Repository navigation
http app behind haproxy ssl terminated #37743
Replies: 2 comments 4 replies
|
If I understand the question correctly, you need to configure the application to use HTTPS in all requests, including the redirect URL. You (probably) should configure both the application and the Keycloak client to use the public addresses of both systems. As far as I know, there are few cases where the HTTP (unencrypted) endpoint of the application would be relevant for Keycloak; as such, if you do not use such features, only the public URL will be used (e.g., user authentication is mostly performed through browser redirects, so the public URL is used to access either application by the user; even when accessing the token endpoint, only Keycloak's URL is relevant, not the application's). Changing the request or response contents to replace HTTP URLs with HTTPS is technically possible (I have not done so before, so I cannot direct you any further), but it is definitely highly resource intensive and error prone. Such changes are usually done using regexes to match text in headers and the request / response body, and there is a high chance you will encounter corner cases. Basically you would have to do the equivalent of a If I remember correctly, HAProxy actually pride themselves with extremely high throughput by efficiently employing network multiplexing mechanisms provided by the operating system, like |
|
If it was easy to rewrite this http to https I would do it, because I don't expect that high traffic on authentication. I added certs now for this application, but just a bit annoying for just testing |
Your app is in some way providing the redirect_uri, so the app should take responsibility for rewriting that to the desired endpoint. Alternatively it doesn't seem like based upon your description that the authentication should be initiated from the http side - can't you redirect to the frontend / https side from your http app prior to the need to do authentication? |
The app thinks it is just operating in http mode as it communicates with haproxy in http. So that is correct behaviour.
Currently I do not feel the need to redirect everything just because of 1 issue |
Why would it be everything? Wouldn't it just be prior to initiating a login? In any case this is not something that keycloak can currently help you with, and since you don't want to make any changes in the app either, that just leaves the proxy. You would need to see if haproxy can rewrite url parameters - that way you can manipulate the redirect_uri before it reaches keycloak. |
Exactly that is why I am here, I can't imagine I am the first one putting an app with http behind haproxy. |
- 5DF2
Uh oh!
There was an error while loading. Please reload this page.
How to configure an app or keycloak or haproxy to change the redirect url from http to https. I am not looking for an answer that just redirects everything from http to https.
Current problem is that if you have an http app that is behind haproxy ssl terminated configured for keycloak. It sends (I assume) information to keycloak that it is http (how can it now it has a ssl frontend). If keycload sign in completes, it redirects back to http but that does not exists as the frontend of the app is https.
Can I rewrite headers/urls in haproxy somewhere so keycloak is redirecting to https? Or are there other options?
All reactions