Hide Keycloak admin console from public access

Question

We are considering using Keycloak for our public REST APIs (mostly Spring boot apps) to authorize and authenticate our users.

In order not to make the admin UI publicly available we want to restrict it. Our idea is to create two instances but access the same database.

1. the public Keycloak instance, which only publishes what is necessary eg the admin path is not accessible. In this instance only paths should be accessible like these recommended here: https://www.keycloak.org/server/reverseproxy#_exposed_path_recommendations .

2. a private Keycloak instance, which is only accessible from the internal.network, but offers the admin UI (console). With which one can then manage the users/permissions.

Is this a valid solution to have two different instances but with the same database or are there other best practices here to not publish the admin ui/paths?

Answer 1

Yes, this is definitely a common setup. Depending on your requirements, it is always recommended to have more than one instance of Keycloak on the same database, for availability reasons. Keycloak shares some in memory data (like sessions) in an Infinispan Cache, which is shared between one or more instances of Keycloak (generally referred to as a cluster)

You would then use a load balancer (like haproxy, nginx, apache, the choices are practically endless) and configure it to send requests to the actual Keycloak instances.

A possible setup could be the following: Using 4 Keycloak instances on 4 servers:

• public-keycloak-1.internal.example.com
• public-keycloak-2.internal.example.com
• private-keycloak-1.internal.example.com
• private-keycloak-2.internal.example.com

You can then add 2 load balancers:

• keycloak.example.com (sending requests to public-keycloak-*)
• keycloak.internal.example.com (sending requests to private-keycloak-*)

In this example, keycloak.internal.example.com would be the instance you connect to, in order to perform administrative tasks in Keycloak via the Admin Console, or the Admin API, and keycloak.example.com would be the host that you use for Auth{n,z} for your applications.

Restricting access to the Admin API and Admin Console can be done at the load balancer level (restricting requests to those paths), but since Keycloak 20, it is also possible to completely disable the Admin API and Admin console. This is done through the disabling the respective features seen in the documentation . That way, you can disable the features "admin-api", "admin" and "admin2". If you do this on the public-keycloak-* instances, then requests to the public load balancer can never end up touching the Admin API or Console, because Keycloak is configured to simply not serve those requests in the first place.