<p>Im integrating keycloak OAuth login to Grafana in Openshift.</p>
<pre><code>Keycloak Image Version - quay.io/keycloak/keycloak:15.0.2
Grafana Image Version - grafana/grafana:7.1.5
Kubernetes Version -  v1.21
Openshift Version - 4.8
</code></pre>
<p>The keyclaok is exposed at Route: <code>http://keycloak-keycloak.router.default.svc.cluster.local.167.254.203.104.nip.io</code>
The Grafana is exposed at Route: <code>https://grafana.router.default.svc.cluster.local.167.254.203.104.nip.io</code>
The keycloak is created with Realm - <code>devops</code> and client - <code>grafana</code> and these values are added to Grafana deployment as Environmental variable as follows</p>
<pre><code>GF_AUTH_GENERIC_OAUTH_NAME=OAuth
GF_AUTH_GENERIC_OAUTH_ENABLED=true
GF_AUTH_GENERIC_OAUTH_ALLOW_SIGN_UP=true
GF_AUTH_GENERIC_OAUTH_CLIENT_ID=grafana
GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET=33341c00-daf2-4170-a66f-c2c7c23ad151 
GF_AUTH_GENERIC_OAUTH_AUTH_URL=http://keycloak-keycloak.router.default.svc.cluster.local.167.254.203.104.nip.io/auth/realms/devops/protocol/openid-connect/auth
GF_AUTH_GENERIC_OAUTH_TOKEN_URL=http://keycloak-keycloak.router.default.svc.cluster.local.167.254.203.104.nip.io/auth/realms/devops/protocol/openid-connect/token
GF_AUTH_GENERIC_OAUTH_API_URL=http://keycloak-keycloak.router.default.svc.cluster.local.167.254.203.104.nip.io/auth/realms/devops/protocol/openid-connect/userinfo
GF_AUTH_GENERIC_OAUTH_TLS_SKIP_VERIFY_INSECURE=true
</code></pre>
<p>With this when I browse the Grafana route and click on <code>Sign in with OAuth</code> I get error in screen - <code>Inavalid Prameter Redirect URI</code>. In the keycloak logs i see error - <code> error=invalid_redirect_uri, redirect_uri=http://localhost:3000/login/generic_oauth</code>.
Its taking <code>localhost:3000</code> as Redirect URI, but i have specified the right redirect URI in client section of keycloak web i.e, : <code>https://grafana.router.default.svc.cluster.local.167.254.203.104.nip.io/*</code>.</p>
<p>While debugging this issue came across a similar issue : <a href="https://github.com/cetic/helm-fadi/issues/39" rel="nofollow noreferrer">https://github.com/cetic/helm-fadi/issues/39</a>.
Hence I have added these two environmental variables to Grafana:</p>
<pre><code>GF_SERVER_DOMAIN=grafana.router.default.svc.cluster.local.167.254.203.104.nip.io
GF_SERVER_HTTP_PORT=80
</code></pre>
<p>This has resulted in pod crashloopbackoff with following error in logs:</p>
<pre><code>t=2021-12-31T11:29:26+0000 lvl=info msg=&quot;HTTP Server Listen&quot; logger=http.server address=[::]:80 protocol=https subUrl=//grafana.router.default.svc.cluster.local.167.254.203.104.nip.io:80 socket=
t=2021-12-31T11:32:53+0000 lvl=info msg=&quot;Shutdown started&quot; logger=server reason=&quot;System signal: terminated&quot;
t=2021-12-31T11:32:53+0000 lvl=info msg=&quot;Stopped Stream Manager&quot;

</code></pre>
<p>Please help me to proceed.</p>

rakesh kotian
<p>It is in the <a href="https://grafana.com/docs/grafana/latest/auth/generic-oauth/" rel="nofollow noreferrer">Grafana documentation</a>:</p>
<blockquote>
<p>You may have to set the root_url option of [server] for the callback URL to be correct.</p>
</blockquote>
<p>So remove <code>GF_SERVER_DOMAIN,GF_SERVER_HTTP_PORT</code> and configure <code>GF_SERVER_ROOT_URL</code> properly (I guess correct value for your setup is <code>https://grafana.router.default.svc.cluster.local.167.254.203.104.nip.io</code>)</p>
<p>Grafana will be able to generate correct redirect URL with this setup.</p>
