Repository navigation
Replies: 2 comments 3 replies
|
I have also posted this at https://keycloak.discourse.group/t/kc-17-x-x-how-to-access-admin-ui-from-port-forwarded-internal-url-prevent-redirect-from-internal-url-to-kc-hostname/14917 |
|
I ran into this same problem on keycloak 18.0.0 (quarkus). After updating to 18.0.2 (quarkus) it's working for me - with the addition of the KC_HOSTNAME_ADMIN variable. |
|
Hi @XcrigX , After I added ENV KC_HOSTNAME_ADMIN=localhost as your suggestion then there is the page still using public url. We are using 19.0.1 (quarkus). Do you face same issue like this? Any clue in determining the cause of this issue would be very much appreciated. Thank you! |
|
I did see something similar - which looked like a likely bug to me. Even when accessing on my intranet using the private KC_HOSTNAME_ADMIN, there was still (at least) one call made to the public hostname when authenticating the admin user. |
|
Try hostname-admin-url instead |
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Objective:
keycloak is deployed in kubernetes with proxy=edge with a hostname/KC_HOSTNAME=public.url. I want to restrict admin UI access by allowing it only from internal url by doing port-forwarding
kubectl port-forward svc/keycloak 9010:80
now http://localhost:9010/admin should work but https://public.url/admin shouldn't work (assuming that I blocked it using reverse proxy)
I have tried setting adminUrl using KC_HOSTNAME_ADMIN but it doesn't work.
Problem:
Currently port-forwarded local url http://localhost:9010 is working but it is redirecting me to KC_HOSTNAME :(
As far as I know same setup was working fine with keycloak <17
Environment variables:
KC_HOSTNAME=public.url
KC_PROXY=edge
Related information:
mentioned at https://www.keycloak.org/docs/latest/server_installation/
"If you do not want to expose the admin endpoints and console on the public domain use the property adminUrl to set a fixed URL for the admin console, which is different to the frontendUrl. It is also required to block access to /auth/admin externally"
All reactions