nginx - 使用 nginx 的 Keycloak 重定向 url 将转到 http 而不是 https | 尝试了stackoverflow上可用的多种解决方案

Question

我一直在尝试在 nginx 服务器后面设置 keycloak，但在通过 keycloak 验证任何应用程序时遇到问题。重定向 uri 始终是 http 而不是 https。当我在客户端设置的重定向 uri 中设置 http 而不是 https 时，一切都像魅力一样。

我已经尝试过的解决方案。

1. 在 nginx 配置中添加几行

    location / {
      proxy_pass http://keycloak:8080;
      proxy_http_version 1.1;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection "upgrade";

      proxy_set_header Host $host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-Scheme $scheme;
      proxy_set_header X-Forwarded-Proto $scheme;

    }

2. 根据https://www.keycloak.org/docs/latest/server_installation/index.html#enable-https-ssl-with-a-reverse-proxy编辑standalone.xml

<subsystem xmlns="urn:jboss:domain:undertow:11.0">
    ...
    <http-listener name="default" socket-binding="http"
        proxy-address-forwarding="true" redirect-socket="proxy-https"/>
    ...
</subsystem>

<socket-binding-group name="standard-sockets" default-interface="public"
    port-offset="${jboss.socket.binding.port-offset:0}">
    ...
    <socket-binding name="proxy-https" port="443"/>
    ...
</socket-binding-group>

3. 我当前的docker-compose.yml文件看起来像这样

version: '3.6'

services:

  keycloak:
    image: jboss/keycloak:12.0.4
    volumes:
      - ./standalone.xml:/opt/jboss/keycloak/standalone/configuration/standalone.xml
    environment:
      - DB_VENDOR=POSTGRES
      - DB_ADDR=<db_addr>
      - DB_PORT=<db_port>
      - DB_DATABASE=keycloak
      - DB_USER=keycloak
      - DB_SCHEMA=public
      - DB_PASSWORD=<db_password>
      - KEYCLOAK_USER=<username>
      - KEYCLOAK_PASSWORD=<password>
      - PROXY_ADDRESS_FORWARDING=true

## I am using nginx:1.19-alpine and installing certbot + copying nginx.conf
  proxy:
    build:
      context: .
      dockerfile: Dockerfile
    restart: always
    depends_on:
      - keycloak
    ports:
      - 80:80
      - 443:443

还有什么我想念的吗？？？

标签： nginxsslproxykeycloakreverse-proxy