2/__init__.py&quot;, line 1994, in request
    cachekey,
  File &quot;/usr/local/lib/python3.7/site-packages/httplib2/__init__.py&quot;, line 1651, in _request
    conn, request_uri, method, body, headers
  File &quot;/usr/local/lib/python3.7/site-packages/httplib2/__init__.py&quot;, line 1557, in _conn_request
    conn.connect()
  File &quot;/usr/local/lib/python3.7/site-packages/httplib2/__init__.py&quot;, line 1326, in connect
    self.sock = self._context.wrap_socket(sock, server_hostname=self.host)
  File &quot;/usr/local/lib/python3.7/ssl.py&quot;, line 423, in wrap_socket
    session=session
  File &quot;/usr/local/lib/python3.7/ssl.py&quot;, line 870, in _create
    self.do_handshake()
  File &quot;/usr/local/lib/python3.7/ssl.py&quot;, line 1139, in do_handshake
    self._sslobj.do_handshake()
ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self signed certificate (_ssl.c:1091)

</code></pre>
<p>I suspected this might be due to my key-cloack server is https and flask app is http and hence I have  have modified the <a href="https://gist.githubusercontent.com/thomasdarimont/145dc9aa857b831ff2eff221b79d179a/raw/a72a9462b2bd693913efba86cbc74f87c043121d/app.py" rel="noreferrer">app.py</a> to be https:</p>
<pre><code>app.run(host='0.0.0.0', port=8000, debug=True, ssl_context='adhoc')
</code></pre>
<p>But even after making the flask app https, the issue remains the same.</p>
<p>Note since im running this application in containers , I have exposed the 8000 port to Nodeport i.e 30397 , hence the app url is : <code>https://167.254.224.26:30397</code></p>

<p>That's a <a href="https://github.com/puiterwijk/flask-oidc/issues/52" rel="nofollow noreferrer">problem of flask-oidc</a>. It uses httplib2, which offers <code>disable_ssl_certificate_validation</code> option to disable ssl/tls cert verification, but unfortunately it is not configurable from the flask-oidc.</p>
<p>The only option is to add CA cert which was used to create TLS cert for <code>https://keycloak-keycloak.router.default.svc.cluster.local.167.254.224.26.nip.io</code> to the httplib2 ca certs:</p>
<pre><code>cat ca-cert.crt &gt;&gt; [path_to_python_libs]/certifi/cacert.pem
</code></pre>
<p>Offtopic: your deployment looks like Kubernetes, so it should be easy to get <code>ca-cert.crt</code> from the cluster and copy it to right place when app is starting.</p>
