Custom IDP: OAuth 2.0 Errors Not Propagated to Application #36303

benhansson · 2025-01-08T14:51:01Z

benhansson
Jan 8, 2025

I’ve implemented a custom OpenID Connect Identity Provider (IDP) and integrated it into Keycloak. When executing the authorization flow, my IDP returns detailed error responses as per the OAuth 2.0 Authorization Framework.

However, I’ve observed that Keycloak does not propagate these errors, or even the error codes, to the application as expected. Instead, it seems several required error codes are missing. Upon reviewing the source code, the issue appears to originate from the following section:

keycloak/services/src/main/java/org/keycloak/broker/oidc/AbstractOAuth2IdentityProvider.java

Lines 524 to 535 in 0783e2a

    
           if (error != null) { 
        
               logErroneousRedirectUrlError("Redirection URL contains an error", providerConfig); 
        
               if (error.equals(ACCESS_DENIED)) { 
        
                   return callback.cancelled(providerConfig); 
        
               } else if (error.equals(OAuthErrorException.LOGIN_REQUIRED) || error.equals(OAuthErrorException.INTERACTION_REQUIRED)) { 
        
                   return callback.error(error); 
        
               } else if (error.equals(OAuthErrorException.TEMPORARILY_UNAVAILABLE) && Constants.AUTHENTICATION_EXPIRED_MESSAGE.equals(errorDescription)) { 
        
                   return callback.retryLogin(this.provider, authSession); 
        
               } else { 
        
                   return callback.error(Messages.IDENTITY_PROVIDER_UNEXPECTED_ERROR); 
        
               } 
        
           }

Could you clarify if this is intentional behaviour or a limitation in the current implementation? If it’s the latter, is there a recommended workaround to ensure the error messages or codes from the custom IDP are correctly propagated to the client application?

Navigation Menu

Repository navigation

Custom IDP: OAuth 2.0 Errors Not Propagated to Application #36303

Uh oh!

{{title}}

Uh oh!

Replies: 0 comments

Select a reply

Uh oh!

Custom IDP: OAuth 2.0 Errors Not Propagated to Application #36303

Uh oh!

benhansson Jan 8, 2025

Replies: 0 comments

benhansson
Jan 8, 2025