Repository navigation
Keycloak URI Questions #45788
Replies: 1 comment
Require SSL is considered a legacy configuration value at this point. We've been discussing how to move forward with deprecating and removing it in: The check is called in targeted, not all, requests against the server: If you don't already have a token, you should not be able to authenticate with SSL Required = ALL and using http. In this case you are using an existing token and calling endpoints where the SSL Required check is not performed. Note that it is also being used to validate URLs that are being formed based upon the hostname - which in a case like yours will pass. And when set to EXTERNAL it yes will infer that local access, such as using localhost, is fine.
I don't believe so. |
Uh oh!
There was an error while loading. Please reload this page.
Hi,
I'm a little confused right now about how the hostname configuration options as well as the
Require SSLrealm setting works.We are running Keycloak (Version 26.5.1) on Docker behind a reverse proxy, so we have
We also set the
Require SSLsetting in the realms toAll requestsUntil today I thought that:
KC_HOSTNAMEenvironment variableRequire SSLtoAll requestson a realm will prevent any access to the realms data without SSLToday I learned, that with this configuration it is possible to use the admin cli with
http://localhost:8080.I thought, ok, maybe there is an exception with localhost.
Next I tried retrieving a token with http and the ip using
http://<ip-of-my-keycloak-server>:8080/realms/master/protocol/openid-connect/tokenfrom my local machine and that works too.With that token, I could call
http://<ip-of-my-keycloak-server>:8080/admin/realms/AI/clients.Next I tried accessing Keycloak with another HTTPS URL
https://some-other-uri.domain.com(I modified the proxy config for it to redirect it the same as the original one).Entering it in the browser just redirects to the real configured hostname
https://my-external-keycloak-uri.domain.com.But using it in a REST client, I was able to retrieve a token wit this URI and also call the REST API.
All the token have the original hostname as issuer, so that seems ok.
Maybe that is the intended behavior and the hostname is only relevant for the issuer and the UI, but I would like to understand:
Require SSLsetting do then? Does it only affect the UI usage?KC_HOSTNAME_BACKCHANNEL_DYNAMICto true change anything in my configuration?Also I'm pretty sure there was some point in the past where localhost definitely did not work - but maybe that was before Quarkus.
Anyway, I would appreciate any insights or thoughts here.
Thank you!
All reactions