[keycloak-user] Getting 401 if trying to access app via loadbalancer

[KASALA Štefan]

Hello,
Finally we upgraded to Keycloak 2.1.0.Final. We have configured Apache httpd proxy in front of the server. We configured keycloak server according to https://keycloak.gitbooks.io/server-installation-and-configuration/content/topics/clustering/load-balancer.html.

The configuration is still not complete/correct, probably I missed something. When I access proxied url for either of our configured realms I got unproxied auth-server-url:
[localuser at machine01:~/keycloak]$ curl -s http://lb.our.domain/auth/admin/governance/console/config | python -m json.tool
{
    "auth-server-url": "http://machine01.our.domain:8081/auth",
    "public-client": true,
    "realm": "governance",
    "realm-public-key": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCrVrCuTtArbgaZzL1hvh0xtL5mc7o0NqPVnYXkLvgcwiC3BjLGw1tGEGoJaXDuSaRllobm53JBhjx33UNv+5z/UMG4kytBWxheNVKnL6GgqlNabMaFfPLPCF8kAgKnsi79NMo+n6KnSY8YeUmec/p2vjO2NjsSAVcWEQMVhJ31LwIDAQAB",
    "resource": "security-admin-console",
    "ssl-required": "external"
}

[localuser at machine01:~/keycloak]$ curl -s http://lb.our.domain/auth/admin/master/console/config | python -m json.tool
{
    "auth-server-url": "http://machine01.our.domain:8081/auth",
    "public-client": true,
    "realm": "master",
    "realm-public-key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtJYkLAIk+/lkVQFcKtKKFG7/n9B5m7kBcExUg3VqbbbZZy3NUmfzRyQeKMw9TdFirXwhoS+xnyYC/bo1m8BLJB3fACmPKSGdTZdsf9t37z12pWELUk07O5IfjNh5ITPgDmTkHY3dE1E4CxyabdSkhCGdGjBI0HZa8Ekc91Hk7JKCJ62g7yoEwHai8POiFAk2LoRUFlc42rpLmhvgZooUDD5/R/XUEOHk1U0fQJP0GAHjZyJnPisCoSdFoCoBoGb12m0PrFOXQBpn4QOMIiidU8Vt/D2Gc7I/fiPBhMKBXcinL5i5wvy1EizA8f9tRv4mvyb0+fCT8aDi0M2qK7KvmwIDAQAB",
    "resource": "security-admin-console",
    "ssl-required": "external"
}

How can I configure it to return the proxied version? Thanks.
Stefan.

From: Stian Thorgersen [mailto:sthorger at redhat.com]
Sent: Tuesday, June 28, 2016 3:51 PM
To: KASALA Štefan <Stefan.Kasala at posam.sk>
Cc: keycloak-user at lists.jboss.org
Subject: Re: [keycloak-user] Getting 401 if trying to access app via loadbalancer

Firstly, please upgrade to a more recent Keycloak version. Then refer to https://keycloak.gitbooks.io/server-installation-and-configuration/content/topics/clustering/load-balancer.html for details on how to setup a reverse proxy / load balancer in front of Keycloak.

On 27 June 2016 at 09:18, KASALA Štefan <Stefan.Kasala at posam.sk<mailto:Stefan.Kasala at posam.sk>> wrote:
Hello,
we have installed JBoss Overlord Rtgov 2.1.0 which is using Keycloak 1.2.0.Beta1. It is running on JBoss EAP 6.3, I will name it with hostname app01. We have a load balancer under another hostname lbapp in front of the deployed app. I am able to call the rest interface of RtGov directly on machine app01 but not using lbapp, I get 401 - Unauthorized from Keycloak. My guess is there is some check against hostname in http request. Is there some possibility to register aliases with the keycloak to enable calls via load balancer? Thanks.
Stefan Kasala

________________________________

Táto správa je určená iba pre uvedeného príjemcu a môže obsahovať dôverné alebo interné informácie. Ak ste ju omylom obdržali, upovedomte o tom prosím odosielateľa a vymažte ju. Akýkoľvek iný spôsob použitia tohto e-mailu je zakázaný.

This message is for the designated recipient only and may contain confidential or internal information. If you have received it in error, please notify the sender immediately and delete the original. Any other use of the e-mail by you is prohibited.

_______________________________________________
keycloak-user mailing list
keycloak-user at lists.jboss.org<mailto:keycloak-user at lists.jboss.org>
https://lists.jboss.org/mailman/listinfo/keycloak-user


________________________________

Táto správa je určená iba pre uvedeného príjemcu a môže obsahovať dôverné alebo interné informácie. Ak ste ju omylom obdržali, upovedomte o tom prosím odosielateľa a vymažte ju. Akýkoľvek iný spôsob použitia tohto e-mailu je zakázaný.

This message is for the designated recipient only and may contain confidential or internal information. If you have received it in error, please notify the sender immediately and delete the original. Any other use of the e-mail by you is prohibited.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.jboss.org/pipermail/keycloak-user/attachments/20160908/f28d2d61/attachment-0001.html