Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

loadDiscoveryDocument fails without issuer #1432

Open
baxyz opened this issue Aug 22, 2024 · 0 comments
Open

loadDiscoveryDocument fails without issuer #1432

baxyz opened this issue Aug 22, 2024 · 0 comments

Comments

@baxyz
Copy link

baxyz commented Aug 22, 2024

Describe the bug
The loadDiscoveryDocument method raises the error issuer must use HTTPS (with TLS), or config value for property 'requireHttps' must be set to 'false' and allow HTTP (without TLS). when no issuer is specified by default.

My understanding
Context: No issuer provided in the initial config.
When I call authService.loadDiscoveryDocumentAndTryLogin(), loadDiscoveryDocument() is invoked without a parameter (fullUrl), so it:

  1. Concatenates /.well-known/openid-configuration to an empty string
  2. Checks if the URL starts with https
  3. Fails due to an invalid URL

Stackblitz example
sorry, too lazy.

To Reproduce
Steps to reproduce the behavior:

  1. Provide a valid project
  2. Do not specify the issuer
  3. Call authService.loadDiscoveryDocumentAndTryLogin()
  4. See error

Expected behavior
When no issuer is provided, the default URL should be used like http[s]://current-server/.well-known/openid-configuration, and not only the path like /.well-known/openid-configuration.

Desktop (please complete the following information):

  • OS: WSL
  • Browser: Firefox, Edge, Arc, ...
  • Version: 17.0.2

Additional context
I'm using Keycloak on another server with an unpredictable realm (i.e., an unpredictable URL). To solve this issue, we proxy the Keycloak realm .well-known locally to our .well-known endpoint. There is no problem if, after that, the Angular client uses the absolute URL of the Keycloak realm. Because of this, I cannot provide the issuer URL.

I know that I could specify our local server and the issuer will be automatically replaced by the one specified in the discovery document. However, I believe it is a bad practice to set a temporary issuer.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant