# Springboot application with keycloak adapter not working behind an HTTPS proxy **URL:** \ **Category:** Securing applications\ **Created:** [June 4, 2022, 5:29pm UTC](https://forum.keycloak.org/t/springboot-application-with-keycloak-adapter-not-working-behind-an-https-proxy/15845 "2022-06-04T17:29:49Z")\ **Posts on this page:** 18\ **Page:** 1
**Author:** ![aanciaes](https://avatars.discourse-cdn.com/v4/letter/a/f19dbf/32.png) [@aanciaes](https://forum.keycloak.org/u/aanciaes)\ **Post date:** [June 4, 2022, 5:29pm UTC](https://forum.keycloak.org/t/springboot-application-with-keycloak-adapter-not-working-behind-an-https-proxy/15845/1 "2022-06-04T17:29:49Z")
Hi I have a small spring boot application being protected by keycloak 17.0.1 springboot adapter. It works fine with http but when running behind a https proxy (responsible for offload the https external requests to internal http requests) it always fails because the redirect\_url still refers http. Entry point for the application is [https://entry2-pp.domain/public-library/](https://entry2-pp.domain/public-library/) When calling keycloak for login, the redirect URL still refers http See below, the debug from class org.keycloak 2022-06-04 18:10:58.016 DEBUG 72966 — [nio-8081-exec-2] o.k.adapters.OAuthRequestAuthenticator : redirecting to auth server 2022-06-04 18:10:58.016 DEBUG 72966 — [nio-8081-exec-2] o.k.adapters.OAuthRequestAuthenticator : callback uri: **http** ://entry2-pp.domain/public-library/books 2022-06-04 18:10:58.023 DEBUG 72966 — [nio-8081-exec-2] o.k.adapters.OAuthRequestAuthenticator : Sending redirect to login page: [https://am3-pp.domain/realms/AAAAAA/protocol/openid-connect/auth?response\_type=code&client\_id=public-library&redirect\_uri=](https://am3-pp.domain/realms/AAAAAA/protocol/openid-connect/auth?response_type=code&client_id=public-library&redirect_uri=) **http** %3A%2F%2Fentry2-pp.domain%2Fpublic-library%2Fbooks&state=a1bca340-9af0-41b2-8f7a-cc3a37ce00cc&login=true&scope=openid Any suggestion would be very much appreciated. Thanks ---
**Author:** ![weltonrodrigo](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/weltonrodrigo/32/3104_2.png) [@weltonrodrigo](https://forum.keycloak.org/u/weltonrodrigo)\ **Post date:** [June 4, 2022, 10:31pm UTC](https://forum.keycloak.org/t/springboot-application-with-keycloak-adapter-not-working-behind-an-https-proxy/15845/2 "2022-06-04T22:31:42Z")
Can you show your keycloak adapter configuration? ---
**Author:** ![aanciaes](https://avatars.discourse-cdn.com/v4/letter/a/f19dbf/32.png) [@aanciaes](https://forum.keycloak.org/u/aanciaes)\ **Post date:** [June 6, 2022, 8:57am UTC](https://forum.keycloak.org/t/springboot-application-with-keycloak-adapter-not-working-behind-an-https-proxy/15845/3 "2022-06-06T08:57:27Z")
```auto Hi My springboot application.properties is below: ---- server.connection-timeout=5000 server.port = 8081 server.use-forwarded-headers=true # keycloak.enabled = false logging.level.org.keycloak=DEBUG keycloak.realm=AAAAAA keycloak.resource=public-library keycloak.auth-server-url=https://am3-pp.domain keycloak.ssl-required=external keycloak.public-client=true keycloak.securityConstraints[0].authRoles[0]=libMember keycloak.securityConstraints[0].authRoles[1]=Librarian keycloak.securityConstraints[0].securityCollections[0].name=libmember resource keycloak.securityConstraints[0].securityCollections[0].patterns[0]=/books keycloak.securityConstraints[1].authRoles[0]=Librarian keycloak.securityConstraints[1].securityCollections[0].name=librarian resource keycloak.securityConstraints[1].securityCollections[0].patterns[0]=/manager ---- Thanks ``` ---
**Author:** ![aanciaes](https://avatars.discourse-cdn.com/v4/letter/a/f19dbf/32.png) [@aanciaes](https://forum.keycloak.org/u/aanciaes)\ **Post date:** [June 6, 2022, 3:21pm UTC](https://forum.keycloak.org/t/springboot-application-with-keycloak-adapter-not-working-behind-an-https-proxy/15845/4 "2022-06-06T15:21:32Z")
Hi there Thanks for the help.I’ve posted my configuration. ---
**Author:** ![aanciaes](https://avatars.discourse-cdn.com/v4/letter/a/f19dbf/32.png) [@aanciaes](https://forum.keycloak.org/u/aanciaes)\ **Post date:** [June 7, 2022, 1:06pm UTC](https://forum.keycloak.org/t/springboot-application-with-keycloak-adapter-not-working-behind-an-https-proxy/15845/5 "2022-06-07T13:06:55Z")
Hi I’ve tried to use **keycloak.ssl-required=all** As you can see below, i still have references to http but the redirect\_url is now https. However now, is specifying port 0 !? Which makes it even more wrong: redirect\_url is now: "[https://entry2-pp.domain:0/](https://entry2-pp.domain:0/) … " See below the log from the adapter 2022-06-07 13:54:05.939 DEBUG 19104 — [nio-8081-exec-2] o.k.adapters.OAuthRequestAuthenticator : redirecting to auth server 2022-06-07 13:54:05.943 DEBUG 19104 — [nio-8081-exec-2] o.k.adapters.OAuthRequestAuthenticator : callback uri: [http://entry2-pp.domain/public-library/books](http://entry2-pp.domain/public-library/books) 2022-06-07 13:54:05.947 DEBUG 19104 — [nio-8081-exec-2] o.keycloak.adapters.KeycloakDeployment : Resolving URLs from [https://am3-pp.domain/realms/AAAAA/.well-known/openid-configuration](https://am3-pp.domain/realms/AAAAA/.well-known/openid-configuration) 2022-06-07 13:54:06.624 INFO 19104 — [nio-8081-exec-2] o.keycloak.adapters.KeycloakDeployment : Loaded URLs from [https://am3-pp.domain/realms/AAAAA/.well-known/openid-configuration](https://am3-pp.domain/realms/AAAAA/.well-known/openid-configuration) 2022-06-07 13:54:06.632 DEBUG 19104 — [nio-8081-exec-2] o.k.adapters.OAuthRequestAuthenticator : Sending redirect to login page: [https://am3-pp.domain/realms/AAAAA/protocol/openid-connect/auth?response\_type=code&client\_id=public-library&redirect\_uri=](https://am3-pp.domain/realms/AAAAA/protocol/openid-connect/auth?response_type=code&client_id=public-library&redirect_uri=) **https** %3A%2F%2Fentry2-pp.domain **%3A0** %2Fpublic-library%2Fbooks&state=830a4e5d-b1a0-4bc4-ad9e-16b845ebb99d&login=true&scope=openid Any help would be appreciated. Thanks ---
**Author:** ![weltonrodrigo](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/weltonrodrigo/32/3104_2.png) [@weltonrodrigo](https://forum.keycloak.org/u/weltonrodrigo)\ **Post date:** [June 8, 2022, 11:52am UTC](https://forum.keycloak.org/t/springboot-application-with-keycloak-adapter-not-working-behind-an-https-proxy/15845/6 "2022-06-08T11:52:33Z")
Do you have a reverse proxy in front of your application? I’m not sure which method the adapter uses to determine on which port the external url is called on, but I suppose you can use the conf `keycloak.confidential-port: 443` or `80` if it’s your case. ---
**Author:** ![aanciaes](https://avatars.discourse-cdn.com/v4/letter/a/f19dbf/32.png) [@aanciaes](https://forum.keycloak.org/u/aanciaes)\ **Post date:** [June 9, 2022, 7:59am UTC](https://forum.keycloak.org/t/springboot-application-with-keycloak-adapter-not-working-behind-an-https-proxy/15845/7 "2022-06-09T07:59:32Z")
Hi Yes, I do have an apache proxy in front. My flow is: HTTPS Incoming requests → F5 (terminates SSL) → Apache (already in HTTP) → Application or keycloak Seting up `keycloak.confidential-port: 443` helped to solve the “:0” issue in the redirect\_url but still having problems with references to http. Now i’m able to login but it fails on the next step. See the log below, where you can find the references to http and the request failling: 2022-06-09 08:46:55.037 INFO 20770 — [nio-8081-exec-1] o.s.web.servlet.DispatcherServlet : Completed initialization in 8 ms 2022-06-09 08:46:55.357 DEBUG 20770 — [nio-8081-exec-2] o.k.adapters.PreAuthActionsHandler : adminRequest **http** ://entry2-pp.domain/public-library/css/style.css 2022-06-09 08:46:55.357 DEBUG 20770 — [nio-8081-exec-2] .k.a.t.AbstractAuthenticatedActionsValve : AuthenticatedActionsValve.invoke /public-library/css/style.css 2022-06-09 08:46:55.358 DEBUG 20770 — [nio-8081-exec-2] o.k.a.AuthenticatedActionsHandler : AuthenticatedActionsValve.invoke **http** ://entry2-pp.domain/public-library/css/style.css 2022-06-09 08:46:55.358 DEBUG 20770 — [nio-8081-exec-2] o.k.a.AuthenticatedActionsHandler : Policy enforcement is disabled. 2022-06-09 08:46:58.815 DEBUG 20770 — [nio-8081-exec-3] o.k.adapters.PreAuthActionsHandler : adminRequest [http://entry2-pp.domain/public-library/books](http://entry2-pp.domain/public-library/books) 2022-06-09 08:46:58.823 DEBUG 20770 — [nio-8081-exec-3] o.k.adapters.OAuthRequestAuthenticator : there was no code 2022-06-09 08:46:58.823 DEBUG 20770 — [nio-8081-exec-3] o.k.adapters.OAuthRequestAuthenticator : redirecting to auth server 2022-06-09 08:46:58.828 DEBUG 20770 — [nio-8081-exec-3] o.k.adapters.OAuthRequestAuthenticator : callback uri: [http://entry2-pp.domain/public-library/books](http://entry2-pp.domain/public-library/books) 2022-06-09 08:46:58.833 DEBUG 20770 — [nio-8081-exec-3] o.keycloak.adapters.KeycloakDeployment : Resolving URLs from [https://am3-pp.domain/realms/AAAAA/.well-known/openid-configuration](https://am3-pp.domain/realms/AAAAA/.well-known/openid-configuration) 2022-06-09 08:46:59.365 INFO 20770 — [nio-8081-exec-3] o.keycloak.adapters.KeycloakDeployment : Loaded URLs from [https://am3-pp.domains/realms/AAAAAA/.well-known/openid-configuration](https://am3-pp.domains/realms/AAAAAA/.well-known/openid-configuration) 2022-06-09 08:46:59.380 DEBUG 20770 — [nio-8081-exec-3] o.k.adapters.OAuthRequestAuthenticator : Sending redirect to login page: [https://am3-pp.domains/realms/AAAAAA/protocol/openid-connect/auth?response\_type=code&client\_id=public-library&redirect\_uri=https%3A%2F%2Fentry2-pp.domain%2Fpublic-library%2Fbooks&state=273d4208-5d1e-43ea-a342-0af4eab5c42f&login=true&scope=openid](https://am3-pp.domains/realms/AAAAAA/protocol/openid-connect/auth?response_type=code&client_id=public-library&redirect_uri=https%3A%2F%2Fentry2-pp.domain%2Fpublic-library%2Fbooks&state=273d4208-5d1e-43ea-a342-0af4eab5c42f&login=true&scope=openid) 2022-06-09 08:47:07.772 DEBUG 20770 — [nio-8081-exec-5] o.k.adapters.PreAuthActionsHandler : adminRequest **http** ://entry2-pp.domains/public-library/books?state=273d4208-5d1e-43ea-a342-0af4eab5c42f&session\_state=dcc73ef3-5f2f-4317-9566-41f8eaaf1aaa&code=172872b0-0f74-42c8-978b-73bdaf9ad9e0.dcc73ef3-5f2f-4317-9566-41f8eaaf1aaa.a994565b-bfab-4b59-acf5-00b2c20b1a1d 2022-06-09 08:47:07.774 DEBUG 20770 — [nio-8081-exec-5] o.k.adapters.OAuthRequestAuthenticator : there was a code, resolving 2022-06-09 08:47:07.774 **ERROR** 20770 — [nio-8081-exec-5] o.k.adapters.OAuthRequestAuthenticator : **Adapter requires SSL. Request: http:** [//entry2-pp.domains/public-library/books?state=273d4208-5d1e-43ea-a342-0af4eab5c42f&session\_state=dcc73ef3-5f2f-4317-9566-41f8eaaf1aaa&code=172872b0-0f74-42c8-978b-73bdaf9ad9e0.dcc73ef3-5f2f-4317-9566-41f8eaaf1aaa.a994565b-bfab-4b59-acf5-00b2c20b1a1d](https://entry2-pp.domains/public-library/books?state=273d4208-5d1e-43ea-a342-0af4eab5c42f&session_state=dcc73ef3-5f2f-4317-9566-41f8eaaf1aaa&code=172872b0-0f74-42c8-978b-73bdaf9ad9e0.dcc73ef3-5f2f-4317-9566-41f8eaaf1aaa.a994565b-bfab-4b59-acf5-00b2c20b1a1d) 2022-06-09 08:47:07.868 DEBUG 20770 — [nio-8081-exec-6] o.k.adapters.PreAuthActionsHandler : adminRequest [http://entry2-pp.domains/public-library/css/style.css](http://entry2-pp.domains/public-library/css/style.css) 2022-06-09 08:47:07.869 DEBUG 20770 — [nio-8081-exec-6] .k.a.t.AbstractAuthenticatedActionsValve : AuthenticatedActionsValve.invoke /public-library/css/style.css 2022-06-09 08:47:07.869 DEBUG 20770 — [nio-8081-exec-6] o.k.a.AuthenticatedActionsHandler : AuthenticatedActionsValve.invoke **http** ://entry2-pp.domain/public-library/css/style.css 2022-06-09 08:47:07.869 DEBUG 20770 — [nio-8081-exec-6] o.k.a.AuthenticatedActionsHandler : Policy enforcement is disabled. ---
**Author:** ![mduchrow](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/mduchrow/32/4676_2.png) [@mduchrow](https://forum.keycloak.org/u/mduchrow)\ **Post date:** [June 11, 2022, 6:15am UTC](https://forum.keycloak.org/t/springboot-application-with-keycloak-adapter-not-working-behind-an-https-proxy/15845/8 "2022-06-11T06:15:40Z")
I had a similar problem recently. I solved it by setting spring-boot property: server.forward-headers-strategy=NATIVE See also [Spring-Boot doc “Running Behind a Front-end Proxy Server”](https://docs.spring.io/spring-boot/docs/current/reference/htmlsingle/#howto.webserver.use-behind-a-proxy-server) ---
**Author:** ![aanciaes](https://avatars.discourse-cdn.com/v4/letter/a/f19dbf/32.png) [@aanciaes](https://forum.keycloak.org/u/aanciaes)\ **Post date:** [June 11, 2022, 1:34pm UTC](https://forum.keycloak.org/t/springboot-application-with-keycloak-adapter-not-working-behind-an-https-proxy/15845/9 "2022-06-11T13:34:41Z")
Thanks @mduchrow Unfortunately i had already tried that without success. I think the issue is related with the adapter implementation ---
**Author:** ![weltonrodrigo](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/weltonrodrigo/32/3104_2.png) [@weltonrodrigo](https://forum.keycloak.org/u/weltonrodrigo)\ **Post date:** [June 14, 2022, 4:12pm UTC](https://forum.keycloak.org/t/springboot-application-with-keycloak-adapter-not-working-behind-an-https-proxy/15845/10 "2022-06-14T16:12:27Z")
By default, ssl is required for all external (non localhost) requests. You can use `ssl-required: none` to disable this behavior. Obviously, this should not be used in production. ---
**Author:** ![aanciaes](https://avatars.discourse-cdn.com/v4/letter/a/f19dbf/32.png) [@aanciaes](https://forum.keycloak.org/u/aanciaes)\ **Post date:** [June 14, 2022, 4:59pm UTC](https://forum.keycloak.org/t/springboot-application-with-keycloak-adapter-not-working-behind-an-https-proxy/15845/11 "2022-06-14T16:59:29Z")
Thanks @weltonrodrigo but that is not really the objective. What I’m testing is exactly the opposite; I’m testing the PRODUCTION deployment ---
**Author:** ![olla](https://avatars.discourse-cdn.com/v4/letter/o/96bed5/32.png) [@olla](https://forum.keycloak.org/u/olla)\ **Post date:** [September 9, 2022, 2:48pm UTC](https://forum.keycloak.org/t/springboot-application-with-keycloak-adapter-not-working-behind-an-https-proxy/15845/12 "2022-09-09T14:48:39Z")
I have exactly the same problem in a spring (non spring boot) application running behind an apache reverse proxy. Reverse proxy is configured with: ```auto ProxyRequests Off ProxyPreserveHost On RequestHeader set X-Forwarded-Proto "https" ``` Keycloak.json: ```auto "realm": "myrealm", "resource": "myresource", "auth-server-url": "https://login.sso-migration.example.com/auth", "ssl-required": "all", "confidential-port": 443, "use-resource-role-mappings": true, "bearer-only": false, "enable-basic-auth": false, "expose-token": false, "credentials": { "secret": "mysecret" }, "connection-pool-size": 20, "disable-trust-manager": true, "allow-any-hostname": true ``` The protocol of the redirect\_uri param for the keycloak request is correctly “https” (since adding ssl-required: all to keycloak.json) and the port is blank since adding confidential-port: 443. Nevertheless the request fails at my application: ```auto S 2022-09-09 15:46:52,777 [http-nio-8080-exec-607] DEBUG org.keycloak.adapters.PreAuthActionsHandler - adminRequest http://myapp.example.com/myapp/ S 2022-09-09 15:46:52,780 [http-nio-8080-exec-607] DEBUG org.keycloak.adapters.OAuthRequestAuthenticator - there was no code S 2022-09-09 15:46:52,781 [http-nio-8080-exec-607] DEBUG org.keycloak.adapters.OAuthRequestAuthenticator - redirecting to auth server S 2022-09-09 15:46:52,781 [http-nio-8080-exec-607] DEBUG org.keycloak.adapters.OAuthRequestAuthenticator - callback uri: http://myapp.example.com/myapp/ S 2022-09-09 15:46:52,784 [http-nio-8080-exec-607] DEBUG org.keycloak.adapters.OAuthRequestAuthenticator - Sending redirect to login page: https://login.sso-migration.example.com/auth/realms/myrealm/protocol/openid-connect/auth?response_type=code&client_id=myresource&redirect_uri=https%3A%2F%2Fmyapp.example.com%2Fmyapp%2F&state=aaf2342b-82d5-4dac-9010-dcc6029c8a4e&login=true&scope=openid S 2022-09-09 15:48:13,729 [http-nio-8080-exec-605] DEBUG org.keycloak.adapters.PreAuthActionsHandler - adminRequest http://myapp.example.com/myapp/?state=aaf2342b-82d5-4dac-9010-dcc6029c8a4e&session_state=cf46dace-7b9f-4850-929e-9e11da30b75c&code=80c24aec-ff10-41a2-a9f5-89332ac2362f.cf46dace-7b9f-4850-929e-9e11da30b75c.32c18f21-6c95-4a6a-a757-a8a0a2710924 S 2022-09-09 15:48:13,732 [http-nio-8080-exec-605] DEBUG org.keycloak.adapters.OAuthRequestAuthenticator - there was a code, resolving S 2022-09-09 15:48:13,732 [http-nio-8080-exec-605] ERROR org.keycloak.adapters.OAuthRequestAuthenticator - Adapter requires SSL. Request: http://myapp.example.com/myapp/?state=aaf2342b-82d5-4dac-9010-dcc6029c8a4e&session_state=cf46dace-7b9f-4850-929e-9e11da30b75c&code=80c24aec-ff10-41a2-a9f5-89332ac2362f.cf46dace-7b9f-4850-929e-9e11da30b75c.32c18f21-6c95-4a6a-a757-a8a0a2710924 ``` Finally I am not sure whether setting “ssl-required” to “all” is the correct way to get keycloak to write a “https”-redirect\_uri. I thought that configuring reverse proxy with `"RequestHeader set X-Forwarded-Proto "https"` could be enough but it isn’t. Any ideas what else to try? ---
**Author:** ![olla](https://avatars.discourse-cdn.com/v4/letter/o/96bed5/32.png) [@olla](https://forum.keycloak.org/u/olla)\ **Post date:** [September 12, 2022, 8:41am UTC](https://forum.keycloak.org/t/springboot-application-with-keycloak-adapter-not-working-behind-an-https-proxy/15845/13 "2022-09-12T08:41:35Z")
For future readers: Setting `ssl-required` to “all” was not the correct way. Solution was adding the RemoteIpFilter to Tomcat (which is probably comparable of configuring `server.forward-headers-strategy` in a spring boot application) so that the x-forwarded-proto header is used by Tomcat: ```auto RemoteIpFilter org.apache.catalina.filters.RemoteIpFilter protocolHeader x-forwarded-proto RemoteIpFilter /* REQUEST ``` ---
**Author:** ![hendersonweb](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/hendersonweb/32/7017_2.png) [@hendersonweb](https://forum.keycloak.org/u/hendersonweb)\ **Post date:** [November 15, 2022, 10:45am UTC](https://forum.keycloak.org/t/springboot-application-with-keycloak-adapter-not-working-behind-an-https-proxy/15845/14 "2022-11-15T10:45:44Z")
Were you able to find the solution. I’m also facing the same problem. ---
**Author:** ![aanciaes](https://avatars.discourse-cdn.com/v4/letter/a/f19dbf/32.png) [@aanciaes](https://forum.keycloak.org/u/aanciaes)\ **Post date:** [November 19, 2022, 10:12pm UTC](https://forum.keycloak.org/t/springboot-application-with-keycloak-adapter-not-working-behind-an-https-proxy/15845/15 "2022-11-19T22:12:05Z")
Unfortunately not. I still think this is an issue with the adapter but couldn’t find a solution. I’ve abandoned the idea. ---
**Author:** ![jsplate](https://avatars.discourse-cdn.com/v4/letter/j/839c29/32.png) [@jsplate](https://forum.keycloak.org/u/jsplate)\ **Post date:** [January 4, 2023, 4:58pm UTC](https://forum.keycloak.org/t/springboot-application-with-keycloak-adapter-not-working-behind-an-https-proxy/15845/16 "2023-01-04T16:58:50Z")
Me too! 😒 Is there any example code for a docker application with nginx, keycloak and tomcat? ---
**Author:** ![ajitp3](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/ajitp3/32/7816_2.png) [@ajitp3](https://forum.keycloak.org/u/ajitp3)\ **Post date:** [February 28, 2023, 6:41pm UTC](https://forum.keycloak.org/t/springboot-application-with-keycloak-adapter-not-working-behind-an-https-proxy/15845/17 "2023-02-28T18:41:01Z")
A sample docker-compose file it use to test nginx and keycloak ```auto version: '3' volumes: postgres_data_v2: driver: local services: postgres: image: postgres:11 volumes: - postgres_data_v2:/var/lib/postgresql/data2 environment: POSTGRES_DB: keycloak POSTGRES_USER: keycloak POSTGRES_PASSWORD: password ports: - 5433:5432 keycloak: image: quay.io/phasetwo/phasetwo-keycloak:latest container_name: mykeycloak volumes: - ./realm/realm-export.json:/tmp/import-realm.json environment: PROXY_ADDRESS_FORWARDING: 'true' KEYCLOAK_USER: admin KEYCLOAK_PASSWORD: password KEYCLOAK_ADMIN: admin KEYCLOAK_ADMIN_PASSWORD: password KC_DB_URL_HOST: postgres KC_DB_URL_DATABASE: keycloak KC_DB_SCHEMA: public KC_DB_USERNAME: keycloak KC_DB_PASSWORD: password KC_HOSTNAME_STRICT: 'false' KC_HTTP_ENABLED: 'true' KC_PROXY: 'edge' KC_LOG_LEVEL: INFO JAVA_OPTS: '-server -Xms1024m -Xmx1024m' KEYCLOAK_IMPORT: /tmp/import-realm.json command: start ports: - 8080:8080 depends_on: - postgres rproxy: image: nginx:latest container_name: nginx_rproxy restart: unless-stopped volumes: - ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro - ./www:/data/www:ro - ./cert:/etc/cert:ro ports: - 80:80 - 443:443 ``` Nginx conf ```auto % cat nginx/nginx.conf events { } http { server { listen 80; server_name _; return 301 https://$host$request_uri; } server { # settings added upstream sent too big header while proxy_busy_buffers_size 512k; proxy_buffers 4 512k; proxy_buffer_size 256k; include /etc/nginx/mime.types; listen 443 ssl; ssl_protocols TLSv1.2 TLSv1.3; ssl_certificate /etc/cert/fullchain.pem; ssl_certificate_key /etc/cert/privkey.pem; add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; add_header Content-Security-Policy "default-src 'self'; frame-ancestors 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src https://my-test-host.com;"; #add_header X-Content-Type-Options nosniff; # cannot apply now because of open keycloak issue https://issues.redhat.com/browse/KEYCLOAK-17076 add_header X-XSS-Protection: "1; mode=block"; proxy_set_header X-Forwarded-For $proxy_protocol_addr; # To forward the original client's IP address proxy_set_header X-Forwarded-Proto $scheme; # to forward the original protocol (HTTP or HTTPS) proxy_set_header Host $host; # to forward the original host requested by the client location / { proxy_pass http://mykeycloak:8080; } } } ``` ---
**Author:** ![mfarewell](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/mfarewell/32/8827_2.png) [@mfarewell](https://forum.keycloak.org/u/mfarewell)\ **Post date:** [June 21, 2023, 9:06pm UTC](https://forum.keycloak.org/t/springboot-application-with-keycloak-adapter-not-working-behind-an-https-proxy/15845/18 "2023-06-21T21:06:05Z")
I am using Spring Security rather than Spring Boot. The strategy that worked for me was a variation on that of @olla above. Set ssl-required to “all”, confidential-port to “443” in keycloak.json. I added the filters to my web.xml but it didn’t work for me, adding the following to my tomcat server.conf: ```auto ``` and ProxyRequests Off ProxyPreserveHost On RequestHeader set X-Forwarded-Proto “https” In my apache ssl config got it working.