Keycloak behind Kong and strange redirect

Question

Setup:

minikube version: v0.27.0
Kong (helm install stable/kong) / version 1.0.2
Keycloak (helm install stable/keycloak) / version 4.8.3.Final

I have a self signed SSL certificate for my "hello.local".

What I need to achieve: Keycloak behind Kong at "https://hello.local/".

My steps:

1) fresh minikube

2) Install Keycloak with helm, following values.yaml:

keycloak:
    basepath: ""
    replicas: 1
    ...
    extraEnv: |
      - name: PROXY_ADDRESS_FORWARDING
        value: "true"

(that would create service auth-keycloak-http)

3) Install Kong with helm, following values.yaml:

replicaCount: 1
admin:
  ingress:
    enabled: true
    hosts: ['hello.local']
proxy:
  type: LoadBalancer 
  ingress:
    enabled: true
    hosts: ['hello.local']
    tls:
      - hosts:
        - hello.local
        secretName: tls-certificate
    annotations:
      kubernetes.io/ingress.class: "nginx"
      nginx.ingress.kubernetes.io/rewrite-target: /
      nginx.ingress.kubernetes.io/ssl-passthrough: "true"
  tls:
    enabled: true
postgresql:
...

4) I setup service and route for Kong

Service:

Protocol: http
Host: auth-keycloak-http
Port: 80

Route:

Hosts: hello.local

After that I can open "https://hello.local" and can see welcome page from Keycloak where I can click Administration Console and after that I have redirect to "https://hello.local:8443/admin/master/console/" in my browser. So we should not have redirect with another port at this point.

Setup with 2 docker images (Keycloak + Kong) is working if PROXY_ADDRESS_FORWARDING is true.

How can I make Keycloak (helm chart) to work behind Kong (helm chart) in kubernetes cluster as expected, without redirect?

This is being discussed in github issue 1, github issue 2 and github issue 3. Also, Similar questions on stackoverflow

Question has been added, as well as extra links related to this issue — Igor

Igor Igor · Accepted Answer · 2019-10-09T14:10:11

Original answer:

Seems, it is necessary to setup following environment variables in values.yaml of keycloak helm chart:

...
  extraEnv: |
    - name: KEYCLOAK_HTTP_PORT
      value: "80"
    - name: KEYCLOAK_HTTPS_PORT
      value: "443"
    - name: KEYCLOAK_HOSTNAME
      value: example.com
...

All of them are required, after that, redirect would work correctly.

Added 2021 Sep:

Issue with weird behavior with redirect to port 8443 for some action (like go to Account management with the link on the top right of admin console).

In fact we do not need to set any KEYCLOAK_HTTP_PORT or KEYCLOAK_HTTPS_PORT.

Some changes are required on proxy side. On proxy we need to set x-forwarded-port to 443 for this route.

In my case we use Kong:

On the route, where Keycloak is exposed, we need to add (this one worked for me):

serverless > post function with following content:

ngx.var.upstream_x_forwarded_port=443

More info on KONG and x_forwarded_*

Keycloak behind Kong and strange redirect

1 Answers