Repository navigation
HTTPS required issue #41253
Unanswered
atiq-zangoh
asked this question in
Q&A
HTTPS required issue
#41253
Replies: 1 comment
|
If you access keycloak over http and use a non-localhost hostname, you may see the https required error. It may even appear when simply running with docker or podman if you don't specifically use -p 127.0.01:8080:8080 https://www.keycloak.org/server/containers#_trying_keycloak_in_development_mode |
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Hi,
I am integrating keycloak in my AI agent. So I have used below realm-import.json and docker-compose.yml
realm-import.json
{ "realm": "ashid-sales-de", "enabled": true, "displayName": "AshiD Sales DE", "displayNameHtml": "<div class=\"kc-logo-text\"><span>AshiD Sales DE</span></div>", "notBefore": 0, "defaultSignatureAlgorithm": "RS256", "revokeRefreshToken": false, "refreshTokenMaxReuse": 0, "accessTokenLifespan": 300, "accessTokenLifespanForImplicitFlow": 900, "ssoSessionIdleTimeout": 1800, "ssoSessionMaxLifespan": 36000, "ssoSessionIdleTimeoutRememberMe": 0, "ssoSessionMaxLifespanRememberMe": 0, "offlineSessionIdleTimeout": 2592000, "offlineSessionMaxLifespanEnabled": false, "offlineSessionMaxLifespan": 5184000, "clientSessionIdleTimeout": 0, "clientSessionMaxLifespan": 0, "clientOfflineSessionIdleTimeout": 0, "clientOfflineSessionMaxLifespan": 0, "accessCodeLifespan": 60, "accessCodeLifespanUserAction": 300, "accessCodeLifespanLogin": 1800, "actionTokenGeneratedByAdminLifespan": 43200, "actionTokenGeneratedByUserLifespan": 300, "oauth2DeviceCodeLifespan": 600, "oauth2DevicePollingInterval": 5, "sslRequired": "external", "registrationAllowed": false, "registrationEmailAsUsername": false, "rememberMe": false, "verifyEmail": false, "loginWithEmailAllowed": true, "duplicateEmailsAllowed": false, "resetPasswordAllowed": true, "editUsernameAllowed": false, "bruteForceProtected": false, "permanentLockout": false, "maxFailureWaitSeconds": 900, "minimumQuickLoginWaitSeconds": 60, "waitIncrementSeconds": 60, "quickLoginCheckMilliSeconds": 1000, "maxDeltaTimeSeconds": 43200, "failureFactor": 30, "roles": { "realm": [ { "name": "default-roles-ashid-sales-de", "description": "${role_default-roles}", "composite": true, "composites": { "realm": ["offline_access", "uma_authorization"], "client": { "account": ["view-profile", "manage-account"] } } }, { "name": "offline_access", "description": "${role_offline-access}", "composite": false, "clientRole": false }, { "name": "uma_authorization", "description": "${role_uma_authorization}", "composite": false, "clientRole": false }, { "name": "admin", "description": "Administrator role" }, { "name": "user", "description": "Standard user role" }, { "name": "agent", "description": "AI agent role" } ] }, "groups": [], "defaultRoles": ["default-roles-ashid-sales-de", "offline_access", "uma_authorization"], "requiredCredentials": ["password"], "otpPolicyType": "totp", "otpPolicyAlgorithm": "HmacSHA1", "otpPolicyInitialCounter": 0, "otpPolicyDigits": 6, "otpPolicyLookAheadWindow": 1, "otpPolicyPeriod": 30, "otpSupportedApplications": ["FreeOTP", "Google Authenticator"], "localizationTexts": {}, "webAuthnPolicyRpEntityName": "keycloak", "webAuthnPolicySignatureAlgorithms": ["ES256"], "webAuthnPolicyRpId": "", "webAuthnPolicyAttestationConveyancePreference": "not specified", "webAuthnPolicyAuthenticatorAttachment": "not specified", "webAuthnPolicyRequireResidentKey": "not specified", "webAuthnPolicyUserVerificationRequirement": "not specified", "webAuthnPolicyCreateTimeout": 0, "webAuthnPolicyAvoidSameAuthenticatorRegister": false, "webAuthnPolicyAcceptableAaguids": [], "webAuthnPolicyPasswordlessRpEntityName": "keycloak", "webAuthnPolicyPasswordlessSignatureAlgorithms": ["ES256"], "webAuthnPolicyPasswordlessRpId": "", "webAuthnPolicyPasswordlessAttestationConveyancePreference": "not specified", "webAuthnPolicyPasswordlessAuthenticatorAttachment": "not specified", "webAuthnPolicyPasswordlessRequireResidentKey": "not specified", "webAuthnPolicyPasswordlessUserVerificationRequirement": "not specified", "webAuthnPolicyPasswordlessCreateTimeout": 0, "webAuthnPolicyPasswordlessAvoidSameAuthenticatorRegister": false, "webAuthnPolicyPasswordlessAcceptableAaguids": [], "users": [ { "username": "admin", "enabled": true, "email": "admin@ashid-sales-de.com", "firstName": "Admin", "lastName": "User", "credentials": [ { "type": "password", "value": "admin", "temporary": false } ], "realmRoles": ["admin", "user"], "clientRoles": { "realm-management": ["realm-admin"] } }, { "username": "testuser", "enabled": true, "email": "test@ashid-sales-de.com", "firstName": "Test", "lastName": "User", "credentials": [ { "type": "password", "value": "test", "temporary": false } ], "realmRoles": ["user"] } ], "clients": [ { "clientId": "ashid-sales-de-web", "name": "AshiD Sales DE Web Client", "description": "Web application client", "enabled": true, "clientAuthenticatorType": "client-secret", "secret": "web-client-secret", "redirectUris": [ "http://localhost:3000/*", "http://localhost:8000/*", "http://localhost:8080/*" ], "webOrigins": [ "http://localhost:3000", "http://localhost:8000", "http://localhost:8080" ], "protocol": "openid-connect", "publicClient": false, "bearerOnly": false, "consentRequired": false, "standardFlowEnabled": true, "implicitFlowEnabled": false, "directAccessGrantsEnabled": true, "serviceAccountsEnabled": false, "authorizationServicesEnabled": false, "fullScopeAllowed": true, "nodeReRegistrationTimeout": -1, "defaultClientScopes": [ "web-origins", "profile", "roles", "email" ], "optionalClientScopes": [ "address", "phone", "offline_access", "microprofile-jwt" ] }, { "clientId": "ashid-sales-de-api", "name": "AshiD Sales DE API Client", "description": "API service client", "enabled": true, "clientAuthenticatorType": "client-secret", "secret": "api-client-secret", "protocol": "openid-connect", "publicClient": false, "bearerOnly": true, "consentRequired": false, "standardFlowEnabled": false, "implicitFlowEnabled": false, "directAccessGrantsEnabled": false, "serviceAccountsEnabled": true, "authorizationServicesEnabled": true, "fullScopeAllowed": false, "nodeReRegistrationTimeout": -1, "defaultClientScopes": [ "profile", "roles", "email" ] } ], "clientScopes": [ { "name": "agent-scope", "description": "Scope for AI agent operations", "protocol": "openid-connect", "attributes": { "include.in.token.scope": "true", "display.on.consent.screen": "true" } }, { "name": "web-origins", "description": "OpenID Connect scope for add allowed web origins to the access token", "protocol": "openid-connect", "attributes": { "include.in.token.scope": "false", "display.on.consent.screen": "false" } }, { "name": "profile", "description": "OpenID Connect built-in scope: profile", "protocol": "openid-connect", "attributes": { "include.in.token.scope": "true", "display.on.consent.screen": "true" } }, { "name": "roles", "description": "OpenID Connect scope for add user roles to the access token", "protocol": "openid-connect", "attributes": { "include.in.token.scope": "false", "display.on.consent.screen": "true" } }, { "name": "email", "description": "OpenID Connect built-in scope: email", "protocol": "openid-connect", "attributes": { "include.in.token.scope": "true", "display.on.consent.screen": "true" } }, { "name": "address", "description": "OpenID Connect built-in scope: address", "protocol": "openid-connect", "attributes": { "include.in.token.scope": "true", "display.on.consent.screen": "true" } }, { "name": "phone", "description": "OpenID Connect built-in scope: phone", "protocol": "openid-connect", "attributes": { "include.in.token.scope": "true", "display.on.consent.screen": "true" } }, { "name": "offline_access", "description": "OpenID Connect built-in scope: offline_access", "protocol": "openid-connect", "attributes": { "include.in.token.scope": "true", "display.on.consent.screen": "true" } }, { "name": "microprofile-jwt", "description": "Microprofile JWT scope", "protocol": "openid-connect", "attributes": { "include.in.token.scope": "true", "display.on.consent.screen": "false" } } ], "clientScopeMappings": { "ashid-sales-de-api": [ { "client": "ashid-sales-de-api", "roles": ["agent"] } ] }, "scopeMappings": [], "applications": [], "oauthClients": [], "browserSecurityHeaders": { "contentSecurityPolicyReportOnly": "", "xContentTypeOptions": "nosniff", "xRobotsTag": "none", "xFrameOptions": "SAMEORIGIN", "xXSSProtection": "1; mode=block", "contentSecurityPolicy": "frame-src 'self'; frame-ancestors 'self'; object-src 'none';" }, "smtpServer": {}, "eventsEnabled": false, "eventsListeners": ["jboss-logging"], "enabledEventTypes": [], "adminEventsEnabled": false, "adminEventsDetailsEnabled": false, "identityProviders": [], "identityProviderMappers": [], "components": {}, "internationalizationEnabled": false, "supportedLocales": [], "defaultLocale": "", "authenticatorConfig": [], "requiredActions": [], "browserFlow": "browser", "registrationFlow": "registration", "directGrantFlow": "direct grant", "resetCredentialsFlow": "reset credentials", "clientAuthenticationFlow": "clients", "dockerAuthenticationFlow": "docker auth", "attributes": {}, "keycloakVersion": "23.0.4", "userManagedAccessAllowed": false, "authenticationFlows": [ { "id": "browser", "alias": "browser", "description": "Browser based authentication", "providerId": "basic-flow", "topLevel": true, "builtIn": true, "authenticationExecutions": [] }, { "id": "registration", "alias": "registration", "description": "Registration flow", "providerId": "basic-flow", "topLevel": true, "builtIn": true, "authenticationExecutions": [] }, { "id": "direct grant", "alias": "direct grant", "description": "Direct grant flow", "providerId": "basic-flow", "topLevel": true, "builtIn": true, "authenticationExecutions": [] }, { "id": "reset credentials", "alias": "reset credentials", "description": "Reset credentials flow", "providerId": "basic-flow", "topLevel": true, "builtIn": true, "authenticationExecutions": [] }, { "id": "clients", "alias": "clients", "description": "Client authentication flow", "providerId": "client-flow", "topLevel": true, "builtIn": true, "authenticationExecutions": [] }, { "id": "docker auth", "alias": "docker auth", "description": "Docker authentication flow", "providerId": "basic-flow", "topLevel": true, "builtIn": true, "authenticationExecutions": [] } ], "clientProfiles": { "profiles": [] }, "clientPolicies": { "policies": [] } }and docker-compose.yml
`keycloak:
image: quay.io/keycloak/keycloak:23.0.4
container_name: ashid-keycloak
environment:
KC_DB: postgres
KC_DB_URL: jdbc:postgresql://postgres:5432/${POSTGRES_DB:-ashid_sales_de}
KC_DB_USERNAME: ${POSTGRES_USER:-postgres}
KC_DB_PASSWORD: ${POSTGRES_PASSWORD:-postgres}
KC_HOSTNAME: ${KEYCLOAK_HOSTNAME:-localhost}
KC_HOSTNAME_PORT: ${KEYCLOAK_PORT:-8080}
KC_HOSTNAME_STRICT: false
KC_HOSTNAME_STRICT_HTTPS: false
KC_LOG_LEVEL: ${KEYCLOAK_LOG_LEVEL:-INFO}
KC_METRICS_ENABLED: true
KC_HEALTH_ENABLED: true
KEYCLOAK_ADMIN: ${KEYCLOAK_ADMIN:-admin}
KEYCLOAK_ADMIN_PASSWORD: ${KEYCLOAK_ADMIN_PASSWORD:-admin}
ports:
- "${KEYCLOAK_PORT:-8080}:8080"
depends_on:
- postgres
volumes:
- ./deployment/keycloak/themes:/opt/keycloak/themes
- ./deployment/keycloak/realm-import.json:/opt/keycloak/data/import/realm-import.json
command:
- start-dev
- --import-realm
networks:
- ashid-network
healthcheck:
test: ["CMD-SHELL", "exec 3<>/dev/tcp/localhost/${KEYCLOAK_PORT:-8080} && echo -e 'GET /realms/master HTTP/1.1\r\nHost: localhost\r\n\r\n' >&3 && timeout 1 cat <&3 | grep -q 'HTTP/1.1 200'"]
interval: 30s
timeout: 10s
retries: 3
start_period: 60s
restart: unless-stopped
`
All reactions