Keycloak, spring and /sso/login URL setup

Question

I have a spring boot app which is hidden behind reverse proxy. When user sends request to a resource without authorization he is redirected to keycloak login page with redirect_uri param set to e.g. http://some_url/sso/login (the URL is always relative to context path). I need to change this URL to something like http://some_url/api/my_api/sso/login so that reverse proxy knows where to redirect such request. Any idea how to achieve this? Is there any keycloak adapter configuration option to set it (I haven't found any) or some bean need to be overwritten?

user_14800355 · Answer

I'll answer to my question as I managed to find the solution (in case anyone in future faces similar problem). So basically two things are needed:

Overwrite the KeycloakAuthenticationProcessingFilter bean with setting custom URL in the request matcher:

@Bean
    @Override
    protected KeycloakAuthenticationProcessingFilter keycloakAuthenticationProcessingFilter() throws Exception {
        RequestMatcher requestMatcher =
                new OrRequestMatcher(
                        new AntPathRequestMatcher("/custom_url/sso/login"),
                        new RequestHeaderRequestMatcher("Authorization"),
                        new QueryParamPresenceRequestMatcher("access_token"),
                        new AdapterStateCookieRequestMatcher());

        return new KeycloakAuthenticationProcessingFilter(authenticationManagerBean(), requestMatcher);
    }

Set proper authentication entry point:

@Override
    protected void configure(final HttpSecurity http) throws Exception {
        KeycloakAuthenticationEntryPoint entryPoint = (KeycloakAuthenticationEntryPoint)authenticationEntryPoint();
        entryPoint.setLoginUri("/custom_url/sso/login");

        super.configure(http);
        http
                .authorizeRequests()
                //...
                .and()
                .exceptionHandling()
                .authenticationEntryPoint(entryPoint)
                .and()
                .csrf().disable();


    }

Keycloak, spring and /sso/login URL setup

1 Answers