Exposing the Admin Console Using a Different URL

[pedroigor]

Hi,

We are facing issues when deploying the server in production where the administration console should be exposed using a URL other than the frontend URLs.

After the removal of the hostname-admin option from the server configuration, the admin URLs are now built based on the information from the request, and no longer from the hostname configuration. As a result, we are now forced to change the security-admin-console client to include among the list of valid redirect URIs the URL that the administration console should be exposed.

In order to improve the experience for this particular use case, I would like to propose that we bring back the hostname-admin configuration option so that we no longer need to update the security-admin-console to include a valid redirect URI. In fact, this is not only related to UX but also to align the hostname configuration to what is recommended in our documentation.

In addition to that, and based on @stianst idea, we should change the implementation to accept not only a hostname but also URLs when setting the hostname and hostname-admin configuration options, similar to what we have in the legacy distribution. It should give more flexibility when URLs should be more opinionated without any calculation based on the hostname.

/cc @thomasdarimont, @DGuhr, @andreaTP

[pedroigor]

Created #13681.

[squalou]

Hi,
I'm greatly interested in this.
Facing the same issue, I applied the security-admin-console tweak to make things work as expected, but still I wonder what the "officially" recommended way would be.

[pedroigor]

Does it work for you https://www.keycloak.org/server/hostname#_administration_console?

[squalou]

I tried with setting hostname-admin, then this host serves admin pages BUT, it still calls hostname for login, and fails with a "Sorry..." message, incorrect redirect uri.

Unless I add manually the full https://hostname-amin/path/to/some/where/... in security-admin-console redirect URIS, as you suggested, and it works, but it's weird to start a setup form scratch, configure it from env vars, and afterwards having to tweak this.

I did not try --hostname-strict-backchannel=true, do you think it could work ?

[pedroigor]

Did you try setting the full URL by setting hostname-admin-url=https://admin.mykeycloak.org ?

[squalou]

yes, but it had no effect.

Ah, also note that on the servers I'm trying, I'm still on Keycloak 18. (Keycloak 21 migration on its way). I should have start ed with this.

[kristof-karasz]

Hi everyone.

1. CLI
   --proxy edge
   --hostname-url=public_url
   --hostname-admin-url=private_url

2. Keycloak admin console
   master realm / Realm Settings / Frontend URL = the value of hostname-admin-url

[Arulaln-AR]

@kristof-karasz , I have followed the same steps provided by you. It is working.
Only thing which is not working is, when i user the hostname-url/auth/admin. it redirects to hostname-admin-url/auth/admin automatically. Is it something we can do it to restrict that within keycloak configuration?
I am doing that restriction using nginx layer at my end. But, that is not good right. because tomorrow if there are new paths added by keycloak then everytime we need to update this as well.
Your help will be appreciated on this please.

[squalou]

BTW : confirmed : works fine on keycloak 22 on my side.

[Arulaln-AR]

@squalou , For me also it is working.
Only thing which is not working is, when i use the hostname-url/auth/admin. it automatically redirects to hostname-admin-url/auth/admin. Our main idea is to not do that right? can you share your list of configurations done by you to make this work?