[stable/keycloak] invalid port redirect behind Kong

[Igor-lkm]

Is this a request for help?: yes

---

Is this a BUG REPORT or FEATURE REQUEST? (choose one): Bug

Version of Helm and Kubernetes: Helm v2.13.3 / minikube v0.27.0

Which chart: stable/keycloak 4.6.1

What happened: I have Keycloak behind Kong proxy. I can see welcome page of Keycloak at my {url}. When I click Administration Console I am redirected to {url}:8443/admin/master/console/

What you expected to happen:

Redirect should be to {url}/admin/master/console/

How to reproduce it (as minimally and precisely as possible):

1. Fresh minikube
2. Install Keycloak chart with values.yaml:

keycloak:
    basepath: ""
    replicas: 1
    username: *
    password: *
    dbVendor: *
    dbName: *
    dbHost: *
    dbUser: *
    dbPassword: *
    extraEnv: |
      - name: PROXY_ADDRESS_FORWARDING
         value: "true"

At this point environment var PROXY_ADDRESS_FORWARDING is set to true correctly on container. standalone config is loaded opt/jboss/keycloak/standalone/configuration/standalone_xml_history/standalone.boot.xml

4. Install Kong chart with values.yaml:
   (I have self signed ssl certificate for my hello.local)

replicaCount: 1
admin:
  ingress:
    enabled: true
    hosts: ['hello.local']
proxy:
  type: ClusterIP
  ingress:
    enabled: true
    hosts: ['hello.local']
    tls:
      - hosts:
        - hello.local
        secretName: tls-certificate
    annotations:
      kubernetes.io/ingress.class: "nginx"
      nginx.ingress.kubernetes.io/rewrite-target: /
      nginx.ingress.kubernetes.io/ssl-passthrough: "true"
  tls:
    enabled: true
...

5. Setup service and route for Kong

Service:

Protocol: http
Host: auth-keycloak-http
Port: 80

Route:

Hosts: hello.local 
Path: /

After that I can open https://hello.local and can see welcome page from Keycloak where I can click Administration Console and after that I have redirect to "https://hello.local:8443/admin/master/console/" in my browser. So we should not have redirect with another port at this point...

Anything else we need to know:

Similar setup with 2 docker images (Keycloak + Kong) is working if environment variable PROXY_ADDRESS_FORWARDING is true

[namadori]

Same problem here, with a deploy on Azure Kubernetes. Other services (angular frontend, spring boot backend services) are working correcly.

[tolmanam]

I'm currently working through the same issue.

I may have found a promising lead in the keycloak.org docs that descibe the steps to set up Keycloack behind a load balancer or proxy.

[Igor-lkm]

well... it seems that keycloak is working behind express-gateway at least 🤔, with config like:

keycloakService:
  url: 'http://keycloak-http:80'
  proxyOptions:
    xfwd: true

@tolmanam did you have any luck with Kong?

[tolmanam]

@Igor-lkm I've had to pivot to work on other tasks. I thought that the keycloak.org documents appear to provide a promising lead that I hoped to come back to later.

If you have it working behind express-gateway that is a really good sign.

[unguiculus]

The Keycloak chart here is being deprecated (#13316) and moved to a new home:
https://github.com/codecentric/helm-charts

I'm closing this issue. Feel free to open a new issue in the new repo. Thanks.