Keycloak Client settings, what URLs do I need?

Question

I have problems setting up Keycloak for a project I do. Keycloak is running on http://localhost:8180. Thorntail server is running on http://localhost:8080/users which serves data for an Angular frontend on http://localhost:4200/*. What I want to do is that a User can only see http://localhost:4200/sign-in without logging in. Once logged in they can access for example http://localhost:4200/list-user. I was using this guide to set up Keycloak, but I'm not sure what I my Client settings should be. This is what I thought:

Root URL: http://localhost:4200/sign-in

*Valid Redirect URIs: http://localhost:4200/list-user

Base URL: http://localhost:4200/sign-in

Admin URL: http://localhost:8080

Somebody please explain the purpose of these settings as I struggle to understand.

Solution

Root url is just a value that will be used for relative paths resolving.

• Root: http://localhost:4200/sign-in
• Valid Redirects: /* (After login user could be redirected to any URI that matches pattern http://localhost:4200/sign-in/*)
• Base URL: / (Is not mandatory. Used when keycloak need to calculate application url by client_id only)
• Admin URL: / (Used when Keycloak need to notify applications about revocation or when user logs out. For example when user logs out in application A if he has session in application B, Keycloak will send backchannel request to Admin URL of application B, so Application B will also flush user session in it)

Check out docs and info badges in Admin Console

Comments

[Ahmad]

I still don't understand Base URL, can you elaborate on this? I went to the documentation which says "This URL is used when Keycloak needs to link to the client" still I don't get what is the difference between this and root url

[solveMe]

@Ahmad root URL never used directly, it's just a feature to reduce copy-pasting in other URL fields (base URL, redirect URIs, Admin URL etc...)