Keycloak behind nginx in docker results in 404 and infinitive redirects

Question

I am new to Keycloak and not an expert in nginx either. I have followed documentations and other questions and set-up a docker-compose file with keycloak, protected by nginx.

Here is my docker-compose.yml which contains the config for nginx and keycloak.

radarbase-keycloak:
    networks:
      - api
      - security
    environment:
      KEYCLOAK_USER : ${KEYCLOAK_USER}
      KEYCLOAK_PASSWORD: ${KEYCLOAK_PASSWORD}
      DB_VENDOR: postgres
      DB_ADDR: radarbase-postgresql
      DB_PORT: 5432
      DB_DATABASE: rbkeycloak
      DB_USER: ${POSTGRES_USER}
      DB_PASSWORD: ${POSTGRES_PASSWORD}
      PROXY_ADDRESS_FORWARDING: "true"
    depends_on:
      - radarbase-postgresql
    restart: always
radarbase-postgresql:
    image: postgres:${POSTGRES_VERSION}
    networks:
      - security
    volumes:
      - "${RB_POSTGRES_DIR}/data/:/var/lib/postgresql/data/"
    environment:
      POSTGRES_USER : ${POSTGRES_USER}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      POSTGRES_DB: rbkeycloak
    healthcheck:
      test: ["CMD-SHELL", "PGPASSWORD='${POSTGRES_PASSWORD}' psql -U '${POSTGRES_USER}' rbkeycloak -l || exit 1"]
      interval: 1m30s
    timeout: 5s
webserver:
    image: nginx:1.13.1-alpine
    restart: always
    networks:
      - api
      - default
    depends_on:
      - radarbase-keycloak
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - certs:/etc/letsencrypt
      - certs-data:/data/letsencrypt
      - "./etc/webserver/nginx.conf:/etc/nginx/nginx.conf:ro"

And my nginx.conf is configured as below

worker_rlimit_nofile 8192;

events {
  worker_connections  4096;  ## Default: 1024
}

http {
  default_type application/octet-stream;
  log_format   main '$remote_addr - $remote_user [$time_local]  $status '
    '"$request" $body_bytes_sent "$http_referer" '
    '"$http_user_agent" "$http_x_forwarded_for"';
  tcp_nodelay  on;

  # hide nginx version
  server_tokens off;

  # add nosniff header (https://www.owasp.org/index.php/List_of_useful_HTTP_headers)
  add_header X-Content-Type-Options nosniff;

  # For logins, make 2 requests per second at most
  limit_req_zone $binary_remote_addr zone=login_limit:10m rate=2r/s;

  server {
    listen                    80 default_server;
    listen                    [::]:80 default_server;
    server_name               mydomain-dev.example.net;

    access_log                /var/log/nginx/access.log;
    error_log                 /var/log/nginx/error.log;

    location /auth/{
      proxy_pass http://radarbase-keycloak:8080/;

      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header Host $host;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;

    }
  }
}

Everything is running, however, if I try to access keycloak from https://mydomain-dev.example.net/auth/ I get **404** and the nginx logs from docker says

webserver_1              | 143.168.122.1 - - [29/Nov/2018:16:15:46 +0000] "GET /auth/ HTTP/1.1" 200 1087 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:63.0) Gecko/20100101 Firefox/63.0"
webserver_1              | 143.168.122.1 - - [29/Nov/2018:16:15:46 +0000] "GET /favicon.ico HTTP/1.1" 404 162 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:63.0) Gecko/20100101 Firefox/63.0"

webserver_1              | 143.168.122.1 - - [29/Nov/2018:16:15:56 +0000] "GET /favicon.ico HTTP/1.1" 404 162 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:63.0) Gecko/20100101 Firefox/63.0"
webserver_1              | 2018/11/29 16:15:57 [error] 8#8: *7 open() "/etc/nginx/html/favicon.ico" failed (2: No such file or directory), client: 143.168.122.1, server: mydomain-dev.example.net, request: "GET /favicon.ico HTTP/1.1", host: "mydomain-dev"
webserver_1              | 143.168.122.1 - - [29/Nov/2018:16:15:57 +0000] "GET /favicon.ico HTTP/1.1" 404 162 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:63.0) Gecko/20100101 Firefox/63.0"
webserver_1              | 2018/11/29 16:15:57 [error] 8#8: *7 open() "/etc/nginx/html/favicon.ico" failed (2: No such file or directory), client: 143.168.122.1, server: mydomain-dev.example.net, request: "GET /favicon.ico HTTP/1.1", host: "mydomain-dev"
webserver_1              | 143.168.122.1 - - [29/Nov/2018:16:15:57 +0000] "GET /favicon.ico HTTP/1.1" 404 162 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:63.0) Gecko/20100101 Firefox/63.0"
webserver_1              | 2018/11/29 16:15:58 [error] 8#8: *7 open() "/etc/nginx/html/favicon.ico" failed (2: No such file or directory), client: 143.168.122.1, server: mydomain-dev.example.net, request: "GET /favicon.ico HTTP/1.1", host: "mydomain-dev"
webserver_1              | 143.168.122.1 - - [29/Nov/2018:16:15:58 +0000] "GET /favicon.ico HTTP/1.1" 404 162 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:63.0) Gecko/20100101 Firefox/63.0"
webserver_1              | 2018/11/29 16:15:59 [error] 8#8: *7 open() "/etc/nginx/html/favicon.ico" failed (2: No such file or directory), client: 143.168.122.1, server: mydomain-dev.example.net, request: "GET /favicon.ico HTTP/1.1", host: "mydomain-dev"
webserver_1              | 143.168.122.1 - - [29/Nov/2018:16:15:59 +0000] "GET /favicon.ico HTTP/1.1" 404 162 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:63.0) Gecko/20100101 Firefox/63.0"
webserver_1              | 2018/11/29 16:15:59 [error] 8#8: *7 open() "/etc/nginx/html/favicon.ico" failed (2: No such file or directory), client: 143.168.122.1, server: mydomain-dev.example.net, request: "GET /favicon.ico HTTP/1.1", host: "mydomain-dev"
webserver_1              | 143.168.122.1 - - [29/Nov/2018:16:15:59 +0000] "GET /favicon.ico HTTP/1.1" 404 162 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:63.0) Gecko/20100101 Firefox/63.0"
webserver_1              | 143.168.122.1 - - [29/Nov/2018:16:15:59 +0000] "GET /favicon.ico HTTP/1.1" 404 162 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:63.0) Gecko/20100101 Firefox/63.0"
webserver_1              | 2018/11/29 16:15:59 [error] 8#8: *7 open() "/etc/nginx/html/favicon.ico" failed (2: No such file or directory), client: 143.168.122.1, server: mydomain-dev.example.net, request: "GET /favicon.ico HTTP/1.1", host: "mydomain-dev"
webserver_1              | 2018/11/29 16:16:00 [error] 8#8: *7 open() "/etc/nginx/html/favicon.ico" failed (2: No such file or directory), client: 143.168.122.1, server: mydomain-dev.example.net, request: "GET /favicon.ico HTTP/1.1", host: "mydomain-dev"
webserver_1              | 143.168.122.1 - - [29/Nov/2018:16:16:00 +0000] "GET /favicon.ico HTTP/1.1" 404 162 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:63.0) Gecko/20100101 Firefox/63.0"
webserver_1              | 2018/11/29 16:16:01 [error] 8#8: *7 open() "/etc/nginx/html/favicon.ico" failed (2: No such file or directory), client: 143.168.122.1, server: mydomain-dev.example.net, request: "GET /favicon.ico HTTP/1.1", host: "mydomain-dev"
webserver_1              | 143.168.122.1 - - [29/Nov/2018:16:16:01 +0000] "GET /favicon.ico HTTP/1.1" 404 162 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:63.0) Gecko/20100101 Firefox/63.0"
webserver_1              | 2018/11/29 16:16:01 [error] 8#8: *7 open() "/etc/nginx/html/favicon.ico" failed (2: No such file or directory), client: 143.168.122.1, server: mydomain-dev.example.net, request: "GET /favicon.ico HTTP/1.1", host: "mydomain-dev"
webserver_1              | 143.168.122.1 - - [29/Nov/2018:16:16:01 +0000] "GET /favicon.ico HTTP/1.1" 404 162 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:63.0) Gecko/20100101 Firefox/63.0"
webserver_1              | 2018/11/29 16:16:02 [error] 8#8: *7 open() "/etc/nginx/html/favicon.ico" failed (2: No such file or directory), client: 143.168.122.1, server: mydomain-dev.example.net, request: "GET /favicon.ico HTTP/1.1", host: "mydomain-dev"
webserver_1              | 143.168.122.1 - - [29/Nov/2018:16:16:02 +0000] "GET /favicon.ico HTTP/1.1" 404 162 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:63.0) Gecko/20100101 Firefox/63.0"
webserver_1              | 2018/11/29 16:16:02 [error] 8#8: *7 open() "/etc/nginx/html/favicon.ico" failed (2: No such file or directory), client: 143.168.122.1, server: mydomain-dev.example.net, request: "GET /favicon.ico HTTP/1.1", host: "mydomain-dev"
webserver_1              | 143.168.122.1 - - [29/Nov/2018:16:16:02 +0000] "GET /favicon.ico HTTP/1.1" 404 162 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:63.0) Gecko/20100101 Firefox/63.0"

which to me looks like it is looking for resources under nginx . What am I missing? Can somebody help with with this?

Jan Garaj · Answer 1 · 2018-12-03T13:17:28.557

0

You proxying only /auth/, but keycloak page is trying to load /favicon.ico (not /auth/favicon.ico). Try to proxy / not /auth/ in your nginx.conf:

location / {
...
}

Update: so you want to update the context path of Keycloak (everything will be served from that context path, even favicon), that is IMHO not supported, see https://issues.jboss.org/browse/KEYCLOAK-2310

edited Dec 03 '18 at 13:17

answered Nov 29 '18 at 19:19

Jan Garaj

25,598
3
38
59

Thanks for the reply @Jan Garaj. In that case would I be able to tell the keycloak to load /auth/favicon.ico instead of /favicon.ico. I would essentially like to have other services running on different paths and keycloak on /auth/ path. – NehaM Dec 03 '18 at 09:31
Added: info about context path. – Jan Garaj Dec 03 '18 at 13:17

Keycloak behind nginx in docker results in 404 and infinitive redirects

1 Answers1