Discovery document is missing

[wayway_way]

Hi there,
Discourse is currently the software that I think has the highest degree of technical freedom, so I chose it as my forum. But I encountered ‘Discovery document is missing’ error when configuring OIDC, which took me a week , and I did not find a suitable solution here.
I successfully built Discourse according to the following tutorial:

Install Discourse for development using Docker

Developing using Docker Since Discourse runs in Docker, you should be able to run Discourse directly from your source directory using a Discourse development container. Pros: No need to install any system dependencies, no configuration needed at all for setting up a development environment quickly. Cons: Will be slightly slower than the native dev environment on Ubuntu, and much slower than a native install on MacOS. See also Developing Discourse using a Dev Container …

Then I used docker to build Keycloak, and both Keycloak and Discourse were deployed locally. When I established the connection of Discourse and keycloak through OIDC, I encountered the following error:

OIDC Log: Fetching discovery document raised error Faraday::ConnectionFailed FinalDestination: all resolved IPs were disallowed
1:51 pm
(oidc) Authentication failure! openid_connect_discovery_error: OmniAuth::OpenIDConnect::DiscoveryError, Discovery document is missing
1:51 pm
OmniAuth::OpenIDConnect::DiscoveryError (Discovery document is missing) lib/middleware/omniauth_bypass_middleware.rb:53:in `call' lib/content_security_policy/middleware.rb:12:in `call' lib/middleware/

According to this error I found the corresponding solution as follows:

Openid-connect plugin can't fetch configuration

There is a security patch that disallows reaching out to addresses in the private ranges (10.0.0.0/8 and so on) to prevent internal network explorations. You need to add the hostname to Admin - Settings - Security - allowed internal hosts to bypass the check. It would have been nice if the plugin did that for you.

After following the solution, a new error was reported as follows:

(oidc) Authentication failure! openid_connect_discovery_error: OmniAuth::OpenIDConnect::DiscoveryError, Discovery document is missing
2:00 pm
OmniAuth::OpenIDConnect::DiscoveryError (Discovery document is missing) lib/middleware/omniauth_bypass_middleware.rb:53:in `call' lib/content_security_policy/middleware.rb:12:in `call' lib/middleware/

Here are some of my configurations:

Keycloak’s port is 7070

The contents of the openid connect discovery document are as follows

[simon]

I am likely off base here, but since Discourse and Keycloak are both deployed locally with Docker, are you sure that Discourse can make requests to Keycloak? It’s something I’ve run into trouble with in the past. I know it can be made to work though.

[wayway_way]

Thank you for your patient reply which gave me a good idea . You are indeed right. The local keycloak service cannot be accessed through localhost or 127.0.0.1, so I use the host’s IP instead of localhost. But a new problem has arisen:

Then I decoded the url and found that the redirect url pointed to http://127.0.0.1:3000/auth/oidc/callback instead of http://127.0.0.1:4200/auth/oidc/callback whose port is the port of the discussion front-end page. Finally, I made the corresponding modifications in Keycloak and succeeded：