[keycloak-user] Keycloak Proxy passing thorugh unauthenticated

[Guy Bowdler]

Hi,

We've got the Keycloak Security Proxy (official one - 
https://keycloak.github.io/docs/userguide/keycloak-server/html/proxy.html) 
running and passing to an nginx proxy which is in turn proxying out 
different apps, ie:

[client] ----> [:80|443 KeyCloak Proxy ----> :8080 Nginx Reverse Proxy] 
------> [application]

Where [] denotes a different box, the ProxyBox is hostname.domain and 
the apps are published as hostname.domain/appname


However, the client is able to access the application without 
authentication, we have clients and roles set up in keycloak and the 
config looks ok (although obviously isn't!)

Are there any KeyCloak Proxy logs we can look at, or debugging options?  
I haven't found any as yet andnothing is jumping out of the config.

We can access the back end apps ok either from the Keycloak proxy 
running on ports 80 or 443 or via the nginx proxy on 8080 (and yes, this 
latter connection will be restricted to localhost when it's working!).   
The keycloak proxy config is very similar to the default except the 
values from the keycloak installation GUI have been pasted in.

Any troubleshooting tips would be much appreciated!

thanks in advance:)

Guy