<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<p>FYI I haven't touched this code in more than a year and have been
relying on the community to maintain it. Why? Well, we're not
supporting it in product and Apache plugins like mod-auth-mellon
and mod-auth-oidc exist. We're also talking to other teams like
API Man to see if we can offload the proxy on them. Anyways,
sounds like lame excuses...I know you just want answers...<br>
</p>
<br>
<div class="moz-cite-prefix">On 5/13/16 4:33 PM, Guy Bowdler wrote:<br>
</div>
<blockquote
cite="mid:45D64FAC-4227-4110-9B2F-5A203E0F09D4@dorsetnetworks.com"
type="cite">Also, you just need to configure and back end proxy
only to accept connections from the key cloak proxy to secure,
we've just left it open for now to troubleshoot <br>
<br>
<div class="gmail_quote">On 13 May 2016 19:58:47 BST, Bill Burke
<a class="moz-txt-link-rfc2396E" href="mailto:bburke@redhat.com"><bburke@redhat.com></a> wrote:
<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt
0.8ex; border-left: 1px solid rgb(204, 204, 204);
padding-left: 1ex;">
<pre class="k9mail">The idea of the proxy is that the secured app doesn't have to have a
plugin. The secured app is supposed to be on a private network and the
proxy sits on a public one.
On 5/13/16 11:52 AM, Jason Axley wrote:
<blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #729fcf; padding-left: 1ex;"> From my read of the design, it doesn’t look like the proxy design provides a secure way of front-ending an application that won’t allow someone with network access behind the proxy to access the application either without authentication or by impersonating any user since the design appears to rely on HTTP headers set with identity information sent to the backend application.
A better design would have been to pass the actual Id Token to the backend application so that the backend application can actually verify the identity signature on the JWT so that someone can’t just fabricate
arbitrary identity information. I would think this could work in concert with an application plugin that could consume these tokens and validate and make the identity information available to the application in a trustworthy manner.
-Jason
On 5/13/16, 8:00 AM, <a class="moz-txt-link-rfc2396E" href="mailto:keycloak-user-bounces@lists.jboss.orgonbehalfofGuyBowdler">"keycloak-user-bounces@lists.jboss.org on behalf of Guy Bowdler"</a> <a class="moz-txt-link-rfc2396E" href="mailto:keycloak-user-bounces@lists.jboss.orgonbehalfofguybowdler@dorsetnetworks.com"><keycloak-user-bounces@lists.jboss.org on behalf of guybowdler@dorsetnetworks.com></a> wrote:
<blockquote class="gmail_quote" style="margin: 0pt 0pt 1ex 0.8ex; border-left: 1px solid #ad7fa8; padding-left: 1ex;"> Hi,
We've got the Keycloak Security Proxy (official one -
<a moz-do-not-send="true" href="https://keycloak.github.io/docs/userguide/keycloak-server/html/proxy.html">https://keycloak.github.io/docs/userguide/keycloak-server/html/proxy.html</a>)
running and passing to an nginx proxy which is in turn proxying out
different apps, ie:
[client] ----> [:80|443 KeyCloak Proxy ----> :8080 Nginx
Reverse Proxy]
------> [application]
Where [] denotes a different box, the ProxyBox is hostname.domain and
the apps are published as hostname.domain/appname
However, the client is able to access the application without
authentication, we have clients and roles set up in keycloak and the
config looks ok (although obviously isn't!)
Are there any KeyCloak Proxy logs we can look at, or debugging options?
I haven't found any as yet andnothing is jumping out of the config.
We can access the back end apps ok either from the Keycloak proxy
running on ports 80 or 443 or via the nginx proxy on 8080 (and yes, this
latter connection will be restricted to localhost when it's working!).
The keycloak proxy config is very similar to the default except the
values from the keycloak installation GUI have been pasted in.
Any troubleshooting tips would be much appreciated!<b! r="">
thanks in advance:)
Guy
<hr>
keycloak-user mailing list
<a class="moz-txt-link-abbreviated" href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a>
<a moz-do-not-send="true" href="https://lists.jboss.org/mailman/listinfo/keycloak-user">https://lists.jboss.org/mailman/listinfo/keycloak-user</a>
</b!></blockquote>
<hr>
keycloak-user mailing list
<a class="moz-txt-link-abbreviated" href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a>
<a moz-do-not-send="true" href="https://lists.jboss.org/mailman/listinfo/keycloak-user">https://lists.jboss.org/mailman/listinfo/keycloak-user</a>
</blockquote>
<hr>
keycloak-user mailing list
<a class="moz-txt-link-abbreviated" href="mailto:keycloak-user@lists.jboss.org">keycloak-user@lists.jboss.org</a>
<a moz-do-not-send="true" href="https://lists.jboss.org/mailman/listinfo/keycloak-user">https://lists.jboss.org/mailman/listinfo/keycloak-user</a></pre></blockquote></div>
--
Sent from my Android device with K-9 Mail. Please excuse my brevity.
</blockquote>
</body></html>