Configuring IIS as reverse-proxy for Keycloak

Question

I'm using Keycloak 2.3.0 version, standalone mode, server. I configured IIS URL Rewrite for local Keycloak server running on localhost:8080.

The problem is that there is no way to specify base url in Keycloak, instead Keycloak tries to detect its own host/port and always appends port number (8080) to redirects. I fixed everything except 'auth-server-url' in config json. Is there any way to get it working?

Answer 1

I've been running Keycloak behind a reverse-proxy for some time. The key is:

• to have it configured properly in standalone.xml - HTTPS proxy settings for mydomain.com/sso settings follow:

  • <http-listener name="default"... -> <http-listener name="default" socket-binding="http" proxy-address-forwarding="true" redirect-socket="proxy-https"/>
  • <socket-binding name="http"... -> <socket-binding name="proxy-https" port="443"/>
  • <web-context>auth... -> <web-context>sso</web-context>

• to run it on the same context path as the proxy is. Eg. mydomain.com/keycloak -> localhost:8080/keycloak

• to access Keycloak admin console from the non-local address for the first time - it generates some of its settings based on this first access