<p>I am trying to get my kubernetes dashboard authenticated using the keycloak identity provider but getting the invalid bearer token. Here are the details.</p>
<p>For keycloak, i have already setup a client - gatekeeper, user - alice part of group - developers. Also did the mapping of the User attribute 'name' and Group membership attribute 'groups'. I can test the setup successfully using the kubectl command line utility, but unable to succeed through the dashboard.</p>
<p>When i hit the url - kubernetes-dashboard.localdev.me:8081/, i am able to authenticate with keycloak and can load the kubernetes dashboard but i am getting Unauthorized notification and cannot list my resources in the dashboard even though i have provided the required level of permissions using the RBAC to user 'alice'.</p>
<p>Kubernetes cluster</p>
<pre><code>NAME         STATUS   ROLES                  AGE   VERSION   INTERNAL-IP       EXTERNAL-IP   OS-IMAGE             KERNEL-VERSION      CONTAINER-RUNTIME
kubemaster   Ready    control-plane,master   11d   v1.23.1   192.168.122.54    &lt;none&gt;        Ubuntu 20.04.3 LTS   5.11.0-43-generic   docker://20.10.12
kubenode     Ready    &lt;none&gt;                 11d   v1.23.1   192.168.122.198   &lt;none&gt;        Ubuntu 20.04.3 LTS   5.11.0-43-generic   docker://20.10.12
</code></pre>
<p>Ingress controller -</p>
<pre><code>https://kubernetes.github.io/ingress-nginx/
</code></pre>
<p>API server configuration for keycloak IDP</p>
<pre><code>...
    - --oidc-issuer-url=https://kubemaster:8443/auth/realms/local
    - --oidc-client-id=gatekeeper
    - --oidc-username-claim=name
    - --oidc-groups-claim=groups
    - --oidc-ca-file=/etc/kubernetes/ssl/kubemaster.crt
...
</code></pre>
<p>keycloak docker server</p>
<pre><code>version: '3.8'
services:

  keycloak:
    #image: rsk-internal-docker.dkrreg.mmih.biz/risk-keycloak:15.0.1-1
    image: quay.io/keycloak/keycloak:16.1.0
    environment:
      KEYCLOAK_USER: admin
      KEYCLOAK_PASSWORD: admin
      PROXY_ADDRESS_FORWARDING: &quot;true&quot;
    ports:
      - &quot;8080:8080&quot;
      - &quot;8443:8443&quot;
    volumes:
    - &quot;$PWD/tls.key:/etc/x509/https/tls.key&quot;
    - &quot;$PWD/tls.crt:/etc/x509/https/tls.crt&quot;
    - &quot;$PWD/keycloak-latest-db:/opt/jboss/keycloak/standalone/data&quot;
</code></pre>
<p>kubernetes dashboard - the recommended.yml definition file from the kubernetes documentation.</p>
<pre><code>kubectl apply -f https://raw.githubusercontent.com/kubernetes/dashboard/v2.4.0/aio/deploy/recommended.yaml
</code></pre>
<p>gatekeeper oauth proxy</p>
<pre><code>apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    k8s-app: gatekeeper-proxy
  name: gatekeeper-proxy
  namespace: kubernetes-dashboard
spec:
  replicas: 1
  selector:
    matchLabels:
      k8s-app: gatekeeper-proxy
  template:
    metadata:
      labels:
        k8s-app: gatekeeper-proxy
    spec:
      containers:
      - command:
        - /opt/keycloak-gatekeeper
        - --discovery-url=https://192.168.122.54:8443/auth/realms/local
        - --client-id=gatekeeper
        - --client-secret=jZzvJ0wCDDwltV3tAf0SXSbVoKXM1RqV
        - --listen=0.0.0.0:3000
        - --encryption-key=vGcLt8ZUdPX5fXhtLZaPHZkGWHZrT6aa
        - --redirection-url=https://kubernetes-dashboard.localdev.me:8081/
        - --enable-refresh-tokens=true
        - --upstream-url=https://kubernetes-dashboard
        - --skip-openid-provider-tls-verify=true
        - --secure-cookie=false
        image: keycloak/keycloak-gatekeeper:latest
        #image: carlosedp/keycloak-gatekeeper:latest
        imagePullPolicy: Always
        name: gatekeeper-proxy
        ports:
        - containerPort: 3000
          protocol: TCP
          name: http
---

apiVersion: v1
kind: Service
metadata:
  labels:
    k8s-app: gatekeeper-proxy
  name: gatekeeper-proxy
  namespace: kubernetes-dashboard
spec:
  ports:
  - name: http
    port: 3000
    protocol: TCP
    targetPort: 3000
  selector:
    k8s-app: gatekeeper-proxy

---

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    #nginx.ingress.kubernetes.io/auth-url: &quot;https://$host/oauth2/auth&quot;
    #nginx.ingress.kubernetes.io/auth-signin: &quot;https://$host/oauth2/start?rd=$escaped_request_uri&quot;
    #kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/rewrite-target: /
    nginx.ingress.kubernetes.io/proxy-buffer-size: &quot;64k&quot;
    #cert-manager.io/cluster-issuer: ca-issuer
  name: gatekeeper-proxy
  namespace: kubernetes-dashboard
spec:
  ingressClassName: nginx
  rules:
  - host: kubernetes-dashboard.localdev.me
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: gatekeeper-proxy
            port:
              number: 3000
  tls:
  - hosts:
    - kubernetes-dashboard.localdev.me
    secretName: kubernetes-dashboard-ingress-tls
</code></pre>
<p>gatekeeper proxy logs - showing generating and injecting the token</p>
<pre><code>1.641220737766937e+09   info    starting the service    {&quot;prog&quot;: &quot;keycloak-gatekeeper&quot;, &quot;author&quot;: &quot;Keycloak&quot;, &quot;version&quot;: &quot;7.0.0 (git+sha: f66e137, built: 03-09-2019)&quot;}
1.6412207377670407e+09  info    attempting to retrieve configuration discovery url  {&quot;url&quot;: &quot;https://192.168.122.54:8443/auth/realms/local&quot;, &quot;timeout&quot;: &quot;30s&quot;}
1.6412207377766109e+09  info    successfully retrieved openid configuration from the discovery
1.641220737778449e+09   info    enabled reverse proxy mode, upstream url    {&quot;url&quot;: &quot;https://kubernetes-dashboard&quot;}
1.6412207377785714e+09  info    using session cookies only for access and refresh tokens
1.6412207377785907e+09  info    adding a default denial into the protected resources
1.641220737778598e+09   info    protecting resource {&quot;resource&quot;: &quot;uri: /*, methods: DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT,TRACE, required: authentication only&quot;}
1.6412207377788239e+09  info    keycloak proxy service starting {&quot;interface&quot;: &quot;0.0.0.0:3000&quot;}
1.6412207747293563e+09  info    accces token for user has expired, attemping to refresh the token   {&quot;client_ip&quot;: &quot;192.168.1.107:42948&quot;, &quot;email&quot;: &quot;alice@stack.com&quot;}
1.6412207747479768e+09  info    injecting the refreshed access token cookie {&quot;client_ip&quot;: &quot;192.168.1.107:42948&quot;, &quot;cookie_name&quot;: &quot;kc-access&quot;, &quot;email&quot;: &quot;alice@stack.com&quot;, &quot;refresh_expires_in&quot;: 1800, &quot;expires_in&quot;: 299.252029216}
</code></pre>
<p>API server log -</p>
<pre><code>E0103 14:43:23.960726       1 authentication.go:63] &quot;Unable to authenticate the request&quot; err=&quot;invalid bearer token&quot;
E0103 14:43:23.961244       1 authentication.go:63] &quot;Unable to authenticate the request&quot; err=&quot;invalid bearer token&quot;
E0103 14:43:23.962304       1 authentication.go:63] &quot;Unable to authenticate the request&quot; err=&quot;invalid bearer token&quot;
E0103 14:43:23.991455       1 authentication.go:63] &quot;Unable to authenticate the request&quot; err=&quot;invalid bearer token&quot;
E0103 14:43:23.991526       1 authentication.go:63] &quot;Unable to authenticate the request&quot; err=&quot;invalid bearer token&quot;
E0103 14:43:23.991602       1 authentication.go:63] &quot;Unable to authenticate the request&quot; err=&quot;invalid bearer token&quot;
</code></pre>
<p>ClusterRole and ClusterRoleBinding</p>
<pre><code>kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: developer-role
rules:
  - apiGroups: [&quot;&quot;]
    resources: [&quot;namespaces&quot;,&quot;pods&quot;]
    verbs: [&quot;get&quot;, &quot;watch&quot;, &quot;list&quot;]
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: developer-crb
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: developer-role
subjects:
- kind: Group
  name: &quot;developers&quot;
</code></pre>
<p>Please suggest if i am missing anything here. If there is any compatibility issues with versions that i am currently using for kubernetes cluster, keycloak server and gatekeeper proxy server. If there is anyway i can troubleshoot more on this. please suggest.</p>
<p>Thanks
Sudhir</p>

sb9
<p>The image 'keycloak/keycloak-gatekeeper:latest' is no longer being supported and as per the suggestion from the <a href="https://www.keycloak.org/2020/08/sunsetting-louketo-project.adoc" rel="nofollow noreferrer">keycloak portal</a> i have opted for oauth2-proxy as the implemention.</p>
<p>Here is the solution details for kubernetes authentication using oauth2-proxy and keycloak oidc as resolved by self - <a href="https://stackoverflow.com/questions/70584157/unable-to-load-kubernetes-dashboard-after-successful-oauth2/70705961#70705961">Unable to load kubernetes dashboard after successful oauth2</a></p>
