6

Today I'm unable to log in to my web application with Stack Overflow OAuth2.

I receive the following error on Keycloak:

2023-09-22 12:46:28,800 ERROR [org.keycloak.broker.oidc.AbstractOAuth2IdentityProvider] (executor-thread-1865) Failed to make identity provider oauth callback: org.keycloak.broker.provider.IdentityBrokerException: No access token available in OAuth server response: <!DOCTYPE html><html lang="en-US"><head><title>Just a moment...</title><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta http-equiv="X-UA-Compatible" content="IE=Edge"><meta name="robots" content="noindex,nofollow"><meta name="viewport" content="width=device-width,initial-scale=1"><link href="/cdn-cgi/styles/challenges.css" rel="stylesheet"></head><body class="no-js"><div class="main-wrapper" role="main"><div

LinkedIn, Google, FB, GitHub OAuth2 providers work fine.

Keycloak version: 18.0.2

Has anything changed for Stack Overflow OAuth2?

20
  • 2
    Maybe relevant: meta.stackexchange.com/questions/393039/…
    – rene
    Sep 22 at 10:44
  • 3
    It could be that you're getting an intermittent response from CloudFlare: meta.stackexchange.com/questions/393116/…
    – rene
    Sep 22 at 10:48
  • 1
    I'm a bit curious how you use keycloak here. Is keycloak handling the authentication for the app?
    – rene
    Sep 22 at 10:52
  • It worked throughout the whole year, and today, for some reason, it stopped working
    – alexanoid
    Sep 22 at 10:57
  • @rene I use Keycloak as the Single Sign-On (SSO) server for my app. On the Keycloak side, I have configured various Identity Providers (IdPs) such as Google, Facebook, StackOverflow, and so on
    – alexanoid
    Sep 22 at 11:06
  • 2
    Might be related: meta.stackexchange.com/questions/392172/… Sep 22 at 11:23
  • I have no idea what I can do with this because Keycloak is a black box to me, and I can't change anything there
    – alexanoid
    Sep 22 at 13:10
  • 2
    @alexanoid I actually went and looked into Keycloak's code. If I am reading things right the change in the response containing the scope won't break Keycloak. Looking at the error you get it also gives you the response the access token endpoint should have given to Keycloak, the title of it is "Just a moment..." so it seems you might be hitting CloudFlare like rene mentioned. Although putting bot protection on an API created to be used by bots does sound like a weird thing for SE to do. Sep 22 at 13:44
  • @AbdulAzizBarkat thanks. I changed the CloudFlare DNS record settings for my 'sso' subdomain from 'Proxied' to 'DNS only', but it didn't help.
    – alexanoid
    Sep 22 at 14:30
  • 1
    Your settings for CloudFlare won't help. It's Stack Overflow's settings that are the problem. Keycloak needs to call their API for getting the access token but is hitting CloudFlare in the process. See the url rene linked in their second comment. Sep 22 at 14:41
  • Oh, I see. Thank you! It seems like I have no choice but to temporarily disable it until the SO dev team fixes this issue.
    – alexanoid
    Sep 22 at 14:48
  • 4
    Thanks for the report, pushing out a fix now.
    – Josh Zhang StaffMod
    Sep 22 at 14:58
  • @alexanoid the fix is live, can you see if it resolved your issue?
    – Josh Zhang StaffMod
    Sep 22 at 15:18
  • Unfortunately, no, the same issue is still present
    – alexanoid
    Sep 22 at 15:36
  • @alexanoid I'd like to isolate your traffic, are you getting a RayID in that response? If so I can use that to find the exact request.
    – Josh Zhang StaffMod
    Sep 22 at 15:59

0

You must log in to answer this question.

Browse other questions tagged .