Re: [keycloak-dev] next-gen Keycloak proxy

You can have multiple virtual hosts with the TLS endpoint being KC. We do ti with OpenUnison and apache lets you do it I think with TLS 1.2 and apache 2.4 (I have a customer thats doing that right now so I know it works). So long as the cert has multiple Subject Alternative Names or is a wildcard it should work. OpenUnison originally took the "everything in a cookie" approach, the cookie quickly got too big to be effective and we had to switch to maintaining a backend session. I know I've brought this up before, but I'd like to offer up OpenUnison as a starting point: https://github.com/tremolosecurity/openunison. OU probably has 70%-80% of what you are looking for. It already has the reverse proxy code built in, written in Java, supports extensibility via multiple mechanisms, an authorization subsystem that can easily be extended to support an external az service and we have an extensible last mile system for legacy apps that don't support openid connect for apache, .net and Java. We also have multiple production deployments (including public safety applications). levels. We're sponsoring Summit this year again and I'll be doing a session on OpenShift identity management and compliance. Thanks -- Marc Boorshtein CTO Tremolo Security marc.boorshtein(a)tremolosecurity.com (703) 828-4902 Twitter - @mlbiam / @tremolosecurity