# Failed to turn code into token with 401

**URL:** <https://forum.keycloak.org/t/failed-to-turn-code-into-token-with-401/22214>\
**Category:** Configuring the server\
**Tags:** authentication\
**Created:** [May 19, 2023, 4:01pm UTC](https://forum.keycloak.org/t/failed-to-turn-code-into-token-with-401/22214 "2023-05-19T16:01:13Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![skim](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/skim/32/8599_2.png) [@skim](https://forum.keycloak.org/u/skim)\
**Post date:** [May 19, 2023, 4:01pm UTC](https://forum.keycloak.org/t/failed-to-turn-code-into-token-with-401/22214/1 "2023-05-19T16:01:13Z")

</div>

I am trying to get Quarkus Keycloak running for the admin/user management for a tomcat application behind reverse proxy. And opening app on the browser works for accessing Keycloak admin tool and initial login page. However, when logging in with configured user, the application fails with 401

```auto
[https-jsse-nio-8443-exec-8] [] ERROR org.keycloak.adapters.OAuthRequestAuthenticator - failed to turn code into token
        org.apache.http.conn.HttpHostConnectException: Connect to proxyName:443 [proxyName/127.0.0.1] failed: Connection refused (Connection refused)
                at org.apache.http.impl.conn.DefaultHttpClientConnectionOperator.connect(DefaultHttpClientConnectionOperator.java:156) ~[httpclient-4.5.13.jar:4.5.13]
                at org.apache.http.impl.conn.PoolingHttpClientConnectionManager.connect(PoolingHttpClientConnectionManager.java:376) ~[httpclient-4.5.13.jar:4.5.13]
                at org.apache.http.impl.execchain.MainClientExec.establishRoute(MainClientExec.java:393) ~[httpclient-4.5.13.jar:4.5.13]
                at org.apache.http.impl.execchain.MainClientExec.execute(MainClientExec.java:236) ~[httpclient-4.5.13.jar:4.5.13]
                at org.apache.http.impl.execchain.ProtocolExec.execute(ProtocolExec.java:186) ~[httpclient-4.5.13.jar:4.5.13]
                at org.apache.http.impl.execchain.RetryExec.execute(RetryExec.java:89) ~[httpclient-4.5.13.jar:4.5.13]
                at org.apache.http.impl.execchain.RedirectExec.execute(RedirectExec.java:110) ~[httpclient-4.5.13.jar:4.5.13]
                at org.apache.http.impl.client.InternalHttpClient.doExecute(InternalHttpClient.java:185) ~[httpclient-4.5.13.jar:4.5.13]
                at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:83) ~[httpclient-4.5.13.jar:4.5.13]
                at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:108) ~[httpclient-4.5.13.jar:4.5.13]
                at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:56) ~[httpclient-4.5.13.jar:4.5.13]
                at org.keycloak.adapters.ServerRequest.invokeAccessCodeToToken(ServerRequest.java:111) ~[keycloak-adapter-core-19.0.2.jar:19.0.2]
                at org.keycloak.adapters.OAuthRequestAuthenticator.resolveCode(OAuthRequestAuthenticator.java:335) [keycloak-adapter-core-19.0.2.jar:19.0.2]
                at org.keycloak.adapters.OAuthRequestAuthenticator.authenticate(OAuthRequestAuthenticator.java:280) [keycloak-adapter-core-19.0.2.jar:19.0.2]
                at org.keycloak.adapters.RequestAuthenticator.authenticate(RequestAuthenticator.java:138) [keycloak-adapter-core-19.0.2.jar:19.0.2]
                at org.keycloak.adapters.springsecurity.filter.KeycloakAuthenticationProcessingFilter.attemptAuthentication(KeycloakAuthenticationProcessingFilter.java:154) [keycloak-spring-security-adapter-19.0.2.jar:19.0.2]
                ... suppressed 3 lines
                at org.keycloak.adapters.springsecurity.filter.KeycloakPreAuthActionsFilter.doFilter(KeycloakPreAuthActionsFilter.java:96) [keycloak-spring-security-adapter-19.0.2.jar:19.0.2]
                ...
                at org.springframework.boot.web.servlet.support.ErrorPageFilter.doFilter(ErrorPageFilter.java:126) [spring-boot-2.7.11.jar:2.7.11]
                at org.springframework.boot.web.servlet.support.ErrorPageFilter.access$000(ErrorPageFilter.java:64) [spring-boot-2.7.11.jar:2.7.11]
                at org.springframework.boot.web.servlet.support.ErrorPageFilter$1.doFilterInternal(ErrorPageFilter.java:101) [spring-boot-2.7.11.jar:2.7.11]
                ...
                at org.springframework.boot.web.servlet.support.ErrorPageFilter.doFilter(ErrorPageFilter.java:119) [spring-boot-2.7.11.jar:2.7.11]
                ... 
                at org.apache.logging.log4j.web.Log4jServletFilter.doFilter(Log4jServletFilter.java:71) [log4j-web-2.17.1.jar:2.17.1]
                ... suppressed 18 lines
                at java.lang.Thread.run(Thread.java:834) [?:?]
        Caused by: java.net.ConnectException: Connection refused (Connection refused)
                at java.net.PlainSocketImpl.socketConnect(Native Method) ~[?:?]
                at java.net.AbstractPlainSocketImpl.doConnect(AbstractPlainSocketImpl.java:412) ~[?:?]
                at java.net.AbstractPlainSocketImpl.connectToAddress(AbstractPlainSocketImpl.java:255) ~[?:?]
                at java.net.AbstractPlainSocketImpl.connect(AbstractPlainSocketImpl.java:237) ~[?:?]
                at java.net.SocksSocketImpl.connect(SocksSocketImpl.java:392) ~[?:?]
                at java.net.Socket.connect(Socket.java:608) ~[?:?]
                at org.apache.http.conn.ssl.SSLSocketFactory.connectSocket(SSLSocketFactory.java:543) ~[httpclient-4.5.13.jar:4.5.13]
                at org.keycloak.adapters.SniSSLSocketFactory.connectSocket(SniSSLSocketFactory.java:114) ~[keycloak-adapter-core-19.0.2.jar:19.0.2]
                at org.apache.http.impl.conn.DefaultHttpClientConnectionOperator.connect(DefaultHttpClientConnectionOperator.java:142) ~[httpclient-4.5.13.jar:4.5.13]
                ... 87 more

```

With the reverse proxy set along with keycloak :  
keycloak.auth-server-url=[https://proxyName:8443/auth](https://proxyName:8443/auth) \*\*tomcat is running on 8443

**keycloak.conf file has the following configurations related to network:**

http-port=8081  
https-port=8444  
http-relative-path=/auth  
hostname-strict=false  
http-enabled=true  
proxy=edge  
hostname=proxyName

**On tomat server.xml :**  
proxyName=“proxyName” proxyPort=“443”  
hosts file on the tomcat server, added proxyName as one of localhost list along with 127.0.0.1

The reverse proxy is running from nginx and set with the following server set:

```auto
  server {
        listen 443 ssl;
        server_name proxyName;

        ssl_certificate /etc/ssl/certs/my-site.crt;
        ssl_certificate_key /etc/ssl/private/my-site.key;

        location / {
            proxy_pass https://actual_tomcat_serverdomain:8443;
            proxy_http_version 1.1;
            proxy_cache_bypass $http_upgrade;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection keep-alive;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header X-Forwarded-Host $server_name;
            proxy_buffer_size 128k;
            proxy_buffers 4 256k;
            proxy_busy_buffers_size 256k;
        }
    }

```

the following is response from [https://proxyName/auth/realms/master/.well-known/openid-configuration](https://proxyName/auth/realms/master/.well-known/openid-configuration)

```auto

{"issuer":"https://proxyName/auth/realms/master","authorization_endpoint":"https://proxyName/auth/realms/master/protocol/openid-connect/auth","token_endpoint":"https://proxyName/auth/realms/master/protocol/openid-connect/token","introspection_endpoint":"https://proxyName/auth/realms/master/protocol/openid-connect/token/introspect","userinfo_endpoint":"https://proxyName/auth/realms/master/protocol/openid-connect/userinfo","end_session_endpoint":"https://proxyName/auth/realms/master/protocol/openid-connect/logout","frontchannel_logout_session_supported":true,"frontchannel_logout_supported":true,"jwks_uri":"https://proxyName/auth/realms/master/protocol/openid-connect/certs","check_session_iframe":"https://proxyName/auth/realms/master/protocol/openid-connect/login-status-iframe.html","grant_types_supported":["authorization_code","implicit","refresh_token","password","client_credentials","urn:ietf:params:oauth:grant-type:device_code","urn:openid:params:grant-type:ciba"],"acr_values_supported":["0","1"],"response_types_supported":["code","none","id_token","token","id_token token","code id_token","code token","code id_token token"],"subject_types_supported":["public","pairwise"],"id_token_signing_alg_values_supported":["PS384","ES384","RS384","HS256","HS512","ES256","RS256","HS384","ES512","PS256","PS512","RS512"],"id_token_encryption_alg_values_supported":["RSA-OAEP","RSA-OAEP-256","RSA1_5"],"id_token_encryption_enc_values_supported":["A256GCM","A192GCM","A128GCM","A128CBC-HS256","A192CBC-HS384","A256CBC-HS512"],"userinfo_signing_alg_values_supported":["PS384","ES384","RS384","HS256","HS512","ES256","RS256","HS384","ES512","PS256","PS512","RS512","none"],"userinfo_encryption_alg_values_supported":["RSA-OAEP","RSA-OAEP-256","RSA1_5"],"userinfo_encryption_enc_values_supported":["A256GCM","A192GCM","A128GCM","A128CBC-HS256","A192CBC-HS384","A256CBC-HS512"],"request_object_signing_alg_values_supported":["PS384","ES384","RS384","HS256","HS512","ES256","RS256","HS384","ES512","PS256","PS512","RS512","none"],"request_object_encryption_alg_values_supported":["RSA-OAEP","RSA-OAEP-256","RSA1_5"],"request_object_encryption_enc_values_supported":["A256GCM","A192GCM","A128GCM","A128CBC-HS256","A192CBC-HS384","A256CBC-HS512"],"response_modes_supported":["query","fragment","form_post","query.jwt","fragment.jwt","form_post.jwt","jwt"],"registration_endpoint":"https://proxyName/auth/realms/master/clients-registrations/openid-connect","token_endpoint_auth_methods_supported":["private_key_jwt","client_secret_basic","client_secret_post","tls_client_auth","client_secret_jwt"],"token_endpoint_auth_signing_alg_values_supported":["PS384","ES384","RS384","HS256","HS512","ES256","RS256","HS384","ES512","PS256","PS512","RS512"],"introspection_endpoint_auth_methods_supported":["private_key_jwt","client_secret_basic","client_secret_post","tls_client_auth","client_secret_jwt"],"introspection_endpoint_auth_signing_alg_values_supported":["PS384","ES384","RS384","HS256","HS512","ES256","RS256","HS384","ES512","PS256","PS512","RS512"],"authorization_signing_alg_values_supported":["PS384","ES384","RS384","HS256","HS512","ES256","RS256","HS384","ES512","PS256","PS512","RS512"],"authorization_encryption_alg_values_supported":["RSA-OAEP","RSA-OAEP-256","RSA1_5"],"authorization_encryption_enc_values_supported":["A256GCM","A192GCM","A128GCM","A128CBC-HS256","A192CBC-HS384","A256CBC-HS512"],"claims_supported":["aud","sub","iss","auth_time","name","given_name","family_name","preferred_username","email","acr"],"claim_types_supported":["normal"],"claims_parameter_supported":true,"scopes_supported":["openid","acr","profile","offline_access","web-origins","microprofile-jwt","email","roles","address","phone"],"request_parameter_supported":true,"request_uri_parameter_supported":true,"require_request_uri_registration":true,"code_challenge_methods_supported":["plain","S256"],"tls_client_certificate_bound_access_tokens":true,"revocation_endpoint":"https://proxyName/auth/realms/master/protocol/openid-connect/revoke","revocation_endpoint_auth_methods_supported":["private_key_jwt","client_secret_basic","client_secret_post","tls_client_auth","client_secret_jwt"],"revocation_endpoint_auth_signing_alg_values_supported":["PS384","ES384","RS384","HS256","HS512","ES256","RS256","HS384","ES512","PS256","PS512","RS512"],"backchannel_logout_supported":true,"backchannel_logout_session_supported":true,"device_authorization_endpoint":"https://proxyName/auth/realms/master/protocol/openid-connect/auth/device","backchannel_token_delivery_modes_supported":["poll","ping"],"backchannel_authentication_endpoint":"https://proxyName/auth/realms/master/protocol/openid-connect/ext/ciba/auth","backchannel_authentication_request_signing_alg_values_supported":["PS384","ES384","RS384","ES256","RS256","ES512","PS256","PS512","RS512"],"require_pushed_authorization_requests":false,"pushed_authorization_request_endpoint":"https://proxyName/auth/realms/master/protocol/openid-connect/ext/par/request","mtls_endpoint_aliases":{"token_endpoint":"https://proxyName/auth/realms/master/protocol/openid-connect/token","revocation_endpoint":"https://proxyName/auth/realms/master/protocol/openid-connect/revoke","introspection_endpoint":"https://proxyName/auth/realms/master/protocol/openid-connect/token/introspect","device_authorization_endpoint":"https://proxyName/auth/realms/master/protocol/openid-connect/auth/device","registration_endpoint":"https://proxyName/auth/realms/master/clients-registrations/openid-connect","userinfo_endpoint":"https://proxyName/auth/realms/master/protocol/openid-connect/userinfo","pushed_authorization_request_endpoint":"https://proxyName/auth/realms/master/protocol/openid-connect/ext/par/request","backchannel_authentication_endpoint":"https://proxyName/auth/realms/master/protocol/openid-connect/ext/ciba/auth"}}

```