title: API Server: Unable to authenticate the request due to an error: invalid bearer token
body: <p>I set up a sample Kubernetes Cluster with 3 master nodes and 2 worker nodes.
  I tried to connect it to an OpenId Provider (in my case Keycloak). But when querying the API I get the following message from kubectl:</p>
  <pre><code>error: You must be logged in to the server (Unauthorized)
  </code></pre>
  <p>or via curl:</p>
  <pre><code>curl -H &quot;Authorization: Bearer $token&quot; -k https://192.168.178.30:6443/api/v1/namespaces/default/pods
  {
    &quot;kind&quot;: &quot;Status&quot;,
    &quot;apiVersion&quot;: &quot;v1&quot;,
    &quot;metadata&quot;: {
      
    },
    &quot;status&quot;: &quot;Failure&quot;,
    &quot;message&quot;: &quot;Unauthorized&quot;,
    &quot;reason&quot;: &quot;Unauthorized&quot;,
    &quot;code&quot;: 401
  }
  </code></pre>
  <p>and in the API server logs it says</p>
  <pre><code>Unable to authenticate the request due to an error: invalid bearer token
  </code></pre>
  <p>According to <a href="https://jwt.io/" rel="nofollow noreferrer">jwt.io</a> my token seems to be valid.</p>
  <h2>Configuration of the API server</h2>
  <p>In the API server I specified the following parameters:</p>
  <pre><code>oidc-issuer-url: https://192.168.178.25:8443/auth/realms/master
  oidc-client-id: account
  oidc-ca-file: /etc/kubernetes/ssl/keycloak-rootCA.pem
  oidc-username-claim: sub
  oidc-groups-claim: groups
  </code></pre>
  <p><em>I had to specify the CA file, because the certificate used for keycloak was a self signed one</em></p>
  <p>The certificate seems to work, because a curl without the CA file results in an error; where specifying the CA file doesn't:</p>
  <pre><code>ansible@node1:~$ curl https://192.168.178.25:8443/auth/realms/master
  curl: (60) SSL certificate problem: unable to get local issuer certificate
  More details here: https://curl.haxx.se/docs/sslcerts.html
  
  curl failed to verify the legitimacy of the server and therefore could not
  establish a secure connection to it. To learn more about this situation and
  how to fix it, please visit the web page mentioned above.
  
  
  ansible@node1:~$ curl --cacert /etc/kubernetes/ssl/keycloak-rootCA.pem https://192.168.178.25:8443/auth/realms/master
  {&quot;realm&quot;:&quot;master&quot;,&quot;public_key&quot;:&quot;...&quot;,&quot;token-service&quot;:&quot;https://192.168.178.25:8443/auth/realms/master/protocol/openid-connect&quot;,&quot;account-service&quot;:&quot;https://192.168.178.25:8443/auth/realms/master/account&quot;,&quot;tokens-not-before&quot;:0}
  </code></pre>
  <h3>JWT Token</h3>
  <p>The payload of my JWT token looks the following:</p>
  <pre><code>{
    &quot;jti&quot;: &quot;455feab7-5828-49f3-9243-a2ce0a1ae6f9&quot;,
    &quot;exp&quot;: 1557246081,
    &quot;nbf&quot;: 0,
    &quot;iat&quot;: 1557246021,
    &quot;iss&quot;: &quot;https://192.168.178.25:8443/auth/realms/master&quot;,
    &quot;aud&quot;: &quot;account&quot;,
    &quot;sub&quot;: &quot;78f9bdc8-d1a4-43c4-ab83-f1b4645519f6&quot;,
    &quot;typ&quot;: &quot;ID&quot;,
    &quot;azp&quot;: &quot;account&quot;,
    &quot;auth_time&quot;: 1557246020,
    &quot;session_state&quot;: &quot;ccafaa62-a888-43dd-9135-1c5a31766e0b&quot;,
    &quot;acr&quot;: &quot;1&quot;,
    &quot;email_verified&quot;: true,
    &quot;name&quot;: &quot;Testuser&quot;,
    &quot;groups&quot;: [
      &quot;group1&quot;,
      &quot;k8s-admin&quot;
    ],
    &quot;preferred_username&quot;: &quot;dummy-username&quot;,
    &quot;given_name&quot;: &quot;Firstname1&quot;,
    &quot;family_name&quot;: &quot;Lastname1&quot;,
    &quot;email&quot;: &quot;me@example.com&quot;
  }
  </code></pre>
  <p>When I try to login with the token of a generated service account (from kubernetes) everything works fine.</p>
  <h2>additional Information</h2>
  <p>The environment was set up via Kubespray and the API server parameters specified in the following way:</p>
  <pre><code>kube_oidc_url: https://192.168.178.25:8443/auth/realms/master
  kube_oidc_client_id: account
  kube_oidc_ca_file: &quot;{{ kube_cert_dir }}/keycloak-rootCA.pem&quot;
  kube_oidc_username_claim: sub
  kube_oidc_groups_claim: groups
  #kube_oidc_username_prefix: &quot;oidc:&quot;
  #kube_oidc_groups_prefix: &quot;oidc:&quot;
  </code></pre>
  <p>Thanks for your help.</p>