Keycloak 26's Admin console always shows "somethingWentWrong"

[xingxingxia]

Describe the bug

Following https://www.keycloak.org/getting-started/getting-started-openshift and accessing the Admin console of the keycloak route, it always shows "somethingWentWrong".

Version

26.0.7

Expected behavior

With tag 26.0.0 ~ 26.0.7, the admin console of the keycloak route should work well in browser, as 25.0.0 works well.

Actual behavior

With tag 26.0.0 ~ 26.0.7, the admin console of the keycloak route can't be accessed in browser.

How to Reproduce?

$ oc new-project keycloak

$ oc process -n keycloak -f https://raw.githubusercontent.com/keycloak/keycloak-quickstarts/latest/openshift/keycloak.yaml -p KEYCLOAK_ADMIN=admin -p KEYCLOAK_ADMIN_PASSWORD=admin -p NAMESPACE=keycloak | sed -e 's/KEYCLOAK_ADMIN_PASSWORD/KC_BOOTSTRAP_ADMIN_PASSWORD/g' -e 's/KEYCLOAK_ADMIN\b/KC_BOOTSTRAP_ADMIN_USERNAME/g' | oc create -n keycloak -f -
service/keycloak created
route.route.openshift.io/keycloak created
Warning: apps.openshift.io/v1 DeploymentConfig is deprecated in v4.14+, unavailable in v4.10000+
deploymentconfig.apps.openshift.io/keycloak created

$ oc get po -n keycloak
NAME                READY   STATUS      RESTARTS   AGE
keycloak-1-deploy   0/1     Completed   0          8m53s
keycloak-1-nnrnl    1/1     Running     0          8m52s

$ oc get po keycloak-1-nnrnl -n keycloak -o yaml | grep "image:"
    image: quay.io/keycloak/keycloak:26.0.7
    image: quay.io/keycloak/keycloak:26.0.7

$ oc get route -n keycloak
NAME       HOST/PORT                                                         PATH   SERVICES   PORT    TERMINATION   WILDCARD
keycloak   keycloak-keycloak.xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx          keycloak   <all>   edge          None

Then in FireFox browser, open https://keycloak-keycloak.apps.xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/admin/master/console/ , it spins seconds to load the admin console then shows:

Danger alert:somethingWentWrong

somethingWentWrongDescription

tryAgain

Meantime I open the Web Developer Tools from the browser "Tools" menu. In the "Console" tab of the the tool, below are seen:

Blocked loading mixed active content “http://keycloak-keycloak.apps.xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/resources/master/admin/en”
Content-Security-Policy: The page’s settings blocked the loading of a resource (frame-src) at http://keycloak-keycloak.apps.xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/realms/master/protocol/openid-connect/3p-cookies/step1.html because it violates the following directive: “frame-src 'self'”

Below are the full logs of the pod:

$ oc logs keycloak-1-nnrnl -n keycloak
Updating the configuration and installing your custom providers, if any. Please wait.
2024-12-05 07:13:03,240 INFO  [io.qua.dep.QuarkusAugmentor] (main) Quarkus augmentation completed in 11972ms
2024-12-05 07:13:04,471 ERROR [org.keycloak.quarkus.runtime.configuration.mappers.PropertyMappers] (main) Hostname v1 options [proxy] are still in use, please review your configuration
2024-12-05 07:13:09,413 INFO  [org.keycloak.quarkus.runtime.storage.infinispan.CacheManagerFactory] (main) Starting Infinispan embedded cache manager
2024-12-05 07:13:09,630 INFO  [org.keycloak.quarkus.runtime.storage.infinispan.CacheManagerFactory] (main) Persistent user sessions enabled and no memory limit found in configuration. Setting max entries for sessions to 10000 entries.
2024-12-05 07:13:09,630 INFO  [org.keycloak.quarkus.runtime.storage.infinispan.CacheManagerFactory] (main) Persistent user sessions enabled and no memory limit found in configuration. Setting max entries for clientSessions to 10000 entries.
2024-12-05 07:13:09,630 INFO  [org.keycloak.quarkus.runtime.storage.infinispan.CacheManagerFactory] (main) Persistent user sessions enabled and no memory limit found in configuration. Setting max entries for offlineSessions to 10000 entries.
2024-12-05 07:13:09,630 INFO  [org.keycloak.quarkus.runtime.storage.infinispan.CacheManagerFactory] (main) Persistent user sessions enabled and no memory limit found in configuration. Setting max entries for offlineClientSessions to 10000 entries.
2024-12-05 07:13:10,185 INFO  [org.infinispan.CONTAINER] (ForkJoinPool.commonPool-worker-1) ISPN000556: Starting user marshaller 'org.infinispan.commons.marshall.ImmutableProtoStreamMarshaller'
2024-12-05 07:13:12,751 INFO  [org.keycloak.quarkus.runtime.storage.database.liquibase.QuarkusJpaUpdaterProvider] (main) Initializing database schema. Using changelog META-INF/jpa-changelog-master.xml

UPDATE SUMMARY
Run:                        148
Previously run:               0
Filtered out:                 0
-------------------------------
Total change sets:          148

2024-12-05 07:13:17,194 WARN  [io.agroal.pool] (main) Datasource '<default>': JDBC resources leaked: 1 ResultSet(s) and 0 Statement(s)
2024-12-05 07:13:17,839 INFO  [org.keycloak.connections.infinispan.DefaultInfinispanConnectionProviderFactory] (main) Node name: node_446828, Site name: null
2024-12-05 07:13:18,090 INFO  [org.keycloak.broker.provider.AbstractIdentityProviderMapper] (main) Registering class org.keycloak.broker.provider.mappersync.ConfigSyncEventListener
2024-12-05 07:13:18,234 INFO  [org.keycloak.services] (main) KC-SERVICES0050: Initializing master realm
2024-12-05 07:13:21,349 INFO  [org.keycloak.services] (main) KC-SERVICES0077: Created temporary admin user with username admin
2024-12-05 07:13:21,394 WARN  [io.agroal.pool] (main) Datasource '<default>': JDBC resources leaked: 1 ResultSet(s) and 0 Statement(s)
2024-12-05 07:13:21,621 INFO  [io.quarkus] (main) Keycloak 26.0.7 on JVM (powered by Quarkus 3.15.1) started in 18.181s. Listening on: http://0.0.0.0:8080
2024-12-05 07:13:21,621 INFO  [io.quarkus] (main) Profile dev activated.
2024-12-05 07:13:21,621 INFO  [io.quarkus] (main) Installed features: [agroal, cdi, hibernate-orm, jdbc-h2, keycloak, narayana-jta, opentelemetry, reactive-routes, rest, rest-jackson, smallrye-context-propagation, vertx]
2024-12-05 07:13:21,628 WARN  [org.keycloak.quarkus.runtime.KeycloakMain] (main) Running the server in development mode. DO NOT use this configuration in production.

Anything else?

If the 26.0.7 tag in oc edit dc keycloak -n keycloak is replaced with 25.0.0, all are good without this issue. (Tried 26.0.0, it also had same issue).

[max1weber]

yes samehere

[TjenWellens]

Same with v 26 (latest for me atm)
Using v "25.0" fixes this issue for me.

fyi: I had to use KEYCLOAK_ADMIN and KEYCLOAK_ADMIN_PASSWORD instead of (actually using it alongside) KC_BOOTSTRAP_ADMIN_PASSWORD and KC_BOOTSTRAP_ADMIN_USERNAME

[sqlstatement]

Seems like this issue is being caused by 26.0.0+ removing v1 hostnames. I've fixed this issue by downloading the keycloak.yaml, adding the KC_HOSTNAME environment variable and setting it to https://<keycloak-url.tld>.

Hope this helps!

[jamieoneill]

Thanks @sqlstatement that also worked for me.

[xingxingxia]

@sqlstatement thank you! That works for me too:

$ oc new-project keycloak

$ oc process -n keycloak -f https://raw.githubusercontent.com/keycloak/keycloak-quickstarts/latest/openshift/keycloak.yaml -p KEYCLOAK_ADMIN=admin -p KEYCLOAK_ADMIN_PASSWORD=admin -p NAMESPACE=keycloak | sed -e 's/KEYCLOAK_ADMIN_PASSWORD/KC_BOOTSTRAP_ADMIN_PASSWORD/g' -e 's/KEYCLOAK_ADMIN\b/KC_BOOTSTRAP_ADMIN_USERNAME/g' | oc create -n keycloak -f -
service/keycloak created
route.route.openshift.io/keycloak created
Warning: apps.openshift.io/v1 DeploymentConfig is deprecated in v4.14+, unavailable in v4.10000+
deploymentconfig.apps.openshift.io/keycloak created

$ oc set env dc/keycloak -e KC_HOSTNAME=https://keycloak-keycloak.apps.xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Now https://keycloak-keycloak.apps.xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx can be logged in successfully.

https://www.keycloak.org/getting-started/getting-started-openshift should be updated for it.

[jamieoneill]

also is there a way to KC_HOSTNAME to something like https://{spec.host} for reusing the same yaml in different environments?

[mposolda]

I am closing as this is not an issue in Keycloak quickstarts and it seems that this is already resolved.