Can't access to keycloak admin manager behind apache reverse-proxy #41674

aliceboizet · 2025-08-05T15:48:56Z

aliceboizet
Aug 5, 2025

I tried to deploy keycloak with an apache reverse-proxy. Keycloak is running in a docker container. It worked until we got a valid SSL certificate. Now when I try to access the master realm with the admin user, I get an infinite loop trying to log me in. I added the parameter KC_PROXY_HEADERS=xforwarded suggested in #33109 but still not working.

Here is the apache conf :


<VirtualHost *:80>
    ServerName keycloak-alias         

    ErrorLog /opt/www/keycloak-alias/logs/error.log

    # Redirect to HTTPS
    Redirect permanent / https://keycloak-alias/

</VirtualHost>

# HTTPS - reverse proxy to Keycloak
<VirtualHost *:443>
    ServerName keycloak-alias  
    
    ErrorLog /opt/www/keycloak-alias/logs/error.log

    SSLEngine on

    SSLCertificateFile    "/opt/httpd/conf/ssl/fr_bundle.pem"
    SSLCertificateKeyFile    "/opt/httpd/conf/ssl/fr.key"

    # Reverse proxy configuration
    ProxyPreserveHost On
    ProxyPass / http://localhost:8085/
    ProxyPassReverse / http://localhost:8085/

    RequestHeader set X-Forwarded-Proto "https"
    RequestHeader set X-Forwarded-Port "443"

    ProxyPassReverseCookieDomain localhost keycloak-alias
    ProxyPassReverseCookiePath / /

</VirtualHost>

and the docker-compose.yml keycloak part:

keycloak:
    image: quay.io/keycloak/keycloak:25.0.6
    container_name: keycloak
    ports:
      - 8085:8080
    environment:
      - KEYCLOAK_ADMIN=admin
      - KEYCLOAK_ADMIN_PASSWORD=admin
      - KC_HTTP_ENABLED=true
      - KC_PROXY=edge
      - KC_HOSTNAME_STRICT=false
      - KC_PROXY_HEADERS=xforwarded
      - KC_HOSTNAME=keycloak-alias
      - KC_HOSTNAME_DEBUG=true
    volumes:
      - keycloak:/opt/keycloak/data/
    restart: always
    command:
      - "start-dev"
    networks:
      - nirs_api_net

Here is what I get from hostname_debug:

URL	Value
Request	https://keycloak-alias/realms/master/hostname-debug
Frontend	https://keycloak-alias/ [OK]
Backend	https://keycloak-alias/ [OK]
Admin	https://keycloak-alias/ [OK]
Runtime	Value
Server mode	dev [start-dev]
Realm	master
Hostname SPI implementation	V2
Configuration property	Value
hostname	keycloak-alias
hostname-backchannel-dynamic	false
hostname-strict	false
proxy-headers	xforwarded
http-enabled	true
http-relative-path	/
http-port	8080
https-port	8443
Header	Value
Host	keycloak-alias
X-Forwarded-For	10.1.16.46
X-Forwarded-Host	keycloak-alias
X-Forwarded-Port	443
X-Forwarded-Proto	https

In the browser console, I get this:

Any clue ?

shawkins · 2025-08-06T15:42:59Z

shawkins
Aug 6, 2025
Collaborator

Try removing those additional cookie directives.

2 replies

I actually added them hoping they would fix my problem but nothing changed.

shawkins Aug 7, 2025
Collaborator

More than likely the problem is with the proxy configuration.

It's not clear from the screen shot what is happening with the request. Can you show more about what looks like an infinite loop and the response codes you are seeing? I thought it may be something the proxy was doing to the cookies due to the similarity with #40111

From the hostname debug page things look from from the keycloak side - it knows the front end url should be https://keycloak-alias/ with the default port of 443, and that url is reachable. You can also confirm the responses you are getting from keycloak by

increased proxy logging
curl (a custom image that includes curl or by bringing up a container with curl) to directly issue requests with the appropriate headers to the keycloak instance

Navigation Menu

Repository navigation

Can't access to keycloak admin manager behind apache reverse-proxy #41674

Uh oh!

{{title}}

Uh oh!

Replies: 1 comment 2 replies

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Can't access to keycloak admin manager behind apache reverse-proxy #41674

Uh oh!

aliceboizet Aug 5, 2025

Replies: 1 comment · 2 replies

Uh oh!

shawkins Aug 6, 2025 Collaborator

Uh oh!

aliceboizet Aug 7, 2025 Author

Uh oh!

shawkins Aug 7, 2025 Collaborator

aliceboizet
Aug 5, 2025

Replies: 1 comment 2 replies

shawkins
Aug 6, 2025
Collaborator

aliceboizet Aug 7, 2025
Author

shawkins Aug 7, 2025
Collaborator