Restrict Keycloak redirect URIs

Limit the addresses that Keycloak sends users back to after login and logout, to close an open redirect

Overview

Out of the box, the Keycloak clients that CAST Imaging uses for login accept any redirect URI (*). An attacker can therefore craft a link to your genuine login page that delivers the login response to a server they control, which security scanners report as an open redirect on the /auth/realms/<realm>/protocol/openid-connect/auth endpoint. This page explains how to restrict each client to the addresses your installation actually uses, and is intended for administrators hardening an installation on Microsoft Windows or Linux via Docker/Podman.

The whole configuration is performed in the Keycloak admin console. No configuration files are changed.

Requirements

Access to the Keycloak admin console with the kcadmin account - see Keycloak accounts and passwords.
A list of every address that users type to reach CAST Imaging, for example a short host name, an FQDN, an IP address or localhost.

Which client to configure

The client, and the base address (<base>) used in its redirect URIs, depend on how users reach CAST Imaging:

Access	Realm	Client	`<base>`
Direct	`aip-realm`	`<hostname>-client-aip-realm`	`http://<hostname>:8090`
Behind a reverse proxy	`aip-realm`	`aip-console-client`	The public address and the gateway address
Additional tenant, direct	`<tenant-realm>`	`<hostname>-client-<tenant-realm>`	`http://<hostname>:8090`
Additional tenant, behind a reverse proxy	`<tenant-realm>`	`aip-console-client-<tenant-realm>`	The public address and the gateway address

Direct access: there is one client per host name that users type, therefore localhost, the machine name and the IP address each have their own client and each must be configured.
Behind a reverse proxy (Microsoft Windows or Docker/Podman): one shared client carries two sets of addresses: the public address, including any context path (for example https://imaging.corp.domain.com/some-path), and the gateway address (http://<imaging-services-fqdn>:8090).
Additional tenants: where domain mapping is in use, each tenant has its own realm. Repeat the configuration in each tenant realm.

The dashboards do not have a client of their own: they log in through the same client as CAST Imaging. The MCP Server clients do not use the browser login flow, so there is nothing to configure for them.

Step 1 - Find the exact redirect URI

Keycloak compares redirect URIs as exact strings, therefore register the value that CAST Imaging actually sends rather than one typed by hand:

Open a private browser window and browse to CAST Imaging using the address you are configuring.
Let CAST Imaging redirect you to the Keycloak login page. Do not log in.
In the address bar, locate the client_id= parameter, which names the client to configure, and the redirect_uri= parameter, which is the value to register. Both are URL-encoded: %3A stands for : and %2F for /.

Repeat for each address in your list.

Register the value character for character. In an HTTPS deployment the value often reads http:// although the browser is on https://: this is expected, so do not correct it to https://.
Omit the port when it is 443 or 80: https://host:443/... does not match https://host/....
If the value reads http:// behind a reverse proxy, the proxy must also answer on port 80, otherwise the browser cannot return to CAST Imaging after login.

Step 2 - Restrict the client

Log in to the Keycloak admin console with the kcadmin account: http://<imaging-services-fqdn>:8090/auth.
Select the realm, for example aip-realm, from the realm drop-down list.
Click Clients in the left menu, then click the client identified in Step 1.
On the Settings tab, scroll to the Access settings section and replace the existing values as follows:

Field	Value
Valid redirect URIs	`<base>/login/oauth2/code/<client-id>` - the value found in Step 1
Valid post logout redirect URIs	`<base>`
Web origins	`+` - allows the origins of the valid redirect URIs only

Click Save.

Behind a reverse proxy, add one entry for the public address and one for the gateway address in both redirect URI fields, for example:

https://imaging.corp.domain.com/some-path/login/oauth2/code/aip-console-client
http://imaging-services.corp.domain.com:8090/login/oauth2/code/aip-console-client

Repeat for each client identified in Step 1.

Step 3 - Check the configuration

Open CAST Imaging through each address in your list, log in, open the dashboards, then log out. Each step must complete without an error.
Open the Keycloak login page again, replace the redirect_uri= value in the address bar with an external address, and press Enter. Keycloak must refuse the request with Invalid parameter: redirect_uri.

If users see Invalid parameter: redirect_uri instead of the login page, the address they are using does not match any registered value. Repeat Step 1 for that address and add the value it shows.

To restore access immediately while you investigate, set Valid redirect URIs back to * on the client and click Save. Only the CAST Imaging clients are modified on this page, so the Keycloak admin console itself remains reachable.