Keycloak does not start in azure app service when using custom domain as KC_HOST #42020

SenneVerhaegen · 2025-08-20T21:07:59Z

SenneVerhaegen
Aug 20, 2025

Hi all,

In short I'm trying to have a nice and trusted URL for my end users. However, when I provide my custom domain as KC_HOST, keycloak fails to start. I will describe my setup below.

Keycloak 26.3.0 container running in Azure App Service
Keycloak container is in a subnet "sn-backend" => publicly accessible
Postgres database is in subnet "sn-database". Only inbound postgres traffic is allowed (TCP 5432) from the same vnet,
A VNET integration is made such that the keycloak container can communicate with the database.
Added a custom domain ("www.keycloak.test.mycustomdomain.com") to the app service

When I set KC_HOST as the default azure generated one (e.g. app-keycloak-test.azurewebsites.net), everything works fine. I can navigate to keycloak.test.mycustomdomain.com, however the URL in the browsers gets changed back to app-keycloak-test.azurewebsites.net
I would like that it still shows my custom domain.

When I set KC_HOST as "https://keycloak.test.mycustomdomain.com", the keycloak container fails to start.

It seems like it's still trying to use ispn instead of local cache, even though I specified that in the start script. But actually it should still work with ispn, because I have verified that everything works when using the default azure host names.

My docker image looks like this:

FROM quay.io/keycloak/keycloak:26.3.0 AS builder

ENV KC_HEALTH_ENABLED=true
ENV KC_METRICS_ENABLED=true
ENV KC_DB=postgres

WORKDIR /opt/keycloak

RUN /opt/keycloak/bin/kc.sh build

FROM quay.io/keycloak/keycloak:26.3.0
COPY --from=builder /opt/keycloak/ /opt/keycloak/

COPY start-keycloak.sh /opt/keycloak/start-keycloak.sh
USER root
RUN chown 1000 /opt/keycloak/start-keycloak.sh
USER 1000
RUN chmod +x /opt/keycloak/start-keycloak.sh

ENTRYPOINT ["/opt/keycloak/start-keycloak.sh"]

#!/bin/sh

# # App Service terminates TLS/SSL at the front ends. 
# # That means that TLS/SSL requests never get to the app.
# # We don't need to, and shouldn't implement any support for TLS/SSL.
# # Configure HTTP and proxy
exec /opt/keycloak/bin/kc.sh start --optimized --http-enabled=true --proxy-headers=xforwarded --hostname=$KC_HOST --cache=local --log-level=$LOG_LEVEL

Logs:

2025-08-20T20:33:12.5685233Z 2025-08-20 20:33:12,567 INFO  [org.keycloak.spi.infinispan.impl.embedded.JGroupsConfigurator] (main) JGroups JDBC_PING discovery enabled.
2025-08-20T20:33:14.0319704Z 2025-08-20 20:33:14,031 INFO  [org.infinispan.CONTAINER] (main) ISPN000556: Starting user marshaller 'org.infinispan.commons.marshall.ImmutableProtoStreamMarshaller'/appsvctmp/volatile/logs/runtime/container.1.log
2025-08-20T19:01:29.7260305Z 2025-08-20 19:01:29,722 DEBUG [com.arjuna.ats.arjuna] (Periodic Recovery) PeriodicRecovery: background thread exiting
2025-08-20T19:01:29.7531900Z 2025-08-20 19:01:29,752 DEBUG [org.hibernate.orm.beans] (Shutdown thread) HHH10005004: Stopping BeanContainer: io.quarkus.hibernate.orm.runtime.cdi.QuarkusArcBeanContainer@6a57dab5
2025-08-20T19:01:29.7543172Z 2025-08-20 19:01:29,754 DEBUG [io.quarkus.arc.impl] (Shutdown thread) ArC DI container shut down
2025-08-20T19:01:29.7604185Z 2025-08-20 19:01:29,760 DEBUG [io.quarkus.runtime.util.NoopShutdownScheduledExecutorService] (vert.x-eventloop-thread-2) shutdownNow() not allowed on managed executor service
2025-08-20T19:01:29.7687979Z 2025-08-20 19:01:29,768 DEBUG [io.netty.buffer.PoolThreadCache] (vert.x-eventloop-thread-1) Freed 2 thread-local buffer(s) from thread: vert.x-eventloop-thread-1
2025-08-20T19:01:29.7689182Z 2025-08-20 19:01:29,768 DEBUG [io.netty.buffer.PoolThreadCache] (vert.x-eventloop-thread-3) Freed 2 thread-local buffer(s) from thread: vert.x-eventloop-thread-3
2025-08-20T19:01:29.7692519Z 2025-08-20 19:01:29,769 DEBUG [io.netty.buffer.PoolThreadCache] (vert.x-eventloop-thread-0) Freed 4 thread-local buffer(s) from thread: vert.x-eventloop-thread-0
2025-08-20T19:01:29.7692630Z 2025-08-20 19:01:29,769 DEBUG [io.netty.buffer.PoolThreadCache] (vert.x-eventloop-thread-2) Freed 3 thread-local buffer(s) from thread: vert.x-eventloop-thread-2
2025-08-20T19:01:29.7708468Z 2025-08-20 19:01:29,770 DEBUG [io.quarkus.thread-pool] (Shutdown thread) loop: 1, remaining: 60000000000, intervalRemaining: 5000000000, interruptRemaining: 10000000000
2025-08-20T19:01:29.7789364Z 2025-08-20 19:01:29,770 INFO  [io.quarkus] (Shutdown thread) Keycloak stopped in 0.915s/appsvctmp/volatile/logs/runtime/container.2.log
2025-08-18T14:35:44.6238740Z 	at io.agroal.pool.ConnectionPool.handlerFromSharedCache(ConnectionPool.java:344)
2025-08-18T14:35:44.6238756Z 	... 18 more
2025-08-18T14:35:44.6238793Z
2025-08-18T14:35:44.6531013Z 2025-08-18 14:35:44,652 WARN  [io.agroal.pool] (agroal-11) Datasource '<default>': The connection attempt failed.
2025-08-18T14:36:24.2687721Z 2025-08-18 14:36:24,268 ERROR [org.keycloak.jgroups.protocol.KEYCLOAK_JDBC_PING2] () a1a63804469a-24602: failed reading from the DB: java.lang.RuntimeException: Failed to obtain JDBC connection
2025-08-18T14:36:24.2688390Z 	at org.keycloak.quarkus.runtime.storage.database.jpa.AbstractJpaConnectionProviderFactory.getConnection(AbstractJpaConnectionProviderFactory.java:56)
2025-08-18T14:36:24.2688428Z 	at org.keycloak.jgroups.protocol.KEYCLOAK_JDBC_PING2.getConnection(KEYCLOAK_JDBC_PING2.java:80)
2025-08-18T14:36:24.2688450Z 	at org.jgroups.protocols.JDBC_PING2.readFromDB(JDBC_PING2.java:225)
2025-08-18T14:36:24.2688473Z 	at org.jgroups.protocols.JDBC_PING2.readAll(JDBC_PING2.java:209)
2025-08-18T14:36:24.2688503Z 	at org.jgroups.protocols.FILE_PING.findMembers(FILE_PING.java:146)Ending Log Tail of existing logs ---Starting Live Log Stream ---
2025-08-20T20:33:15.6559118Z 2025-08-20 20:33:15,655 INFO  [org.keycloak.connections.infinispan.DefaultInfinispanConnectionProviderFactory] (main) Node name: node_396573, Site name: null
2025-08-20T20:33:19.6094859Z 2025-08-20 20:33:19,608 INFO  [io.quarkus] (main) Keycloak 26.3.0 on JVM (powered by Quarkus 3.20.1) started in 25.113s. Listening on: http://0.0.0.0:8080. Management interface listening on http://0.0.0.0:9000.
2025-08-20T20:33:19.6135768Z 2025-08-20 20:33:19,613 INFO  [io.quarkus] (main) Profile prod activated.
2025-08-20T20:33:19.6145269Z 2025-08-20 20:33:19,614 INFO  [io.quarkus] (main) Installed features: [agroal, cdi, hibernate-orm, jdbc-postgresql, keycloak, micrometer, narayana-jta, opentelemetry, reactive-routes, rest, rest-jackson, smallrye-context-propagation, smallrye-health, vertx]
2025-08-20T20:33:40.4705920Z 2025-08-20 20:33:40,470 INFO  [com.arjuna.ats.jbossatx] (Shutdown thread) ARJUNA032014: Stopping transaction recovery manager
2025-08-20T20:33:40.5166328Z 2025-08-20 20:33:40,516 INFO  [io.quarkus] (Shutdown thread) Keycloak stopped in 0.151s
[keycloak-logstream.txt](https://github.com/user-attachments/files/21906202/keycloak-logstream.txt)

shawkins · 2025-08-21T13:17:47Z

shawkins
Aug 21, 2025
Collaborator

When I set KC_HOST as "https://keycloak.test.mycustomdomain.com/", the keycloak container fails to start.

There is nothing that I know of nor shown here related to the hostname setting that would prevent the server from starting.

It seems like it's still trying to use ispn instead of local cache, even though I specified that in the start script.

That does seem to be a bug / enhancement. cc @pruivo @ryanemerson when the cache is set to local jdbc ping discovery still seems to be used.

Note that local mode is really only for dev / testing scenarios.

Failed to obtain JDBC connection

Is the database down or not ready?

3 replies

pruivo Aug 21, 2025
Collaborator

@shawkins jdbc-ping stack is configured but never started. I'll create an issue to remove the log entry.

Please note that the KEYCLOAK_JDBC_PING2 error does not belong to the logs, as the timestamp is quite old.

SenneVerhaegen Aug 21, 2025
Author

The database is up and running. I suppose it has something to do with the hostname and DNS resolution, but I don't have much experience in it.

shawkins Aug 21, 2025
Collaborator

@shawkins jdbc-ping stack is configured but never started. I'll create an issue to remove the log entry.

Ok, so it still has to do some db access in configureDiscovery, but doesn't actually run.

Please note that the KEYCLOAK_JDBC_PING2 error does not belong to the logs, as the timestamp is quite old.

Right it's quite likely from an entirely different run.

The database is up and running. I suppose it has something to do with the hostname and DNS resolution, but I don't have much experience in it.

Again there's nothing about the hostname setting that would prevent the server from starting. Also there's nothing in the log showing why the instance is stopping. It could be related to whatever is configured as your azure health checks.

Navigation Menu

Repository navigation

Keycloak does not start in azure app service when using custom domain as KC_HOST #42020

Uh oh!

{{title}}

Uh oh!

Replies: 1 comment 3 replies

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Keycloak does not start in azure app service when using custom domain as KC_HOST #42020

Uh oh!

SenneVerhaegen Aug 20, 2025

Replies: 1 comment · 3 replies

Uh oh!

shawkins Aug 21, 2025 Collaborator

Uh oh!

pruivo Aug 21, 2025 Collaborator

Uh oh!

SenneVerhaegen Aug 21, 2025 Author

Uh oh!

shawkins Aug 21, 2025 Collaborator

SenneVerhaegen
Aug 20, 2025

Replies: 1 comment 3 replies

shawkins
Aug 21, 2025
Collaborator

pruivo Aug 21, 2025
Collaborator

SenneVerhaegen Aug 21, 2025
Author

shawkins Aug 21, 2025
Collaborator