[SOLVED] keycloak gatekeeper 404 after credentials

I have a backend hello world app, using the following ACLS

match-claims:
  aud: appserver
  iss: http://192.168.1.132/auth/realms/master

resources:
  - uri: /app
    methods:
      - GET
    roles:
      - user
    require-any-role: true

causes 404 right after login, with the following logs


gatekeeper_1      | 1.5576708594647906e+09      error   keycloak-gatekeeper/middleware.go:108   no session found in request, redirecting for authorization   {"error": "authentication session not found"} 
nginx_1           | 172.23.0.1 - - [12/May/2019:22:20:59 +0800] "GET /app HTTP/1.1" 307 95 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.131
Safari/537.36"
gatekeeper_1      | 1.5576708594775462e+09      debug   keycloak-gatekeeper/handlers.go:88      incoming authorization request from client address   {"access_type": "", "auth_url": "http://192.168.1.132/auth/realms/master/protocol/openid-connect/auth?client_id=appserver&redirect_uri=http%3A%2F%2Flocalhost%2Foauth%2Fcallback&response_type=code&scope=openid+email+profile&state=9e9edff9-b532-45e8-8b57-ed30783b38d6", "client_ip": "172.23.0.6:42310"}
nginx_1           | 172.23.0.1 - - [12/May/2019:22:20:59 +0800] "GET /oauth/authorize?state=9e9edff9-b532-45e8-8b57-ed30783b38d6 HTTP/1.1" 307 284 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.131 Safari/537.36"
nginx_1           | 172.23.0.1 - - [12/May/2019:22:20:59 +0800] "GET /auth/realms/master/protocol/openid-connect/auth?client_id=appserver&redirect_uri=http%3A%2F%2Flocalhost%2Foauth%2Fcallback&response_type=code&scope=openid+email+profile&state=9e9edff9-b532-45e8-8b57-ed30783b38d6 HTTP/1.1" 302 0 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.131 Safari/537.36"
nginx_1           | 172.23.0.1 - appserver [12/May/2019:22:20:59 +0800] "POST /auth/realms/master/protocol/openid-connect/token HTTP/1.1" 200 3507 "-" "Go-http-client/1.1"                                
gatekeeper_1      | 1.557670859584654e+09       info    keycloak-gatekeeper/handlers.go:167     issuing access token for user        {"email": "benjamin.hon@biomind.ai", "expires": "2019-05-12T14:21:59Z", "duration": "59.4153639s"}
nginx_1           | 172.23.0.1 - - [12/May/2019:22:20:59 +0800] "GET /oauth/callback?state=9e9edff9-b532-45e8-8b57-ed30783b38d6&session_state=bea8afff-1137-4a60-beb5-cf05a9974b34&code=ce737cdb-f3b2-4c8f-9198-5f5e0d80e2f4.bea8afff-1137-4a60-beb5-cf05a9974b34.10d7e9eb-226b-4ac8-890e-6c640ab53059 HTTP/1.1" 307 37 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.131 Safari/537.36"
nginx_1           | 172.23.0.1 - - [12/May/2019:22:20:59 +0800] "GET / HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.131 Safari/537.36"
nginx_1           | 172.23.0.1 - - [12/May/2019:22:20:59 +0800] "GET /auth/realms/master/protocol/openid-connect/auth?client_id=appserver&redirect_uri=http%3A%2F%2Flocalhost%2Foauth%2Fcallback&response_type=code&scope=openid+email+profile&state=9e9edff9-b532-45e8-8b57-ed30783b38d6 HTTP/1.1" 302 0 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.131 Safari/537.36"
nginx_1           | 172.23.0.1 - appserver [12/May/2019:22:20:59 +0800] "POST /auth/realms/master/protocol/openid-connect/token HTTP/1.1" 200 3507 "-" "Go-http-client/1.1"                                
gatekeeper_1      | 1.5576708598920956e+09      info    keycloak-gatekeeper/handlers.go:167     issuing access token for user        {"email": "benjamin.hon@biomind.ai", "expires": "2019-05-12T14:21:59Z", "duration": "59.107928s"}
nginx_1           | 172.23.0.1 - - [12/May/2019:22:20:59 +0800] "GET /oauth/callback?state=9e9edff9-b532-45e8-8b57-ed30783b38d6&session_state=bea8afff-1137-4a60-beb5-cf05a9974b34&code=fc79909a-3b36-4140-ac6a-cc340b621398.bea8afff-1137-4a60-beb5-cf05a9974b34.10d7e9eb-226b-4ac8-890e-6c640ab53059 HTTP/1.1" 307 37 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.131 Safari/537.36"

However, it works if i use the follow ACLS

resources:
  - uri: /app
    methods:
      - GET
    white-listed: true

I've checked everything, the roles are assigned and created.

This is the JWT i get after logging in

{
  "jti": "04de181a-bf9a-4db3-bfcc-006a12d00892",
  "exp": 1557672962,
  "nbf": 0,
  "iat": 1557672902,
  "iss": "http://192.168.1.132/auth/realms/master",
  "aud": [
    "account",
    "appserver"
  ],
  "sub": "d7a580b3-7987-40fa-905d-5be1662392ee",
  "typ": "Bearer",
  "azp": "appserver",
  "auth_time": 1557672902,
  "session_state": "71353c04-3e7c-4cf4-9203-fea485990fe9",
  "acr": "1",
  "realm_access": {
    "roles": [
      "offline_access",
      "uma_authorization",
      "user"
    ]
  },
  "resource_access": {
    "account": {
      "roles": [
        "manage-account",
        "manage-account-links",
        "view-profile"
      ]
    }
  },
  "scope": "openid profile email",
  "email_verified": true,
  "name": "john doe",
  "preferred_username": "john",
  "given_name": "john",
  "family_name": "doe",
  "email": "xxx"
}

It seems to me that the authentication is working, but after the authorization, it seems to not redirect it to the internal proxy of the backend app, but to http://localhost instead?

I don't really know how to debug this though, any help will be appreciated!