platform/sicabe-core
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix trino realm

Browse Source
This commit is contained in:
subroto
2026-10-12 14:43:12 +07:00
parent f56c184110
commit 64c60f99c2
3 changed files with 21 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
deploy/config/trino/config-coordinator.properties
+4 -4
View File
@@ -40,7 +40,7 @@ http-server.process-forwarded=${ENV:TRINO_PROCESS_FORWARDED}
# Diambil dari KEYCLOAK_PUBLIC_URL (bukan ditulis tetap): nilainya berubah antara
# single-host (localhost) dan multi-host tanpa TLS (http://<alamat-host-control>:12080).
# Kalau di-hardcode, issuer di klaster multi-host tidak cocok dan token ditolak.
http-server.authentication.oauth2.issuer=${ENV:KEYCLOAK_PUBLIC_URL}/realms/sicabe
http-server.authentication.oauth2.issuer=${ENV:KEYCLOAK_PUBLIC_URL}/realms/${ENV:SICABE_REALM}
# Server-ke-server (token/jwks) pakai KEYCLOAK_INTERNAL_URL — URL penuh
# (skema+host+port). Di multi-host dgn Keycloak EKSTERNAL berdomain mis.
# `https://sso.example.com`, nilainya persis itu (skema+port dihormati). Selain itu
@@ -49,10 +49,10 @@ http-server.authentication.oauth2.issuer=${ENV:KEYCLOAK_PUBLIC_URL}/realms/sicab
# di host lain → penukaran token gagal → "Authentication response could not be verified").
http-server.authentication.oauth2.oidc.discovery=false
# Endpoint browser-facing (auth redirect) — harus URL publik juga
http-server.authentication.oauth2.auth-url=${ENV:KEYCLOAK_PUBLIC_URL}/realms/sicabe/protocol/openid-connect/auth
http-server.authentication.oauth2.auth-url=${ENV:KEYCLOAK_PUBLIC_URL}/realms/${ENV:SICABE_REALM}/protocol/openid-connect/auth
# Endpoint server-side (token exchange & JWKS) — reachable dari container
http-server.authentication.oauth2.token-url=${ENV:KEYCLOAK_INTERNAL_URL}/realms/sicabe/protocol/openid-connect/token
http-server.authentication.oauth2.jwks-url=${ENV:KEYCLOAK_INTERNAL_URL}/realms/sicabe/protocol/openid-connect/certs
http-server.authentication.oauth2.token-url=${ENV:KEYCLOAK_INTERNAL_URL}/realms/${ENV:SICABE_REALM}/protocol/openid-connect/token
http-server.authentication.oauth2.jwks-url=${ENV:KEYCLOAK_INTERNAL_URL}/realms/${ENV:SICABE_REALM}/protocol/openid-connect/certs
# Kunci HMAC tetap untuk `state` OAuth2 (default Trino = acak tiap coordinator start →
# sesi login batal saat restart). Nilai acak-per-instalasi dari .env.
http-server.authentication.oauth2.state-key=${ENV:TRINO_OAUTH_STATE_KEY}