Repository navigation
UserInfo request fails by using an access token obtained in Hybrid flow with offline_access scope #39037
Description
Before reporting an issue
- I have read and understood the above terms for submitting issues, and I understand that my issue may be closed without action if I do not follow them.
Area
oidc
Describe the bug
In hybrid flow with offline_access scope (response_type = code token OR code token id_token, scope = openid offline_access), UserInfo request with an access token obtained from an autorization response fails as 401 Unauthorized (error = "invalid_token", error_description="user_session_not_found").
In the earlier version of 26.2.0, it does not happen.
Due to this issue, Keycloak 26.2.0 cannot pass OpenID Foundation's OIDC conformance tests while all the earlier version of Keycload could pass.
Version
26.2.0
Regression
- The issue is a regression
Expected behavior
We can get an appropriate UserInfo response as 200 OK.
Actual behavior
We get an error UserInfo response as 401 Unauthorized (error = "invalid_token", error_description="user_session_not_found").
How to Reproduce?
- Send an authorization request with response_type = code token OR code token id_token, which means doing OIDC hybrid flow and scope = openid offline_access .
- On the login screen, a user input their username and password, which lead to successful login.
- On the consent screen, the user input their cosent.
- Receive an authorization response with an access token.
- Send a UserInfo request with the access token.
- Receive an error UserInfo response.
Example:
[1] an authorization request
{
"client_id": "0908b642-8d6c-4075-80e2-d2d7628c9bb1",
"redirect_uri": "https://conformance-suite.keycloak-fapi.org/test/a/keycloak/callback",
"scope": "openid offline_access",
"state": "YQhigLVlWq",
"nonce": "Baki3USTOx",
"response_type": "code token",
"prompt": "consent"
}
->
https://as.keycloak-fapi.org/auth/realms/test/protocol/openid-connect/auth?client_id=0908b642-8d6c-4075-80e2-d2d7628c9bb1&redirect_uri=https://conformance-suite.keycloak-fapi.org/test/a/keycloak/callback&scope=openid%20offline_access&state=YQhigLVlWq&nonce=Baki3USTOx&response_type=code%20token&prompt=consent
[6] an error UserInfo response
401 Unauthorized
Header:
"www-authenticate": "Bearer realm="test", error="invalid_token", error_description="user_session_not_found"",
Anything else?
I found the issue when I ran the OpenID Foundation's OIDC conformance test against Keycloak 26.2.0.
(1) The authorization request's scope includes "offline_access", which may contribute to this issue.
(2) When receiving the UserInfo request, Keycloak outputs the following logs bout AccessTokenContext
accessTokenContext.getSessionType() = OFFLINE
accessTokenContext.getGrantType() = na
accessTokenContext.getRawTokenId() = d5daa054-015a-4869-9dc1-cccc6b04671b
accessTokenContext.getTokenType() = REGULAR
2025-04-17 00:03:45,662 WARN [org.keycloak.events] (executor-thread-5) type="USER_INFO_REQUEST_ERROR", realmId="5b9ce58b-4b1d-42bd-a714-eca698e2157f", realmName="test", clientId="b967393f-a745-4efd-9cb9-91d733f41a58", userId="null", sessionId="59e8808b-bb1e-4171-9c57-ccae9cd6bc2a", ipAddress="17
8000
2.18.0.13", error="user_session_not_found", auth_method="validate_access_token"
(3) Due to this issue, Keycloak 26.2.0 cannot pass OpenID Foundation's OIDC conformance tests while all the earlier version of Keycload could pass.
Activity
tnorimat commentedon Apr 17, 2025
@mposolda I am not sure, but does this issue relate to #37694 ?
[-]UserInfo request fails by using an access token obtained in Hybrid flow[/-][+]UserInfo request fails by using an access token obtained in Hybrid flow with offline_access scope[/+]mposolda commentedon Apr 24, 2025
@tnorimat Thanks for reporting this! Yes #37694 is related.
I've sent PR to fix this. Review is welcome! See PR description for the details.
tnorimat commentedon Apr 25, 2025
@mposolda Thank you for sending the PR. I wil review it. Also, I would like to run the OIDC conformance tests against the Keycloak including the PR to confirm that the Keycloak can pass the tests. I will notify you of its test results.
UserInfo request fails by using an access token obtained in Hybrid fl…
UserInfo request fails by using an access token obtained in Hybrid fl…
UserInfo request fails by using an access token obtained in Hybrid fl…
stempler commentedon Jan 27, 2026
@tnorimat What were the results of your tests?
I'm still seeing this issue (tested with 26.2.0, 26.3.0 and 26.5.2). The problem does not occur if I remove
offline_accessfrom the scope or use version 26.1.3.Difference might be that in my case the original token is created in an "implicit" flow.
ahus1 commentedon Jan 29, 2026
@stempler - this issue has been closed for some time. If you still see this occurring, please open a new bug with your results against 26.5.2