Repository navigation
Replies: 3 comments 4 replies
|
Did you find a solution for this? I am experiencing the exact same problem with the same errors. Signing in with a company account works, but a private account does not work. |
|
Same for me |
|
I can't remember what I did in the end. But try these suggestions. I ran the error via chatgpt: "The GitHub discussion you referenced, Keycloak Discussion #14929, addresses an issue where users encounter a 502 error during the OAuth2 callback from Microsoft to Keycloak. The error message in the logs is: Failed to make identity provider oauth callback: org.keycloak.broker.provider.IdentityBrokerException: Could not obtain user profile from Microsoft Graph This problem arises when Keycloak is configured to use Microsoft as an Identity Provider (IdP), and the callback fails to retrieve the user's profile information from Microsoft Graph. Possible Causes and Solutions
Ensure that your Azure App Registration has the necessary API permissions. Specifically, the app should have delegated permissions for: User.Read openid profile After adding these permissions, remember to grant admin consent for them.
Verify that the redirect URI specified in Azure matches exactly with the one configured in Keycloak. Any mismatch can lead to callback errors.
Some users have reported that signing in with personal Microsoft accounts fails, while organizational accounts work correctly. This could be due to restrictions or limitations in the Azure App Registration settings. Ensure that your app is configured to support both personal and organizational accounts if needed.
The issue was reported with Keycloak version 19.0.2. Consider upgrading to a newer version of Keycloak, as updates often include bug fixes and improved compatibility with identity providers.
A 502 error can also result from network issues. Ensure that your Keycloak server can reach Microsoft's endpoints and that there are no firewall rules blocking the communication." |
|
Thanks for your reply! I tried these things but somehow it still doesn't work for personal accounts. Have you been able to make it work for users with a personal microsoft account? Somehow I think something must be different between how the redirect or accessing the user data is handled for organizational and personal accounts. But I can't figure out what I am doing wrong. |
|
I think i also was only able to get it to work on commercial accounts. |
|
But there must be different privileges between a personal and work account, do you find any noticeable differences? |
|
In case anybody ever needs this I think I finally found a solution that is working. I think the "problem" was inside the microsoft provider in keycloak. The URLs for the user endpoint are different for organizational and personal accounts. When configuring the identity provider on the microsoft side it is possible to choose personal and organizational accounts, but I think keycloak couldn't handle it or differ when to use which endpoint! You need to create an OPENID Connect v1.0 provider. I needed to configure the following for the OpenID Connect settings The issuer needs to be empty otherwise keycloak tries to call this URL with the tenant id of the user and throws an exception because it does not match. These URLs work for personal and organizational accounts. As far as I have seen keycloak checks if it is configured for personal or organizational accounts and uses the /common if both should be working. But not for the User Info URL. And that's why this exception is thrown. I already created a custom mapper for the user attributes first name and last name. In the microsoft id token the first name is called given_name for organizations and givenname for personal accounts. Same for family_name and familyname. |
Uh oh!
There was an error while loading. Please reload this page.
I am running keycloak 19.0.2 in dev mode. When trying to login to microsoft using the oauth2 flow, I get 502 error in the browser on the callback to keycloak. The code param has a strange value also.
I believe it has something to do with user permissions, but I can clearly see I have defined them.
Steps:
The keycloak logs throw this errors.
2022-10-17 13:08:46,517 ERROR [org.keycloak.broker.oidc.AbstractOAuth2IdentityProvider] (executor-thread-42) Failed to make identity provider oauth callback: org.keycloak.broker.provider.IdentityBrokerException: Could not obtain user profile from Microsoft Graph2022-10-17 13:08:46,542 WARN [org.keycloak.events] (executor-thread-42) type=IDENTITY_PROVIDER_LOGIN_ERROR, realmId=8ca06b23-d544-4464-a3bf-448be5308802, clientId=recruit-api, userId=null, ipAddress=127.0.0.1, error=identity_provider_login_failure, code_id=62aaf7bf-9c08-4c88-a7c3-e6f7af282de1, authSessionParentId=62aaf7bf-9c08-4c88-a7c3-e6f7af282de1, authSessionTabId=WjArYJ99WyMAll reactions