<p><strong>Current flow:</strong></p>

<blockquote>
  <p>incoming request (/sso-kibana) --> Envoy proxy --> /sso-kibana</p>
</blockquote>

<p><strong>Expected flow:</strong></p>

<blockquote>
  <p>incoming request (/sso-kibana) --> Envoy proxy --> keycloak-gatekeeper 
  -->
  keycloak </p>
  
  <p>--> If not logged in --> keycloak loging page --> /sso-kibana</p>
  
  <p>--> If Already logged in --> /sso-kibana</p>
</blockquote>

<p>I deployed keycloak-gatekeeper as a k8s cluster which has the following configuration:</p>

<p><strong>keycloak-gatekeeper.yaml</strong></p>

<pre><code>apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: keycloak-gatekeeper
  name: keycloak-gatekeeper
spec:
  selector:
    matchLabels:
      app: keycloak-gatekeeper
  replicas: 1
  template:
    metadata:
      labels:
        app: keycloak-gatekeeper
    spec:
      containers:
        - image: keycloak/keycloak-gatekeeper
          imagePullPolicy: Always
          name: keycloak-gatekeeper
          ports:
            - containerPort: 3000
          args:
            - "--config=/keycloak-proxy-poc/keycloak-gatekeeper/gatekeeper.yaml"
            - "--enable-logging=true"
            - "--enable-json-logging=true"
            - "--verbose=true"
          volumeMounts:
             -
              mountPath: /keycloak-proxy-poc/keycloak-gatekeeper
              name: secrets
      volumes:
        - name: secrets
          secret:
           secretName: gatekeeper
</code></pre>

<p><strong>gatekeeper.yaml</strong>                                                                             </p>

<pre><code>discovery-url: https://keycloak/auth/realms/MyRealm
enable-default-deny: true
listen: 0.0.0.0:3000
upstream-url: https://kibana.k8s.cluster:5601
client-id: kibana
client-secret: d62e46c3-2a65-4069-b2fc-0ae5884a4952
</code></pre>

<p><strong>Envoy.yaml</strong></p>

<pre><code>- name: kibana
    hosts: [{ socket_address: { address: keycloak-gatekeeper, port_value: 3000}}]
</code></pre>

<p><strong>Problem:</strong>     </p>

<p>I am able to invoke keycloak login on /Kibana but after login user is not going to /Kibana url i.e. Kibana dashboard is not loading.</p>

<p><strong>Note:</strong> Kibana is also running as k8s cluster.</p>

<p><strong>References:</strong><br>
<a href="https://medium.com/@vcorreaniche/securing-serverless-services-in-kubernetes-with-keycloak-gatekeeper-6d07583e7382" rel="nofollow noreferrer">https://medium.com/@vcorreaniche/securing-serverless-services-in-kubernetes-with-keycloak-gatekeeper-6d07583e7382</a>     </p>

<p><a href="https://medium.com/stakater/proxy-injector-enabling-sso-with-keycloak-on-kubernetes-a1012c3d9f8d" rel="nofollow noreferrer">https://medium.com/stakater/proxy-injector-enabling-sso-with-keycloak-on-kubernetes-a1012c3d9f8d</a></p>

<p><strong>Update 1:</strong></p>

<p>I'm able to invoke keycloak login on /sso-kibana but after entering credentials its giving 404. The flow is following:</p>

<p><strong>Step 1.</strong> Clicked on <a href="http://something/sso-kibana" rel="nofollow noreferrer">http://something/sso-kibana</a><br>
<strong>Step 2.</strong> Keycloak login page opens at <a href="https://keycloak/auth/realms/THXiRealm/protocol/openid-connect/auth" rel="nofollow noreferrer">https://keycloak/auth/realms/THXiRealm/protocol/openid-connect/auth</a>?...<br>
<strong>Step 3.</strong> After entering credentials redirected to this URL <a href="https://something/sso-kibana/oauth/callback?state=890cd02c-f" rel="nofollow noreferrer">https://something/sso-kibana/oauth/callback?state=890cd02c-f</a>...<br>
<strong>Step 4.</strong> 404</p>

<p><strong>Update 2:</strong></p>

<p>404 error was solved after I added a new route in Envoy.yaml</p>

<p><strong>Envoy.yaml</strong> </p>

<pre><code>  - match: { prefix: /sso-kibana/oauth/callback }
                route: { prefix_rewrite: "/", cluster: kibana.k8s.cluster }
</code></pre>

<p>Therefore, Expected flow (as shown below) is working fine now.</p>

<blockquote>
  <p>incoming request (/sso-kibana) --> Envoy proxy --> keycloak-gatekeeper
  --> keycloak</p>
  
  <p>--> If not logged in --> keycloak loging page --> /sso-kibana</p>
  
  <p>--> If Already logged in --> /sso-kibana</p>
</blockquote>

<p>In your config you explicitly enabled <code>enable-default-deny</code> which is explained in the documentation as:</p>

<blockquote>
  <p>enables a default denial on all requests, you have to explicitly say what is permitted (recommended)</p>
</blockquote>

<p>With that enabled, you will need to specify urls, methods etc. either via <code>resources</code> entries as shown in [1] or an commandline argument [2]. In case of Kibana, you can start with:</p>

<pre><code>resources:
- uri: /app/*
</code></pre>

<p>[1] <a href="https://www.keycloak.org/docs/latest/securing_apps/index.html#example-usage-and-configuration" rel="nofollow noreferrer">https://www.keycloak.org/docs/latest/securing_apps/index.html#example-usage-and-configuration</a></p>

<p>[2] <a href="https://www.keycloak.org/docs/latest/securing_apps/index.html#http-routing" rel="nofollow noreferrer">https://www.keycloak.org/docs/latest/securing_apps/index.html#http-routing</a></p>
