<p>I have a Problem with KeyCloak 19.0.1 deployed in Kubernetes as custom docker image (build by me) and Spring Boot client application. I see in my app logs:</p>
<pre><code>o.k.adapters.OAuthRequestAuthenticator   : failed verification of token: Invalid token issuer. Expected 'http://auth.example.com/realms/MyRealm', but was 'https://auth.example.com/realms/MyRealm'
</code></pre>
<p>My application is accessible via <code>https://example.com</code>, the KeyCloak is accessible via <code>https://auth.example.com</code>. All pods are behind Ingress Nginx. I set the ingress to detect correct client IP (by setting:  <code>controller.service.externalTrafficPolicy=Local</code>). If I'm trying to login to admin console with bad credentials I see in KeyCloak logs my public IP:</p>
<pre><code>WARN  [org.keycloak.events] (executor-thread-68) type=LOGIN_ERROR, realmId=dbb1ee57-XXXX, clientId=security-admin-console, userId=null, ipAddress=165.225.XX.XX, error=user_not_found, auth_method=openid-connect, auth_type=code, redirect_uri=https://auth.example.com/admin/master/console/#/MyRealm/realm-settings/general, code_id=d905f971-5638-40e0-8460-73df72e68398, username=xxxx, authSessionParentId=d905f971-XXXX, authSessionTabId=2VFrXXXXXX
</code></pre>
<p>Also <code>https://auth.example.com/realms/master/.well-known/openid-configuration</code> returns the whole configuration and each URI uses <code>https://</code> instead of <code>http://</code>.</p>
<p>Configuration of KeyCloak pod (other ENVs like DB connection cutted out):</p>
<pre><code>env:
  - name: KC_HOSTNAME
    value: &quot;auth.example.com&quot;    // to override default for local development, without it something else didn't work
  - name: KC_HOSTNAME_URL
    value: &quot;https://auth.example.com&quot;
  - name: KC_PROXY
    value: edge
</code></pre>
<p>Start arguments passed to KeyCloak container: <code>start-dev --http-port 8080 --http-enabled true --hostname-strict false</code>.</p>
<p>Conf of Spring Boot (comunication between spring backend and KeyCloak inside the cluster):</p>
<pre><code>env:
  - name: KEYCLOAK_AUTHSERVERURL
  value: http://gap-got-chart-keycloak-svc:8080
</code></pre>
<p>Defaults in application.yaml:</p>
<pre><code>keycloak:
  auth-server-url: http://localhost:8081
  realm: MyRealm
  resource: my-app-id
  public-client: true
  principal-attribute: preferred_username
</code></pre>
<p>Any idea what is missconfigured?</p>

Marcin Stachniuk
<p>The workaound is to use the public DNS of the KeyCloak server:</p>
<pre><code>env:
  - name: KEYCLOAK_AUTHSERVERURL
  value: https://auth.example.com
</code></pre>
