nginx keycloak spring boot 反向代理重定向循环答案

【问题标题】：nginx keycloak spring boot reverse proxy redirect loopnginx keycloak spring boot 反向代理重定向循环
【发布时间】：2021-08-03 03:16:49
【问题描述】：

我已经对 spring boot 应用程序和 keycloak 进行了 dockerized 授权。所以，我尝试使用 nginx 作为反向代理（nginx 未 dockerized）。当我在没有 ssl 的情况下使用 nginx 时，它可以完美运行。但是当我尝试使用 https 到 http 重定向启用 ssl 时，keycloak 在输入凭据后会陷入重定向循环。我的 nginx 配置

# For more information on configuration, see:
#   * Official English Documentation: http://nginx.org/en/docs/
#   * Official Russian Documentation: http://nginx.org/ru/docs/

user docker-user;
worker_processes auto;
error_log /var/log/nginx/error.log;
pid /run/nginx.pid;

# Load dynamic modules. See /usr/share/doc/nginx/README.dynamic.
include /usr/share/nginx/modules/*.conf;

events {
    worker_connections 1024;
}

http {
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    sendfile            on;
    tcp_nopush          on;
    tcp_nodelay         on;
    keepalive_timeout   65;
    types_hash_max_size 2048;

    ssl_session_cache   shared:SSL:10m;
    ssl_session_timeout 5m;
    ssl_prefer_server_ciphers on;
    ssl_stapling on;
    resolver 8.8.8.8;

    include             /etc/nginx/mime.types;
    default_type        application/octet-stream;

    include /etc/nginx/conf.d/*.conf;


   server {
    server_name myhost.com;
    listen 443 ssl; 
    ssl_certificate      /etc/nginx/ssl/certs/bundle.crt;
    ssl_certificate_key  /etc/nginx/ssl/certs/cert.key;  
    ssl_dhparam /etc/nginx/ssl/certs/dhparam.pem; 

    ssl_session_cache shared:le_nginx_SSL:10m;
    ssl_session_timeout 1440m;
    ssl_session_tickets off;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers off;
    ssl_ciphers "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384";

   
    error_page   500 502 503 504  /50x.html;
    location = /50x.html {
        root   /usr/share/nginx/html;
    }

    client_max_body_size 500M;
    proxy_read_timeout 3600;

        location /auth {
        proxy_http_version 1.1;
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Host $server_name;  
        proxy_pass          http://myhost.com:8080;
        proxy_redirect off;    
        }
        
       

        location / { 
        proxy_http_version 1.1;
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Host $server_name;          
        proxy_pass http://myhost.com:9010;
        proxy_redirect off;     
        }
    


        error_page 404 /404.html;
            location = /usr/share/nginx/html/50x.html/40x.html {
        }

        error_page 500 502 503 504 /50x.html;
            location = /usr/share/nginx/html/50x.html {
        }

}


server {
    if ($host = myhost.com) {
        return 301 https://$host$request_uri;
    } 
    server_name myhost.com;
    listen 80;
    return 404; 
}

}

spring boot 登录重定向循环

2021-05-13 10:45:25.756 ERROR 1 --- [qtp276869158-20] o.k.adapters.OAuthRequestAuthenticator   : failed to turn code into token
2021-05-13 10:45:25.757 ERROR 1 --- [qtp276869158-20] o.k.adapters.OAuthRequestAuthenticator   : status from server: 301
2021-05-13 10:45:25.757 ERROR 1 --- [qtp276869158-20] o.k.adapters.OAuthRequestAuthenticator   :    <html>
<head><title>301 Moved Permanently</title></head>
<body bgcolor="white">
<center><h1>301 Moved Permanently</h1></center>
<hr><center>nginx/1.14.1</center>
</body>
</html>

【问题讨论】：

标签： spring-boot nginx keycloak

【解决方案1】：

我解决了我的问题。
在 keycloak docker compose 文件中需要在 KEYCLOAK_FRONTEND_URL 中添加反向代理位置
点赞 KEYCLOAK_FRONTEND_URL：“https://myhost.com/auth”

【讨论】：