title: Keycloak Admin console not accessible
body: <p>I'm trying to setup Keycloak on a root server but I cannot access the admin console from the internet.
  I've installed the keycloak server and put it behind an nginx reverse proxy on the same machine. I've setup a letsencrypt cert for the domain. I've also setup the admin user for keycloak via script.</p>
  
  <p>When I visit the server with it's domain <code>https://&lt;my-domain&gt;</code> I'm forwarded to <code>https://&lt;my-domain&gt;/auth</code> and there is the keycloak welcome page with a link to "Administration Console". This link points to <code>https://&lt;my-domain&gt;/admin</code> but shows a 404.</p>
  
  <p>At first I thought this might be a problem with nginx so I followed the guide in the docs to setup a load-balancer (<a href="https://www.keycloak.org/docs/latest/server_installation/index.html#_setting-up-a-load-balancer-or-proxy" rel="noreferrer">https://www.keycloak.org/docs/latest/server_installation/index.html#_setting-up-a-load-balancer-or-proxy</a>). There, under "Verify Configuration" it tells you to open the path <code>https://&lt;my-domain&gt;/auth/realms/master/.well-known/openid-configuration</code> which works as expected and I get a json file with several links and other information in it. However, none of those links do work - all give me a 404.</p>
  
  <p>When I try <code>https://&lt;my-domain&gt;/auth/realms/master</code> I get a JSON response. 
  So some links do work so I think it's not a problem with nginx but with keycloak itself.</p>
  
  <p>So the basic question is: How do I configure Keycloak so that I can access the admin console via internet? I've read that by default you can only access it on localhost but there must be a way to overwrite this default?</p>
  
  <p>The relevant nginx config:</p>
  
  <pre><code>upstream keycloak {
      server 127.0.0.1:8080;
  }
  
  server {
      listen 443 ssl http2;
      # some ssl configuration for letsencrypt
  
      location / {
          proxy_pass          http://keycloak;
          proxy_set_header    Host                $host;
          proxy_set_header    X-Real-IP           $remote_addr;
          proxy_set_header    X-Forwarded-For     $proxy_add_x_forwarded_for;
          proxy_set_header    X-Forwarded-Host    $host;
          proxy_set_header    X-Forwarded-Server  $host;
          proxy_set_header    X-Forwarded-Port    $server_port;
          proxy_set_header    X-Forwarded-Proto   $scheme;
      }
  }
  </code></pre>
  
  <p>Some parts in <code>keycloak/standalone/configuration/standalone.xml</code> that I've edited:</p>
  
  <pre class="lang-xml prettyprint-override"><code>&lt;subsystem xmlns="urn:jboss:domain:undertow:10.0" ...&gt;
      ...
      &lt;server name="default-server"&gt;
          &lt;http-listener name="default" 
              socket-binding="http" 
              redirect-socket="proxy-https"
              enable-http2="true"
              proxy-address-forwarding="true" /&gt;
          ...
      &lt;/server&gt;
      ...
  &lt;/subsystem&gt;
  ...
  &lt;interfaces&gt;
      &lt;interface name="management"&gt;
          &lt;any-address /&gt;
      &lt;/interface&gt;
      &lt;interface name="public"&gt;
          &lt;any-address /&gt;
      &lt;/interface&gt;
  &lt;/interfaces&gt;
  &lt;socket-binding-group name="standard-sockets" ...&gt;
      ...
      &lt;socket-binding name="proxy-https" port="443" /&gt;
      ...
  &lt;/socket-binding-group&gt;
  
  </code></pre>
  
  <p>EDIT</p>
  
  <p>I was able to fix it. The problem was that keycloak was redirecting the initial page from <code>https://&lt;my-domain&gt;/</code> to <code>https://&lt;my-domain&gt;/auth</code> but then in all other links this additional <code>/auth</code> was missing. So the admin link was pointing to <code>https://&lt;my-domain&gt;/admin/master/console</code> without the <code>/auth</code> part and this page wasn't existing. When I was manually typing the URL with <code>/auth</code> in it I got a page with a "loading.." message but all style and JavaScript files linked where also missing the <code>/auth</code> part in their URLs so nothing was working.</p>
  
  <p>To fix this I had now changed in <code>standalone.xml</code> the line <code>&lt;web-context&gt;auth&lt;/web-context&gt;</code> to <code>&lt;web-context&gt;/&lt;/web-context&gt;</code> and now everything behaves as expected. There is no redirecting anymore at the start page and all links do work without the <code>/auth</code> part in it. 
  However, it would be interesting why it wasn't working in the first place and how one solve this if the <code>/auth</code> redirection was intended.</p>