Accessing Admin dashboard from different urls throwing 403? #44641

tarazena · 2025-12-03T16:33:32Z

tarazena
Dec 3, 2025

Hey all
I'm using 26.4 hosted in AWS, I have two seperate ECS Services, one is publicaly facing that deny requests to admin urls (["/admin/*", "/auth/admin/*", "/realms/master/*"]), and other instance that is protected via IP Address filters that allows me to access the admin console.

My current configuration is

ENV KC_HOSTNAME=https://auth.tst.dev
ENV KC_HOSTNAME_ADMIN=https://authadmin.tst.dev

when I hit https://authadmin.tst.dev, I'm getting a 403 when the page is loading
https://auth.tst.dev/realms/master/protocol/openid-connect/3p-cookies/step1.html

Is this the proper setup for separate access between admin and public users?

here is my keycloak.conf

# Database configuration
# db=mssql
db=postgres
db-pool-initial-size=5
db-pool-min-size=5
db-pool-max-size=20
db-url-properties=maxStatements=0
db-url-properties=queryTimeout=300
db-url-properties=oracle.net.CONNECT_TIMEOUT=60000
db-url-properties=oracle.jdbc.ReadTimeout=120000

# Networking and proxy settings
http-enabled=true
proxy-headers=xforwarded
hostname-strict=true

# Set to true to enable health checks and metrics
health-enabled=true
metrics-enabled=true
cache-metrics-histograms-enabled=true

# Enable and disable features as needed
features=account,account-api,login,passkeys,persistent-user-sessions,recovery-codes,web-authn,token-exchange,authorization,par,step-up-authentication,client-policies
# features-disabled=admin,admin-api,admin-fine-grained-authz,update-email

# Security settings
spi-connections-http-client-default-max-connections=16
spi-connections-http-client-default-time-to-live=30
spi-connections-http-client-default-disable-trust-manager=false
spi-login-protocol-openid-connect-code-lifespan=120
spi-login-protocol-openid-connect-access-token-lifespan=300
spi-login-protocol-openid-connect-refresh-token-lifespan=1800

# Performance tuning + caching
theme-static-max-age=86400
theme-cache-themes=true
theme-cache-templates=true
spi-theme-cache-themes=true
spi-theme-cache-templates=true

Docker image

FROM quay.io/keycloak/keycloak:26.4@sha256:9409c59bdfb65dbffa20b11e6f18b8abb9281d480c7ca402f51ed3d5977e6007 AS builder


WORKDIR /opt/keycloak/bin
COPY ./keycloak.conf /opt/keycloak/conf/

ENV KC_HOSTNAME=https://auth.tst.dev
ENV KC_HOSTNAME_ADMIN=https://authadmin.tst.dev
ENV KC_HOSTNAME_BACKCHANNEL_DYNAMIC=true

RUN ./kc.sh build
RUN ./kc.sh show-config

EXPOSE 9000
EXPOSE 8080
EXPOSE 7800
EXPOSE 57800

ENTRYPOINT ["/opt/keycloak/bin/kc.sh", "start", "--optimized"]

Thanks

Answered by tarazena

Dec 3, 2025

I've figured it out, I put the front end url on the realm and started working. thank you for your help

View full answer

shawkins · 2025-12-03T16:52:00Z

shawkins
Dec 3, 2025
Collaborator

when I hit https://authadmin.tst.dev, I'm getting a 403 when the page is loading
https://auth.tst.dev/realms/master/protocol/openid-connect/3p-cookies/step1.html

Sounds similar to #41411 presumably https://authadmin.tst.dev access is going through a proxy, so it might be doing something to the cookies.

6 replies

tarazena Dec 3, 2025
Author

@shawkins No, when we recieved the emails from the non public domain, it was before setting the KC_HOSTNAME_ADMIN, this was for an invite email to an organization in KC

shawkins Dec 3, 2025
Collaborator

Just to make sure I'm following - you are saying that with hostname=https://auth.tst.dev, and no setting for hostname_admin, that you received an email with a link containing https://authadmin.tst.dev ?

Other than modifying the email template or perhaps setting the realm frontend url, I don't see how a link with an entirely unknown domain would come from Keycloak given those settings.

tarazena Dec 3, 2025
Author

@shawkins Sorry for the confusion, no, that's not the case, here is what we did.

We have 2 Instances, the public facing one https://auth.tst.dev/ and private admin one https://authadmin.tst.dev/.
Each of these instance have seperate configurations:
- Public facing one have KC_HOSTNAME: https://auth.tst.dev/
- Private Admin instance have KC_HOSTNAME: https://authadmin.tst.dev/
- Both instances are connected to the same DB and communicates with each other.
We wanted to add email configuration, so we used private admin one to changed the email configuration via the Admin UI.
When we started triggering email invites from private admin one, the URLs in the email are using https://authadmin.tst.dev/ (private) instead of https://auth.tst.dev/ (public)
- I think it makes sense since we are triggiering those events from the private admin one, so the URL probably will be from there as well.
We decided to fix this behavior by change KC_HOSTNAME=https://auth.tst.dev/ and adding KC_HOSTNAME_ADMIN=https://authadmin.tst.dev/ to our Private Admin instance.
When we try to login to the Private Admin UI https://authadmin.tst.dev/admin/master/console/, it sends a request to the public instance https://auth.tst.dev/realms/master/protocol/openid-connect/3p-cookies/step1.html, which results in HTTP 403.
- The reason we are getting 403 because we have Load Balancer rules to filter traffic /realms/master/* and deny any requests

my question is: Is there a way we can change the email URLs without messing with KC_HOSTNAME & KC_HOSTNAME_ADMIN? or is my approach to seperate access between admin ui and public login pages are wrong?

tarazena Dec 3, 2025
Author

I've figured it out, I put the front end url on the realm and started working. thank you for your help

Answer selected by tarazena

shawkins · 2025-12-03T20:19:32Z

shawkins
Dec 3, 2025
Collaborator

I've figured it out, I put the front end url on the realm and started working. thank you for your help

No problem. Seems like you mostly figured it on your own. Let us know if doc changes would help the situation be more clear.

0 replies

Navigation Menu

Repository navigation

Accessing Admin dashboard from different urls throwing 403? #44641

Uh oh!

{{title}}

Uh oh!

Replies: 2 comments 6 replies

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Accessing Admin dashboard from different urls throwing 403? #44641

Uh oh!

tarazena Dec 3, 2025

Replies: 2 comments · 6 replies

Uh oh!

shawkins Dec 3, 2025 Collaborator

Uh oh!

tarazena Dec 3, 2025 Author

Uh oh!

Uh oh!

shawkins Dec 3, 2025 Collaborator

Uh oh!

Uh oh!

tarazena Dec 3, 2025 Author

Uh oh!

tarazena Dec 3, 2025 Author

Uh oh!

shawkins Dec 3, 2025 Collaborator

tarazena
Dec 3, 2025

Replies: 2 comments 6 replies

shawkins
Dec 3, 2025
Collaborator

tarazena Dec 3, 2025
Author

shawkins Dec 3, 2025
Collaborator

tarazena Dec 3, 2025
Author

tarazena Dec 3, 2025
Author

shawkins
Dec 3, 2025
Collaborator