# controller-oidc-proxy：net::ERR\_CONNECTION\_REFUSED **URL:** \ **Category:** BrowZer\ **Created:** [August 12, 2025, 6:36am UTC](https://openziti.discourse.group/t/controller-oidc-proxy-net-err-connection-refused/4991 "2025-08-12T06:36:38Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![McGonagall666](https://avatars.discourse-cdn.com/v4/letter/m/51bf81/32.png) [@McGonagall666](https://openziti.discourse.group/u/McGonagall666)\ **Post date:** [August 12, 2025, 6:36am UTC](https://openziti.discourse.group/t/controller-oidc-proxy-net-err-connection-refused/4991/1 "2025-08-12T06:36:38Z")
controller version: 1.5.4 browZer version: latest controller-oidc-proxy urlWithParams："[https://ctrl.mmtest.com:1280/oidc/authorize?client\_id=openziti&scope=openid%20offline\_access&response\_type=code&redirect\_uri=https%3A%2F%2Fzf-svc.mmtest.com&code\_challenge=jVbB2hr5SPKZk6FxYS4C4SsS0yPazQinJZ0egy2TU5g&code\_challenge\_method=S256&audience=openziti&state=SesodjUEQZWOJjPiV9Ln4eBmaarQtki0lwi4PVM3dlU](https://ctrl.mmtest.com:1280/oidc/authorize?client_id=openziti&scope=openid%20offline_access&response_type=code&redirect_uri=https%3A%2F%2Fzf-svc.mmtest.com&code_challenge=jVbB2hr5SPKZk6FxYS4C4SsS0yPazQinJZ0egy2TU5g&code_challenge_method=S256&audience=openziti&state=SesodjUEQZWOJjPiV9Ln4eBmaarQtki0lwi4PVM3dlU)" ```auto The requested redirect_uri is missing in the client configuration. If you have any questions, you may contact the administrator of the application. ``` ![image](https://global.discourse-cdn.com/free1/uploads/netfoundry/original/2X/3/3fef9fe79a7da2f3e439ae46553e9605bb311512.png) ![image](https://global.discourse-cdn.com/free1/uploads/netfoundry/original/2X/f/f3bff0f30c5f800f6e7ed45da730d1eba3d33fca.png) ![image](https://global.discourse-cdn.com/free1/uploads/netfoundry/original/2X/9/9ad7502675dac810684f451f188200854bb26c18.png) ![image](https://global.discourse-cdn.com/free1/uploads/netfoundry/original/2X/b/b55c29a8cb1379b4e726961fba9c020c859543e1.png) ![image](https://global.discourse-cdn.com/free1/uploads/netfoundry/original/2X/9/9a5e5dc9d867633e73731f1a7b976218dce06c2a.png) ---
**Author:** ![McGonagall666](https://avatars.discourse-cdn.com/v4/letter/m/51bf81/32.png) [@McGonagall666](https://openziti.discourse.group/u/McGonagall666)\ **Post date:** [August 12, 2025, 8:42am UTC](https://openziti.discourse.group/t/controller-oidc-proxy-net-err-connection-refused/4991/2 "2025-08-12T08:42:02Z")
i find ctrl log [136.467] DEBUG ziti/controller/env.(\*AppEnv).getJwtTokenFromRequest: {error=[token is unverifiable: error while executing keyfunc: key for kid 90by2k\_tMGWtbYi9ng8LHIEG3vfL3a6L198ex9dPXek, not found]} JWT provided that did not parse and verify against controller public keys, skipping but keycloak certs have 90by2k\_tMGWtbYi9ng8LHIEG3vfL3a6L198ex9dPXek ![image](https://global.discourse-cdn.com/free1/uploads/netfoundry/original/2X/a/ae3d13966a28a43ad5d8bcbf736d55572aaae850.jpeg) ---
**Author:** ![TheLumberjack](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/thelumberjack/32/113_2.png) [@TheLumberjack](https://openziti.discourse.group/u/TheLumberjack)\ **Post date:** [August 13, 2025, 9:09am UTC](https://openziti.discourse.group/t/controller-oidc-proxy-net-err-connection-refused/4991/3 "2025-08-13T09:09:12Z")
Hi @McGonagall666, is your Keycloak server using a verifiable cert such as from ZeroSSL/LetsEncrypt? This sounds to me like the sort of problem where the controller doesn't trust the IdP and thus can't (well, _won't_) connect to the IdP to get the JWKS. My best guess is the keycloak server cert isn't able to be validated/verified by the controller, the controller can't/won't connect to the keycloak server, leading to "no results" when the controller tries to get the JWKS and leading to a "no kid found" type of error. ---
**Author:** ![McGonagall666](https://avatars.discourse-cdn.com/v4/letter/m/51bf81/32.png) [@McGonagall666](https://openziti.discourse.group/u/McGonagall666)\ **Post date:** [August 14, 2025, 1:13am UTC](https://openziti.discourse.group/t/controller-oidc-proxy-net-err-connection-refused/4991/4 "2025-08-14T01:13:48Z")
Thanks for your reply，I'm using a self-signed certificate, but I've trusted the certificate used by Keycloak using update-ca-certificates in the controller environment, and I still get this error. One more thing: I'm using an HA controller. I tested it and it works in single-controller mode, but not in HA mode. I'm not sure if the HA controller verification method has changed. The HA certificate is a sub-certificate generated by a trusted CA. ziti pki create ca --trust-domain [ctrl.mmtest.com](http://ctrl.mmtest.com) --pki-root ./pki --ca-file ca --ca-name 'HA Ctrl Trust Root' ---
**Author:** ![andrew.martinez](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/andrew.martinez/32/540_2.png) [@andrew.martinez](https://openziti.discourse.group/u/andrew.martinez)\ **Post date:** [August 14, 2025, 4:19am UTC](https://openziti.discourse.group/t/controller-oidc-proxy-net-err-connection-refused/4991/5 "2025-08-14T04:19:54Z")
This url `https://ctrl.mmtest.com:1280/oidc/authorize?client_id=openziti&scope=openid%20offline_access&response_type=code&redirect_uri=https%3A%2F%2Fzf-svc.mmtest.com&code_challenge=jVbB2hr5SPKZk6FxYS4C4SsS0yPazQinJZ0egy2TU5g&code_challenge_method=S256&audience=openziti&state=SesodjUEQZWOJjPiV9Ln4eBmaarQtki0lwi4PVM3dlU` Is going to this endpoint `https://ctrl.mmtest.com:1280/oidc/authorize` , which is the OpenZiti OIDC provider. Whatever is doing the OIDC flow with it is attempting to redirect to `https%3A%2F%2Fzf-svc.mmtest.com` (or `https://svc.mmtest.com` unescaped). The OpenZiti OIDC provider denies the redirect. OIDC providers usually have a whitelist of hostnames that are valid for redirects; otherwise, they can trick users into logging in and sending tokens to a host that will intercept them. You need to tell your Ziti controller to allow redirect to `svc.mmtest.com` . You do that in the controller config files. In the controler configs, there is a `web` section that will have one or more instances of the API binding `edge-oidc`. You need to add your redirect there if you want to send tokens to a relying party server at [svc.mmtest.com](http://svc.mmtest.com). It is, however, odd that you do not have a path on that redirect. Normally, I would expect to see a `/callback`, `oidc/callback`, `auth/callback`, etc. Whatever the case, the redirect needs to be added to the white list. It would look something like this: ```auto - binding: edge-oidc options: redirectURIs: - "http://localhost:*/auth/callback" - "http://127.0.0.1:*/auth/callback" - "https://svc.mmtest.com" ``` Again, I would expect a callback path in that configuration, but you didn’t provide one in your request URL at the top. So I don’t know what it should be. Maybe you are hosting a relying party on the root URL. I also do not know what browZer expects it to be - as that might be your browZer site. ---
**Author:** ![McGonagall666](https://avatars.discourse-cdn.com/v4/letter/m/51bf81/32.png) [@McGonagall666](https://openziti.discourse.group/u/McGonagall666)\ **Post date:** [August 14, 2025, 10:11am UTC](https://openziti.discourse.group/t/controller-oidc-proxy-net-err-connection-refused/4991/6 "2025-08-14T10:11:31Z")
Thank you very much. I added redirectURIs in ctrl.yaml,Now the problem has been solved. ---
**Author:** ![McGonagall666](https://avatars.discourse-cdn.com/v4/letter/m/51bf81/32.png) [@McGonagall666](https://openziti.discourse.group/u/McGonagall666)\ **Post date:** [August 27, 2025, 3:22am UTC](https://openziti.discourse.group/t/controller-oidc-proxy-net-err-connection-refused/4991/7 "2025-08-27T03:22:30Z")
![image](https://global.discourse-cdn.com/free1/uploads/netfoundry/original/2X/d/d9b3702a77719bb7f041758c5c97dcbf0e5bf36a.png)Why does this happen occasionally? My browzer uses a wildcard certificate \*.mytest.com. Is this related to it? browzer error log {"code":"ENOTFOUND","errno":-3008,"hostname":"\*.mytest.com","level":"error","message":"getaddrinfo ENOTFOUND \*.mytest.com","stack":"Error: getaddrinfo ENOTFOUND \*.mytest.com\n at GetAddrInfoReqWrap.onlookupall [as oncomplete] (node:dns:118:26)","syscall":"getaddrinfo","timestamp":"2025-08-27T03:13:46.489Z","version":"0.90.0"} other error,And the client agent will report an error half an hour after starting： ctrl[[https://ctrl2.mytest.com:1280/edge/client/v1](https://ctrl2.mytest.com:1280/edge/client/v1)] API request[/current-identity] failed code[UNAUTHORIZED] message[The request could not be completed. The session is not authorized or the credentials are invalid] failed to get identity\_data: The request could not be completed. The session is not authorized or the credentials are invalid[UNAUTHORIZED] update\_identity\_data() ztx[0] api session is no longer valid. Trying to re-auth auth error: The request could not be completed. The session is not authorized or the credentials are invalid controller connections failed: failed to authenticate context event : status is failed to authenticate ---
**Author:** ![McGonagall666](https://avatars.discourse-cdn.com/v4/letter/m/51bf81/32.png) [@McGonagall666](https://openziti.discourse.group/u/McGonagall666)\ **Post date:** [September 1, 2025, 7:30am UTC](https://openziti.discourse.group/t/controller-oidc-proxy-net-err-connection-refused/4991/8 "2025-09-01T07:30:51Z")
I solved both issues. The first, the browser controller-oidc-proxy error about wildcard domains, was caused by using a wildcard certificate in my controller's alt\_server\_certs. Deleting it fixed the problem. The second issue was resolved by adding this to the controller's YAML file: authRateLimiter: enabled: true minSize: 5 maxSize: 100 oidc: accessTokenDuration: 30m idTokenDuration: 30m refreshTokenDuration: 24h