[OAuth] Prefer authorization error on redirect_uri by tdiesler · Pull Request #48553 · keycloak/keycloak

tdiesler · 2026-04-28T13:52:20Z

This PR tries to be as unintrusive as possible. While processing an authorization request there are potential errors coming from

checks in client policies
various request parsers (e.g. url query, request object, request_uri)
checks on request_uri, response_type, response_mode

most of these errors map to an unchecked ErrorPageException, which then displays an html error page.

When the request passes the above, errors tend to be reported back to the caller via redirect_uri already.

This PR proposes to first catch these ErrorPageExceptions and then (when configured to do so) make a "best effort" to use the redirect_uri path - otherwise, the error is returned to the caller as json object.

Without the authorization.preferErrorOnRedirect attribute on the realm, this PR changes nothing. As a result, no test cases needed to be touched. That was in fact the hard bit: change nothing, unless the headless error path is wanted.

Automated conformance tests are headless - they prefer errors to be delivered on the redirect_uri when possible.

If this approach gets accepted, we would likely want to expose that switch on the admin UI, which is not (yet) part of this PR.

This PR is at the bottom of all other HAIP conformance work.

keycloak-github-bot

Unreported flaky test detected, please review

keycloak-github-bot · 2026-04-28T14:55:21Z

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.adapter.servlet.SAMLLoginResponseHandlingTest#testAttributes

Keycloak CI - Adapter IT Strict Cookies

org.openqa.selenium.JavascriptException: 
TypeError: can't access property "outerHTML", document.documentElement is null
Build info: version: '4.28.1', revision: '73f5ad48a2'
System info: os.name: 'Linux', os.arch: 'amd64', os.version: '6.17.0-1011-azure', java.version: '21.0.11'
Driver info: org.openqa.selenium.firefox.FirefoxDriver
...

Report flaky test

keycloak-github-bot

Unreported flaky test detected, please review

keycloak-github-bot · 2026-04-29T06:37:05Z

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.model.user.UserModelTest#testAddRemoveUser

Keycloak CI - Store Model Tests

org.opentest4j.MultipleFailuresError: 
Multiple Failures (2 failures)
	java.lang.NullPointerException: Cannot invoke "org.keycloak.models.KeycloakSessionFactory.create()" because "factory" is null
	java.lang.NullPointerException: Null keys are not supported!
	Suppressed: java.lang.NullPointerException: Cannot invoke "org.keycloak.models.KeycloakSessionFactory.create()" because "factory" is null
...

Report flaky test

keycloak-github-bot

Unreported flaky test detected, please review

keycloak-github-bot · 2026-05-04T11:53:50Z

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.forms.BruteForceTest#testNoFailureResetForPermanentLockout

Keycloak CI - Base IT (5)

org.opentest4j.AssertionFailedError: Expected error event ==> expected: <true> but was: <false>
	at org.junit.jupiter.api.AssertionFailureBuilder.build(AssertionFailureBuilder.java:151)
	at org.junit.jupiter.api.AssertionFailureBuilder.buildAndThrow(AssertionFailureBuilder.java:132)
	at org.junit.jupiter.api.AssertTrue.failNotTrue(AssertTrue.java:63)
	at org.junit.jupiter.api.AssertTrue.assertTrue(AssertTrue.java:36)
...

Report flaky test

dominikschlosser · 2026-05-06T09:00:20Z

+                event.detail(Details.CLIENT_POLICY_ERROR, cpe.getError());
+                event.detail(Details.CLIENT_POLICY_ERROR_DETAIL, cpe.getErrorDetail());
+                event.error(cpe.getError());
+                throw new ErrorPageException(session, authenticationSession, cpe.getErrorStatus(), cpe.getErrorDetail());


cpe.getError() gets lost here, so a client policy raising a different OAuth error code than invalid_request will always be overridden by invalid_request now?

Yes, this is how the translation from ClientPolicyException => ErrorPageException works. Perhaps the html error page does not show the error property from the CPE. This code path has not changed.

This has been fixed - the error code coming from ErrorPageException and AuthorizationCheckException are now passed on correctly.

Signed-off-by: Thomas Diesler <tdiesler@proton.me>

tdiesler changed the title ~~[OAuth] Avoid error page when redirect to client is possible/configured~~ [OAuth] Avoid error page when redirect to client is possible Apr 28, 2026

tdiesler force-pushed the ghi48542 branch from af92e6d to 6c9dae8 Compare April 28, 2026 13:53

keycloak-github-bot Bot added the flaky-test label Apr 28, 2026

keycloak-github-bot Bot mentioned this pull request Apr 28, 2026

Flaky test: org.keycloak.testsuite.authz.PolicyEvaluationTest# #48446

Closed

keycloak-github-bot Bot reviewed Apr 28, 2026

View reviewed changes

tdiesler force-pushed the ghi48542 branch 9 times, most recently from 2c3c43a to 6927d2a Compare April 29, 2026 03:33

tdiesler changed the title ~~[OAuth] Avoid error page when redirect to client is possible~~ [OAuth] Avoid error page in headless environments Apr 29, 2026

tdiesler force-pushed the ghi48542 branch 3 times, most recently from 64cf932 to b2ea215 Compare April 29, 2026 05:33

tdiesler force-pushed the ghi48542 branch from b2ea215 to cad26ae Compare April 29, 2026 05:38

keycloak-github-bot Bot reviewed Apr 29, 2026

View reviewed changes

tdiesler force-pushed the ghi48542 branch 10 times, most recently from 4853bfb to 1a960a5 Compare May 4, 2026 09:12

tdiesler marked this pull request as draft May 4, 2026 09:32

tdiesler force-pushed the ghi48542 branch 2 times, most recently from 3d081eb to 0d1663e Compare May 4, 2026 11:53

keycloak-github-bot Bot reviewed May 4, 2026

View reviewed changes

tdiesler force-pushed the ghi48542 branch 3 times, most recently from 8143546 to bf8cdad Compare May 4, 2026 15:21

tdiesler marked this pull request as ready for review May 5, 2026 00:25

tdiesler mentioned this pull request May 5, 2026

[OID4VCI-FAPI2] Pass fapi2-security-profile-final-state-only-outside-request-object-not-used (blocked) #48326

Open

dominikschlosser reviewed May 6, 2026

View reviewed changes

Comment thread services/src/main/java/org/keycloak/protocol/oidc/endpoints/AuthorizationEndpoint.java

dominikschlosser reviewed May 6, 2026

View reviewed changes

Comment thread services/src/main/java/org/keycloak/protocol/oidc/endpoints/AuthorizationEndpoint.java

tdiesler force-pushed the ghi48542 branch 5 times, most recently from 508875f to b40195a Compare May 7, 2026 08:39

[OAuth] Prefer authorization error on redirect_uri

0707c36

Signed-off-by: Thomas Diesler <tdiesler@proton.me>

tdiesler force-pushed the ghi48542 branch from b40195a to 0707c36 Compare May 7, 2026 11:50

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[OAuth] Prefer authorization error on redirect_uri#48553

[OAuth] Prefer authorization error on redirect_uri#48553
tdiesler wants to merge 1 commit intokeycloak:mainfrom
tdiesler:ghi48542

tdiesler commented Apr 28, 2026 •

edited

Loading

Uh oh!

keycloak-github-bot Bot left a comment

Uh oh!

keycloak-github-bot Bot commented Apr 28, 2026

Uh oh!

keycloak-github-bot Bot left a comment

Uh oh!

keycloak-github-bot Bot commented Apr 29, 2026

Uh oh!

keycloak-github-bot Bot left a comment

Uh oh!

keycloak-github-bot Bot commented May 4, 2026

Uh oh!

Uh oh!

dominikschlosser May 6, 2026

Uh oh!

tdiesler May 6, 2026

Uh oh!

tdiesler May 7, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

tdiesler commented Apr 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

keycloak-github-bot Bot left a comment

Choose a reason for hiding this comment

Uh oh!

keycloak-github-bot Bot commented Apr 28, 2026

Unreported flaky test detected

org.keycloak.testsuite.adapter.servlet.SAMLLoginResponseHandlingTest#testAttributes

Uh oh!

keycloak-github-bot Bot left a comment

Choose a reason for hiding this comment

Uh oh!

keycloak-github-bot Bot commented Apr 29, 2026

Unreported flaky test detected

org.keycloak.testsuite.model.user.UserModelTest#testAddRemoveUser

Uh oh!

keycloak-github-bot Bot left a comment

Choose a reason for hiding this comment

Uh oh!

keycloak-github-bot Bot commented May 4, 2026

Unreported flaky test detected

org.keycloak.testsuite.forms.BruteForceTest#testNoFailureResetForPermanentLockout

Uh oh!

Uh oh!

dominikschlosser May 6, 2026

Choose a reason for hiding this comment

Uh oh!

tdiesler May 6, 2026

Choose a reason for hiding this comment

Uh oh!

tdiesler May 7, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

tdiesler commented Apr 28, 2026 •

edited

Loading