Repository navigation
Replies: 1 comment
|
Please see https://www.keycloak.org/server/hostname and https://www.keycloak.org/server/reverseproxy
This is no longer a configuration option - you should see a warning in the log. You need to set proxy-headers instead.
Note that this is implied when the hostname setting is set. |
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Before reporting an issue
Area
core
Describe the bug
Hello Keycloak team,
⚠️ Important: I am using only one Ingress, which handles both URLs. The hostname separation is enforced at the network/DNS level, not via multiple ingress definitions.
I’m using the official Keycloak image (tested via Bitnami Helm chart 26.3.1) with a dual-hostname setup in Kubernetes:
• One internal URL (auth.internal.local) used exclusively for accessing the admin console (routed internally and restricted by IP or DNS).
• One external URL (auth.external.com) exposed via a WAF / reverse proxy, used for OIDC/SAML clients and user-facing authentication.
I’ve tried to configure Keycloak with the following extraEnvVars:
extraEnvVars:
value: auth.external.com
value: auth.internal.local
value: "true"
value: edge
I also tested with:
value: https://auth.external.com/
value: https://auth.internal.local/
❗ Problem:
When using this dual setup (either with KC_HOSTNAME_ADMIN or KC_HOSTNAME_ADMIN_URL), the admin console (/admin/master/console) enters an infinite redirect loop between:
/admin/master/console ↔︎ /admin/master/console/?state=...
If I remove the KC_HOSTNAME_ADMIN or KC_HOSTNAME_ADMIN_URL, everything gets redirected through the external URL (auth.external.com) — but this is not desirable for our security model.
Version
26.1.3
Regression
Expected behavior
Keycloak should support split access like:
• Internal admin access via auth.internal.local
• External public OIDC endpoints via auth.external.com
• Admin console working without infinite redirects
• Proper rendering of .well-known URLs with external URL
Actual behavior
After logging in successfully via the admin URL (https://auth.internal.local/admin/master/console), I am redirected to /admin/master/console/?state=..., which then loops back to /admin/master/console, creating an infinite redirect loop.
The login itself works (no invalid credentials), and session cookies are correctly set.
This issue occurs:
• Only in normal browsing mode (not in incognito/private mode)
• Only when KC_HOSTNAME_STRICT=true is set
• Only when KC_HOSTNAME_ADMIN or KC_HOSTNAME_ADMIN_URL is configured
If I remove KC_HOSTNAME_ADMIN and only keep KC_HOSTNAME, the redirect loop disappears — but all admin traffic is then routed via the external hostname, which breaks our security model (we want admin access restricted to the internal network).
How to Reproduce?
KC_HOSTNAME=auth.external.com
KC_HOSTNAME_ADMIN=auth.internal.local
KC_HOSTNAME_STRICT=true
KC_PROXY=edge
Configure a single ingress or reverse proxy that allows Keycloak to be reached under two different DNS names:
• https://auth.external.com/ (used by clients for OIDC/SAML flows, routed via WAF)
• https://auth.internal.local/ (used internally for admin access)
Access the Keycloak admin console via:
https://auth.internal.local/admin/master/console
Anything else?
No response
All reactions