JHipster keycloak docker configuration for production

Question

My JHipster(v4.11.1) project is using Monolithic architecture with OAuth 2.0 authentication type. I did face couple of issue for hosting it in a production server. Currently here are not fixed yet ones:

After I do click 'Sign in' link I get redirect into following url:

https://my-domain-name/auth/realms/jhipster/protocol/openid-connect/auth?client_id=web_app&redirect_uri=http://my-docker-service-name/login&response_type=code&scope=openid%20profile%20email&state=hO2NCQ

First issue is, here I need my-docker-service-name to be my-domain-name (and using https).

Note: Here I do see keycloak login page with following error message: Invalid parameter: redirect_uri

If I do change redirect_uri into my domain name manually, then I see keycloak login page without error. Next issue is after I do enter username/password, I get redirect into following url:

http://keycloak/auth/realms/jhipster/login-actions/authenticate?code=3MADiKg19-SL1L_lOmMEJv4w3kmGlF--0hyIDInKPm8&execution=07cacbc6-5b72-407e-9a0c-9a1b6447a7ff&client_id=web_app

And as you can see my second issue is keycloak need to be my-domain-name (and using https).

Note: Here if change the url manually into my-domain-name, then I see login page with invalid username/password error message.

Moreover I do have same problem for accessing keycloak administration console(it get redirect into http://keycloak) and I can't see the login page(Invalid parameter: redirect_uri).

I can provide more information regards to my production configurations if needed? for instance I do use Nginx as reverse proxy and also for handling https requests. My Nginx instance is a docker container and using default docker network for finding it's upstreams (keycloak(for /auth path) and my-app(for / path).

Even I did face above issues, so far I am very happy with the result and I would like to Thank you JHipster team, Keycloak team and Matt Raible! :-) for making it possible for us to use this great frameworks together! Cheers!

Answer 1

First of all this section(8.3. Setting Up a Load Balancer or Proxy) of Keycloak documentation was absolutely helpful. I was able to make things somehow working but I still feel things can get done better and in more secure way!

I am not going to repeat needed configuration for Keycloak side, but I rather provide some hints for you in case you are using Nginx as reverse proxy.

Here is my nginx.conf which includes required configs:

```

upstream rock-app {
    server rock-app:8080;
}
upstream keycloak {
    server keycloak:9080;
}

server {
    listen 80;
    listen 443 ssl http2;
    ...
    add_header Strict-Transport-Security "max-age=86400; includeSubdomains; preload" always;
    ...
}

location / {
    proxy_set_header HOST $host;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_pass http://rock-app;
}

location /auth {
    proxy_set_header HOST $host;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_pass http://keycloak;
}

```

Note: add_header Strict-Transport-Security ... part is important and ensure us users will stay in https protocol when they enter the site with a https url. please correct me if I am wrong!?

Now If I visit following url:

https://my-example.com/auth/realms/jhipster/.well-known/openid-configuration

I will see this response:

{
    "issuer": "http://my-example.com/auth/realms/jhipster",
    "authorization_endpoint": "http://my-example.com/auth/realms/jhipster/protocol/openid-connect/auth",
    "token_endpoint": "http://my-example.com/auth/realms/jhipster/protocol/openid-connect/token",
    "token_introspection_endpoint": "http://my-example.com/auth/realms/jhipster/protocol/openid-connect/token/introspect",
    "userinfo_endpoint": "http://my-example.com/auth/realms/jhipster/protocol/openid-connect/userinfo",
    "end_session_endpoint": "http://my-example.com/auth/realms/jhipster/protocol/openid-connect/logout",
    "jwks_uri": "http://my-example.com/auth/realms/jhipster/protocol/openid-connect/certs",
    "check_session_iframe": "http://my-example.com/auth/realms/jhipster/protocol/openid-connect/login-status-iframe.html",
    "grant_types_supported": ["authorization_code", "implicit", "refresh_token", "password", "client_credentials"],
    "response_types_supported": ["code", "none", "id_token", "token", "id_token token", "code id_token", "code token", "code id_token token"],
    "subject_types_supported": ["public", "pairwise"],
    "id_token_signing_alg_values_supported": ["RS256"],
    "userinfo_signing_alg_values_supported": ["RS256"],
    "request_object_signing_alg_values_supported": ["none", "RS256"],
    "response_modes_supported": ["query", "fragment", "form_post"],
    "registration_endpoint": "http://my-example.com/auth/realms/jhipster/clients-registrations/openid-connect",
    "token_endpoint_auth_methods_supported": ["private_key_jwt", "client_secret_basic", "client_secret_post"],
    "token_endpoint_auth_signing_alg_values_supported": ["RS256"],
    "claims_supported": ["sub", "iss", "auth_time", "name", "given_name", "family_name", "preferred_username", "email"],
    "claim_types_supported": ["normal"],
    "claims_parameter_supported": false,
    "scopes_supported": ["openid", "offline_access"],
    "request_parameter_supported": true,
    "request_uri_parameter_supported": true
}

As you may notice http://my-example.com/... is shown instead of https://my-example.com/...

Therefore I had to change following config of my realm(jhipster-realm.json) from "sslRequired" : "external", to "sslRequired" : "none", which I don't know if is a bad thing? considering (1) my browser never leaves https when I do test login workflow and (2) my keycloak instance is not accessible through any public port.

Well I am not going to accept my own answer as accepted answer, because as I said earlier I feel things can get done better and in more secure way. Thanks!

Update

I've done following changes for using https protocol:

Dockerfile

FROM jboss/keycloak:3.4.1.Final

standalone.xml

<server name="default-server">
    ...
    <http-listener name="default" socket-binding="http" redirect-socket="proxy-https" proxy-address-forwarding="${env.PROXY_ADDRESS_FORWARDING}" certificate-forwarding="true" enable-http2="true"/>
    <https-listener name="https" socket-binding="https" security-realm="ApplicationRealm" proxy-address-forwarding="${env.PROXY_ADDRESS_FORWARDING}" certificate-forwarding="true" enable-http2="true"/>
...

<socket-binding-group ...
    <socket-binding name="proxy-https" port="443"/>
...

nginx.conf

upstream keycloak {
    server keycloak:9443;
}
...
server {
    listen 80;
    return 301 https://$host$request_uri;
}
server {
    listen 443 ssl http2;
    ...
    location /auth {
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_pass https://keycloak;
    }
...

jhipster-realm.json

...
"sslRequired": "external",

HTH, Thanks!