Repository navigation
Replies: 8 comments 14 replies
|
First try to disable forcing tls. The Hope that helps. |
|
hi, I tried the first one, that seemed to make it worse, it ended up in a weird redirect loop.... the other 2 didn't have a noticeable affect, still complaining about the redirect_uri the hostname is set to the keyserver.local which is the proxy server which has https... it does serve up the login page over https, just the redirect seems to be having issues, from what I can tell, keycloak is having issues and saying its a bad uri (ie, 400 - bad request) |
|
just a FYI for anyone who has the same problem, I couldn't work it out, I've had to back out of using keycloak as the documentation etc isn't quite good enough to actually do this. The developer experience is great, install it, and go, and it's pretty easy to use. But deploying to a production environment fails on its mission "Add authentication to applications and secure services with minimum effort." as the errors keycloak produces don't help and often there is no documentation explaining what's wrong when you get particular errors, and documentation in general on how to do it seem fragmented / out of date / or lacking. Hopefully this improves. I might have a go at it again at a later date. |
|
Unfortunately I am having the same issues on the part "Add authentication to applications and secure services with minimum effort.". Keycloak is a great and promising tool but it seems the documentation is not quite good. This issue should be seriously discussed since a documentation is the definition of whole application. If documentation is good enough, people will use it more. It would be so nice to have more detailed docs and some "How to dockerize Keycloak for production" etc. guides. Especially for people like me, new to self hosting and security. |
|
Can the Keycloak team help us with an example of a production ready setup (behind a reverse proxy or ingress) ? |
|
I have been able to get KC 18 running behind a Spring Cloud Gateway. The environment variables I used were For the gateway I had to add some headers and add an additional path because hte frontend doesn't correctly set the url path. The frontend uses frames and gateway by default adds security headers. So I had to set x-frame-options to the response. You may also need to setup a webFilterChain with a matecher. |
|
Im having the same issue when using edge proxy, seems maybe the initial master realm isn't adding allowed redirects to cater for |
|
This below currently works for me, using 18.0.2 on Ubuntu 22.04: Add --proxy=edge to startup of keycloak in systemd keycloak.service file Below FULL nginx config, default site disabled. |
|
What do you have configured for keycloak? I'm running JDK16 and basically same results as OP and the other poster with the redirect with effectively the same proxy configuration you have here. Oddly, I was able to access the administration panel with no issues using |
|
I do not understand your question. What do you mean "what have I configured for keycloak"? Is it the command line to start it? |
|
@kwoot If you remove the server section in your nginx config that redirects http to https does it still run then? |
|
thank u man! You save my life! |
|
Perhaps I'm misunderstanding the question, but in my case I've gotten Keycloak to listen on a custom URL behind an Apache reverse proxy, and it appears to work. We're still building the environment, so it's not in production, but it has supported my testing. First, I use this option when building keycloak: I have these settings when I start Keycloak: My apache proxy load balances between two Keycloak servers, but when I had only one server configured, it worked fine with this configuration, where my keycloak instance listens on port 8083: |
|
This thread is quire old, I'm wondering if someone figure out how to get work keycloak (HTTP) with IIS (HTTPS) as reverse proxy? As the original request from @keithn |
|
If you somehow got it to work, let me know please |
|
Hi, I'm also trying to get it to work through a proxy using docker and there's no way :( |
|
I am using portainer in my synology NAS and using reverse proxy to load apps. I was able to load homepage but not the admin page. I was able to resolve the issue with the following docker-compose script. https://gist.github.com/anup-khanal/3c3d29978dfb5c3f88727b4f4adbba67 |
|
Thanks for your code snippets. I succeed in making the keycloak run behind the APISIX. apiVersion: apps/v1
kind: Deployment
metadata:
name: keycloak
namespace: keycloak
labels:
app: keycloak
spec:
replicas: 1
selector:
matchLabels:
app: keycloak
template:
metadata:
creationTimestamp: null
labels:
app: keycloak
spec:
containers:
- name: keycloak
image: quay.io/keycloak/keycloak:23.0.7
args:
- start
ports:
- name: http
containerPort: 8080
protocol: TCP
- name: https
containerPort: 8443
protocol: TCP
env:
- name: KC_HTTP_ENABLED
value: "true"
- name: KC_HOSTNAME_URL
value: 'https://keycloak.xxxx.com'
- name: KC_HOSTNAME_ADMIN_URL
value: 'https://keycloak.xxxx.com'
- name: KC_HOSTNAME_PATH
value: '/'
- name: KC_PROXY_ADDRESS_FORWARDING
value: 'true'
- name: KC_PROXY
value: edge
- name: KC_HOSTNAME_STRICT_HTTPS
value: "false"
- name: KC_HOSTNAME_STRICT
value: "false"
- name: KC_HOSTNAME_STRICT_BACKCHANNEL
value: "true"
- name: KEYCLOAK_ADMIN
value: admin
- name: KEYCLOAK_ADMIN_PASSWORD
value: password
- name: KC_HEALTH_ENABLED
value: 'true'
- name: KC_METRICS_ENABLED
value: 'true'
- name: KC_DB
value: postgres
- name: KC_DB_URL
value: >-
jdbc:postgresql://xxxx:5432/keycloak
- name: KC_DB_USERNAME
value: postgres
- name: KC_DB_PASSWORD
value: password
- name: jgroups.dns.query
value: keycloak
resources: {}
terminationMessagePath: /dev/termination-log
terminationMessagePolicy: File
imagePullPolicy: IfNotPresent
restartPolicy: Always
terminationGracePeriodSeconds: 30
dnsPolicy: ClusterFirst
securityContext: {}
schedulerName: default-schedulerapiVersion: apisix.apache.org/v2
kind: ApisixRoute
spec:
http:
- backends:
- serviceName: keycloak
servicePort: 8080
match:
hosts:
- keycloak.xxx.com
paths:
- /*
name: route-1
plugins:
- config:
comp_level: 6
min_length: 100
types:
- text/plain
- text/css
- text/html
- text/xml
- text/javascript
- application/json
- application/x-javascript
- application/javascript
- image/bmp
- image/png
- font/ttf
- font/otf
- font/eot
enable: true
name: gzip
- enable: true
name: cors
timeout:
connect: 5m
read: 5m
send: 5mapiVersion: v1
kind: Service
spec:
ports:
- name: http
protocol: TCP
port: 8080
targetPort: 8080
- name: https
protocol: TCP
port: 8443
targetPort: 8443
selector:
app: keycloak
clusterIP: None
clusterIPs:
- None
type: ClusterIP
sessionAffinity: None
ipFamilies:
- IPv4
ipFamilyPolicy: SingleStack
internalTrafficPolicy: Cluster |
|
This is how I got it going, Keycloak in production mode behind an nginx reverse proxy. You should tell the machine's firewall to close port 8080, though. keycloak.conf: log-level=INFO
# Database
db=postgres
db-username=kc
db-password=<guesswhat>
# Observability
metrics-enabled=true
# HTTP
http-enabled=true
hostname-strict=false
proxy-headers=xforwarded
hostname-strict-https=falsenginx site config: # Redirect HTTP to HTTPS
server {
if ($host = rumpel.pumpel.com) {
return 301 https://$host$request_uri;
} # managed by Certbot
listen 80;
server_name rumpel.pumpel.com;
return 301 https://$host$request_uri;
}
server {
listen 443 ssl http2;
server_name rumpel.pumpel.com;
ssl_certificate /etc/letsencrypt/live/rumpel.pumpel.com/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/rumpel.pumpel.com/privkey.pem; # managed by Certbot
# For a list of paths to expose, see recommendations at
# https://www.keycloak.org/server/reverseproxy
location /realms/ {
include kcproxy.conf;
}
location /resources/ {
include kcproxy.conf;
}
# Not recommended, but we need this:
location /admin/ {
include kcproxy.conf;
}
location /metrics/ {
include kcproxy.conf;
}
# Default is the admin page.
location / {
return 302 https://$host/admin/;
}
}
And this is kxproxy.conf, referenced in the site config; place in # Include this file in each location you want to serve.
# See https://www.keycloak.org/server/reverseproxy (Exposed Path Recommendations)
#
# Save this file to /etc/nginx/kxproxy.conf and include it in you nginx configuration (location blocks).
proxy_pass http://localhost:8080;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Server $host;
proxy_set_header X-Forwarded-Port $server_port;
proxy_set_header X-Forwarded-Proto $scheme; |
|
The combination of all the snippets in this thread helped me to get Keycloak to work behind an nginx proxy, thanks! 👏 |
|
@aidanlangelaan Could you please share your configuration ? |
|
key point to note here is not to mention hostname. thank you @basebox-mt saved a ton of time :) |
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
So I started out using keycloak in start dev, and it was super trouble free... but now trying to work out how to configure it for a production environment, I get all kinds of problems and I'm really not sure how to solve them. I'm using keycloak for a .net website, and I want to put it behind a reverse proxy on IIS where it has a certificate. It has a sql database backend ( which seems to work ok so far). Ultimately the keycloak server would live in a private network and not directly exposed to the internet and I could access the admin interface via the internal private network. I'm just experimenting with this locally using docker, and a windows server 2019 virtual machine for web which has an address of "keyserver.local". I made a certificate on the windows server for the website, and use a browser on that server to try out the reverse proxy to keycloak.
I have a docker compose :
version: "3.2"
services:
keycloak:
image: quay.io/keycloak/keycloak:latest
container_name: keycloak
ports:
- "8090:8080"
environment:
- KEYCLOAK_ADMIN=admin
- KEYCLOAK_ADMIN_PASSWORD=admin
- KC_DB=mssql
- KC_DB_URL=jdbc:sqlserver://192.168.1.146;database=Keycloak
- KC_DB_USERNAME=keycloak
- KC_DB_PASSWORD=keycloak
- KC_HOSTNAME=keyserver.local
- KC_TRANSACTION_XA_ENABLED=false
command:
- start --auto-build --proxy=edge
so if I try to use the internal network
http://192.168.1.146:8090/admin/master/console/or via the proxy (which ideally won't proxy admin , but it is while I try and work this out)
https://keyserver.local/admin/master/console/I get a login but, logging in I get....
invalid redirect_url
ie, when doing the following it gets a 400 - Bad Request doing a get on the following ....
https://keyserver.local/realms/master/protocol/openid-connect/auth?client_id=security-admin-console&redirect_uri=https://keyserver.local/admin/master/console/&state=81abcd9c-6103-47b0-92e0-180dcf83454d&response_mode=fragment&response_type=code&scope=openid&nonce=04dbc003-15e5-46b0-9680-aaead7e4d008&code_challenge=amiL6XNwyDx5OLB9MMhziKoWkcEWypH_wgZZ3Wfx0wY&code_challenge_method=S256the redirect url for whatever reason always uses the hostname, rather than the direct address, hence why I still have it reverse proxied, but more importantly I don't understand why I'm getting the bad request.
The keycloak DB is fresh, nothing in it and its just using the default admin login.
Not really sure how to get this working / how to work out what is going wrong
All reactions