Keycloak reverse proxy with nginx - infinite redirects #40111

dylanlonglands · 2025-05-30T20:57:04Z

dylanlonglands
May 30, 2025

Hey all,

Posting this here as I've been banging my head against this problem for a while, and my colleagues and I are unsure of what to do. I'm hoping someone with a bit more experience using Keycloak may be able to point me in the right direction.

I'm trying to run keycloak in docker as part of a wider application, and serve it over a subpath using nginx.

Image: quay.io/keycloak/keycloak:24.0.3

I've got it to the point where I am able to reach the keycloak login screen by visiting /keycloak, but after logging in, I am met with an infinite redirect loop from keycloak/admin/console. I've tried different nginx configs and different keycloak env variables all to no avail so far.

From reading up on other issues I've heard it could be problems with the path of the cookies that are being returned, but I'm unsure how to fix that or if it even is the issue. The path returned is /keycloak/realms/master which seems normal to me.

Here is my current config for the setup:

Keycloak env vars

KEYCLOAK_ADMIN=admin
KEYCLOAK_ADMIN_PASSWORD=admin
KC_DB=postgres
KC_DB_URL=***
KC_DB_USERNAME=***
KC_DB_PASSWORD=***
KC_HTTP_ENABLED=true
KC_PROXY=edge
KC_PROXY_HEADERS=xforwarded
#KC_HOSTNAME=localhost
KC_HOSTNAME_STRICT=false
KC_HOSTNAME_STRICT_HTTPS=false
KC_HTTP_RELATIVE_PATH=/keycloak
PROXY_ADDRESS_FORWARING=true
KC_LOG_LEVEL=DEBUG

Nginx config

location /keycloak/ {
    proxy_pass http://keycloak:8080; --> container address via docker bridge network
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-Forwarded-Host $host;
    proxy_set_header X-Forwarded-Port $server_port;
    proxy_set_header X-Forwarded-Prefix /keycloak;
    add_header Content-Security-Policy "frame-ancestors *" always;
}

I should also add these console errors that appear during the infinite redirect loop from inside the keycloak container:

2025-05-30 20:42:11,060 DEBUG [org.keycloak.authentication.AuthenticationProcessor] (executor-thread-6) AUTHENTICATE CLIENT
2025-05-30 20:42:11,060 DEBUG [org.keycloak.authentication.ClientAuthenticationFlow] (executor-thread-6) client authenticator: client-secret
2025-05-30 20:42:11,060 DEBUG [org.keycloak.authentication.ClientAuthenticationFlow] (executor-thread-6) client authenticator SUCCESS: client-secret
2025-05-30 20:42:11,060 DEBUG [org.keycloak.authentication.ClientAuthenticationFlow] (executor-thread-6) Client security-admin-console authenticated by client-secret
2025-05-30 20:42:11,061 DEBUG [org.keycloak.protocol.oidc.utils.RedirectUtils] (executor-thread-6) replacing relative valid redirect with: https://192.168.19.55/keycloak/admin/master/console/*
2025-05-30 20:42:11,061 DEBUG [org.keycloak.protocol.oidc.utils.RedirectUtils] (executor-thread-6) replacing relative valid redirect with: https://192.168.19.55/keycloak/admin/master/console/*
2025-05-30 20:42:11,061 DEBUG [org.keycloak.jose.jws.DefaultTokenManager] (executor-thread-6) Failed to decode token: org.keycloak.jose.jws.JWSInputException: java.lang.IllegalArgumentException: Parsing error
	at org.keycloak.jose.jws.JWSInput.<init>(JWSInput.java:59)
	at org.keycloak.jose.jws.DefaultTokenManager.decode(DefaultTokenManager.java:92)
	at org.keycloak.protocol.oidc.TokenManager.toRefreshToken(TokenManager.java:554)
	at org.keycloak.protocol.oidc.TokenManager.verifyRefreshToken(TokenManager.java:505)
	at org.keycloak.protocol.oidc.TokenManager.refreshAccessToken(TokenManager.java:404)
	at org.keycloak.protocol.oidc.grants.RefreshTokenGrantType.process(RefreshTokenGrantType.java:75)
	at org.keycloak.protocol.oidc.endpoints.TokenEndpoint.processGrantRequest(TokenEndpoint.java:139)
	at org.keycloak.protocol.oidc.endpoints.TokenEndpoint$quarkusrestinvoker$processGrantRequest_6408e15340992839b66447750c221d9aaa837bd7.invoke(Unknown Source)
	at org.jboss.resteasy.reactive.server.handlers.InvocationHandler.handle(InvocationHandler.java:29)
	at io.quarkus.resteasy.reactive.server.runtime.QuarkusResteasyReactiveRequestContext.invokeHandler(QuarkusResteasyReactiveRequestContext.java:141)
	at org.jboss.resteasy.reactive.common.core.AbstractResteasyReactiveContext.run(AbstractResteasyReactiveContext.java:147)
	at io.quarkus.vertx.core.runtime.VertxCoreRecorder$14.runWith(VertxCoreRecorder.java:582)
	at org.jboss.threads.EnhancedQueueExecutor$Task.run(EnhancedQueueExecutor.java:2513)
	at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1538)
	at org.jboss.threads.DelegatingRunnable.run(DelegatingRunnable.java:29)
	at org.jboss.threads.ThreadLocalResettingRunnable.run(ThreadLocalResettingRunnable.java:29)
	at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30)
	at java.base/java.lang.Thread.run(Thread.java:840)
Caused by: java.lang.IllegalArgumentException: Parsing error
	at org.keycloak.jose.jws.JWSInput.<init>(JWSInput.java:46)
	... 17 more

2025-05-30 20:42:11,061 DEBUG [org.keycloak.transaction.JtaTransactionWrapper] (executor-thread-6) new JtaTransactionWrapper
2025-05-30 20:42:11,061 DEBUG [org.keycloak.transaction.JtaTransactionWrapper] (executor-thread-6) was existing? true
2025-05-30 20:42:11,061 DEBUG [org.keycloak.transaction.JtaTransactionWrapper] (executor-thread-6) JtaTransactionWrapper  commit
2025-05-30 20:42:11,062 DEBUG [org.keycloak.transaction.JtaTransactionWrapper] (executor-thread-6) JtaTransactionWrapper end
2025-05-30 20:42:11,062 DEBUG [org.keycloak.transaction.JtaTransactionWrapper] (executor-thread-6) JtaTransactionWrapper resuming suspended
2025-05-30 20:42:11,062 WARN  [org.keycloak.events] (executor-thread-6) type="REFRESH_TOKEN_ERROR", realmId="719d10bf-5470-41eb-8ec8-4849868acd39", clientId="security-admin-console", userId="null", ipAddress="192.168.224.234", error="invalid_token", grant_type="refresh_token", client_auth_method="client-secret"
2025-05-30 20:42:11,062 DEBUG [WebApplicationException] (executor-thread-6) Restarting handler chain for exception exception: org.keycloak.services.CorsErrorResponseException: HTTP 500 Internal Server Error
	at org.keycloak.protocol.oidc.grants.RefreshTokenGrantType.process(RefreshTokenGrantType.java:98)
	at org.keycloak.protocol.oidc.endpoints.TokenEndpoint.processGrantRequest(TokenEndpoint.java:139)
	at org.keycloak.protocol.oidc.endpoints.TokenEndpoint$quarkusrestinvoker$processGrantRequest_6408e15340992839b66447750c221d9aaa837bd7.invoke(Unknown Source)
	at org.jboss.resteasy.reactive.server.handlers.InvocationHandler.handle(InvocationHandler.java:29)
	at io.quarkus.resteasy.reactive.server.runtime.QuarkusResteasyReactiveRequestContext.invokeHandler(QuarkusResteasyReactiveRequestContext.java:141)
	at org.jboss.resteasy.reactive.common.core.AbstractResteasyReactiveContext.run(AbstractResteasyReactiveContext.java:147)
	at io.quarkus.vertx.core.runtime.VertxCoreRecorder$14.runWith(VertxCoreRecorder.java:582)
	at org.jboss.threads.EnhancedQueueExecutor$Task.run(EnhancedQueueExecutor.java:2513)
	at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1538)
	at org.jboss.threads.DelegatingRunnable.run(DelegatingRunnable.java:29)
	at org.jboss.threads.ThreadLocalResettingRunnable.run(ThreadLocalResettingRunnable.java:29)
	at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30)
	at java.base/java.lang.Thread.run(Thread.java:840)

2025-05-30 20:42:11,062 DEBUG [org.keycloak.services.cors.DefaultCors] (executor-thread-6) Added CORS headers to response
2025-05-30 20:42:11,062 DEBUG [org.keycloak.transaction.JtaTransactionWrapper] (executor-thread-6) JtaTransactionWrapper  commit
2025-05-30 20:42:11,062 DEBUG [org.keycloak.transaction.JtaTransactionWrapper] (executor-thread-6) JtaTransactionWrapper end
2025-05-30 20:42:11,181 DEBUG [org.keycloak.transaction.JtaTransactionWrapper] (executor-thread-6) new JtaTransactionWrapper
2025-05-30 20:42:11,181 DEBUG [org.keycloak.transaction.JtaTransactionWrapper] (executor-thread-6) was existing? false
2025-05-30 20:42:11,181 DEBUG [WebApplicationException] (executor-thread-6) Restarting handler chain for exception exception: jakarta.ws.rs.NotAuthorizedException: HTTP 401 Unauthorized
	at org.keycloak.services.resources.admin.AdminRoot.authenticateRealmAdminRequest(AdminRoot.java:168)
	at org.keycloak.services.resources.admin.AdminRoot.getServerInfo(AdminRoot.java:263)
	at org.keycloak.services.resources.admin.AdminRoot$quarkusrestinvoker$getServerInfo_af58ef46002deb1ad4721c04a79203aeec92de8e.invoke(Unknown Source)
	at org.jboss.resteasy.reactive.server.handlers.InvocationHandler.handle(InvocationHandler.java:29)
	at io.quarkus.resteasy.reactive.server.runtime.QuarkusResteasyReactiveRequestContext.invokeHandler(QuarkusResteasyReactiveRequestContext.java:141)
	at org.jboss.resteasy.reactive.common.core.AbstractResteasyReactiveContext.run(AbstractResteasyReactiveContext.java:147)
	at io.quarkus.vertx.core.runtime.VertxCoreRecorder$14.runWith(VertxCoreRecorder.java:582)
	at org.jboss.threads.EnhancedQueueExecutor$Task.run(EnhancedQueueExecutor.java:2513)
	at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1538)
	at org.jboss.threads.DelegatingRunnable.run(DelegatingRunnable.java:29)
	at org.jboss.threads.ThreadLocalResettingRunnable.run(ThreadLocalResettingRunnable.java:29)
	at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30)
	at java.base/java.lang.Thread.run(Thread.java:840)

2025-05-30 20:42:11,181 DEBUG [org.keycloak.services.error.KeycloakErrorHandler] (executor-thread-6) Error response 401: jakarta.ws.rs.NotAuthorizedException: HTTP 401 Unauthorized
	at org.keycloak.services.resources.admin.AdminRoot.authenticateRealmAdminRequest(AdminRoot.java:168)
	at org.keycloak.services.resources.admin.AdminRoot.getServerInfo(AdminRoot.java:263)
	at org.keycloak.services.resources.admin.AdminRoot$quarkusrestinvoker$getServerInfo_af58ef46002deb1ad4721c04a79203aeec92de8e.invoke(Unknown Source)
	at org.jboss.resteasy.reactive.server.handlers.InvocationHandler.handle(InvocationHandler.java:29)
	at io.quarkus.resteasy.reactive.server.runtime.QuarkusResteasyReactiveRequestContext.invokeHandler(QuarkusResteasyReactiveRequestContext.java:141)
	at org.jboss.resteasy.reactive.common.core.AbstractResteasyReactiveContext.run(AbstractResteasyReactiveContext.java:147)
	at io.quarkus.vertx.core.runtime.VertxCoreRecorder$14.runWith(VertxCoreRecorder.java:582)
	at org.jboss.threads.EnhancedQueueExecutor$Task.run(EnhancedQueueExecutor.java:2513)
	at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1538)
	at org.jboss.threads.DelegatingRunnable.run(DelegatingRunnable.java:29)
	at org.jboss.threads.ThreadLocalResettingRunnable.run(ThreadLocalResettingRunnable.java:29)
	at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30)
	at java.base/java.lang.Thread.run(Thread.java:840)

Attached image of what the network logs look like while this redirect loop is occuring

Answered by dylanlonglands

Jun 6, 2025

After verifying that we could proxy to keycloak locally, we got it working eventually - turned out to be one of the global proxy headers that was interfering with the cookies

proxy_cookie_path ~(.*) "$1; SameSite=strict; secure; httponly";

This seemed to be interfering with the cookies coming back from keycloak, which would explain why the refresh token was absent on the second token request.

Thank you for all of your help and input on this, you helped greatly with my understanding of how Keycloak should work and all of the intricacies involved with hosting it behind a reverse proxy

View full answer

shawkins · 2025-06-02T13:36:45Z

shawkins
Jun 2, 2025
Collaborator

Please use a newer version of keycloak using only hostname v2 options. The parse exception was last reported with #26696 and already marked as resolved by using hostname v2.

39 replies

dylanlonglands Jun 5, 2025
Author

Yep, no issues running that on podman with the relative path

shawkins Jun 5, 2025
Collaborator

Ok that's likely progress. You should be able to confirm using a proxy to access that instance as well.

dylanlonglands Jun 5, 2025
Author

Trying to run an nginx container with podman to set up a proxy to test, but having trouble getting it to map to any ports on my machine.

Its late evening here now, will keep trying to set up this proxy locally in the morning and get back with an update tomorrow!

dylanlonglands Jun 6, 2025
Author

After verifying that we could proxy to keycloak locally, we got it working eventually - turned out to be one of the global proxy headers that was interfering with the cookies

proxy_cookie_path ~(.*) "$1; SameSite=strict; secure; httponly";

This seemed to be interfering with the cookies coming back from keycloak, which would explain why the refresh token was absent on the second token request.

Thank you for all of your help and input on this, you helped greatly with my understanding of how Keycloak should work and all of the intricacies involved with hosting it behind a reverse proxy

Answer selected by dylanlonglands

shawkins Jun 7, 2025
Collaborator

Glad to help. It's good to have identified the issue as I don't think we've commonly seen this.

Navigation Menu

Repository navigation

Keycloak reverse proxy with nginx - infinite redirects #40111

Uh oh!

{{title}}

Uh oh!

Replies: 1 comment 39 replies

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Keycloak reverse proxy with nginx - infinite redirects #40111

Uh oh!

dylanlonglands May 30, 2025

Here is my current config for the setup:

Replies: 1 comment · 39 replies

Uh oh!

shawkins Jun 2, 2025 Collaborator

Uh oh!

dylanlonglands Jun 5, 2025 Author

Uh oh!

shawkins Jun 5, 2025 Collaborator

Uh oh!

dylanlonglands Jun 5, 2025 Author

Uh oh!

dylanlonglands Jun 6, 2025 Author

Uh oh!

shawkins Jun 7, 2025 Collaborator

dylanlonglands
May 30, 2025

Replies: 1 comment 39 replies

shawkins
Jun 2, 2025
Collaborator

dylanlonglands Jun 5, 2025
Author

shawkins Jun 5, 2025
Collaborator

dylanlonglands Jun 5, 2025
Author

dylanlonglands Jun 6, 2025
Author

shawkins Jun 7, 2025
Collaborator