KeyCloak5.0版本使用nginx代理解决HTTPS域名的问题_keycloak nginx代理错误的iss-CSDN博客

本文链接：https://blog.csdn.net/zhuwei_clark/article/details/88532218

本文介绍了在KeyCloak 5.0版本中遇到的两个问题及其解决方法：一是UTF-8编码需使用大写；二是通过nginx代理HTTPS域名时，内部HTTP转向报错。解决之道包括在nginx配置中指定转发协议为HTTPS，并在KeyCloak的standalone.xml中启用proxy-address-forwarding。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

第一个问题：

java.sql.SQLException: Can not call getNString() when field's charset isn't UTF-8

UTF-8的编码问题，在指定编码的时候必须使用大写的UTF-8，不能使用小写的UTF-8

<datasource jndi-name="java:jboss/datasources/KeycloakDS" pool-name="KeycloakDS" enabled="true" use-java-context="true">
    <!-- database keycloak 需要事先创建好  -->
    <connection-url>jdbc:mysql://172.17.4.178:3306/keycloak?characterEncoding=UTF-8&amp;allowMultiQueries=true&amp;useSSL=false</connection-url>
    <!--  指定引用的driver名称  -->
    <driver>mysql</driver>
    <pool>
        <max-pool-size>20</max-pool-size>
    </pool>
    <security>
		<user-name>daxian</user-name>
		<password>zhudaxian;.,68NB</password>
    </security>
</datasource>

第二个问题：nginx代理https域名，内部使用http的转向报错

error=invalid_redirect_uri, redirect_uri=https://auth.zhubanxian.com/auth/admin/master/console/

解决方法：

第一步修改nginx配置，指定转发的协议为https： proxy_set_header X-Forwarded-Proto https;

        upstream auth{
                server 172.17.4.178:8180  weight=1;
        }

        server {
                listen 443;
                server_name auth.zhubanxian.com;

                ssl on;
                ssl_certificate /etc/nginx/vhosts/auth/auth.pem;
                ssl_certificate_key /etc/nginx/vhosts/auth/auth.key;
                ssl_session_timeout 5m;
                ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4;
                ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
                ssl_prefer_server_ciphers on;

                location ~ ^/(.*){
                        proxy_pass http://auth;
                        proxy_set_header REMOTE_ADDR $remote_addr;
                        proxy_set_header Host $http_host;
                        #指定转发的协议为https
                        proxy_set_header X-Forwarded-Proto https;
                        proxy_pass_header Authorization;
                        proxy_http_version 1.1;
                        proxy_set_header Connection "";
                        proxy_set_header Upgrade $http_upgrade;
                        proxy_set_header Connection "upgrade";
                }

        }

第二步：修改standalone.xml,增加属性配置：proxy-address-forwarding="true"

<server name="default-server">
    <http-listener name="default" socket-binding="http" proxy-address-forwarding="true" redirect-socket="https" enable-http2="true"/>
    <https-listener name="https" socket-binding="https" security-realm="ApplicationRealm" enable-http2="true"/>
    <host name="default-host" alias="localhost">
        <location name="/" handler="welcome-content"/>
        <http-invoker security-realm="ApplicationRealm"/>
    </host>
</server>

重启keycloak，重新访问成功。