Clash Royale CLAN TAG#URR8PPP

Keycloak behind reverse proxy

I installed keycloak standanlone on a server and try to use it behind a reverse Proxy through nginx.
Keycloak is bind to 127.0.0.1

That it my nginx vhost config:

server
server_name auth.dp.net;
location /auth
proxy_pass http://localhost:8080;
proxy_http_version 1.1;

proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;

listen 443 ssl; # managed by Certbot
ssl_certificate /etc/letsencrypt/live/auth.dp.net/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/auth.dp.net/privkey.pem; # managed by Certbot
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot


server
if ($host = auth.dp.net)
return 301 https://$host$request_uri;
# managed by Certbot
listen 80;
server_name auth.dp.net;
return 404; # managed by Certbot



But when I access https://auth.dp.net/auth I get the following keycloak error:

Invalid parameter: redirect_uri


What is misssing in my configuration?

2 Answers
2

Go to your Keycloak Client's Settings and change Valid Redirect Uri to *.

Valid redirect Uri's are a security mechanism of Keycloak that restrict to where a redirect can happen. In production it should be as exact as possible to ensure a secure connection.

A / or two, and maybe an =.

/

=

location /auth {
proxy_pass http://localhost:8080;


If your proxy pass directive is naked, ie has no path specified (as yours is above) then the entire request path will be appended to the proxy pass url.

So your configuration above will result in a request to https://auth.dp.net/auth being proxied to http://localhost:8080/auth/.

https://auth.dp.net/auth

http://localhost:8080/auth/

If you add anything, even just a slash to your proxy pass directive then whatever you add will replace the matching part of your location directive. So to pass the request to the proxy with no path you need to add a slash. So this might work:

location /auth {
proxy_pass http://localhost:8080/;


However, as Nginx likes to add a trailing slash when proxying if the request url doesnt have one it might not work. So you either tell Nginx to match exactly by changing your location directive to:

location = /auth {


Or you anticipate the fact it's going to rewrite your request and change it to:

location /auth/ {


Or if you really want to be a pro you create two identical blocks. One with = /auth and the other with /auth/

= /auth

/auth/

This wins because:

= /auth

https://auth.dp.net/auth/

/auth/

https://auth.dp.net/auth

https://auth.dp.net/auth/

/

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.