title: Using Keycloak behind a reverse proxy: Could not open Admin loginpage because mixed Content
body: <p>so I have a problem getting keycloak 3.2.1 to work behind kong (0.10.3), a reverse proxy based on nginx. </p>
  
  <p>Scenario is:</p>
  
  <p>I call keycloak via my gateway-route via <code>https://{gateway}/auth</code> and it shows me the entrypoint with keycloak logo, link to admin console etc. - so far so good. </p>
  
  <p>But when clicking on administration console -> calling <code>https://{gateway}/auth/admin/master/console/</code> , keycloak tries to load its css/js via http (see screenie below), which my browser blocks because mixed content.</p>
  
  <p>I searched around and found this thread: <a href="https://stackoverflow.com/questions/35169503/keycloak-apache-server-configuration-with-mixed-content-problems">keycloak apache server configuration with &#39;Mixed Content&#39; problems</a> which lead to this github repo: <a href="https://github.com/dukecon/keycloak_postgres_https" rel="noreferrer">https://github.com/dukecon/keycloak_postgres_https</a></p>
  
  <p>From there on, I tried to integrate its' cli into my dockerfile with success (did not change the files' contents, just copied them into my repo and add/run them from dockerfile). This is my dockerfile right now:</p>
  
  <pre><code>FROM jboss/keycloak-postgres:3.2.1.Final
  
  USER root
  
  ADD config.sh /tmp/
  ADD batch.cli /tmp/
  
  RUN bash /tmp/config.sh
  
  #Give correct permissions when used in an OpenShift environment.
  RUN chown -R jboss:0 $JBOSS_HOME/standalone &amp;&amp; \
      chmod -R g+rw $JBOSS_HOME/standalone
  
  USER jboss
  EXPOSE 8080
  </code></pre>
  
  <p>Sadly, my problem still exists:
  <a href="https://i.stack.imgur.com/K2qVE.png" rel="noreferrer"><img src="https://i.stack.imgur.com/K2qVE.png" alt="error"></a></p>
  
  <p>So I am out of ideas for now and hope you could help me out:</p>
  
  <ul>
  <li><p>How do I tell keycloak to call its' css-files via https here? </p></li>
  <li><p>do I have to change something in the cli script? </p></li>
  </ul>
  
  <p>Here's the content of the script:</p>
  
  <p>config.sh:</p>
  
  <pre><code>#!/bin/bash -x
  
  set -e
  
  JBOSS_HOME=/opt/jboss/keycloak
  JBOSS_CLI=$JBOSS_HOME/bin/jboss-cli.sh
  JBOSS_MODE=${1:-"standalone"}
  JBOSS_CONFIG=${2:-"$JBOSS_MODE.xml"}
  
  echo "==&gt; Executing..."
  cd /tmp
  
  $JBOSS_CLI --file=`dirname "$0"`/batch.cli
  
  # cf. http://stackoverflow.com/questions/34494022/permissions-error-when-using-cli-in-jboss-wildfly-and-docker
  /bin/rm -rf ${JBOSS_HOME}/${JBOSS_MODE}/configuration/${JBOSS_MODE}_xml_history/current
  </code></pre>
  
  <p>and batch.cli:</p>
  
  <pre><code>embed-server --std-out=echo
  
  # http://keycloak.github.io/docs/userguide/keycloak-server/html/server-installation.html
  # 3.2.7.2. Enable SSL on a Reverse Proxy
  # First add proxy-address-forwarding and redirect-socket to the http-listener element.
  # Then add a new socket-binding element to the socket-binding-group element.
  
  batch
  
  /subsystem=undertow/server=default-server/http-listener=default:write-attribute(name=proxy-address-forwarding,value=true)
  
  /subsystem=undertow/server=default-server/http-listener=default:write-attribute(name=redirect-socket,value=proxy-https)
  
  /socket-binding-group=standard-sockets/socket-binding=proxy-https:add(port=443)
  
  run-batch
  
  stop-embedded-server
  </code></pre>
  
  <p>It may be of interest too, that kong is deployed on openshift with a route using a redirect from http to https ( "insecureEdgeTerminationPolicy": "Redirect" ).</p>