"Expired_Code" error in keycloak HA #37482

enricosoft · 2025-02-19T09:30:49Z

enricosoft
Feb 19, 2025

Hi,
I'm running 3 nodes of Keycloak in Azure Container Apps with infinispan distributed cache in front.
Yesterday I catched the following WARN in my container's logs and in that moment I was not able to login to web admin... it continued to log that warn every time I tried to login.

2025-02-18T13:10:59.3949172Z stdout F 2025-02-18 13:10:59,394 WARN [org.keycloak.events] (executor-thread-10) type="LOGIN_ERROR", realmId="a1d39a9f-95b4-4fd6-9538-171ed94bead6", realmName="master", clientId="security-admin-console", userId="null", ipAddress="xx.xx.xx.xx", error="expired_code", restart_after_timeout="true"

After restarted my Azure Container App I solved. I supposed that the distributed cache could be the problem... is it possible?

My infinispan cache configuration was the following (default):

<cache-container name="keycloak">
        <transport lock-timeout="60000" stack="jdbc-ping"/>
		
        <local-cache name="realms" simple-cache="true">
            <encoding>
                <key media-type="application/x-java-object"/>
                <value media-type="application/x-java-object"/>
            </encoding>
            <memory max-count="10000"/>
        </local-cache>
        <local-cache name="users" simple-cache="true">
            <encoding>
                <key media-type="application/x-java-object"/>
                <value media-type="application/x-java-object"/>
            </encoding>
            <memory max-count="10000"/>
        </local-cache>
		<local-cache name="authorization" simple-cache="true">
            <encoding>
                <key media-type="application/x-java-object"/>
                <value media-type="application/x-java-object"/>
            </encoding>
            <memory max-count="10000"/>
        </local-cache>
		<local-cache name="keys" simple-cache="true">
            <encoding>
                <key media-type="application/x-java-object"/>
                <value media-type="application/x-java-object"/>
            </encoding>
            <expiration max-idle="3600000"/>
            <memory max-count="1000"/>
        </local-cache>
				
        <distributed-cache name="sessions" owners="2">
            <expiration lifespan="-1"/>
        </distributed-cache>
        <distributed-cache name="authenticationSessions" owners="2">
            <expiration lifespan="-1"/>
        </distributed-cache>
        <distributed-cache name="offlineSessions" owners="2">
            <expiration lifespan="-1"/>
        </distributed-cache>
        <distributed-cache name="clientSessions" owners="2">
            <expiration lifespan="-1"/>
        </distributed-cache>
        <distributed-cache name="offlineClientSessions" owners="2">
            <expiration lifespan="-1"/>
        </distributed-cache>
        <distributed-cache name="loginFailures" owners="2">
            <expiration lifespan="-1"/>
        </distributed-cache>                      
        <distributed-cache name="actionTokens" owners="2">
            <encoding>
                <key media-type="application/x-java-object"/>
                <value media-type="application/x-java-object"/>
            </encoding>
            <expiration max-idle="-1" lifespan="-1" interval="300000"/>
            <memory max-count="-1"/>
        </distributed-cache>
		
		<replicated-cache name="work">
            <expiration lifespan="-1"/>
        </replicated-cache>
		
    </cache-container>

Thinking about it, this default configuration is not good and I'll update it, but apart that, can you help me understand the problem I had?

Thanks in advance

enricosoft · 2025-02-24T07:53:17Z

enricosoft
Feb 24, 2025
Author

Today I get another type of error:

2025-02-24T07:31:47.2906574Z stdout F 2025-02-24 07:31:47,290 WARN [org.keycloak.events] (executor-thread-30) type="CODE_TO_TOKEN_ERROR", realmId="5f626112-b788-4c16-8e15-c3be1a3910b6", realmName="MVN", clientId="WmsWeb", userId="null", sessionId="cee35b2b-cc88-44cd-81cc-792708b48ec2", ipAddress="xx.xx.xx.xx", error="invalid_code", grant_type="authorization_code", code_id="cee35b2b-cc88-44cd-81cc-792708b48ec2", client_auth_method="client-secret"

I solved just restarting the 3 container instances, because I suppose they reset the distributed cache

Can anyone help me?

0 replies

enricosoft · 2025-03-31T07:18:32Z

enricosoft
Mar 31, 2025
Author

Can anyone help me? After I started the keycloak service, this error happens always after 1 week, that's why I supposed it's the cache.

2 replies

Oleg-lord Apr 21, 2025

Have you managed to figure out the problem, or at least locate the source of the problem?
We have a similar situation now, and there is no understanding where to look for the cause of the errors.

enricosoft Jun 13, 2025
Author

unfortunately not

quocthinhle · 2025-06-13T07:23:40Z

quocthinhle
Jun 13, 2025

Hey, any updates about it? Im in the same situation right now.

1 reply

enricosoft Jun 13, 2025
Author

unfortunately not

CallumYoung01 · 2025-07-28T16:03:51Z

CallumYoung01
Jul 28, 2025

Hi, any updates on this please? I'm getting the exact same issue running KeyCloak 26.1 on Azure Container apps.
Is it worth posting this in the issue section as well as the Q&A?

0 replies

quocthinhle · 2025-07-28T16:05:06Z

quocthinhle
Jul 28, 2025

In my case, it was a clock skew issue between nodes. Le Quoc Thinh.

…

On Mon, 28 Jul 2025 at 23:04, Callum Young ***@***.***> wrote: Hi, any updates on this please? I'm getting the exact same issue running KeyCloak 26.1 on Azure Container apps. Is it worth posting this in the issue section as well as the Q&A? — Reply to this email directly, view it on GitHub <#37482 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ANIFEZY536MKOD5IQQ2ESAT3KZCXZAVCNFSM6AAAAABXNV7BF2VHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTGOJRGIZDQMA> . You are receiving this because you commented.Message ID: ***@***.***>

2 replies

CallumYoung01 Jul 28, 2025

Thanks for the reply, can I ask your approach on how you fixed this please?
I'm seeing a few possible options and interested in what worked for you.
Thanks.

CallumYoung01 Aug 11, 2025

Hi @quocthinhle,

Can I please ask, how did you identify the clock skew issues? I've just had the issue happen again in one of my environments, I've run "data -u" in the console for both of my nodes and both look correct.

Many thanks.

quocthinhle · 2025-07-28T16:24:46Z

quocthinhle
Jul 28, 2025

Actually, in that case, you could expand the lifetime of the authorization code in the realm settings. Le Quoc Thinh.

…

On Mon, 28 Jul 2025 at 23:23, Callum Young ***@***.***> wrote: Thanks for the reply, can I ask your approach on how you fixed this please? I'm seeing a few possible options and interested in what worked for you. Thanks. — Reply to this email directly, view it on GitHub <#37482 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ANIFEZ4JSCLI66HNRA55ARD3KZFAZAVCNFSM6AAAAABXNV7BF2VHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTGOJRGI2DMOA> . You are receiving this because you commented.Message ID: ***@***.***>

0 replies

szagriichuk · 2025-09-10T12:47:36Z

szagriichuk
Sep 10, 2025

you can try to set up the same node name
like <transport lock-timeout="60000" stack="jdbc-ping" node-name="any_name_you_prefered"/>

0 replies

"Expired_Code" error in keycloak HA #37482

Uh oh!

Replies: 7 comments · 5 replies

Uh oh!

enricosoft Feb 24, 2025 Author

Uh oh!

enricosoft Mar 31, 2025 Author

Uh oh!

Uh oh!

enricosoft Jun 13, 2025 Author

Uh oh!

Uh oh!

enricosoft Jun 13, 2025 Author

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Replies: 7 comments 5 replies

enricosoft
Feb 24, 2025
Author

enricosoft
Mar 31, 2025
Author

enricosoft Jun 13, 2025
Author

enricosoft Jun 13, 2025
Author