# Keycloak on OpenJDK (bare metal) behind reverse proxy

**URL:** <https://forum.keycloak.org/t/keycloak-on-openjdk-bare-metal-behind-reverse-proxy/8672>\
**Category:** Getting advice\
**Created:** [April 22, 2021, 6:49pm UTC](https://forum.keycloak.org/t/keycloak-on-openjdk-bare-metal-behind-reverse-proxy/8672 "2021-04-22T18:49:47Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![xkey](https://avatars.discourse-cdn.com/v4/letter/x/ce7236/32.png) [@xkey](https://forum.keycloak.org/u/xkey)\
**Post date:** [April 22, 2021, 6:49pm UTC](https://forum.keycloak.org/t/keycloak-on-openjdk-bare-metal-behind-reverse-proxy/8672/1 "2021-04-22T18:49:47Z")

</div>

Hi everyone,

I recently installed Keycloak on OpenJDK 12.0.4 (bare metal).  
I use a nginx server as a reverse proxy for all my applications to secure my connections (HTTP → HTTPS) over SSL.

My current configuration does not start correctly to prepare keycloak loadblancing for cluster operation in the next step.

Does anyone here already have a running nginx configuration or already reverse-prroxy un dloadbalancing successfully implemented in the cluster?

Many thanks in advance

---

<div class="post-metadata">

**Author:** ![mbonn](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/mbonn/32/5755_2.png) [@mbonn](https://forum.keycloak.org/u/mbonn)\
**Post date:** [April 23, 2021, 10:06am UTC](https://forum.keycloak.org/t/keycloak-on-openjdk-bare-metal-behind-reverse-proxy/8672/2 "2021-04-23T10:06:33Z")

</div>

Hi,

I did this (two wildfly instances) with an Apache AJP proxy configuration. Keycloak must be running in standalone-ha mode.

In Apache, I enabled the mods ssl, rewrite, proxy\_ajp, proxy\_balancer, lbmethod\_byrequests, headers.

In Apache’s default-ssl.conf I defined the cluster (on top of the file):

\<Proxy balancer://cluster\>  
BalancerMember ajp://NODE1.yourdomain.org:8009 route=NODE1 status=  
BalancerMember ajp://NODE2.yourdomain.org:8009 route=NODE2 status=  
ProxySet stickysession=AUTH\_SESSION\_ID  
Allow from all

In the virtual host section, I aded this:

ProxyPass /auth balancer://cluster/auth  
ProxyPassReverse /auth balancer://cluster/auth

Then the both wildfly instances are startet with the prarams:  
–server-config=standalone-ha.xml -b=0.0.0.0 -bprivate=x.y.z.1 -Djboss.node.name=NODE1 -Djboss.tx.node.id=NODE1  
–server-config=standalone-ha.xml -b=0.0.0.0 -bprivate=x.y.z.2 -Djboss.node.name=NODE2 -Djboss.tx.node.id=NODE2

(To be redundant in case of an apache restart, we are running the apache proxies crosswise on each wildfly node and a Big IP F5 network loadbalancer in front of them, but this requires some network reconfiguration for the ARP-resolution…)

regards,  
Matthias

---

<div class="post-metadata">

**Author:** ![xkey](https://avatars.discourse-cdn.com/v4/letter/x/ce7236/32.png) [@xkey](https://forum.keycloak.org/u/xkey)\
**Post date:** [April 24, 2021, 1:29pm UTC](https://forum.keycloak.org/t/keycloak-on-openjdk-bare-metal-behind-reverse-proxy/8672/3 "2021-04-24T13:29:20Z")

</div>

@mbonn many thanks for your reply and sharing experience

I’m currently preparing keycloak redundant and HA to serve two instances on different hardware (keycloak, DB, etc.) by means of loadbalancer, which will continue to provide the SSO IdP in case of a service outage.  
Apache is already used by other instances/applications, so I wanted to run the nginx separately for keycloak

Is there anyone running keycloak without docker → bare metal in nginx where 2 keycloak instances communicate with each other in parallel (SSO instances, database and switching over to the second keycloak instance when one keycloak instance terminates).

---

<div class="post-metadata">

**Author:** ![ederc](https://avatars.discourse-cdn.com/v4/letter/e/ce73a5/32.png) [@ederc](https://forum.keycloak.org/u/ederc)\
**Post date:** [April 29, 2021, 5:10am UTC](https://forum.keycloak.org/t/keycloak-on-openjdk-bare-metal-behind-reverse-proxy/8672/4 "2021-04-29T05:10:38Z")

</div>

Hi,

we are running nearly this environment. Had you tried this configuration in nginx?  
…  
http {  
upstream keycloak-ha {  
server env\_SERVERIP1:8080 fail\_timeout=0 max\_fails=1;  
server env\_SERVERIP2:8080 backup fail\_timeout=0 max\_fails=1;  
}  
…

The second one is used only when the first has a timeout.  
Maybe this helps.

---

<div class="post-metadata">

**Author:** ![xkey](https://avatars.discourse-cdn.com/v4/letter/x/ce7236/32.png) [@xkey](https://forum.keycloak.org/u/xkey)\
**Post date:** [April 29, 2021, 9:08am UTC](https://forum.keycloak.org/t/keycloak-on-openjdk-bare-metal-behind-reverse-proxy/8672/5 "2021-04-29T09:08:19Z")

</div>

@ederc  
Are you running keycloak in multiple instances in a cluster with synchronized databases for load-balancing and fallback (service backup) in case a server/instance stops running or is interrupted

I tried different nginx configurations, because i still have apache and tomcat running in parallel in my test environment before roll out into productive env

---

<div class="post-metadata">

**Author:** ![ederc](https://avatars.discourse-cdn.com/v4/letter/e/ce73a5/32.png) [@ederc](https://forum.keycloak.org/u/ederc)\
**Post date:** [April 29, 2021, 9:25am UTC](https://forum.keycloak.org/t/keycloak-on-openjdk-bare-metal-behind-reverse-proxy/8672/6 "2021-04-29T09:25:40Z")

</div>

@xkey  
Both keycloak instances are running in standalone-ha mode and uses same database. It works fine, we tried it for maintaining. Only thing is, a user session will not move from one node to the other. A re-login is necessary.

---

<div class="post-metadata">

**Author:** ![xkey](https://avatars.discourse-cdn.com/v4/letter/x/ce7236/32.png) [@xkey](https://forum.keycloak.org/u/xkey)\
**Post date:** [April 29, 2021, 4:23pm UTC](https://forum.keycloak.org/t/keycloak-on-openjdk-bare-metal-behind-reverse-proxy/8672/7 "2021-04-29T16:23:37Z")

</div>

Are you using keycloak as SSO/IAM in docker container or bare metal in your environment?

Would you have an extended snippet of your nginx/apache configuration

---

<div class="post-metadata">

**Author:** ![ederc](https://avatars.discourse-cdn.com/v4/letter/e/ce73a5/32.png) [@ederc](https://forum.keycloak.org/u/ederc)\
**Post date:** [April 30, 2021, 4:56am UTC](https://forum.keycloak.org/t/keycloak-on-openjdk-bare-metal-behind-reverse-proxy/8672/8 "2021-04-30T04:56:42Z")

</div>

We don´t use docker. Here are my configuration with some values which will be replaced by the GIT pipeline:

> user env\_DESTUSER;  
> worker\_processes 1;
> 
> pid /srv/httpd/sites/env\_DESTUSER/runtime/nginx.pid;
> 
> events {  
> worker\_connections 1024;  
> }
> 
> http {  
> upstream keycloak-ha {  
> server env\_SERVERIP1:8080 fail\_timeout=0 max\_fails=1;  
> server env\_SERVERIP2:8080 backup fail\_timeout=0 max\_fails=1;  
> }
> 
> log\_format weka ‘$remote\_addr - $remote\_user [$time\_local] “$request” $status $body\_bytes\_sent “$http\_referer” “$http\_user\_agent” “$host”’;  
> access\_log logs/access\_log weka;
> 
> error\_log logs/error\_log;
> 
> include mime.nginx.types;  
> default\_type application/octet-stream;
> 
> sendfile on;  
> #tcp\_nopush on;
> 
> keepalive\_timeout 65;
> 
> # SSL options
> 
> ssl\_session\_cache shared:SSL:10m;  
> ssl\_session\_timeout 10m;  
> ssl\_protocols TLSv1.2;  
> ssl\_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA384;  
> ssl\_prefer\_server\_ciphers on;
> 
> ### SSL-redirect 80 → 443
> 
> server {  
> listen env\_WWW\_SERVERIP:80;  
> server\_name env\_WWW\_SERVERDOMAIN;  
> server\_tokens off;  
> return 301 https://$server\_name$request\_uri;  
> }
> 
> ### SSL-Host
> 
> server {  
> listen env\_WWW\_SERVERIP:443 ssl;  
> server\_name env\_WWW\_SERVERDOMAIN;  
> server\_tokens off;
> 
> ```
> add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
> 
> ssl_certificate /srv/httpd/sites/env_DESTUSER/conf/certs/XXXX.pem;
> ssl_certificate_key /srv/httpd/sites/env_DESTUSER/conf/certs/XXXX.key;
> 
> # access rules for URLs
> include includes/keycloak.inc;
> 
> ```
> 
> }
> 
> }

---

<div class="post-metadata">

**Author:** ![xkey](https://avatars.discourse-cdn.com/v4/letter/x/ce7236/32.png) [@xkey](https://forum.keycloak.org/u/xkey)\
**Post date:** [May 5, 2021, 8:08am UTC](https://forum.keycloak.org/t/keycloak-on-openjdk-bare-metal-behind-reverse-proxy/8672/9 "2021-05-05T08:08:14Z")

</div>

@ederc many thanks for sharing your config and quick reply

---

<div class="post-metadata">

**Author:** ![xkey](https://avatars.discourse-cdn.com/v4/letter/x/ce7236/32.png) [@xkey](https://forum.keycloak.org/u/xkey)\
**Post date:** [May 5, 2021, 8:12am UTC](https://forum.keycloak.org/t/keycloak-on-openjdk-bare-metal-behind-reverse-proxy/8672/10 "2021-05-05T08:12:32Z")

</div>

I’m not making any progress with my current nginx configuration for keycloak and am stuck at this point

Keycloak alone runs without problems  
The current configuration of Nginx (/etc/nginx/nginx.conf) on its own also runs without problems

As soon as I start both in a row it leads to problems because the ports 80, 443, 8080 and 8443 are already in use (Keycloak or Nginx).

Do I need the reverse proxy necessarily in front of keycloak?

Currently Keycloak communicates via 8443 but still without SSL/TLS, where is this to be deposited/configured with existing, purchased certificates?

Many thanks in advance