I'm using a very lazy hack for authenticating web services by letting Apache check the OpenID auth state in the browser and redirecting to Keycloak's login page if the session expired.
It's like HTTP Basic Auth but with extra steps. It's basically these rules:
This basically ensures that if you try to visit https://example.com/sonarr you'll get redirected to Keycloak and asked to log in. It's the main reason I'm still running Apache instead of nginx because I haven't figured out an easy way to do this with nginx. I think you can do it with some custom LUA and an extension?
You'd have to be careful with custom code like this, though, because it's very easy to try to get the server to send a redirect but end up sending actual content that just has its HTTP status code changed to 301. The example seems to fail with 500 instead of redirecting, that's one way to do it.
It's like HTTP Basic Auth but with extra steps. It's basically these rules:
This basically ensures that if you try to visit https://example.com/sonarr you'll get redirected to Keycloak and asked to log in. It's the main reason I'm still running Apache instead of nginx because I haven't figured out an easy way to do this with nginx. I think you can do it with some custom LUA and an extension?