2

I've followed the procedure here https://www.keycloak.org/docs/3.4/server_installation/index.html#enable-https-ssl-with-a-reverse-proxy but something is missing when I try to open https://auth.solidsense.tk/auth/realms/master/.well-known/openid-configuration endpoints dont have proper scheme ( http instead of https ) and I cannot enter administration console

        listen 80;
        listen [::]:80;


        server_name auth.solidsense.tk;
        root /var/www/auth.solidsense.tk/html;
        index index.html index.htm index.nginx-debian.html;


        location /{ 
              proxy_set_header Host $host; 
              proxy_set_header X-Real-IP  $remote_addr; 
              proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
              proxy_set_header X-Forwarded-Proto $scheme;
              proxy_set_header   Cookie $http_cookie;                 
              proxy_pass http://localhost:9080;

    }


    listen [::]:443 ssl ipv6only=on; # managed by Certbot
    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/auth.solidsense.tk/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/auth.solidsense.tk/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

}

root@scw-mainflux:~/keycloak-3.4.3.Final# git diff standalone/configuration/standalone.xml
diff --git a/standalone/configuration/standalone.xml b/standalone/configuration/standalone.xml
index 2cb189a..73db59c 100644
--- a/standalone/configuration/standalone.xml
+++ b/standalone/configuration/standalone.xml
@@ -465,7 +465,7 @@
         <subsystem xmlns="urn:jboss:domain:undertow:4.0">
             <buffer-cache name="default"/>
             <server name="default-server">
-                <http-listener name="default" socket-binding="http" redirect-socket="https" enable-http2="true"/>
+               <http-listener name="default" socket-binding="http" proxy-address-forwarding="true" redirect-socket="proxy-https"  enable-http2="true"/>
                 <https-listener name="https" socket-binding="https" security-realm="ApplicationRealm" enable-http2="true"/>
                 <host name="default-host" alias="localhost">
                     <location name="/" handler="welcome-content"/>
@@ -564,6 +564,7 @@
         <socket-binding name="ajp" port="${jboss.ajp.port:8009}"/>
         <socket-binding name="http" port="${jboss.http.port:8080}"/>
         <socket-binding name="https" port="${jboss.https.port:8443}"/>
+        <socket-binding name="proxy-https" port="443"/>
         <socket-binding name="txn-recovery-environment" port="4712"/>
         <socket-binding name="txn-status-manager" port="4713"/>
         <outbound-socket-binding name="mail-smtp">
mirkash
  • 121

1 Answers1

2

I know this is old, but it remains un-answered, and looking at the view count, this comes up time and again. I assume many many people are finding an answer by themselves eventually but not posting, so i'll post what worked for me.

Typical Scenario Internet -> HTTPS -> ModSecNginx -> HTTP -> Keycloak

Keycloak 4.4.0 ModSecurity-nginx v1.0.0 (rules loaded inline/local/remote: 0/903/0)

I had this identical problem after doing "everything", keycloak proxy forward true, nginx recommendations.. etc etc.

curl https://modsec.redacted.com/auth/realms/master/.well-known/openid-configuration
{"issuer":"http://modsec.redacted.com/auth/realms/master","authorization_endpoint":"http://modsec.redacted.com/auth/realms/master/protocol/openid-connect/auth"....

Config

    server
    {
      listen 80;
      listen [::]:80;
      location /
        {

          modsecurity on;
          modsecurity_rules '
            SecRuleEngine On
            SecDebugLog /tmp/modsec_debug.log
            # Debug Levels are 3,4,5,9
            SecDebugLogLevel 3
            # The below rules are disabled, else keycloak does not work at paranoia level 5
            SecRuleRemoveById 942432 920273 942421 942420
          ';
          proxy_set_header    Host               $http_host;
          proxy_set_header    X-Real-IP          $remote_addr;
          proxy_set_header    X-Forwarded-For    $proxy_add_x_forwarded_for;
          proxy_set_header    Cookie              $http_cookie;
          proxy_set_header    X-Forwarded-Host   $host;
          proxy_set_header    X-Forwarded-Server $host;
          proxy_set_header    X-Forwarded-Port   $server_port;
          proxy_set_header    X-Forwarded-Proto  $scheme;
          proxy_pass http://keycloak:8080;
        }
    }

This is what i had to do

Change:

          proxy_set_header    X-Forwarded-Proto  $scheme;

to:

          proxy_set_header    X-Forwarded-Proto  https;

Result

curl https://modsec.redacted.com/auth/realms/master/.well-known/openid-configuration
{"issuer":"https://modsec.redacted.com:80/auth/realms/master","authorization_endpoint":"https://modsec.redacted.com:80/auth/realms/master/protocol/openid-connect/auth"

You see what happened?

Then change:

          proxy_set_header    X-Forwarded-Port   $server_port;

to:

          proxy_set_header    X-Forwarded-Proto  443;

Or, take it out completely.

Result

curl https://modsec.redacted.com/auth/realms/master/.well-known/openid-configuration
{"issuer":"https://modsec.redacted.com/auth/realms/master","authorization_endpoint":"https://modsec.redacted.com/auth/realms/master/protocol/openid-connect/auth",

Your admin console will start working as well. I'm convinced that Nginx has the proper variables for this ($request_scheme, or $client_scheme perhaps?).

That is it!

Marnus van Wyk
  • 21