I configured mutual-ssl authentication on Keycloak. That means that user coming to Keycloak does SSL handshake allowing Keycloak to extract data from client certificate and map that data to an existing user at Keycloak, and based on that authenticate the user. Now, I need to configure reverse proxy in front of Keycloak. I'm using Apache's httpd. The problem is that user's browser now does SSL handshake with the reverse proxy server instead of Keycloak and sends plain http request, disabling Keycloak to map and authenticate the user. Is there a proposed method to achieve this? Can I configure some reverse proxy (maybe not httpd) to proxy requests on the transport layer? For example, I've seen there is a way to do client authentication on httpd and then send client certificate details to the Wildfly thorugh AJP protocol, but how to map this data to the user then? Or should I somehow configure Keycloak for this? Maybe configure the proxy to be KC's client and do the authentication somehow? Many thanks, Nikola _______________________________________________ keycloak-user mailing list keycloak-user(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/keycloak-user