Camunda 8 Identity无法连接现有Keycloak的问题求助

尝试通过Camunda Helm Chart将Camunda 8 Identity连接到现有Keycloak（v23.0.7），使用的Keycloak连接配置如下：

global:
  identity:
    keycloak:
      url:
        protocol: "https"
        host: "keycloak.keycloak.svc.cluster.local"
        port: "443"
      contextPath: "/"
      realm: "/realms/camunda-platform"
      auth:
        adminUser: "admin"
        existingSecret: "keycloak-auth"
        existingSecretKey: "admin-password"

identity:
  keycloak:
    enabled: false

但Identity容器启动失败，报错如下：

ingframework.beans.factory.BeanCreationException: Error creating bean with name 'frontendController': Invocation of init method failed
2024-03-23 08:58:26.371 ERROR 1 --- [           main] o.s.b.SpringApplication                  : Application run failed

org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'frontendController': Invocation of init method failed
        at org.springframework.beans.factory.annotation.InitDestroyAnnotationBeanPostProcessor.postProcessBeforeInitialization(InitDestroyAnnotationBeanPostProcessor.java:222) ~[spring-beans-6.0.17.jar!/:6.0.17]
        at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.applyBeanPostProcessorsBeforeInitialization(AbstractAutowireCapableBeanFactory.java:419) ~[spring-beans-6.0.17.jar!/:6.0.17]
        at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1760) ~[spring-beans-6.0.17.jar!/:6.0.17]
        at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:596) ~[spring-beans-6.0.17.jar!/:6.0.17]
        at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:518) ~[spring-beans-6.0.17.jar!/:6.0.17]
        at org.springframework.beans.factory.support.AbstractBeanFactory.lambda$doGetBean$0(AbstractBeanFactory.java:325) ~[spring-beans-6.0.17.jar!/:6.0.17]
        at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:234) ~[spring-beans-6.0.17.jar!/:6.0.17]
        at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:323) ~[spring-beans-6.0.17.jar!/:6.0.17]
        at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:199) ~[spring-beans-6.0.17.jar!/:6.0.17]
        at org.springframework.beans.factory.support.DefaultListableBeanFactory.preInstantiateSingletons(DefaultListableBeanFactory.java:973) ~[spring-beans-6.0.17.jar!/:6.0.17]
        at org.springframework.context.support.AbstractApplicationContext.finishBeanFactoryInitialization(AbstractApplicationContext.java:949) ~[spring-context-6.0.17.jar!/:6.0.17]
        at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:615) ~[spring-context-6.0.17.jar!/:6.0.17]
        at org.springframework.boot.web.servlet.context.ServletWebServerApplicationContext.refresh(ServletWebServerApplicationContext.java:146) ~[spring-boot-3.1.9.jar!/:3.1.9]
        at org.springframework.boot.SpringApplication.refresh(SpringApplication.java:738) [spring-boot-3.1.9.jar!/:3.1.9]
        at org.springframework.boot.SpringApplication.refreshContext(SpringApplication.java:440) [spring-boot-3.1.9.jar!/:3.1.9]
        at org.springframework.boot.SpringApplication.run(SpringApplication.java:324) [spring-boot-3.1.9.jar!/:3.1.9]
        at org.springframework.boot.SpringApplication.run(SpringApplication.java:1317) [spring-boot-3.1.9.jar!/:3.1.9]
        at org.springframework.boot.SpringApplication.run(SpringApplication.java:1306) [spring-boot-3.1.9.jar!/:3.1.9]
        at io.camunda.identity.Application.main(Application.java:21) [classes!/:?]
        at jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[?:?]
        at jdk.internal.reflect.NativeMethodAccessorImpl.invoke(Unknown Source) ~[?:?]
        at jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source) ~[?:?]
        at java.lang.reflect.Method.invoke(Unknown Source) ~[?:?]
        at org.springframework.boot.loader.MainMethodRunner.run(MainMethodRunner.java:49) [identity.jar:?]
        at org.springframework.boot.loader.Launcher.launch(Launcher.java:95) [identity.jar:?]
        at org.springframework.boot.loader.Launcher.launch(Launcher.java:58) [identity.jar:?]
        at org.springframework.boot.loader.JarLauncher.main(JarLauncher.java:65) [identity.jar:?]
Caused by: java.lang.IllegalArgumentException: Expected authority at index 7: http://
        at java.net.URI.create(Unknown Source) ~[?:?]
        at io.camunda.identity.config.IdentityCommon.basePath(IdentityCommon.java:62) ~[classes!/:?]
        at io.camunda.identity.frontend.controller.FrontendController.initialize(FrontendController.java:53) ~[classes!/:?]
        at jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[?:?]
        at jdk.internal.reflect.NativeMethodAccessorImpl.invoke(Unknown Source) ~[?:?]
        at jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source) ~[?:?]
        at java.lang.reflect.Method.invoke(Unknown Source) ~[?:?]
        at org.springframework.beans.factory.annotation.InitDestroyAnnotationBeanPostProcessor$LifecycleMethod.invoke(InitDestroyAnnotationBeanPostProcessor.java:457) ~[spring-beans-6.0.17.jar!/:6.0.17]
        at org.springframework.beans.factory.annotation.InitDestroyAnnotationBeanPostProcessor$LifecycleMetadata.invokeInitMethods(InitDestroyAnnotationBeanPostProcessor.java:401) ~[spring-beans-6.0.17.jar!/:6.0.17]
        at org.springframework.beans.factory.annotation.InitDestroyAnnotationBeanPostProcessor.postProcessBeforeInitialization(InitDestroyAnnotationBeanPostProcessor.java:219) ~[spring-beans-6.0.17.jar!/:6.0.17]
        ... 26 more
Caused by: java.net.URISyntaxException: Expected authority at index 7: http://
        at java.net.URI$Parser.fail(Unknown Source) ~[?:?]
        at java.net.URI$Parser.failExpecting(Unknown Source) ~[?:?]
        at java.net.URI$Parser.parseHierarchical(Unknown Source) ~[?:?]
        at java.net.URI$Parser.parse(Unknown Source) ~[?:?]
        at java.net.URI.<init>(Unknown Source) ~[?:?]
        at java.net.URI.create(Unknown Source) ~[?:?]
        at io.camunda.identity.config.IdentityCommon.basePath(IdentityCommon.java:62) ~[classes!/:?]
        at io.camunda.identity.frontend.controller.FrontendController.initialize(FrontendController.java:53) ~[classes!/:?]
        at jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[?:?]
        at jdk.internal.reflect.NativeMethodAccessorImpl.invoke(Unknown Source) ~[?:?]
        at jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source) ~[?:?]
        at java.lang.reflect.Method.invoke(Unknown Source) ~[?:?]
        at org.springframework.beans.factory.annotation.InitDestroyAnnotationBeanPostProcessor$LifecycleMethod.invoke(InitDestroyAnnotationBeanPostProcessor.java:457) ~[spring-beans-6.0.17.jar!/:6.0.17]
        at org.springframework.beans.factory.annotation.InitDestroyAnnotationBeanPostProcessor$LifecycleMetadata.invokeInitMethods(InitDestroyAnnotationBeanPostProcessor.java:401) ~[spring-beans-6.0.17.jar!/:6.0.17]
        at org.springframework.beans.factory.annotation.InitDestroyAnnotationBeanPostProcessor.postProcessBeforeInitialization(InitDestroyAnnotationBeanPostProcessor.java:219) ~[spring-beans-6.0.17.jar!/:6.0.17]
        ... 26 more

已完成以下排查：

• 核对secret中的密码，可正常登录Keycloak管理面板；
• 当前使用Camunda v8.4.5，尝试过Identity v8.5.0-alpha2，错误一致；
• 按照官方文档要求尝试了支持的Keycloak 22.x版本，仍出现相同错误。

解决方案 #

报错核心是java.net.URISyntaxException: Expected authority at index 7: http://，说明生成URI时缺少主机地址，问题出在配置的两个关键点：

1. 修正Keycloak Realm配置
   配置中global.identity.keycloak.realm的值是"/realms/camunda-platform"，正确写法应为仅填Realm名称"camunda-platform"，不需要前缀/realms/。Helm Chart会自动拼接完整的Realm路径，多余前缀会导致URI解析错误。

2. 添加Identity Public URL配置
   Identity前端控制器初始化时需要明确的公开URL生成正确的basePath，否则会出现空URL情况。在Helm配置中添加：

   identity:
     publicUrl: "https://<你的Identity公开域名>"
   

   若为集群内部访问，也可使用Service的ClusterIP地址或DNS名称，例如"http://identity.camunda.svc.cluster.local:8080"。

修改后的完整配置示例：

global:
  identity:
    keycloak:
      url:
        protocol: "https"
        host: "keycloak.keycloak.svc.cluster.local"
        port: "443"
      contextPath: "/"
      realm: "camunda-platform"
      auth:
        adminUser: "admin"
        existingSecret: "keycloak-auth"
        existingSecretKey: "admin-password"

identity:
  keycloak:
    enabled: false
  publicUrl: "https://identity.your-domain.com"

应用修改后的配置重新部署，即可解决启动失败问题。

内容的提问来源于stack exchange，提问作者Hazhir