<div dir="ltr">Excellent, just tested it out and it is working as expected.<div><br></div><div>I also had to add 'RequestHeader set X-Forwarded-Proto "https"' to my Apache virtualhost configuration.</div>
<div><br></div><div>Some documentation somewhere that this is required would be useful for the next guy.</div><div><br></div><div>Thanks,</div><div>Josh</div>
</div><div class="gmail_extra"><br><br><div class="gmail_quote">On Tue, Jun 17, 2014 at 4:58 AM, Stian Thorgersen <span dir="ltr"><<a href="mailto:stian@redhat.com" target="_blank">stian@redhat.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">This is quite likely an issue with either Apache or WildFly not being configured correctly.<br>
<br>
Have you enabled proxy-address-forwarding in WildFly/Undertow (see <a href="https://docs.jboss.org/author/display/WFLY8/Undertow+(web)+subsystem+configuration" target="_blank">https://docs.jboss.org/author/display/WFLY8/Undertow+(web)+subsystem+configuration</a> for more info)?<br>
<div class="im HOEnZb"><br>
----- Original Message -----<br>
> From: "Josh" <<a href="mailto:smysnk@gmail.com">smysnk@gmail.com</a>><br>
</div><div class="HOEnZb"><div class="h5">> To: "Stian Thorgersen" <<a href="mailto:stian@redhat.com">stian@redhat.com</a>><br>
> Cc: <a href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a><br>
> Sent: Monday, 16 June, 2014 4:42:27 PM<br>
> Subject: Re: [keycloak-user] Significant SSL issue: Support for reverse proxies<br>
><br>
> The first would be at the "Welcome to Keycloak" page, clicking on<br>
> Administration Console. The link itself is not redirecting to http, but as<br>
> part of the login page it looks like it forwards back to http. (eg.<br>
> <a href="https://auth.psidox.com/auth/" target="_blank">https://auth.psidox.com/auth/</a> -> <a href="https://auth.psidox.com/auth/admin/" target="_blank">https://auth.psidox.com/auth/admin/</a> -><br>
> <a href="http://auth.psidox.com/auth/admin/master/console" target="_blank">http://auth.psidox.com/auth/admin/master/console</a> -><br>
> <a href="http://auth.psidox.com/auth/realms/master/tokens/login?client_id=security-admin-console&redirect_uri=http%3A%2F%2Fauth.psidox.com%2Fauth%2Fadmin%2Fmaster%2Fconsole%2F&state=2ae3dfaa-fe7c-4973-8932-ffea553d8dfe&response_type=code" target="_blank">http://auth.psidox.com/auth/realms/master/tokens/login?client_id=security-admin-console&redirect_uri=http%3A%2F%2Fauth.psidox.com%2Fauth%2Fadmin%2Fmaster%2Fconsole%2F&state=2ae3dfaa-fe7c-4973-8932-ffea553d8dfe&response_type=code</a><br>
> )<br>
><br>
> I haven't really gotten too far beyond the login page.<br>
><br>
> - Josh<br>
><br>
><br>
> On Mon, Jun 16, 2014 at 3:33 AM, Stian Thorgersen <<a href="mailto:stian@redhat.com">stian@redhat.com</a>> wrote:<br>
><br>
> > When does it forward the browser from https to http?<br>
> ><br>
> > As Bill pointed out, does auth-server-url in your keycloak.json point to<br>
> > your proxy with https?<br>
> ><br>
> > What adapter are you using?<br>
> ><br>
> > ----- Original Message -----<br>
> > > From: "Josh" <<a href="mailto:smysnk@gmail.com">smysnk@gmail.com</a>><br>
> > > To: <a href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a><br>
> > > Sent: Friday, 13 June, 2014 8:41:32 AM<br>
> > > Subject: [keycloak-user] Significant SSL issue: Support for reverse<br>
> > proxies<br>
> > ><br>
> > > Hi guys,<br>
> > ><br>
> > > So looking to help solve this issue possibly or at least get it on the<br>
> > radar,<br>
> > > I've reported it here: <a href="https://issues.jboss.org/browse/KEYCLOAK-497" target="_blank">https://issues.jboss.org/browse/KEYCLOAK-497</a><br>
> > ><br>
> > > To breifly recap the issue, when logging in via reverse proxy it keeps<br>
> > > forwarding the browser from https back to regular http.<br>
> > ><br>
> > > Eg. Apache virtualhost configured as:<br>
> > ><br>
> > > <VirtualHost *:443><br>
> > > ServerName <a href="http://auth.domain.com" target="_blank">auth.domain.com</a><br>
> > > SSLEngine On<br>
> > ><br>
> > > <Proxy *><br>
> > > Order deny,allow<br>
> > > Allow from all<br>
> > > </Proxy><br>
> > ><br>
> > > ProxyVia Off<br>
> > > ProxyPreserveHost On<br>
> > > ProxyRequests Off<br>
> > ><br>
> > > ProxyPass / <a href="http://keycloak.core.docker:8080/" target="_blank">http://keycloak.core.docker:8080/</a><br>
> > > ProxyPassReverse / <a href="http://keycloak.core.docker:8080/" target="_blank">http://keycloak.core.docker:8080/</a><br>
> > ><br>
> > ><br>
> > > </VirtualHost><br>
> > ><br>
> > > If I were to start looking into the code base, where would I start?<br>
> > Trying to<br>
> > > find for example during the login process how the forward url is formed?<br>
> > ><br>
> > > Thanks,<br>
> > ><br>
> > > Josh<br>
> > ><br>
> > > _______________________________________________<br>
> > > keycloak-user mailing list<br>
> > > <a href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a><br>
> > > <a href="https://lists.jboss.org/mailman/listinfo/keycloak-user" target="_blank">https://lists.jboss.org/mailman/listinfo/keycloak-user</a><br>
> ><br>
><br>
</div></div></blockquote></div><br></div>