Callback API returns 401 after login after keycloak upgrade to 26.2.5 #40823

abhishek-shrivastava-netspi · 2025-07-01T08:57:01Z

abhishek-shrivastava-netspi
Jul 1, 2025

I am trying to upgrade Keycloak from 24 -> 26.
After the upgrade, my login journey has started to break. Once the login happens and the call comes back to my backend using the callback api, I get 401.

the callback api looks something like this.

https://myhostname.ai/api/auth/callback?state=https%3A%2F%2Fmyhostname.ai%2Flanding?back%3D&session_state=c253a8e7-1015-47f2-a56b-780f68098d16&iss=https%3A%2F%2Fmyhostname.ai%2Fauth%2Frealms%2Fdemo&code=1aebdc91-404a-4805-aae0-5583137b17f6.c253a8e7-1015-47f2-a56b-780f68098d16.b7c4c5b0-39b8-4d5d-9132-1d4a76fa8e5f

After investigating it further, I realised the token exchange api is breaking.

token exchange url https://myhostname.ai/auth/realms/platformdemo/protocol/openid-connect/token

payload: {grant_type=[authorization_code], code=[949df05b-4bfb-4361-9dd4-1c967ba315ce.87b65bb6-a8d3-4dab-8eab-a91d0dad8288.b7c4c5b0-39b8-4d5d-9132-1d4a76fa8e5f], redirect_uri=[https://myhostname.ai/api/auth/callback], client_id=[platform], client_secret=[X2snpdNd5maiW5MqhXWiSYvfQYU9D56a]}

Response from Keycloak for token exchange: <!doctype html><html lang="en"><head><meta charset="utf-8"/><link rel="icon" href="/favicon.ico"/><meta name="viewport" content="width=device-width,initial-scale=1"/><meta name="theme-color" content="#000000"/><meta name="description" content="NetSPI Platform"/><title>NetSPI Platform</title><script defer="defer" src="/main.bundle.8fcbdb6432de9cb0e98c.js"></script><link href="/main.3db24d12c69f738b5402.styles.css" rel="stylesheet"></head><body><noscript>You need to enable JavaScript to run this app.</noscript><div id="root"></div></body></html>, status: 200 OK

It should typically return JSON with access token. interestingly when I remove the whole callback and just call

https://myhostname.ai/ I am able to successfully login. and if I just retry on 401 page the response changes to

400 Bad Request: "{"error":"invalid_grant","error_description":"Code not valid"}"

dockerfile

# Use Maven as the base image
FROM maven:3.8.4-openjdk-17-slim AS kcbuilder

# Set the working directory
WORKDIR /app

# Copy the Maven project files to the container
WORKDIR ./src/
COPY providers /app/src/

# Build the Maven project and package the application JAR
RUN mkdir -p /app/src/providers_jar/
RUN for i in `find /app/src/* -maxdepth 0 -print`; do echo "entering into $i" && cd $i && mvn clean install && cp -pv $i/target/*.jar /app/src/providers_jar/; done
FROM quay.io/keycloak/keycloak:26.2.5 as builder

# Just relevant if you would activate specific features
ARG KC_DB
ARG KC_HEALTH_ENABLED
ARG KC_HTTP_RELATIVE_PATH
ARG KC_FEATURES_DISABLED
ENV KC_HTTP_RELATIVE_PATH="/auth"
ENV KC_DB="postgres"
ENV KC_HEALTH_ENABLED="true"
ENV KC_FEATURES_DISABLED="admin,admin-fine-grained-authz,account,ciba,impersonation,kerberos,par,step-up-authentication,web-authn"

# JDBC-PING cluster setup
RUN mkdir -p /opt/keycloak/data/import
RUN mkdir -p /opt/keycloak/providers
ENV KC_CACHE_CONFIG_FILE=cache-ispn-jdbc-ping.xml
COPY ./cache-ispn-jdbc-ping.xml /opt/keycloak/conf/cache-ispn-jdbc-ping.xml
ADD ./themes/ /opt/keycloak/
COPY --from=kcbuilder --chown=keycloak:keycloak /app/src/providers_jar/*.jar /opt/keycloak/providers/
#COPY postgresql-42.7.3.jar /opt/keycloak/providers/
RUN chmod 644 /opt/keycloak/providers/*.jar

#RUN sha256sum /opt/keycloak/providers/*.jar > /opt/keycloak/providers/checksums.txt
# Install curl for ECS health check
FROM registry.access.redhat.com/ubi9 AS ubi-micro-build
RUN mkdir -p /mnt/rootfs
RUN dnf install  --installroot /mnt/rootfs curl --releasever 9 --setopt  install_weak_deps=false --nodocs -y; dnf --installroot /mnt/rootfs clean  all


# Custom configuration and JAR setup
#FROM builder
FROM quay.io/keycloak/keycloak:26.2.5

# Copy everything from builder, including the full built Keycloak instance
COPY --from=builder /opt/keycloak/ /opt/keycloak/
RUN rm -fv /opt/keycloak/providers/original-com.netspi.keycloak.sms-authenticator.jar /opt/keycloak/providers/original-com.netspi.keycloak.user-enable-disable-event-listener.jar

COPY --from=builder /opt/keycloak/lib/quarkus/ /opt/keycloak/lib/quarkus/
COPY --from=builder /opt/keycloak/conf/cache-ispn-jdbc-ping.xml /opt/keycloak/conf
COPY --from=builder /opt/keycloak/providers/*.jar /opt/keycloak/providers/
RUN rm -fv /opt/keycloak/providers/original-com.netspi.keycloak.sms-authenticator.jar /opt/keycloak/providers/original-com.netspi.keycloak.user-enable-disable-event-listener.jar
RUN mkdir -p /opt/keycloak/data/password-blacklists
COPY ./password-blacklists/password-list-filtered.txt /opt/keycloak/data/password-blacklists/password.txt
ADD ./themes/ /opt/keycloak/themes/
COPY --from=ubi-micro-build /mnt/rootfs /
RUN touch -m --date=@1743465600 /opt/keycloak/providers/*
#RUN /opt/keycloak/bin/kc.sh build --verbose
WORKDIR /opt/keycloak


# Only applies if you have customized JARs and Themes
#COPY ./target/*.jar /opt/keycloak/<lib>
#COPY ./themes/ /opt/keycloak/themes/
#Add datadog APM
USER root
ADD 'https://dtdg.co/latest-java-tracer' /tmp/dd-java-agent.jar
ENV SERVICE_NAME=auth-service
ENV CUST_ID dev01
#RUN chown 1000:1000 /tmp/dd-java-agent.jar /opt/keycloak/providers/*.jar
RUN chown 1000:1000 /tmp/dd-java-agent.jar

COPY entrypoint.sh /entrypoint.sh
RUN chmod +x /entrypoint.sh

USER 1000
ENTRYPOINT ["/entrypoint.sh"]
EXPOSE 8080

entrypoint to start

#!/bin/sh
JAVA_OPTS_APPEND="-javaagent:/tmp/dd-java-agent.jar \
                  -Ddd.profiling.enabled=true \
                  -XX:FlightRecorderOptions=stackdepth=256 \
                  -Ddd.logs.injection=true \
                  -Ddd.service=${CUST_ID:-dev01}-${SERVICE_NAME}"

export JAVA_OPTS_APPEND="${JAVA_OPTS_APPEND}"
# Start Keycloak
echo "building in entrypoint"
/opt/keycloak/bin/kc.sh build --verbose --legacy-observability-interface=true
echo "starting in entrypoint"
exec /opt/keycloak/bin/kc.sh start --verbose --optimized --proxy-headers xforwarded --log-level=DEBUG

a couple of configs that might help understand the issue

    cache_owners_count: 2
    kc_cache_config_file: "cache-ispn-jdbc-ping.xml"
    jgroups_discovery_protocol: "JDBC_PING"
    kc_proxy: "edge"
    kc_ui_admin: "netspiadm"
    kc_db: "postgres"
    kc_log_level: "ERROR"
    kc_hostname: "myhostname.ai"
    kc_hostname_relative_path: "/auth"
    kc_hostname_admin: "myhostname-auth.ai"
    kc_realm_name: "platformdemo"
    kc_features_disabled: "admin,admin-fine-grained-authz,account,ciba,impersonation,kerberos,par,step-up-authentication,web-authn"
    backend_db_user: "user_backend"

there are some variables that I provide directly to ecs task. I can attach it if it is required.

I dont have any reverse proxy configured but I do have ALB thats in place

Navigation Menu

Repository navigation

Callback API returns 401 after login after keycloak upgrade to 26.2.5 #40823

Uh oh!

{{title}}

Uh oh!

Replies: 0 comments

Select a reply

Uh oh!

Callback API returns 401 after login after keycloak upgrade to 26.2.5 #40823

Uh oh!

abhishek-shrivastava-netspi Jul 1, 2025

Replies: 0 comments

abhishek-shrivastava-netspi
Jul 1, 2025