# Invalid redirect uri for "Valid Redirect URIs with https://\*" **URL:** \ **Category:** Configuring the server\ **Tags:** saml\ **Created:** [June 23, 2020, 2:13pm UTC](https://forum.keycloak.org/t/invalid-redirect-uri-for-valid-redirect-uris-with-https/3454 "2020-06-23T14:13:53Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![jobycxa](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/jobycxa/32/1046_2.png) [@jobycxa](https://forum.keycloak.org/u/jobycxa)\ **Post date:** [June 23, 2020, 2:13pm UTC](https://forum.keycloak.org/t/invalid-redirect-uri-for-valid-redirect-uris-with-https/3454/1 "2020-06-23T14:13:53Z")
Hi I have set up the keycloak docker containers behind the aws loadbalancer with ACM SSL certificates. I have created a SAML Client for Zabbix SSO integration. I am getting “Invalid redirect uri” on the keycloak sso page while adding “https://_" on the “Valid Redirect URIs” field. "http://_” is working fine. Using aws RDS Mariadb as database. I have enabled “Require SSL” for “all request” on the Realm setting. I have followed [https://www.keycloak.org/2019/05/keycloak-cluster-setup.html](https://www.keycloak.org/2019/05/keycloak-cluster-setup.html) with JDBC\_PING and [https://hub.docker.com/r/jboss/keycloak/](https://hub.docker.com/r/jboss/keycloak/) ---
**Author:** ![jangaraj](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/jangaraj/32/5175_2.png) [@jangaraj](https://forum.keycloak.org/u/jangaraj)\ **Post date:** [June 23, 2020, 3:53pm UTC](https://forum.keycloak.org/t/invalid-redirect-uri-for-valid-redirect-uris-with-https/3454/2 "2020-06-23T15:53:55Z")
> [@jobycxa](#): > > I am getting “Invalid redirect uri” on the keycloak sso page What is the full URL of that ‘keycloak sso page’. There is requested redirect url parameter and that one can be really http, so it may work as expected. ---
**Author:** ![jobycxa](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/jobycxa/32/1046_2.png) [@jobycxa](https://forum.keycloak.org/u/jobycxa)\ **Post date:** [June 23, 2020, 3:58pm UTC](https://forum.keycloak.org/t/invalid-redirect-uri-for-valid-redirect-uris-with-https/3454/3 "2020-06-23T15:58:23Z")
> [@jangaraj](#): > > cloak sso pag I am following [https://www.zabbix.com/documentation/current/manual/web\_interface/frontend\_sections/administration/authentication#saml\_authentication](https://www.zabbix.com/documentation/current/manual/web_interface/frontend_sections/administration/authentication#saml_authentication) “keycloak sso page” is [https://id.mysite.net/auth/realms/master/protocol/saml?SAMLRequest=fVNNr9owELzzK1DuxAGUpFhARaEfSBQQ0B56eXLspVhK7DzvpvD66%2Bsk0EerJ3yxtJ4Zz47XYxRFXvJZRSezg%2BcKkDpdvy5FbpA3h5OgcoZbgRq5EQUgJ8n3s68rPggjXjpLVto8%2BI%2F2mCUQwZG2pqUtF5Ngs%2F642nxerp%2FepUKlqYqzZKRUMkxGo6GI4qjfj45HFcs0U5BGkZAt9Ts49DqTwMsGnVYNsYKlQRKGfD0aRL0o6Q2Gh37M44THox8tdeGb1UZQQz8RlcgZ0yokewYX4nOlnbOhAWLCx8MciLxAVggkcOzWN6ubbfW219IHbZQ2Px8nkLUg5F8Oh21vu9kfWpHZLZm5NVgV4PbgfmkJ33ar1qT3WFijyTpPf8Prb5Fl%2BsK8PFyeEG1Ynsr3QmIwbfTHtV%2FeROSmLXbM7muvqJKvve3lYmtzLV%2Baer0%2BWVcIetxdXdGqd2ygnJwwqMFQ8Fdkluf2PPeREkwCchUEXfbP1ddhBNWMpg%2BD4ELduS1K4TTWLwYXIena1Wtn9%2FB57udsB8fpw1GUXNY4X9767Wydqh8SpL%2F7UBsvraNrRG%2BKt67ZA9vTzu34%2Fp9N%2FwA%3D&RelayState=http%3A%2F%2Fmonitoring.mysite.net%2Fzabbix%2Findex\_sso.php&SigAlg=http%3A%2F%2Fwww.w3.org%2F2001%2F04%2Fxmldsig-more%23rsa-sha256&Signature=fVMk9cjaGyFbcVE1kRX4CE5QxObXxJOJQjscENFHuW%2B6YvC4fxBNw6HoRT3HPbNlYiLo4DxKMcwpFdMehZ%2FPEUXQkv%2BLdOm2q0csJRtH%2FgRL1yge3MCSN%2BEJ35jQ2vEr6iMppqdPXUPX0OQYfWz%2B19EknQ4exi3qsQAxsO0mzO3wVRhvAm9JSp3M2evmIobd5G1y1YU6AlNL%2FVDQieJwwwHX4WglJjh%2BngfQbQY0yleYOqGfJ729khxa1t032C5%2FtHe3Z%2B03E64J6jABqdvvfTTVH7S4Qx5S8Q7v47T3gJQv%2BxaVdaxZWCrGOJjpfiImgfEB0Q9TnDqXcs2SzeJBQA%3D%3D](https://id.mysite.net/auth/realms/master/protocol/saml?SAMLRequest=fVNNr9owELzzK1DuxAGUpFhARaEfSBQQ0B56eXLspVhK7DzvpvD66%2Bsk0EerJ3yxtJ4Zz47XYxRFXvJZRSezg%2BcKkDpdvy5FbpA3h5OgcoZbgRq5EQUgJ8n3s68rPggjXjpLVto8%2BI%2F2mCUQwZG2pqUtF5Ngs%2F642nxerp%2FepUKlqYqzZKRUMkxGo6GI4qjfj45HFcs0U5BGkZAt9Ts49DqTwMsGnVYNsYKlQRKGfD0aRL0o6Q2Gh37M44THox8tdeGb1UZQQz8RlcgZ0yokewYX4nOlnbOhAWLCx8MciLxAVggkcOzWN6ubbfW219IHbZQ2Px8nkLUg5F8Oh21vu9kfWpHZLZm5NVgV4PbgfmkJ33ar1qT3WFijyTpPf8Prb5Fl%2BsK8PFyeEG1Ynsr3QmIwbfTHtV%2FeROSmLXbM7muvqJKvve3lYmtzLV%2Baer0%2BWVcIetxdXdGqd2ygnJwwqMFQ8Fdkluf2PPeREkwCchUEXfbP1ddhBNWMpg%2BD4ELduS1K4TTWLwYXIena1Wtn9%2FB57udsB8fpw1GUXNY4X9767Wydqh8SpL%2F7UBsvraNrRG%2BKt67ZA9vTzu34%2Fp9N%2FwA%3D&RelayState=http%3A%2F%2Fmonitoring.mysite.net%2Fzabbix%2Findex_sso.php&SigAlg=http%3A%2F%2Fwww.w3.org%2F2001%2F04%2Fxmldsig-more%23rsa-sha256&Signature=fVMk9cjaGyFbcVE1kRX4CE5QxObXxJOJQjscENFHuW%2B6YvC4fxBNw6HoRT3HPbNlYiLo4DxKMcwpFdMehZ%2FPEUXQkv%2BLdOm2q0csJRtH%2FgRL1yge3MCSN%2BEJ35jQ2vEr6iMppqdPXUPX0OQYfWz%2B19EknQ4exi3qsQAxsO0mzO3wVRhvAm9JSp3M2evmIobd5G1y1YU6AlNL%2FVDQieJwwwHX4WglJjh%2BngfQbQY0yleYOqGfJ729khxa1t032C5%2FtHe3Z%2B03E64J6jABqdvvfTTVH7S4Qx5S8Q7v47T3gJQv%2BxaVdaxZWCrGOJjpfiImgfEB0Q9TnDqXcs2SzeJBQA%3D%3D) ---
**Author:** ![jangaraj](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/jangaraj/32/5175_2.png) [@jangaraj](https://forum.keycloak.org/u/jangaraj)\ **Post date:** [June 23, 2020, 4:37pm UTC](https://forum.keycloak.org/t/invalid-redirect-uri-for-valid-redirect-uris-with-https/3454/4 "2020-06-23T16:37:28Z")
I can’t decode SAML request (probably encrypted), but see RelayState: ![image](https://global.discourse-cdn.com/free1/uploads/keycloak/original/2X/2/2d2b1e0a7f4af3b8963d870d4e4a7bfb186d652c.png) So I guess also SAML request requests redirect to http and not https - it is working as expected - not a Keycloak issue. Blind guess: you are using reverse proxy with ssl offloading and you didn’t forwarded info that https must be used to the backend. Problem seems to be in your infrastructure setup and not in the Keycloak. Maybe Zabbix frontend doesn’t support your setup (ssl offloading with SAML). ---
**Author:** ![jobycxa](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/jobycxa/32/1046_2.png) [@jobycxa](https://forum.keycloak.org/u/jobycxa)\ **Post date:** [June 23, 2020, 4:50pm UTC](https://forum.keycloak.org/t/invalid-redirect-uri-for-valid-redirect-uris-with-https/3454/5 "2020-06-23T16:50:57Z")
Thanks for the quick replay, let me check ssl offloading option ---
**Author:** ![jobycxa](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/jobycxa/32/1046_2.png) [@jobycxa](https://forum.keycloak.org/u/jobycxa)\ **Post date:** [June 24, 2020, 10:21am UTC](https://forum.keycloak.org/t/invalid-redirect-uri-for-valid-redirect-uris-with-https/3454/6 "2020-06-24T10:21:25Z")
I have allowed http traffic on loadbalancer and now it works on http but on the ‘zabbix’ side “Username attribute” value causing issues, I am getting following error on zabbix due to this value “The parameter “username” is missing from the user attributes.” We may need “saml\_username\_attribute” value here. I tried all the values given on the doc [https://www.zabbix.com/documentation/current/manual/web\_interface/frontend\_sections/administration/authentication#saml\_authentication](https://www.zabbix.com/documentation/current/manual/web_interface/frontend_sections/administration/authentication#saml_authentication) From keycloak database:- MariaDB [keycloak]\> select \* from USER\_ATTRIBUTE \G; \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* 1. row \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* NAME: saml\_username\_attribute VALUE: username USER\_ID: 5e913cc5-ab5c-4d73-97ab-6b85d03330ec ID: 08152161-e0a9-4edf-9468-1f024c500eea 1 row in set (0.001 sec) Thanks in advance ---
**Author:** ![fureszpeter](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/fureszpeter/32/1105_2.png) [@fureszpeter](https://forum.keycloak.org/u/fureszpeter)\ **Post date:** [July 10, 2020, 9:40am UTC](https://forum.keycloak.org/t/invalid-redirect-uri-for-valid-redirect-uris-with-https/3454/7 "2020-07-10T09:40:14Z")
You should go to the client configuration and need to add an url pattern where you will be redirected after the authentication. You can check the url in the browser and there is a redirect\_url= , so that should be added to your client configuration ![keycloak_redirect](https://global.discourse-cdn.com/free1/uploads/keycloak/original/2X/1/1d8883481544af95f73d04e80ccba014d2d64ad7.png) ---
**Author:** ![viniciusalvess](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/viniciusalvess/32/3754_2.png) [@viniciusalvess](https://forum.keycloak.org/u/viniciusalvess)\ **Post date:** [August 25, 2021, 4:58pm UTC](https://forum.keycloak.org/t/invalid-redirect-uri-for-valid-redirect-uris-with-https/3454/8 "2021-08-25T16:58:22Z")
I’ve been trying keycloak recently and my Valid Redirect URIs is https://… but when I try the test app, Keycloak is changing the redirect\_uri to http instead. If I change the redirect\_uri query string manually to https it works, but by default it is giving me a the error: Invalid parameter: redirect\_uri. How do I set it to redirect to https? ---
**Author:** ![jol002](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/jol002/32/2418_2.png) [@jol002](https://forum.keycloak.org/u/jol002)\ **Post date:** [February 17, 2022, 12:44pm UTC](https://forum.keycloak.org/t/invalid-redirect-uri-for-valid-redirect-uris-with-https/3454/9 "2022-02-17T12:44:50Z")
I used to have the same problem. I do not know exactly what, but the cause was in the settings of the nginx. ---
**Author:** ![ekennedy80](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/ekennedy80/32/5454_2.png) [@ekennedy80](https://forum.keycloak.org/u/ekennedy80)\ **Post date:** [March 28, 2022, 7:26pm UTC](https://forum.keycloak.org/t/invalid-redirect-uri-for-valid-redirect-uris-with-https/3454/10 "2022-03-28T19:26:51Z")
Has there been a solution found for this? We are experiencing the same exact problem. ---
**Author:** ![bpedersen2](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/bpedersen2/32/3934_2.png) [@bpedersen2](https://forum.keycloak.org/u/bpedersen2)\ **Post date:** [March 29, 2022, 8:46am UTC](https://forum.keycloak.org/t/invalid-redirect-uri-for-valid-redirect-uris-with-https/3454/11 "2022-03-29T08:46:56Z")
You need to do 2 things: 1. configure your client app to pass the correct redirect url to keycloak (how that is done depends on the app) 2. configure keycloak to accept this redirect url (never use too wide wildcard redirect uris here) This is an important security measure to avoid redirecting to a wrong site that could intercept the tokens… ---
**Author:** ![ekennedy80](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/ekennedy80/32/5454_2.png) [@ekennedy80](https://forum.keycloak.org/u/ekennedy80)\ **Post date:** [March 29, 2022, 12:01pm UTC](https://forum.keycloak.org/t/invalid-redirect-uri-for-valid-redirect-uris-with-https/3454/12 "2022-03-29T12:01:04Z")
The only way I was able to get it to work was to use the “too wide wildcard redirect”. What could I be doing wrong? ---
**Author:** ![bpedersen2](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/bpedersen2/32/3934_2.png) [@bpedersen2](https://forum.keycloak.org/u/bpedersen2)\ **Post date:** [March 29, 2022, 12:35pm UTC](https://forum.keycloak.org/t/invalid-redirect-uri-for-valid-redirect-uris-with-https/3454/13 "2022-03-29T12:35:42Z")
enter the redirect url that your app is reporting…