Cross domain impersonate

Getting advice
,
1

We usually login to the admin console on our own url (e.g. keycloak.mycompany.com) and we set a different frontend url for a specific realm (e.g. auth.myproject.com)

I’ve set these java opts

      -Dkeycloak.adminUrl=https://keycloak.mycompany.com
      -Dkeycloak.hostname.default.forceBackendUrlToFrontendUrl=true

and the problem is that when I click on impersonate in the admin console I get redirected to the login page in the realm domain (auth.myproject.com)

It seems impossible to impersonate a user on a realm which frontend url is different than the console admin url?

1 Like
2

I’m running into the same issue and from what I can tell, yes impersonation is strictly impossible if your admin domain is different from your login domain because the impersonate endpoint works by including set-cookies in the response header but if your admin domain is different those cookies will be set in the wrong origin and you won’t be logged in when redirected to the app.

For my use case I need impersonation so I’ll need to put them on the same domain unless anyone else has any other options I’m unaware of.