Why my custom `AbstractIdpAuthenticator` always failed: `Not found serialized context in clientSession` #47183

fredsuvn · 2026-03-16T11:21:01Z

fredsuvn
Mar 16, 2026

I add a new basic flow in Authentication, and add only one excetuion:

Here is the code:

public class MyPostBrokerAuthenticator extends AbstractIdpAuthenticator {

    private static final Logger logger = Logger.getLogger(MyPostBrokerAuthenticator.class);

    @Override
    protected void authenticateImpl(
        AuthenticationFlowContext context,
        SerializedBrokeredIdentityContext serializedCtx,
        BrokeredIdentityContext brokerContext
    ) {
        logger.info("authenticateImpl: " + serializedCtx.getUsername());
        UserModel user = context.getUser();
        if (user != null) {
            if (Objects.equals(user.getUsername(), "bulaize")) {
                Response customErrorResponse = context.form()
                    .setError("accountDisabledMessage")
                    .createErrorPage(Response.Status.FORBIDDEN);
                context.failure(AuthenticationFlowError.ACCESS_DENIED, customErrorResponse);
                return;
            }
        }
        context.success();
    }

    @Override
    protected void actionImpl(
        AuthenticationFlowContext context,
        SerializedBrokeredIdentityContext serializedCtx,
        BrokeredIdentityContext brokerContext
    ) {
        logger.info("actionImpl: " + serializedCtx.getUsername());
        context.success();
    }

    @Override
    public boolean requiresUser() {
        logger.info("requiresUser");
        return false;
    }

    @Override
    public boolean configuredFor(KeycloakSession session, RealmModel realm, UserModel user) {
        logger.info("configuredFor");
        return true;
    }
}

Then I add this flow in Post login flow of Identity Providers:

But it fails to run:

2026-03-16 19:17:47,872 INFO  [com.mykeycloak.sso.keycloak.spi.MyPostBrokerAuthenticator] (executor-thread-1) requiresUser
2026-03-16 19:17:47,872 INFO  [com.mykeycloak.sso.keycloak.spi.MyPostBrokerAuthenticator] (executor-thread-1) configuredFor
2026-03-16 19:17:47,872 WARN  [org.keycloak.services] (executor-thread-1) KC-SERVICES0013: Failed authentication: org.keycloak.authentication.AuthenticationFlowException: Not found serialized context in clientSession
        at org.keycloak.authentication.authenticators.broker.AbstractIdpAuthenticator.authenticate(AbstractIdpAuthenticator.java:62)
        at org.keycloak.authentication.DefaultAuthenticationFlow.processSingleFlowExecutionModel(DefaultAuthenticationFlow.java:472)
        at org.keycloak.authentication.DefaultAuthenticationFlow.processFlow(DefaultAuthenticationFlow.java:275)
        at org.keycloak.authentication.AuthenticationProcessor.authenticateOnly(AuthenticationProcessor.java:1118)
        at org.keycloak.services.resources.LoginActionsService$1.authenticateOnly(LoginActionsService.java:938)
        at org.keycloak.authentication.AuthenticationProcessor.authenticate(AuthenticationProcessor.java:956)
        at org.keycloak.services.resources.LoginActionsService.processFlow(LoginActionsService.java:383)
        at org.keycloak.services.resources.LoginActionsService.brokerLoginFlow(LoginActionsService.java:970)
        at org.keycloak.services.resources.LoginActionsService.postBrokerLoginGet(LoginActionsService.java:865)
        at org.keycloak.services.resources.LoginActionsService$quarkusrestinvoker$postBrokerLoginGet_e4fdf4ae3eb1eaf7ba14f877c8cff2db4c8b4c10.invoke(Unknown Source)
        at org.jboss.resteasy.reactive.server.handlers.InvocationHandler.handle(InvocationHandler.java:29)
        at io.quarkus.resteasy.reactive.server.runtime.QuarkusResteasyReactiveRequestContext.invokeHandler(QuarkusResteasyReactiveRequestContext.java:183)
        at org.jboss.resteasy.reactive.common.core.AbstractResteasyReactiveContext.run(AbstractResteasyReactiveContext.java:147)
        at io.quarkus.vertx.core.runtime.VertxCoreRecorder$15.runWith(VertxCoreRecorder.java:645)
        at org.jboss.threads.EnhancedQueueExecutor$Task.doRunWith(EnhancedQueueExecutor.java:2651)
        at org.jboss.threads.EnhancedQueueExecutor$Task.run(EnhancedQueueExecutor.java:2630)
        at org.jboss.threads.EnhancedQueueExecutor.runThreadBody(EnhancedQueueExecutor.java:1622)
        at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1589)
        at org.jboss.threads.DelegatingRunnable.run(DelegatingRunnable.java:11)
        at org.jboss.threads.ThreadLocalResettingRunnable.run(ThreadLocalResettingRunnable.java:11)
        at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30)
        at java.base/java.lang.Thread.run(Unknown Source)

why?

Oluwatobi-Mustapha · 2026-04-03T01:16:26Z

Oluwatobi-Mustapha
Apr 3, 2026

Hi @fredsuvn, I think you didn’t do anything weird here.

Your authenticator extends AbstractIdpAuthenticator, and that class expects broker data in BROKERED_CONTEXT (first-broker-login flow).

But in Post Login Flow, Keycloak stores broker context in PBL_BROKERED_IDENTITY_CONTEXT instead.

So it fails with Not found serialized context in clientSession before authenticateImpl() is called.

If you want this in Post Login Flow, use a regular Authenticator (or override authenticate()) and read PBL_BROKERED_IDENTITY_CONTEXT.

If you keep AbstractIdpAuthenticator as-is, use it in First Login Flow.

0 replies

Navigation Menu

Repository navigation

Why my custom `AbstractIdpAuthenticator` always failed: `Not found serialized context in clientSession` #47183

Uh oh!

{{title}}

Uh oh!

Replies: 1 comment

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Why my custom AbstractIdpAuthenticator always failed: Not found serialized context in clientSession #47183

Uh oh!

fredsuvn Mar 16, 2026

Replies: 1 comment

Uh oh!

Oluwatobi-Mustapha Apr 3, 2026

Why my custom `AbstractIdpAuthenticator` always failed: `Not found serialized context in clientSession` #47183

fredsuvn
Mar 16, 2026

Oluwatobi-Mustapha
Apr 3, 2026