<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">+1 to remove it.<br>
<br>
We can always re-add or add something different if people start to
complain <span class="moz-smiley-s3"><span> ;-) </span></span><br>
<br>
I guess that earlier or later, we may still need a possibility to
configure hostname for keycloak server. I think that there were
people with funky deployments having issues even if they don't use
auth-server-url-for-backend-requests. Other possibility instead of
introduce hostname might be to introduce list of valid URLs on
adapter side, which are acceptable as issuers of access token. But
who knows, maybe everyone can somehow fix his deployment and we
won't need anything <span class="moz-smiley-s1"><span> :-) </span></span><br>
<br>
Marek<br>
<br>
On 08/03/16 09:08, Stian Thorgersen wrote:<br>
</div>
<blockquote
cite="mid:CAJgngAc6uh7TfKYMT1BP=sCGUbe4Z4_nD2rBv5QaPdDJ14+2PA@mail.gmail.com"
type="cite">
<div dir="ltr">
<div>Currently we allow adapters to configure two urls for
Keycloak (auth-server-url and
auth-server-url-for-backend-requests). I propose we
remove auth-server-url-for-backend-requests.</div>
<div><br>
</div>
<div>The auth-server-url-for-backend-requests property was added
as a way for adapters to invoke Keycloak directly without
having to go through a load balancer or reverse proxy.</div>
<div><br>
</div>
<div>The issue with auth-server-url-for-backend-requests is that
the Keycloak server will not know the adapter is invoking
Keycloak from a different URL, which results in invalid URLs
in tokens and also if any links are generated (for example
verify email). </div>
<div><br>
</div>
<div>It also means that there's a need to have two separate
certificates configured for Keycloak as there are different
hostnames.</div>
<div><br>
</div>
<div>The currently proposed solution is to add a way to
configure the hostname for the Keycloak server. However, this
is an extra configuration requirement and is also a
significant amount of work to implement as well as potentially
quite error prone. This could further be problematic if there
is indeed two valid URLs for a server (for example <a
moz-do-not-send="true" href="http://company.com"><a class="moz-txt-link-freetext" href="http://company.com">http://company.com</a></a>
and <a moz-do-not-send="true"
href="http://internal.company.com">http://internal.company.com</a>).</div>
<div><br>
</div>
<div>We should simply remove
auth-server-url-for-backend-requests. If anyone wants to
bypass the load balancer for internal machines that should be
solved at the DNS level or by adding entries to the host file.
As the hostname remains the same there's no need for multiple
certificates, nor is there a need to hardcode the address on
the Keycloak server itself.</div>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
keycloak-dev mailing list
<a class="moz-txt-link-abbreviated" href="mailto:keycloak-dev@lists.jboss.org">keycloak-dev@lists.jboss.org</a>
<a class="moz-txt-link-freetext" href="https://lists.jboss.org/mailman/listinfo/keycloak-dev">https://lists.jboss.org/mailman/listinfo/keycloak-dev</a></pre>
</blockquote>
<br>
</body>
</html>