31

I am working with the nodeJS keycloak adapter and so far have my client application redirecting to the keycloak login.

When attempting to login, I get an error in the keycloak logs as follows:

12:07:12,341 WARN [org.keycloak.events] (default task-30) type=CODE_TO_TOKEN_ERROR, realmId=myrealm, clientId=client-test, userId=xxx, ipAddress=xxx.xxx.xxx.xx, error=invalid_code, grant_type=authorization_code, code_id=xxx, client_auth_method=client-secret

The error message sent back to my express application reads as 'Could not obtain grant code'.

Can someone shed some light on what this means exactly? I can only think I have configured something incorrectly in my realm\client\user settings.

Thanks

5 Answers 5

22

I've found the solution. It seems that if you follow this guide: https://www.ibm.com/developerworks/library/se-oauthjavapt3/index.html you will see that when you exchange the access code for the access token(/realms/{realm-name}/protocol/openid-connect/token) you need to add the same redirect_uri that you used when requesting the access code. It works for me now.

Hope it helps,

Adrian

3
  • 2
    hi Adrian, could you please explain where to add redirect_uri? I am adding it as a query param to the url which I use to get access token but error stays the same. Aug 23, 2019 at 8:38
  • I've added it as a query param. Maybe that's working for you and something else causes your problem. Sep 3, 2019 at 10:18
  • @mindparse Can you please mark this answer as the desired one? Thank you. Oct 30, 2019 at 6:48
8

The redirect URL should be exactly similar. I was using the following redirect url to obtain the code http://example.com/frontend/ . And when obtaining the token I was using the following URL http://example.com/ Using the same URL for both the calls resolved the problem.

1

This usually means the code sent back to Keycloak in order to exchange the code for tokens was invalid or got lost. First take a look at the log message of type=LOGIN for the user and make sure the code in that message matches the code_id on the login message matches the code_id on the CODE_TO_TOKEN_ERROR.

1

I came accross the same CODE_TO_TOKEN_ERROR after I added a new delegate idp to my keycloak config. That error is returned by Keycloak when some parameter in the body of the POST request to the token endpoint is wrong. In my case I investigated my parameters values and I realized a mere hash character (i.e. #) was mistakenly appended in my application to the value of that parameter called code. Removing that hash solved the bug.

In your case it could be an error in any of the parameters in the body of your POST request Parameters in the code authorization flow are the following: grant_type, client_id, client_secret, code, scope and redirect_uri. However, they can be different depending on the implemented flow.

Parameters like 'code' are received in the client app from the url of a redirect sent by Keycloak as a response to the code grant authorize request. There are slight differences sometimes in the syntax of the url. I realized that a hash character can be appended only in some cases to the end of the url. Url parsing needs to deal with all cases.

1
  • Could you share more information about your issue? In my case, I'm experiencing this exact same appended hash symbol. I'm making a .NET MAUI app and get this issue when interacting with Azure OIDC (also with Keycloak federation) Sep 8 at 18:43
0

if you are using browser login then change the client Access Type from 'condifential' to 'public'. Condifential requires secret in request to initiate login protocol.

3
  • You will sacrifice security :-(. Each login case has own OIDC flow and nodejs server app shouldn't use public client.
    – Jan Garaj
    Jan 13, 2022 at 17:47
  • Is because I said "if you are using browser login". If you are using nuxt.js (which is node.js) you will need set the client access as public, because for frontend there is not private secrets.
    – Piero
    Jan 17, 2022 at 19:59
  • Had the same issue - I got the error above (with unauthorized_client code 2003) because the Client was set to confidential ([x] Client Authorization) but my public client (AppAuth library) did not send a client secret. Unchecking "Client Authorization" fixed it, thanks for the hint!
    – hb0
    May 24 at 8:53

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.