Unexpected "Update Account" form after login with Keycloak 26 behind reverse proxy #42727

ptite-ratte · 2025-09-18T09:16:32Z

ptite-ratte
Sep 18, 2025

Hi,

I’ve just set up Keycloak 26.3 in a Docker container on a VM. The container starts correctly without errors and is accessible through an Nginx reverse proxy configured as follows:

server {
    listen 443 ssl;
    server_name keycloak-kc01.mondomaine.fr;
    
    ssl_certificate /etc/nginx/certs/fullchain.pem;
    ssl_certificate_key /etc/nginx/certs/privkey.pem;

    location / {
        proxy_pass http://keycloak-kc01:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Port 443;
        proxy_set_header X-Forwarded-Host $host;
    }
}

My Keycloak Docker service is configured with environment variables for proxy, cookies, and cluster (JGroups/ISPN). The relevant variables include:

KC_HTTP_ENABLED: "true"
KC_PROXY_HEADERS: xforwarded
KC_PROXY: edge
KC_COOKIE_SECURE: "true"
KC_COOKIE_SAMESITE: "None"
KC_HOSTNAME: keycloak-kc01.mondomaine.fr

I created a client using OpenID Connect and a frontend JS application to test authentication:

const keycloakConfig: KeycloakOptions = {
  config: {
    url: 'https://keycloak-kc01.mondomaine.fr',
    realm: 'info-adm53',
    clientId: 'sensibilisation-ia-application'
  },
  initOptions: {
    onLoad: 'login-required',
    checkLoginIframe: false
  },
  bearerExcludedUrls: ['/assets']
};

The login flow works fine: I’m redirected to Keycloak login, credentials are accepted. However, after login I’m unexpectedly redirected to the “Update Account” form where I must enter email, first name, and last name.

Previously, I had a “cookie not found” issue after login, which I believe was resolved by setting:

KC_COOKIE_SECURE: "true"
KC_COOKIE_SAMESITE: "None"

I don’t understand why this “Update Account” form appears. I have reviewed all client settings and realm configurations in the admin console but cannot identify the cause.

Has anyone experienced this behavior on Keycloak 26 with Docker behind a reverse proxy? Could it be related to cookies, proxy settings, or some new behavior in Keycloak 26?

Thanks in advance for any guidance.

shawkins · 2025-09-18T14:22:26Z

shawkins
Sep 18, 2025
Collaborator

KC_PROXY: edge
KC_COOKIE_SECURE: "true"
KC_COOKIE_SAMESITE: "None"

None of these are valid options in KC 26.

I don’t understand why this “Update Account” form appears. I have reviewed all client settings and realm configurations in the admin console but cannot identify the cause.

Once the account has an email, first, and last name, are you still redirected to the update account screen?

Also what is your application sending as the redirect url?

0 replies

Navigation Menu

Repository navigation

Unexpected "Update Account" form after login with Keycloak 26 behind reverse proxy #42727

Uh oh!

{{title}}

Uh oh!

Replies: 1 comment

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Unexpected "Update Account" form after login with Keycloak 26 behind reverse proxy #42727

Uh oh!

ptite-ratte Sep 18, 2025

Replies: 1 comment

Uh oh!

shawkins Sep 18, 2025 Collaborator

ptite-ratte
Sep 18, 2025

shawkins
Sep 18, 2025
Collaborator