0

I am using jhipster generator, after generating the application this is my keycloak.yml file:

version: '3.8'
services:
  keycloak:
    image: quay.io/keycloak/keycloak:19.0.1
    command: ['start-dev --import-realm --http-relative-path=/auth']
    volumes:
      - ./realm-config:/opt/keycloak/data/import
 #     - /etc/ssl/certs:/etc/x509/certs
#      - /etc/ssl/certs:/e
#      - /etc/ssl/certs/auth-website.crt:/etc/ssl/certs
#      - /etc/ssl/private:/etc/ssl/private
    environment:
      - KC_DB=dev-file
      - KEYCLOAK_ADMIN=xxxxx
      - KEYCLOAK_ADMIN_PASSWORD=xxxxx
      - KC_FEATURES=scripts
      - KC_HTTP_PORT=9080
      - KC_HTTPS_PORT=9443
#      - KC_HOSTNAME=auth.website.com
#      - KEYCLOAK_FRONTEND_URL=https://auth.website.com/auth
#      - PROXY_ADDRESS_FORWARDING=true
#      - KC_HTTPS_CERTIFICATE_FILE=/etc/ssl/certs/auth-website.crt
#      - KC_HTTPS_CERTIFICATE_KEY_FILE=/etc/ssl/private/auth-website.key
#      - KC_HTTPS_CERTIFICATE_FILE=/etc/ssl/certs/auth-website.crt
#      - KC_HTTPS_CERTIFICATE_KEY_FILE=/etc/ssl/private/auth-website.key
    # If you want to expose these ports outside your dev PC,
    # remove the "127.0.0.1:" prefix
    ports:
      - 9080:9080
      - 9443:9443

My nginx file for this is:

server {
    server_name auth.website.com;
    return 301 https://auth.website.com$request_uri;
}
server {

#    listen 443 ssl http2;
    listen 443 ssl;
    ssl_certificate /etc/ssl/certs/website.crt;
    ssl_certificate_key /etc/ssl/private/website.key;
    add_header Content-Security-Policy "frame-src 'self' http://auth.website>

    server_name auth.website.com www.auth.website.com;
    index index.html index.htm;
    access_log /var/log/nginx/auth-website.log;
    error_log  /var/log/nginx/auth-website-error.log error;

    location / {
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Host $http_host;
        proxy_buffer_size   128k;
        proxy_buffers   4 256k;
        proxy_busy_buffers_size   256k;
        proxy_pass http://website_ip_address:9080;
        proxy_redirect off;
    }

    location /auth {
        proxy_pass http://localhost:9080;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

` when I try to access https://auth.website.com/auth/ every thing run as expected, but for the admin console at url https://auth.website.com/auth/admin/master/console/, I am getting a page that is always showing "Loading the admin console" and a console error: Refused to frame 'http://auth.website.com/' because it violates the following Content Security Policy directive: "frame-src 'self'".

I think keycloak is trying to load something using http instead of https. I am stuck at this point.

I have tried a lot of changes to the sites-available file and to keycloak.yml, but none fixed the problem.

4
  • 1
    Have you tried adding KC_PROXY: edge to the environment variables of the keycloak docker container? In that run I would also uncomment the KC_HOSTNAME variable. Maybe give it a try, I think that is needed if you want to run keycloak behind a proxy.
    – Geilmaker
    Jul 18 at 0:34
  • Maybe you also want to try forwarding the host inside the nginx location with proxy_set_header X-Forwarded-Host $server_name; but I think thats optional.
    – Geilmaker
    Jul 18 at 0:37
  • KC_PROXY= edge solved the problem, thank you @Geilmaker. I have asked chatgpt, sage, google-palm, ... But your comment was the right answer. Jul 18 at 4:25
  • Glad to hear it helped! I would write it inside an answer for searches. If you have time it would be nice, if you accept the answer :)
    – Geilmaker
    Jul 18 at 10:13

1 Answer 1

1

Please add KC_PROXY: edge to the environment variables of the keycloak docker container. That is needed, if you run keycloak behind a proxy.

You can find more documentation about this here: https://www.keycloak.org/server/reverseproxy

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.