# Partly Blank Admin Page in Production Mode **URL:** \ **Category:** Configuring the server\ **Tags:** admin-console\ **Created:** [May 6, 2022, 2:51pm UTC](https://forum.keycloak.org/t/partly-blank-admin-page-in-production-mode/15403 "2022-05-06T14:51:42Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Peter-CA](https://avatars.discourse-cdn.com/v4/letter/p/3ab097/32.png) [@Peter-CA](https://forum.keycloak.org/u/Peter-CA)\ **Post date:** [May 6, 2022, 2:51pm UTC](https://forum.keycloak.org/t/partly-blank-admin-page-in-production-mode/15403/1 "2022-05-06T14:51:42Z")
I am running keycloak behind an nginx proxy. The nginx proxy is terminating encryption using a self-signed certificate. Both keycloak and the nginx proxy are running as docker containers. My configuration works in dev mode, but in production I get a party blank screen when I try to access the admin console. Does anyone know what might be causing this? I don’t see any obvious errors in the browser console or networking tab. Here is an screenshot of my problem: ![image](https://global.discourse-cdn.com/free1/uploads/keycloak/original/2X/f/f6c64367fbfbb4dd21658f6a211c7b9ae674e889.png) My docker compose: ```auto keycloak: container_name: hxd-keycloak restart: "always" image: hyperxdashboard-keycloak:latest environment: # KC_DB: mariadb KC_DB_URL_HOST: hxd-mariadb KC_DB_URL_PORT: 3306 KC_DB_URL_DATABASE: keycloak KC_DB_USERNAME: ${DASH_DB_USERNAME} KC_DB_PASSWORD: ${DASH_DB_PASSWORD} KC_HOSTNAME: "192.168.74.247" # KC_HOSTNAME_PATH: "https://192.168.74.247:443/auth" KC_HOSTNAME_PORT: 443 # This is false assuming the proxy handles encryption. Don't expose keycloak to a network unencrypted! KC_HOSTNAME_STRICT: false KC_HTTP_ENABLED: true # KC_HTTP_RELATIVE_PATH: "auth" KC_HTTP_PORT: 14040 # KC_HTTPS_PORT: 14040 KC_PROXY: "edge" KEYCLOAK_ADMIN: "${KEYCLOAK_ADMIN_USERNAME}" KEYCLOAK_ADMIN_PASSWORD: "${KEYCLOAK_ADMIN_PASSWORD}" ports: - 14040:14040 depends_on: - hxd-mariadb networks: - hxd-network ``` My nginx conf: ```auto upstream auth { server hxd-keycloak:14040; } server { listen *:443 ssl; listen [::]:443 ssl; keepalive_timeout 70; ssl_certificate selfsigned.crt; ssl_certificate_key private.key; location /auth { proxy_buffers 4 256k; proxy_buffer_size 128k; proxy_busy_buffers_size 256k; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_pass http://auth$request_uri; proxy_read_timeout 90; } ``` ---
**Author:** ![Paul6552](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/paul6552/32/3146_2.png) [@Paul6552](https://forum.keycloak.org/u/Paul6552)\ **Post date:** [May 6, 2022, 7:46pm UTC](https://forum.keycloak.org/t/partly-blank-admin-page-in-production-mode/15403/2 "2022-05-06T19:46:30Z")
You have many similiar discussion on github. For example: > > > \### Describe the bug > > Following (https://github.com/keycloak/keycloak/issues/108…17), I've updated keycloak the newest version (18), and I'm still running in to some issues. > > As described, the current proxy setting is \*\*edge\*\* > > First issues is that when the server is first spawn up, we get a \*\*redirect\_uri\*\* error: > !\[redirect\_uri\](https://user-images.githubusercontent.com/3610553/166299423-efc6031d-d76f-426f-bd72-3b374a17805d.PNG) > > LOGS: > \> DEBUG \[io.quarkus.vertx.http.runtime.ForwardedParser\] (executor-thread-11) Recalculated absoluteURI to http://something.com/auth/realms/master/protocol/openid-connect/auth?client\_id=security-admin-console&redirect\_uri=https%3A%2F%2Fsomething.com%2Fauth%2Fadmin%2Fmaster%2Fconsole%2F&state=fbd3f10a-d929-4af8-a4ce-e3ef06c1b89e&response\_mode=fragment&response\_type=code&scope=openid&nonce=ea937eae-bcc6-4bf3-aae3-0a4b3742c9d7&code\_challenge=pNq3qur9\_XOZfrTirOaHRMxCx8pdGL-yeFjAKbLLiHA&code\_challenge\_method=S256 > > \> DEBUG \[org.keycloak.protocol.oidc.utils.RedirectUtils\] (executor-thread-11) replacing relative valid redirect with: http://something.com/auth/admin/master/console/\* > > \> WARN \[org.keycloak.events\] (executor-thread-11) type=LOGIN\_ERROR, realmId=a1634d31-f503-4b6b-9ce9-522e84855fc7, clientId=security-admin-console, userId=null, ipAddress=40.41.43.44, error=invalid\_redirect\_uri, redirect\_uri=https://something.com/auth/admin/master/console/ > > Here we can see that calls are reaching the keycloak server as \*\*http\*\*, so I'm guessing that nginx ingress is forwarding the headers correctly, however its expected that the server knows that its being redirected from an \*\*https\*\* origin and should allow for access as such. This does not happen as we get the aforementioned \*\*redirect\_uri\*\* error. > > To fix this, we need to add the \*\*absoluteURI\*\* to the redirect\_uris of the \*\*security-admin-console\*\* client using kcadm: > \> ./kcadm.sh update clients/\ -s 'redirectUris=\["https://something.com/auth/\*"\]' --no-config --server http://localhost:8080/auth --realm master --user admin --password admin > > We can now enter the password and the user to get access to the admin console, but some requests are generated with the wrong \*\*scheme\*\*: > !\[keyckloak\_wrong\_scheme\](https://user-images.githubusercontent.com/3610553/166296260-161ffb1c-87e8-4437-850f-e7e58c464f11.png) > > If we copy the request as cURL we get the following: > \> curl '\*\*http\*\*://something.com/auth/admin/realms' -H 'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0' -H 'Accept: application/json, text/plain, \*/\*' -H 'Accept-Language: en-US,en;q=0.5' -H 'Accept-Encoding: gzip, deflate' -H 'Authorization: Bearer \<\_TOKEN\_\>' -H 'Origin: https://something.com' > > As we can see the address is generated with \*\*HTTP\*\*, at this point the browser identifies this as a possible risk and flags the requests as \*\*MIXED BLOCK\*\*. I'm not able to get any logs from this as the browser doesn't even try to reach the server. However if we take this and change to \*\*HTTPS\*\* and run the cURL command its is successful. > > There are however some requests that are generated correctly: > !\[keyckloak\_correct\_scheme\](https://user-images.githubusercontent.com/3610553/166297548-ae419682-c8e4-410d-80c8-abff4cab7f78.png) > > So my guess is that something in the client-sided application is generating the urls incorrectly. > > Is this a known bug or is it some miss configuration on my side? > > My current setup is as follows: > KEYCLOAK 18 (quarkus): > KC\_PROXY=EDGE > KC\_HOSTNAME=something.com > KC\_PORT = 8080 > KC\_HTTP\_RELATIVE\_PATH=/auth > > Cloud Provicer is AWS > Running on Kubernentes (EKS) > INGRESS-CONTROLLER = nginx > Ingress variables: > host: something.com > path: / > port: 8080 > > > > \### Version > > 18 > > \### Expected behavior > > Not getting redirect\_url error and being able to access the admin console. > > \### Actual behavior > > Getting redirect\_url on a fresh instance and not being able to access the admin console. > > \### How to Reproduce? > > Spawn a new keycloak instance in kubernetes with \*\*KC\_PROXY=edge\*\* and with an nginx ingress. Then just access the browser on the defined url. > > \### Anything else? > > https://github.com/keycloak/keycloak/issues/10817 > https://github.com/keycloak/keycloak/issues/11667 > https://forum.keycloak.org/t/mixed-block-error-on-api-request-on-the-admin-console/15178 Maybe that can help you. What i see is that you commented out relative path but your nginx config redirects to auth. One other thing is you havent set the X-Forwarded-Scheme I think you see partly the admin page because of the browsers cache. ---
**Author:** ![Peter-CA](https://avatars.discourse-cdn.com/v4/letter/p/3ab097/32.png) [@Peter-CA](https://forum.keycloak.org/u/Peter-CA)\ **Post date:** [May 6, 2022, 8:47pm UTC](https://forum.keycloak.org/t/partly-blank-admin-page-in-production-mode/15403/3 "2022-05-06T20:47:13Z")
Thanks for your reply Paul! I looked through the GitHub and I found [this bug report](https://github.com/keycloak/keycloak/issues/11327) that seemed similar to my issue. After removing “KC\_HOSTNAME\_PORT: 443” from my docker compose, everything works! In case you’re curious, I commented out the KC\_HTTP\_RELATIVE\_PATH line in my compose because I’m setting that variable at build time in my DockerFile. Production mode seems to want you to get that variable at build time, while dev mode wants you to set it at runtime. Kinda strange behavior. I also tried clearing my cache, but that top section of the admin page was still visible. In any case, removing KC\_HOSTNAME\_PORT seems to have fixed my issue! ---
**Author:** ![spamgooner](https://avatars.discourse-cdn.com/v4/letter/s/a587f6/32.png) [@spamgooner](https://forum.keycloak.org/u/spamgooner)\ **Post date:** [June 8, 2022, 6:02am UTC](https://forum.keycloak.org/t/partly-blank-admin-page-in-production-mode/15403/4 "2022-06-08T06:02:20Z")
thanks Peter-CA for posting this…I’d read docs and blogs and tried various env var combos and configs but was still stuck with a completely blank admin console page. removing KC\_HOSTNAME\_PORT as per your followup post fixed it for me… much appreciated! Need to upskill on keycloak for sure! ---
**Author:** ![habrazilay](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/habrazilay/32/9782_2.png) [@habrazilay](https://forum.keycloak.org/u/habrazilay)\ **Post date:** [February 15, 2024, 1:48pm UTC](https://forum.keycloak.org/t/partly-blank-admin-page-in-production-mode/15403/5 "2024-02-15T13:48:06Z")
Thank you so much! Removing KC\_HOSTNAME\_PORT worked for me. It’s curious that for dev mode, it only work with KC\_HOSTNAME\_PORT.