Fix Keycloak login: enable assume_ssl for reverse proxy #154

New issue

Closed

opened 2026-06-07 04:18:13 +00:00 by ldraney · 0 comments

ldraney commented

2026-06-07 04:18:13 +00:00

Owner

Type

Bug

Lineage

Related to ldraney/landscaping-assistant #151 (login page fix deployed but Keycloak rejects the redirect).

Repo

ldraney/landscaping-assistant

What Broke

Clicking "Sign in with Keycloak" on the login page shows Keycloak's grey "We are sorry" error page. Keycloak logs: error="invalid_redirect_uri", clientId="landscaping-assistant".

Root cause: config.assume_ssl = true is commented out in config/environments/production.rb. Without it, Rails doesn't trust X-Forwarded-Proto from the Tailscale funnel reverse proxy, so OmniAuth auto-derives the callback URL as http://... instead of https://.... Keycloak only accepts https://landscaping-assistant.tail5b443a.ts.net/auth/keycloak/callback.

Repro Steps

Visit https://landscaping-assistant.tail5b443a.ts.net/
Get redirected to /login
Click "Sign in with Keycloak"
Observe: Keycloak grey error page "We are sorry"

Expected Behavior

Clicking sign-in should show the Keycloak login form and authenticate the user.

Environment

Cluster/namespace: prod (landscaping-assistant)
Image: d42018a
Keycloak realm: landscaping, client: landscaping-assistant

Acceptance Criteria

Clicking sign-in shows Keycloak login form
Successful login redirects back to the app as authenticated user
Super admin can log in and see admin tabs

landscaping-assistant project
ldraney/landscaping-assistant #151 — login page fix (prerequisite, already deployed)

### Type Bug ### Lineage Related to `ldraney/landscaping-assistant #151` (login page fix deployed but Keycloak rejects the redirect). ### Repo `ldraney/landscaping-assistant` ### What Broke Clicking "Sign in with Keycloak" on the login page shows Keycloak's grey "We are sorry" error page. Keycloak logs: `error="invalid_redirect_uri"`, `clientId="landscaping-assistant"`. Root cause: `config.assume_ssl = true` is commented out in `config/environments/production.rb`. Without it, Rails doesn't trust `X-Forwarded-Proto` from the Tailscale funnel reverse proxy, so OmniAuth auto-derives the callback URL as `http://...` instead of `https://...`. Keycloak only accepts `https://landscaping-assistant.tail5b443a.ts.net/auth/keycloak/callback`. ### Repro Steps 1. Visit https://landscaping-assistant.tail5b443a.ts.net/ 2. Get redirected to /login 3. Click "Sign in with Keycloak" 4. Observe: Keycloak grey error page "We are sorry" ### Expected Behavior Clicking sign-in should show the Keycloak login form and authenticate the user. ### Environment - Cluster/namespace: prod (landscaping-assistant) - Image: d42018a - Keycloak realm: landscaping, client: landscaping-assistant ### Acceptance Criteria - [ ] Clicking sign-in shows Keycloak login form - [ ] Successful login redirects back to the app as authenticated user - [ ] Super admin can log in and see admin tabs ### Related - `landscaping-assistant` project - `ldraney/landscaping-assistant #151` — login page fix (prerequisite, already deployed)