Keycloak Behind Reverse Proxy and Internal Backend Access: “Invalid Bearer Token” Error #41251

roman-galyaminskiy · 2025-07-18T10:25:37Z

roman-galyaminskiy
Jul 18, 2025

We use Keycloak 26.0.5 with a reverse proxy and have the following setup to support multiple tenants:

KC_HOSTNAME_BACKCHANNEL_DYNAMIC=false  
KC_HOSTNAME_STRICT=false  
KC_HTTP_ENABLED=true  
KC_HTTP_RELATIVE_PATH=/api/keycloak  
KC_PROXY_HEADERS=xforwarded

Reference: https://www.keycloak.org/server/reverseproxy#_relevant_options

https://tenantN.mydomain.com/api/keycloak/realms/myrealm/.well-known/openid-configuration returns tenant-specific endpoints as expected:

{
  "issuer": "https://tenantN.mydomain.com/api/keycloak/realms/myrealm",
  "authorization_endpoint": "https://tenantN.mydomain.com/api/keycloak/realms/myrealm/protocol/openid-connect/auth",
  "token_endpoint": "https://tenantN.mydomain.com/api/keycloak/realms/myrealm/protocol/openid-connect/token",
  "introspection_endpoint": "https://tenantN.mydomain.com/api/keycloak/realms/myrealm/protocol/openid-connect/token/introspect",
  "userinfo_endpoint": "https://tenantN.mydomain.com/api/keycloak/realms/myrealm/protocol/openid-connect/userinfo",
  "end_session_endpoint": "https://tenantN.mydomain.com/api/keycloak/realms/myrealm/protocol/openid-connect/logout",
  ...
}

However, we are also using Keycloak for authorization, utilizing the Quarkus Keycloak authorization client. Backend services communicate with Keycloak using an internal URL.

Setting:

QUARKUS_KEYCLOAK_ADMIN_CLIENT_SERVER_URL=http://my-keycloak-service:8080/api/keycloak

results in the following error from the backend:

{"error":"invalid_grant","error_description":"Invalid bearer token"}

And a corresponding warning in Keycloak logs:

2025-07-18 06:20:11,688 WARN  [org.keycloak.events] (executor-thread-5) type="PERMISSION_TOKEN_ERROR", realmId="...", realmName="myrealm", clientId="myclient", userId="null", ipAddress="...", error="invalid_token", auth_method="oauth_credentials", grant_type="urn:ietf:params:oauth:grant-type:uma-ticket"

The only way I managed to make it work was to use tenant-specific public URLs for the authorization client instead of the local one.

The "Invalid bearer token" message is not very informative. However, if I understand https://www.keycloak.org/server/hostname#_utilizing_an_internal_url_for_communication_among_clients correctly, it occurs because Keycloak rejects requests via internal URLs when KC_HOSTNAME_BACKCHANNEL_DYNAMIC is set to false. But I can't set it to true, because that requires specifying a static URL via KC_HOSTNAME, which then disables dynamic hostname resolution from X-Forwarded-* headers.

My questions:

Is there a way to enable dynamic hostnames (via X-Forwarded-* headers) and allow the backend to access Keycloak using internal URLs at the same time?
Is the described setup a valid approach for multi-tenant deployments?

Navigation Menu

Repository navigation

Keycloak Behind Reverse Proxy and Internal Backend Access: “Invalid Bearer Token” Error #41251

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Replies: 0 comments

Select a reply

Uh oh!

Keycloak Behind Reverse Proxy and Internal Backend Access: “Invalid Bearer Token” Error #41251

Uh oh!

Uh oh!

roman-galyaminskiy Jul 18, 2025

My questions:

Replies: 0 comments

roman-galyaminskiy
Jul 18, 2025