Keycloak Behind Reverse Proxy
To run keycloak behind reverse proxy servers, you must forward client headers and set public hostnames. The front server handles TLS certificates and routes incoming login traffic to the private identity server. Teams use this design to hide internal auth services from the public internet. Still, broad role mappings in your identity server often grant engineers wide permissions across internal tools. Once a user logs in, the identity server cannot limit what commands they run inside databases.
Keycloak + Reverse Proxy Security: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
To run keycloak behind reverse proxy servers, you must forward client headers and set public hostnames. The front server handles TLS certificates and routes incoming login traffic to the private identity server. Teams use this design to hide internal auth services from the public internet. Still, broad role mappings in your identity server often grant engineers wide permissions across internal tools. Once a user logs in, the identity server cannot limit what commands they run inside databases.
How keycloak behind reverse proxy routing works
A reverse proxy sits at the network edge and receives all public login requests first. It terminates the public HTTPS connection or passes encrypted traffic straight to the backend server. When it terminates TLS, the edge server strips encryption and sends plain traffic over a private network. The identity server needs to know the original client IP address and the public web protocol. You must set the edge server to attach standard forwarding headers to every incoming request.
Next, you tell the identity server which proxy mode matches your edge TLS setup. You also define the public hostname so the server builds valid redirect links for login pages. If these settings do not match, users will hit broken redirect loops during login. Admin consoles should stay on a separate internal port or require strict IP allowlists at the edge. This step stops outside attackers from guessing admin passwords on your public web address.
What edge routing solves and what it misses
Putting your identity provider behind an edge server centralizes TLS certificate management in one place. It protects the auth backend from direct web traffic and hides internal network addresses. You can also apply rate limits at the edge to block brute force login attacks. Once the user proves their identity, the server issues a token with their assigned group roles. This setup handles single sign-on well for standard web apps.
Still, an identity provider only checks who logs in at the start of a session. It does not inspect individual SQL queries or shell commands after the login finishes. Teams often map identity groups to shared database accounts or broad cloud roles for daily work. An engineer with a valid token can still drop a table or read raw customer data. Static role checks cannot approve dangerous commands in flight or rewrite sensitive fields like emails and card numbers.
Securing internal admin paths and tokens
To keep your identity server safe, block public traffic to management endpoints and health checks. Your edge server should only forward paths that normal users need for login flows and token exchange. Keep internal management ports bound to private network interfaces that only your admin team can reach. Short token lifetimes also reduce the risk if a user device gets compromised during work.
Keycloak + Reverse Proxy Security: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
Even with short token lifetimes, shared backend credentials remain a major risk for engineering teams. Developers often need direct database or server sessions to fix bugs in production systems. Passing static passwords to local machines creates audit blind spots across your whole stack. You need a way to link every single query and command back to the user identity.
Check database and API queries on the wire
Identity tools, roles, and network rules decide who opens a session. Setup alone cannot check what each query does or mask sensitive values in a response once a session starts. When workflows touch Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, or internal HTTP APIs, hoop.dev runs beside those services as an open-source proxy, a sidecar for your Postgres or API. It inspects requests coming in and results going back on the wire.
Your login details and client tools stay as they are while hoop.dev guardrails refuse bad deletes or drops before they run. On responses, hoop.dev data masking rewrites matched sensitive values in memory. Furthermore, hoop.dev holds SOC 2 Type II, is MIT licensed, and writes every query and decision to an audit trail that generates evidence for HIPAA, GDPR, and PCI DSS. See the source on GitHub.
Frequently asked questions
Why do users get redirect loops after login?
Redirect loops happen when the identity server does not trust the forwarded protocol header. Check that your edge server sends the HTTPS protocol header and the backend reads it.
Should the admin console use the same public URL?
No, exposing the admin console to the public internet increases your attack surface. Route admin traffic through a private network or restrict the admin path by IP address.
Why does the audit log show the same IP for every user?
The identity server logs the edge server address if client IP headers are missing. Tell your edge server to send the client IP header and tell the backend to trust it.
Short role checks help teams work fast. Simple rules make each review clear. Good logs keep every team safe. Scoped keys stop bad changes early.