Admin console is localhost:8080 behind NGINX reverse proxy in edge mode #11125

snupsband · 2022-04-05T15:26:08Z

snupsband
Apr 5, 2022

I recently migrated from Keycloak 15.0.2 to 17.0.1 (with Quarkus) and I'm having an issue with hostname for the admin console.

I'm running behind an NGINX reverse proxy in edge mode.

When I attempt to navigate to the admin console via browser, the URL points to http://localhost:8080/auth/admin/ instead of https://myauth.mydomain.com/auth/admin/

In the Wildfly distribution the was an adminUrl that I could set so that the UI worked properly but I don't see the corresponding argument for setting the hostname/IP for the administration console.

Here are my build and start parameters:

./kc.sh build --db postgres --http-relative-path /auth --spi-x509cert-lookup-provider=nginx
./kc.sh start --db-url-host localhost --db-username keycloak --db-password keycloak --hostname=myauth.mydomain.com --hostname-strict-backchannel=true --http-host 127.0.0.1 --http-port 8080 --proxy edge --spi-x509cert-lookup-nginx-ssl-client-cert=ssl-client-cert --spi-x509cert-lookup-nginx-ssl-cert-chain-prefix=USELESS --spi-x509cert-lookup-nginx-certificate-chain-length=2 --https-trust-store-file=/etc/pki/java/cacerts --https-trust-store-password=changeit

Is there a parameter I'm missing? I couldn't find one specifically for the admin console in the documentation.

snupsband · 2022-04-06T17:15:53Z

snupsband
Apr 6, 2022
Author

Thanks for all your help! I was able to figure this out.

2 replies

drohwer89 Apr 11, 2022

Hey @snupsband, how did you solve this error? I'm actually running into the same error and I'm currently not sure how to solve this error. At the moment I'm thinking that the error is related to #10997. I have fixed that error by adding an quarkus.properties file to the conf folder. This file only contains quarkus.http.proxy.enable-forwarded-host=true. This fixes the hostname for me. But the UI is still blank. I think that this is related to #11108.

Could you please post your fix for this problem?:)

snupsband Apr 18, 2022
Author

In my case the issue was with my NGINX configuration. I didn't see any documentation in the Quarkus setup for actually configuring NGINX. My relevant settings are:

    location /auth/ {
        proxy_set_header    Host               $host;
        proxy_set_header    X-Real-IP          $remote_addr;
        proxy_set_header    X-Forwarded-For    $proxy_add_x_forwarded_for;
        proxy_set_header    X-Forwarded-Host   $host;
        proxy_set_header    X-Forwarded-Server $host;
        proxy_set_header    X-Forwarded-Port   $server_port;
        proxy_set_header    X-Forwarded-Proto  $scheme;
        proxy_set_header    ssl-client-cert    $ssl_client_escaped_cert;
        proxy_connect_timeout   2s;
        proxy_pass http://localhost:8080/auth/;
        proxy_buffer_size          128k;
        proxy_buffers              4 256k;
        proxy_busy_buffers_size    256k;
    }

If you're running a reverse proxy in edge mode then this might help. Without some of these headers the Keycloak application doesn't seem to be able to set internal URLs correctly (i.e., it relies on these headers to tell it where it is, rather than strictly using the hostname arguments).

I had some of these headers set in Keycloak v15 but apparently some of them were missing after the upgrade to v17.

Navigation Menu

Repository navigation

Admin console is localhost:8080 behind NGINX reverse proxy in edge mode #11125

Uh oh!

{{title}}

Uh oh!

Replies: 1 comment 2 replies

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Admin console is localhost:8080 behind NGINX reverse proxy in edge mode #11125

Uh oh!

snupsband Apr 5, 2022

Replies: 1 comment · 2 replies

Uh oh!

snupsband Apr 6, 2022 Author

Uh oh!

drohwer89 Apr 11, 2022

Uh oh!

snupsband Apr 18, 2022 Author

snupsband
Apr 5, 2022

Replies: 1 comment 2 replies

snupsband
Apr 6, 2022
Author

snupsband Apr 18, 2022
Author