We did not test anything like this. If you use reverse proxy in front of Keycloak and this reverse proxy is doing the SPNEGO handshake, you will probably need to change some code on the Keycloak side as well and rewrite SpnegoAuthenticator a bit. Maybe it is possible if you create your own authenticator and replace the builtin SpnegoAuthenticator it in the authentication flow with yours. No guarantees... Another question is why/if the proxy is needed? Marek On 13/09/18 10:25, Kannan, Vidhya (CMS) wrote: