Stéphane Tailland
f9b73fda9f
The AI gateway's openid-connect plugin still carried the cluster-wide dataplane-template-defaults issuer, https://keycloak.sttlab.eu/realms/sttlab. Every other domain gateway overrides it to the lab realm; this one was missed. The plugin therefore fetched JWKS from a realm that never signed the token and rejected it with "invalid signature", which reaches the caller as a bare 401 "Authentication required". Combined with the missing llm-proxy audience in the realm, the OIDC path on this gateway had never authenticated anyone — only the key-auth path LibreChat uses was ever exercised. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>