Before reporting an issue

• I have read and understood the above terms for submitting issues, and I understand that my issue may be closed without action if I do not follow them.

Area

core

Describe the bug

When using IPv6 and client is sending request from link-local or unique local address (ULA), client is blocked from sending clear-text HTTP requests when realm configuration is set to require SSL for "External request" (link).

Version

main

Regression

• The issue is a regression

Expected behavior

Requests sent from IPv6 link-local or unique local address should succeed.

Actual behavior

Requests are rejected with response 403 Forbidden with body

{
    "error": "invalid_request",
    "error_description": "HTTPS required"
}

How to Reproduce?

One way to reproduce is to use Kubernetes cluster with IPv6 enabled

1. Run Keycloak in a Kubernetes cluster with IPv6 enabled.
2. Run a client in another pod and check that the pod's network interface has IPv6 address either from link-local address range or unique local address range. Send request using IPv6.
3. Observe response 403 Forbidden

For example for local development, Kind would use link-local addresses for pods and services within the cluster and a "real" CNI like Calico would typically use unique local addresses (ULA).

Anything else?

The code that checks for the request is here

Looking at the git history, it seems that initially the code aimed to cover only clients within localhost, and later it took the current form where it was extended to allow IPv4 private addresses (link).

In case of IPv6 the private address ranges are following:

While the JDK method Inet4Address.isSiteLocalAddress() covers private address ranges for IPv4 (link), the IPv6 version Inet6Address.isSiteLocalAddress() only covers site-local unicast address range (link). According to RFC4291 section2.5.7 this address range is now deprecated and should be considered as global address by new implementation

The special behavior of this prefix defined in [RFC3513] must no longer be supported in new implementations (i.e., new implementations must treat this prefix as Global Unicast).

Existing implementations and deployments may continue to use this prefix.

While the documentation for interface InetAddress.isSiteLocalAddress() says (link)

Utility routine to check if the InetAddress is a site local address.

it seems likely to me that applications may rather use it for the effect of "all private address ranges", than for the specific (now deprecated) IPv6 site-local definition, especially considering the method is used through the upper class that covers both IPv4 and IPv6. Still, the JDK IPv6 implementation seems to take strict interpretation of covering site-local only and does not offer any method for checking for IPv6 private address ranges.