1
<#import "/templates/guide.adoc" as tmpl>
2
<#import "/templates/kc.adoc" as kc>
3
<#import "/templates/links.adoc" as links>
6
title="Configuring the hostname"
7
summary="Learn how to configure the frontend and backchannel endpoints exposed by {project_name}."8
includedOptions="hostname hostname-* proxy">
12
{project_name} exposes different endpoints to talk with applications as well as to allow accessing the administration console. These endpoints13
can be categorized into three main groups:
17
* Administration Console
19
The base URL for each group has an important impact on how tokens are issued and validated, on how links are created for actions that require the user
20
to be redirected to {project_name} (for example, when resetting password through email links), and, most importantly, how applications will21
discover these endpoints when fetching the OpenID Connect Discovery Document from `realms/++{realm-name}++/.well-known/openid-configuration`.25
The frontend endpoints are those accessible through a public domain and usually related to authentication/authorization flows that happen
26
through the front-channel. For instance, when an SPA wants to authenticate their users it redirects them to the `authorization_endpoint` so that users
27
can authenticate using their browsers through the front-channel.
29
By default, when the hostname settings are not set, the base URL for these endpoints is based on the incoming request so that the HTTP scheme,
30
host, port, and path, are the same from the request. The default behavior also has a direct impact on how the server is going to issue tokens given that the issuer is also based on
31
the URL set to the frontend endpoints. If the hostname settings are not set, the token issuer will also be based on the incoming request and also lack consistency if the client is requesting tokens using different URLs.
33
When deploying to production you usually want a consistent URL for the frontend endpoints and the token issuer regardless of how the request is constructed.
34
In order to achieve this consistency, you can set either the `hostname` or the `hostname-url` options.
36
Most of the time, it should be enough to set the `hostname` option in order to change only the *host* of the frontend URLs:
38
<@kc.start parameters="--hostname=<host>"/>
40
When using the `hostname` option the server is going to resolve the HTTP scheme, port, and path, automatically so that:
42
* `https` scheme is used unless you set `hostname-strict-https=false`
43
* if the `proxy-headers` option is set, the proxy will use the default ports (i.e.: 80 and 443). If the proxy uses a different port, it needs to be specified via the `hostname-url` configuration option
45
However, if you want to set not only the host but also a scheme, port, and path, you can set the `hostname-url` option:
47
<@kc.start parameters="--hostname-url=<scheme>://<host>:<port>/<path>"/>
49
This option gives you more flexibility as you can set the different parts of the URL from a single option. Note that
50
the `hostname` and `hostname-url` are mutually exclusive.
54
By `hostname` and `proxy-headers` configuration options you affect only the static resources URLs, redirect URIs, OIDC well-known endpoints, etc. In order to change, where/on which port the server actually listens on, you need to use the `http/tls` configuration options (e.g. `http-host`, `https-port`, etc.). For more details, see <@links.server id="enabletls"/> and <@links.server id="all-config"/>.
59
The backend endpoints are those accessible through a public domain or through a private network. They are used for a direct communication
60
between the server and clients without any intermediary but plain HTTP requests. For instance, after the user is authenticated an SPA
61
wants to exchange the `code` sent by the server with a set of tokens by sending a token request to `token_endpoint`.
63
By default, the URLs for backend endpoints are also based on the incoming request. To override this behavior, set the `hostname-strict-backchannel` configuration option by entering this command:
65
<@kc.start parameters="--hostname=<value> --hostname-strict-backchannel=true"/>
67
By setting the `hostname-strict-backchannel` option, the URLs for the backend endpoints are going to be exactly the same as the frontend endpoints.
69
When all applications connected to {project_name} communicate through the public URL, set `hostname-strict-backchannel` to `true`.70
Otherwise, leave this parameter as `false` to allow client-server communication through a private network.
72
=== Administration Console
74
The server exposes the administration console and static resources using a specific URL.
76
By default, the URLs for the administration console are also based on the incoming request. However, you can set a specific host or base URL if you want
77
to restrict access to the administration console using a specific URL. Similarly to how you set the frontend URLs, you can use the `hostname-admin` and `hostname-admin-url` options to achieve that.
78
Note that if HTTPS is enabled (`http-enabled` configuration option is set to false, which is the default setting for the production mode), the {project_name} server automatically assumes you want to use HTTPS URLs. The admin console then tries to contact {project_name} over HTTPS and HTTPS URLs are also used for its configured redirect/web origin URLs. It is not recommended for production, but you can use HTTP URL as `hostname-admin-url` to override this behaviour.80
Most of the time, it should be enough to set the `hostname-admin` option in order to change only the *host* of the administration console URLs:
82
<@kc.start parameters="--hostname-admin=<host>"/>
84
However, if you want to set not only the host but also a scheme, port, and path, you can set the `hostname-admin-url` option:
86
<@kc.start parameters="--hostname-admin-url=<scheme>://<host>:<port>/<path>"/>
88
Note that the `hostname-admin` and `hostname-admin-url` are mutually exclusive.
90
To reduce attack surface, the administration endpoints for {project_name} and the Admin Console should not be publicly accessible.91
Therefore, you can secure them by using a reverse proxy.
92
For more information about which paths to expose using a reverse proxy, see <@links.server id="reverseproxy"/>.
95
The following are more example scenarios and the corresponding commands for setting up a hostname.
97
Note that the `start` command requires setting up TLS. The corresponding options are not shown for example purposes. For more details, see <@links.server id="enabletls"/>.
99
=== Exposing the server behind a TLS termination proxy
101
In this example, the server is running behind a TLS termination proxy and publicly available from `https://mykeycloak`.
104
<@kc.start parameters="--hostname=mykeycloak --http-enabled=true --proxy-headers=forwarded|xforwarded"/>
106
=== Exposing the server without a proxy
108
In this example, the server is running without a proxy and exposed using a URL using HTTPS.
110
.{project_name} configuration:111
<@kc.start parameters="--hostname-url=https://mykeycloak"/>
113
It is highly recommended using a TLS termination proxy in front of the server for security and availability reasons. For more details,
114
see <@links.server id="reverseproxy"/>.
116
=== Forcing backend endpoints to use the same URL the server is exposed
118
In this example, backend endpoints are exposed using the same URL used by the server so that clients always fetch the same URL
119
regardless of the origin of the request.
121
.{project_name} configuration:122
<@kc.start parameters="--hostname=mykeycloak --hostname-strict-backchannel=true"/>
124
=== Exposing the server using a port other than the default ports
126
In this example, the server is accessible using a port other than the default ports.
128
.{project_name} configuration:129
<@kc.start parameters="--hostname-url=https://mykeycloak:8989"/>
131
=== Exposing {project_name} behind a TLS reencrypt proxy using different ports133
In this example, the server is running behind a proxy and both the server and the proxy are using their own certificates, so the communication between {project_name} and the proxy is encrypted. The reverse proxy uses the `Forwarded` header and does not set the `X-Forwarded-*` headers. We need to keep in mind that the proxy configuration options (as well as hostname configuration options) are not changing the ports on which the server actually is listening on (it changes only the ports of static resources like JavaScript and CSS links, OIDC well-known endpoints, redirect URIs, etc.). Therefore, we need to use HTTP configuration options to change the {project_name} server to internally listen on a different port, e.g. 8543. The proxy will be listening on the port 8443 (the port visible while accessing the console via a browser). The example hostname `my-keycloak.org` will be used for the server and similarly the admin console will be accessible via the `admin.my-keycloak.org` subdomain.135
.{project_name} configuration:136
<@kc.start parameters="--proxy-headers=forwarded --https-port=8543 --hostname-url=https://my-keycloak.org:8443 --hostname-admin-url=https://admin.my-keycloak.org:8443"/>
138
WARNING: Usage of the `proxy-headers` option rely on `Forwarded` and `X-Forwarded-*` headers, respectively, that have to be set and overwritten by the reverse proxy.
139
Misconfiguration may leave {project_name} exposed to security issues. For more details, see <@links.server id="reverseproxy"/>.143
To troubleshoot the hostname configuration, you can use a dedicated debug tool which can be enabled as:
145
.{project_name} configuration:146
<@kc.start parameters="--hostname=mykeycloak --hostname-debug=true"/>
148
Then after {project_name} started properly, open your browser and go to:150
`http://mykeycloak:8080/realms/<your-realm>/hostname-debug`
152
.By default, this endpoint is disabled (`--hostname-debug=false`)