[keycloak-user] Keycloak behind reverse proxy

[Nikola Malenic]

I configured mutual-ssl authentication on Keycloak. That means that user
coming to Keycloak does SSL handshake allowing Keycloak to extract data from
client certificate and map that data to an existing user at Keycloak, and
based on that authenticate the user.

 

Now, I need to configure reverse proxy in front of Keycloak. I'm using
Apache's httpd.

The problem is that user's browser now does SSL handshake with the reverse
proxy server instead of Keycloak and sends plain http request, disabling
Keycloak to map and authenticate the user.

 

Is there a proposed method to achieve this? 

Can I configure some reverse proxy (maybe not httpd) to proxy requests on
the transport layer?

Or should I somehow configure Keycloak for this? 

Maybe configure the proxy to be KC's client and do the authentication
somehow?

 

Many thanks,

Nikola