2:41 a.m.
Hi guys,
So looking to help solve this issue possibly or at least get it on the
radar, I've reported it here: https://issues.jboss.org/browse/KEYCLOAK-497
To breifly recap the issue, when logging in via reverse proxy it keeps
forwarding the browser from https back to regular http.
Eg. Apache virtualhost configured as:
<VirtualHost *:443>
ServerName auth.domain.com
SSLEngine On
<Proxy *>
Order deny,allow
Allow from all
</Proxy>
ProxyVia Off
ProxyPreserveHost On
ProxyRequests Off
ProxyPass / http://keycloak.core.docker:8080/
ProxyPassReverse / http://keycloak.core.docker:8080/
</VirtualHost>
If I were to start looking into the code base, where would I start? Trying
to find for example during the login process how the forward url is formed?
Thanks,
Josh
2:50 a.m.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
I faced the exact same issue earlier this week, but with nginx. On a
quick look, the problem seems to be on the JavaScript adapter, which
seems to think that it's being served via non-SSL.
As I haven't had enough time to debug and do a proper fix, the quick
solution was to configure Wildfly to serve Keycloak via SSL and proxy
the request to 8443 instead of 8080. It works, but it's suboptimal.
There are instructions on the documentation on how to setup Wildfly to
serve requests via SSL.
- - Juca.
On 06/13/2014 09:41 AM, Josh wrote:
Hi guys,
So looking to help solve this issue possibly or at least get it on
the radar, I've reported it here:
https://issues.jboss.org/browse/KEYCLOAK-497
To breifly recap the issue, when logging in via reverse proxy it
keeps forwarding the browser from https back to regular http.
Eg. Apache virtualhost configured as:
<VirtualHost *:443> ServerName auth.domain.com
<http://auth.domain.com> SSLEngine On
<Proxy *> Order deny,allow Allow from all </Proxy>
ProxyVia Off ProxyPreserveHost On
ProxyRequests Off
ProxyPass / http://keycloak.core.docker:8080/
ProxyPassReverse / http://keycloak.core.docker:8080/
</VirtualHost>
If I were to start looking into the code base, where would I
start? Trying to find for example during the login process how the
forward url is formed?
Thanks,
Josh
_______________________________________________ keycloak-user
mailing list keycloak-user(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iQEcBAEBCgAGBQJTmq1jAAoJEDnJtskdmzLM+iIIAI/TPlujrVqrFM6u7XqarUB/
RVtgPzsF3cjeKJZQYAxJhBO7eMHYlGsfFwROylV1F397PNvQdOE5E+TBXI/pDwXr
t5PVVVw9ehUVkf2gGLLXWkrniUCxbetKvColKIbRMGSpJuIOnUkLkP6J1J2wHGhl
u5oLYNxLZfhP0Ag5/U9+3Mnezti0yKD7Z1818BtV45+9cCqwV45XqbcwNyoeBCPC
+8iOmg5aFlNki1D/zGZNOkgziLzq8+lmK2yrpZGvSRZ10ShbCj80v72nkBB101Ac
6SYofgywL2CcDCOK1/MEo71pUzaUrXLoNbTT/4v18TSXvCF9M0RUSJSEr8MRvYk=
=jExe
-----END PGP SIGNATURE-----
7:42 a.m.
Was the adapter not configured right? It should be pointed to the auth
server's reverse-proxy URL.
On 6/13/2014 3:50 AM, Juraci Paixão Kröhling wrote:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
I faced the exact same issue earlier this week, but with nginx. On a
quick look, the problem seems to be on the JavaScript adapter, which
seems to think that it's being served via non-SSL.
As I haven't had enough time to debug and do a proper fix, the quick
solution was to configure Wildfly to serve Keycloak via SSL and proxy
the request to 8443 instead of 8080. It works, but it's suboptimal.
There are instructions on the documentation on how to setup Wildfly to
serve requests via SSL.
- - Juca.
On 06/13/2014 09:41 AM, Josh wrote:
> Hi guys,
>
> So looking to help solve this issue possibly or at least get it on
> the radar, I've reported it here:
> https://issues.jboss.org/browse/KEYCLOAK-497
>
> To breifly recap the issue, when logging in via reverse proxy it
> keeps forwarding the browser from https back to regular http.
>
> Eg. Apache virtualhost configured as:
>
> <VirtualHost *:443> ServerName auth.domain.com
> <http://auth.domain.com> SSLEngine On
>
> <Proxy *> Order deny,allow Allow from all </Proxy>
>
> ProxyVia Off ProxyPreserveHost On
> ProxyRequests Off
>
> ProxyPass / http://keycloak.core.docker:8080/
> ProxyPassReverse / http://keycloak.core.docker:8080/
>
>
> </VirtualHost>
>
> If I were to start looking into the code base, where would I
> start? Trying to find for example during the login process how the
> forward url is formed?
>
> Thanks,
>
> Josh
>
>
> _______________________________________________ keycloak-user
> mailing list keycloak-user(a)lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
--
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iQEcBAEBCgAGBQJTmq1jAAoJEDnJtskdmzLM+iIIAI/TPlujrVqrFM6u7XqarUB/
RVtgPzsF3cjeKJZQYAxJhBO7eMHYlGsfFwROylV1F397PNvQdOE5E+TBXI/pDwXr
t5PVVVw9ehUVkf2gGLLXWkrniUCxbetKvColKIbRMGSpJuIOnUkLkP6J1J2wHGhl
u5oLYNxLZfhP0Ag5/U9+3Mnezti0yKD7Z1818BtV45+9cCqwV45XqbcwNyoeBCPC
+8iOmg5aFlNki1D/zGZNOkgziLzq8+lmK2yrpZGvSRZ10ShbCj80v72nkBB101Ac
6SYofgywL2CcDCOK1/MEo71pUzaUrXLoNbTT/4v18TSXvCF9M0RUSJSEr8MRvYk=
=jExe
-----END PGP SIGNATURE-----
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
12:06 p.m.
I'm talking more about the login, registration, administration on the key
cloak server, all the links revert https back to http. I haven't got
around to testing the adapters yet.
On Fri, Jun 13, 2014 at 6:42 AM, Bill Burke <bburke(a)redhat.com> wrote:
Was the adapter not configured right? It should be pointed to the
auth
server's reverse-proxy URL.
On 6/13/2014 3:50 AM, Juraci Paixão Kröhling wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA512
>
> I faced the exact same issue earlier this week, but with nginx. On a
> quick look, the problem seems to be on the JavaScript adapter, which
> seems to think that it's being served via non-SSL.
>
> As I haven't had enough time to debug and do a proper fix, the quick
> solution was to configure Wildfly to serve Keycloak via SSL and proxy
> the request to 8443 instead of 8080. It works, but it's suboptimal.
> There are instructions on the documentation on how to setup Wildfly to
> serve requests via SSL.
>
> - - Juca.
>
> On 06/13/2014 09:41 AM, Josh wrote:
>> Hi guys,
>>
>> So looking to help solve this issue possibly or at least get it on
>> the radar, I've reported it here:
>> https://issues.jboss.org/browse/KEYCLOAK-497
>>
>> To breifly recap the issue, when logging in via reverse proxy it
>> keeps forwarding the browser from https back to regular http.
>>
>> Eg. Apache virtualhost configured as:
>>
>> <VirtualHost *:443> ServerName auth.domain.com
>> <http://auth.domain.com> SSLEngine On
>>
>> <Proxy *> Order deny,allow Allow from all </Proxy>
>>
>> ProxyVia Off ProxyPreserveHost On
>> ProxyRequests Off
>>
>> ProxyPass / http://keycloak.core.docker:8080/
>> ProxyPassReverse / http://keycloak.core.docker:8080/
>>
>>
>> </VirtualHost>
>>
>> If I were to start looking into the code base, where would I
>> start? Trying to find for example during the login process how the
>> forward url is formed?
>>
>> Thanks,
>>
>> Josh
>>
>>
>> _______________________________________________ keycloak-user
>> mailing list keycloak-user(a)lists.jboss.org
>> https://lists.jboss.org/mailman/listinfo/keycloak-user
>>
>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v2.0.22 (GNU/Linux)
> Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
>
> iQEcBAEBCgAGBQJTmq1jAAoJEDnJtskdmzLM+iIIAI/TPlujrVqrFM6u7XqarUB/
> RVtgPzsF3cjeKJZQYAxJhBO7eMHYlGsfFwROylV1F397PNvQdOE5E+TBXI/pDwXr
> t5PVVVw9ehUVkf2gGLLXWkrniUCxbetKvColKIbRMGSpJuIOnUkLkP6J1J2wHGhl
> u5oLYNxLZfhP0Ag5/U9+3Mnezti0yKD7Z1818BtV45+9cCqwV45XqbcwNyoeBCPC
> +8iOmg5aFlNki1D/zGZNOkgziLzq8+lmK2yrpZGvSRZ10ShbCj80v72nkBB101Ac
> 6SYofgywL2CcDCOK1/MEo71pUzaUrXLoNbTT/4v18TSXvCF9M0RUSJSEr8MRvYk=
> =jExe
> -----END PGP SIGNATURE-----
>
_______________________________________________
> keycloak-user mailing list
> keycloak-user(a)lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
>
--
Bill Burke
JBoss, a division of Red Hat
http://bill.burkecentral.com
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
1:47 p.m.
On 06/13/2014 02:42 PM, Bill Burke wrote:
Was the adapter not configured right? It should be pointed to the
auth server's reverse-proxy URL.
Sorry, it seems I was wrong in saying that I had the exact same
problem. The problem wasn't an infinite redirect (I had this problem
earlier, but on my app sending redirects to the /auth).
The problem I had *this time* were in fact two:
- I have a redirect from http to https on nginx, and
Strict-Transport-Security on the https. With this setup, the first
request is always sent to https, and all subsequent requests are
automatically to https. On an out-of-the-box installation, when
hitting the admin console, Keycloak uses a redirect_uri with the
https, which renders an "invalid_uri".
- Manually changing the redirect_uri query parameter to http renders
makes it work, in the sense that I can login as admin/admin and change
the password. After that, I get a blank screen. On Firebug, I see that
Firefox blocks mixed content (ie: javascript from http://localhost
requested from https://localhost). The exact message on the console is:
Blocked loading mixed active content
"http://192.168.122.202/auth/realms/master/tokens/access/codes"
keycloak.js line 278
Which is the place where I put the breakpoint and found out that the
generated URL is http, even though keycloak.js itself is loaded from
https.
But my setup is as I mentioned earlier: nginx in front of wildfly,
with nginx being the only part caring about SSL. Making the proxy talk
with Wildfly also on SSL makes the problem go away.
- Juca.
4:33 a.m.
When does it forward the browser from https to http?
As Bill pointed out, does auth-server-url in your keycloak.json point to your proxy with
https?
What adapter are you using?
----- Original Message -----
From: "Josh" <smysnk(a)gmail.com>
To: keycloak-user(a)lists.jboss.org
Sent: Friday, 13 June, 2014 8:41:32 AM
Subject: [keycloak-user] Significant SSL issue: Support for reverse proxies
Hi guys,
So looking to help solve this issue possibly or at least get it on the radar,
I've reported it here: https://issues.jboss.org/browse/KEYCLOAK-497
To breifly recap the issue, when logging in via reverse proxy it keeps
forwarding the browser from https back to regular http.
Eg. Apache virtualhost configured as:
<VirtualHost *:443>
ServerName auth.domain.com
SSLEngine On
<Proxy *>
Order deny,allow
Allow from all
</Proxy>
ProxyVia Off
ProxyPreserveHost On
ProxyRequests Off
ProxyPass / http://keycloak.core.docker:8080/
ProxyPassReverse / http://keycloak.core.docker:8080/
</VirtualHost>
If I were to start looking into the code base, where would I start? Trying to
find for example during the login process how the forward url is formed?
Thanks,
Josh
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
10:42 a.m.
The first would be at the "Welcome to Keycloak" page, clicking on
Administration Console. The link itself is not redirecting to http, but as
part of the login page it looks like it forwards back to http. (eg.
https://auth.psidox.com/auth/ -> https://auth.psidox.com/auth/admin/ ->
http://auth.psidox.com/auth/admin/master/console ->
http://auth.psidox.com/auth/realms/master/tokens/login?client_id=security...
)
I haven't really gotten too far beyond the login page.
- Josh
On Mon, Jun 16, 2014 at 3:33 AM, Stian Thorgersen <stian(a)redhat.com> wrote:
When does it forward the browser from https to http?
As Bill pointed out, does auth-server-url in your keycloak.json point to
your proxy with https?
What adapter are you using?
----- Original Message -----
> From: "Josh" <smysnk(a)gmail.com>
> To: keycloak-user(a)lists.jboss.org
> Sent: Friday, 13 June, 2014 8:41:32 AM
> Subject: [keycloak-user] Significant SSL issue: Support for reverse
proxies
>
> Hi guys,
>
> So looking to help solve this issue possibly or at least get it on the
radar,
> I've reported it here: https://issues.jboss.org/browse/KEYCLOAK-497
>
> To breifly recap the issue, when logging in via reverse proxy it keeps
> forwarding the browser from https back to regular http.
>
> Eg. Apache virtualhost configured as:
>
> <VirtualHost *:443>
> ServerName auth.domain.com
> SSLEngine On
>
> <Proxy *>
> Order deny,allow
> Allow from all
> </Proxy>
>
> ProxyVia Off
> ProxyPreserveHost On
> ProxyRequests Off
>
> ProxyPass / http://keycloak.core.docker:8080/
> ProxyPassReverse / http://keycloak.core.docker:8080/
>
>
> </VirtualHost>
>
> If I were to start looking into the code base, where would I start?
Trying to
> find for example during the login process how the forward url is formed?
>
> Thanks,
>
> Josh
>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user(a)lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
5:58 a.m.
This is quite likely an issue with either Apache or WildFly not being configured
correctly.
Have you enabled proxy-address-forwarding in WildFly/Undertow (see
https://docs.jboss.org/author/display/WFLY8/Undertow+(web)+subsystem+conf... for
more info)?
----- Original Message -----
From: "Josh" <smysnk(a)gmail.com>
To: "Stian Thorgersen" <stian(a)redhat.com>
Cc: keycloak-user(a)lists.jboss.org
Sent: Monday, 16 June, 2014 4:42:27 PM
Subject: Re: [keycloak-user] Significant SSL issue: Support for reverse proxies
The first would be at the "Welcome to Keycloak" page, clicking on
Administration Console. The link itself is not redirecting to http, but as
part of the login page it looks like it forwards back to http. (eg.
https://auth.psidox.com/auth/ -> https://auth.psidox.com/auth/admin/ ->
http://auth.psidox.com/auth/admin/master/console ->
http://auth.psidox.com/auth/realms/master/tokens/login?client_id=security...
)
I haven't really gotten too far beyond the login page.
- Josh
On Mon, Jun 16, 2014 at 3:33 AM, Stian Thorgersen <stian(a)redhat.com> wrote:
> When does it forward the browser from https to http?
>
> As Bill pointed out, does auth-server-url in your keycloak.json point to
> your proxy with https?
>
> What adapter are you using?
>
> ----- Original Message -----
> > From: "Josh" <smysnk(a)gmail.com>
> > To: keycloak-user(a)lists.jboss.org
> > Sent: Friday, 13 June, 2014 8:41:32 AM
> > Subject: [keycloak-user] Significant SSL issue: Support for reverse
> proxies
> >
> > Hi guys,
> >
> > So looking to help solve this issue possibly or at least get it on the
> radar,
> > I've reported it here: https://issues.jboss.org/browse/KEYCLOAK-497
> >
> > To breifly recap the issue, when logging in via reverse proxy it keeps
> > forwarding the browser from https back to regular http.
> >
> > Eg. Apache virtualhost configured as:
> >
> > <VirtualHost *:443>
> > ServerName auth.domain.com
> > SSLEngine On
> >
> > <Proxy *>
> > Order deny,allow
> > Allow from all
> > </Proxy>
> >
> > ProxyVia Off
> > ProxyPreserveHost On
> > ProxyRequests Off
> >
> > ProxyPass / http://keycloak.core.docker:8080/
> > ProxyPassReverse / http://keycloak.core.docker:8080/
> >
> >
> > </VirtualHost>
> >
> > If I were to start looking into the code base, where would I start?
> Trying to
> > find for example during the login process how the forward url is formed?
> >
> > Thanks,
> >
> > Josh
> >
> > _______________________________________________
> > keycloak-user mailing list
> > keycloak-user(a)lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/keycloak-user
>
12:19 p.m.
Excellent, just tested it out and it is working as expected.
I also had to add 'RequestHeader set X-Forwarded-Proto "https"' to my
Apache virtualhost configuration.
Some documentation somewhere that this is required would be useful for the
next guy.
Thanks,
Josh
On Tue, Jun 17, 2014 at 4:58 AM, Stian Thorgersen <stian(a)redhat.com> wrote:
This is quite likely an issue with either Apache or WildFly not
being
configured correctly.
Have you enabled proxy-address-forwarding in WildFly/Undertow (see
https://docs.jboss.org/author/display/WFLY8/Undertow+(web)+subsystem+conf...
for more info)?
----- Original Message -----
> From: "Josh" <smysnk(a)gmail.com>
> To: "Stian Thorgersen" <stian(a)redhat.com>
> Cc: keycloak-user(a)lists.jboss.org
> Sent: Monday, 16 June, 2014 4:42:27 PM
> Subject: Re: [keycloak-user] Significant SSL issue: Support for reverse
proxies
>
> The first would be at the "Welcome to Keycloak" page, clicking on
> Administration Console. The link itself is not redirecting to http, but
as
> part of the login page it looks like it forwards back to http. (eg.
> https://auth.psidox.com/auth/ -> https://auth.psidox.com/auth/admin/ ->
> http://auth.psidox.com/auth/admin/master/console ->
>
http://auth.psidox.com/auth/realms/master/tokens/login?client_id=security...
> )
>
> I haven't really gotten too far beyond the login page.
>
> - Josh
>
>
> On Mon, Jun 16, 2014 at 3:33 AM, Stian Thorgersen <stian(a)redhat.com>
wrote:
>
> > When does it forward the browser from https to http?
> >
> > As Bill pointed out, does auth-server-url in your keycloak.json point
to
> > your proxy with https?
> >
> > What adapter are you using?
> >
> > ----- Original Message -----
> > > From: "Josh" <smysnk(a)gmail.com>
> > > To: keycloak-user(a)lists.jboss.org
> > > Sent: Friday, 13 June, 2014 8:41:32 AM
> > > Subject: [keycloak-user] Significant SSL issue: Support for reverse
> > proxies
> > >
> > > Hi guys,
> > >
> > > So looking to help solve this issue possibly or at least get it on
the
> > radar,
> > > I've reported it here: https://issues.jboss.org/browse/KEYCLOAK-497
> > >
> > > To breifly recap the issue, when logging in via reverse proxy it
keeps
> > > forwarding the browser from https back to regular http.
> > >
> > > Eg. Apache virtualhost configured as:
> > >
> > > <VirtualHost *:443>
> > > ServerName auth.domain.com
> > > SSLEngine On
> > >
> > > <Proxy *>
> > > Order deny,allow
> > > Allow from all
> > > </Proxy>
> > >
> > > ProxyVia Off
> > > ProxyPreserveHost On
> > > ProxyRequests Off
> > >
> > > ProxyPass / http://keycloak.core.docker:8080/
> > > ProxyPassReverse / http://keycloak.core.docker:8080/
> > >
> > >
> > > </VirtualHost>
> > >
> > > If I were to start looking into the code base, where would I start?
> > Trying to
> > > find for example during the login process how the forward url is
formed?
> > >
> > > Thanks,
> > >
> > > Josh
> > >
> > > _______________________________________________
> > > keycloak-user mailing list
> > > keycloak-user(a)lists.jboss.org
> > > https://lists.jboss.org/mailman/listinfo/keycloak-user
> >
>
5:13 a.m.
I've updated the documentation. One more thing you should enable is the confidential
transport-guarantee for Keycloak to make sure all http traffic is redirected to https. To
make sure it redirects to the correct port you also need to specify redirect-socket.
I've included the added documentation below so you don't have to build this from
source.
Added Documentation:
3.3.4.2. Enable SSL on a Reverse Proxy
Follow the documentation for your web server to enable SSL and configure reverse proxy for
Keycloak. It is important that you make sure the web server sets the X-Forwarded-For and
X-Forwarded-Proto headers on the requests made to Keycloak. Next you need to enable
proxy-address-forwarding on the Keycloak http connector. Assuming that your reverse proxy
doesn't use port 8443 for SSL you also need to configure what port http traffic is
redirected to. This is done by editing standalone/configuration/standalone.xml.
First add proxy-address-forwarding and redirect-socket to the http-listener element:
<subsystem xmlns="urn:jboss:domain:undertow:1.1">
...
<http-listener name="default" socket-binding="http"
proxy-address-forwarding="true" redirect-socket="proxy-https"/>
...
</subsystem>
Then add a new socket-binding element to the socket-binding-group element:
<socket-binding-group name="standard-sockets"
default-interface="public"
port-offset="${jboss.socket.binding.port-offset:0}">
...
<socket-binding name="proxy-https" port="443"/>
...
</socket-binding-group>
Check the WildFly documentation
[https://docs.jboss.org/author/display/WFLY8/Undertow+(web)+subsystem+conf...] for
more information.
----- Original Message -----
From: "Josh" <smysnk(a)gmail.com>
To: "Stian Thorgersen" <stian(a)redhat.com>
Cc: keycloak-user(a)lists.jboss.org
Sent: Tuesday, 17 June, 2014 6:19:10 PM
Subject: Re: [keycloak-user] Significant SSL issue: Support for reverse proxies
Excellent, just tested it out and it is working as expected.
I also had to add 'RequestHeader set X-Forwarded-Proto "https"' to my
Apache virtualhost configuration.
Some documentation somewhere that this is required would be useful for the
next guy.
Thanks,
Josh
On Tue, Jun 17, 2014 at 4:58 AM, Stian Thorgersen <stian(a)redhat.com> wrote:
> This is quite likely an issue with either Apache or WildFly not being
> configured correctly.
>
> Have you enabled proxy-address-forwarding in WildFly/Undertow (see
> https://docs.jboss.org/author/display/WFLY8/Undertow+(web)+subsystem+conf...
> for more info)?
>
> ----- Original Message -----
> > From: "Josh" <smysnk(a)gmail.com>
> > To: "Stian Thorgersen" <stian(a)redhat.com>
> > Cc: keycloak-user(a)lists.jboss.org
> > Sent: Monday, 16 June, 2014 4:42:27 PM
> > Subject: Re: [keycloak-user] Significant SSL issue: Support for reverse
> proxies
> >
> > The first would be at the "Welcome to Keycloak" page, clicking on
> > Administration Console. The link itself is not redirecting to http, but
> as
> > part of the login page it looks like it forwards back to http. (eg.
> > https://auth.psidox.com/auth/ -> https://auth.psidox.com/auth/admin/ ->
> > http://auth.psidox.com/auth/admin/master/console ->
> >
>
http://auth.psidox.com/auth/realms/master/tokens/login?client_id=security...
> > )
> >
> > I haven't really gotten too far beyond the login page.
> >
> > - Josh
> >
> >
> > On Mon, Jun 16, 2014 at 3:33 AM, Stian Thorgersen <stian(a)redhat.com>
> wrote:
> >
> > > When does it forward the browser from https to http?
> > >
> > > As Bill pointed out, does auth-server-url in your keycloak.json point
> to
> > > your proxy with https?
> > >
> > > What adapter are you using?
> > >
> > > ----- Original Message -----
> > > > From: "Josh" <smysnk(a)gmail.com>
> > > > To: keycloak-user(a)lists.jboss.org
> > > > Sent: Friday, 13 June, 2014 8:41:32 AM
> > > > Subject: [keycloak-user] Significant SSL issue: Support for reverse
> > > proxies
> > > >
> > > > Hi guys,
> > > >
> > > > So looking to help solve this issue possibly or at least get it on
> the
> > > radar,
> > > > I've reported it here:
https://issues.jboss.org/browse/KEYCLOAK-497
> > > >
> > > > To breifly recap the issue, when logging in via reverse proxy it
> keeps
> > > > forwarding the browser from https back to regular http.
> > > >
> > > > Eg. Apache virtualhost configured as:
> > > >
> > > > <VirtualHost *:443>
> > > > ServerName auth.domain.com
> > > > SSLEngine On
> > > >
> > > > <Proxy *>
> > > > Order deny,allow
> > > > Allow from all
> > > > </Proxy>
> > > >
> > > > ProxyVia Off
> > > > ProxyPreserveHost On
> > > > ProxyRequests Off
> > > >
> > > > ProxyPass / http://keycloak.core.docker:8080/
> > > > ProxyPassReverse / http://keycloak.core.docker:8080/
> > > >
> > > >
> > > > </VirtualHost>
> > > >
> > > > If I were to start looking into the code base, where would I start?
> > > Trying to
> > > > find for example during the login process how the forward url is
> formed?
> > > >
> > > > Thanks,
> > > >
> > > > Josh
> > > >
> > > > _______________________________________________
> > > > keycloak-user mailing list
> > > > keycloak-user(a)lists.jboss.org
> > > > https://lists.jboss.org/mailman/listinfo/keycloak-user
> > >
> >
>
3848
days inactive
3853
days old
9 comments
4 participants
participants (4)
-
Bill Burke -
Josh -
Juraci Paixão Kröhling -
Stian Thorgersen