Blank admin console, Keycloak 17/18 + HA-Proxy/Nginx (Docker Compose) - EDIT: Solved #13191

Hermansson · 2022-07-18T16:08:36Z

Hermansson
Jul 18, 2022

Hi.

I'm currently struggling to setup Keycloak with HA-Proxy.

The scenario

My local computer
Docker Desktop
- HA-Proxy
- Keycloak 17
- containous/whoami

Goal and some questions

My goal is for now to access the lovely "Welcome to Keycloak" page by browsing "https://localhost/keycloak".
HTTPS to the haproxy, HTTP from the haproxy to Keycloak.

I've been reading a lot of forums, bug reports etc. where it's clear that a lot has changed between the Jboss/Wildfly and the Quarkus versions, and also between the latest versions 17 -> 18. For someone who is just starting out, this get confusing quickly.

One thing that has been especially frustrating is the fact that some configuration can be specified using the "ENV" setting in docker, while other must go in the entry point, proxy mode is one example which can be set using the "ENV" but is ignored since it apparently should go in the entry point.

Is there a consistent way where I can pass all variables in a single place, perhaps in the docker compose file? Also which variables do I need to set, I've tried to follow the recommendations for reverse proxy.

Current state

Keycloack
- startup fine
- http://localhost:8080/ (works fine)
- https://localhost:8443/ (works fine)
- https://localhost/keycloak (routing via haproxy = Page not found from Keycloak)
Whoami
- https://localhost/app (routing via haproxy = works fine)
Haproxy
- spins up fine, informs me that the check found "web1" and "keycloak".
- my tls certificate is created using openssl on my pc, browser is not considering it secure, but it's there and my "whoami" service works fine with it.

I'd apricate any suggestions/examples how to do this set up correctly, for a home test environment. The fact that Keycloak returns a 404 means that I'm at least directing traffic to it, but some configuration, somewhere, is wrong.

My Keycloak dockerfile (Note that I've also tested Keycloak 18):

FROM quay.io/keycloak/keycloak:17.0.0 as builder
ENV KC_HEALTH_ENABLED=true
ENV KC_METRICS_ENABLED=true
ENV KC_FEATURES=token-exchange
ENV KC_DB=postgres
RUN /opt/keycloak/bin/kc.sh build

FROM quay.io/keycloak/keycloak:17.0.0
COPY --from=builder /opt/keycloak/lib/quarkus/ /opt/keycloak/lib/quarkus/
WORKDIR /opt/keycloak
ENV KC_DB_URL=jdbc:postgresql://postgres:5432/keycloak
ENV KC_DB_USERNAME=keycloak
ENV KC_DB_PASSWORD=keycloak

ENV KC_HOSTNAME=localhost

#ENV KC_PROXY=edge #Not working in v17+ of keycloak?
ENV KC_HOSTNAME_STRICT_HTTPS=false
ENV KC_HTTP_ENABLED=true
ENV PROXY_ADDRESS_FORWARDING=false
ENV KC_FEATURES=token-exchange
ENV KEYCLOAK_ADMIN=admin
ENV KEYCLOAK_ADMIN_PASSWORD=admin
ENV KC_PROXY=edge
ENV KEYCLOAK_ADMIN_PASSWORD=admin
ENV KC_HOSTNAME_STRICT_BACKCHANNEL=false

ENTRYPOINT ["/opt/keycloak/bin/kc.sh","start --auto-build --proxy=edge"]

My compose

version: '3'
volumes:
postgres_data:
driver: local
services:

haproxy:
image: "haproxy"
container_name: "haproxy"
ports:
- "80:80"
- "443:443"
service1:
image: containous/whoami
container_name: service1
ports:
- "80"
postgres:
image: postgres
container_name: postgres
ports:
- "5432:5432"
volumes:
- postgres_data:/var/lib/postgresql/data
environment:
POSTGRES_DB: keycloak
POSTGRES_USER: keycloak
POSTGRES_PASSWORD: keycloak
keycloak:
image: keycloak:test
container_name: keycloak
ports:
- "8443:8443"
- "8080:8080"
depends_on:
- postgres

My haproxy config

global

defaults
mode http
timeout connect 5000ms
timeout client 50000ms
timeout server 50000ms

frontend inbound
# bind *:80
bind *:443 ssl crt /usr/local/etc/haproxy/mydomain.pem
mode http
acl is_app path_beg /app
acl is_keycloak path_beg /keycloak
use_backend app_backend if is_app
use_backend keycloak_backend if is_keycloak
default_backend no_match

option forwardfor
http-request set-header X-Real-IP %[src]
http-request set-header X-Forwarded-Host %[req.hdr(host)]
http-request set-header X-Forwarded-Port %[dst_port]
http-request set-header X-Forwarded-For %[src]
http-request set-header X-Forwarded-Proto https
backend app_backend
mode http
server web1 service1:80 check

backend keycloak_backend
mode http
server keycloak keycloak:8080 check
#server keycloak keycloak:8443 check ssl verify none

backend no_match
mode http
http-request deny deny_status 400

Hermansson · 2022-07-19T22:30:00Z

Hermansson
Jul 19, 2022
Author

I've now registered a no-np domain and hooked up a proper certificate from lets-encrypt pointing to my FQDN from no-ip.

I've also tried with nginx since mot people are using that, no luck. Currently I get "to many redirects".

Also, if I skip going trough the proxy, straight to http://localhost:8080/ I get the "Welcome to Keycloak", but as soon as I click the "Adminstration Console" I get slapped with "An internal server error has occurred" from Keycloak. This happens after enabling "KC_FEATURES: admin2", if I remove that feature I instead get a blank page, some kind of loop.

I would love to see a tutorial where someone qualified shows how to set up a vanilla environment running behind a reverse proxy, preferably via Docker. For now I'm not sure if I'm doing something fundamentally wrong, or if it's just difficult to configure in general, I see a lot of other threads mentioning similar issues.

0 replies

Hermansson · 2022-07-20T11:02:04Z

Hermansson
Jul 20, 2022
Author

Solved!

DISCLAIMER: Not sure if this is "safe" workaround.

There is a table called "redirect_uris" inside the Keycloak databse, in my case persisted in a Postgres DB.

To stop the redirects, that did not point correctly, I put '*', ex:

Note that I put it on all, not just the for the admin panel. Once that was don, it works. I can login via the admin panel.

Currently using nginx as a proxy, I'll share if I mange to get it working with HA-Proxy later.

0 replies

Hermansson · 2022-07-20T19:23:52Z

Hermansson
Jul 20, 2022
Author

I got it to working using HA-Proxy as well.

0 replies

Navigation Menu

Repository navigation

Blank admin console, Keycloak 17/18 + HA-Proxy/Nginx (Docker Compose) - EDIT: Solved #13191

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Replies: 3 comments

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Blank admin console, Keycloak 17/18 + HA-Proxy/Nginx (Docker Compose) - EDIT: Solved #13191

Uh oh!

Uh oh!

Hermansson Jul 18, 2022

The scenario

Goal and some questions

Current state

My Keycloak dockerfile (Note that I've also tested Keycloak 18):

My compose

My haproxy config

Replies: 3 comments

Uh oh!

Hermansson Jul 19, 2022 Author

Uh oh!

Uh oh!

Hermansson Jul 20, 2022 Author

Uh oh!

Hermansson Jul 20, 2022 Author

Hermansson
Jul 18, 2022

Hermansson
Jul 19, 2022
Author

Hermansson
Jul 20, 2022
Author

Hermansson
Jul 20, 2022
Author