Repository navigation
Admin console won't load #38544
Unanswered
ethanmwk29
asked this question in
Q&A
Admin console won't load
#38544
Replies: 1 comment
The hostname you specify should match the expected external access. It is unlikely that you want to specify a hostname involving localhost. At what host and port is your proxy server listening for keycloak requests? There also seems to be a mismatch. You have urls mixing https and port 8080 - the http port.
If you do not specify a port, then the protocol default will be assumed. For https that will be 443. |
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Hey folks! Any help would be greatly appreciated!!
When I try to configure Keycloak with KC_HOSTNAME=https://localhost/keycloak/ I see the infamous "loading" admin console screen, followed by a vague "something went wrong" error. This is observed in my browser when I set up my localhost 8080 port to point to my VM's 443. I'm thus accessing the admin console via my browser at https://localhost:8080/keycloak/admin/master/console. When I use KC_HOSTNAME=https://localhost:8080/keycloak/ hostname-debug gives me the green light and the admin console works fine. This isn't a desirable solution though, because for our service to call Keycloak directly via 8080 we'd need to give Keycloak a cert. For simplicity of deployment we'd really prefer to just remove the port from the hostname and access Keycloak through our proxy. Perhaps this is a CORS issue?
Context:
I'd like to specify a hostname without a port because I'm trying to get my service (running on the same machine) to hit Keycloak through our reverse proxy, envoy. Because of the OIDC client library we use (Zitadel), the URL that we use for discovery has to match the "issuer" URL that Keycloak returns at the
/.well-known/openid-configurationendpoint. From what I can tell, this URL is generated via the hostname, and so having a hostname with :8080 included, but accessing the discovery endpoint via the reverse proxy (no port) causes a mismatch error.Relevant info:**
Keycloak version: 26.1.4-debian-12-r0 from the bitnami repo (using bitnami because we also deploy Keycloak on k8s)
Keycloak is running via a docker image as a containerized systemd process on a VM, where these processes are managed by Nix.
I've taken a look at both the hostname and using a reverse proxy pieces of documentation, and neither of them seem to provide a solution for this problem.
Environment variables:
"KEYCLOAK_DATABASE_VENDOR=dev-file",
"KEYCLOAK_BIND_ADDRESS=127.0.0.1",
"KEYCLOAK_PRODUCTION=yes",
"KC_HTTP_RELATIVE_PATH=/keycloak/",
"KC_HTTP_ENABLED=true",
"KC_PROXY_HEADERS=xforwarded",
"KC_HOSTNAME=https://localhost/keycloak/", (I've also tried just "localhost" here)
(I've tried KC_HOSTNAME_ADMIN=https://localhost/keycloak/ alongside the above variable, no difference in observed behavior)
"KC_HOSTNAME_DEBUG=true",
"KC_BOOTSTRAP_ADMIN_USERNAME=username",
"KC_BOOTSTRAP_ADMIN_PASSWORD=password",
"KC_LOG_LEVEL=debug"
Output of hostname-debug:
(fwiw, these failures are due to the fact that I'm running keycloak on a VM and accessing hostname-debug locally, and it's trying to make the testUrl calls without specifying a port, so the request isn't getting forwarded to my VM)
All reactions