How to enable Script with keycloak 21 ? "error "Could not find authenticator provider" #19790

amdev74 · 2023-04-18T16:31:39Z

amdev74
Apr 18, 2023

hello,

On my keycloak 15 instance I have a custom browser flow using some scripts script

In the new /opt/keycloak/conf folder in keycloak 21 I have been creating profile.properties containing

feature.scripts=enabled
feature.upload_scripts=enabled

This was working on keycloak 15 but doesn't seems to works on keycloak 21

When I'm trying to reach my custom browser flow I have an error in the UI and a warning in the log

2023-04-18 18:25:58,995 WARN [org.keycloak.services.resources.admin.AuthenticationManagementResource] (executor-thread-5) Cannot find authentication provider implementation with provider ID 'auth-script-based'

Screenshot

Are Script still available with KC 21 on Quarkus and how to use them please ? Any documentation ?

Thanks

amdev74 · 2023-04-19T13:06:22Z

amdev74
Apr 19, 2023
Author

I tried to rebuild with features=scripts according to this documentation

bin/kc.sh build --features=scripts

It's indeed enabled

/opt/keycloak# bin/kc.sh show-config
Changes detected in configuration. Updating the server image.
Current Mode: production
Current Configuration:
    ...
	kc.feature.scripts =  enabled (PropertiesConfigSource[source=file:/opt/keycloak/bin/../conf/keycloak.conf])
	kc.feature.upload_scripts =  enabled (PropertiesConfigSource[source=file:/opt/keycloak/bin/../conf/keycloak.conf])

But still not able to add a Script to the browser/registration flow, and I still have the error when loading my previous Custom Browser config that was using script

Cannot find authentication provider implementation with provider ID 'auth-script-based'

If no answer I will open a real ticket for this maybe ?

0 replies

bonnm · 2023-04-19T14:01:29Z

bonnm
Apr 19, 2023

Have you followed this guide and packaged your scripts in JAR Files and deployed them via file system?

https://www.keycloak.org/docs/latest/server_development/index.html#_script_providers

Editing scripts in browser and store them in the DB ist not supported any more...

0 replies

amdev74 · 2023-04-19T18:10:32Z

amdev74
Apr 19, 2023
Author

Thanks for this information @bonnm , I didn't know about this migration. I will try tomorrow and close the discussion.

0 replies

amdev74 · 2023-04-20T16:03:36Z

amdev74
Apr 20, 2023
Author

I tried today without success.

I think my structure is good

/opt/keycloak# jar tf providers/ebrains-scripts.jar
check-guest-active.js
is-guest-user.js
matomo.js
META-INF/
META-INF/keycloak-scripts.json
role-based-access.js

Every JS script here is correct I copy paste them from the admin UI of our keycloak 15 version

I think my keycloak-scripts.json is correct too

{
    "authenticators": [
        {
            "name": "Check Feature Authenticate",
            "fileName": "role-based-access.js",
            "description": "lorem ipsum"
        },
        {
            "name": "Check Is Guest User",
            "fileName": "is-guest-user.js",
            "description": "lorem ipsum"
        },
        {
            "name": "Check Guest Active",
            "fileName": "check-guest-active.js",
            "description": "lorem ipsum"
        },
        {
            "name": "Collect statistics",
            "fileName": "matomo.js",
            "description": "lorem ipsum"
        }
    ]
}

Then I build (I tries with and without --features=scripts)

/opt/keycloak# bin/kc.sh build --features=scripts
Updating the configuration and installing your custom providers, if any. Please wait.
2023-04-20 16:54:21,442 INFO  [org.keycloak.common.Profile] (main) Preview features enabled: scripts
2023-04-20 16:54:21,550 INFO  [org.keycloak.common.Profile] (main) Preview features enabled: scripts
2023-04-20 16:54:22,741 INFO  [org.keycloak.common.Profile] (build-53) Preview features enabled: scripts
2023-04-20 16:54:22,766 INFO  [org.keycloak.common.Profile] (build-1) Preview features enabled: scripts
2023-04-20 16:54:24,524 WARN  [org.keycloak.services] (build-56) KC-SERVICES0047: regular-email-validation (eu.*.RegularEmailValidationEnforcerFactory) is implementing the internal SPI authenticator. This SPI is internal and may change without notice
2023-04-20 16:54:25,251 WARN  [org.keycloak.services] (build-56) KC-SERVICES0047: email-whitelist is implementing the internal SPI form-action. This SPI is internal and may change without notice
2023-04-20 16:54:25,253 WARN  [org.keycloak.services] (build-56) KC-SERVICES0047: username-policies  is implementing the internal SPI form-action. This SPI is internal and may change without notice
2023-04-20 16:54:25,261 WARN  [org.keycloak.services] (build-56) KC-SERVICES0047: email-whitelist-listener is implementing the internal SPI eventsListener. This SPI is internal and may change without notice
2023-04-20 16:54:32,372 INFO  [io.quarkus.deployment.QuarkusAugmentor] (main) Quarkus augmentation completed in 11539ms
Server configuration updated and persisted. Run the following command to review the configuration:

It even appears in kc.sh show-config

	kc.provider.file.ebrains-scripts.jar.last-modified =  1682005966298 (PersistedConfigSource)
	kc.provider.file.user-policies.jar.last-modified =  1682000077000 (PersistedConfigSource)

The request to get the flow return this

GET https://hostname/auth/admin/realms/hbp/authentication/flows/Custom%20browser/executions
404

error | "Could not find authenticator provider"

So I feel like nothing happens on the build, the 4 SPI that was saw in the logs are from an other providers (a java extension), but for the scripts extension nothing and my Custom Browser flow is still broken with same error than in the first post

Did I forgot something ?

0 replies

bonnm · 2023-04-21T06:02:06Z

bonnm
Apr 21, 2023

The new jar-based JS providers and the old ones stored in your DB are not the same. You have to delete the old authenticators/flows/subflows/executions and create new ones with the new JS providers. If the deletion is not possible with the admin UI, try to delete them directly in the database. Then, in the admin UI, the new authenticators are listed each as single execution (named as defined in your keycloak-scripts.json), there's no generic javascript executor any more.

To get the scrips executed in Java 17, you need to run Keycloak 21.1 (it ships with the necessary nashorn scripting engine). For older Keycloaks (21.0 and lower), Java 11 is needed (or Java 17 plus manually added nashorn engine).

0 replies

amdev74 · 2023-04-24T15:27:20Z

amdev74
Apr 24, 2023
Author

Thanks for the answer !

Indeed unbind my KC15 flow remove it and recreate it solved my issue !

Also I had to add ENV KC_FEATURES=scripts in my dockerfile, RUN /opt/keycloak/bin/kc.sh build --features=scripts was not working for some reasons

I close this thread I hope it will help other persons.

0 replies

achetronic · 2025-08-30T17:04:15Z

achetronic
Aug 30, 2025

Hello! I would like to know why the ability to create and store JS scripts in the UI was deprecated

0 replies

How to enable Script with keycloak 21 ? "error "Could not find authenticator provider" #19790

Uh oh!

Uh oh!

amdev74 Apr 18, 2023

Replies: 7 comments

Uh oh!

Uh oh!

amdev74 Apr 19, 2023 Author

Uh oh!

bonnm Apr 19, 2023

Uh oh!

amdev74 Apr 19, 2023 Author

Uh oh!

amdev74 Apr 20, 2023 Author

Uh oh!

Uh oh!

bonnm Apr 21, 2023

Uh oh!

amdev74 Apr 24, 2023 Author

Uh oh!

achetronic Aug 30, 2025

amdev74
Apr 18, 2023

amdev74
Apr 19, 2023
Author

bonnm
Apr 19, 2023

amdev74
Apr 19, 2023
Author

amdev74
Apr 20, 2023
Author

bonnm
Apr 21, 2023

amdev74
Apr 24, 2023
Author

achetronic
Aug 30, 2025