# Keycloak - "failed to turn code into token" - Connection refused

**URL:** <https://support.openanalytics.eu/t/keycloak-failed-to-turn-code-into-token-connection-refused/938>\
**Category:** ShinyProxy\
**Created:** [February 6, 2019, 11:46am UTC](https://support.openanalytics.eu/t/keycloak-failed-to-turn-code-into-token-connection-refused/938 "2019-02-06T11:46:09Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![ana](https://support.openanalytics.eu/letter_avatar_proxy/v4/letter/a/a6a055/32.png) [@ana](https://support.openanalytics.eu/u/ana)\
**Post date:** [February 6, 2019, 11:46am UTC](https://support.openanalytics.eu/t/keycloak-failed-to-turn-code-into-token-connection-refused/938/1 "2019-02-06T11:46:09Z")

</div>

Hi,

I have this problem. After click Login in, the browser shows this message “Can’t reach this page”. This is the log:

> 2019-02-06 13:36:16.820 ERROR 1 — [XNIO-2 task-3] o.k.adapters.OAuthRequestAuthenticator : failed to turn code into token
> 
> java.net.ConnectException: Connection refused (Connection refused)  
> at java.net.PlainSocketImpl.socketConnect(Native Method) ~[na:1.8.0\_181]  
> at java.net.AbstractPlainSocketImpl.doConnect(AbstractPlainSocketImpl.java:350) ~[na:1.8.0\_181]  
> at java.net.AbstractPlainSocketImpl.connectToAddress(AbstractPlainSocketImpl.java:206) ~[na:1.8.0\_181]  
> at java.net.AbstractPlainSocketImpl.connect(AbstractPlainSocketImpl.java:188) ~[na:1.8.0\_181]  
> at java.net.SocksSocketImpl.connect(SocksSocketImpl.java:392) ~[na:1.8.0\_181]  
> at java.net.Socket.connect(Socket.java:589) ~[na:1.8.0\_181]  
> at org.apache.http.conn.scheme.PlainSocketFactory.connectSocket(PlainSocketFactory.java:121) ~[httpclient-4.5.5.jar!/:4.5.5]  
> at org.apache.http.impl.conn.DefaultClientConnectionOperator.openConnection(DefaultClientConnectionOperator.java:180) ~[httpclient-4.5.5.jar!/:4.5.5]  
> at org.apache.http.impl.conn.AbstractPoolEntry.open(AbstractPoolEntry.java:144) ~[httpclient-4.5.5.jar!/:4.5.5]  
> at org.apache.http.impl.conn.AbstractPooledConnAdapter.open(AbstractPooledConnAdapter.java:134) ~[httpclient-4.5.5.jar!/:4.5.5]  
> at org.apache.http.impl.client.DefaultRequestDirector.tryConnect(DefaultRequestDirector.java:610) ~[httpclient-4.5.5.jar!/:4.5.5]  
> at org.apache.http.impl.client.DefaultRequestDirector.execute(DefaultRequestDirector.java:445) ~[httpclient-4.5.5.jar!/:4.5.5]  
> at org.apache.http.impl.client.AbstractHttpClient.doExecute(AbstractHttpClient.java:835) ~[httpclient-4.5.5.jar!/:4.5.5]  
> at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:83) ~[httpclient-4.5.5.jar!/:4.5.5]  
> at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:108) ~[httpclient-4.5.5.jar!/:4.5.5]  
> at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:56) ~[httpclient-4.5.5.jar!/:4.5.5]  
> at org.keycloak.adapters.ServerRequest.invokeAccessCodeToToken(ServerRequest.java:111) ~[keycloak-adapter-core-4.7.0.Final.jar!/:4.7.0.Final]  
> at org.keycloak.adapters.OAuthRequestAuthenticator.resolveCode(OAuthRequestAuthenticator.java:335) [keycloak-adapter-core-4.7.0.Final.jar!/:4.7.0.Final]  
> at org.keycloak.adapters.OAuthRequestAuthenticator.authenticate(OAuthRequestAuthenticator.java:280) [keycloak-adapter-core-4.7.0.Final.jar!/:4.7.0.Final]  
> at org.keycloak.adapters.RequestAuthenticator.authenticate(RequestAuthenticator.java:139) [keycloak-adapter-core-4.7.0.Final.jar!/:4.7.0.Final]  
> at org.keycloak.adapters.springsecurity.filter.KeycloakAuthenticationProcessingFilter.attemptAuthentication(KeycloakAuthenticationProcessingFilter.java:149) [keycloak-spring-security-adapter-4.7.0.Final.jar!/:4.7.0.Final]  
> at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:212) [spring-security-web-5.0.3.RELEASE.jar!/:5.0.3.RELEASE]  
> at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) [spring-security-web-5.0.3.RELEASE.jar!/:5.0.3.RELEASE]  
> at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:116) [spring-security-web-5.0.3.RELEASE.jar!/:5.0.3.RELEASE]  
> at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) [spring-security-web-5.0.3.RELEASE.jar!/:5.0.3.RELEASE]  
> at org.keycloak.adapters.springsecurity.filter.KeycloakPreAuthActionsFilter.doFilter(KeycloakPreAuthActionsFilter.java:86) [keycloak-spring-security-adapter-4.7.0.Final.jar!/:4.7.0.Final]  
> at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) [spring-security-web-5.0.3.RELEASE.jar!/:5.0.3.RELEASE]  
> at org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:66) [spring-security-web-5.0.3.RELEASE.jar!/:5.0.3.RELEASE]  
> at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-5.0.4.RELEASE.jar!/:5.0.4.RELEASE]  
> at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) [spring-security-web-5.0.3.RELEASE.jar!/:5.0.3.RELEASE]  
> at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:105) [spring-security-web-5.0.3.RELEASE.jar!/:5.0.3.RELEASE]  
> at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) [spring-security-web-5.0.3.RELEASE.jar!/:5.0.3.RELEASE]  
> at org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:56) [spring-security-web-5.0.3.RELEASE.jar!/:5.0.3.RELEASE]  
> at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-5.0.4.RELEASE.jar!/:5.0.4.RELEASE]  
> at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334) [spring-security-web-5.0.3.RELEASE.jar!/:5.0.3.RELEASE]  
> at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:215) [spring-security-web-5.0.3.RELEASE.jar!/:5.0.3.RELEASE]  
> at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:178) [spring-security-web-5.0.3.RELEASE.jar!/:5.0.3.RELEASE]  
> at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:357) [spring-web-5.0.4.RELEASE.jar!/:5.0.4.RELEASE]  
> at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:270) [spring-web-5.0.4.RELEASE.jar!/:5.0.4.RELEASE]  
> at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61) [undertow-servlet-1.4.22.Final.jar!/:1.4.22.Final]  
> at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) [undertow-servlet-1.4.22.Final.jar!/:1.4.22.Final]  
> at org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:99) [spring-web-5.0.4.RELEASE.jar!/:5.0.4.RELEASE]  
> at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-5.0.4.RELEASE.jar!/:5.0.4.RELEASE]  
> at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61) [undertow-servlet-1.4.22.Final.jar!/:1.4.22.Final]  
> at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) [undertow-servlet-1.4.22.Final.jar!/:1.4.22.Final]  
> at org.springframework.web.filter.HttpPutFormContentFilter.doFilterInternal(HttpPutFormContentFilter.java:109) [spring-web-5.0.4.RELEASE.jar!/:5.0.4.RELEASE]  
> at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-5.0.4.RELEASE.jar!/:5.0.4.RELEASE]  
> at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61) [undertow-servlet-1.4.22.Final.jar!/:1.4.22.Final]  
> at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) [undertow-servlet-1.4.22.Final.jar!/:1.4.22.Final]  
> at org.springframework.web.filter.HiddenHttpMethodFilter.doFilterInternal(HiddenHttpMethodFilter.java:81) [spring-web-5.0.4.RELEASE.jar!/:5.0.4.RELEASE]  
> at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-5.0.4.RELEASE.jar!/:5.0.4.RELEASE]  
> at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61) [undertow-servlet-1.4.22.Final.jar!/:1.4.22.Final]  
> at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) [undertow-servlet-1.4.22.Final.jar!/:1.4.22.Final]  
> at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:200) [spring-web-5.0.4.RELEASE.jar!/:5.0.4.RELEASE]  
> at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-5.0.4.RELEASE.jar!/:5.0.4.RELEASE]  
> at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61) [undertow-servlet-1.4.22.Final.jar!/:1.4.22.Final]  
> at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) [undertow-servlet-1.4.22.Final.jar!/:1.4.22.Final]  
> at io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84) [undertow-servlet-1.4.22.Final.jar!/:1.4.22.Final]  
> at io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62) [undertow-servlet-1.4.22.Final.jar!/:1.4.22.Final]  
> at io.undertow.servlet.handlers.ServletChain$1.handleRequest(ServletChain.java:64) [undertow-servlet-1.4.22.Final.jar!/:1.4.22.Final]  
> at io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36) [undertow-servlet-1.4.22.Final.jar!/:1.4.22.Final]  
> at io.undertow.server.handlers.PathHandler.handleRequest(PathHandler.java:94) [undertow-core-1.4.22.Final.jar!/:1.4.22.Final]  
> at eu.openanalytics.containerproxy.ContainerProxyApplication$ProtectedPathHandler.handleRequest(ContainerProxyApplication.java:111) [containerproxy-0.7.0.jar!/:0.7.0]  
> at io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:131) [undertow-servlet-1.4.22.Final.jar!/:1.4.22.Final]  
> at io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57) [undertow-servlet-1.4.22.Final.jar!/:1.4.22.Final]  
> at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) [undertow-core-1.4.22.Final.jar!/:1.4.22.Final]  
> at io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46) [undertow-core-1.4.22.Final.jar!/:1.4.22.Final]  
> at io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64) [undertow-servlet-1.4.22.Final.jar!/:1.4.22.Final]  
> at io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60) [undertow-core-1.4.22.Final.jar!/:1.4.22.Final]  
> at io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77) [undertow-servlet-1.4.22.Final.jar!/:1.4.22.Final]  
> at io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43) [undertow-core-1.4.22.Final.jar!/:1.4.22.Final]  
> at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) [undertow-core-1.4.22.Final.jar!/:1.4.22.Final]  
> at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) [undertow-core-1.4.22.Final.jar!/:1.4.22.Final]  
> at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:292) [undertow-servlet-1.4.22.Final.jar!/:1.4.22.Final]  
> at io.undertow.servlet.handlers.ServletInitialHandler.access$100(ServletInitialHandler.java:81) [undertow-servlet-1.4.22.Final.jar!/:1.4.22.Final]  
> at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:138) [undertow-servlet-1.4.22.Final.jar!/:1.4.22.Final]  
> at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:135) [undertow-servlet-1.4.22.Final.jar!/:1.4.22.Final]  
> at io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:48) [undertow-servlet-1.4.22.Final.jar!/:1.4.22.Final]  
> at io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43) [undertow-servlet-1.4.22.Final.jar!/:1.4.22.Final]  
> at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:272) [undertow-servlet-1.4.22.Final.jar!/:1.4.22.Final]  
> at io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81) [undertow-servlet-1.4.22.Final.jar!/:1.4.22.Final]  
> at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:104) [undertow-servlet-1.4.22.Final.jar!/:1.4.22.Final]  
> at io.undertow.server.Connectors.executeRootHandler(Connectors.java:336) [undertow-core-1.4.22.Final.jar!/:1.4.22.Final]  
> at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:830) [undertow-core-1.4.22.Final.jar!/:1.4.22.Final]  
> at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [na:1.8.0\_181]  
> at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [na:1.8.0\_181]  
> at java.lang.Thread.run(Thread.java:748) [na:1.8.0\_181]

---

<div class="post-metadata">

**Author:** ![ana](https://support.openanalytics.eu/letter_avatar_proxy/v4/letter/a/a6a055/32.png) [@ana](https://support.openanalytics.eu/u/ana)\
**Post date:** [February 6, 2019, 11:53am UTC](https://support.openanalytics.eu/t/keycloak-failed-to-turn-code-into-token-connection-refused/938/2 "2019-02-06T11:53:49Z")

</div>

This is my application file:

> proxy:  
> title: Open Analytics Shiny Proxy Ana  
> landing-page: /  
> useForwardHeaders: true  
> heartbeat-rate: 10000  
> heartbeat-timeout: 60000  
> port: 8080  
> authentication: keycloak  
> admin-groups: admins  
> users:
> 
> - name: jack  
> password: password  
> groups: admins
> - name: jeff  
> password: password  
> docker:  
> internal-networking: true  
> specs:
> - id: 01\_hello  
> display-name: Hello Application3  
> description: Application which demonstrates the basics of a Shiny app  
> container-cmd: [“R”, “-e”, “shinyproxy::run\_01\_hello()”]  
> container-image: openanalytics/shinyproxy-demo  
> container-network: sp-example-net
> - id: 06\_tabsets  
> container-cmd: [“R”, “-e”, “shinyproxy::run\_06\_tabsets()”]  
> container-image: openanalytics/shinyproxy-demo  
> container-network: sp-example-net
> - id: anaApp  
> display-name: anaApp  
> container-cmd: [“R”, “-e”, “shiny::runApp(‘/root/euler2’)”]  
> container-image: anaid  
> container-network: sp-example-net  
> keycloak:  
> realm: shinyproxy  
> auth-server-url: [http://localhost:8010/auth](http://localhost:8010/auth)  
> public-client: true  
> resource: shinyproxy  
> credentials-secret: c9e16dd7-95f1-4e81-96f2-a018ac105e40
> 
> logging:  
> file:  
> shinyproxy.log

This is my docker-compose file:

> version: ‘3’
> 
> services:  
> keycloak:  
> image: jboss/keycloak  
> ports:  
> - ‘8010:8080’  
> networks:  
> - sp-example-net  
> environment:  
> PROXY\_ADDRESS\_FORWARDING: “True”  
> shinyproxy:  
> image: shinyproxy-example  
> ports:  
> - ‘8020:8080’  
> networks:  
> - sp-example-net  
> volumes:  
> - /var/run/docker.sock:/var/run/docker.sock  
> networks:  
> sp-example-net:  
> external: true

---

<div class="post-metadata">

**Author:** ![fmichielssen](https://support.openanalytics.eu/user_avatar/support.openanalytics.eu/fmichielssen/32/1088_2.png) [@fmichielssen](https://support.openanalytics.eu/u/fmichielssen)\
**Post date:** [February 7, 2019, 10:53am UTC](https://support.openanalytics.eu/t/keycloak-failed-to-turn-code-into-token-connection-refused/938/3 "2019-02-07T10:53:56Z")

</div>

Hi @ana,

The error is caused by the fact that shinyproxy cannot access keycloak using the URL `http://localhost:8080/auth/...`

Note that this URL (which is set by `proxy.keycloak.auth-server-url`) is used for several purposes:

- The auth endpoint, accessed by the client: Shinyproxy will send the user there (via a redirect from `/login`) to authenticate
- The token endpoint, accessed by Shinyproxy: After the user returns from authentication carrying an auth code, Shinyproxy will contact the token endpoint to validate the code and turn it into a secret access token.

In your scenario, the error happens at the token endpoint, because shinyproxy cannot connect to keycloak using the `localhost` interface: they are different containers each having their own `localhost`.

One possible solution would be to attach the Shinyproxy container to the `host` network. But since it also needs to be on the `sp-example-net` network to communicate with the shiny containers, you have to attach it there as well.

When done manually in docker, this would be:  
`docker run ... --name="sp-container" --network="host"`  
`docker network connect sp-example-net sp-container`  
I’m not sure how to accomplish this in docker-compose.

---

<div class="post-metadata">

**Author:** ![ana](https://support.openanalytics.eu/letter_avatar_proxy/v4/letter/a/a6a055/32.png) [@ana](https://support.openanalytics.eu/u/ana)\
**Post date:** [February 7, 2019, 3:09pm UTC](https://support.openanalytics.eu/t/keycloak-failed-to-turn-code-into-token-connection-refused/938/4 "2019-02-07T15:09:41Z")

</div>

Hi @fmichielssen,

Thank you!!!

I am going to try that.

I tried the same configuration in another computer and the application is working. The new computer has Windows 10 Home, so I had to install Docker Toolbox.  
The another computer where the application doesn’t work has Windows 10 Education.

This is very strange ☹

---

<div class="post-metadata">

**Author:** ![BeaGy](https://support.openanalytics.eu/user_avatar/support.openanalytics.eu/beagy/32/415_2.png) [@BeaGy](https://support.openanalytics.eu/u/BeaGy)\
**Post date:** [August 13, 2020, 4:08pm UTC](https://support.openanalytics.eu/t/keycloak-failed-to-turn-code-into-token-connection-refused/938/5 "2020-08-13T16:08:59Z")

</div>

Hi @ana,

I am getting the exact same error, and my docker-compose and application.yml is very similar to yours. I was wondering if you have found a solution since.

---

<div class="post-metadata">

**Author:** ![mickey-ng](https://support.openanalytics.eu/user_avatar/support.openanalytics.eu/mickey-ng/32/750_2.png) [@mickey-ng](https://support.openanalytics.eu/u/mickey-ng)\
**Post date:** [September 26, 2022, 6:05pm UTC](https://support.openanalytics.eu/t/keycloak-failed-to-turn-code-into-token-connection-refused/938/6 "2022-09-26T18:05:39Z")

</div>

Any updates to this? I am running into the same problem.