Attempting to use kc_idp_hint with PAR seems to always result in 'Invalid request' #41874

sychare · 2025-08-14T09:46:31Z

sychare
Aug 14, 2025

Is passing along kc_idp_hint for Pushed Authorisation Requests expected to work (i.e. is this a bug) or is it simply not supported using the PAR mechanism?

Seemingly no matter where I apply the query parameter (whether to the PAR request URL or the eventual authorize URL) I hit a wall with 'Invalid request' or the hint being ignored.

If instead I force disable the use of PAR in my client the hint is processed as expected.

Hopefully I'm doing something wrong, as I'd like to keep PAR enabled if possible, and if so please do let me know!

underq · 2025-08-18T10:04:40Z

underq
Aug 18, 2025

Hi @sychare,
Do you try to add kc_idp_hint outside of the PAR request ? like auth?client_id=....&request_uri=...&kc_idp_hint=...
I meet the same problem with prompt param

1 reply

sychare Aug 18, 2025
Author

I attempted to inject it into various parts of the flow to no avail. Disabling PAR from the client side and it works fine.

jesevis · 2025-10-06T14:09:13Z

jesevis
Oct 6, 2025

Same here. I think the problem is here.

keycloak/services/src/main/java/org/keycloak/authentication/authenticators/browser/IdentityProviderAuthenticator.java

Line 51 in ae7c2d2

    
           if (context.getUriInfo().getQueryParameters().containsKey(AdapterConstants.KC_IDP_HINT)) {

PAR request params are "hidden" from the query and authenticator is unable to see the passed kc_idp_hint.

One workaround could be to duplicate browser flow (or use existing) and set the explicit IDP of your choice in Identity Provider Redirector step. But this moves the dynamic IDP control from the client to a static IDP choice in Keycloak.

1 reply

sychare Oct 6, 2025
Author

Yeah, unfortunately that wasn't a viable approach for us. In the end we've simply left PAR disabled for now.

Jeroen-Van-Loocke · 2025-11-05T15:33:01Z

Jeroen-Van-Loocke
Nov 5, 2025

We have also tested this and came to the same conclusion.
When a fixed IDP is set in the "Identity Provider Redirector" config it works, but when we use the kc_idp_hint it no longer works and we get the following error:
2025-11-05 16:08:57,144 DEBUG [org.keycloak.authentication.AuthenticationSelectionResolver] (executor-thread-1) Selections when trying execution 'identity-provider-redirector' : [ authSelection - identity-provider-redirector] 2025-11-05 16:08:57,144 DEBUG [org.keycloak.authentication.DefaultAuthenticationFlow] (executor-thread-1) invoke authenticator.authenticate: identity-provider-redirector 2025-11-05 16:08:57,144 DEBUG [org.keycloak.authentication.DefaultAuthenticationFlow] (executor-thread-1) authenticator ATTEMPTED: identity-provider-redirector 2025-11-05 16:08:57,148 WARN [org.keycloak.services] (executor-thread-1) KC-SERVICES0013: Failed authentication: org.keycloak.authentication.AuthenticationFlowException at org.keycloak.authentication.AuthenticationProcessor.authenticateOnly(AuthenticationProcessor.java:1128) at org.keycloak.authentication.AuthenticationProcessor.authenticate(AuthenticationProcessor.java:955) at org.keycloak.services.resources.LoginActionsService.processFlow(LoginActionsService.java:381) at org.keycloak.services.resources.LoginActionsService.processAuthentication(LoginActionsService.java:350) at org.keycloak.services.resources.LoginActionsService.authenticate(LoginActionsService.java:342) at org.keycloak.services.resources.LoginActionsService$quarkusrestinvoker$authenticate_1e8e02bfcd078bee44c98357a53697b22d76edef.invoke(Unknown Source) at org.jboss.resteasy.reactive.server.handlers.InvocationHandler.handle(InvocationHandler.java:29) at io.quarkus.resteasy.reactive.server.runtime.QuarkusResteasyReactiveRequestContext.invokeHandler(QuarkusResteasyReactiveRequestContext.java:183) at org.jboss.resteasy.reactive.common.core.AbstractResteasyReactiveContext.run(AbstractResteasyReactiveContext.java:147) at io.quarkus.vertx.core.runtime.VertxCoreRecorder$15.runWith(VertxCoreRecorder.java:645) at org.jboss.threads.EnhancedQueueExecutor$Task.doRunWith(EnhancedQueueExecutor.java:2651) at org.jboss.threads.EnhancedQueueExecutor$Task.run(EnhancedQueueExecutor.java:2630) at org.jboss.threads.EnhancedQueueExecutor.runThreadBody(EnhancedQueueExecutor.java:1622) at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1589) at org.jboss.threads.DelegatingRunnable.run(DelegatingRunnable.java:11) at org.jboss.threads.ThreadLocalResettingRunnable.run(ThreadLocalResettingRunnable.java:11) at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30) at java.base/java.lang.Thread.run(Thread.java:1583)

For us it is also not a viable option to set this to a fixed IDP, the idp hint has to be determined by the client side.
PAR becomes more important and this issue makes it unusable.
It should be possible to send "the old query parameters" in the back channel request like what is done with the redirect uri.

Created an issue: #44002

0 replies

laurids · 2026-04-08T17:37:08Z

laurids
Apr 8, 2026

kc_idp_hint support for PAR added in Keycloak 26.6.0, see #47244

0 replies

Navigation Menu

Repository navigation

Attempting to use kc_idp_hint with PAR seems to always result in 'Invalid request' #41874

Uh oh!

{{title}}

Uh oh!

Replies: 4 comments 2 replies

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Attempting to use kc_idp_hint with PAR seems to always result in 'Invalid request' #41874

Uh oh!

sychare Aug 14, 2025

Replies: 4 comments · 2 replies

Uh oh!

underq Aug 18, 2025

Uh oh!

sychare Aug 18, 2025 Author

Uh oh!

jesevis Oct 6, 2025

Uh oh!

sychare Oct 6, 2025 Author

Uh oh!

Uh oh!

Jeroen-Van-Loocke Nov 5, 2025

Uh oh!

laurids Apr 8, 2026

sychare
Aug 14, 2025

Replies: 4 comments 2 replies

underq
Aug 18, 2025

sychare Aug 18, 2025
Author

jesevis
Oct 6, 2025

sychare Oct 6, 2025
Author

Jeroen-Van-Loocke
Nov 5, 2025

laurids
Apr 8, 2026