As per the mailing list: http://lists.jboss.org/pipermail/keycloak-user/2016-December/008876.html There wasn't any support for proxy in case of policy enforcement. Since the thread is quite old, can someone from Keycloak team kindly confirm whether proxy support has been added yet or not?