[keycloak-dev] Keycloak SSL Reverse Proxy settings

Stian Thorgersen sthorger at redhat.com
Tue Jul 12 05:50:03 EDT 2016


I'm pretty sure there's no changes. Has anything changed in your proxy
setup? Does it still work with 1.9.2, but the exact same config doesn't
work with 2.0.0?

On 8 July 2016 at 10:59, gambol <gambol99 at gmail.com> wrote:

> Hiya
>
>
> We've been running v1.9.2 behind a nginx proxy for some time now. Has the
> setup for running Keycloak v2.0.0-Final behind a proxy changed? ... We've
> kept the amended lines, but Keycloak is returns content in non-https
> appearing to ignore the X-Forwarded-Proto
>
>> <http-listener name="default" socket-binding="http"
> proxy-address-forwarding="true" redirect-socket="proxy-https"/>
> ...
>
> <socket-binding name="ajp" port="${jboss.ajp.port:8009}"/>
>
> <socket-binding name="http" port="${jboss.http.port:8080}"/>
>
> <socket-binding name="https" port="${jboss.https.port:8443}"/>
>
> <socket-binding name="proxy-https" port="443"/> <---
>
> ...
> ------------------------------
>
> But looking at the urls handed back, they are all http://
>
>
> Doing a tcpdump dump between proxy and keycloak, I can see the X-Forwarded
> headers added by the proxy
>
> GET /auth/admin/master/console/ HTTP/1.0
> X-Real-IP: 127.0.0.1
> X-Forwarded-For: 127.0.0.1
> X-Forwarded-Proto: https
> Host: 127.0.0.1
> Connection: close
> Cache-Control: max-age=0
> Upgrade-Insecure-Requests: 1
> User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML,
> like Gecko) Chrome/51.0.2704.106 Safari/537.36
> Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,
> */*;q=0.8
> Accept-Encoding: gzip, deflate, sdch, br
> Accept-Language: en-US,en;q=0.8
>
>
>
> _______________________________________________
> keycloak-dev mailing list
> keycloak-dev at lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-dev
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-dev/attachments/20160712/5bdb78e2/attachment.html 


More information about the keycloak-dev mailing list