Getting Invalid parameter: redirect_uri when installed with keycloak-operator

Configuring the server
1

Hi

I have been trying to install Keycloak on a K8s environment but with limited success so far. I just followed the instructions of the keycloak-operator:

make cluster/prepare 
kubectl apply -f deploy/operator.yaml
kubectl apply -f deploy/examples/keycloak/keycloak.yaml

This worked fine and I got a running pod

Trouble started when I wanted to access the UI to start configuring. I had to amend the ingress in order to specify my DNS. And I could not get it to work. I kept seeing SSL errors in my NginX.
I decided to create a HTTP only service that pointed to 8080 instead of 8443. Fine, I could curl it.
I created the corresponding ingress and it worked too. Good! I could access

https://<my.dns.name>/auth/

But as soon as I click to get the Administration Console, I get

Invalid parameter: redirect_uri

And in Keycloak logs, I get

23:17:43,307 WARN  [org.keycloak.events] (default task-7) type=LOGIN_ERROR, realmId=master, clientId=security-admin-console, userId=null, ipAddress=10.1.1.1, error=invalid_redirect_uri, redirect_uri=https://<my.dns.name>/auth/admin/master/console/

I did find here some references to the X-Forwarded-For headers. I looked at my nginx conf and found this line

proxy_set_header X-Forwarded-For        $the_real_ip;

I also saw mentions of an env variable called PROXY_ADDRESS_FORWARDING but I cannot see how to set it with the operator.

Any idea what I am doing wrong?

2

I managed to go a bit further now. I deactivated the operator and edited my StatefulSet. I added the environment variable:

- name: PROXY_ADDRESS_FORWARDING
  value: "true"

Now, I suppose it is just a matter of making the Keycloak CRD configurable now. Either giving the possibility to pass any environment parameters, either having a property proxyForwarding in the CRD. Or maybe it should be linked to the existing externalAccess property?

3

This list may help: A curated list of resources for learning about Keycloak

4

Thanks a lot for giving the Keycloak Operator a go!

Yes, I think it’s a good idea to link this with externalAccess property. I created KEYCLOAK-12679 to track this.

Also - if you have any spare cycles, we would love to get some community Pull Requests!