-
Bug
-
Resolution: Done
-
Undefined
-
None
-
False
-
-
False
-
-
Before reporting an issue
[x] I have read and understood the above terms for submitting issues, and I understand that my issue may be closed without action if I do not follow them.
Area
oidc
Describe the bug
When a user authenticates for the first time to the client, the LOGIN event is generated without the user session.
The problem is in the consent approval flow.
In the LoginActionsService, the event is sent before the session is created:
event.detail(Details.CONSENT, Details.CONSENT_VALUE_CONSENT_GRANTED);
event.success();
ClientSessionContext clientSessionCtx = AuthenticationProcessor.attachSession(authSession, null, session, realm, clientConnection, event);
return AuthenticationManager.redirectAfterSuccessfulFlow(session, realm, clientSessionCtx.getClientSession().getUserSession(), clientSessionCtx, request, session.getContext().getUri(), clientConnection, event, authSession);
Version
26.3.3
Regression
[ ] The issue is a regression
Expected behavior
The LOGIN event contains the user session when consent is approved.
Actual behavior
The LOGIN event doesn't contain the user session when consent is approved.
How to Reproduce?
Log in to the client with consent for the first time.
Anything else?
The PR that will fix the issue is here: https://github.com/keycloak/keycloak/pull/42866
- links to