From f9b73fda9f67a2d52f7c8abb1503cb7194872ee7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?St=C3=A9phane=20Tailland?= Date: Fri, 28 Aug 2026 11:09:39 +0200 Subject: [PATCH] fix(llm): validate tokens against the classic-models realm, not the stale VPS one MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The AI gateway's openid-connect plugin still carried the cluster-wide dataplane-template-defaults issuer, https://keycloak.sttlab.eu/realms/sttlab. Every other domain gateway overrides it to the lab realm; this one was missed. The plugin therefore fetched JWKS from a realm that never signed the token and rejected it with "invalid signature", which reaches the caller as a bare 401 "Authentication required". Combined with the missing llm-proxy audience in the realm, the OIDC path on this gateway had never authenticated anyone — only the key-auth path LibreChat uses was ever exercised. Co-Authored-By: Claude Opus 5 --- dev/proxy-kustomization.yaml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/dev/proxy-kustomization.yaml b/dev/proxy-kustomization.yaml index 766595f..59036f9 100644 --- a/dev/proxy-kustomization.yaml +++ b/dev/proxy-kustomization.yaml @@ -21,7 +21,12 @@ spec: NAME: llm-dev NAMESPACE: llm CONTROL_PLANE_REF_NAME: llm-dev-cp - OIDC_ISSUER: https://keycloak.sttlab.eu/realms/sttlab + # The classic-models realm on the lab Keycloak, not the stale VPS realm + # inherited from dataplane-template-defaults. Every domain gateway + # overrides it the same way; this one was missed, so its openid-connect + # plugin validated against the wrong JWKS and answered 401 to every + # token — visible only as "invalid signature" in the gateway log. + OIDC_ISSUER: https://keycloak.sttlab.local/realms/classic-models AGENT_AUDIENCE: '["llm-proxy"]' OPENROUTER_UPSTREAM_URL: https://openrouter.ai/api/v1/chat/completions # Cost per 1M tokens for the model behind OPENROUTER_UPSTREAM_URL, used by