KC HOSTNAME / KC HOSTNAME STRICT

KC_HOSTNAME (ref) --hostname

If --hostname (KC_HOSTNAME) is not configured:

• hostname-backchannel-dynamic (KC_HOSTNAME_BACKCHANNEL_DYNAMIC) must be set to false (default value)
• hostname-strict (KC_HOSTNAME_STRICT) must be set to false.

Used for:

• iss claim in tokens
• URLs in the discovery document (/.well-known/openid-configuration)
• Origin expectations (iframe validation)
• Redirect URLs Keycloak generates
• Links in emails

# Do this in your values.yaml instead of extraEnvVars
ingress:
  enabled: true
  hostname: auth.example.com # The chart uses this to build the right KC_ or KEYCLOAK_ variables!

INFO [org.keycloak.url.HostnameV2ProviderFactory] (main) If hostname is specified, hostname-strict is effectively ignored

• 403 Forbidden in login-status-iframe.html
• Okta backchannel
• extraEnvVars
• JAVA_OPTS_APPEND
• KC_HTTP_ENABLED
• start-dev
• KC_PROXY_HEADERS

See also

• KC_HOSTNAME, KC_HOSTNAME_STRICT, KC_PROXY_HEADERS
• KC_PROXY (deprecated), KC_HOSTNAME, KC_HOSTNAME_STRICT_HTTPS (deprecated), KC_HTTP_ENABLED, KC_PROXY_HEADERS
• KC env variables, KC_BOOTSTRAP_ADMIN_USERNAME, KC_HOSTNAME, KC_HTTP_ENABLED, KC_PROXY_HEADERS
• /.well-known/openid-configuration, Okta Org /token, /authorize, /auth/callback