Browse Source

Correct keycloak proxy config

Some extra steps are needed to use keycloak with a reverse proxy.
This adjusts the apache config to send the required headers and
the keycloak server config to use them.

Since the openid configuration json page is constructed entirely
from these headers (and not from static configuration), this is
a good test that the entire system is working.

Change-Id: I662dc85836d640cb732f12f39e9a61607767fcf3
changes/46/820446/1
James E. Blair 6 months ago
parent
commit
f131ae98a8
  1. 1
      playbooks/roles/keycloak/templates/docker-compose.yaml.j2
  2. 2
      playbooks/roles/keycloak/templates/keycloak.vhost.j2
  3. 10
      testinfra/test_keycloak.py

1
playbooks/roles/keycloak/templates/docker-compose.yaml.j2

@ -11,6 +11,7 @@ services:
- KEYCLOAK_USER=admin
- KEYCLOAK_PASSWORD="{{ keycloak_admin_password }}"
- DB_VENDOR=h2
- PROXY_ADDRESS_FORWARDING=true
command:
-Djboss.bind.address.private=127.0.0.1
-Djboss.bind.address=127.0.0.1

2
playbooks/roles/keycloak/templates/keycloak.vhost.j2

@ -50,6 +50,8 @@
ProxyPass / http://localhost:8080/ retry=0
ProxyPassReverse / http://localhost:8080/
ProxyPreserveHost on
RequestHeader set "X-Forwarded-Proto" expr=%{REQUEST_SCHEME}
</VirtualHost>

10
testinfra/test_keycloak.py

@ -20,3 +20,13 @@ testinfra_hosts = ['keycloak01.opendev.org']
def test_keycloak_listening(host):
keycloak = host.socket("tcp://127.0.0.1:8080")
assert keycloak.is_listening
def test_keycloak_openid_config(host):
# This tests the proxy config since the output is determined by
# the proxy headers and is not hard-coded configuration.
cmd = host.run('curl --insecure '
'--resolve keycloak.opendev.org:443:127.0.0.1 '
'https://keycloak.opendev.org/auth/realms/master'
'/.well-known/openid-configuration')
assert ('"issuer":"https://keycloak.opendev.org/auth/realms/master"'
in cmd.stdout)

Loading…
Cancel
Save