fix(web): Disable OIDC PAR so a Keycloak restart / stale cookie can't dead-end login - #144
Merged
Conversation
… cookie can't dead-end it .NET's OIDC handler auto-enables Pushed Authorization Requests whenever the IdP advertises a pushed_authorization_request_endpoint — Keycloak does — so the browser was redirected to /auth?request_uri=urn:... and Keycloak had to resolve that reference from its in-memory PAR store. Restarting Keycloak (or a stale browser session cookie) drops the reference, Keycloak can't recover the pushed params, and login dead-ends with "Missing parameter: response_type". A fresh cookie jar worked; the real browser did not — which read like the 431 was back, but it was this. The realm does not require PAR, so the classic authorization-code flow (response_type carried in the URL) is both valid and robust: no server-side reference to lose, so a Keycloak restart or a stale cookie cannot break the redirect. Sets options.PushedAuthorizationBehavior = Disable. Verified: the login redirect now carries response_type=code&scope=openid& code_challenge=... directly (no request_uri=urn:), the full flow reaches the login page (200), and the real browser with its pre-existing cookies lands on the AgentOS sign-in page instead of the Keycloak error page. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Change description
.NET's OIDC handler auto-enables Pushed Authorization Requests (PAR) whenever the IdP advertises a
pushed_authorization_request_endpoint— Keycloak does. The browser is then redirected to/auth?request_uri=urn:ietf:…and Keycloak must resolve that reference from its in-memory PAR store. Restarting Keycloak (dev volume reset, container recreate) or a stale browser session cookie drops that reference → Keycloak can't recover the pushed params →Missing parameter: response_typeand login dead-ends.The
agenticrealm does not require PAR, so this disables it (PushedAuthorizationBehavior.Disable) and falls back to the classic authorization-code flow —response_typeis carried in the URL, there is no server-side reference to lose, so a Keycloak restart or a stale cookie can no longer break login.Follow-up to #143 (dev header-limit 512K) on the same login-robustness thread.
Type of change
Related issues
Follow-up to #143.
Checklist
dotnet buildpasses locally in Release mode (Web built + booted via Aspire AppHost)dotnet test— CI runs the full suite on PR→main; change is OIDC config only (no unit surface)Test plan (E2E, full Aspire stack)
Verified on the real stack (
dotnet run --project infra/AgentOs.AppHost), clean KC + Postgres volumes:curl -k -i https://localhost:5180/account/login→ 302 to…/realms/agentic/protocol/openid-connect/auth?client_id=…&response_type=code&code_challenge=…— norequest_uri=urn:ietf:…, confirming PAR is off and params ride the URL.operator/operatoron real Keycloak → OIDC callback → Blazor circuit → GNOME desktop loads (screenshot captured).