Repository navigation
|
Hello, I'm following the instructions here because I want to run a keycloak server behind cloudfront. I launch a container with a hostname configured docker run -d \
--name keycloak-dev \
--network=net1 \
-p 8080:8080 \
-e KEYCLOAK_ADMIN=admin \
-e KEYCLOAK_ADMIN_PASSWORD=password \
quay.io/keycloak/keycloak:latest \
start-dev \
--hostname=https://d1nxc6sm28vl4m.cloudfront.net \
--proxy-headers forwardedWhen I access the site via the cloudfront url I'm redirected to I'm reading the docs where it's recommended not to expose Some experiments with cul on the box where the container is running. Accessing # curl -v localhost:8080/admin/
< HTTP/1.1 302 Found
< Location: https://d1nxc6sm28vl4m.cloudfront.net/admin/master/console/Accessing when I include the host header it 404s - I believe this is reproducing what I see in my browser. # curl -v --header 'Host: d1nxc6sm28vl4m.cloudfront.net' localhost:8080/admin/
< HTTP/1.1 404 Not FoundBut accessing # curl -v --header 'Host: d1nxc6sm28vl4m.cloudfront.net' localhost:8080/admin/master/console/
< HTTP/1.1 200 OK
< content-length: 3900I realize I'm not following some production best practices here (non ssl access on my origin, running a dev server container) - this is just for an experiment in a bigger project and I want to get this experiment going before I go any further. |
Replies: 2 comments 8 replies
On 26.1 I am not able to reproduce this locally when not using docker. Make sure the request is reaching keycloak correctly. |
|
@shawkins the curl to localhost is going to the container. How can I be sure it’s going to keycloak? I tried to turn on debug/trace logging but it creates a lot of logs. |
|
Try instead starting a local Keycloak, not in docker, and try the same curl. |
|
I downloaded and unzipped KC_BOOTSTRAP_ADMIN_USERNAME=russ \
KC_BOOTSTRAP_ADMIN_PASSWORD=qwerty1234 \
./bin/kc.sh start-dev \
--hostname=https://banana.russdevThen curled from another tab and I see the 404. I get the 404 no matter what host header I send along. $ curl -v --header 'Host: banana.russdev' localhost:8080/admin/
< HTTP/1.1 404 Not Found
...I just noticed that setting $ curl -v --header 'Host: banana.russdev' localhost:8080/admin/
< HTTP/1.1 302 Found
< Location: http://banana.russdev/admin/master/console/I have a theory the problem is in the code below. It's a problem with https on the CDN site, with http on the keycloak site (a bad practice I know). In the |
|
I think my issue is related to this: #38463. Confirming I don't have the same issue with the Maybe the comparison can compare urls with the schemes removed. |
Yes that's the behavior I saw as well. I hadn't considered that your docker file lastest tag would have already been pointing at 26.2 though.
Can you open an issue? We need to relax this logic. The check does not work well in the case of having an edge proxy server and requests going through the proxy without proxy-headers set, or with direct requests not via the proxy. |
|
Thanks for taking a look. I've created an issue here: #39085. I might try create a PR today. My java is pretty rusty, but I think I can see how to update |
|
hello @shawkins - I comented on the PR, all looks good to me! Thanks again for taking a look. |
|
@russau thank you for checking the PR |
Yes that's the behavior I saw as well. I hadn't considered that your docker file lastest tag would have already been pointing at 26.2 though.
Can you open an issue?
We need to relax this logic. The check does not work well in the case of having an edge proxy server and requests going through the proxy without proxy-headers set, or with direct requests not via the proxy.