Admin Console does not work after upgrading from 18.0.2 to 19.0.1

Describe the bug

We upgraded from 18.0.2 to 19.0.1 and can no longer access the admin console. We believe that KC_HTTP_RELATIVE_PATH seems to no longer be honored.

FROM quay.io/keycloak/keycloak:19.0.1 as builder

ENV KC_DB=postgres \
    KC_HTTP_RELATIVE_PATH=/auth \
    KC_HEALTH_ENABLED=true
RUN /opt/keycloak/bin/kc.sh build

FROM quay.io/keycloak/keycloak:19.0.1
COPY --from=builder /opt/keycloak/lib/quarkus/ /opt/keycloak/lib/quarkus/
COPY themes /opt/keycloak/themes
WORKDIR /opt/keycloak
ENTRYPOINT ["/opt/keycloak/bin/kc.sh", "--spi-login-protocol-openid-connect-legacy-logout-redirect-uri=true", "start"]

Version

19.0.1

Expected behavior

Requests to /auth/admin previously returned the admin console for all versions <=18.0.2

Actual behavior

We now receive an error page

How to Reproduce?

Change the relative path to /auth and attempt to access /auth/admin

Anything else?

We have keycloak running as a docker container behind a reverse proxy, but if I use curl to attempt to access the container directly, I get a successful response using /admin which is why I believe the issue is that KC_HTTP_RELATIVE_PATH is not being honored

[pedroigor]

@lexcao @westmc Now there is a reasonable explanation. Thanks.

Basically, the start command behavior changed in 19 so that we have “auto-build” enabled by default. That said, the server will try to run a build (if there are build time configuration changes) before actually starting the server. To avoid that, you can use the optimized option which tells the server to skip the build prior to starting.

Sorry about the confusion, the changes are documented here https://www.keycloak.org/docs/latest/upgrading/#changes-to-the-server-configuration-and-startup. Kinda hidden, I think.

@westmc I’m not sure if the container guide is misleading, but if you want we can create a separate issue for it for improvements.

[westmc]

@lexcao I tried your suggestions and it started working. Based on some additional testing, it looks like KC_HTTP_RELATIVE_PATH changed from a build option to a runtime option in 19. The config documentation should probably be updated. I was able to get it to work by removing the flag from the dockerfile entirely and just setting the flag as part of the run command.

The change in the dockerfile to copy the full folder should probably be added to the release notes for 19. I got the original dockerfile from here and I noticed that it has been updated to what you suggested.

FYI @pedroigor