Wrong iss in dockerized keycloak

In my project I have three containers: frontend, backend and keycloak v26.1.3.

frontend and backend are hidden behind reverse proxy 8080, keycloak has port 8082 exposed. From the frontend I am able to log in to keycloak and receive a token, but later using this token for api calls I get the error "Cannot validate access token: Error: Grant validation failed. Reason: invalid token (wrong ISS)". I use angular-auth-oidc-client on frontend and nest-keycloak-connect on backend.

It seems to me that everything should be fine, authServerUrl on the backend is the same as authority on the frontend (http://localhost:8082/realms/my-realm).

What am i doing wrong?

//backend/auth.module.ts
@Module({
controllers: [KeycloakController],
imports: [
KeycloakConnectModule.register({
authServerUrl: 'http://keycloak:80/realms/my-realm',
realm: 'my-realm',
clientId: 'my-auth',
secret: 'someFancySecretKey',
logLevels: ['debug']
}),
HttpModule,
],
providers: [
{
provide: APP_GUARD,
useClass: AuthGuard,
},
{
provide: APP_GUARD,
useClass: RoleGuard,
}
],
})
export class AuthModule {}


// frontend/app.config.ts
export const appConfig: ApplicationConfig = {
providers: [
...,
provideAuth(
{
config: {
authority: 'http://localhost:8082/realms/my-realm',
redirectUrl: window.location.origin,
postLogoutRedirectUri: window.location.origin,
clientId: 'my-client',
scope: 'openid profile email offline_access',
authWellknownEndpointUrl: 'http://localhost:8082/realms/my-realm/.well-known/openid-configuration',
responseType: 'code',
silentRenew: true,
useRefreshToken: true,
renewTimeBeforeTokenExpiresInSeconds: 30,
startCheckSession: true,
logLevel: LogLevel.Warn,
},
},
withAppInitializerAuthCheck(),
),
...
],
};



//nginx.conf reverse proxy
user nginx;
worker_processes auto;

error_log /var/log/nginx/error.log warn;
pid /var/run/nginx.pid;

events {
worker_connections 1024;
}

http {
include /etc/nginx/mime.types;
default_type application/octet-stream;

access_log /var/log/nginx/access.log;

sendfile on;

keepalive_timeout 65;

server {
listen 80;
server_name localhost;

# Route API requests to the backend server
location /api {
proxy_pass http://backend:3000;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}

# Route all other requests to the client
location / {
proxy_pass http://frontend:80;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}
}

Continue reading...