Why does keycloak remove SSL in uri redirection?

Question

We have a simple requirement: PS : https: / === https: //

When a user clicks https: /company_landing.company.com, they should be redirected to the login page in keycloak (on the page https: /ourcompany-keycloak.company.com). The user enters their credentials to enter keycloak. After successfully logging in to keyclay, they will be presented on the company_landing page.

Problem:

When user types are https: /company_landing.company.com

Keycloak tries to display the landing page, but gives a 500 Internal server error and says “Wrong uri redirect”, and in the browser I see this:

Https: /ourcompany-keycloak.company.com/auth/realms/realm1/tokens/login client_id = company_dev & status = aaaafffff-559d-4312-a8be-123412341234 & redirect_uri = HTTP% 3A% 2F? % 2Fcompany_landing.company.com% 3A8081% 2F% 3Fauth_callback% 3D1

If you observe the uri redirection above, I think the problem is that instead of https, uri redirection starts with http and http: /company-landing.company.com does not exist.

Settings: Keyboard Settings: -

Realm -> settings -> login: require SSL = all Requests (also verified with "external")

Applications → realm1 → settings → Redirect URI = https://company_landing.company.com/ *

AWS Load Balancer: Port Configuration: 443 (https) Forwarding to 8443

I'm confused, why does it strip SSL? The above works fine when testing in a local environment (possibly because its http: // localhost ), but it always gives the wrong redirect URL when trying to access any link, i.e. ssl is encrypted.

-mm

Answer 1

You need to add the following property in the jQuery proxy configuration file (default proxy.json) as an application attribute (at the same level as adapter-config):

"proxy-address-forwarding" : true, 

This configuration attribute is not documented, but it is present in the proxy configuration sources: https://github.com/keycloak/keycloak/blob/master/proxy/proxy-server/src/main/java/org/keycloak/proxy/ProxyConfig.java

Answer 2

You do not need to install a certificate or use changes to the adapter configuration.

This should be done in your standalone.xml , standalone-ha or domain.xml (as the case may be), as described in the reverse proxy section of the Keycloak document https://www.keycloak.org/docs/latest/server_installation/ index.html # _setting-up-a-load balancing or proxy

Assuming your reverse proxy does not use port 8443 for SSL, you also need to configure which port the HTTPS traffic is forwarded to.

 <subsystem xmlns="urn:jboss:domain:undertow:4.0"> ... <http-listener name="default" socket-binding="http" proxy-address-forwarding="true" redirect-socket="proxy-https"/> ... </subsystem> 

Add the redirect-socket attribute to the http-listener element. The value should be proxy-https, which indicates a socket binding, which you must also define.

Then add the new socket-binding element to the socket-binding-group element:

 <socket-binding-group name="standard-sockets" default-interface="public" port-offset="${jboss.socket.binding.port-offset:0}"> ... <socket-binding name="proxy-https" port="443"/> ... </socket-binding-group>