Keycloak Proxy Buffering behing Nginx to support Blazor Server (websockets)

1

Hi,

I have a Keycloak v17 running on Kubernetes, exposed behind an Nginx ingress controller. Keycloak is exposed via its own subdomain like auth.mydomain.com.

Further more, I have a Blazor Server (.net 6) application exposed via the domain example.com, in which I do authentication against the above Keycloak server.

I now have the dilemma, that Blazor Server seems to enforce websocket, which does not allow to set the proxy_buffer to ‘ON’ on the ingress route, whilst Keycloak requires it. Is there a way to let Keycloak successfully run with proxy_buffering=‘OFF’ behind Nginx ingress?

Thanks

2

Hi, it took me very long to debug this but I want to share the result if anybody else might run into similar issues. Ultimately, it turned out that it was a bad configuration of the hosted .net core service. While I knew it was related to the cookie/header size, I always tried to tweak the Nginx Ingress configuration - without any improvement. What solved it finally was to change in the .net core AddOpenIdConnect() method from “SaveTokens = true” to “SaveTokens = false”. This reduces the header size so that it will work.