Page has expired #38171

EdwardMelendezM · 2025-03-17T17:45:36Z

EdwardMelendezM
Mar 17, 2025

Hi, everyone.
I am implementing a custom authentication but I have an error.
This is the context:

I've implemented 'Check User SSO'
I need to know if the user have some linked account SSO.

This is the code:

@Override
public void authenticate(AuthenticationFlowContext context) {
    // 1. Retrieve the current user
    UserModel user = context.getUser();
    if (user == null) {
        context.failure(AuthenticationFlowError.UNKNOWN_USER);
        return;
    }

    // 2. Get the list of federated identity providers for the user
    List<String> identityProviders = getIdentityProviders(context.getSession(), context.getRealm(), user);
    if (identityProviders == null || identityProviders.isEmpty()) {
        context.attempted();
        return;
    }
    // Select the first provider, e.g., "google"
    String provider = identityProviders.get(0);
    String realmName = context.getRealm().getName();

    // 3. Extract relevant parameters from the original request URL
    //    NOTE: The "execution" parameter is not extracted, as the final URL should not contain it.
    MultivaluedMap<String, String> queryParams = context.getHttpRequest().getUri().getQueryParameters();
    String clientData = queryParams.getFirst("client_data");
    String sessionCode = queryParams.getFirst("session_code");

    // For tab_id, use the value from the request if available; otherwise, use the session tab_id.
    String tabId = queryParams.getFirst("tab_id");
    if (tabId == null || tabId.isEmpty()) {
        tabId = context.getAuthenticationSession().getTabId();
    }

    // 4. Build the URL to the broker endpoint without including "execution"
    //    The URL format will be:
    //    /realms/{realm}/broker/{provider}/login?client_id=...&tab_id=...&client_data=...&session_code=...
    UriBuilder uriBuilder = context.getUriInfo().getBaseUriBuilder()
            .path("realms").path(realmName)
            .path("broker").path(provider).path("login")
            .queryParam("client_id", context.getAuthenticationSession().getClient().getClientId())
            .queryParam("tab_id", tabId);

    if (clientData != null && !clientData.isEmpty()) {
        uriBuilder.queryParam("client_data", clientData);
    }
    if (sessionCode != null && !sessionCode.isEmpty()) {
        uriBuilder.queryParam("session_code", sessionCode);
    }

    URI redirectUri = uriBuilder.build(realmName);

    // 5. Send the challenge to redirect (HTTP 303 See Other)
    //    context.challenge() is used to prevent authentication session termination 
    //    and allow the flow to continue.
    context.challenge(Response.seeOther(redirectUri).build());
}

I've tested with user with password. And that work good.
But when I write the username of user and I know this user have a linked account google this happen:

ShahinRashidbayliCofinityX · 2025-05-20T09:01:48Z

ShahinRashidbayliCofinityX
May 20, 2025

Hi @EdwardMelendezM,
I am facing the same kind of issue

Issue:
User is redirected to "Page has expired" and gets the below log message when the user selects one of the available linked IDPs, let's say idp22, and clicks the browser back button, and selects a different IDP or even selects the same IDP.

According to my research, it is related to session management in the 24+ versions of Keycloak.
Once the session is redirected to an identity provider(IdP) login page, the session is marked as used. If the user tries to go back(Clicking browser back button using same session id) and select a different IdP or the same IdP, the session (and specifically the code_id) may no longer be valid, leading to the "Page has expired" error.

Understanding the Issue:
The code_id in Keycloak's Identity Broker flow is used to identify a specific authentication session. Once it is used (i.e., the flow redirects to an IdP), it cannot be reused because the session is considered "finalized."
This can occur when a user clicks the browser back button after initiating the login flow with a specific IdP. When user try to select another IdP or the same IdP, the code_id is stale, and the session is invalidated.

2025-05-19 09:21:12,019 ERROR [org.keycloak.services.resources.IdentityBrokerService] (executor-thread-13) unexpectedErrorHandlingRequestMessage: jakarta.ws.rs.WebApplicationException: HTTP 200 OK
2025-05-19T09:21:12.019567627Z  at org.keycloak.services.resources.IdentityBrokerService.pars
8000
eSessionCode(IdentityBrokerService.java:1161)
2025-05-19T09:21:12.019614127Z  at org.keycloak.services.resources.IdentityBrokerService.performLogin(IdentityBrokerService.java:380)
2025-05-19T09:21:12.019618168Z  at org.keycloak.services.resources.IdentityBrokerService$quarkusrestinvoker$performLogin_639fa76256feb47da66621dcdd20f8de386404c5.invoke(Unknown Source)
2025-05-19T09:21:12.019620168Z  at org.jboss.resteasy.reactive.server.handlers.InvocationHandler.handle(InvocationHandler.java:29)

0 replies

Navigation Menu

Repository navigation

Page has expired #38171

Uh oh!

{{title}}

Uh oh!

Replies: 1 comment

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Page has expired #38171

Uh oh!

EdwardMelendezM Mar 17, 2025

Replies: 1 comment

Uh oh!

ShahinRashidbayliCofinityX May 20, 2025

EdwardMelendezM
Mar 17, 2025

ShahinRashidbayliCofinityX
May 20, 2025