JWK refresh error KeyCloak + Hasura

[089-ilya]

Help me to understand what is the problem please!
I am using KeyCloak as auth server.
Starting Hasura with
HASURA_GRAPHQL_JWT_SECRET: '{"jwk_url": "https://*/realms/avcab/protocol/openid-connect/certs"}' parameter.
Url returns something like:

{ "keys": [ { "kid": "HXIMzBTS0xRnW6ZAJLMhQJ5d0beXI61NkcHjY5fQjzs", "kty": "RSA", "alg": "RSA-OAEP", "use": "enc", "n": "uefxjWeMnXQmF_J6Qw_niHCdVdGV59UmqO93XQaLOvKixtCypA1WA_nOiPspX-AP8EKFvBf9URTpNDCm2VTh47VCUNUyG3QOxhWrFjSAuX0i_1-l9KixsKztAnykUtZ7ZDgE-4DNLvjn0B-CD-eEnuNL869tpVgBRfqoMTt9Z-WIXg2drhlrllCf-wKBB0KsU498ju988POxDHyI75QmnEj3NEKExucyqhliVhgfWzxBynQKGoFBwcJQ-CWVoxVX5IREIoXUWIq-wQ7qXdOXuQeoH9-KgE6VobAX-6_Xxr3u7YCUB-2WRYNh-Mow-5Gdx16SDlCzUji94-lEta_-lQ", "e": "AQAB", "x5c": [ "MIICmTCCAYECBgGL0qRhQjANBgkqhkiG9w0BAQsFADAQMQ4wDAYDVQQDDAVhdmNhYjAeFw0yMzExMTUxMDU5MzBaFw0zMzExMTUxMTAxMTBaMBAxDjAMBgNVBAMMBWF2Y2FiMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuefxjWeMnXQmF/J6Qw/niHCdVdGV59UmqO93XQaLOvKixtCypA1WA/nOiPspX+AP8EKFvBf9URTpNDCm2VTh47VCUNUyG3QOxhWrFjSAuX0i/1+l9KixsKztAnykUtZ7ZDgE+4DNLvjn0B+CD+eEnuNL869tpVgBRfqoMTt9Z+WIXg2drhlrllCf+wKBB0KsU498ju988POxDHyI75QmnEj3NEKExucyqhliVhgfWzxBynQKGoFBwcJQ+CWVoxVX5IREIoXUWIq+wQ7qXdOXuQeoH9+KgE6VobAX+6/Xxr3u7YCUB+2WRYNh+Mow+5Gdx16SDlCzUji94+lEta/+lQIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQCxz6+6IPs1DuU2QLQ1gWugiVkD65oWaOEvnpyp87U5gkWP4zvW/dhoMk2JOiR4PnjMKshoiopAnU/WgWfyggznmPD9HCd6nURkULMxGCD0VbfCZQvPPNA5ZZaOPm3TdhkWJvHSsPGoC25bRU0wRxP+SKfFhSpF4YLWGOmU+tJgu4u/q4bHEV4x+sfWJXxWGw4bXzFsYXcjB9UKzATS6Kmm5yag4DbuPuYMqgFWNfMFRPW+SosnY6ObxQtrLY4lBySa9ML3jB9UaHbYh5H147FwE4e1rN1iq8ai6UwD003Q4q8hVqWeeGwEeUJYGnnPAOwclSXKwtquFG4w4Nk2E1oC" ], "x5t": "N3opiqI2q3RNg4AaK585-ULLwJQ", "x5t#S256": "_M-N4-p4GcdPsDPO_AiUM0hsJUYHrLTBrPjr564gCUs" }, { "kid": "N2UlhDE4NNpd2AWisQkw9xQljPLx1tb6xJluhjgQKfY", "kty": "RSA", "alg": "RS256", "use": "sig", "n": "0_jkW7TqrC1BF-V1-vT_qaXL8FmOJIgvFzF8xaPcbri2SeeAxHJEEmDggL5rJn45KDIFr4E3fAVK8WveseB-ETQyhk62kmms1lVrt6nXAyKU0T2VFeBjbxvESO35ELN_Df91go3RqvcTa4Vh7RFSj0M9aLWJuU-xoRiQpJGVfYfAWtq84FSwE2CKrb0XYc0gRHCNG7Xql7L3BtAjB9l1QpAcP4ZOB3IOUVfrOtcSPjQr37xIyKicbGn5C6EgZtdhPiygDPrrbt68ajGNz3azjLCboXLNB0z9_4gW4YJPgl0zxQFgFaVrtwLz_PPq9mB8Row1sPOhiWdEpj4xRafrQQ", "e": "AQAB", "x5c": [ "MIICmTCCAYECBgGL0qRgiTANBgkqhkiG9w0BAQsFADAQMQ4wDAYDVQQDDAVhdmNhYjAeFw0yMzExMTUxMDU5MjlaFw0zMzExMTUxMTAxMDlaMBAxDjAMBgNVBAMMBWF2Y2FiMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0/jkW7TqrC1BF+V1+vT/qaXL8FmOJIgvFzF8xaPcbri2SeeAxHJEEmDggL5rJn45KDIFr4E3fAVK8WveseB+ETQyhk62kmms1lVrt6nXAyKU0T2VFeBjbxvESO35ELN/Df91go3RqvcTa4Vh7RFSj0M9aLWJuU+xoRiQpJGVfYfAWtq84FSwE2CKrb0XYc0gRHCNG7Xql7L3BtAjB9l1QpAcP4ZOB3IOUVfrOtcSPjQr37xIyKicbGn5C6EgZtdhPiygDPrrbt68ajGNz3azjLCboXLNB0z9/4gW4YJPgl0zxQFgFaVrtwLz/PPq9mB8Row1sPOhiWdEpj4xRafrQQIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQC1DTqq+lUNQgiG/d2qJg+bLs0byrk+ZixyQPLu468BPMdsM5cJugrUqDOo8ivBA9J4HwB/r0LInnrsdMabeS6JYYF9KLz6DAJRQnnI4vRPMNUD27J2JaBbmH8sHvHiFNGHRGyR+tRDx4NFn1SJw55kNr62zdCJ3wegFkSLd7soKavIddOkAA+0AyJlP8xI/g01LD1sqd9QF5WUyS/rQmYz+FHN1mvTOJFqfJ3y8wik9zb2V7ALDD9TVI1hoMBbh7veaC7AE9pWC/Uy138+aVHXqnSS+vQOWDeLC6svxyrZl7pj5Udj23X/83Leyc0LqhdM2/HdbKTOaonRMBkBSoAH" ], "x5t": "hcRgx8iskFeRbEK-MOTSJoTTSZc", "x5t#S256": "8dNyLHEVtU18ZJD73YFFrPjvITJAUvgiOtJFI55oH0o" } ] }

But Hasura is throwing errors:
{"detail":{"error":null,"message":"refreshing JWK from endpoint: https://176.3.147.222:8080/realms/avcab/protocol/openid-connect/certs"},"level":"info","timestamp":"2023-11-16T11:59:02.321+0000","type":"jwk-refresh-log"} {"detail":"Thread SchemeUpdate.listener (re)started","level":"info","timestamp":"2023-11-16T11:59:02.321+0000","type":"unstructured"} {"detail":{"error":{"http_exception":{"message":"Internal Exception","request":{"host":"176.3.147.222","method":"GET","path":"/realms/avcab/protocol/openid-connect/certs","port":8080,"queryString":"","requestHeaders":{"Content-Type":"application/json","User-Agent":"hasura-graphql-engine/v2.35.1"},"responseTimeout":"ResponseTimeoutDefault","secure":true},"type":"http_exception"}},"message":null},"level":"critical","timestamp":"2023-11-16T11:59:02.321+0000","type":"jwk-refresh-log"} {"detail":"Stopping immortal SchemeUpdate.listener thread","level":"info","timestamp":"2023-11-16T11:59:02.321+0000","type":"unstructured"} Error fetching JWK: InternalException (HandshakeFailed (Error_Packet_Parsing "Failed reading: invalid header type: 72\nFrom:\theader\n\n"))

[mnp]

I am seeing exactly this as well. I can shell into the Hasura container and from there, curl the Keycloak endpoint it's complaining about just fine.