Using public hostname and admin hostname - Keycloak 26.5.2

Configuring the server
1

Hello everyone!

I am happy to share my question with the keycloak community!

I have setup keycloak v26.5.2 with 2 separate hostnames:

-the public URL where the user is redirected to

-the internal admin URL where we (the vendor) have access to the API endpoints and the admin UI

This setup required the following changes in keycloak.conf:

-proxy-headers=xforwarded

-hostname-backchannel-dynamic=true

-hostname-admin=https://auth.cloud:40443

-hostname=https://auth.io:40443

I have also updated in the keycloak database the `keycloak.realm_attribute` of `frontendUrl` of the master realm to match the admin url https://auth.cloud:40443.

image
image540×720 80.1 KB

Please note that we have setup 2 keycloak nodes, behind 2 nginx reverse proxies that are served by a central keepalived VIP on linux.

This setup has currently the following behaviour:

-when the user access our web application, they are redirected to the public hostname for login. No issues, this works properly

-when the user tries to hit the root path of the public hostname which is https://auth.io:40443 they are redirected to https://auth.cloud:40443/admin which is not accessible because this DNS is resolved only internally for our internal communication . This is an issue because we would like to serve the admin url to the user as well. We would like to give them access to manage their users in the Keycloak admin UI. But this is currently resolved only by us internally.

Could you please let me know, is this behaviour possible? We would like to keep accessing keycloak using 2 separate hostnames as it is now, but allow the user to use the login and admin UI as well. While we internally should keep using the internal admin URL for the API endpoints and the backend.

Thank you for your time!

2

Hi!

If this behaviour is not feasible, can we do the following instead: disable the redirection from the public auth.io:40443 to the admin internal hostname auth.cloud:40443, I mean why the user gets redirected to the internal admin hostname when accessing the public hostname? There should be a way to hide this from the user.

Thank you.

3

The admin hostname setting is for everything under /admin path, no matter from which network one is accessing the admin resources.
If you request the root path of your Keycloak server, it automatically redirects you by default to /admin, thus your are getting redirected to the admin hostname.

If you want users from external network to be able to access admin resources, you either must not set admin hostname, or you have to ensure somehow that these users have a proper hostname resolution. There’s no differentiation between public admin resources and private/internal admin resources, there are only admin resources. Either with admin hostname settings, or without.

4

Hello Dasniko! thanks a lot for the provided details!