# Discovery document is missing
**URL:** https://meta.discourse.org/t/discovery-document-is-missing/279551
**Category:** SSO
**Created:** [September 20, 2023, 6:19am UTC](https://meta.discourse.org/t/discovery-document-is-missing/279551 "2023-09-20T06:19:21Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@wayway\_way](https://meta.discourse.org/u/wayway_way)
#### Post date: [September 20, 2023, 6:19am UTC](https://meta.discourse.org/t/discovery-document-is-missing/279551/1 "2023-09-20T06:19:21Z")
Hi there,
Discourse is currently the software that I think has the highest degree of technical freedom, so I chose it as my forum. But I encountered ‘Discovery document is missing’ error when configuring OIDC, which took me a week 😵💫, and I did not find a suitable solution here.
I successfully built Discourse according to the following tutorial:
> [@Install Discourse for development using Docker](https://meta.discourse.org/t/install-discourse-for-development-using-docker/102009):
>
> Developing using Docker Since Discourse runs in Docker, you should be able to run Discourse directly from your source directory using a Discourse development container. white_check_mark Pros: No need to install any system dependencies, no configuration needed at all for setting up a development environment quickly. x Cons: Will be slightly slower than the native dev environment on Ubuntu, and much slower than a native install on MacOS. See also [Developing Discourse using a Dev Container](https://meta.discourse.org/t/developing-discourse-using-a-dev-container/336366) …
Then I used docker to build Keycloak, and both Keycloak and Discourse were deployed locally. When I established the connection of Discourse and keycloak through OIDC, I encountered the following error:
```plaintext
OIDC Log: Fetching discovery document raised error Faraday::ConnectionFailed FinalDestination: all resolved IPs were disallowed
1:51 pm
(oidc) Authentication failure! openid_connect_discovery_error: OmniAuth::OpenIDConnect::DiscoveryError, Discovery document is missing
1:51 pm
OmniAuth::OpenIDConnect::DiscoveryError (Discovery document is missing) lib/middleware/omniauth_bypass_middleware.rb:53:in `call' lib/content_security_policy/middleware.rb:12:in `call' lib/middleware/
```
According to this error I found the corresponding solution as follows:
> [@Openid-connect plugin can't fetch configuration](https://meta.discourse.org/t/openid-connect-plugin-cant-fetch-configuration/253728/2):
>
> There is a [security patch](https://github.com/discourse/discourse/blame/64171730827c58df26a7ad75f0e58f17c2add118/lib/final_destination/ssrf_detector.rb) that disallows reaching out to addresses in the private ranges (10.0.0.0/8 and so on) to prevent internal network explorations. You need to add the hostname to Admin - Settings - Security - allowed internal hosts to bypass the check. It would have been nice if the plugin did that for you.
After following the solution, a new error was reported as follows:
```plaintext
(oidc) Authentication failure! openid_connect_discovery_error: OmniAuth::OpenIDConnect::DiscoveryError, Discovery document is missing
2:00 pm
OmniAuth::OpenIDConnect::DiscoveryError (Discovery document is missing) lib/middleware/omniauth_bypass_middleware.rb:53:in `call' lib/content_security_policy/middleware.rb:12:in `call' lib/middleware/
```
Here are some of my configurations:
Keycloak’s port is 7070
The contents of the openid connect discovery document are as follows
---
### Author:  [@simon](https://meta.discourse.org/u/simon)
#### Post date: [September 20, 2023, 7:11am UTC](https://meta.discourse.org/t/discovery-document-is-missing/279551/2 "2023-09-20T07:11:55Z")
I am likely off base here, but since Discourse and Keycloak are both deployed locally with Docker, are you sure that Discourse can make requests to Keycloak? It’s something I’ve run into trouble with in the past. I know it can be made to work though.
---
### Author:  [@wayway\_way](https://meta.discourse.org/u/wayway_way)
#### Post date: [September 20, 2023, 10:43am UTC](https://meta.discourse.org/t/discovery-document-is-missing/279551/3 "2023-09-20T10:43:17Z")
Thank you for your patient reply which gave me a good idea 😊. You are indeed right. The local keycloak service cannot be accessed through localhost or 127.0.0.1, so I use the host’s IP instead of localhost. But a new problem has arisen:
Then I decoded the url and found that the redirect url pointed to [http://127.0.0.1:3000/auth/oidc/callback](http://127.0.0.1:3000/auth/oidc/callback) instead of [http://127.0.0.1:4200/auth/oidc/callback](http://127.0.0.1:4200/auth/oidc/callback) whose port is the port of the discussion front-end page. Finally, I made the corresponding modifications in Keycloak and succeeded：
---
### Author:  [@system](https://meta.discourse.org/u/system)
#### Post date: [October 20, 2023, 10:44am UTC](https://meta.discourse.org/t/discovery-document-is-missing/279551/4 "2023-10-20T10:44:13Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.