Keycloak "Unexpected error when handling authentication request to identity provider"

Question

We have configured Keycloak as Identity Broker to external SAML2 based Identity Provider. For most of the users, we are able to sign in without any issues, but for some, we are facing issues at Keycloak end saying "Unexpected error when handling authentication request to identity provider". As all the users are from the same organization, the SAML assertions are identical, and we can't find any error in logs. Keycloak version in question is 4.3.0.Final. Has anyone faced a similar issue? Please help. TIA

Solution

Fix or disable faulty User Federation providers.

We had an improperly configured LDAP provider under User Federation which was also set to be the highest priority provider, so when a user logged in, Keycloak checked LDAP first which always failed and returned Unexpected error when handling authentication request to identity provider.

When the LDAP entry was disabled, Keycloak passed control on to the next provider which was able to authenticate the user successfully.

Comments

[Hans Z.]

a stack trace is always good to add! good luck

[Navin M]

Unfortunately, there wasn't a stack trace. thankyou.

[JakeRobb]

I'm seeing the same error with no User Federation sources configured. No stacktrace, nothing in Keycloak's logs. Just a user-facing error page with this message. I'd love to see more answers to this!