keycloak redirects urls to http instead of https

Question

I have a keycloak setup behind SSL terminating nginx proxy. When i try to access application secured using keycloak, keycloak generates url like following:

https://keycloak.mydomain.com/auth/realms/AdfsDemo/protocol/openid-connect/auth?client_id=adfs&redirect_uri=http%3A%2F%2Fmyapp.mydomain.com%2Fsignin-oidc&response_type=code&scope=openid%20profile&response_mode=form_post&nonce=636603226928179925.MmUzYWEzMGYtNTAxOS00MTBkLTk4MWItMDU3MGY1NjAxOGViNzlhYmZiMDQtNTQyOC00Y2YzLTk2MjMtZjNjMWFjNTI1YzM3&state=CfDJ8NQosUp9FsZBgifUu0XsVAEasSeKTitMPUM5yatTiQGf_Kz_X9CpQNPIHOkGr1hsgdErjhbw4ULINvCJgnFdWYctcIuhoyhOTt2Km3xy0qFh4o9gNFkPQlbEqc771MmVC2FUqUtvDqf8zChsyDDfGkxZ6Kc1y36I_3lFfzfubBAyXK0cEb_3AdZBMyDRp2WMykrarD8Z-0iGBk_q5Z8akYYHyCc7q-FSKxP1DW59nHpF8fM6P-S8SdVxvTW2dtEyV9UL6rlqD8dabNNJxhoaXEeBzwRh84it2vVlaaYpQ7d1ErZ51hpuzhG2gYSxnowMdQa8gfd8X1hs5HsgJXL-gCmBgTlxWNQfAy5DRpcX8Wi0&x-client-SKU=ID_NET&x-client-ver=2.1.4.0

I can access keycloak on https just fine. But when i try to access application secured using keycloak You will notice that redirect_uri generated by keycloak is http instead of https.

Here is my nginx configuration

server {       
listen 443  ssl;
server_name  myapp.mydomain.com;
ssl_certificate /etc/nginx/external/wildcard_mydomain_com.pem;
ssl_certificate_key /etc/nginx/external/private.rsa;

location / {                 
   proxy_set_header Host myapp.mydomain.com;         
   proxy_set_header X-Real-IP $remote_addr;
   proxy_set_header X-Forwarded-Proto $scheme;       
   proxy_set_header X-Forwarded-Port 443;
   proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;                               
   proxy_pass http://172.30.5.28:8001;
 }
}

#Keycloak Service
server {
listen 443  ssl;
server_name  keycloak.mydomain.com;  
ssl_certificate /etc/nginx/external/wildcard_mydomain_com.pem;
ssl_certificate_key /etc/nginx/external/private.rsa;
location = / {
     return 301 https://keycloak.mydomain.com/auth; 
}  
location /auth {
   proxy_pass http://172.30.5.28:8080;        
   proxy_set_header Host keycloak.mydomain.com;  
   proxy_set_header X-Real-IP $remote_addr;
   proxy_set_header X-Forwarded-Proto https;
   proxy_set_header X-Forwarded-Port 443;
   proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;           
 }
}

Any help is greatly appreciated.

Thanks, Rahul

Are you using some kind of adapter in order to protect your application? It looks like that adapter is not properly parsing the forwarded proto header when it needs to build the authentication entry point url. — Aritz, Apr 30 '18 at 10:13

score 1 · Answer 1 · answered Sep 06 '21 at 06:05

Got the same problem with KeyCloak docker, I resolved it as follows,

nginx config,

    location /auth {
        resolver 127.0.0.11 ipv6=off valid=5s;
        set $upstream "http://identity-service:8080";
        proxy_pass $upstream;
        proxy_redirect     off;
        proxy_set_header   Host $host;
        proxy_set_header   X-Real-IP $remote_addr;
        proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Host $server_name;
        proxy_set_header   X-Forwarded-Proto https;
        proxy_set_header   X-Forwarded-Port 443;
        proxy_connect_timeout       3000;
        proxy_send_timeout          3000;
        proxy_read_timeout          3000;
        send_timeout                3000;
        client_max_body_size 5120m;
    }

docker-compose file, set PROXY_ADDRESS_FORWARDING to true

environment:
  KEYCLOAK_USER: 
  KEYCLOAK_PASSWORD: 
  KEYCLOAK_FRONTEND_URL: 
  PROXY_ADDRESS_FORWARDING: "true"
  DB_VENDOR: 
  DB_ADDR: 
  DB_PORT: 
  DB_DATABASE: 
  DB_USER: 
  DB_PASSWORD:

By removing the KEYCLOAK_FRONTEND_URL you can disable the KeyCloak front-end as well.

score 0 · Accepted Answer · answered May 03 '18 at 11:04

I was able to resolve this issue. We have dotnet core application and keycloak behing ssl terminating SSL proxy. Nginx setting as mentioned above is correct, the issue was application was not forwarding the headers properly to keyclaok. Following link helped: https://learn.microsoft.com/en-us/aspnet/core/host-and-deploy/proxy-load-balancer?view=aspnetcore-2.1

score 0 · Answer 3 · answered Sep 12 '18 at 04:02

    var forwardingOptions = new ForwardedHeadersOptions()
{
    ForwardedHeaders = ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto
};
forwardingOptions.KnownNetworks.Clear(); //its loopback by default
forwardingOptions.KnownProxies.Clear();
app.UseForwardedHeaders(forwardingOptions);

this code block from another answer solved the issue for me. .net Core X Forwarded Proto not working

score 0 · Answer 4 · answered Aug 26 '21 at 21:16

0

With a nodejs/express app, I had to add the trust proxy setting.

app.set('trust proxy', function (ip) {
  return true;
  // if (ip === '127.0.0.1' || ip === '123.123.123.123') return true // trusted IPs
  // else return false
});

answered Aug 26 '21 at 21:16

viniciusalvess

756
8
18

keycloak redirects urls to http instead of https

4 Answers4

Linked