Keycloak && Nginx Reverse Proxy #12373

AlexeiKlimenko · 2022-06-07T10:35:29Z

AlexeiKlimenko
Jun 7, 2022

We're using latest version KC and have started to publish it via nginx according to https://www.keycloak.org/server/reverseproxy
At the moment we're looking for secure working config nginx for this purpose, but unfortunately this deal didn't fully described in RTFM.

The main config:
`upstream kc {
ip_hash;
server kc01:443;
}

server {
include /etc/nginx/listeners_80_443;
server_name kc;

location /realms/ {
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;	
    proxy_pass https://kc;
}

location /resources/ {
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;	
    proxy_pass https://kc;
}

location /admin/ {
    include /etc/nginx/office;
    deny all;
    proxy_pass https://kc;
}

location / {
    include /etc/nginx/office;
    deny all;
    proxy_pass https://kc;
}

}`

What do you think about it and could you share your examples?

tjayr · 2022-06-07T12:41:16Z

tjayr
Jun 7, 2022

I'll share mine, I've just gone through this for Keycloak 18 and it was very frustrating. Its working but I don't know if its "good". I really hate this type of proxy configuration, so I'd love to see some recommended configurations for the common reverse proxy servers as part of the documentation or in an examples repository.

I tried to follow the recommendations about restricting access to the admin console from the reverse proxy guide and this is what I came up with for Nginx. For context Keycloak and Nginx are running as containers within an AWS Fargate task on a private subnet behind an application loadbalancer.

server {
    listen 80;
    listen  [::]:80;
    server_name  localhost;

    proxy_set_header        X-Forwarded-For     $proxy_add_x_forwarded_for;
    real_ip_header X-Forwarded-For;
    set_real_ip_from <Allowed IP>;

    location / {
        root   /usr/share/nginx/html;
        index  index.html index.htm;
    }

    error_page   500 502 503 504  /50x.html;
    location = /50x.html {
        root   /usr/share/nginx/html;
    }

    location /auth {
      try_files $uri @proxy;
    }

    location ~ /auth/(admin|health|metrics) {
        allow <Allowed IP>/32;  
        deny all;

        try_files $uri @proxy;
    }

    location @proxy {
        proxy_set_header    X-Forwarded-Host   $host;
        proxy_set_header    X-Forwarded-Proto ht
8000
tps;
        proxy_set_header    X-Forwarded-Port 443;

        proxy_pass https://localhost:8443;
        proxy_buffer_size          128k;
        proxy_buffers              4 256k;
        proxy_busy_buffers_size    256k;
    }

}

0 replies

Navigation Menu

Repository navigation

Keycloak && Nginx Reverse Proxy #12373

Uh oh!

{{title}}

Uh oh!

Replies: 1 comment

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Select a reply

Uh oh!

Keycloak && Nginx Reverse Proxy #12373

Uh oh!

AlexeiKlimenko Jun 7, 2022

Replies: 1 comment

Uh oh!

Uh oh!

tjayr Jun 7, 2022

AlexeiKlimenko
Jun 7, 2022

tjayr
Jun 7, 2022