Keycloak Access Token被OAuth2误验证为GitHub令牌的问题求助及解决更新

我维护着一批需要认证机制保护的微服务，采用了 OAuth2 + Keycloak 的方案来做身份认证。之前遇到过 redirect_uri 的问题已经解决了，但这次又碰到新状况：成功登录后，Keycloak 生成的 Access Token 发送到 OAuth2 服务验证时，居然被识别成了来自 GitHub 的令牌，相关日志如下：

123.28.110.207 - 78368701-f2b3-48c2-8f57-3a77a6b385f0 - - [2021/09/28 03:20:52] grafana.my-domain.com GET - "/oauth2/start?rd=https%3A%2F%2Fgrafana.my-domain.com%2F" HTTP/1.1 "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36" 302 419 0.000
[2021/09/28 03:21:06] [internal_util.go:64] GET https://keycloak.org/api/v3/user?access_token=eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJvNXViN...
[2021/09/28 03:21:06] [internal_util.go:65] token validation request failed: error performing request: Get "https://keycloak.org/api/v3/user?access_token=eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJvNXViNgmU66CrcaFozOg": x509: certificate is valid for *.github.com, github.com, not keycloak.org
123.28.110.207 - a4f32698-44f4-463d-831e-93c292fb91ea - dathuynh@my-domain.com [2021/09/28 03:21:06] [AuthSuccess] Authenticated via OAuth2: Session{email:dathuynh@my-domain.com user: PreferredUsername: token:true}
123.28.110.207 - a4f32698-44f4-463d-831e-93c292fb91ea - - [2021/09/28 03:21:05] grafana.my-domain.com GET - "/oauth2/callback?state=rVOsXkFxqswYCI8LhKTCOAUUjP76i8k3ltnqJcoxEDU%3Ahttps%3A%2F%2Fgrafana.my-domain.com%2F&session_state=36f8da18-6477-4a72-a7d2-10aadc5a0679&code=b9bbeb85-45bf-4fb5-ad31-cd6a59fc955f.36f8da18-6477-4a72-a7d2-10aadc5a0679.9f5b720c-0be6-44f0-946f-62e34ca0e5ec" HTTP/1.1 "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36" 302 63 0.955
123.28.110.207 - a25fe783-0e8f-48de-8040-80e77c98d35b - dathuynh@my-domain.com [2021/09/28 03:21:06] grafana.my-domain.com GET - "/" HTTP/1.1 "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36" 404 19 0.000
123.28.110.207 - c5eeb805-c532-401b-aed4-d462b8b26d11 - dathuynh@my-domain.com [2021/09/28 03:21:07] grafana.my-domain.com GET - "/" HTTP/1.1 "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36" 404 19 0.000

我怀疑是 Keycloak 的配置哪里漏了，但实在找不到具体问题，有没有大佬能给点建议？

更新：问题已解决！ #

最终发现是 Traefik ForwardAuth 中间件的地址配置错误。之前 OAuth2 服务里的那条证书错误日志并不是核心问题，具体的排查和解决细节可以参考我之前的相关记录。

内容的提问来源于stack exchange，提问作者tandathuynh148