Eu segui o procedimento aqui https://www.keycloak.org/docs/3.4/server_installation/index.html#enable-https-ssl-with-a-reverse-proxy mas falta alguma coisa quando tento abrirhttps://auth.solidsense.tk/auth/realms/master/.well-known/openid-configuration endpoints não possuem esquema adequado (http em vez de https) e não consigo entrar no console de administração
listen 80;
listen [::]:80;
server_name auth.solidsense.tk;
root /var/www/auth.solidsense.tk/html;
index index.html index.htm index.nginx-debian.html;
location /{
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Cookie $http_cookie;
proxy_pass http://localhost:9080;
}
listen [::]:443 ssl ipv6only=on; # managed by Certbot
listen 443 ssl; # managed by Certbot
ssl_certificate /etc/letsencrypt/live/auth.solidsense.tk/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/auth.solidsense.tk/privkey.pem; # managed by Certbot
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
}
root@scw-mainflux:~/keycloak-3.4.3.Final# git diff standalone/configuration/standalone.xml
diff --git a/standalone/configuration/standalone.xml b/standalone/configuration/standalone.xml
index 2cb189a..73db59c 100644
--- a/standalone/configuration/standalone.xml
+++ b/standalone/configuration/standalone.xml
@@ -465,7 +465,7 @@
<subsystem xmlns="urn:jboss:domain:undertow:4.0">
<buffer-cache name="default"/>
<server name="default-server">
- <http-listener name="default" socket-binding="http" redirect-socket="https" enable-http2="true"/>
+ <http-listener name="default" socket-binding="http" proxy-address-forwarding="true" redirect-socket="proxy-https" enable-http2="true"/>
<https-listener name="https" socket-binding="https" security-realm="ApplicationRealm" enable-http2="true"/>
<host name="default-host" alias="localhost">
<location name="/" handler="welcome-content"/>
@@ -564,6 +564,7 @@
<socket-binding name="ajp" port="${jboss.ajp.port:8009}"/>
<socket-binding name="http" port="${jboss.http.port:8080}"/>
<socket-binding name="https" port="${jboss.https.port:8443}"/>
+ <socket-binding name="proxy-https" port="443"/>
<socket-binding name="txn-recovery-environment" port="4712"/>
<socket-binding name="txn-status-manager" port="4713"/>
<outbound-socket-binding name="mail-smtp">
Responder1
Eu sei que isso é antigo, mas permanece sem resposta e, olhando para a contagem de visualizações, isso surge repetidamente. Presumo que muitas pessoas eventualmente encontrem uma resposta sozinhas, mas não postem, então postarei o que funcionou para mim.
Cenário típico Internet -> HTTPS -> ModSecNginx -> HTTP -> Keycloak
Keycloak 4.4.0 ModSecurity-nginx v1.0.0 (regras carregadas inline/local/remota: 0/903/0)
Eu tive esse problema idêntico depois de fazer "tudo", keycloak proxy forward true, recomendações nginx .. etc etc.
curl https://modsec.redacted.com/auth/realms/master/.well-known/openid-configuration
{"issuer":"http://modsec.redacted.com/auth/realms/master","authorization_endpoint":"http://modsec.redacted.com/auth/realms/master/protocol/openid-connect/auth"....
Configuração
server
{
listen 80;
listen [::]:80;
location /
{
modsecurity on;
modsecurity_rules '
SecRuleEngine On
SecDebugLog /tmp/modsec_debug.log
# Debug Levels are 3,4,5,9
SecDebugLogLevel 3
# The below rules are disabled, else keycloak does not work at paranoia level 5
SecRuleRemoveById 942432 920273 942421 942420
';
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Cookie $http_cookie;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Server $host;
proxy_set_header X-Forwarded-Port $server_port;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_pass http://keycloak:8080;
}
}
Isso é o que eu tive que fazer
Mudar:
proxy_set_header X-Forwarded-Proto $scheme;
para:
proxy_set_header X-Forwarded-Proto https;
Resultado
curl https://modsec.redacted.com/auth/realms/master/.well-known/openid-configuration
{"issuer":"https://modsec.redacted.com:80/auth/realms/master","authorization_endpoint":"https://modsec.redacted.com:80/auth/realms/master/protocol/openid-connect/auth"
Você viu o que aconteceu?
Então mude:
proxy_set_header X-Forwarded-Port $server_port;
para:
proxy_set_header X-Forwarded-Proto 443;
Ou retire-o completamente.
Resultado
curl https://modsec.redacted.com/auth/realms/master/.well-known/openid-configuration
{"issuer":"https://modsec.redacted.com/auth/realms/master","authorization_endpoint":"https://modsec.redacted.com/auth/realms/master/protocol/openid-connect/auth",
Seu console de administração também começará a funcionar. Estou convencido de que o Nginx possui as variáveis adequadas para isso ($request_scheme ou $client_scheme talvez?).
É isso!