UAE PASS Identity Provider Integration - No token from server #36715

Disura-Randunu · 2025-01-22T17:36:30Z

Disura-Randunu
Jan 22, 2025

Hi everyone,

I'm trying to integrate UAE Pass as an OIDC IDP for keycloak. I tried the relevant UAE endpoints in postman and I can get the access token.

But for some reason, after configuring in keycloak it gives the following error:

2025-01-22 22:55:53,326 ERROR [org.keycloak.broker.oidc.AbstractOAuth2IdentityProvider] (executor-thread-80) Failed to make identity provider oauth callback: org.keycloak.broker.provider.IdentityBrokerException: No token from server.
        at org.keycloak.broker.oidc.OIDCIdentityProvider.parseTokenInput(OIDCIdentityProvider.java:630)
        at org.keycloak.broker.oidc.OIDCIdentityProvider.validateToken(OIDCIdentityProvider.java:696)
        at org.keycloak.broker.oidc.OIDCIdentityProvider.validateToken(OIDCIdentityProvider.java:690)
        at org.keycloak.broker.oidc.OIDCIdentityProvider.getFederatedIdentity(OIDCIdentityProvider.java:379)
        at org.keycloak.broker.oidc.AbstractOAuth2IdentityProvider$Endpoint.authResponse(AbstractOAuth2IdentityProvider.java:557)
        at org.keycloak.broker.oidc.AbstractOAuth2IdentityProvider$Endpoint$quarkusrestinvoker$authResponse_ab908fbdd086ee82e140d8a818c077362a2d04b4.invoke(Unknown Source)
        at org.jboss.resteasy.reactive.server.handlers.InvocationHandler.handle(InvocationHandler.java:29)
        at io.quarkus.resteasy.reactive.server.runtime.QuarkusResteasyReactiveRequestContext.invokeHandler(QuarkusResteasyReactiveRequestContext.java:141)
        at org.jboss.resteasy.reactive.common.core.AbstractResteasyReactiveContext.run(AbstractResteasyReactiveContext.java:147)
        at io.quarkus.vertx.core.runtime.VertxCoreRecorder$14.runWith(VertxCoreRecorder.java:635)
        at org.jboss.threads.EnhancedQueueExecutor$Task.doRunWith(EnhancedQueueExecutor.java:2516)
        at org.jboss.threads.EnhancedQueueExecutor$Task.run(EnhancedQueueExecutor.java:2495)
        at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1521)
        at org.jboss.threads.DelegatingRunnable.run(DelegatingRunnable.java:11)
        at org.jboss.threads.ThreadLocalResettingRunnable.run(ThreadLocalResettingRunnable.java:11)
        at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30)
        at java.base/java.lang.Thread.run(Thread.java:840)

2025-01-22 22:55:53,329 WARN  [org.keycloak.events] (executor-thread-80) type="IDENTITY_PROVIDER_LOGIN_ERROR", realmId="f58c9b2c-d038-4cf7-9a5d-69cbddb5152c", realmName="Mercury", clientId="NEFELI", userId="null", ipAddress="0:0:0:0:0:0:0:1", error="identity_provider_login_failure", code_id="9d174b31-f389-4117-9007-d859c651a082"

These are the endpoints:
Auth: https://stg-id.uaepass.ae/idshub/authorize?response_type=code&redirect_uri=http://localhost:8080/realms/Mercury/broker/uae-pass/endpoint&client_id=sandbox_stage&scope=urn:uae:digitalid:profile:general&acr_values=urn:safelayer:tws:policies:authentication:level:low

Token:
https://stg-id.uaepass.ae/idshub/token

Logout:
https://stg-id.uaepass.ae/idshub/logout

UserInfo:
https://stg-id.uaepass.ae/idshub/userinfo

client_id: sandbox_stage
client_secret: sandbox_stage

These information are publically available in the UAE Pass Docs.
https://docs.uaepass.ae/guides/authentication/web-application/1.-obtaining-the-oauth2-access-code

I tried changing almost every setting in different combinations, but nothing works.

Anyone got any idea?

Btw, I'm using Keycloak 17.

Thanks.

Answered by Disura-Randunu

Jan 24, 2025

As for the original question,
I changed the Auth endpoint in keycloak to the following in UAE Pass Config:
https://stg-id.uaepass.ae/idshub/authorize?acr_values=urn:safelayer:tws:policies:authentication:level:low

Keycloak automatically attaches the required params on the fly. So we don't need to set them up manually.

Also added the scope values to "Scope" field in config.

View full answer

Disura-Randunu · 2025-01-24T18:24:47Z

Disura-Randunu
Jan 24, 2025
Author

I was ble to find the issue.

Tried a fresh instance of keycloak and went through keycloak setup from the beginning and added UAE Pass IDP Config.
Then got a new issue: Token is no longer valid

I went through the logs and got the token response from UAE Pass. Decoded the "id_token". There's a property called "iss". Copied it's value and pasted it in UAE Pass config's "Issuer" field in keycloak.

Now its working. Hope it helps someone!

0 replies

Disura-Randunu · 2025-01-24T18:28:53Z

Disura-Randunu
Jan 24, 2025
Author

As for the original question,
I changed the Auth endpoint in keycloak to the following in UAE Pass Config:
https://stg-id.uaepass.ae/idshub/authorize?acr_values=urn:safelayer:tws:policies:authentication:level:low

Keycloak automatically attaches the required params on the fly. So we don't need to set them up manually.

Also added the scope values to "Scope" field in config.

0 replies

belov38 · 2026-02-25T04:39:49Z

belov38
Feb 25, 2026

If the goal is "make UAE PASS look like a proper OIDC IdP" for downstream consumers (Azure CIAM / Entra External ID, apps, proxies), a cleaner approach is to place an OIDC broker in front of it. Dex works well for this: Dex exposes a full OIDC surface (/.well-known/openid-configuration, JWKS, ID token signing) and uses its generic oauth connector upstream to do the UAE PASS OAuth2 code flow + userinfo fetch + claim mapping.

In other words: downstream talks OIDC to Dex; upstream talks OAuth2 to UAE PASS, and you keep Keycloak/Azure on the happy path of standards-based federation.

0 replies

Navigation Menu

Repository navigation

UAE PASS Identity Provider Integration - No token from server #36715

Uh oh!

{{title}}

Uh oh!

Replies: 3 comments

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

UAE PASS Identity Provider Integration - No token from server #36715

Uh oh!

Disura-Randunu Jan 22, 2025

Replies: 3 comments

Uh oh!

Disura-Randunu Jan 24, 2025 Author

Uh oh!

Disura-Randunu Jan 24, 2025 Author

Uh oh!

belov38 Feb 25, 2026

Disura-Randunu
Jan 22, 2025

Disura-Randunu
Jan 24, 2025
Author

Disura-Randunu
Jan 24, 2025
Author

belov38
Feb 25, 2026