# Ondemand + keycloak + RHEL8 issues

**URL:** <https://discourse.openondemand.org/t/ondemand-keycloak-rhel8-issues/2215>\
**Category:** Get Help\
**Tags:** question\
**Created:** [August 1, 2022, 8:38pm UTC](https://discourse.openondemand.org/t/ondemand-keycloak-rhel8-issues/2215 "2022-08-01T20:38:31Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![rgbryant](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/rgbryant/32/1025_2.png) [@rgbryant](https://discourse.openondemand.org/u/rgbryant)\
**Post date:** [August 1, 2022, 8:38pm UTC](https://discourse.openondemand.org/t/ondemand-keycloak-rhel8-issues/2215/1 "2022-08-01T20:38:31Z")

</div>

I’m trying to setup ondemand 2 with OIDC to keycloak on RHEL8 and I’m having some issues.

The error is  
`oidc_provider_static_config: could not retrieve metadata from url: http://<ondemand-server>:5556/.well-known/openid-configuration`

We are on running keycloak (RHSSO actually) on a completely different server and I’ve mentioned that in several config files and I can’t get it to recognize that.

I had setup the ondemand server with dex to log in locally and have turned that service off. I’m trying to figure out where the OIDC settings are set. I set things in `/etc/ood/config/ood_portal.yml` and they don’t seem to have an effect. I also see `/opt/rh/httpd24/root/etc/httpd/conf.d/auth_openidc.conf` mentioned in the documentation, but it looks like we’re using httpd instead of httpd24. I see the actual portal conf file located in `/etc/httpd/conf.d/ood-portal.conf` so I tried auth\_openidc.conf in that directory but that doesn’t seem to pick up the correct metadata url either. Where should I try setting the OIDC settings?

---

<div class="post-metadata">

**Author:** ![rgbryant](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/rgbryant/32/1025_2.png) [@rgbryant](https://discourse.openondemand.org/u/rgbryant)\
**Post date:** [August 2, 2022, 6:03pm UTC](https://discourse.openondemand.org/t/ondemand-keycloak-rhel8-issues/2215/2 "2022-08-02T18:03:00Z")

</div>

@jeff.ohrstrom can you help?

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [August 2, 2022, 6:33pm UTC](https://discourse.openondemand.org/t/ondemand-keycloak-rhel8-issues/2215/3 "2022-08-02T18:33:27Z")

</div>

Yea you seem to have `Dex` configured and the system (OOD) is still using it. It’s checking for `ondemand-dex` the package being installed and making some default choices based on that - like your OIDCMetadataURL there pointing locally to dex.

Remove the `ondemand-dex` RPM and subsequent invocations of `update_ood_portal` and/or `httpd` restarts (the systemd unit file calls `update_ood_portal` on restarts) should clear all that dex stuff out and should start to use your OIDC settings you have in `ood_portal.yml`

---

<div class="post-metadata">

**Author:** ![rgbryant](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/rgbryant/32/1025_2.png) [@rgbryant](https://discourse.openondemand.org/u/rgbryant)\
**Post date:** [August 3, 2022, 5:05pm UTC](https://discourse.openondemand.org/t/ondemand-keycloak-rhel8-issues/2215/4 "2022-08-03T17:05:28Z")

</div>

That did the trick, thanks!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex015/uploads/osc/original/2X/b/bae70bd0ed39a3ae769c2108155f4cb3e9da8385.png) [@system](https://discourse.openondemand.org/u/system)\
**Post date:** [January 30, 2023, 5:05pm UTC](https://discourse.openondemand.org/t/ondemand-keycloak-rhel8-issues/2215/5 "2023-01-30T17:05:49Z")

</div>

This topic was automatically closed 180 days after the last reply. New replies are no longer allowed.