Accessing AuthNote or UserSessionNote

Getting advice
1

I have created a custom authenticator(AuthenticationFlowContext context).
This context I use to get some parameters that my user are sending me.
I am getting them by doing:
String param = context.getAuthenticationSession().getClientNotes().get("giver");

These parameters I am trying to save either as context.getAuthenticationSession().setAuthNote("test", param);
or

context.getAuthenticationSession().setUserSessionNote("Giver", param);

I am then trying to add this param to the tokens. How can I do this?

I have created a protocol mapper too, and here I am able to do:

String test = keycloakSession.getContext().getAuthenticationSession().getAuthNote("giver");
OIDCAttributeMapperHelper.mapClaim(token, mappingModel, test);

But this gives an error, when I am trying to exchange the pkce code for a token. Also if I am trying to use the getUserSessionNote

2

What kind of error does it give? I’ve had a similar case before, without success. The auth session is probably gone at the token endpoint.
I ended up writing the questionable values into the user attributes when authenticating…
user.setAttribute(...)
…and then read them back in the mapper:
user.getAttribute(...)
Be careful, get/setAttribute() takes/gives Lists as values, not plain strings:
https://www.keycloak.org/docs-api/20.0.3/javadocs/org/keycloak/models/map/storage/jpa/user/entity/JpaUserEntity.html

3

When ever I tried to get the token, it just returned unknown error I think it was. I deleted that part again and then I tried to use Keycloaks own mapper.

There is a mapper called User Session Note. I have managed to log in and I can see my parameter in the token, but if I try to login again my parameter is gone.

The paramater is set with the context.getAuthenticationSession().setUserSessionNote("giver", param);

If I try to add an other mapper for an other parameter saved in the notes, it gives me an “unknown error” in return. Might have to make both my parameters into one note

EDIT

I am now revieving the parameters and they are getting into my token.

I am using the context.getAuthenticationSession().setUserSessionNote("giver", param);

Then I go into the client in keycloak and add a User Session Note mapper for each of the parameters, and they are now going from the url into my token

My next issue is that I so far have to use the logout endpoint if I want to log in again with the attributes. I cant just wait until the session is gone and nothing about the session is left in keycloak.

If anyone got any ideas about why this is, I would love to hear it