title: What is the purpose of redirection-url in keycloak gatekeeper?
body: <p>I'm trying to set up Keycloak Gatekeeper as a reverse proxy in front of my service, but I don't know what the purpose is of the <code>redirection-url</code>. I figured I could just put Gatekeeper in front of my service, without my service needing to know anything about the authn/z. This doesn't seem possible if it needs a callback endpoint.</p>
  
  <p>I was able to deploy the Keycloak Server, Keycloak Gatekeeper, and a simple node service (all deployed locally in docker containers). With a bit of hacking to my hosts file, I was able to send a request to Gatekeeper, which properly authenticated me and redirected me back to my node service. However, my node service needed to add a <code>/oauth/callback</code> endpoint, since Gatekeeper adds that suffix to whatever is specified in the <code>redirection-url</code>.</p>
  
  <p>Here is what my Gatekeeper config looks like:</p>
  
  <pre><code>discovery-url: http://keycloak-server:8080/auth/realms/master
  client-id: proxy-node-server
  client-secret: abcabcab-abca-abca-abca-abcabcabcabc
  listen: ':3001'
  enable-refresh-tokens: true
  redirection-url: http://node-server:3000
  encryption-key: &lt;ENCRYPTION_KEY&gt;
  upstream-url: http://node-server:3000
  resources:
  - uri: /*
  secure-cookie: false
  </code></pre>
  
  <p>I expect to be able to put Gatekeeper in front of a service that has no knowledge of authentication, authorization, OIDC, etc, but with the <code>redirection-url</code> that doesn't seem possible.</p>
  
  <p>Is there any way to get Gatekeeper to do authnz when needed and just act as a simple proxy when the user is properly authenticated? Or is there something I don't understand where this is not possible?</p>