Uploaded image for project: 'Quarkus'
  1. Quarkus
  2. QUARKUS-6686

OIDC Step-Up Authentication fails, WWW-Authenticate header is missing challenge details when acr claim is a single string

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Unresolved
    • Icon: Critical Critical
    • 3.27.1.GA
    • 3.27.0.GA, 3.27.0.CR1
    • team/eng

      This bug was discovered during test development for the OIDC Step-Up Authentication feature https://issues.redhat.com/browse/QUARKUS-6260 .

      When an OIDC provider, such as Keycloak, returns a single Authentication Context Class Reference (ACR) value as a String instead of a JsonArray, the step-up authentication mechanism does not behave as expected.

      Detailed description is in the upstream issue here : https://github.com/quarkusio/quarkus/issues/50364

      The fix has been done (also merged in main)  here : https://github.com/quarkusio/quarkus/pull/50367 

              rh-ee-mvavrik Michal Vavrik
              rhn-support-jcarranz Jose Carranza
              Jose Carranza Jose Carranza
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Created:
                Updated: