title: Keycloack: User is able to access a realm by logging to another
body: <p>I have an nginx/openresty client to a keycloack server for authorization using openid.
  I am using <a href="https://github.com/zmartzone/lua-resty-openidc" rel="nofollow noreferrer">lua-resty-openidc</a> to allow access to services behind the proxy.</p>
  <p>I have created two clients at two different realms for different services.</p>
  <p>The problem is that after a user gets authenticated at the first realm on e.g. <code>https://&lt;my-server&gt;/auth/realms/&lt;realm1&gt;/protocol/openid-connect/auth?response_type=code&amp;client_id=openresty&amp;state=...........</code>, he is able to directly access the other service at <code>realm2</code> as well.</p>
  <p>What is going on here? How can I ensure that the user will only be able to access the client at the realm he authenticated against?</p>
  <p>How can I ensure that after logout the user will no longer be able to get access until he logs in anew?</p>
  <p>[Edit-details]
  My nginx.conf for the two services is bellow.
  The user first accesses  <code>https://&lt;my-server&gt;/service_1/</code>
  and is redirected to keycloack to give his password for realm1. He provides it and is able to access service_1.</p>
  <p>However, if after that he tries to access <code>https://&lt;my-server&gt;/service_2/</code>, he no longer has to authenticate, but can login although the service_2 is about a client on a different realm, with a different client_secret!</p>
  <p>.....
  location /service_1/ {</p>
  <pre><code>    access_by_lua_block {
          local opts = {
              redirect_uri_path = &quot;/service_1/auth&quot;, -- we are send here after auth
              discovery = &quot;https://&lt;my-server&gt;/keycloak/auth/realms/realm1/.well-known/openid-configuration&quot;,
              client_id = &quot;openresty&quot;,
              client_secret = &quot;&lt;client1-secret&gt;&quot;,
              session_contents = {id_token=true} -- this is essential for safari!
          }
          -- call introspect for OAuth 2.0 Bearer Access Token validation
          local res, err = require(&quot;resty.openidc&quot;).authenticate(opts)
  
          if err then
              ngx.status = 403
              ngx.say(err)
              ngx.exit(ngx.HTTP_FORBIDDEN)
          end
      }
  
      # I disabled caching so the browser won't cache the site.
      expires           0;
      add_header        Cache-Control private;
  
      proxy_pass http://&lt;server-for-service1&gt;:port1/foo/;
      proxy_set_header Host $http_host;
  
      proxy_http_version 1.1;
      proxy_redirect off;
      proxy_buffering off;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection &quot;upgrade&quot;;
  
  }
  </code></pre>
  <p>..........................</p>
  <pre><code>location /service_2/ {
  
      access_by_lua_block {
          local opts = {
              redirect_uri_path = &quot;/service_2/auth&quot;, -- we are send here after auth
              discovery = &quot;https://&lt;my-server&gt;/keycloak/auth/realms/realm2/.well-known/openid-configuration&quot;,
              client_id = &quot;openresty&quot;,
              client_secret = &quot;client2-secret&quot;,
              session_contents = {id_token=true} -- this is essential for safari!
          }
          -- call introspect for OAuth 2.0 Bearer Access Token validation
          local res, err = require(&quot;resty.openidc&quot;).authenticate(opts)
  
          if err then
              ngx.status = 403
              ngx.say(err)
              ngx.exit(ngx.HTTP_FORBIDDEN)
          end
      }
  
      # I disabled caching so the browser won't cache the site.
      expires           0;
      add_header        Cache-Control private;
  
      proxy_pass http://&lt;server-for-service2&gt;:port2/bar/;
      proxy_set_header Host $http_host;
  
      proxy_http_version 1.1;
      proxy_redirect off;
      proxy_buffering off;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection &quot;upgrade&quot;;
  
  }
  </code></pre>
  <p>[Edit-details 2]</p>
  <p>I am using lua resty openidc version 1.7.2, but everything I write should stand for 1.7.4 based on the diff of the two version's code.</p>
  <p>I can clearly see from the debug level logs that the session is created during the first access, and then reused on the second realm, which is wrong, as the second access still has a token for the first realm... Here is what the authorization for <strong>realm2</strong> looks like...:</p>
  <pre><code>2021/04/28 12:56:41 [debug] 2615#2615: *4617979 [lua] openidc.lua:1414: authenticate(): session.present=true, session.data.id_token=true, session.data.authenticated=true, opts.force_reauthorize=nil, opts.renew_access_token_on_expiry=nil, try_to_renew=true, token_expired=false
  2021/04/28 12:56:41 [debug] 2615#2615: *4617979 [lua] openidc.lua:1470: authenticate(): id_token={&quot;azp&quot;:&quot;realm1&quot;,&quot;typ&quot;:&quot;ID&quot;,&quot;iat&quot;:1619614598,&quot;iss&quot;:&quot;https:\/\/&lt;myserver&gt;\/keycloak\/auth\/realms\/realm1&quot;,&quot;aud&quot;:&quot;realm1&quot;,&quot;nonce&quot;:&quot;8c8ca2c4df2...b26&quot;
  ,&quot;jti&quot;:&quot;1c028c65-...0994f&quot;,&quot;session_state&quot;:&quot;0e1241e3-66fd-4ca1-a0dd-c0d1a6a5c708&quot;,&quot;email_verified&quot;:false,&quot;sub&quot;:&quot;25303e44-...e2c1757ae857&quot;,&quot;acr&quot;:&quot;1&quot;,&quot;preferred_username&quot;:&quot;logoutuser&quot;,&quot;auth_time&quot;:1619614598,&quot;exp&quot;:1619614898,&quot;at_hash&quot;:&quot;5BNT...j414r72LU6g&quot;}
  </code></pre>