Keycloak either only works via hostname or also via localhost, but admin console does not load #15332

BR14Nx · 2022-11-03T16:33:29Z

BR14Nx
Nov 3, 2022

I am looking forward to get keycloak into production mode in our internal server network. DNS is set up so far.

It is not possible for me to enter the admin console via localhost and externally via hostname.domain at the same time on production mode. Is it intended to be like this?

Because I have different behaviors that never allow both access options:

Without KC_PROXY the admin console is working, but the frontend is no more reachable by localhost.
With KC_PROXY: reencrypt or passthrough -> Production mode only working externally with giving :8443 port to url. Though admin console is not loading. (What should I do to avoid typing :8443 every time?)
With KC_PROXY: edge -> Production mode also works internally. Though admin console is not loading.
KC_HOSTNAME_STRICT can be on any value apparently.

Nevertheless the developement mode allows me to enter the admin console anywhere without problems.

None of the Docker-Compose files I found were working, so I had to figure it out by myself. My Docker compose file is as follows:

version: '3.9'

volumes:
  postgres_data:
    driver: local

services:
  postgres:
    image: postgres:13.2
    restart: unless-stopped
    volumes:
        - postgres_data:/var/keycloak/postgresql/data
    env_file:
      - keycloak.env
    environment:
      POSTGRES_DB: ${POSTGRESQL_DB}
      POSTGRES_USER: ${POSTGRESQL_USER}
      POSTGRES_PASSWORD: ${POSTGRESQL_PASS}

  keycloak:
    image: quay.io/keycloak/keycloak:${KEYCLOAK_VERSION}
    container_name: keycloak
    volumes:
      - /var/keycloak/certs/:/etc/x509/https
    restart: unless-stopped
    env_file:
      - keycloak.env
    environment:
      KEYCLOAK_ADMIN: ${KEYCLOAK_USER}
      KEYCLOAK_ADMIN_PASSWORD: ${KEYCLOAK_PASS}
      KC_HTTPS_CERTIFICATE_FILE: /etc/x509/https/fullchain.pem
      KC_HTTPS_CERTIFICATE_KEY_FILE: /etc/x509/https/privkey.pem
      KC_HOSTNAME: ${KEYCLOAK_HOSTNAME}
      DB_VENDOR: postgres
      DB_ADDR: postgres
      DB_DATABASE: ${POSTGRESQL_DB}
      DB_USER: ${POSTGRESQL_USER}
      DB_PASSWORD: ${POSTGRESQL_PASS}
    entrypoint: /opt/keycloak/bin/kc.sh start
    ports:
      - 8080:8080
      - 8443:8443
    depends_on:
      - postgres

Answered by DAHAG-ArisNourbakhsh

Nov 7, 2022

It is not possible for me to enter the admin console via localhost and externally via hostname.domain at the same time on production mode. Is it intended to be like this?

I'm pretty sure that this is by design. In any non proxy=edge sceneraio keycloak strictly enforces the correct domain for security and ssl reasons. My only recommendation would be to not use localhost to access your production deployment and instead use the actual dns

View full answer

DAHAG-ArisNourbakhsh · 2022-11-07T16:33:48Z

DAHAG-ArisNourbakhsh
Nov 7, 2022

It is not possible for me to enter the admin console via localhost and externally via hostname.domain at the same time on production mode. Is it intended to be like this?

I'm pretty sure that this is by design. In any non proxy=edge sceneraio keycloak strictly enforces the correct domain for security and ssl reasons. My only recommendation would be to not use localhost to access your production deployment and instead use the actual dns

0 replies

Navigation Menu

Repository navigation

Keycloak either only works via hostname or also via localhost, but admin console does not load #15332

Uh oh!

{{title}}

Uh oh!

Replies: 1 comment

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Keycloak either only works via hostname or also via localhost, but admin console does not load #15332

Uh oh!

BR14Nx Nov 3, 2022

Replies: 1 comment

Uh oh!

DAHAG-ArisNourbakhsh Nov 7, 2022

BR14Nx
Nov 3, 2022

DAHAG-ArisNourbakhsh
Nov 7, 2022