I'm trying to set up Keycloak to restrict access to clients depending on their roles. Since the users authenticate against AAD, I'd like to use the "Post Login Flow" configured in Identitity Provider settings. Fortunately, for the moment we want to apply the same set of rules across all clients, so this option would suffice.
I've set up a very basic authentication flow Role-access1 that should check whether a user has "restrict-by-role" role assigned. I can see in user's "Role Mappings" that indeed the test user has the role assigned through group membership.
Unfortunately, upon enabling the post login flow I get the generic "We are sorry... Invalid username or password" screens for all users.
I've checked debug logs and I can see the system attempts to execute the post-login-flow, but fails.
[org.keycloak.services.resources.IdentityBrokerService] (default task-6) Authorization code is valid.
[org.keycloak.services.resources.IdentityBrokerService] (default task-6) Token will not be stored for identity provider [SSO].
[org.keycloak.services.resources.IdentityBrokerService] (default task-6) Redirect to postBrokerLogin flow after authentication with identityProvider 'SSO'.
[io.undertow.request] (default I/O-3) Matched prefix path /auth for path /auth/realms/master/login-actions/post-broker-login
[io.undertow.request.security] (default task-6) Attempting to authenticate /auth/realms/master/login-actions/post-broker-login, authentication required: false
[io.undertow.request.security] (default task-6) Authentication outcome was NOT_ATTEMPTED with method io.undertow.security.impl.CachedAuthenticatedSessionMechanism@46c8c6b2 for /auth/realms/master/login-actions/post-broker-login
[io.undertow.request.security] (default task-6) Authentication result was ATTEMPTED for /auth/realms/master/login-actions/post-broker-login
[org.keycloak.transaction.JtaTransactionWrapper] (default task-6) new JtaTransactionWrapper
[org.keycloak.transaction.JtaTransactionWrapper] (default task-6) was existing? false
[org.jboss.resteasy.resteasy_jaxrs.i18n] (default task-6) RESTEASY002315: PathInfo: /realms/master/login-actions/post-broker-login
[org.keycloak.services.managers.AuthenticationSessionManager] (default task-6) Found AUTH_SESSION_ID cookie with value 7e7926d9-7018-xxxxxx
[org.keycloak.services.resources.SessionCodeChecks] (default task-6) Transition between flows! Current flow: post-broker-login, Previous flow: authenticate
[org.keycloak.authentication.AuthenticationProcessor] (default task-6) AUTHENTICATE
[org.keycloak.authentication.AuthenticationProcessor] (default task-6) AUTHENTICATE ONLY
[org.keycloak.authentication.DefaultAuthenticationFlow] (default task-6) processFlow: Role-access1
[org.hibernate.SQL] (default task-6)
select
roleentity0_.ID as col_0_0_
from
KEYCLOAK_ROLE roleentity0_
where
roleentity0_.CLIENT_ROLE=false
and roleentity0_.NAME=?
and roleentity0_.REALM=?
[org.jboss.jca.core.connectionmanager.pool.strategy.OnePool] (default task-6) KeycloakDS: getConnection(null, WrappedConnectionRequestInfo@6dd2b8e0[userName=keycloak]) [0/100]
[org.hibernate.loader.Loader] (default task-6) Result set row: 0
[org.hibernate.loader.Loader] (default task-6) Result row:
[org.hibernate.resource.jdbc.internal.LogicalConnectionManagedImpl] (default task-6) Initiating JDBC connection release from afterStatement
[org.keycloak.authentication.DefaultAuthenticationFlow] (default task-6) check execution: 'role check flow', requirement: 'CONDITIONAL'
[org.keycloak.authentication.DefaultAuthenticationFlow] (default task-6) processFlow: role check
[org.keycloak.authentication.DefaultAuthenticationFlow] (default task-6) Flow 'role check flow' failed
[org.keycloak.services] (default task-6) KC-SERVICES0013: Failed authentication: org.keycloak.authentication.AuthenticationFlowException
at org.keycloak.authentication.AuthenticationProcessor.authenticateOnly(AuthenticationProcessor.java:984)
at org.keycloak.services.resources.LoginActionsService$1.authenticateOnly(LoginActionsService.java:798)
(...)
Ending in:
[org.keycloak.events] (default task-6) type=IDENTITY_PROVIDER_POST_LOGIN_ERROR, realmId=master, clientId=https://sxxxxxxxxxxx, userId=null, ipAddress=xxxxxxxxx, error=invalid_user_credentials, identity_provider=SSO, auth_method=saml, redirect_uri=https://sxxxxxxxxxxx/oauth2/callback/saml, identity_provider_identity=xxxxx@xxxx.com, code_id=7e7926d9-7018-xxxxxxx, authSessionParentId=7e7926d9-7018-xxxxx, authSessionTabId=ILBy-xxxx
This is Keycloak 11.0.3. Any suggestions where does the problem come from?