IDX20803: Unable to obtain configuration from: 'http://keycloak:8080/realms/main/.well-known/openid-configuration'.

The message continues with "Will retry at '…'. Exception: '…'" and the inner exception text. The URL is your `Authority` + `/.well-known/openid-configuration` or your `MetadataAddress`.

Microsoft.IdentityModel.Protocols (.NET) — ConfigurationManager<OpenIdConnectConfiguration>, used by JwtBearer and OpenIdConnect handlers

What it means

The configuration manager could not download (or parse) the OpenID Connect discovery document, so the JWT bearer or OpenID Connect handler has no issuer and no signing keys. Every token is then rejected, typically followed by IDX10500/IDX10503 errors. The real reason is in the inner exception: IDX20108 when the metadata address is plain HTTP while HTTPS is required, IDX20804 with a network or TLS error otherwise.

Why it happens

• HTTP metadata address with RequireHttpsMetadata on

  common

  Local Keycloak or IdentityServer containers are often reached as `http://service:8080`. `RequireHttpsMetadata` is true by default, so the retriever refuses the address before connecting (IDX20108).

• The authority is unreachable from the API

  common

  DNS that resolves only outside the cluster, a firewall or egress proxy, or a container network where `localhost` means the container itself.

• TLS certificate not trusted

  occasional

  Self-signed or internal-CA certificates on the identity provider fail the HTTPS request inside the API container unless that CA is installed there.

• Wrong authority path

  occasional

  A missing `/realms/<name>` (Keycloak), tenant ID or `/v2.0` (Entra ID) gives 404 for the discovery URL.

How to fix it

1. 1.

   Allow HTTP metadata only in development

   Tie `RequireHttpsMetadata = false` to the development environment; in production the authority must be HTTPS, because the keys you download decide which tokens you accept.

   builder.Services.AddAuthentication().AddJwtBearer(options =>
   {
       options.Authority = builder.Configuration["Auth:Authority"];
       // Plain HTTP only for local development containers; production authorities must be HTTPS.
       options.RequireHttpsMetadata = !builder.Environment.IsDevelopment();
   });

2. 2.

   Fetch the URL from where the API runs

   Run the request inside the API's container or pod. A 200 with JSON confirms network and TLS; anything else names the layer to fix.

   # From inside the API container: DNS, TLS and HTTP status of the metadata URL
   curl -sS -o /dev/null -w '%{http_code} %{ssl_verify_result}\n' https://login.example.com/realms/main/.well-known/openid-configuration

← Browse the full signature error database