Nginx反向代理下Keycloak 21.1 HTTPS跳转问题排查

我正在学习使用Keycloak，希望禁用其HTTPS功能（无需考虑安全问题）。我的Docker配置如下：

keycloak:
image: quay.io/keycloak/keycloak:21.1
container_name: keycloak
restart: always
environment:
  KC_DB_URL: jdbc:postgresql://postgres:5432/keycloak
  KC_DB_USERNAME: postgres
  KC_DB_PASSWORD: foo
  KC_HTTP_RELATIVE_PATH: /auth/
  KC_PROXY: "passthrough"
  KC_HOSTNAME_STRICT: "false"
  KC_HOSTNAME_STRICT_HTTPS: "false"
  KC_HOSTNAME: "myurl.onion:4672/auth"
  KEYCLOAK_ADMIN: "admin"
  KEYCLOAK_ADMIN_PASSWORD: "bar"
entrypoint: ["/opt/keycloak/bin/kc.sh", "start-dev", "--db=postgres"]
ports:
  - 8080:8080
volumes:
  - /config/keycloak/themes/:/opt/keycloak/themes/
  - /config/keycloak/deployments:/opt/keycloak/providers
depends_on:
  - postgres
networks:
  - nt_int

Nginx代理配置如下：

listen 4672 default_server;
    listen [::]:4672 default_server;

    root /site;

    server_name _;
    server_tokens off;

    location /auth/ {
            proxy_pass                           http://keycloak:8080/auth/;
            proxy_set_header   X-Forwarded-Proto $scheme;
            proxy_set_header   Host              $host:$server_port;
            proxy_set_header   X-Real-IP         $remote_addr;
            proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
            proxy_set_header   X-Forwarded-Port  $server_port;
    }

可以正常访问Keycloak主页，但点击登录主领域时出现以下错误：

Mixed Content: The page at 'http://myurl.onion:4672/auth/admin/master/console/' was loaded over HTTPS, but requested an insecure frame 'http://myurl.onion:4672/auth/auth/realms/master/protocol/openid-connect/3p-cookies/step1.html'. This request has been blocked; the content must be served over HTTPS.

尝试过将KC_PROXY改为edge、手动禁用领域SSL、设置PROXY_ADDRESS_FORWARDING为true、切换到17.0.1版本，问题依旧。请问哪里配置错误？

核心问题 #

错误中出现重复的/auth/auth/路径，且Keycloak生成的URL协议为HTTP，与外部访问的HTTPS不匹配，导致混合内容拦截。这是由KC_HOSTNAME配置错误和代理协议头传递问题共同导致的。

具体修改步骤 #

1. 修正Keycloak环境变量
   • 移除KC_HOSTNAME末尾的/auth，避免路径重复：KC_HOSTNAME: "myurl.onion:4672"
   • 将KC_PROXY设为edge，让Keycloak信任代理传递的协议和端口信息
   • 保留KC_HOSTNAME_STRICT: "false"和KC_HOSTNAME_STRICT_HTTPS: "false"以禁用HTTPS强制检查

修改后的Docker环境变量片段：

environment:
  KC_DB_URL: jdbc:postgresql://postgres:5432/keycloak
  KC_DB_USERNAME: postgres
  KC_DB_PASSWORD: foo
  KC_HTTP_RELATIVE_PATH: /auth/
  KC_PROXY: "edge"
  KC_HOSTNAME_STRICT: "false"
  KC_HOSTNAME_STRICT_HTTPS: "false"
  KC_HOSTNAME: "myurl.onion:4672"
  KEYCLOAK_ADMIN: "admin"
  KEYCLOAK_ADMIN_PASSWORD: "bar"

2. 调整Nginx代理配置
   • 将X-Forwarded-Proto硬设为https，确保Keycloak识别外部请求使用的是HTTPS协议，避免生成HTTP链接
   • 其他代理头保持不变，确保主机和端口信息正确传递

修改后的Nginx location片段：

location /auth/ {
        proxy_pass                           http://keycloak:8080/auth/;
        proxy_set_header   X-Forwarded-Proto https;
        proxy_set_header   Host              $host:$server_port;
        proxy_set_header   X-Real-IP         $remote_addr;
        proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Port  $server_port;
}

3. 重启服务
   修改配置后，重启Keycloak和Nginx容器，验证登录流程是否正常。

内容的提问来源于stack exchange，提问作者Jacopo Sciampi