Too many redirects #44893

Paul6552 · 2025-12-12T23:19:25Z

Paul6552
Dec 12, 2025

We're currently having a problem where "admin" appears twice in our URL. Everything is working, but we wanted to fix this. Our current configuration and URL:

https://mydomain.org/admin/admin/master/console/

Keycloak startup-configuration:

docker run --name keycloak-2647 \
--restart unless-stopped \
-p 8280:8080 \
-e KEYCLOAK_ADMIN=admin \
-e KEYCLOAK_ADMIN_PASSWORD=PASSWORD \
--net=peanetwork \
-v /opt/theme/pea:/opt/keycloak/themes/pea \
quay.io/keycloak/keycloak:26.4.7 \
start \
--spi-brute-force-protector-default-brute-force-detector-allow-concurrent-requests=true \
--hostname=https://mydomain.org/admin \
--hostname-strict=false \
--http-relative-path=/admin \
--http-enabled=true \
--db=postgres \
--db-url-host=pea-postgres \
--db-url-database=keycloak \
--db-username=keycloak \
--db-password=keycloak \
--proxy-headers=xforwarded

This is our NGINX configuration:

## Nginx config

# redirect all traffic to https (Port 80)
server {
    listen 80 default_server;
    listen [::]:80 default_server;

    location / {
        return 301 https://$host$request_uri;
    }
}

server {
	# Hören auf Ports 443 (IPv4 und IPv6)
    listen 443 quic reuseport default_server;
    listen [::]:443 quic reuseport default_server;
    add_header Alt-Svc 'h3=":443"' always;
    # HTTP/2 und HTTP/1.1 Fallback beibehalten
    listen 443 ssl;
    listen [::]:443 ssl;
    http2 on;

	index index.html index.htm;

    # Explizite Domain setzen
    server_name mydomain.org;

	# Gzip-Komprimierung
	gzip on;
	gzip_types text/plain text/css application/javascript application/x-javascript;

	# all ssl related config moved to ssl.conf
	include /config/nginx/ssl.conf;

	client_max_body_size 0;

    # My SSL Settings
    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
    add_header Content-Security-Policy "default-src 'self'; script-src 'self' https://mydomain.org 'unsafe-inline'; connect-src 'self' https://mydomain.org blob:; style-src 'self' 'unsafe-inline'; font-src 'self' data:; img-src 'self' data: blob:; media-src 'self' blob:;" always;
    add_header X-Frame-Options "SAMEORIGIN" always;

    location @fallback {
        # CORS für fetch-Requests im Embed-Skript
        add_header Access-Control-Allow-Origin "*" always;
        add_header Access-Control-Allow-Methods "GET, POST, OPTIONS" always;
        add_header Access-Control-Allow-Headers "Content-Type, Authorization" always;

        # Security-Header müssen hier wiederholt werden (inkl. CSP und X-Frame-Options)
        add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
        add_header Content-Security-Policy "default-src 'self'; script-src 'self' https://mydomain.org 'unsafe-inline'; connect-src 'self' https://mydomain.org blob:; style-src 'self' 'unsafe-inline'; font-src 'self' data:; img-src 'self' data: blob:; media-src 'self' blob:;" always;
        add_header X-Frame-Options "SAMEORIGIN" always;

        rewrite ^.*$ /index.html break;
        proxy_pass http://localhost:8180;
        proxy_set_header X-Forwarded-Host $host:$server_port;
        proxy_set_header X-Forwarded-Server $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }

    # first application
    location / {
        # CORS Headers für alle normalen GET/POST Requests
        add_header Access-Control-Allow-Origin "*" always;
        add_header Access-Control-Allow-Methods "GET, POST, OPTIONS" always;
        add_header Access-Control-Allow-Headers "Content-Type, Authorization" always;

        # Security-Header müssen hier wiederholt werden
        add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
        add_header Content-Security-Policy "default-src 'self'; script-src 'self' https://mydomain.org 'unsafe-inline'; connect-src 'self' https://mydomain.org blob:; style-src 'self' 'unsafe-inline'; font-src 'self' data:; img-src 'self' data: blob:; media-src 'self' blob:;" always;
        add_header X-Frame-Options "SAMEORIGIN" always;

        # Preflight (OPTIONS) Behandlung – Header müssen hier wiederholt werden!
        if ($request_method = 'OPTIONS') {
            add_header Access-Control-Allow-Origin "*" always;
            add_header Access-Control-Allow-Methods "GET, POST, OPTIONS" always;
            add_header Access-Control-Allow-Headers "Content-Type, Authorization" always;
            add_header Access-Control-Max-Age 86400;
            add_header Content-Type 'text/plain; charset=utf-8';
            add_header Content-Length 0;
            return 204;
        }

        proxy_set_header X-Forwarded-Host $host:$server_port;
        proxy_set_header X-Forwarded-Server $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_pass http://localhost:8180;

        proxy_intercept_errors on;
        error_page 404 = @fallback;
    }

    # Second application
    location = /pea {
        return 301 /pea/;
    }

    location /pea/ {
        proxy_pass http://localhost:8080;
        proxy_set_header X-Forwarded-Host $host:$server_port;
        proxy_set_header X-Forwarded-Server $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }

    # Keycloak 18 and up
    location /admin {
        proxy_set_header    Host               $host;
        proxy_set_header    X-Real-IP          $remote_addr;
        proxy_set_header    X-Forwarded-For    $proxy_add_x_forwarded_for;
        proxy_set_header    X-Forwarded-Host   $host;
        proxy_set_header    X-Forwarded-Server $host;
        proxy_set_header    X-Forwarded-Port   $server_port;
        proxy_set_header    X-Forwarded-Proto  $scheme;
        proxy_pass          http://localhost:8280/admin;
    }

    # deny access to .htaccess/.htpasswd files
    location ~ /\.ht {
        deny all;
    }
}

We thought we could simply change the following in NGINX (remove admin after port 8280):
proxy_pass http://localhost:8280;

and leave the startup configuration as is, except for the parameter:
--hostname=https://mydomain.org \

We restarted nginx and stoped and recreated keycloak with our newly adapted startup configuration.
When we try to open Keycloak via the domain:
https://mydomain.org/admin
we get the error message: too many redirects.

We've already cleared cookies and cache and tried accessing the site with a different browser. We keep getting the same error.

What are we doing wrong?
Thanks a lot

shawkins · 2025-12-13T18:59:28Z

shawkins
Dec 13, 2025
Collaborator

proxy_pass http://localhost:8280

Seems fine to use. However you would leave the hostname as https://mydomain.org/admin

What are we doing wrong?

Make sure you know exactly what your proxy config is doing. If you add curl to the keycloak container, or start a container with curl on the same network as the keycloak container, or increasing logging enough on your proxy, you should be able to see the reponse, including headers, that keycloak is sending to the proxy. If it looks correct, the the problem lies with the proxy configuration.

0 replies

Navigation Menu

Repository navigation

Too many redirects #44893

Uh oh!

{{title}}

Uh oh!

Replies: 1 comment

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Too many redirects #44893

Uh oh!

Paul6552 Dec 12, 2025

Replies: 1 comment

Uh oh!

shawkins Dec 13, 2025 Collaborator

Paul6552
Dec 12, 2025

shawkins
Dec 13, 2025
Collaborator