KEYCLOAK-8397 Remove deprecated proxy from docs
This commit is contained in:
stianst
Bruno Oliveira da Silva
parent
8cb975d273
commit
cf7e0253f3
2 changed files with 1 additions and 255 deletions
|
|
@ -46,6 +46,3 @@ include::topics/cache/eviction.adoc[]
|
||||||
include::topics/cache/replication.adoc[]
|
include::topics/cache/replication.adoc[]
|
||||||
include::topics/cache/disable.adoc[]
|
include::topics/cache/disable.adoc[]
|
||||||
include::topics/cache/clear.adoc[]
|
include::topics/cache/clear.adoc[]
|
||||||
ifeval::[{project_community}==true]
|
|
||||||
include::topics/proxy.adoc[]
|
|
||||||
endif::[]
|
|
||||||
|
|
|
||||||
|
|
@ -1,251 +0,0 @@
|
||||||
|
|
||||||
[[_proxy]]
|
|
||||||
== {project_name} Security Proxy
|
|
||||||
|
|
||||||
{project_name} has an HTTP(S) proxy that you can put in front of web applications and services where it is not possible to install the {project_name} adapter.
|
|
||||||
You can set up URL filters so that certain URLs are secured either by browser login and/or bearer token authentication.
|
|
||||||
You can also define role constraints for URL patterns within your applications.
|
|
||||||
|
|
||||||
=== Proxy Install and Run
|
|
||||||
|
|
||||||
Download the {project_name} proxy distribution from the {project_name} download pages and unzip it.
|
|
||||||
[source]
|
|
||||||
----
|
|
||||||
|
|
||||||
$ unzip keycloak-proxy-dist.zip
|
|
||||||
----
|
|
||||||
|
|
||||||
To run it you must have a proxy config file (which we'll discuss in a moment).
|
|
||||||
[source]
|
|
||||||
----
|
|
||||||
|
|
||||||
$ java -jar bin/launcher.jar [your-config.json]
|
|
||||||
----
|
|
||||||
|
|
||||||
If you do not specify a path to the proxy config file, the launcher will look in the current working directory for the file named `proxy.json`
|
|
||||||
|
|
||||||
=== Proxy Configuration
|
|
||||||
|
|
||||||
Here's an example configuration file.
|
|
||||||
[source,json]
|
|
||||||
----
|
|
||||||
|
|
||||||
{
|
|
||||||
"target-url": "http://localhost:8082",
|
|
||||||
"target-request-timeout": "60000",
|
|
||||||
"send-access-token": true,
|
|
||||||
"bind-address": "localhost",
|
|
||||||
"http-port": "8080",
|
|
||||||
"https-port": "8443",
|
|
||||||
"keystore": "classpath:ssl.jks",
|
|
||||||
"keystore-password": "password",
|
|
||||||
"key-password": "password",
|
|
||||||
"applications": [
|
|
||||||
{
|
|
||||||
"base-path": "/customer-portal",
|
|
||||||
"error-page": "/error.html",
|
|
||||||
"adapter-config": {
|
|
||||||
"realm": "demo",
|
|
||||||
"resource": "customer-portal",
|
|
||||||
"realm-public-key": "MIGfMA0GCSqGSIb",
|
|
||||||
"auth-server-url": "http://localhost:8081/auth",
|
|
||||||
"ssl-required" : "external",
|
|
||||||
"principal-attribute": "name",
|
|
||||||
"credentials": {
|
|
||||||
"secret": "password"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
,
|
|
||||||
"constraints": [
|
|
||||||
{
|
|
||||||
"pattern": "/users/*",
|
|
||||||
"roles-allowed": [
|
|
||||||
"user"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"pattern": "/admins/*",
|
|
||||||
"roles-allowed": [
|
|
||||||
"admin"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"pattern": "/users/permit",
|
|
||||||
"permit": true
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"pattern": "/users/deny",
|
|
||||||
"deny": true
|
|
||||||
}
|
|
||||||
]
|
|
||||||
}
|
|
||||||
]
|
|
||||||
}
|
|
||||||
----
|
|
||||||
|
|
||||||
==== Basic Config
|
|
||||||
|
|
||||||
The basic configuration options for the server are as follows:
|
|
||||||
|
|
||||||
target-url::
|
|
||||||
The URL this server is proxying. _REQUIRED_.
|
|
||||||
|
|
||||||
target-request-timeout::
|
|
||||||
The timeout (in ms) for the proxied request. _OPTIONAL_.
|
|
||||||
Default is 30000.
|
|
||||||
|
|
||||||
send-access-token::
|
|
||||||
Boolean flag.
|
|
||||||
If true, this will send the access token via the KEYCLOAK_ACCESS_TOKEN header to the proxied server. _OPTIONAL_.
|
|
||||||
Default is false.
|
|
||||||
|
|
||||||
bind-address::
|
|
||||||
DNS name or IP address to bind the proxy server's sockets to. _OPTIONAL_.
|
|
||||||
The default value is _localhost_
|
|
||||||
|
|
||||||
http-port::
|
|
||||||
Port to listen for HTTP requests.
|
|
||||||
If you do not specify this value, then the proxy will not listen for regular HTTP requests. _OPTIONAL_.
|
|
||||||
|
|
||||||
https-port::
|
|
||||||
Port to listen for HTTPS requests.
|
|
||||||
If you do not specify this value, then the proxy will not listen for HTTPS requests. _OPTIONAL_.
|
|
||||||
|
|
||||||
keystore::
|
|
||||||
Path to a Java keystore file that contains private key and certificate for the server to be able to handle HTTPS requests.
|
|
||||||
Can be a file path, or, if you prefix it with `classpath:` it will look for this file in the classpath. _OPTIONAL_.
|
|
||||||
If you have enabled HTTPS, but have not defined a keystore, the proxy will auto-generate a self-signed certificate and use that.
|
|
||||||
|
|
||||||
buffer-size::
|
|
||||||
HTTP server socket buffer size.
|
|
||||||
Usually the default is good enough. _OPTIONAL_.
|
|
||||||
|
|
||||||
buffers-per-region::
|
|
||||||
HTTP server socket buffers per region.
|
|
||||||
Usually the default is good enough. _OPTIONAL_.
|
|
||||||
|
|
||||||
io-threads::
|
|
||||||
Number of threads to handle IO.
|
|
||||||
Usually default is good enough.
|
|
||||||
_OPTIONAL_.
|
|
||||||
The default is the number of available processors * 2.
|
|
||||||
|
|
||||||
worker-threads::
|
|
||||||
Number of threads to handle requests.
|
|
||||||
Usually the default is good enough. _OPTIONAL_.
|
|
||||||
The default is the number of available processors * 16.
|
|
||||||
|
|
||||||
=== Application Config
|
|
||||||
|
|
||||||
Next under the `applications` array attribute, you can define one or more applications per host you are proxying.
|
|
||||||
|
|
||||||
base-path::
|
|
||||||
The base context root for the application.
|
|
||||||
Must start with '/'. _REQUIRED_.
|
|
||||||
|
|
||||||
error-page::
|
|
||||||
If the proxy has an error, it will display the target application's error page relative URL. _OPTIONAL_.
|
|
||||||
This is a relative path to the base-path.
|
|
||||||
In the example above it would be `/customer-portal/error.html`.
|
|
||||||
|
|
||||||
adapter-config::
|
|
||||||
_REQUIRED_.
|
|
||||||
Same configuration as any other {project_name} adapter.
|
|
||||||
// See <<_adapter_config,Adapter Config>>
|
|
||||||
|
|
||||||
proxy-address-forwarding::
|
|
||||||
Enable usage of X-Forwarded-For, X-Forwarded-Host, X-Forwarded-Proto when hosted behind another proxy/load-balancer.
|
|
||||||
|
|
||||||
==== Constraint Config
|
|
||||||
|
|
||||||
Next under each application you can define one or more constraints in the `constraints` array attribute.
|
|
||||||
A constraint defines a URL pattern relative to the base-path.
|
|
||||||
You can deny, permit, or require authentication for a specific URL pattern.
|
|
||||||
You can specify roles allowed for that path as well.
|
|
||||||
More specific constraints will take precedence over more general ones.
|
|
||||||
|
|
||||||
pattern::
|
|
||||||
URL pattern to match relative to the base-path of the application.
|
|
||||||
Must start with '/'. _REQUIRED._
|
|
||||||
You may only have one wildcard and it must come at the end of the pattern.
|
|
||||||
|
|
||||||
* Valid: [x-]`/foo/bar/*` and [x-]`/foo/*.txt`
|
|
||||||
* Not valid: [x-]`/*/foo/*`.
|
|
||||||
|
|
||||||
roles-allowed::
|
|
||||||
Array of strings of roles allowed to access this url pattern. _OPTIONAL_.
|
|
||||||
|
|
||||||
methods::
|
|
||||||
Array of strings of HTTP methods that will exclusively match this pattern and HTTP request. _OPTIONAL_.
|
|
||||||
|
|
||||||
excluded-methods::
|
|
||||||
Array of strings of HTTP methods that will be ignored when match this pattern. _OPTIONAL_.
|
|
||||||
|
|
||||||
deny::
|
|
||||||
Deny all access to this URL pattern. _OPTIONAL_.
|
|
||||||
|
|
||||||
permit::
|
|
||||||
Permit all access without requiring authentication or a role mapping. _OPTIONAL_.
|
|
||||||
|
|
||||||
permit-and-inject::
|
|
||||||
Permit all access, but inject the headers, if user is already authenticated. _OPTIONAL_.
|
|
||||||
|
|
||||||
authenticate::
|
|
||||||
Require authentication for this pattern, but no role mapping. _OPTIONAL_.
|
|
||||||
|
|
||||||
==== Header Names Config
|
|
||||||
|
|
||||||
Next under the list of applications you can override the defaults for the names of the header fields injected by the proxy (see <<_identity_headers, {project_name} Identity Headers>>). This mapping is optional.
|
|
||||||
|
|
||||||
keycloak-subject::
|
|
||||||
e.g.
|
|
||||||
MYAPP_USER_ID
|
|
||||||
|
|
||||||
keycloak-username::
|
|
||||||
e.g.
|
|
||||||
MYAPP_USER_NAME
|
|
||||||
|
|
||||||
keycloak-email::
|
|
||||||
e.g.
|
|
||||||
MYAPP_USER_EMAIL
|
|
||||||
|
|
||||||
keycloak-name::
|
|
||||||
e.g.
|
|
||||||
MYAPP_USER_ID
|
|
||||||
|
|
||||||
keycloak-access-token::
|
|
||||||
e.g.
|
|
||||||
MYAPP_ACCESS_TOKEN
|
|
||||||
|
|
||||||
[[_identity_headers]]
|
|
||||||
=== {project_name} Identity Headers
|
|
||||||
|
|
||||||
When forwarding requests to the proxied server, {project_name} Proxy will set some additional headers with values from the OIDC identity token it received for authentication.
|
|
||||||
|
|
||||||
KEYCLOAK_SUBJECT::
|
|
||||||
User id.
|
|
||||||
Corresponds to JWT `sub` and will be the user id {project_name} uses to store this user.
|
|
||||||
|
|
||||||
KEYCLOAK_USERNAME::
|
|
||||||
Username.
|
|
||||||
Corresponds to JWT `preferred_username`.
|
|
||||||
|
|
||||||
KEYCLOAK_EMAIL::
|
|
||||||
Email address of user if set.
|
|
||||||
|
|
||||||
KEYCLOAK_NAME::
|
|
||||||
Full name of user if set.
|
|
||||||
|
|
||||||
KEYCLOAK_ACCESS_TOKEN::
|
|
||||||
Send the access token in this header if the proxy was configured to send it.
|
|
||||||
This token can be used to make bearer token requests. Header field names can be configured using a map of `header-names` in configuration file:
|
|
||||||
+
|
|
||||||
[source,json]
|
|
||||||
----
|
|
||||||
|
|
||||||
{
|
|
||||||
"header-names" {
|
|
||||||
"keycloak-subject": "MY_SUBJECT"
|
|
||||||
}
|
|
||||||
}
|
|
||||||
----
|
|
||||||
Loading…
Reference in a new issue