我有一个HAProxy作为负载均衡器，位于两台运行独立模式下的Keycloak机器前面。
版本
- HAProxy版本1.6.3，发布于2015/12/25
- Keycloak版本2.4.0.Final
HAProxy配置
global
user haproxy
group haproxy
log /dev/log local0
log-tag WARDEN
chroot /var/lib/haproxy
daemon
quiet
stats socket /var/lib/haproxy/stats level admin
maxconn 256
pidfile /var/run/haproxy.pid
tune.bufsize 262144
defaults
timeout connect 5000ms
timeout client 5000ms
timeout server 5000ms
log global
mode http
option httplog
option dontlognull
option redispatch
retries 5
stats uri /haproxy-status
frontend http-in
mode http
bind *:80
maxconn 2000
redirect scheme https code 301 if !{ ssl_fc }
frontend https
mode http
default_backend servers
bind *:443 ssl crt /etc/letsencrypt/live/authhomolog2.portaltecsinapse.com.br/combined.pem
maxconn 2000
option forwardfor
http-request set-header X-Forwarded-Port %[dst_port]
http-request set-header X-Forwarded-For %[src]
http-request set-header X-Forwarded-Proto https
backend servers
mode http
balance source
cookie JSESSIONID prefix
server master 172.30.0.74:8080 maxconn 32 check cookie master
server slave 172.30.0.124:8080 maxconn 32 check cookie slave
Keycloak 相关配置
<subsystem xmlns="urn:jboss:domain:undertow:3.0">
<buffer-cache name="default"/>
<server name="default-server">
<http-listener name="default"
socket-binding="http"
proxy-address-forwarding="true"
redirect-socket="proxy-https"/>
...
...
<socket-binding-group name="standard-sockets" default-interface="public" port-offset="${jboss.socket.binding.port-offset:0}">
<socket-binding name="proxy-https" port="443"/>
...
...
当我尝试登录使用Keycloak作为单点登录的Java应用程序时，屏幕上出现403 Forbidden错误：
HAProxy日志
Dec 16 13:18:49 keycloak-haproxy-test WARDEN[8714]: 191.205.78.16:35794 [16/Dec/2017:13:18:48.582] https~ servers/master 487/0/0/72/559 302 2765 - - --NN 2/2/0/1/0 0/0 "GET /realms/BMW/protocol/openid-connect/auth?response_type=code&client_id=BMWGestaoDealer&redirect_uri=https%3A%2F%2Fhomolog2gd.bmwbic.com.br%2Ffavicon.ico&state=81%2F4ad46389-fe45-4dec-b804-5563c29c51db&login=true&scope=openid HTTP/1.1"
Dec 16 13:18:49 keycloak-haproxy-test WARDEN[8714]: 54.233.89.231:54608 [16/Dec/2017:13:18:48.606] https~ servers/slave 552/0/0/4/556 400 457 - - --NN 2/2/0/1/0 0/0 "POST /realms/BMW/protocol/openid-connect/token HTTP/1.1"
我意识到请求在我的机器（191.205.78.16）上开始的GET请求由master Keycloak机器响应，并且应用服务器（54.233.89.231）开始的重定向POST请求由slave Keycloak机器响应。我希望所有这些请求都由同一台机器（master或slave）响应。你知道我该怎么做吗？我尝试了很多不同的HAProxy配置，但没有成功。 :-(
还有一个信息，如果我只保留master或slave Keycloak实例，则可以正常工作。
Keycloak slave日志
2017-12-16 14:43:13.235 WARN [org.keycloak.events] (default task-1) type=CODE_TO_TOKEN_ERROR, realmId=BMW, clientId=BMWGestaoDealer, userId=null, ipAddress=54.233.89.231, error=invalid_code, grant_type=authorization_code, code_id=52204563-53c8-4c72-bd8c-cb7540ebda3b, client_auth_method=client-secret
希望能给予任何帮助。