From 78a72a0783c9003f68018c1683ca79eb93481b35 Mon Sep 17 00:00:00 2001 From: Piotr Mlocek Date: Fri, 30 Oct 2026 19:04:00 -0700 Subject: [PATCH] fix(test): drop IPv6 loopback redirect from the Keycloak fixture realm Keycloak 24 rejects http://[::1]:* (and every other port wildcard on an IPv6 literal) when importing the realm, so it fails to start with "Invalid client openshell-cli: A redirect URI is not a valid URI". That broke every lane that loads scripts/keycloak-realm.json, including the features/keycloak suite and the OIDC Docker E2E jobs. Restore the IPv4 loopback and localhost entries only, and correct the authentication docs: IPv6 callback binds against the bundled realm need an exact http://[::1]:/callback redirect URI. Signed-off-by: Piotr Mlocek --- docs/how-it-works/gateways/authentication.mdx | 2 +- scripts/keycloak-realm.json | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/how-it-works/gateways/authentication.mdx b/docs/how-it-works/gateways/authentication.mdx index 436be775e1..232cd0f5a0 100644 --- a/docs/how-it-works/gateways/authentication.mdx +++ b/docs/how-it-works/gateways/authentication.mdx @@ -343,7 +343,7 @@ For example, a wrapper running the CLI in a container sets both variables and pu OPENSHELL_CALLBACK_PORT=18080 OPENSHELL_CALLBACK_BIND_ADDRESS=0.0.0.0 openshell gateway login ``` -The browser-facing callback URL derives from the bound address, so the callback matches the listener: IPv4 binds (including the default and `0.0.0.0`) use `http://127.0.0.1:/callback`, and IPv6 binds use the bracketed RFC 8252 loopback form `http://[::1]:/callback`. The bundled Keycloak realm allows `http://127.0.0.1:*`, `http://localhost:*`, and `http://[::1]:*` redirects for the CLI client; other identity providers that allowlist loopback redirects for native apps should include the `[::1]` form as well. +The browser-facing callback URL derives from the bound address, so the callback matches the listener: IPv4 binds (including the default and `0.0.0.0`) use `http://127.0.0.1:/callback`, and IPv6 binds use the bracketed RFC 8252 loopback form `http://[::1]:/callback`. Identity providers that allowlist loopback redirects for native apps must include the `[::1]` form for IPv6 binds. The bundled Keycloak realm allows only `http://127.0.0.1:*` and `http://localhost:*`, because Keycloak rejects a port wildcard on an IPv6 literal, so IPv6 binds against it need an exact `http://[::1]:/callback` redirect URI added to the `openshell-cli` client. **IPv6 limitation for edge login:** IPv6 callback binds are fully supported for OIDC login, but the edge browser flow has a known browser limitation. The gateway's connect page enforces a Content-Security-Policy that must allow the callback target, and Chrome does not currently support IPv6 literals in CSP `connect-src` source expressions. An IPv6-bound CLI (`OPENSHELL_CALLBACK_BIND_ADDRESS=::1` or `::`) therefore cannot complete edge login in Chrome: the page's POST to the callback is blocked by CSP and the page reports that it could not reach the CLI. This is a browser limitation, not a CLI or gateway defect; IPv6 edge login is best-effort until browsers implement IPv6 CSP source expressions. The IPv4 paths, including the container use case, are unaffected. diff --git a/scripts/keycloak-realm.json b/scripts/keycloak-realm.json index 224bb82890..0664d6160e 100644 --- a/scripts/keycloak-realm.json +++ b/scripts/keycloak-realm.json @@ -288,8 +288,8 @@ "standardFlowEnabled": true, "directAccessGrantsEnabled": true, "serviceAccountsEnabled": false, - "redirectUris": ["http://127.0.0.1:*", "http://localhost:*", "http://[::1]:*"], - "webOrigins": ["http://127.0.0.1:*", "http://localhost:*", "http://[::1]:*"], + "redirectUris": ["http://127.0.0.1:*", "http://localhost:*"], + "webOrigins": ["http://127.0.0.1:*", "http://localhost:*"], "attributes": { "pkce.code.challenge.method": "S256" },