Charts: Keycloak Invalid parameter: redirect_uri nginx-ingress

[miguel-veliz]

Is this a request for help?:

Yes

Version of Helm and Kubernetes:

EKS

Which chart:

stable/keycloak

What happened:
Invalid parameter: redirect_uri

How to reproduce it (as minimally and precisely as possible):

Base install of stable/keycloak with the follwing values.yaml

extraEnv: |
    - name: PROXY_ADDRESS_FORWARDING
      value: "true"

Base install of stable/nginx-ingress with the following values.yaml

controller:
  config:
    proxy-protocol: "true"
    real-ip-header: "proxy_protocol"
    set-real-ip-from: "0.0.0.0/0"

  service:
    targetPorts:
      http: http
      https: http
    annotations:
      service.beta.kubernetes.io/aws-load-balancer-ssl-cert: "arn:aws:xxxx"
      service.beta.kubernetes.io/aws-load-balancer-backend-protocol: "http"
      service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "https"
      service.beta.kubernetes.io/aws-load-balancer-connection-idle-timeout: '3600'

web-ingress looks like this:

apiVersion: extensions/v1beta1
kind: Ingress
metadata:
  name: web-ingress
  annotations :
    kubernetes.io/tls-acme: "true"
    kubernetes.io/ingress.class: "nginx"
    ingress.kubernetes.io/force-ssl-redirect: "true"
spec:
  rules:
  - host: auth.mydomain.com
    http:
      paths:
      - backend:
          serviceName: keycloak-http
          servicePort: 80

So when i try going to https://auth.mydomain.com and click on admin console i get: Invalid parameter: redirect_uri

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Any further update will cause the issue/pull request to no longer be considered stale. Thank you for your contributions.

[stale[bot]]

This issue is being automatically closed due to inactivity.

[nccurry]

For future researchers you need to add the following environment variables to your keycloak pod:

- name: PROXY_ADDRESS_FORWARDING
  value: "true" 

This is documented on the keycloak container image page in the Enable proxy address forwarding section.

[wstewartii]

I'm running keycloak on eks with the nginx-ingress-controller and I get the same error with a clean install after setting

- name: PROXY_ADDRESS_FORWARDING
  value: "true" 

[timothyclarke]

Check the logs and make sure the remote app is not setting a bad redirect_uri such as https://myapp:0/path note the :0
You may need to set confidential-port: 443 in your apps keycloak config