Unable to use Keycloak behind proxy (invalid redirect uri) #10663

gardellajuanpablo · 2022-03-09T13:05:48Z

gardellajuanpablo
Mar 9, 2022

Hi,

I am trying to update to version 17.0.0 from 16.1.0 and I am unable to make it work behind proxy. Below docker file:

FROM quay.io/keycloak/keycloak: as builder

ENV KC_METRICS_ENABLED=true
ENV KC_FEATURES=authorization, account2, account-api, admin-fine-grained-authz, admin2, docker, impersonation, token-exchange, client-policies, declarative-user-profile, dynamic-scopes, preview
ENV KC_DB=${KC_DB}
ENV KC_CACHE=local
ENV KC_HTTP_RELATIVE_PATH=/auth
# https://github.com/keycloak/keycloak/commit/f750c2e0f7bd5b8e3a137a8be283d5ca9a08ac4d
#.Enable the corresponding proxy provider
RUN /opt/keycloak/bin/kc.sh build --spi-x509cert-lookup-provider=haproxy --spi-x509cert-lookup-haproxy-ssl-client-cert=SSL_CLIENT_CERT --spi-x509cert-lookup-haproxy-ssl-cert-chain-prefix=CERT_CHAIN --spi-x509cert-lookup-haproxy-certificate-chain-length=10

FROM quay.io/keycloak/keycloak:17.0.0
COPY --from=builder /opt/keycloak/lib/quarkus/ /opt/keycloak/lib/quarkus/
COPY themes/ /opt/keycloak/
WORKDIR /opt/keycloak
# for demonstration purposes only, please make sure to use proper certificates in production instead

RUN keytool -genkeypair -storepass password -storetype PKCS12 -keyalg RSA -keysize 2048 -dname "CN=server" -alias server -keystore conf/server.keystore
ENTRYPOINT ["/opt/keycloak/bin/kc.sh", "start"]

Docker compose file:

  keycloak_x:
    image: foo/keycloak_quarkus:${KEYCLOAK_VERSION_X}
    build:
      context: ../images/keycloak_quarkus
      args:
        KC_DB: ${DB_VENDOR}
    container_name: ${KEYCLOAK_HOST_X}
    environment:
      #- KC_HOSTNAME=myserver:8181
      - KC_HOSTNAME=myserver:443
      - KC_HOSTNAME_PATH=/auth
      - KC_DB_URL_HOST=${DB_HOST}
      - KC_DB_USERNAME=${KEYCLOAK_DB_USER}
      - KC_DB_PASSWORD=${KEYCLOAK_DB_PASS}
      - KC_HTTP_ENABLED=true
      - KC_PROXY=edge
      - KEYCLOAK_ADMIN=${KEYCLOAK_USER}
      - KEYCLOAK_ADMIN_PASSWORD=${KEYCLOAK_PASSWORD}
    ports:
        - 8181:8443

When using KC_HOSTNAME=myserver:8181 it works, but not when I try to use myserver:443/auth. It displays the first page but when I trying to access to console it fail with Invalid parameter: redirect_uri.
If I update manually client.root_url column with full URL I can access but console is blank. Any idea?

stianst · 2022-03-11T08:10:01Z

stianst
Mar 11, 2022
Maintainer

You should use KC_HOSTNAME=myserver and not include the port there. If that doesn't work it's a bug.

1 reply

gardellajuanpablo Mar 11, 2022
Author

Thanks it works!

Navigation Menu

Repository navigation

Unable to use Keycloak behind proxy (invalid redirect uri) #10663

Uh oh!

{{title}}

Uh oh!

Replies: 1 comment 1 reply

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Unable to use Keycloak behind proxy (invalid redirect uri) #10663

Uh oh!

gardellajuanpablo Mar 9, 2022

Replies: 1 comment · 1 reply

Uh oh!

stianst Mar 11, 2022 Maintainer

Uh oh!

gardellajuanpablo Mar 11, 2022 Author

gardellajuanpablo
Mar 9, 2022

Replies: 1 comment 1 reply

stianst
Mar 11, 2022
Maintainer

gardellajuanpablo Mar 11, 2022
Author