title: HAProxy, Keycloak with x509
body: <p>I have an HAProxy as a reverse proxy to my application which has x509 authentication. HAProxy does X509 validation (client certificate based) and and add the certificate back to request header <code>SSL_CLIENT_CERT</code>. Now I want to identify the user from the certificate using Keycloak. I have Keycloak authentication flow as given in <a href="https://www.keycloak.org/docs/latest/server_admin/#_x509" rel="nofollow noreferrer">doc</a> and my haproxy config is as follows</p>
  <pre><code>frontend http-frontend
      bind *:8888
      bind *:8888 transparent ssl crt /etc/x509/https/haproxy.pem ca-file /etc/x509/https/myCA.pem verify required
      http-request redirect scheme https if !{ ssl_fc }
      http-request set-header SSL_CLIENT_CERT %[ssl_c_der,base64]
      default_backend app1
  
  backend app1
      server server1 host.docker.internal:8443/auth/realms/ng/protocol/openid-connect/auth ssl verify none
  </code></pre>
  <ol>
  <li>What should be the Keycloak url to be forwarded from HAProxy?</li>
  <li>Is <code>CERT_CHAIN</code> header mandatory (if yes, how to get it. ssl_c_der contains server cert with issuer. Should I split them?)</li>
  <li>After user is extracted, will Keycloak redirect to the url in client. If yes, how do I mention a client name in HAProxy?</li>
  <li>What should be the settings for that specific `client' ? (oidc/public/standard-flow)</li>
  <li>After the redirect, how will the application get the access token?</li>
  </ol>
  <p>I also tried to forward the request to web app from HAProxy and try to login via authorisation-code flow. But Keycloak throws an error may be because, I have only <code>x509 username form execution</code> in the custom browser auth flow.</p>