[SOLVED]: Unexpected error when authenticating with identity provider

Keycloak is a powerful open-source identity and access management solution that provides authentication, authorization, and user management capabilities for applications and services. While it is a reliable platform, users may occasionally encounter the error message "Unexpected error when authenticating with identity provider" when trying to authenticate with Keycloak. One possible cause of this error is a CA cert issue. In this article, we will discuss what a CA cert issue is and the steps you can take to fix it.

Unexpected error when authenticating with identity provider

ISSUE

When keycloak acts as an Identity broker, and authentication is redirected to the identity broker, an error "Unexpected error when authenticating with identity provider" is seen. Below screen shot shows the same

SOLUTION

Below contains, step by step procedure to check and debug/fix the issue.

Step 1: Verify the SSL/TLS Certificate

The first step in fixing this error is to verify the SSL/TLS certificate of the identity provider. Check the validity of the certificate and make sure it has not expired. Verify that the certificate's common name matches the identity provider's domain name. You can use online SSL/TLS certificate verification tools to check the certificate's validity.

This can be done, if we have a physical copy of the identity provider's certificate, or if there is a GUI access (most IDP will be having GUI), we can inspect the certificate in the browser. Below screenshot shows a sample of the same

Step 2: Import the CA Cert

If the certificate is valid, the next step is to import the CA cert into Keycloak's truststore. To do this, follow the steps below:

1. Download the CA cert from the identity provider's website.
2. (Optional) Convert the certificate to the appropriate format using the following command:
   openssl x509 -in certificate.crt -outform PEM -out certificate.pem
3. Import the certificate into Keycloak's truststore using the following command:

 keytool -import -alias identity_provider -keystore $KEYCLOAK_HOME/standalone/configuration/truststore.jks -file certificate.pem

Step 3: Restart Keycloak

After importing the CA cert into Keycloak's truststore, restart Keycloak to apply the changes. Once Keycloak is restarted , try authenticating with the identity provider again. If the issue was caused by a CA cert issue, it should now be resolved.

Reference

Keycloak Official documentation