hi all, We have the following set up with two DMZ boxes, one running a single KeyCloak security proxy and sending requests to a local NGINX proxy which farms out requests to internal applications. This should allow us to maintain a single namespace for all applications (<hostname>/appname redirects to appname.local) and gives authenticated visibility of who's accessing what at the front end proxy. DMZ: [KeyCloakSecProxy:80 ---> NGINX:8080] ---> TRUST: [Various applications] ---> TRUST: [Various applications] Keycloak runs on its own server and is published via an NGINX proxy in the DMZ DMZ: [NGINX:80] ---> TRUST: [Keycloak:8080] So clients hit the KeyCloak security Proxy, are redirected to KeyCloak and then after logging in, we get an "invalid Redirect URI" error from Keycloak. We've found that for some reason, the redirect URL from KeyCloak is appending the :8080 port value from the KeyCloak Security proxy (verified as if we change this port number, the value changes in the redirect URL). It's like KeyCloak is redirecting back to the NGINX:8080 proxy direct rather than back to the KeyCloak security proxy, which is what we were expecting. This is possibly by design, or possibly a bug, or possibly a side effect of our configuration. Has anyone tried using the KeyCloak security proxy in this manner? It's clear that the intended use is as a single instance adapter for a single local application, whereas our application happens to be an nginx proxy redirecting to different applications using location directives. _______________________________________________ keycloak-user mailing list keycloak-user(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/keycloak-user

Hi all, I have an app that isn't keycloak aware and have put the keycloak security proxy in front of it however even with the most basic settings I cannot succesfully authenticate to the page - it returns a 403 access denies error and the keycloak proxy outputs this: org.keycloak.adapters.OAuthRequestAuthenticator resolveCode ERROR: failed to turn code into token java.net.ConnectException: Connection refused (Connection refused) Must admit I'm stumped, I thought with this config, any user with an account that successfully logs in would get the app. I'm not using roles or anything complicated (because I don't understand it yet) and have been round the houses without success so any advice would be greatly appreciated! thanks, Guy ---------------------------------------------- Here's some info about the environment: ---------------------------------------------- Both keycloak and the application are reverse proxied via NGINX, but this works fine when I change the proxy config from "authenticate":true to "permit": true. DMZ: 2 X NGINX SERVERS (not clustered) one proxying keycloak and the other proxyying the application <-- Proper headers set ---------------------------------------------- TRUST: KEYCLOAK SERVER - Wildfly configured with _<http-listener name="default" socket-binding="http" redirect-socket="PROXY-HTTPS" PROXY-ADDRESS-FORWARDING="TRUE"/> _and _<socket-binding name="proxy-https" port="443"/> _ APPLICATION SERVER - Keycloak Security Proxy 1 { 2 "target-url": "http://1.2.3.4:80", 3 "bind-address": "5.6.7.8", 4 "http-port": "80", 5 "https-port": "443", 6 "keystore": "/opt/keycloak-proxy/KeyStore.jks", 7 "keystore-password": "password", 8 "key-password": "password", 9 "applications": [ 10 { 11 "base-path": "/", 12 "error-page": "/error/denied.html", 13 "adapter-config": { 14 "realm": "realmname", 15 "resource": "clientname", 16 "realm-public-key": "publickey", 17 "auth-server-url": "https://keycloak.tiberius.local/auth", 18 "ssl-required": "external", 19 "credentials": { 20 "secret": "secret" 21 } 22 } 23 , 24 "constraints": [ 25 { 26 "pattern": "/*", 27 "authenticate": "true" 28 } 29 ] 30 31 } _______________________________________________ keycloak-user mailing list keycloak-user(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/keycloak-user