Authentication via OIDC issue

dj_kill · March 15, 2023, 1:00pm

I have Keycloak 21.0.0 with 2 realms. Realms are identical except name.
In each realm I have external IDP. Also the same.
Only difference is a call-back URL which has realm name.

On one realm everything works fine. On another realm I cannot authenticate and Keycloak shows exception type=IDENTITY_PROVIDER_LOGIN_ERROR

2023-03-14 22:01:32,103 ERROR [org.keycloak.broker.oidc.AbstractOAuth2IdentityProvider] (executor-thread-166) Failed to make identity provider oauth callback: org.keycloak.broker.provider.IdentityBrokerException: Could not fetch attributes from userinfo endpoint.
        at org.keycloak.broker.oidc.OIDCIdentityProvider.getFederatedIdentity(OIDCIdentityProvider.java:424)
        at org.keycloak.broker.oidc.AbstractOAuth2IdentityProvider$Endpoint.authResponse(AbstractOAuth2IdentityProvider.java:505)
        at jdk.internal.reflect.GeneratedMethodAccessor1047.invoke(Unknown Source)
        at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.base/java.lang.reflect.Method.invoke(Method.java:568)
        at org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java:170)
        at org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java:130)
        at org.jboss.resteasy.core.ResourceMethodInvoker.internalInvokeOnTarget(ResourceMethodInvoker.java:660)
....
        at org.jboss.threads.DelegatingRunnable.run(DelegatingRunnable.java:29)
        at org.jboss.threads.ThreadLocalResettingRunnable.run(ThreadLocalResettingRunnable.java:29)
        at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30)
        at java.base/java.lang.Thread.run(Thread.java:833)
Caused by: org.keycloak.broker.provider.IdentityBrokerException: Invalid token
        at org.keycloak.broker.oidc.OIDCIdentityProvider.validateToken(OIDCIdentityProvider.java:623)
        at org.keycloak.broker.oidc.KeycloakOIDCIdentityProvider.processAccessTokenResponse(KeycloakOIDCIdentityProvider.java:70)
        at org.keycloak.broker.oidc.OIDCIdentityProvider.extractIdentity(OIDCIdentityProvider.java:539)
        at org.keycloak.broker.oidc.OIDCIdentityProvider.getFederatedIdentity(OIDCIdentityProvider.java:405)
        ... 48 more
Caused by: org.keycloak.jose.jws.JWSInputException: java.lang.IllegalArgumentException: Parsing error
        at org.keycloak.jose.jws.JWSInput.<init>(JWSInput.java:59)
        at org.keycloak.broker.oidc.OIDCIdentityProvider.validateToken(OIDCIdentityProvider.java:617)
        ... 51 more
Caused by: java.lang.IllegalArgumentException: Parsing error
        at org.keycloak.jose.jws.JWSInput.<init>(JWSInput.java:46)
        ... 52 more

Brief googling shows that this is something related to the SSL settings. But they are identical.

I can authenticate with Postman with both call-back URLs emulating both my realms.
Any advice where to look?

pjmalandrino · March 16, 2023, 1:26pm

Hey,
Kind a weird indeed, I would verify IDP configuration on both realms.
Also, you could take a look at : Loading...

Maybe you have disable it on one realm and not in the other ?

dj_kill · March 16, 2023, 1:58pm

No. Userinfo endpoint replies perfectly fine. And I can get userinfo via Postman.
As I can see from the logs this is somehow related to the token itself.
This is not related to the realm name: I can rename “working” realm to “non-working” and it works fine.

I configure the same IDP in the master realm (IDP allows this callback URL) and… it doesn’t work as well. Something related to IDP actually. But not clear what exactly.

LimonCoder · May 28, 2023, 5:46pm

I am facing the same problem.

LimonCoder · June 2, 2023, 2:11am

I am facing this issue: Could not fetch attributes from userinfo endpoint. Please suggest me what can i do ?

dj_kill · June 8, 2023, 1:46pm

In my case I were able to curl userinfo endpoint from the pod.
If you cannot curl userinfo endpoint from the pod, than check networking and URL itself.

If you can… I just delete configuration and configure everything from scratch. This fix the problem for me.

tonydavis995 · January 28, 2024, 12:14am

I have the same issue? I deleted the configuration and tried with Keycloak v 21,22,´and 23. Anyone solved this?
2024-01-28 00:45:19,281 ERROR [org.keycloak.broker.oidc.AbstractOAuth2IdentityProvider] (executor-thread-0) Failed to make identity provider oauth callback: org.keycloak.broker.provider.IdentityBrokerException: Could not fetch attributes from userinfo endpoint.
at org.keycloak.broker.oidc.OIDCIdentityProvider.getFederatedIdentity(OIDCIdentityProvider.java:405)
at org.keycloak.broker.oidc.AbstractOAuth2IdentityProvider$Endpoint.authResponse(AbstractOAuth2IdentityProvider.java:505)
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)
at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.base/java.lang.reflect.Method.invoke(Method.java:568)
at org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java:170)
at org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java:130)
at org.jboss.resteasy.core.ResourceMethodInvoker.internalInvokeOnTarget(ResourceMethodInvoker.java:660)
at org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTargetAfterFilter(ResourceMethodInvoker.java:524)
at org.jboss.resteasy.core.ResourceMethodInvoker.lambda$invokeOnTarget$2(ResourceMethodInvoker.java:474)
at org.jboss.resteasy.core.interception.jaxrs.PreMatchContainerRequestContext.filter(PreMatchContainerRequestContext.java:364)
at org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTarget(ResourceMethodInvoker.java:476)
at org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:434)
at org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(ResourceLocatorInvoker.java:192)
at org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:152)
at org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(ResourceLocatorInvoker.java:183)
at org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:141)
at org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:32)
at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:492)
at org.jboss.resteasy.core.SynchronousDispatcher.lambda$invoke$4(SynchronousDispatcher.java:261)
at org.jboss.resteasy.core.SynchronousDispatcher.lambda$preprocess$0(SynchronousDispatcher.java:161)
at org.jboss.resteasy.core.interception.jaxrs.PreMatchContainerRequestContext.filter(PreMatchContainerRequestContext.java:364)
at org.jboss.resteasy.core.SynchronousDispatcher.preprocess(SynchronousDispatcher.java:164)
at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:247)
at io.quarkus.resteasy.runtime.standalone.RequestDispatcher.service(RequestDispatcher.java:73)
at io.quarkus.resteasy.runtime.standalone.VertxRequestHandler.dispatch(VertxRequestHandler.java:151)
at io.quarkus.resteasy.runtime.standalone.VertxRequestHandler.handle(VertxRequestHandler.java:82)
at io.quarkus.resteasy.runtime.standalone.VertxRequestHandler.handle(VertxRequestHandler.java:42)
at io.vertx.ext.web.impl.RouteState.handleContext(RouteState.java:1284)
at io.vertx.ext.web.impl.RoutingContextImplBase.iterateNext(RoutingContextImplBase.java:173)
at io.vertx.ext.web.impl.RoutingContextImpl.next(RoutingContextImpl.java:140)
at io.quarkus.vertx.http.runtime.StaticResourcesRecorder$2.handle(StaticResourcesRecorder.java:84)
at io.quarkus.vertx.http.runtime.StaticResourcesRecorder$2.handle(StaticResourcesRecorder.java:71)
at io.vertx.ext.web.impl.RouteState.handleContext(RouteState.java:1284)
at io.vertx.ext.web.impl.RoutingContextImplBase.iterateNext(RoutingContextImplBase.java:173)
at io.vertx.ext.web.impl.RoutingContextImpl.next(RoutingContextImpl.java:140)
at io.quarkus.vertx.http.runtime.VertxHttpRecorder$6.handle(VertxHttpRecorder.java:430)
at io.quarkus.vertx.http.runtime.VertxHttpRecorder$6.handle(VertxHttpRecorder.java:408)
at io.vertx.ext.web.impl.RouteState.handleContext(RouteState.java:1284)
at io.vertx.ext.web.impl.RoutingContextImplBase.iterateNext(RoutingContextImplBase.java:173)
at io.vertx.ext.web.impl.RoutingContextImpl.next(RoutingContextImpl.java:140)
at org.keycloak.quarkus.runtime.integration.web.QuarkusRequestFilter.lambda$createBlockingHandler$0(QuarkusRequestFilter.java:82)
at io.quarkus.vertx.core.runtime.VertxCoreRecorder$14.runWith(VertxCoreRecorder.java:576)
at org.jboss.threads.EnhancedQueueExecutor$Task.run(EnhancedQueueExecutor.java:2449)
at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1478)
at org.jboss.threads.DelegatingRunnable.run(DelegatingRunnable.java:29)
at org.jboss.threads.ThreadLocalResettingRunnable.run(ThreadLocalResettingRunnable.java:29)
at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30)
at java.base/java.lang.Thread.run(Thread.java:840)
Caused by: org.keycloak.broker.provider.IdentityBrokerException: Invalid token
at org.keycloak.broker.oidc.OIDCIdentityProvider.validateToken(OIDCIdentityProvider.java:604)
at org.keycloak.broker.oidc.KeycloakOIDCIdentityProvider.processAccessTokenResponse(KeycloakOIDCIdentityProvider.java:70)
at org.keycloak.broker.oidc.OIDCIdentityProvider.extractIdentity(OIDCIdentityProvider.java:520)
at org.keycloak.broker.oidc.OIDCIdentityProvider.getFederatedIdentity(OIDCIdentityProvider.java:386)
… 49 more
Caused by: org.keycloak.jose.jws.JWSInputException: java.lang.IllegalArgumentException: Parsing error
at org.keycloak.jose.jws.JWSInput.(JWSInput.java:59)
at org.keycloak.broker.oidc.OIDCIdentityProvider.validateToken(OIDCIdentityProvider.java:598)
… 52 more
Caused by: java.lang.IllegalArgumentException: Parsing error
at org.keycloak.jose.jws.JWSInput.(JWSInput.java:46)
… 53 more

Topic		Replies	Views
Could not fetch attributes from userinfo endpoint Getting advice authentication , ldap , oidc	0	652	May 28, 2023
OpenID Provider [oidc] did not return a nonce Getting advice oidc	4	1867	February 1, 2021
Unable to Retrieve Identity Provider(IDP) token Getting advice identity-brokering	0	1406	October 24, 2021
OIDC Identity Provider (Azure AD) OAuth Callback Error	1	953	August 11, 2021
Cant log in with/connect identity provider: "invalid_client" Getting advice identity-brokering , oidc	0	307	November 10, 2023

Authentication via OIDC issue

Related Topics