如何在Keycloak Java OIDC适配器中显式设置redirect_uri？

Great question! You’re right that the Keycloak Java Adapter automatically derives the redirect_uri from incoming request details (like scheme, server name, port, and context path) — but there are reliable ways to explicitly set it when you need to override this behavior. Here’s how to do it based on your setup:

1. Servlet/JSP Applications (Standard Adapter) #

If you’re using the core keycloak-servlet-adapter with a traditional web.xml config, add a context parameter to hardcode your desired redirect URI:

<web-app>
  <!-- Existing Keycloak configuration -->
  <context-param>
    <param-name>keycloak.redirect-uri</param-name>
    <param-value>https://your-app-domain.com/auth/callback</param-value>
  </context-param>
</web-app>

2. Spring Boot Integration #

For Spring Boot apps using the Keycloak Spring Boot starter, set the value directly in your configuration files:

In application.properties: #

keycloak.redirect-uri=https://your-app-domain.com/auth/callback

In application.yml: #

keycloak:
  redirect-uri: https://your-app-domain.com/auth/callback

3. Programmatic Configuration (Low-Level Usage) #

If you’re working directly with Keycloak’s OAuth2 client APIs (like AuthorizationRequest), manually set the redirect URI when building the request:

import org.keycloak.representations.adapters.config.AuthorizationRequest;

// ...

AuthorizationRequest authRequest = new AuthorizationRequest();
authRequest.setRedirectUri("https://your-app-domain.com/auth/callback");
// Add other required parameters (client ID, scope, etc.)

When to Use Explicit Configuration #

This is critical in scenarios where automatic derivation breaks, such as:

• Your app runs behind a reverse proxy/load balancer (internal HTTP URL differs from external HTTPS URL users interact with)
• You need a fixed callback path regardless of incoming request details
• Local testing with public callback URLs (e.g., using tools like ngrok)

内容的提问来源于stack exchange，提问作者rdmueller