Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Keycloak Session Check of ImplicitFlow Received 403

See original GitHub issue

Angular 7 Keycloak 4.6.0 Lib 5.0.2

Everything else is working except when the Lib trying to check the session status using the following GET, it got the 403 returns from Keycloak.

GET http://devvm:8080/auth/realms/demo/protocol/openid-connect/login-status-iframe.html/init?client_id=test&origin=http%3A%2F%2Flocalhost%3A4200 403 (Forbidden)
     checkState @ login-status-iframe.html:70
     receiveMessage @ login-status-iframe.html:109

And here is my AuthConfig:

  authConfig: AuthConfig = {
    issuer: 'http://devvm:8080/auth/realms/demo',
    clientId: 'test',
    redirectUri: window.location.origin + '/index.html',
    silentRefreshRedirectUri: window.location.origin + '/silent-refresh.html',
    scope: 'openid profile email',
    sessionChecksEnabled: true,
    requireHttps: false,
    showDebugInformation: false
  };

And the Lib initialization:

  configure() {
    this.oauthService.configure(this.authConfig);
    this.oauthService.tokenValidationHandler = new JwksValidationHandler();
    this.oauthService.events.subscribe(e => this.handleEvent(e));
    this.oauthService.loadDiscoveryDocument()
      .then(() => this.oauthService.tryLogin())
      .then(() => {
        if (!this.oauthService.hasValidAccessToken()) {
          return this.oauthService.silentRefresh();
        }
      });
    this.oauthService.setupAutomaticSilentRefresh();
  }

Please any help to the issue is appreciated 😃