# Keycloak not working with HAProxy

**URL:** <https://forum.keycloak.org/t/keycloak-not-working-with-haproxy/25885>\
**Category:** Configuring the server\
**Created:** [May 6, 2024, 10:56pm UTC](https://forum.keycloak.org/t/keycloak-not-working-with-haproxy/25885 "2024-05-06T22:56:44Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![jmsapps](https://avatars.discourse-cdn.com/v4/letter/j/48db29/32.png) [@jmsapps](https://forum.keycloak.org/u/jmsapps)\
**Post date:** [May 6, 2024, 10:56pm UTC](https://forum.keycloak.org/t/keycloak-not-working-with-haproxy/25885/1 "2024-05-06T22:56:44Z")

</div>

I’ve seen similar issues reported but nothing I’ve seen documented seems to help. The error in log is as follows along with constant redirects in the browser:

> keycloak-1 | 2024-05-06 22:47:39,036 WARN [org.keycloak.events] (executor-thread-9) type=“REFRESH\_TOKEN\_ERROR”, realmId=“\<realm\_id\>”, clientId=“security-admin-console”, userId=“null”, ipAddress=“\<my\_remote\_server\_ip\>”, error=“invalid\_token”, grant\_type=“refresh\_token”, client\_auth\_method=“client-secret”

my docker-compose is as follows:

> version: ‘3’
> 
> services:  
> postgres\_kc:  
> image: postgres:latest  
> environment:  
> - POSTGRES\_DB=${POSTGRES\_DB}  
> - POSTGRES\_USER=${POSTGRES\_USER}  
> - POSTGRES\_PASSWORD=${POSTGRES\_PASSWORD}  
> ports:  
> - “5435:5432”  
> networks:  
> - keycloak-network  
> volumes:  
> - /etc/postgresql/14/main/postgresql.conf:/etc/postgresql/postgresql.conf  
> - /etc/keycloak/data:/var/lib/postgresql/data
> 
> keycloak:  
> image: [Quay](http://quay.io/keycloak/keycloak:latest)  
> restart: always  
> command: start-dev  
> environment:  
> - DB\_VENDOR=POSTGRES  
> - DB\_ADDR=postgres\_kc  
> - DB\_DATABASE=${POSTGRES\_DB}  
> - DB\_USER=${POSTGRES\_USER}  
> - DB\_PASSWORD=${POSTGRES\_PASSWORD}  
> - KEYCLOAK\_ADMIN=${KEYCLOAK\_ADMIN}  
> - KEYCLOAK\_ADMIN\_PASSWORD=${KEYCLOAK\_ADMIN\_PASSWORD}  
> - QUARKUS\_TRANSACTION\_MANAGER\_ENABLE\_RECOVERY=true  
> - KC\_CACHE=ispn  
> - PROXY\_ADDRESS\_FORWARDING=true  
> - REDIRECT\_SOCKET=proxy-https  
> - KC\_PROXY\_ADDRESS\_FORWARDING=true  
> - KC\_PROXY\_HEADERS=xforwarded  
> - KC\_HTTP\_ENABLED=true  
> - KC\_HOSTNAME\_STRICT=false  
> - KC\_HOSTNAME=\<my\_domain\>  
> - KC\_HTTP\_PORT=8081  
> - KC\_HTTPS\_CLIENT\_AUTH=request  
> - KC\_HTTPS\_PROTOCOLS=TLSv1.3,TLSv1.2  
> # - KC\_LOG\_LEVEL=DEBUG  
> depends\_on:  
> - postgres\_kc  
> ports:  
> - “8443:8081”  
> networks:  
> - keycloak-network  
> volumes:  
> - /etc/keycloak/realms:/opt/keycloak/data
> 
> networks:  
> keycloak-network:  
> driver: bridge

haproxy:

> # http front
> 
> frontend http\_front  
> bind \*:80  
> timeout client 60000ms  
> # redirect HTTP to HTTPS  
> redirect scheme https code 301 if { hdr\_sub(host) \<my\_domain\> } !{ ssl\_fc }
> 
> # https front
> 
> frontend https\_front  
> mode http  
> bind \*:443 ssl crt /etc/haproxy/ssl/\<my\_cert\>  
> timeout client 60000ms
> 
> ```
> # pass ssl to end host
> http-request set-header X-Forwarded-Proto https if { ssl_fc }
> http-request add-header X-Forwarded-Port %[dst_port] if { ssl_fc }
> http-request add-header X-Forwarded-Host %[req.hdr(Host)]
> http-request set-header X-Forwarded-For %[src] if { ssl_fc }
> 
> # sets secure cookie flag, and httponly cookie flag
> http-after-response replace-header Set-Cookie '(^((?!(?i)httponly).)*$)' "\1; HttpOnly"
> http-after-response replace-header Set-Cookie '(^((?!(?i)secure).)*$)' "\1; Secure"
> 
> # capture header for logging
> http-request capture req.hdr(Content-Length) len 10
> 
> acl host_keycloak ssl_fc_sni -i <mydomain>
> use_backend https_back_keycloak if host_keycloak
> 
> ```
> 
> # https back
> 
> backend https\_back\_keycloak  
> mode http  
> option forwardfor header X-Client  
> balance roundrobin  
> server nkc1 \<my\_remote\_server\_ip\>:8443  
> timeout connect 60000ms  
> timeout server 60000ms  
> compression algo gzip  
> compression offload

been at this for several days now, any help is appreciated!

---

<div class="post-metadata">

**Author:** ![jmsapps](https://avatars.discourse-cdn.com/v4/letter/j/48db29/32.png) [@jmsapps](https://forum.keycloak.org/u/jmsapps)\
**Post date:** [May 7, 2024, 6:25pm UTC](https://forum.keycloak.org/t/keycloak-not-working-with-haproxy/25885/2 "2024-05-07T18:25:26Z")

</div>

I finally gave up and switched to nginx and its working fine now. I’ll leave this thread up in case someone spots a misconfiguration? My only guess was that haproxy was blocking a header or a cookie so that the refresh token could not be read. Another difference I noted when going through haproxy was that it was making a token POST request an extra time before fetching serverinfo 🤷‍♂️

---

<div class="post-metadata">

**Author:** ![jmsapps](https://avatars.discourse-cdn.com/v4/letter/j/48db29/32.png) [@jmsapps](https://forum.keycloak.org/u/jmsapps)\
**Post date:** [May 8, 2024, 6:19am UTC](https://forum.keycloak.org/t/keycloak-not-working-with-haproxy/25885/3 "2024-05-08T06:19:47Z")

</div>

I figured it out, its this line here in my above haproxy configuration:

> http-after-response replace-header Set-Cookie ‘(^((?!(?i)httponly).)\*$)’ “\1; HttpOnly”

I see when inspecting the cookies for keycloak that a couple are not set to HttpOnly, and I suppose that this is necessary, so after commenting that then I can log into the admin console without issue. If this thread can save a headache for someone else then my suffering will have been worth it!