<p>Has somebody succeeded in setting up OIDC connection to Keycloack in a Quarkus app deployed in a Kubernetes cluster ?
Could you clarify how does the <code>connection-delay</code> (and other related parameters) work ?
(<a href="https://quarkus.io/guides/security-openid-connect" rel="nofollow noreferrer">Here is the documentation</a> I tried to follow)</p>
<p>In our env (Quarkus 1.13.3.Final, Keycloak 12.0.4) we have such config:</p>
<blockquote>
<p>quarkus.oidc.connection-delay: 6M<br />
quarkus.oidc.connection-timeout: 30S<br />
quarkus.oidc.tenant-id: testTenant-01</p>
</blockquote>
<p>And these msgs appear in pod's log when it's being started:</p>
<blockquote>
<p>2021-07-26 14:44:22,523 INFO  [main] [OidcRecorder.java:264] -
Connecting to IDP for up to 180 times every 2 seconds<br />
2021-07-26
14:44:24,142 DEBUG [vert.x-eventloop-thread-1]
[OidcRecorder.java:115] - 'testTenant-01' tenant initialization has failed:
'OpenId Connect Provider configuration metadata is not configured and
can not be discovered'. Access to resources protected by this tenant
will fail with HTTP 401.</p>
</blockquote>
<p>(... following log comes later as the pod is running ...)</p>
<blockquote>
<p>2021-07-27 06:11:54,261 DEBUG [vert.x-eventloop-thread-0]
[DefaultTenantConfigResolver.java:112] - Tenant 'null' is not
initialized<br />
2021-07-27 06:11:54,262 ERROR
[vert.x-eventloop-thread-0] [QuarkusErrorHandler.java:101] - HTTP
Request to /q/health/live failed, error id:
89f83d1d-894c-4fed-9995-0d42d60cec17-2: io.quarkus.oidc.OIDCException:
Tenant configuration has not been resolved    at
io.quarkus.oidc.runtime.OidcAuthenticationMechanism.resolve(OidcAuthenticationMechanism.java:61)
at
io.quarkus.oidc.runtime.OidcAuthenticationMechanism.authenticate(OidcAuthenticationMechanism.java:40)
at
io.quarkus.oidc.runtime.OidcAuthenticationMechanism_ClientProxy.authenticate(OidcAuthenticationMechanism_ClientProxy.zig:189)
at
io.quarkus.vertx.http.runtime.security.HttpAuthenticator.attemptAuthentication(HttpAuthenticator.java:100)
at
io.quarkus.vertx.http.runtime.security.HttpAuthenticator_ClientProxy.attemptAuthentication(HttpAuthenticator_ClientProxy.zig:157)
at
io.quarkus.vertx.http.runtime.security.HttpSecurityRecorder$2.handle(HttpSecurityRecorder.java:101)
at
io.quarkus.vertx.http.runtime.security.HttpSecurityRecorder$2.handle(HttpSecurityRecorder.java:51)
at
io.vertx.ext.web.impl.RouteState.handleContext(RouteState.java:1038)</p>
</blockquote>
<p>Questions:</p>
<ol>
<li>Any way how to find out what metadata are missing ?</li>
<li>Can I somehow change the 2s period between connection attempts ?</li>
<li>Any relation between connection-delay and connection-timeout ?</li>
<li>It failed after cca 2s - does it mean that it fails immediately in the 1st attempt, or has it finished 180 attempts so fast ?</li>
<li>Does <code>DefaultTenantConfigResolver</code> get tenant from different resource than <code>OidcRecorder</code> in initialization, i.e. should tenant be configured at multiple places ?</li>
</ol>

king pong
<p>Finally made it work. Caused by incorrect auth-server-url which <strong>is not clear at all from the log messages</strong>.</p>
<pre><code>quarkus.oidc.client-id: my-app
quarkus.oidc.enabled: true
quarkus.oidc.connection-delay: 6M
quarkus.oidc.connection-timeout: 30S
quarkus.oidc.tenant-id: testTenant-01
quarkus.oidc.auth-server-url: ${keycloak.url}/auth/realms/${quarkus.oidc.tenant-id}
</code></pre>
<p>The URL format is emphasized in <a href="https://quarkus.io/guides/security-openid-connect#quarkus-oidc_quarkus.oidc.auth-server-url" rel="nofollow noreferrer">Quarkus doc</a>: <em>Note if you work with Keycloak OIDC server, make sure the base URL is in the following format: https://host:port/auth/realms/{realm} where {realm} has to be replaced by the name of the Keycloak realm</em></p>
