Openidc with Keycloak error uthenticate(): request to the redirect_uri_path but there's no session state found, client

Question

I am using Openresty as a server. I have the configuration file of the nginx as per the https://eclipsesource.com/blogs/2018/01/11/authenticating-reverse-proxy-with-keycloak/.

I am getting following error "openidc.lua:1053: authenticate(): request to the redirect_uri_path but there's no session state found, client"

Can someone throw some light and try to solve the problem.

Regards, Allahbaksh

Companion

Were you able to resolve this? I have same issue. – Bret

Answer 1

Your redirect URI must not be set to "/" but to some arbitrary path that is not supposed to return content (like /redirect_uri). It is a "vanity" URL that is handled by lua-resty-openidc

Stocks

Hello @Usman, I have redirect URI as the vanity URL mentioned by you, but still, I am facing the same issue. Configs are the same and keycloak and the server being protected using keycloak are on different domains. Any Suggestions – Bret

@AvikAggarwal where you able to resolve this issue? – Kashakashden

Answer 2

I had the same problem and was able to fix it by setting the $session_name variable in the server block. Example:

server {
  ...
  server_name proxy.localhost;
  #lua_code_cache off;      
  set $session_name nginx_session;
  location / {          
          access_by_lua_block {
            local opts = {
               redirect_uri = "http://proxy.localhost/cb",
               discovery = "http://127.0.0.1:9000/.well-known/openid-configuration",
               client_id = "proxyclient-id",
               client_secret = "secret",
               ssl_verify = "no",
               scope = "openid"
            }
            -- call authenticate for OpenID Connect user authentication
            local res, err = require("resty.openidc").authenticate(opts)

            if err then
              ngx.status = 500
              ngx.say(err)
              ngx.exit(ngx.HTTP_INTERNAL_SERVER_ERROR)
            end

            ngx.req.set_header("X-USER", res.id_token.sub)
          }

          proxy_pass http://localhost:8080/;
          proxy_set_header x-forwarded-proto $scheme;
        }
}

Another thing to pay attention to is the lua_code_cache off directive; It could break the session. See: https://github.com/bungle/lua-resty-session#notes-about-turning-lua-code-cache-off

Earleanearleen