diff --git a/docker/OpenResty-Orthanc-Keycloak/config/nginx.conf b/docker/OpenResty-Orthanc-Keycloak/config/nginx.conf
index 894b4e087..86b3665ae 100644
--- a/docker/OpenResty-Orthanc-Keycloak/config/nginx.conf
+++ b/docker/OpenResty-Orthanc-Keycloak/config/nginx.conf
@@ -75,30 +75,36 @@ http {
         location /pacs-admin/ {
           access_by_lua_block {
             local opts = {
-              redirect_uri = "http://127.0.0.1/callback",
+              redirect_uri = "http://127.0.0.1/pacs-admin/admin",
               discovery = "http://127.0.0.1/auth/realms/master/.well-known/openid-configuration",
+              token_endpoint_auth_method = "client_secret_basic",
               client_id = "pacs",
               client_secret = "a726f5b1-5abd-42c9-b7b1-53a1a17d2ad2",
+              client_jwt_assertion_expires_in = 60 * 60,
               ssl_verify = "no",
-              redirect_uri_scheme = "http"
+              scope = "openid email profile",
+              refresh_session_interval = 900,
+              redirect_uri_scheme = "http",
+              redirect_after_logout_uri = "/",
+              session_contents = {id_token=true}
             }
 
             -- call authenticate for OpenID Connect user authentication
             local res, err = require("resty.openidc").authenticate(opts)
 
-            -- check session, but do not redirect to auth if not already logged in
-            -- local res, err = require("resty.openidc").authenticate(opts, nil, "pass")
-
-            if err then
+            if err or not res then
               ngx.print(err)
               ngx.status = 200
-              ngx.say(err)
-              ngx.exit(ngx.HTTP_INTERNAL_SERVER_ERROR)
+              ngx.say(err and err or "no access_token provided")
+              ngx.exit(ngx.HTTP_FORBIDDEN)
             end
 
+            -- Or set cookie?
+            -- ngx.req.set_header("Authorization", "Bearer " .. res.access_token)
             ngx.req.set_header("X-USER", res.id_token.sub)
           }
 
+
           proxy_http_version 1.1;
 
           proxy_set_header Host               $host;