java - 如何在两个反向代理后面配置keycloak？

Question

我有一个关于 Apache 用作反向代理和 Keycloak 的问题。 除了我的反向代理之外，还有另一个由客户应用的反向代理。

我想登录 Keycloak 的管理控制台。 尝试在本地执行此操作按预期工作:http://localhost/application1/auth/admin/ 显示登录表单，我可以成功登录。

但是尝试从外部 URL 登录不起作用: https://externalurl.com/application1/auth/admin/

显示登录表单，我提交表单，然后再次显示(空)表单。 Cookie AUTH_SESSION_ID、KC_RESTART、KEYCLOAK_IDENTITY 和 KEYCLOAK_SESSION 已正确设置。

Apache 的 access.log 中的 View 显示以下内容: (本地和工作电话)

10.1.7.192 - - [29/May/2019:11:16:27 +0200] "GET /auth/admin/master/console HTTP/1.1" 302 -
10.1.7.192 - - [29/May/2019:11:16:28 +0200] "GET /auth/admin/master/console/ HTTP/1.1" 200 8198
10.1.7.192 - - [29/May/2019:11:16:29 +0200] "GET /auth/admin/master/console/config HTTP/1.1" 200 195
10.1.7.192 - - [29/May/2019:11:16:29 +0200] "GET /auth/realms/master/protocol/openid-connect/auth?client_id=security-admin-console&redirect_uri=https%3A%2F%2Fexternalurl.com%2Fapplication1%2Fauth%2Fadmin%2Fmaster%2Fconsole%2F&state=cef5a6cb-4327-45e7-8e97-0b3e74a27ea6&response_mode=fragment&response_type=code&scope=openid&nonce=35edfb09-a16a-41dc-83d6-453393e61391 HTTP/1.1" 200 3120
10.1.7.192 - - [29/May/2019:11:16:33 +0200] "POST /auth/realms/master/login-actions/authenticate?session_code=5iqyNYW56tGETAGGHLEp54m5JbEXU4us-kDe1S1k10Q&execution=ee5e5166-6dcf-47d1-a130-521aaedfd08d&client_id=security-admin-console&tab_id=VF8WaW2--uM HTTP/1.1" 302 -
10.1.7.192 - - [29/May/2019:11:16:33 +0200] "GET /auth/admin/master/console/ HTTP/1.1" 200 8198
10.1.7.192 - - [29/May/2019:11:16:33 +0200] "GET /auth/admin/master/console/config HTTP/1.1" 200 195
--- differences start here
10.1.7.192 - - [29/May/2019:11:16:33 +0200] "GET /auth/admin/master/console/ HTTP/1.1" 200 8198
10.1.7.192 - - [29/May/2019:11:16:33 +0200] "GET /auth/admin/master/console/config HTTP/1.1" 200 195
10.1.7.192 - - [29/May/2019:11:16:33 +0200] "GET /auth/realms/master/protocol/openid-connect/auth?client_id=security-admin-console&redirect_uri=https%3A%2F%2Fexternalurl.com%2Fapplication1%2Fauth%2Fadmin%2Fmaster%2Fconsole%2F&state=8931d4e0-d9b6-41fc-92ef-1e937d5c7704&response_mode=fragment&response_type=code&scope=openid&nonce=fedd80bb-a5e0-4ea1-ad6e-77a8ab0b9938 HTTP/1.1" 200 3120

但是尝试从外部客户端我收到此消息:

::1 - - [29/May/2019:11:14:54 +0200] "GET /application1/auth/admin/master/console HTTP/1.1" 302 -
::1 - - [29/May/2019:11:14:55 +0200] "GET /application1/auth/admin/master/console/ HTTP/1.1" 200 8198
::1 - - [29/May/2019:11:14:55 +0200] "GET /application1/auth/admin/master/console/config HTTP/1.1" 200 183
::1 - - [29/May/2019:11:14:55 +0200] "GET /application1/auth/realms/master/protocol/openid-connect/auth?client_id=security-admin-console&redirect_uri=http%3A%2F%2Flocalhost%2Fapplication1%2Fauth%2Fadmin%2Fmaster%2Fconsole%2F&state=6815eac5-5809-4965-a802-b6ba9479a8d8&response_mode=fragment&response_type=code&scope=openid&nonce=852c3a37-90ed-4bdc-a9dd-50c4ec1291aa HTTP/1.1" 200 3108
::1 - - [29/May/2019:11:15:02 +0200] "POST /application1/auth/realms/master/login-actions/authenticate?session_code=Ehw_zcZmjJruVvIJiajTLqBbN49M7wbsRSoCi24y8MQ&execution=ee5e5166-6dcf-47d1-a130-521aaedfd08d&client_id=security-admin-console&tab_id=qV6HNXsVgtU HTTP/1.1" 302 -
::1 - - [29/May/2019:11:15:02 +0200] "GET /application1/auth/admin/master/console/ HTTP/1.1" 200 8198
::1 - - [29/May/2019:11:15:02 +0200] "GET /application1/auth/admin/master/console/config HTTP/1.1" 200 183
--- differences start here
::1 - - [29/May/2019:11:15:03 +0200] "POST /application1/auth/realms/master/protocol/openid-connect/token HTTP/1.1" 200 3102
::1 - - [29/May/2019:11:15:03 +0200] "GET /application1/auth/admin/master/console/messages.json?lang=en HTTP/1.1" 200 116906
::1 - - [29/May/2019:11:15:03 +0200] "GET /application1/auth/admin/master/console/whoami HTTP/1.1" 200 443
::1 - - [29/May/2019:11:15:03 +0200] "GET /application1/auth/realms/master/protocol/openid-connect/login-status-iframe.html/init?client_id=security-admin-console&origin=http%3A%2F%2Flocalhost HTTP/1.1" 204 -
::1 - - [29/May/2019:11:15:03 +0200] "GET /application1/auth/admin/serverinfo HTTP/1.1" 200 142210
::1 - - [29/May/2019:11:15:03 +0200] "GET /application1/auth/admin/realms HTTP/1.1" 200 3113
::1 - - [29/May/2019:11:15:04 +0200] "GET /application1/auth/admin/realms/master HTTP/1.1" 200 3111
::1 - - [29/May/2019:11:15:04 +0200] "GET /application1/auth/admin/realms HTTP/1.1" 200 3113
::1 - - [29/May/2019:11:15:04 +0200] "GET /application1/auth/admin/realms HTTP/1.1" 200 3113
::1 - - [29/May/2019:11:15:04 +0200] "GET /application1/auth/admin/realms HTTP/1.1" 200 3113

当然Keycloak的standalone.xml设置为:

<web-context>application1/auth</web-context>

和

<http-listener name="default" socket-binding="http" redirect-socket="https" enable-http2="true" proxy-address-forwarding="true"/>

最后是我的 apache 配置的相关部分:

DumpIOInput On
DumpIOOutput On
LogLevel debug
ForensicLog logs/forensic.txt

ProxyPreserveHost Off
RemoteIPHeader X-Forwarded-For

LogLevel debug

<LocationMatch "^/(application1/auth)/*">
    ProxyPass http://localhost:8180
    ProxyPassReverse http://localhost:8180
</LocationMatch>

<LocationMatch "^/(auth)/*">
    ProxyPass http://localhost:8180/application1
    ProxyPassReverse http://localhost:8180/application1
</LocationMatch>

###This reads the value of X-ORIG-HOST into TempValue
SetEnvIf X-ORIG-HOST ".+" TempValue=$0
###This will overwrite the value of "Host" if it was already set
RequestHeader set Host %{TempValue}e env=TempValue

ProxyPassReverseCookiePath "/application1/" "/"

有人可以帮助我或提示我下一步该去哪里吗？ 谢谢!

Answer 1

在 nginx 代理传递到 keycloak 之上的一个 ssl 反向代理 (haproxy) 也存在类似问题。有一个白页而不是管理控制台。显然，这是由于刷新权限 js 函数在 keycloak 上请求 whoami api 并得到 401。尝试了所有带有 x 转发 header 的内容，但没有成功。