You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
external idp + external consent app → unexpected redirect back to IdP after consent
#42073
I am working with Keycloak (v26.2.4) and integrating with an external Identity Provider (OIDC broker). We have added a custom external consent application into the broker flow (post login flow) via SPI. After returning from consent, I’m seeing unexpected behaviour and looking for guidance.
Flow we have implemented
External client uses PAR endpoint → gets request_uri.
Client calls /authorize.
Keycloak redirects the user to the external IdP.
User logs in successfully at IdP and comes back to Keycloak.
Keycloak invokes post login flow which invokes our SPI and redirects user to an external consent app. In SPI, we are creating callbackUrl including the action token.
User approves consent → consent app redirects back to Keycloak on the callbackUrl.
Expectation: Keycloak should resume the flow, generate an authorization code, and redirect to the client redirect_uri.
Actual behavior: Keycloak instead redirects the user back to the IdP for login.
Question
It looks like the authentication flow never reaches the point where LOGIN is recorded after consent and Keycloak restarts the IdP login instead of resuming.
Has anyone seen this before with a broker + external consent SPI pattern?
How can I make Keycloak resume the existing auth session instead of restarting the IdP login?
Is there a recommended way to insert an external consent step between broker login and client code issuance without breaking the broker session?
Any insights or experiences would be much appreciated. Thanks!
reacted with thumbs up emoji reacted with thumbs down emoji reacted with laugh emoji reacted with hooray emoji reacted with confused emoji reacted with heart emoji reacted with rocket emoji reacted with eyes emoji
Uh oh!
There was an error while loading. Please reload this page.
I am working with Keycloak (v26.2.4) and integrating with an external Identity Provider (OIDC broker). We have added a custom external consent application into the broker flow (post login flow) via SPI. After returning from consent, I’m seeing unexpected behaviour and looking for guidance.
Flow we have implemented
Question
It looks like the authentication flow never reaches the point where LOGIN is recorded after consent and Keycloak restarts the IdP login instead of resuming.
Any insights or experiences would be much appreciated. Thanks!
All reactions