title: Keycloak behind apache reverse proxy
body: <p>I have surfed through google without finding any <strong>concrete</strong> answers or <strong>examples</strong>, so again trying my luck here (often get lucky).</p>
  
  <p><strong>The problem</strong></p>
  
  <ul>
  <li><p>I have a single spring boot RESTful service running behind an apache
  reverse proxy. This RESTful service is running HTTP only. Say it's running on
  local ip 172.s port 8080.</p></li>
  <li><p>I have also configured an apache reverse proxy. Say it's running on
  local ip 172.a and public ip 55.a. This proxy responds to both port 80, but all the HTTP traffic is automatically redirected to 443.</p></li>
  <li><p>I have another server running a standalone Keycloak server. Also
  this server is configured to be public accessible through the
  reverse proxy. Say it's running on local ip 172.k. This Keycloak server is running on HTTP-only. The HTTP requests are handled using SSL over the reverse proxy.</p></li>
  <li><p>Last, I have another frontend-webapp running on local ip 172.f. This frontend-webapp is running under Nodejs, and is also configured through the reverse proxy. It's also running only HTTP, but client(browser) is using SSL through the reverse proxy, just as for the Keycloak and RESTful service. This frontend is consuming the RESTful service, and is also configured to authenticate using the keycloak javascript adapter.</p></li>
  <li><p>The RESTful service is configured as bearer-only using Spring Boot Keycloak adapter, while the frontend app is configured with access type public.</p></li>
  </ul>
  
  <p>The RESTful service server, Keycloak server, and the frontend server are not public accessible; they are accessible only through the reverse proxy. But they can communicate with each other (since they are in the same private network).</p>
  
  <p>In the frontend keycloak.json file, the <code>auth-server-url</code> is set to the proxy url <code>https://example.com/auth</code>, and the frontend is able to successfully get a valid token. Now when I try to consume the RESTful service, I get a error in RESTful adapter that the token issuer is invalid. In the http-header I am, of course, sending the <code>Authorization: Bearer &lt;token&gt;</code>. The reason I am getting this error is that in RESTful keycloak configuation, I have configured the <code>auth-server-url</code> to use the local url <code>http://172.k:9080/auth</code>, so this url is different from the one in the token (which is <code>https://example.com/auth</code>).</p>
  
  <p><strong>Question</strong></p>
  
  <p>I cannot include the same <code>auth-server-url</code> in the RESTful service as for the frontend, because that will require me to also setup HTTPs on the RESTful service (because that url is https), and that will complicate stuff a lot, including the need to setup certificates and stuff like that. Also I think it's inefficient and not practical to setup SSL on local only servers.</p>
  
  <p>So my question is how I can make the adapter talk to the Keycloak without going through the reverse proxy. I want the RESTful adapter to talk to the Keyclok server for token verification through <code>auth-server-url: http://172.k:9080/auth</code>.</p>
  
  <p>Earlier there was a different url for backend, that got removed: <a href="https://issues.jboss.org/browse/KEYCLOAK-2623" rel="noreferrer">https://issues.jboss.org/browse/KEYCLOAK-2623</a></p>