# \[KC 17.x.x\] How to access admin UI from port-forwarded/internal URL / prevent redirect from internal url to KC\_HOSTNAME **URL:** \ **Category:** Configuring the server\ **Tags:** admin-console\ **Created:** [April 12, 2022, 7:14am UTC](https://forum.keycloak.org/t/kc-17-x-x-how-to-access-admin-ui-from-port-forwarded-internal-url-prevent-redirect-from-internal-url-to-kc-hostname/14917 "2022-04-12T07:14:34Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![armujahid](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/armujahid/32/4802_2.png) [@armujahid](https://forum.keycloak.org/u/armujahid)\ **Post date:** [April 12, 2022, 7:14am UTC](https://forum.keycloak.org/t/kc-17-x-x-how-to-access-admin-ui-from-port-forwarded-internal-url-prevent-redirect-from-internal-url-to-kc-hostname/14917/1 "2022-04-12T07:14:34Z")
**Steps to reproduce this issue:** > [@\[KC 17.x.x\] How to access admin UI from port-forwarded/internal URL / prevent redirect from internal url to KC\_HOSTNAME](http://forum.keycloak.org/t/kc-17-x-x-how-to-access-admin-ui-from-port-forwarded-internal-url-prevent-redirect-from-internal-url-to-kc-hostname/14917/7): > > My issue can be reproduced by running this docker-compose file version: "3" services: keycloak: image: quay.io/keycloak/keycloak:17.0.1 environment: KEYCLOAK\_ADMIN: admin KEYCLOAK\_ADMIN\_PASSWORD: admin KC\_PROXY: edge KC\_HOSTNAME: localhost:8080 KC\_SPI\_HOSTNAME\_DEFAULT\_ADMIN: localhost:8081 entrypoint: ["/opt/keycloak/bin/kc.sh", "start-dev"] ports: - 8080:8080 - 8081:8080 startup logs: keycloak\_1 | 2022-04-13 05:30:34,890 INF… **Objective:** keycloak is deployed in kubernetes with proxy=edge with a hostname/KC\_HOSTNAME=public.url. I want to restrict admin UI access by allowing it only from internal url by doing port-forwarding 1. kubectl port-forward svc/keycloak 9010:80 2. now [http://localhost:9010/admin](http://localhost:9010/admin) should work but [https://public.url/admin](https://public.url/admin) shouldn’t work (assuming that I blocked it using reverse proxy) I have tried setting adminUrl using KC\_HOSTNAME\_ADMIN but it doesn’t work. **Problem:** Currently port-forwarded local url [http://localhost:9010](http://localhost:9010) is working but it is redirecting me to KC\_HOSTNAME ☹ ![image](https://global.discourse-cdn.com/free1/uploads/keycloak/original/2X/0/0448dd7fea98390842a27e93bca330ba1085a9f5.png) As far as I know same setup was working fine with keycloak \<17 **Environment variables:** KC\_HOSTNAME=public.url KC\_PROXY=edge **Startup log:** ```auto INFO [org.keycloak.quarkus.runtime.hostname.DefaultHostnameProvider] (main) Hostname settings: FrontEnd: public.url, Strict HTTPS: true, Path: , Strict BackChannel: false, Admin: , Port: -1, Proxied: true ``` **Related information:** mentioned at [https://www.keycloak.org/docs/latest/server\_installation/](https://www.keycloak.org/docs/latest/server_installation/) “If you do not want to expose the admin endpoints and console on the public domain use the property adminUrl to set a fixed URL for the admin console, which is different to the frontendUrl. It is also required to block access to /auth/admin externally” Also posted at [[KC 17.x.x] How to access admin UI from port-forwarded/internal URL / prevent redirect from internal url to KC\_HOSTNAME · keycloak/keycloak · Discussion #11237 · GitHub](https://github.com/keycloak/keycloak/discussions/11237) ---
**Author:** ![jangaraj](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/jangaraj/32/5175_2.png) [@jangaraj](https://forum.keycloak.org/u/jangaraj)\ **Post date:** [April 12, 2022, 10:41am UTC](https://forum.keycloak.org/t/kc-17-x-x-how-to-access-admin-ui-from-port-forwarded-internal-url-prevent-redirect-from-internal-url-to-kc-hostname/14917/2 "2022-04-12T10:41:37Z")
Did you try to remove env variable `KC_HOSTNAME`? ---
**Author:** ![armujahid](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/armujahid/32/4802_2.png) [@armujahid](https://forum.keycloak.org/u/armujahid)\ **Post date:** [April 12, 2022, 11:01am UTC](https://forum.keycloak.org/t/kc-17-x-x-how-to-access-admin-ui-from-port-forwarded-internal-url-prevent-redirect-from-internal-url-to-kc-hostname/14917/3 "2022-04-12T11:01:45Z")
> [@jangaraj](#): > > `KC_HOSTNAME` without KC\_HOSTNAME I get this blank page without any console error with 404 error for this call [https://localhost:9010/realms/master/protocol/openid-connect/3p-cookies/step1.html?version=opwzf](https://localhost:9010/realms/master/protocol/openid-connect/3p-cookies/step1.html?version=opwzf) ![image](https://global.discourse-cdn.com/free1/uploads/keycloak/original/2X/6/65aa13b7f77d57f4d9572574151fb6272222fe96.png) ![image](https://global.discourse-cdn.com/free1/uploads/keycloak/original/2X/2/25bbd3d6275f45029bb9fd6379d050de9a47b4a4.png) ---
**Author:** ![wadahiro](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/wadahiro/32/5579_2.png) [@wadahiro](https://forum.keycloak.org/u/wadahiro)\ **Post date:** [April 13, 2022, 2:40am UTC](https://forum.keycloak.org/t/kc-17-x-x-how-to-access-admin-ui-from-port-forwarded-internal-url-prevent-redirect-from-internal-url-to-kc-hostname/14917/4 "2022-04-13T02:40:51Z")
In addition to `KC_HOSTNAME`, please set `KC_SPI_HOSTNAME_DEFAULT_ADMIN` for adminUrl. `KC_HOSTNAME` is an alias for `KC_SPI_HOSTNAME_DEFAULT_HOSTNAME`. But there is no alias for `KC_SPI_HOSTNAME_DEFAULT_ADMIN` currently. ---
**Author:** ![armujahid](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/armujahid/32/4802_2.png) [@armujahid](https://forum.keycloak.org/u/armujahid)\ **Post date:** [April 13, 2022, 4:55am UTC](https://forum.keycloak.org/t/kc-17-x-x-how-to-access-admin-ui-from-port-forwarded-internal-url-prevent-redirect-from-internal-url-to-kc-hostname/14917/6 "2022-04-13T04:55:05Z")
> [@wadahiro](#): > > `KC_SPI_HOSTNAME_DEFAULT_HOSTNAME` after setting `KC_SPI_HOSTNAME_DEFAULT_ADMIN` to localhost. keycloak is starting with these settings (you can see that Admin is now localhost) ```auto [org.keycloak.quarkus.runtime.hostname.DefaultHostnameProvider] (main) Hostname settings: FrontEnd: public.url, Strict HTTPS: true, Path: , Strict BackChannel: false, Admin: localhost, Port: -1, Proxied: true ``` But I am still getting same redirection issue after clicking on Admin console link [http://localhost:9010/admin/](http://localhost:9010/admin/). It redirects me to [https://public.url/realms/master/protocol/](https://public.url/realms/master/protocol/) (screenshot attached in my question). it could be port issue. I have also tried with `KC_SPI_HOSTNAME_DEFAULT_ADMIN` = localhost:9010 (Although I know that port is not part of hostname) but I still get same issue ---
**Author:** ![armujahid](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/armujahid/32/4802_2.png) [@armujahid](https://forum.keycloak.org/u/armujahid)\ **Post date:** [April 13, 2022, 5:35am UTC](https://forum.keycloak.org/t/kc-17-x-x-how-to-access-admin-ui-from-port-forwarded-internal-url-prevent-redirect-from-internal-url-to-kc-hostname/14917/7 "2022-04-13T05:35:13Z")
My issue can be reproduced by running this docker-compose file ```auto version: "3" services: keycloak: image: quay.io/keycloak/keycloak:17.0.1 environment: KEYCLOAK_ADMIN: admin KEYCLOAK_ADMIN_PASSWORD: admin KC_PROXY: edge KC_HOSTNAME: localhost:8080 KC_SPI_HOSTNAME_DEFAULT_ADMIN: localhost:8081 entrypoint: ["/opt/keycloak/bin/kc.sh", "start-dev"] ports: - 8080:8080 - 8081:8080 ``` startup logs: ```auto keycloak_1 | 2022-04-13 05:30:34,890 INFO [org.keycloak.quarkus.runtime.hostname.DefaultHostnameProvider] (main) Hostname settings: FrontEnd: localhost:8080, Strict HTTPS: false, Path: , Strict BackChannel: false, Admin: localhost:8081, Port: -1, Proxied: true ``` Open [http://localhost:8081](http://localhost:8081) and click on administration console. You will be redirected to [http://localhost:8080/realms/master/protocol/](http://localhost:8080/realms/master/protocol/)… ---
**Author:** ![wadahiro](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/wadahiro/32/5579_2.png) [@wadahiro](https://forum.keycloak.org/u/wadahiro)\ **Post date:** [April 13, 2022, 3:06pm UTC](https://forum.keycloak.org/t/kc-17-x-x-how-to-access-admin-ui-from-port-forwarded-internal-url-prevent-redirect-from-internal-url-to-kc-hostname/14917/8 "2022-04-13T15:06:50Z")
One thing I forgot to mention: set the “frontend URL” in the master realm to the admin URL (Note: you need the scheme here like http(s)://〜). Reference: [frontendUrl and adminUrl - how to restrict admin console to internal IP only?](http://forum.keycloak.org/t/frontendurl-and-adminurl-how-to-restrict-admin-console-to-internal-ip-only/2655) However, changing the port number require a slightly tricky configuration. if you want to use localhost:8080 and localhost:8081, start with the following command, then add “[http://localhost:8081](http://localhost:8081)” to the “frontend URL” of the master realm. `docker run -e KC_HOSTNAME=localhost -e KC_HOSTNAME_PORT=8080 -e KC_SPI_HOSTNAME_DEFAULT_ADMIN=localhost -e KEYCLOAK_ADMIN=admin -e KEYCLOAK_ADMIN_PASSWORD=admin -p 8080:8080 -p 8081:8080 quay.io/keycloak/keycloak:17.0.1 start-dev` ---
**Author:** ![armujahid](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/armujahid/32/4802_2.png) [@armujahid](https://forum.keycloak.org/u/armujahid)\ **Post date:** [April 14, 2022, 5:17am UTC](https://forum.keycloak.org/t/kc-17-x-x-how-to-access-admin-ui-from-port-forwarded-internal-url-prevent-redirect-from-internal-url-to-kc-hostname/14917/9 "2022-04-14T05:17:01Z")
after setting frontend URL of the master realm to [http://localhost:9010](http://localhost:9010) I started getting this issue. You can see that API call [http://localhost/realms/master/protocol/openid-connect/3p-cookies/step1.html?version=opwzf](http://localhost/realms/master/protocol/openid-connect/3p-cookies/step1.html?version=opwzf) has host without port. ![image](https://global.discourse-cdn.com/free1/uploads/keycloak/original/2X/c/cb74dcd9bc2200747ba5dfc240c92b9ed1757a75.png) I had to execute ```auto "DELETE FROM REALM_ATTRIBUTE WHERE `REALM_ATTRIBUTE`.`NAME` = 'frontendUrl' AND `REALM_ATTRIBUTE`.`REALM_ID` = 'master'" ``` to rollback this change. Also note that without any of these changes keycloak APIs are still accessible from inside kubernetes cluster from [http://keycloak](http://keycloak) (internal service url) and all admin service calls are working fine. This issue is only occurring for Admin frontend. Your setup is working without KC\_PROXY=edge. You can try your docker run command with KC\_PROXY=edge to reproduce this issue ```auto docker run -e KC_HOSTNAME=localhost -e KC_HOSTNAME_PORT=8080 -e KC_SPI_HOSTNAME_DEFAULT_ADMIN=localhost -e KEYCLOAK_ADMIN=admin -e KEYCLOAK_ADMIN_PASSWORD=admin -e KC_PROXY=edge -p 8080:8080 -p 8081:8080 quay.io/keycloak/keycloak:17.0.1 start-dev ``` ---
**Author:** ![armujahid](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/armujahid/32/4802_2.png) [@armujahid](https://forum.keycloak.org/u/armujahid)\ **Post date:** [April 14, 2022, 5:22am UTC](https://forum.keycloak.org/t/kc-17-x-x-how-to-access-admin-ui-from-port-forwarded-internal-url-prevent-redirect-from-internal-url-to-kc-hostname/14917/10 "2022-04-14T05:22:11Z")
Note that keycloak APIs are still accessible from inside kubernetes cluster from [http://keycloak](http://keycloak) (internal service url) and all admin service calls are working fine. This issue is only occurring while accessing Admin frontend from [http://localhost:9010](http://localhost:9010) after port-forwarding keycloak `kubectl port-forward svc/keycloak 9010:80` ---
**Author:** ![acidsys](https://avatars.discourse-cdn.com/v4/letter/a/ea5d25/32.png) [@acidsys](https://forum.keycloak.org/u/acidsys)\ **Post date:** [April 30, 2022, 8:35pm UTC](https://forum.keycloak.org/t/kc-17-x-x-how-to-access-admin-ui-from-port-forwarded-internal-url-prevent-redirect-from-internal-url-to-kc-hostname/14917/11 "2022-04-30T20:35:30Z")
Hi, what is ```auto KC_SPI_HOSTNAME_DEFAULT_ADMIN ``` in a non-Docker environment, i.e. in a regular `keycloak.conf` ? Where is this documented? Thank you! ---
**Author:** ![rvanderboom](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/rvanderboom/32/1463_2.png) [@rvanderboom](https://forum.keycloak.org/u/rvanderboom)\ **Post date:** [July 4, 2022, 9:40am UTC](https://forum.keycloak.org/t/kc-17-x-x-how-to-access-admin-ui-from-port-forwarded-internal-url-prevent-redirect-from-internal-url-to-kc-hostname/14917/12 "2022-07-04T09:40:18Z")
Hey, I have same issue, getting 404 on the step1.html and step2.html files. I have configured different host name for the admin login (internal)… everything works only i got 404 on the admin step1.html (white page). When i specifically set frontendUrl of master admin to the main (public) url i can login but this is NOT what i want, since i want to have admin on internal domain., so the step1.htmls are not public reachable. anyone already found solution ? I thiink it is a bug in keycloak, also tried keycloak quarkus 18, same.