# Unable to resolve Configuration with the provided Issuer #5

**URL:** <https://forum.keycloak.org/t/unable-to-resolve-configuration-with-the-provided-issuer-5/26529>\
**Category:** Miscellanaeous\
**Tags:** authentication\
**Created:** [June 17, 2024, 5:23pm UTC](https://forum.keycloak.org/t/unable-to-resolve-configuration-with-the-provided-issuer-5/26529 "2024-06-17T17:23:36Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![mohammed-fouzan](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/mohammed-fouzan/32/10681_2.png) [@mohammed-fouzan](https://forum.keycloak.org/u/mohammed-fouzan)\
**Post date:** [June 17, 2024, 5:23pm UTC](https://forum.keycloak.org/t/unable-to-resolve-configuration-with-the-provided-issuer-5/26529/1 "2024-06-17T17:23:36Z")

</div>

I am trying to use Keycloak for oauth while setting up Kafka UI and am facing this error: ‘Unable to resolve Configuration with the provided Issuer of “[http://localhost:9080/realms/myrealm](http://localhost:9080/realms/myrealm)”’ with respect to issuer URI. Keycloak container is running on 9080 and Kafka UI container on 8080, all specified in my docker compose file.

I hit the endpoint on Keycloak localhost:9080/realms/myrealm/.well-known/openid-configuration to verify the issuer URI and have provided the same endpoint in the config.yml, but according to the logs that URI is not resolving!

docker compose.yml:

> * * *
> 
> version: ‘3.8’  
> name: “kafbat-ui-keycloak”
> 
> services:
> 
> kafbat-ui:  
> container\_name: kafbat-rbac  
> image: [Package kafka-ui · GitHub](http://ghcr.io/kafbat/kafka-ui:latest)  
> ports:  
> - 8080:8080  
> environment:  
> SPRING\_CONFIG\_ADDITIONAL-LOCATION: /config.yml  
> volumes:  
> - ./config.yml:/config.yml
> 
> keycloak:  
> image: [Quay](http://quay.io/keycloak/keycloak:25.0.0)  
> ports:  
> - 9080:8080  
> - 8082:8443  
> command: start-dev  
> environment:  
> KC\_LOG\_LEVEL: info  
> KC\_METRICS\_ENABLED: true  
> KC\_HEALTH\_ENABLED: true  
> KEYCLOAK\_ADMIN: admin  
> KEYCLOAK\_ADMIN\_PASSWORD: admin
> 
> ```
> volumes:
> - /keycloak-data:/opt/jboss/keycloak/standalone/data
> 
> ```

config.yml

> * * *
> 
> logging:  
> level:  
> org.springframework.security: TRACE  
> io.kafbat.ui.service.rbac: TRACE
> 
> dynamic.config.enabled: true
> 
> auth:  
> type: OAUTH2  
> oauth2:  
> client:  
> keycloak:  
> clientId: kafbat-ui-client  
> clientSecret: redacted  
> scope: openid,roles  
> client-name: keycloak  
> provider: keycloak  
> redirect-uri: [http://localhost:8080/login/oauth2/code/keycloak](http://localhost:8080/login/oauth2/code/keycloak)  
> authorization-grant-type: authorization\_code  
> issuer-uri: [http://localhost:9080/realms/myrealm](http://localhost:9080/realms/myrealm)  
> user-name-attribute: name  
> custom-params:  
> type: oauth  
> roles-field: groups
> 
> rbac:  
> roles:  
> - name: “admins”  
> clusters:  
> - local  
> subjects:  
> - provider: oauth  
> type: role  
> value: “Admin”
> 
> ```
> permissions:
> - resource: applicationconfig
> actions: all
> 
> - resource: clusterconfig
> actions: all
> 
> - resource: topic
> value: ".*"
> actions: all
> 
> - resource: consumer
> value: ".*"
> actions: all
> 
> - resource: schema
> value: ".*"
> actions: all
> 
> - resource: connect
> value: ".*"
> actions: all
> 
> - resource: ksql
> actions: all
> 
> - resource: acl
> actions: all
> 
> - resource: audit
> actions: all
> - name: "readonly"
> clusters:
> - local
> subjects:
> - provider: oauth
> type: role
> value: "Viewer"
> permissions:
> - resource: clusterconfig
> actions: ["view"]
> 
> - resource: topic
> value: ".*"
> actions:
> - VIEW
> - MESSAGES_READ
> 
> - resource: consumer
> value: ".*"
> actions: [view]
> 
> - resource: schema
> value: ".*"
> actions: [view]
> 
> - resource: connect
> value: ".*"
> actions: [view]
> 
> - resource: acl
> actions: [view]
> 
> ```

---

<div class="post-metadata">

**Author:** ![ThoreKr](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/thorekr/32/7713_2.png) [@ThoreKr](https://forum.keycloak.org/u/ThoreKr)\
**Post date:** [June 17, 2024, 5:41pm UTC](https://forum.keycloak.org/t/unable-to-resolve-configuration-with-the-provided-issuer-5/26529/2 "2024-06-17T17:41:11Z")

</div>

localhost within a container is not the same as localhost on your computer. In order for one container to reach the other you need to use the name of the other container as address.

Alternatively you can use host networking.

---

<div class="post-metadata">

**Author:** ![mohammed-fouzan](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/mohammed-fouzan/32/10681_2.png) [@mohammed-fouzan](https://forum.keycloak.org/u/mohammed-fouzan)\
**Post date:** [June 18, 2024, 8:37am UTC](https://forum.keycloak.org/t/unable-to-resolve-configuration-with-the-provided-issuer-5/26529/3 "2024-06-18T08:37:37Z")

</div>

Is the host supposed to be changed for both issuer and redirect uri? Should i also be changing the host for ‘valid redirect uri’ on keycloak client settings to http://:?

And, how do I access my application via browser, as in what endpoint should I hit - localhost or the url in above format?

Context: Suppose **kafkaui** is container 1 and **keycloak** is container 2.

Update: i have changed the issuer uri to [http://keycloak:9080/realms/myrealm](http://keycloak:9080/realms/myrealm) and still the error persists.

---

<div class="post-metadata">

**Author:** ![ThoreKr](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/thorekr/32/7713_2.png) [@ThoreKr](https://forum.keycloak.org/u/ThoreKr)\
**Post date:** [June 19, 2024, 8:50am UTC](https://forum.keycloak.org/t/unable-to-resolve-configuration-with-the-provided-issuer-5/26529/4 "2024-06-19T08:50:05Z")

</div>

You are mixing the network on your pc with the container network/the one created by compose.

Applications within the compose network are reachable by their name and “native” port, for keycloak this would be 8080, not 9080. The latter is just proxied to the host computers network namespace by docker.

This causes an interesting challenge, as both your browser as well as the application need to be able to reach keycloakn by the same name. Probably the easiest way would be to just use host networking, but then you’ll probably need to ensure the startup ports are unique.

---

<div class="post-metadata">

**Author:** ![mohammed-fouzan](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/mohammed-fouzan/32/10681_2.png) [@mohammed-fouzan](https://forum.keycloak.org/u/mohammed-fouzan)\
**Post date:** [June 19, 2024, 9:33am UTC](https://forum.keycloak.org/t/unable-to-resolve-configuration-with-the-provided-issuer-5/26529/5 "2024-06-19T09:33:53Z")

</div>

Would you suggest anything part from host networking. I tried it and got a ‘Arjuna’ error after providing network mode as ‘host’. I ran on a windows system.

I need to rectify:

1. redirect\_uri (on Keycloak and in the config.yml)
2. issuer\_uri

Based on above context (in previous comments) could you suggest uri’s that would work?

---

<div class="post-metadata">

**Author:** ![ThoreKr](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/thorekr/32/7713_2.png) [@ThoreKr](https://forum.keycloak.org/u/ThoreKr)\
**Post date:** [June 20, 2024, 9:30am UTC](https://forum.keycloak.org/t/unable-to-resolve-configuration-with-the-provided-issuer-5/26529/6 "2024-06-20T09:30:50Z")

</div>

I’m not entirely sure how to connect both, as your browser needs to connect to a different endpoint as your application and the container network does mess with it.

I did find [GitHub - eabykov/keycloak-compose: Keycloak with PostgreSQL, which includes Keycloak's monitoring using Prometheus and Grafana](https://github.com/eabykov/keycloak-compose/tree/main) if you look at the configuration of the grafana container, only the token endpoint is configured to go through the container network. userinfo and auth take the uri accessible from the host.