我有一个与正式提供的docker-compose文件非常相似的文件
version: '3'
volumes:
mysql_data:
driver: local
services:
mysql:
image: mysql:5.7
volumes:
- mysql_data:/var/lib/mysql
environment:
MYSQL_ROOT_PASSWORD: root
MYSQL_DATABASE: keycloak
MYSQL_USER: keycloak
MYSQL_PASSWORD: mypassword
keycloak:
image: jboss/keycloak
environment:
DB_VENDOR: MYSQL
DB_ADDR: mysql
DB_DATABASE: keycloak
DB_USER: keycloak
DB_PASSWORD: mypass
KEYCLOAK_USER: admin
KEYCLOAK_PASSWORD: mypass
# It didn't look like this actually got set.
PROXY_ADDRESS_FORWARDING: "true"
ports:
- 10000:8080
depends_on:
- mysql
我也有nginx配置文件,可以用作keycloak的反向代理
## Redirects all HTTP traffic to the HTTPS host
server {
listen 80;
listen [::]:80;
server_name keycloak keycloak.fqdn.com keycloak.fq.fqdn.com;
server_tokens off;
return 301 https://keycloak.fqdn.com$request_uri;
}
## HTTPS host
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name keycloak.fqdn.com;
server_tokens off;
autoindex off;
include conf.d/site-common-config/ssl.conf;
access_log /var/log/nginx/keycloak-access.log combined;
error_log /var/log/nginx/keycloak-error.log warn;
location / {
gzip on;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_pass http://127.0.0.1:10000;
}
}
根据我的理解,我进一步确认/auth/realms/master/.well-known/openid-configuration
返回的是正确的值。我一直遵循指南here,并且也更新了适当的xml文件并运行了reload命令以确保将proxy-address-forwarding
设置为true。但是我收到了javascript错误
Load denied by X-Frame-Options: https://keycloak.fqdn.com/auth/realms/master/protocol/openid-connect/login-status-iframe.html?version=4.3.0.final does not permit framing.
到目前为止,我仍无法在文档中找到任何东西来解决此问题,因此将不胜感激。
答案 0 :(得分:0)
在领域配置中配置X-Frame-Options
并允许您的域在那里。也许您还需要调整Content-Security-Policy
。
文档:https://www.keycloak.org/docs/latest/server_admin/index.html#clickjacking
答案 1 :(得分:0)
如果我在nginx / openresty配置中添加以下标头,它将起作用:
location / {
…
add_header X-Frame-Options "SAMEORIGIN";
…
}
如果要使用kcadm.sh更改领域中的值(因为gui无法正常工作),则可以使用以下方式导出,编辑和导入领域
sudo -u keycloak /opt/keycloak/bin/kcadm.sh config credentials --realm master --user admin --server http://localhost:8080/auth
sudo -u keycloak /opt/keycloak/bin/kcadm.sh get realms/master > realm.json
# edit realm.json
sudo -u keycloak /opt/keycloak/bin/kcadm.sh update realms/master -f realm.json