I am running a Node App that uses Keycloak for authentication. I added Microsoft as my Identity Provider. The authentication flow works sometimes, but sometimes it also gives me a 504 Gateway Time-out error. I am not able to pinpoint the issue here and it seems to manifest in a non deterministic manner, which makes debugging it pretty painful. Maybe somebody can shine some light on the problem. Here is some information about my setup in Keycloak:
I am deploying Keycloak in an Openshift pod using the jboss/keycloak:12.0.4 docker image. I configured the Identity Provider as an OpenID Connect v1.0 instead of the Microsoft listed option. The reason for that is that the Microsoft option was giving me an error because my application does not support multiple tenants. I noticed that my Authorization URL and my Token URL use oauth2 v2.0 and the OpenID Protocol that Keycloak supports is v1.0, could this be the culprit?
Here are the settings I am using in my OpenID Connect v1.0 Identity Provider:
| Setting | Value |
|---|---|
| Redirect URI | https://{myURL}/auth/realms/{myRealm}/broker/microsoft/endpoint |
| Display Name | Microsoft SSO |
| Enabled | True |
| Store Tokens | False |
| Store Tokens Readable | False |
| Trust Email | True |
| Account Linking Only | False |
| Hide on Login Page | False |
| GUI orderPage | |
| First Login Flow | first broker login |
| Post Login Flow | |
| Sync Mode | import |
| Authorization URL | https://login.microsoftonline.com/{myTenantId}/oauth2/v2.0/authorize |
| Pass login_hint | False |
| Pass current locale | False |
| Token URL | https://login.microsoftonline.com/{myTenantId}/oauth2/v2.0/token |
| Logout URL | |
| Backchannel Logout | False |
| Disable User Info | False |
| User Info URL | |
| Client Authentication | Client secret sent as post |
| Client ID | {myClientId} |
| Client Secret | **** |
| Issuer | |
| Default Scopes | profile email |
| Prompt | unspecified |
| Accepts prompt=none forward from client | False |
| Validate Signatures | False |
| Allowed clock skew | 30 |
| Forwarded Query Parameters |
When I try to login in the Keycloak site I get a Timeout error like this:
Sometimes I get it directly in the Kecloak login site after clicking the "Login with Microsoft" button. Other times I do get redirected to the login.microsoftonline.com webpage, where I login with my credentials and it gets stuck in the last screen after asking if I want to stay signed in. And sometimes the flow works and I end up authenticated inside of my application...
Here ist the error response that I get after some time of waiting:
Request URL: https://{myURL}/auth/realms/{myRealm}/broker/microsoft/endpoint?code=0.AXMA7rFZoACDkkmxG1e0i4BPEZ2cuYMZnDRNtktAE1vudc9zAAA.AQABAAIAAAD--DLA3VO7QrddgJg7WevrbG5Onmk6dlEN-ouVhfpouPkxBHIMaTipydQjf5IPHzHiiF047jqUMeFyZsK2MS_SFivrQzEHsLKCwb1cxoqNflANN5M61kRmWAPl3aMaS-Ss2UyBjRWvDa6uWHm91RYglSSu5KYle1iuuGQy6lbCDylPxGvYuvg0-JYX607C416_BCPWv54T2OseM1FouKs9ZjWTtshbfMphilE7xoY6ELTOza12SitW3-d0XzTpQxBBI4hJYVq1SWMa6LlOPqrFnofmTdQxbzLJrzWgbvXPXD_Mq-y2MABWv1Vp4cC-BWQp7LAvgt5YM4qODrO16hhbRsIoVpGx8Fo4hdGHfz5gzYJSZ7l1JKVm0mPN3EUB36Bxu6nU5H_WEzQKnPgEuWM_XwF1FF3zCEC_T7OCFk8eclh_Ltkj4_6bbvIzq4fkhQHi5ip95JVZCf363JufQfpMwwXuEkBpoA7r_sJZf7eovktt_yF_TY2n6eg2Buhss86fRNplj6lJarUk1wfPg8UtQfIM03Q6ibOdFUbdXKlTNTzBtEXPE09Oq-k58lY54WEuc-6CoI0TVacj5uPAMchIiT9W5zh6Hngrch_JO3_AFY2y4AyZ5z4ztPdmNbI-H5SrTgL6su0B3AW-1ZaSbbtvt5IjuE_BsgDCyUcleELMoScxVTu209iqv1PSJGHm6zX0JLT314nNhv_vft-11mVzn5PnEUvMjnq-SIblkVBFJNo_aHuHZ6YKA5bkTJzRmJsgAA&state=bkT6WkO40z5T_nZmjgWjyr0Yrig9aubRO4tIWzw6FyE.XNF2CybyXuc.express-server&session_state=1406bf80-2d5a-4e76-a526-a68c92369bfd
Request Method: GET
Status Code: 504 Gateway Time-out
Remote Address: **.***.***.***:443
Referrer Policy: no-referrer
Cache-Control: no-cache
Connection: close
Content-Type: text/html
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate, br
Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
Connection: keep-alive
Cookie: AUTH_SESSION_ID=0adf14f3-e2e7-45ad-81f0-41ba2ef14b00.fv-keycloak-dbs-7-zjzrr; AUTH_SESSION_ID_LEGACY=0adf14f3-e2e7-45ad-81f0-41ba2ef14b00.fv-keycloak-dbs-7-zjzrr; KC_RESTART=eyJhbGciOiJIUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJmYzk5ZmY2Yy01ZTYzLTRhZDYtOGQ1MS0zNjUzODc4ZTI3NWEifQ.eyJjaWQiOiJleHByZXNzLXNlcnZlciIsInB0eSI6Im9wZW5pZC1jb25uZWN0IiwicnVyaSI6Imh0dHA6Ly9kYnMtc2VydmVyLWZpbGV2ZXJpZmljYXRvci5iZXJsaW4uZGJjcy5kYi5kZS9sb2dpbj9zaGFyZXBvaW50T249ZmFsc2UmYXV0aF9jYWxsYmFjaz0xIiwiYWN0IjoiQVVUSEVOVElDQVRFIiwibm90ZXMiOnsic2NvcGUiOiJvcGVuaWQiLCJpc3MiOiJodHRwczovL2Ricy1mdi1rZXljbG9hay1maWxldmVyaWZpY2F0b3IuYmVybGluLmRiY3MuZGIuZGUvYXV0aC9yZWFsbXMvZmlsZXZlcmlmaWNhdG9yIiwicmVzcG9uc2VfdHlwZSI6ImNvZGUiLCJyZWRpcmVjdF91cmkiOiJodHRwOi8vZGJzLXNlcnZlci1maWxldmVyaWZpY2F0b3IuYmVybGluLmRiY3MuZGIuZGUvbG9naW4_c2hhcmVwb2ludE9uPWZhbHNlJmF1dGhfY2FsbGJhY2s9MSIsInN0YXRlIjoiYzE5MTZkNDMtNTRkYi00NjdiLWFkOTEtYTk1YThiZTkzYjA5In19.SUlsPCDZ3cOdhWYxGlyjw_5fE97VtVQ3m4JICGwEadE; f7ab773005f1250ab8c4988c6f4d7351=e1353a733014b755be89489617967322
Host: {myKeycloakHost}
sec-ch-ua: "Google Chrome";v="89", "Chromium";v="89", ";Not A Brand";v="99"
sec-ch-ua-mobile: ?0
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Sec-Fetch-User: ?1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 11_2_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
code: 0.AXMA7rFZoACDkkmxG1e0i4BPEZ2cuYMZnDRNtktAE1vudc9zAAA.AQABAAIAAAD--DLA3VO7QrddgJg7WevrbG5Onmk6dlEN-ouVhfpouPkxBHIMaTipydQjf5IPHzHiiF047jqUMeFyZsK2MS_SFivrQzEHsLKCwb1cxoqNflANN5M61kRmWAPl3aMaS-Ss2UyBjRWvDa6uWHm91RYglSSu5KYle1iuuGQy6lbCDylPxGvYuvg0-JYX607C416_BCPWv54T2OseM1FouKs9ZjWTtshbfMphilE7xoY6ELTOza12SitW3-d0XzTpQxBBI4hJYVq1SWMa6LlOPqrFnofmTdQxbzLJrzWgbvXPXD_Mq-y2MABWv1Vp4cC-BWQp7LAvgt5YM4qODrO16hhbRsIoVpGx8Fo4hdGHfz5gzYJSZ7l1JKVm0mPN3EUB36Bxu6nU5H_WEzQKnPgEuWM_XwF1FF3zCEC_T7OCFk8eclh_Ltkj4_6bbvIzq4fkhQHi5ip95JVZCf363JufQfpMwwXuEkBpoA7r_sJZf7eovktt_yF_TY2n6eg2Buhss86fRNplj6lJarUk1wfPg8UtQfIM03Q6ibOdFUbdXKlTNTzBtEXPE09Oq-k58lY54WEuc-6CoI0TVacj5uPAMchIiT9W5zh6Hngrch_JO3_AFY2y4AyZ5z4ztPdmNbI-H5SrTgL6su0B3AW-1ZaSbbtvt5IjuE_BsgDCyUcleELMoScxVTu209iqv1PSJGHm6zX0JLT314nNhv_vft-11mVzn5PnEUvMjnq-SIblkVBFJNo_aHuHZ6YKA5bkTJzRmJsgAA
state: bkT6WkO40z5T_nZmjgWjyr0Yrig9aubRO4tIWzw6FyE.XNF2CybyXuc.express-server
session_state: 1406bf80-2d5a-4e76-a526-a68c92369bfd
And here ist the same response when it does succeed and I end up logged in in my application:
Request URL: https://{myURL}/auth/realms/{myRealm}/broker/microsoft/endpoint?code=0.AXMA7rFZoACDkkmxG1e0i4BPEZ2cuYMZnDRNtktAE1vudc9zAAA.AQABAAIAAAD--DLA3VO7QrddgJg7Wevr54rmOYKEJxCvOnbTf08bIkW6-wYHMPW02S7p1GH83rt_I4HcFoQWc-UTr6E59PQtmKVvhJwPVOtCaloEntwSxyUOjU-ioLUqabuXrOgCK9z0YCAZfPt0i3en6yRq5_8cXTwb3mw_tdC4r72UhRy0-5lZtw0QK6nIBt5csBVe2aecbuUqSgujb342mI2yncyCtTzEDyHK68705BUc5CfZ_G1KrKY4XhOT2gJntasYNZ8W1cEaiRUINe3lJPChcdFSsK1_cXbt8cpcA-ATZII31pYDIj4naXf3TE03OazX_rbTAY9Wv9FemrDD81zoPpWvw-_0C10ZSyVKkiuDpijfLbXPds1PLXqO5_UHVi-L0PTo7Ol_mvy89wX7R7nzXcxQhFJ9N4tBk7_xsnJb84ra2FohF8Fc3nUQlpHKpyVOBF8ZiHmSDbKNFiYwPlO8eGwYl7bDKGezpBGNNyTHQgdh_sUr_JRxo3hAH-KBN5jQbarSPYVcju7DzGbEqdCEjyz2WbNwSw9-iSfFDloUNtiVG_67ZNJTFfuLR3_JkIZi3oOkFnAJXioaRLvijvPFsIcAAf8gvK1GTVyB4Hjqsh4UGFu3zEydKCAfBc-adK8Hh_OBa0_aqNe3vxGXmHdXxwUoK1CRCWXJKGWudyryfsgAZFSSCpoBgGRfVXezW03cHPW3OnLz_yxXZNgsDBY1RxY9v_FG0H1Y3WUXZswQGZ-EFRsLzYlbs1h-xscOc5a8mtAgAA&state=ZuSmElb8DZVi2RfJqty-GXjEI6JTHhgDYsQIj3iLnR0.tXmQN28xbw8.express-server&session_state=e2530203-3269-4f2a-b08c-27955bed47d2
Request Method: GET
Status Code: 302 Found
Remote Address: **.***.***.**:443
Referrer Policy: strict-origin-when-cross-origin
Connection: close
Content-Length: 0
Date: Tue, 06 Apr 2021 11:52:29 GMT
Location: http://{myURL}/login?auth_callback=1&state=143f770b-8de8-4083-8dab-3124bd097b98&session_state=ca4e579e-e22f-4b53-b33b-3bbc161c3ace&code=ca8be1ac-2bcf-420d-be27-9c830d7d6c31.ca4e579e-e22f-4b53-b33b-3bbc161c3ace.960c20e3-4c92-4bba-afea-785097c6fc69
P3P: CP="This is not a P3P policy!"
Referrer-Policy: no-referrer
Set-Cookie: KEYCLOAK_LOCALE=; Version=1; Comment=Expiring cookie; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Max-Age=0; Path=/auth/realms/fileverificator/; HttpOnly
Set-Cookie: KC_RESTART=; Version=1; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Max-Age=0; Path=/auth/realms/fileverificator/; HttpOnly
Set-Cookie: KEYCLOAK_IDENTITY=eyJhbGciOiJIUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJmYzk5ZmY2Yy01ZTYzLTRhZDYtOGQ1MS0zNjUzODc4ZTI3NWEifQ.eyJleHAiOjE2MTc3NDU5NDksImlhdCI6MTYxNzcwOTk0OSwianRpIjoiNTU0YmU1ZTEtZTA5My00ZWMzLTk0MjQtNDljMjhiMmIzYzlmIiwiaXNzIjoiaHR0cHM6Ly9kYnMtZnYta2V5Y2xvYWstZmlsZXZlcmlmaWNhdG9yLmJlcmxpbi5kYmNzLmRiLmRlL2F1dGgvcmVhbG1zL2ZpbGV2ZXJpZmljYXRvciIsInN1YiI6IjE2ZGZhN2UzLTQ1ZmMtNDNkZi05MjA1LTM5NTM4ZGRmY2M5MyIsInR5cCI6IlNlcmlhbGl6ZWQtSUQiLCJzZXNzaW9uX3N0YXRlIjoiY2E0ZTU3OWUtZTIyZi00YjUzLWIzM2ItM2JiYzE2MWMzYWNlIiwic3RhdGVfY2hlY2tlciI6IjlMZTV0Vy1WVVRGbUJOQ1B3TG1lN3NMWlMwd1piQnVKcEo0QXlGa1oyVVEifQ.d0cKuvmJcQp9dkyord6jzIIRqq9dHVoT5J-gOoOS3hU; Version=1; Path=/auth/realms/{myRealm}/; SameSite=None; Secure; HttpOnly
Set-Cookie: KEYCLOAK_IDENTITY_LEGACY=eyJhbGciOiJIUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJmYzk5ZmY2Yy01ZTYzLTRhZDYtOGQ1MS0zNjUzODc4ZTI3NWEifQ.eyJleHAiOjE2MTc3NDU5NDksImlhdCI6MTYxNzcwOTk0OSwianRpIjoiNTU0YmU1ZTEtZTA5My00ZWMzLTk0MjQtNDljMjhiMmIzYzlmIiwiaXNzIjoiaHR0cHM6Ly9kYnMtZnYta2V5Y2xvYWstZmlsZXZlcmlmaWNhdG9yLmJlcmxpbi5kYmNzLmRiLmRlL2F1dGgvcmVhbG1zL2ZpbGV2ZXJpZmljYXRvciIsInN1YiI6IjE2ZGZhN2UzLTQ1ZmMtNDNkZi05MjA1LTM5NTM4ZGRmY2M5MyIsInR5cCI6IlNlcmlhbGl6ZWQtSUQiLCJzZXNzaW9uX3N0YXRlIjoiY2E0ZTU3OWUtZTIyZi00YjUzLWIzM2ItM2JiYzE2MWMzYWNlIiwic3RhdGVfY2hlY2tlciI6IjlMZTV0Vy1WVVRGbUJOQ1B3TG1lN3NMWlMwd1piQnVKcEo0QXlGa1oyVVEifQ.d0cKuvmJcQp9dkyord6jzIIRqq9dHVoT5J-gOoOS3hU; Version=1; Path=/auth/realms/fileverificator/; HttpOnly
Set-Cookie: KEYCLOAK_SESSION=fileverificator/16dfa7e3-45fc-43df-9205-39538ddfcc93/ca4e579e-e22f-4b53-b33b-3bbc161c3ace; Version=1; Expires=Tue, 06-Apr-2021 21:52:29 GMT; Max-Age=36000; Path=/auth/realms/fileverificator/; SameSite=None; Secure
Set-Cookie: KEYCLOAK_SESSION_LEGACY=fileverificator/16dfa7e3-45fc-43df-9205-39538ddfcc93/ca4e579e-e22f-4b53-b33b-3bbc161c3ace; Version=1; Expires=Tue, 06-Apr-2021 21:52:29 GMT; Max-Age=36000; Path=/auth/realms/fileverificator/
Set-Cookie: KEYCLOAK_REMEMBER_ME=; Version=1; Comment=Expiring cookie; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Max-Age=0; Path=/auth/realms/fileverificator/; HttpOnly
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate, br
Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
Cache-Control: max-age=0
Connection: keep-alive
Cookie: AUTH_SESSION_ID=ca4e579e-e22f-4b53-b33b-3bbc161c3ace.fv-keycloak-dbs-7-zjzrr; AUTH_SESSION_ID_LEGACY=ca4e579e-e22f-4b53-b33b-3bbc161c3ace.fv-keycloak-dbs-7-zjzrr; KC_RESTART=eyJhbGciOiJIUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJmYzk5ZmY2Yy01ZTYzLTRhZDYtOGQ1MS0zNjUzODc4ZTI3NWEifQ.eyJjaWQiOiJleHByZXNzLXNlcnZlciIsInB0eSI6Im9wZW5pZC1jb25uZWN0IiwicnVyaSI6Imh0dHA6Ly9kYnMtc2VydmVyLWZpbGV2ZXJpZmljYXRvci5iZXJsaW4uZGJjcy5kYi5kZS9sb2dpbj9zaGFyZXBvaW50T249ZmFsc2UmYXV0aF9jYWxsYmFjaz0xIiwiYWN0IjoiQVVUSEVOVElDQVRFIiwibm90ZXMiOnsic2NvcGUiOiJvcGVuaWQiLCJpc3MiOiJodHRwczovL2Ricy1mdi1rZXljbG9hay1maWxldmVyaWZpY2F0b3IuYmVybGluLmRiY3MuZGIuZGUvYXV0aC9yZWFsbXMvZmlsZXZlcmlmaWNhdG9yIiwicmVzcG9uc2VfdHlwZSI6ImNvZGUiLCJyZWRpcmVjdF91cmkiOiJodHRwOi8vZGJzLXNlcnZlci1maWxldmVyaWZpY2F0b3IuYmVybGluLmRiY3MuZGIuZGUvbG9naW4_c2hhcmVwb2ludE9uPWZhbHNlJmF1dGhfY2FsbGJhY2s9MSIsInN0YXRlIjoiMTQzZjc3MGItOGRlOC00MDgzLThkYWItMzEyNGJkMDk3Yjk4In19.L7zIusN60YSeALEIPEUNdchas_9ey-ZDqtWXjgynC5Q; f7ab773005f1250ab8c4988c6f4d7351=e1353a733014b755be89489617967322
Host: {myKeycloakHost}
Referer: https://login.microsoftonline.com/
sec-ch-ua: "Google Chrome";v="89", "Chromium";v="89", ";Not A Brand";v="99"
sec-ch-ua-mobile: ?0
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Sec-Fetch-User: ?1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 11_2_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
code: 0.AXMA7rFZoACDkkmxG1e0i4BPEZ2cuYMZnDRNtktAE1vudc9zAAA.AQABAAIAAAD--DLA3VO7QrddgJg7Wevr54rmOYKEJxCvOnbTf08bIkW6-wYHMPW02S7p1GH83rt_I4HcFoQWc-UTr6E59PQtmKVvhJwPVOtCaloEntwSxyUOjU-ioLUqabuXrOgCK9z0YCAZfPt0i3en6yRq5_8cXTwb3mw_tdC4r72UhRy0-5lZtw0QK6nIBt5csBVe2aecbuUqSgujb342mI2yncyCtTzEDyHK68705BUc5CfZ_G1KrKY4XhOT2gJntasYNZ8W1cEaiRUINe3lJPChcdFSsK1_cXbt8cpcA-ATZII31pYDIj4naXf3TE03OazX_rbTAY9Wv9FemrDD81zoPpWvw-_0C10ZSyVKkiuDpijfLbXPds1PLXqO5_UHVi-L0PTo7Ol_mvy89wX7R7nzXcxQhFJ9N4tBk7_xsnJb84ra2FohF8Fc3nUQlpHKpyVOBF8ZiHmSDbKNFiYwPlO8eGwYl7bDKGezpBGNNyTHQgdh_sUr_JRxo3hAH-KBN5jQbarSPYVcju7DzGbEqdCEjyz2WbNwSw9-iSfFDloUNtiVG_67ZNJTFfuLR3_JkIZi3oOkFnAJXioaRLvijvPFsIcAAf8gvK1GTVyB4Hjqsh4UGFu3zEydKCAfBc-adK8Hh_OBa0_aqNe3vxGXmHdXxwUoK1CRCWXJKGWudyryfsgAZFSSCpoBgGRfVXezW03cHPW3OnLz_yxXZNgsDBY1RxY9v_FG0H1Y3WUXZswQGZ-EFRsLzYlbs1h-xscOc5a8mtAgAA
state: ZuSmElb8DZVi2RfJqty-GXjEI6JTHhgDYsQIj3iLnR0.tXmQN28xbw8.express-server
session_state: e2530203-3269-4f2a-b08c-27955bed47d2
Any ideas on what could be causing the issue? As I said it does work sometimes, so I am really curious why this behaviour occurs.