Issue
I currently have an Keycloak Gatekeeper as a proxy, over an IIS web application, using ISAPi redirector to connect to a Tomcat server via AJP. The application running on Tomcat requires the REMOTE_USER variable to be set to authenticate a user in the system.
Ideally it would work like this: User --(logs in)--> Keycloak Gatekeeper --(Headers)--> IIS --(Headers)--> Tomcat --(REMOTE_USER set + Headers)--> Web Application
I have tried using the Keycloak Tomcat adapter (which works for logging in existing users) but the application also requires particular headers to be set to sign users up if they do not exist in the system.
I have also tried using IIS URL Rewrite module, but it does not set the REMOTE_USER variable for some reason (I saw this post which suggests that the Rewrite rules run before authentication, URL rewrite - REMOTE_USER always empty).
Solution
I managed to get this working by using Keycloak Gatekeeper (to authenticate the user) and having the Keycloak Tomcat adapter (setting the REMOTE_USER variable on the Tomcat server). I also managed to get this to work using Keycloak Gatekeeper and a custom ISAPI redirector to set the REMOTE_USER variable.
Unfortunately this did not help us as the application we are authenticating for has another issue, but answering this question incase someone else has an issue similar.
Answered By - Jamie Nicholls
