Repository navigation
Keycloak behind nginx with SSO #42005
Replies: 2 comments 2 replies
|
login is always redirected to the KC_HOSTNAME (ui-1), I am struggling with the same sort of issue. The reverse proxy for ui-* block the admin content. I dont know whether this is good enough or secure enough? |
See #37238
If hostname is set, then hostname-strict has no affect - the front end host, if not the whole url, is determined from the hostname setting. In the event that you want to accept admin traffic to a different url, you may then additionally set hostname-admin. |
|
Did you manage to keep SSO working with |
|
This seems to come up quite often. Other similar discussions: #41088 #41858 Other than the ability to set a front-end url per realm, you cannot have multiple front-end urls for keycloak unless you use hostname-strict=false as mentioned by @RutgerLubbers. If you do use hostname-strict=false, then you must be careful about securing the requests that reach keycloak, and effectively lose the notion of dynamic backchannel requests. |
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
I have a k8s cluster running multiple WebAPIs and multiple UIs, all of them using the one Keycloak container to enable Authentication/Authorization.
I've managed to have 1 UI and 1 WebAPI running successfully but now with multiple I'm facing issues.
User Interfaces and API's inside a k8s cluster:
Keycloak Config:
What is Working
Issues
I can't log in to UI-2. I can see the login page with my custom theme, but I encounter the following issues:
When I enter my credentials and try to log in, I keep getting redirected back to the login page.
I can't port-forward from the cluster to my local machine and access the admin console. I can see the login page:
However, after I enter the admin credentials, I receive the following error:
Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://ui-1/auth/realms/master/protocol/openid-connect/token. (Reason: CORS header ‘Access-Control-Allow-Origin’ does not match ‘http://localhost:8090, http://localhost:8090/’).(possible solution, use realm url instead of hostname?)
Extra Info
UI-1 Hostname Debug
UI-2 Hostname Debug
Does anyone know what I'm missing or if this setup is even possible?
All reactions