It is not possible to access Gitea API using token, issued by external oauth2 provider (e.g. Keycloak)

[daniil-pankratov]

• Gitea version (or commit ref): 1.12.5
• Git version:
• Operating system:
• Database (use [x]):
  • PostgreSQL
  • MySQL
  • MSSQL
  • SQLite
• Can you reproduce the bug at https://try.gitea.io:
  • Yes (provide example URL)
  • No
• Log gist:

Description

...

Screenshots

[dfelski]

I have exactly the same issue. A Keycloak instance is running as OAuth2 authentication source and the web UI access works fine, but Restful API calls using bearer token are always answered with "unauthorized".

[6543]

I'm not sure - never tryed

[techknowlogick]

Keycloak doesn't generate Gitea API tokens. Just like you wouldn't expect Twitter API tokens to work with Gitea. If they did we would have to pass each token provided to us upstream to each external auth system to verify the token is valid.

If you would like passthrough authentication I recommend looking at using LDAP.

[dfelski]

But Twitter doesn't support authentication via external OAuth2 provider, right? What's the issue with the usage of the access tokens here like the UI does?