Spring Boot通过负载均衡器调用Keycloak创建用户时持续报404错误

在Spring Boot应用中基于Keycloak实现了用户管理系统，测试环境运行完全正常，但生产环境中通过负载均衡器调用Keycloak创建用户时始终返回404错误。

报错信息 #

com.example.solar.frontend.usecase.exceptions.KeycloakException: Error creating Keycloak user. Get Response 404
Sep 14 08:34:08 solar[23098]: at com.example.solar.frontend.adapter.outgoing.KeycloakUserService.createUser(KeycloakUserService.java:59) ~[classes!/:0.0.4]

服务代码 #

public class KeycloakUserService implements UserService {

private final RealmResource realmResource;

@Autowired
public KeycloakUserService(KeycloakProvider keycloakProvider, @Value("${keycloak.realm}") String realm) {

    realmResource = keycloakProvider.keycloak().realm(realm);
}

public String createUser(KeycloakUserRequest userRequest) throws KeycloakException {

    UsersResource usersResource = realmResource.users();
    CredentialRepresentation credentialRepresentation = createPasswordCredentials(userRequest.getPassword());

    UserRepresentation kcUser = new UserRepresentation();
    kcUser.setUsername(userRequest.getUsername());
    kcUser.setCredentials(Collections.singletonList(credentialRepresentation));
    kcUser.setFirstName(userRequest.getFirstname());
    kcUser.setLastName(userRequest.getLastname());
    kcUser.setEmail(userRequest.getEmail());
    kcUser.setEnabled(true);
    kcUser.setEmailVerified(false);

    Response response = usersResource.create(kcUser);

    if (response.getStatus() == HttpStatus.SC_CREATED) {

        String userId = response.getLocation().getPath().replaceAll(".*/([^/]+)$", "$1");
        log.info("Successfully created user in Keycloak userId: {}, email: {}, firstname: {}, lastname: {}", userId,
                kcUser.getEmail(), kcUser.getFirstName(), kcUser.getLastName());
        return userId;
    } else {
        throw new KeycloakException("Error creating Keycloak user. Get Response " + response.getStatus() + " " + response.getStatusInfo().getReasonPhrase());
    }
}

配置文件（application.properties） #

keycloak.realm=<realm>
keycloak.auth-server-url=http://<loadbalancer-keycloak-url>/auth/
keycloak.resource=solar
keycloak.credentials.secret=<secret>

开发环境直接调用Keycloak地址时运行正常（http协议无误），且通过浏览器访问负载均衡地址能正常返回Keycloak管理首页，说明地址正确。请问遗漏了哪些配置，或者还能进行哪些排查？

问题解决 #

最终已解决该问题，原因是防火墙限制——生产环境防火墙仅开放了浏览器访问Keycloak前端页面的路径/端口，阻挡了应用服务通过负载均衡器调用Keycloak的API接口。

内容的提问来源于stack exchange，提问作者Michael Kronberger