# Accessing admin UI behind reverse proxy

**URL:** <https://forum.keycloak.org/t/accessing-admin-ui-behind-reverse-proxy/14663>\
**Category:** Configuring the server\
**Created:** [March 30, 2022, 2:31pm UTC](https://forum.keycloak.org/t/accessing-admin-ui-behind-reverse-proxy/14663 "2022-03-30T14:31:49Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ohemelaar](https://avatars.discourse-cdn.com/v4/letter/o/f4b2a3/32.png) [@ohemelaar](https://forum.keycloak.org/u/ohemelaar)\
**Post date:** [March 30, 2022, 2:31pm UTC](https://forum.keycloak.org/t/accessing-admin-ui-behind-reverse-proxy/14663/1 "2022-03-30T14:31:49Z")

</div>

Hello,

I am deploying Keycloak 17.0.1 Quarkus with Kubernetes. I see [in the docs about setting up the reverse proxy](https://www.keycloak.org/server/reverseproxy) that it’s preferable to not expose the admin endpoint.

I managed to do this but then I can’t find a way to access the admin UI by port-forwarding the service directly. I can access the welcome page at `localhost:8080` while it’s blocked at `keycloak.minikube.local`, but when I click to open the admin console I get redirected to `keycloak.minikube.local/realms/master/protocol/openid-connect/auth?...` which shows “Invalid parameter: redirect\_uri”. I tried tweaking the `KC_HOSTNAME_STRICT` env var to circumvent this without success.

The `redirect_uri` in the query parameters is `localhost:8080/admin/master/console`. Is there a missing setting for my setup? The `KC_PROXY` var is set to `edge`. Or am I looking at the wrong solution to access the admin console when it’s not exposed by the reverse proxy?

Thank you very much.

---

<div class="post-metadata">

**Author:** ![joerijansen](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/joerijansen/32/5094_2.png) [@joerijansen](https://forum.keycloak.org/u/joerijansen)\
**Post date:** [March 30, 2022, 5:27pm UTC](https://forum.keycloak.org/t/accessing-admin-ui-behind-reverse-proxy/14663/2 "2022-03-30T17:27:37Z")

</div>

Perhaps a slightly different approach could be to restrict access to the admin console via the reverse proxy: this way, all trafic goes via de reverse proxy (easy configuration), but the admin console is protected (use IP whitelisting or additional basic authentication in your reverse proxy config).  
Example for Apache httpd to restrict admin access to local network only:

```auto
<Location "/admin">
        Require all denied
        Require ip 10.10
</Location>

```

---

<div class="post-metadata">

**Author:** ![rsoph](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/rsoph/32/5496_2.png) [@rsoph](https://forum.keycloak.org/u/rsoph)\
**Post date:** [April 2, 2022, 11:10pm UTC](https://forum.keycloak.org/t/accessing-admin-ui-behind-reverse-proxy/14663/3 "2022-04-02T23:10:08Z")

</div>

I am having the same issue and the problem appears to be with a single script included in the admin console page.

All of the scripts seem to be using relative paths except one… The use of the container bound IP address seems to be the problem for me…

```auto

<script src="https://0.0.0.0/js/keycloak.js?version=hjy36" type="text/javascript"></script>

```

I have tried KC\_HOSTNAME\_STRICT, KC\_HOSTNAME\_ADMIN and several other things with no relief. There does not appear to be a way to access the admin console running behind a load balancer (reverse proxy).