Configuring a proxy for outgoing Keycloak HTTP requests

Security Assertion Markup Language (SAML) allows you to access multiple web-based applications using a single set of authentication credentials. It is possible to configure Keycloak to access a SAML server via a preconfigured proxy in situations where Keycloak’s host doesn’t have direct access to the internet.

1. Open a terminal and log in to your instance of Package Security Manager as an admin.

2. Open your installer file, where the docker-compose.yml file is located by running the command:

   # Replace <INSTALLER_LOCATION> with the location of your installer file (where the ``docker-compose.yml`` file is)
   cd <INSTALLER_LOCATION>
   
   You can see all the files contained in your current directory location by running the command ls -la in the terminal. You can look for the docker-compose.yml file this way, if necessary.

3. Open your docker-compose.yml file using your preferred file editor.

4. Find the Keycloak service section of the file, and under environment:, add the following lines:

   # Replace <PROXY_SITE_URL> with the URL of your SAML proxy
   HTTP_PROXY: <PROXY_SITE_URL>
   HTTPS_PROXY: <PROXY_SITE_URL>
   

5. Save your work and close the file. To verify your changes were saved, you can run the command:

   cat docker-compose.yml
   

   Here is an excerpt from a docker-compose.yml file to show you what your Keycloak section might look like.

   keycloak:
     image: ${DOCKER_REGISTRY}keycloak:${VERSION}
     environment:
     - KEYCLOAK_IMPORT=true
     - KC_DB_URL_HOST=${POSTGRES_HOST}
     - KC_DB_URL_PORT=5432
     - KC_DB_URL_DATABASE=keycloak
     - KC_DB_USERNAME=keycloak
     - KC_DB_PASSWORD=keycloak
     - KC_HOSTNAME=${DOMAIN}
     - KC_PROXY=edge
     - KC_HOSTNAME_STRICT_HTTPS=false
     - KC_HTTP_ENABLED=true
     - HTTP_PROXY: <PROXY_IP>:<PROXY_PORT>
     - HTTPS_PROXY: <PROXY_IP>:<PROXY_PORT>
   

6. Restart your instance of Package Security Manager.

   docker compose down
   docker compose up --detach