Authentication scenario with keycloak security proxy
I have built the architecture shown in the image.
A client authentication request reaches the keycloak security proxy docker container.
Proxy asks the actual keycloak server docker container
Keycloak Server asks an external LDAP for user credentials.
Keycloak server replies OK.
Keycloak proxy replies OK and passes control to the external application URL.
The problem is that after successful authentication, the URL of the host server (i.e. where the keycloak proxy container and keycloak authentication container lie) appears on the address bar of the browser instead of the actual external application URL.
For example, if the host machine where the keycloak containers lie is keycloak.containers.gr, and the external application domain name is www.external.application.gr, then, after a successful login to the keycloak SSO login page, the URL in the address bar appears to be http://keycloak.containers.gr instead of http://www.external.application.gr. This fact destroys all the relative css, js scripts, etc. attached to the site www.external.application.gr.
KEYCLOAK SECURITY PROXY CONFIGURATION
I use a proxy.json for the keycloak security proxy configuration
{
"target-url": "http://www.external.application.gr",
"bind-address": "0.0.0.0",
"send-access-token": true,
"http-port": "8180",
"https-port": "8443",
"applications": [
{
"base-path": "/",
"adapter-config": {
"realm": "internal_applications",
"auth-server-url": "http://keycloak.containers.gr:8202/auth",
"resource": "test_app",
"ssl-required": "external",
"credentials": {
"secret": "xxxxx-xxx-xxx-xxxx-xxxxxxxxxxx"
}
},
"constraints": [
{
"pattern": "/*",
"authenticate": true
}
],
"proxy-address-forwarding": true
}
]
}
NOTE:
I have tried to change the "bind-address": "0.0.0.0" parameter, from 0.0.0.0 to the IP of the www.external.application.gr, but with no luck...
