Repository navigation
The KC_ADMIN_HOSTNAME configuration doesn't work for all URLs #42258
Replies: 2 comments 1 reply
|
Moved to a discussion as something similar has come up several times.
That is not the expected/desired behavior. See #34964 (comment) and the linked issues. The expectation is that the admin console must authenticate just like any other application.
What would you expect to happen if you didn't set KC_HOSTNAME_ADMIN? Also hostname-strict will have no effect if hostname is set. |
|
Is there a solution for this yet? I have the same problem with my K3S setup and haven't found a good solution yet. |
|
No, it's still expected that either the public endpoints are accessible or that you set the master realm frontend url to use the admin hostname. |
Uh oh!
There was an error while l 8000 oading. Please reload this page.
Before reporting an issue
Area
admin/ui
Describe the bug
We have an instance of Keycloak deployed inside a Kubernetes environment where we have 3 ways to access it:
Up until Keycloak 22, everything was working fine if we configured Keycloak to allow backchannel access with a frontend URL configured inside our custom REALM.
We just updated to Keycloak 26, which has the hostname v2 SPI. So, we figured out that we needed to configure
KC_HOSTNAME_BACKCHANNEL_DYNAMICtotrue, which required to set theKC_HOSTNAMEvalue to our public facing URL.We then needed to set the
KC_HOSTNAME_ADMINvariable to our private endpoint.But it didn't work completely. When trying to log to the admin console, Keycloak would correctly load all assets from the private endpoint, but then try to load the login iframe from the public URL. Which is blocked for the realm master.
When looking at the well-known configuration for the master realm, the issuer, authorization_endpoint and check_session_iframe values are still set to the public URL. To fix it, we also have to update the frontentUrl attribute of the master realm to the private endpoint. The admin page will then load correctly.
So, either the KC_ADMIN_HOSTNAME is not working correctly (it should also set the correct values to the openid configuration of the master realm) OR there is a gap in the documentation and it should be clear that if we want to use a separate endpoint for Keycloak administration, we have to set both KC_ADMIN_HOSTNAME and the frontendUrl attribute of the master realm.
Version
26.3.0
Regression
Expected behavior
When the KC_ADMIN_HOSTNAME value is set, Keycloak should load all required assets from that URL.
Actual behavior
When trying to log to the admin console, Keycloak is correctly loading all assets from the private admin endpoint, but then try to load the login iframe from the public URL.
How to Reproduce?
Start Keycloak with the following parameters:
Then, try to use http://127.0.0.1:8080/admin to log into Keycloak
Anything else?
No response
All reactions