Repository navigation
SSO with Entra OIDC broker fails at Token Exchange (SSLException via HTTPS proxy) #44786
Unanswered
saurabhPatel1712
asked this question in
Q&A
Replies: 1 comment 1 reply
|
@stianst Can you please help here |
1 reply
|
Issue is resolved. It was due to HTTPS Proxy trying [route: {tls}->https://myprxy:3128->https://login.microsoftonline.com:443]. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Keycloak Version: 26.4.0
OIDC IdP: Microsoft Entra (Azure AD)
Proxy: Outbound internet via proxy, set as https_proxy=https://myproxy:3128
Problem
User can log in successfully via OIDC broker using Microsoft Entra. After Entra authorization, the browser is redirected back to Keycloak as expected. Keycloak then fails to exchange the authorization code for tokens, with the following error:
2025-12-09 15:25:07,639 ERROR [org.keycloak.broker.oidc.AbstractOAuth2IdentityProvider] (executor-thread-782) Failed to make identity provider oauth callback: javax.net.ssl.SSLException: Unsupported or unrecognized SSL message at java.base/sun.security.ssl.SSLSocketInputRecord.handleUnknownRecord(SSLSocketInputRecord.java:462) at java.base/sun.security.ssl.SSLSocketInputRecord.decode(SSLSocketInputRecord.java:175) at java.base/sun.security.ssl.SSLTransport.decode(SSLTransport.java:111) at java.base/sun.security.ssl.SSLSocketImpl.decode(SSLSocketImpl.java:1506) at java.base/sun.security.ssl.SSLSocketImpl.readHandshakeRecord(SSLSocketImpl.java:1421) at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:455) at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:426) at org.apache.http.conn.ssl.SSLConnectionSocketFactory.createLayeredSocket(SSLConnectionSocketFactory.java:436) at org.apache.http.conn.ssl.SSLConnectionSocketFactory.connectSocket(SSLConnectionSocketFactory.java:384) at org.apache.http.impl.conn.DefaultHttpClientConnectionOperator.connect(DefaultHttpClientConnectionOperator.java:142) at org.apache.http.impl.conn.PoolingHttpClientConnectionManager.connect(PoolingHttpClientConnectionManager.java:376) at org.apache.http.impl.execchain.MainClientExec.establishRoute(MainClientExec.java:401) at org.apache.http.impl.execchain.MainClientExec.execute(MainClientExec.java:236) at org.apache.http.impl.execchain.ProtocolExec.execute(ProtocolExec.java:186) at org.apache.http.impl.execchain.RetryExec.execute(RetryExec.java:89) at org.apache.http.impl.execchain.RedirectExec.execute(RedirectExec.java:110) at org.apache.http.impl.client.InternalHttpClient.doExecute(InternalHttpClient.java:185) at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:83) at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:108) at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:56) at org.keycloak.http.simple.SimpleHttpRequest.makeRequest(SimpleHttpRequest.java:242) at org.keycloak.http.simple.SimpleHttpRequest.asResponse(SimpleHttpRequest.java:193) at org.keycloak.broker.oidc.AbstractOAuth2IdentityProvider$Endpoint.authResponse(AbstractOAuth2IdentityProvider.java:729) at org.keycloak.broker.oidc.AbstractOAuth2IdentityProvider$Endpoint$quarkusrestinvoker$authResponse_6fb5b01a2f01bc2a3f5c3bfb26dfe8c191cad835.invoke(Unknown Source) at org.jboss.resteasy.reactive.server.handlers.InvocationHandler.handle(InvocationHandler.java:29) at io.quarkus.resteasy.reactive.server.runtime.QuarkusResteasyReactiveRequestContext.invokeHandler(QuarkusResteasyReactiveRequestContext.java:183) at org.jboss.resteasy.reactive.common.core.AbstractResteasyReactiveContext.run(AbstractResteasyReactiveContext.java:147) at io.quarkus.vertx.core.runtime.VertxCoreRecorder$15.runWith(VertxCoreRecorder.java:645) at org.jboss.threads.EnhancedQueueExecutor$Task.doRunWith(EnhancedQueueExecutor.java:2651) at org.jboss.threads.EnhancedQueueExecutor$Task.run(EnhancedQueueExecutor.java:2630) at org.jboss.threads.EnhancedQueueExecutor.runThreadBody(EnhancedQueueExecutor.java:1622) at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1589) at org.jboss.threads.DelegatingRunnable.run(DelegatingRunnable.java:11) at org.jboss.threads.ThreadLocalResettingRunnable.run(ThreadLocalResettingRunnable.java:11) at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30) at java.base/java.lang.Thread.run(Thread.java:1583)Observations
The Keycloak instance is using a proxy for outbound requests (https_proxy set).
According to debug logs, the proxy is set as https://myproxy:3128.
Full logs
2025-12-09 15:25:07,631 DEBUG [org.keycloak.services.resources.IdentityBrokerService] (executor-thread-782) Authorization code is valid. 2025-12-09 15:25:07,632 DEBUG [org.keycloak.connections.httpclient.ProxyMappingsAwareRoutePlanner] (executor-thread-782) Returning proxyMapping=ProxyMapping{hostnamePattern=.*, proxyHost=https://myprxy:3128} for targetHost=login.microsoftonline.com 2025-12-09 15:25:07,633 DEBUG [org.apache.http.client.protocol.RequestAuthCache] (executor-thread-782) Auth cache not set in the context 2025-12-09 15:25:07,633 DEBUG [org.apache.http.impl.conn.PoolingHttpClientConnectionManager] (executor-thread-782) Connection request: [route: {tls}->https://myprxy:3128->https://login.microsoftonline.com:443][total available: 0; route allocated: 0 of 64; total allocated: 0 of 128] 2025-12-09 15:25:07,633 DEBUG [org.apache.http.impl.conn.PoolingHttpClientConnectionManager] (executor-thread-782) Connection leased: [id: 1][route: {tls}->https://myprxy:3128->https://login.microsoftonline.com:443][total available: 0; route allocated: 1 of 64; total allocated: 1 of 128] 2025-12-09 15:25:07,633 DEBUG [org.apache.http.impl.execchain.MainClientExec] (executor-thread-782) Opening connection {tls}->https://myprxy:3128->https://login.microsoftonline.com:443 2025-12-09 15:25:07,635 DEBUG [org.apache.http.impl.conn.DefaultHttpClientConnectionOperator] (executor-thread-782) Connecting to myprxy/10.226.69.18:3128 2025-12-09 15:25:07,635 DEBUG [org.apache.http.conn.ssl.SSLConnectionSocketFactory] (executor-thread-782) Connecting socket to myprxy/10.226.69.18:3128 with timeout 0 2025-12-09 15:25:07,635 DEBUG [org.apache.http.conn.ssl.SSLConnectionSocketFactory] (executor-thread-782) Enabled protocols: [TLSv1.3, TLSv1.2] 2025-12-09 15:25:07,635 DEBUG [org.apache.http.conn.ssl.SSLConnectionSocketFactory] (executor-thread-782) Enabled cipher suites:[TLS_AES_256_GCM_SHA384, TLS_AES_128_GCM_SHA256, TLS_CHACHA20_POLY1305_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_RSA_WITH_AES_256_GCM_SHA384, TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256, TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, TLS_DHE_RSA_WITH_AES_256_CBC_SHA256, TLS_DHE_RSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_256_GCM_SHA384, TLS_RSA_WITH_AES_128_GCM_SHA256, TLS_RSA_WITH_AES_256_CBC_SHA256, TLS_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_EMPTY_RENEGOTIATION_INFO_SCSV] 2025-12-09 15:25:07,636 DEBUG [org.apache.http.conn.ssl.SSLConnectionSocketFactory] (executor-thread-782) Starting handshake 2025-12-09 15:25:07,639 DEBUG [org.apache.http.impl.conn.DefaultManagedHttpClientConnection] (executor-thread-782) http-outgoing-1: Shutdown connection 2025-12-09 15:25:07,639 DEBUG [org.apache.http.impl.execchain.MainClientExec] (executor-thread-782) Connection discarded 2025-12-09 15:25:07,639 DEBUG [org.apache.http.impl.conn.PoolingHttpClientConnectionManager] (executor-thread-782) Connection released: [id: 1][route: {tls}->https://myprxy:3128->https://login.microsoftonline.com:443][total available: 0; route allocated: 0 of 64; total allocated: 0 of 128] 2025-12-09 15:25:07,639 ERROR [org.keycloak.broker.oidc.AbstractOAuth2IdentityProvider] (executor-thread-782) Failed to make identity provider oauth callback: javax.net.ssl.SSLException: Unsupported or unrecognized SSL messageAll reactions