blocks|key|3627270|text|在此场景中不允许使用AFAIK+*。在设置前端域时，尝试在最后添加/*：|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|3627271|https://myfrontend.dev.example.com/*|code-block|syntax|javascript|3627272|如果这仍然不起作用，请查看中的keycloak日志和响应头，并将它们发布到您的问题中。|3627273|entityMap^0|G|1|X|2|0|0|0^^$0|@$1|2|3|4|5|6|7|O|8|@$9|P|A|Q|B|C]|$9|R|A|S|B|C]]|D|@]|E|$]]|$1|F|3|G|5|H|7|T|8|@]|D|@]|E|$I|J]]|$1|K|3|L|5|6|7|U|8|@]|D|@]|E|$]]|$1|M|3|-4|5|6|7|V|8|@]|D|@]|E|$]]]|N|$]]

AFAIK <code>*</code> is not allowed in this scenario. When setting the frontend domain, try adding <code>/*</code> at the end:
<pre><code>https://myfrontend.dev.example.com/*
</code></pre>
If this still does not work, have a look at the keycloak logs as well as the response headers in Chrome devtools and post them to your question.

blocks|key|330288|text|经过几个小时的分析，不了解这里发生了什么：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|330289|330290|将works设置为*是可以的，而我建议将其显式地设置为正确的起源，在这里：https://myfrontend.dev.example.com+(没有/*，如卡住的答案)|unordered-list-item|offset|length|330291|，如果我们在跨源请求中检查/token端点，它会工作，因为预期的响应头被设置为|330292|，但是:这里的问题在/auth端点|330293|中出现。|330294|因此，无论是谁遇到了这个问题，Keycloak就像在10/2020版本的11.x版本中一样，根本不支持/auth+OpenID-connect端点上的CORS。这不是OIDC规范的要求，所以Keycloak+(和其他工具)在这里不支持CORS。|330295|如果我们设置work并启用CORS，那么它将适用于某些端点，例如/token，但对于一些不适用的端点，例如/auth。这是因为/auth被算作只有用户的端点，用户会显式地请求，或者用户将被重定向到而不是前端应该以某种方式在后台发送请求。|330296|我们在应用程序的一部分中实现了错误的工作流。没有钥匙斗篷(或traefik或kubernetes)问题。|330297|请查看这里的讨论以获得任何功能更新：https://keycloak.discourse.group/t/authorizationendpoint-does-not-support-cors/3495|330298|entityMap|0|LINK|mutability|MUTABLE|url|https://myfrontend.dev.example.com/|1|https://keycloak.discourse.group/t/authorizationendpoint-does-not-support-cors/3495^0|0|0|11|Y|0|0|0|0|0|0|0|0|I|2B|1|0^^$0|@$1|2|3|4|5|6|7|15|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|16|8|@]|9|@]|A|$]]|$1|C|3|D|5|E|7|17|8|@]|9|@$F|18|G|19|1|1A]]|A|$]]|$1|H|3|I|5|E|7|1B|8|@]|9|@]|A|$]]|$1|J|3|K|5|E|7|1C|8|@]|9|@]|A|$]]|$1|L|3|M|5|6|7|1D|8|@]|9|@]|A|$]]|$1|N|3|O|5|6|7|1E|8|@]|9|@]|A|$]]|$1|P|3|Q|5|6|7|1F|8|@]|9|@]|A|$]]|$1|R|3|S|5|6|7|1G|8|@]|9|@]|A|$]]|$1|T|3|U|5|6|7|1H|8|@]|9|@$F|1I|G|1J|1|1K]]|A|$]]|$1|V|3|-4|5|6|7|1L|8|@]|9|@]|A|$]]]|W|$X|$5|Y|Z|10|A|$11|12]]|13|$5|Y|Z|10|A|$11|14]]]]

After some hours of analysis, not understanding what happens here:
<ul>
<li>Setting the Web Origins to * is ok, while I suggest to set it explicitly to the right origins, here: <a href="https://myfrontend.dev.example.com" rel="nofollow noreferrer">https://myfrontend.dev.example.com</a> (without the /* as in Stuck's answer)</li>
<li>If we check the /token endpoint using within an cross-origin request, it works, because the expected response headers are set</li>
<li>BUT: the probleme here occured with the /auth endpoint</li>
</ul>
So, whoever runs into this problem, Keycloak as in 10/2020 with version 11.x does simply not support CORS on the /auth OpenID-connect OIDC endpoint. It is not a requirement from the OIDC specs, so Keycloak (and other tools) do not support CORS here.
If we set the Web Origin and have CORS enable, it will work for some endpoint, e.g. /token, but for some not, e.g. /auth.
This is because /auth is count as a user-only endpoint, a user would explicitly request or a user would be redirected to AND NOT the frontend should somehow send requests in the background to.
We have implemented a wrong workflow inside a part of our application. Not an keycloak (or traefik or kubernetes) problem.
Please check this discussion here for any feature updates:
<a href="https://keycloak.discourse.group/t/authorizationendpoint-does-not-support-cors/3495" rel="nofollow noreferrer">https://keycloak.discourse.group/t/authorizationendpoint-does-not-support-cors/3495</a>

We are currently facing the following problem for our Webapplication using Keycloak as an IDP behind an Traefik 1.7:
Chrome console tells us:
<pre><code>Access to manifest at 'https://keycloak.dev.example.com/auth/realms/myrealm/protocol/openid-connect/auth?client_id=myclient&amp;redirect_uri=...' (redirected from 'https://myfrontend.dev.example.com/manifest.json') from origin 'https://myfrontend.dev.example.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
</code></pre>
In keycloak we set Web Origins = * for client myclient inside the myrealm realm.
We already tried to set <a href="https://myfrontend.dev.example.com" rel="nofollow noreferrer">https://myfrontend.dev.example.com</a> as the Web Origins. That did not help.
We configured the Ingress inside the namespace where our keycloak is deployed. Adding the annotations:
<pre><code>ingress.kubernetes.io/cors-allow-origin: https://myfrontend.dev.example.com
ingress.kubernetes.io/enable-cors: &quot;true&quot;
</code></pre>
It did not help.
In the past we had a setup with the IDP just using the same subdomain. Of corse this will prevent any CORS issues, but we want to seperate this.
Any suggestions on where to add configuration to apply the CORS-related headers?
Thank you.

Keycloak CORS behind traefik on Kubernetes

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

目前，我们的We应用程序使用Keycloak作为Traefik 1.7后面的IDP，面临以下问题：Chrome控制台告诉我们：Access to manifest at 'https://keycloak.dev.example.com/auth/realms/myrealm/protocol/openid-conne...

问Kubernetes上traefik后面的Keycloak CORS
EN

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问Kubernetes上traefik后面的Keycloak CORSEN