Failed to publish API

[jvaparan]

Hi, I am tasked to create a POC with Apiman against our own Keycloak to our R&D, so I:

• Downloaded & unzipped the Apiman Docker Compose Quickstart 3.1.2 version

• Edited & imported data/apiman-realm-for-keycloak.json to our Keycloak:

  • Hardcoded the environment variables, and removed private & public key parts to be able to import the apiman realm to our Keycloak

• Made these changes:
  .env

  • Changed the hostname
  • Pointed KEYCLOAK_PUBLIC_ENDPOINT & KEYCLOAK_PRIVATE_ENDPOINT to our own Keycloak
  • Changed the passwords to the ones hardcoded in apiman-realm-for-keycloak.json

  docker-compose.yml

  • Removed Keycloak section

  data/conf-es.json

  • Changed "auth-server-url": "${apiman.auth.url:-http://localhost:8085}" to point to our Keycloak

• docker-compose -f docker-compose.setup.yml up && docker-compose up

I can authenticate & access the Apiman through our Keycloak, also install plugins, configure things, but when ever I try to Publish a demo API, with admin or apipublisher user that I created with proper roles in our Keycloak, I get this error, and haven't been able to solve it.

Any help would be greatly appreciated.
error.txt

[msavy]

From a first look, it appears that the Vert.x Apiman Gateway API is unable to reach your Keycloak server (it needs to connect to get some auth information and to validate callers).

When working with Docker Compose, you need careful about external addresses vs external addresses, it can be quite annoying sometimes.

Check that the Vert.x configuration makes sense for your Keycloak server location

[jvaparan]

Keycloak server URL looks like this, with real domain name of course:
https://auth.domain.name.com/auth

[msavy]

Some things to try...

• Modify conf-es.json , scroll down to

"auth-server-url": "${apiman.auth.url:-http://localhost:8085}"

• Just try manually setting it to your keycloak server's URL
• Also, try setting validateIssuer to false to see whether that makes any difference (if so, it might be this bug - Problems with allowedIssuers  #2578)
• Verify the Keycloak endpoint is correct. Keycloak recently changed the default structure of the path and dropped the /auth bit.
  • i.e previously https://auth.domain.name.com/auth is now https://auth.domain.name.com
  • When Keycloak moved to Quarkus this changed, and it has caught many people out - please double check

If you are a support customer, please feel free to email me directly.

[jvaparan]

Our Keycloak is using /auth and URL like this https://auth.domain.name.com/auth/

I've set it up in:
.env
KEYCLOAK_PUBLIC_ENDPOINT=https://auth.domain.name.com/auth/
KEYCLOAK_PRIVATE_ENDPOINT=https://auth.domain.name.com/auth/

data/conf-es.json
"auth-server-url": "https://auth.domain.name.com/auth/",
"validateIssuer": false,

Logs:
apiman-apiman-manager-1 | [org.keycloak.adapters.KeycloakDeployment] (default task-1) Loaded URLs from https://auth.domain.name.com/auth/realms/apiman/.well-known/openid-configuration
...

apiman-apiman-gateway-1 | [ERROR] [vert.x-eventloop-thread-1] KeycloakOAuthFactory - Failure during discovery
apiman-apiman-gateway-1 | io.vertx.core.impl.NoStackTraceThrowable: Not Found:

Resource not found

So, to me it looks like apiman-manager can load the URLs, but apiman-gateway discovery still fails.

[msavy]

You may be hitting the bug mentioned earlier. If you could email me a copy of your config [email protected], I'll try to find time to verify and provide a patch/branch.

[jvaparan]

Sent. Thanks.