Path "realms/master" should not exist, for master we need something like /admin/master

[Orlandoiii]

I dont know if is a skill issue of my part but iam trying to follow your guide to improve my security in prod, but you have this table

Keycloak Path | Reverse Proxy Path | Exposed | Reason -- | -- | -- | -- / | - | No | When exposing all paths, admin paths are exposed unnecessarily. /admin/ | - | No | Exposed admin paths lead to an unnecessary attack vector. /realms/ | /realms/ | Yes | This path is needed to work correctly, for example, for OIDC endpoints. /resources/ | /resources/ | Yes | This path is needed to serve assets correctly. It may be served from a CDN instead of the Keycloak path. /.well-known/ | /.well-known/ | Yes | This path is needed to resolve Authorization Server Metadata and other information via RFC 8414. /metrics | - | No | Exposed metrics lead to an unnecessary attack vector. /health | - | No | Exposed health checks lead to an unnecessary attack vector.

in this table said dont expose admin, but expose realms this has sense for me. Until the first redirect of main path of keycloak is /realms/master. I know i can make a rule to dont let certain client in this url. But for me this a desing flaw. The master realm is the admin realm. It should be treat different for the rest. I repeat maybe is a skill issue. Is someone can explain me It would be very helpfull. Thanks a lot by the way. Keycloak is an amazing app.

[shawkins]

Relates to #46572

The master realm is the admin realm. It should be treat different for the rest.

To not expose the master realm on the same host as the other realms currently requires changing the master realm front-end url.

Edit: I realized this didn't address directly the idea that the master realm should be under /admin. The rationale for why it is treated consistently with the other realms is that while it is recommended that the master realm only be for administration, that is not required, the name of the master realm is configurable, and the attack surface area is already minimized by having /admin secured.