Configure Keycloak’s Outgoing Proxy for Identity Brokering

Set the server's outgoing proxy environment and apply Keycloak's own variable precedence when diagnosing the token exchange.

The browser reaches the identity provider's login page; Keycloak's server exchanges the returned code. If that later exchange cannot connect, put the proxy route in the Keycloak process or container environment before startup:

HTTPS_PROXY=http://proxy.example:8080
NO_PROXY=localhost,internal.example

For a public HTTP route, an address from the HTTP proxy list goes in HTTPS_PROXY; keep the intended bypass destinations. The token URL remains the identity provider's endpoint, not the proxy address.

Keycloak's precedence differs from a destination-scheme map:

  • If both HTTP_PROXY and HTTPS_PROXY are defined, HTTPS_PROXY wins.
  • Lowercase forms take precedence over uppercase forms.
  • NO_PROXY is comma-separated, and a named host also excludes its subdomains.

Check all those inputs if the server selects an unexpected route. Browser proxy settings do not supply this server environment.

Once the connection works, a TLS verification failure belongs to trust configuration through Keycloak's truststore interface. Changing the route cannot establish the missing certificate trust.

Allakkat attuumassuteqartut