Skip to content

Commit e89d121

Browse files
ahus1ahus1
committed
Deploying to main from @ 9e764b5f96cf864ddac69c3c09d4a9bc8eea4770 🚀
1 parent 3262575 commit e89d121

7 files changed

Lines changed: 101 additions & 11 deletions

File tree

‎extensions.html‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -272,7 +272,7 @@ <h5 class="card-title">Crossplane provider for Keycloak</h5>
272272
<div class="d-flex align-items-center">
273273
<img src="resources/images/github.png" width="16px" alt="GitHub logo"
274274
class="me-2"/>
275-
<span data-nosnippet>60 stars</span>
275+
<span data-nosnippet>61 stars</span>
276276
</div>
277277
</div>
278278
</div>
@@ -306,7 +306,7 @@ <h5 class="card-title">Event Listener Utilities</h5>
306306
<div class="d-flex align-items-center">
307307
<img src="resources/images/github.png" width="16px" alt="GitHub logo"
308308
class="me-2"/>
309-
<span data-nosnippet>298 stars</span>
309+
<span data-nosnippet>300 stars</span>
310310
</div>
311311
</div>
312312
</div>
@@ -408,7 +408,7 @@ <h5 class="card-title">Keycloak Helm Chart HelmForge</h5>
408408
<div class="d-flex align-items-center">
409409
<img src="resources/images/github.png" width="16px" alt="GitHub logo"
410410
class="me-2"/>
411-
<span data-nosnippet>21 stars</span>
411+
<span data-nosnippet>22 stars</span>
412412
</div>
413413
</div>
414414
</div>
@@ -768,7 +768,7 @@ <h5 class="card-title">Restrict Client Auth</h5>
768768
<div class="d-flex align-items-center">
769769
<img src="resources/images/github.png" width="16px" alt="GitHub logo"
770770
class="me-2"/>
771-
<span data-nosnippet>424 stars</span>
771+
<span data-nosnippet>426 stars</span>
772772
</div>
773773
</div>
774774
</div>

‎nightly/server/haproxy-reencrypt.html‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -158,6 +158,10 @@ <h2 id="haproxy-configuration-reencrypt"><a class="anchor" href="#haproxy-config
158158
http-request del-header uber-trace-id
159159
http-request del-header x-ot-span-context
160160

161+
# Optional. Forward client identities so that client certificate lookups work as expected
162+
http-request set-header Client-Cert %[ssl_c_der,base64] if { ssl_c_used } { ssl_c_verify 0 }
163+
http-request set-header Client-Cert-Chain %[ssl_c_chain_der,base64] if { ssl_c_used } { ssl_c_verify 0 }
164+
161165
# Public paths. Revisit the reverse proxy guide for the latest guidance. <i class="conum" data-value="4"></i><b>(4)</b>
162166
# With these settings, the redirect to the welcome screen or Admin UI will not work from external IP addresses, and this is expected.
163167
acl is_public_path path_beg /realms/
@@ -315,6 +319,24 @@ <h2 id="keycloak-configuration-haproxy-reencrypt"><a class="anchor" href="#keycl
315319
</dd>
316320
</dl>
317321
</div>
322+
<div class="sect2">
323+
<h3 id="_enabling_client_certificate_lookups"><a class="anchor" href="#_enabling_client_certificate_lookups"></a>Enabling client certificate lookups</h3>
324+
<div class="paragraph">
325+
<p>To enable the client certificate lookups, the following CLI options are required when starting Keycloak:</p>
326+
</div>
327+
<div class="listingblock">
328+
<div class="content">
329+
<pre class="highlight"><code class="language-bash" data-lang="bash">bin/kc.[sh|bat] start --spi-x509cert-lookup--provider=haproxy --spi-x509cert-lookup--haproxy--ssl-client-cert=Client-Cert --spi-x509cert-lookup--haproxy--ssl-cert-chain=Client-Cert-Chain --spi-x509cert-lookup--haproxy--certificate-chain-length=2</code></pre>
330+
</div>
331+
</div>
332+
<div class="paragraph">
333+
<p>If the number of intermediate certificates in your certificate chain is longer than the default, you must set the
334+
<code>certificate-chain-length</code> option to an appropriate value. Otherwise, the provider will discard the request.</p>
335+
</div>
336+
<div class="paragraph">
337+
<p>See <a href="https://www.keycloak.org/nightly/server/reverseproxy">Configuring a reverse proxy</a> for more details.</p>
338+
</div>
339+
</div>
318340
</div>
319341
</div>
320342
<div class="sect1">

‎nightly/server/reverseproxy.html‎

Lines changed: 71 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -866,7 +866,13 @@ <h3 id="_enabling_client_certificate_lookup"><a class="anchor" href="#_enabling_
866866
<td class="tableblock halign-left valign-top"><p class="tableblock">The prefix of the headers holding additional certificates in the chain and used to retrieve individual
867867
certificates according to the length of the chain. For instance, a value <code>CERT_CHAIN</code> will tell the server
868868
to load additional certificates from headers <code>CERT_CHAIN_0</code> to <code>CERT_CHAIN_9</code> if <code>certificate-chain-length</code> is set to <code>10</code>.</p></td>
869-
<td class="tableblock halign-left valign-top"><p class="tableblock"><code>apache</code>, <code>haproxy</code>, <code>nginx</code></p></td>
869+
<td class="tableblock halign-left valign-top"><p class="tableblock"><code>apache</code>, <code>nginx</code></p></td>
870+
</tr>
871+
<tr>
872+
<td class="tableblock halign-left valign-top"><p class="tableblock">ssl-cert-chain</p></td>
873+
<td class="tableblock halign-left valign-top"><p class="tableblock">The name of the header holding the full certificate chain as a single value.
874+
All chain certificates are contained in one header rather than split across indexed headers.</p></td>
875+
<td class="tableblock halign-left valign-top"><p class="tableblock"><code>haproxy</code>, <code>rfc9440</code></p></td>
870876
</tr>
871877
<tr>
872878
<td class="tableblock halign-left valign-top"><p class="tableblock">certificate-chain-length</p></td>
@@ -876,6 +882,68 @@ <h3 id="_enabling_client_certificate_lookup"><a class="anchor" href="#_enabling_
876882
</tbody>
877883
</table>
878884
<div class="sect3">
885+
<h4 id="_configuring_the_haproxy_provider"><a class="anchor" href="#_configuring_the_haproxy_provider"></a>Configuring the HAProxy provider</h4>
886+
<div class="paragraph">
887+
<p>HAProxy can forward client certificates as base64-encoded DER using its <code>ssl_c_der,base64</code> and <code>ssl_c_chain_der,base64</code> sample fetches.
888+
The <code>haproxy</code> provider reads the client certificate from the <code>ssl-client-cert</code> header and the certificate chain from the <code>ssl-cert-chain</code> header.</p>
889+
</div>
890+
<div class="paragraph">
891+
<p>The options and defaults specific to <code>haproxy</code> are as follows:</p>
892+
</div>
893+
<table class="tableblock frame-all grid-all fit-content">
894+
<colgroup>
895+
<col>
896+
<col>
897+
<col>
898+
</colgroup>
899+
<thead>
900+
<tr>
901+
<th class="tableblock halign-left valign-top">Option</th>
902+
<th class="tableblock halign-left valign-top">Description</th>
903+
<th class="tableblock halign-left valign-top">Default</th>
904+
</tr>
905+
</thead>
906+
<tbody>
907+
<tr>
908+
<td class="tableblock halign-left valign-top"><p class="tableblock">ssl-client-cert</p></td>
909+
<td class="tableblock halign-left valign-top"><p class="tableblock">The name of the header holding the client certificate.</p></td>
910+
<td class="tableblock halign-left valign-top"><p class="tableblock">(none)</p></td>
911+
</tr>
912+
<tr>
913+
<td class="tableblock halign-left valign-top"><p class="tableblock">ssl-cert-chain</p></td>
914+
<td class="tableblock halign-left valign-top"><p class="tableblock">The name of the header holding the full certificate chain as a single base64-encoded DER value. HAProxy&#8217;s <code>ssl_c_chain_der,base64</code> produces the concatenated DER encoding of all CA certificates in one value.</p></td>
915+
<td class="tableblock halign-left valign-top"><p class="tableblock">(none)</p></td>
916+
</tr>
917+
<tr>
918+
<td class="tableblock halign-left valign-top"><p class="tableblock">certificate-chain-length</p></td>
919+
<td class="tableblock halign-left valign-top"><p class="tableblock">The maximum number of certificates to load from the chain header.</p></td>
920+
<td class="tableblock halign-left valign-top"><p class="tableblock">1</p></td>
921+
</tr>
922+
</tbody>
923+
</table>
924+
<div class="paragraph">
925+
<p>Example HAProxy configuration:</p>
926+
</div>
927+
<div class="listingblock">
928+
<div class="content">
929+
<pre class="highlight"><code>http-request set-header Client-Cert %[ssl_c_der,base64] if { ssl_c_used } { ssl_c_verify 0 }
930+
http-request set-header Client-Cert-Chain %[ssl_c_chain_der,base64] if { ssl_c_used } { ssl_c_verify 0 }</code></pre>
931+
</div>
932+
</div>
933+
<div class="paragraph">
934+
<p>Corresponding Keycloak configuration:</p>
935+
</div>
936+
<div class="listingblock">
937+
<div class="content">
938+
<pre class="highlight"><code class="language-bash" data-lang="bash">bin/kc.[sh|bat] start --spi-x509cert-lookup--provider=haproxy --spi-x509cert-lookup--haproxy--ssl-client-cert=Client-Cert --spi-x509cert-lookup--haproxy--ssl-cert-chain=Client-Cert-Chain --spi-x509cert-lookup--haproxy--certificate-chain-length=2</code></pre>
939+
</div>
940+
</div>
941+
<div class="paragraph">
942+
<p>If the number of intermediate certificates in your certificate chain is longer than the default, you must set the
943+
<code>certificate-chain-length</code> option to an appropriate value. Otherwise, the provider will discard the request.</p>
944+
</div>
945+
</div>
946+
<div class="sect3">
879947
<h4 id="_configuring_the_nginx_provider"><a class="anchor" href="#_configuring_the_nginx_provider"></a>Configuring the NGINX provider</h4>
880948
<div class="paragraph">
881949
<p>The NGINX SSL/TLS module does not expose the client certificate chain. Keycloak&#8217;s NGINX certificate lookup provider rebuilds it by using the Keycloak truststore.</p>
@@ -945,8 +1013,8 @@ <h4 id="_configuring_the_rfc9440_provider"><a class="anchor" href="#_configuring
9451013
</tbody>
9461014
</table>
9471015
<div class="paragraph">
948-
<p>If your certificate chain is longer than the default, you must set the <code>certificate-chain-length</code> option to an appropriate value.
949-
Otherwise, the provider will discard the request.</p>
1016+
<p>If the number of intermediate certificates in your certificate chain is longer than the default, you must set the
1017+
<code>certificate-chain-length</code> option to an appropriate value. Otherwise, the provider will discard the request.</p>
9501018
</div>
9511019
</div>
9521020
<div class="sect3">

‎nightly/ui-customization/quick-theme.html‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -223,7 +223,7 @@ <h3 id="_trying_out_your_new_theme"><a class="anchor" href="#_trying_out_your_ne
223223
<p>Your theme includes the images and colors you provided. They appear throughout the Account Console, Admin Console, and login page.</p>
224224
</div>
225225
<div class="paragraph">
226-
<p>Once your "Quick Theme" archive jar is deployed, you can fully test it using the procedures shown in the <a href="#themes">Themes chapter</a>. Essentially, you just need to choose your new theme on the Realm settings -&#8594; Themes tab.</p>
226+
<p>Once your "Quick Theme" archive jar is deployed, you can fully test it using the procedures shown in the <a href="https://www.keycloak.org/nightly/ui-customization/themes">Working with themes</a> guide. Essentially, you just need to choose your new theme on the Realm settings &#8594; Themes tab.</p>
227227
</div>
228228
</div>
229229
</div>

‎nightly/ui-customization/themes-react.html‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -185,7 +185,7 @@ <h2 id="_translating_the_pages"><a class="anchor" href="#_translating_the_pages"
185185
<h2 id="_using_the_pages"><a class="anchor" href="#_using_the_pages"></a>Using the pages</h2>
186186
<div class="sectionbody">
187187
<div class="paragraph">
188-
<p>To see how to further integrate the pages, we recommend that you take a look at the output of the tool in the <a href="#creating-your-own-console">Creating your own Console</a> chapter.</p>
188+
<p>To see how to further integrate the pages, we recommend that you take a look at the output of the tool in the <a href="https://www.keycloak.org/nightly/ui-customization/creating-your-own-console">Creating your own Console</a> guide.</p>
189189
</div>
190190
</div>
191191
</div> </div>

‎nightly/ui-customization/welcome-theme.html‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -109,7 +109,7 @@ <h1>Customizing the Welcome Theme</h1>
109109
<p>Since the welcome theme is not associated with a realm, it cannot be selected in the admin console like other themes.</p>
110110
</div>
111111
<div class="paragraph">
112-
<p>To change the welcome theme, create and deploy a new welcome theme as described in <a href="#_creating-a-theme">Creating a theme</a>. Then, start the Keycloak server using the <code>spi-theme&#8212;&#8203;welcome-theme</code> option.</p>
112+
<p>To change the welcome theme, create and deploy a new welcome theme as described in <a href="https://www.keycloak.org/nightly/ui-customization/themes#_creating-a-theme">Working with themes</a>. Then, start the Keycloak server using the <code>spi-theme&#8212;&#8203;welcome-theme</code> option.</p>
113113
</div>
114114
<div class="listingblock">
115115
<div class="content">

‎translations.html‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -896,7 +896,7 @@ <h1>Translations</h1>
896896
</tbody>
897897
</table>
898898

899-
<p data-nosnippet>(Statistics updated daily. Last update: 2026-05-26T06:24:58Z)</p>
899+
<p data-nosnippet>(Statistics updated daily. Last update: 2026-05-27T06:32:28Z)</p>
900900

901901
</div>
902902

0 commit comments

Comments
 (0)