Christian, Thanks for the response, I suspect something along those lines but I can thus far prove it. Do you by chance know how they saw the /token call from Keycloak? Or how to find out what the response from the IdP to Keycloak is? This is the hole in my knowledge that is stopping me from figuring it out. Best regards, Graham Burgess -----Original Message----- From: keycloak-user-bounces(a)lists.jboss.org <keycloak-user-bounces(a)lists.jboss.org&gt; On Behalf Of Christian Neudert Sent: Thursday, August 16, 2018 3:07 AM To: keycloak-user(a)lists.jboss.org Subject: Re: [keycloak-user] Problem Integration with OAuth2 provider Hello Graham, Maybe a little help: I remember a similar case in which the client-secret was wrong and the response that Keycloak got, was empty. Keycloak then didn't handle it as error, just went on and found no token. Best regards, Christian Neudert On 15.08.18, 00:55, &quot;keycloak-user-bounces(a)lists.jboss.org on behalf of Graham Burgess" <keycloak-user-bounces(a)lists.jboss.org on behalf of graham.burgess(a)razer.com&gt; wrote: I am trying to use Keycloak to broker our internally managed OAuth2 provider. I am unable to get it complete the "First Broker Login" workflow. The logs show "No token from server" as an error but I have thus far being able to get my Google-fu to help me figure out what the issue might be. I even went as far as looking at the code based on the stack trace and that would suggest that it is looking for an id_token, but my understanding for response_type=code as chosen by Keycloak, id_token isn't returned. I suspect I am doing something wrong but I don't know what and I am at a point that I don't know where to look to figure it out. I have looked at the different requests as they go through the workflow and can see all the redirects, etc. but it hasn't shown anything that has help me either. Anyone have any suggestions on how to proceed with troubleshooting this issue? Best regards, Graham Burgess RΛZΞR|stormmore Sr. DevOps Engineer (USA) Email: graham.burgess(a)razer.com DID: (415) 374 0639 [http://assets.razerzone.com/email/email-sig.jpg] Razer.com<https://www.razer.com/> | Razer Game Store<https://gamestore.razer.com/> | Razer Insider<https://insider.razer.com/> | Razer zVault<https://zvault.razer.com/> [https://upload.wikimedia.org/wikipedia/commons/thumb/c/c2/F_icon.svg/200p... [Twitter_Social_Icon_Rounded_Square_Color] <https://twitter.com/Razer> [glyph-logo_May2016] <https://www.instagram.com/razer/> [youtube_social_squircle_red] <https://www.youtube.com/Razer?sub_confirmation=1> Razer Inc. (San Francisco) 201 3rd Street, Suite 900 San Francisco CA 94103, USA Tel: +1 (415) 266 5300 Razer Inc. Stock Code: 1337.HK IMPORTANT NOTICE: This e-mail may be confidential, legally privileged or otherwise protected from disclosure. If you are not an intended recipient, do not copy, distribute or use its contents. Do inform the sender that you have received the message in error and delete it from your system. E-mails are not secure and may suffer errors, computer viruses, delay, interception and amendment. Razer accepts neither risk nor liability for any damage or loss caused by this e-mail. To the extent permitted by applicable law, Razer reserves the right to retain, monitor and intercept e-mails to and from its systems. ________________________________ [https://www.actaport.de/images/doksafe_mailclosing_actaport.jpg]<https... Kanzleisoftware für moderne Anwälte Kostenlos testen unter www.actaport.de<https://www.actaport.de?utm_source=email&utm_mediu... ________________________________ [https://www.actaport.de/images/doksafe_logo_200.png] dokSAFE GmbH Goethestraße 1 04109 Leipzig www.doksafe.de<https://www.doksafe.de?utm_source=email&utm_medium=... ________________________________ Sitz der Gesellschaft: Goethestraße 1, 04109 Leipzig Amtsgericht Leipzig HRB 32536, Geschäftsführer Steffen Scholz, Dr. Michael Schäfer ________________________________ Diese E-Mail kann Betriebs- oder Geschäftsgeheimnisse oder sonstige vertrauliche Informationen enthalten. Sollten Sie diese E-Mail irrtümlich erhalten haben, ist Ihnen eine Kenntnisnahme des Inhalts, eine Vervielfältigung oder Weitergabe der E-Mail ausdrücklich untersagt. Bitte benachrichtigen Sie uns und vernichten Sie die empfangene E-Mail. Vielen Dank. ________________________________ This e-mail may contain trade secrets or privileged, undisclosed, or otherwise confidential information. If you have received this e-mail in error, you are hereby notified that any review, copying, or distribution of it is strictly prohibited. Please inform us immediately and destroy the original transmittal. Thank you for your cooperation. _______________________________________________ keycloak-user mailing list keycloak-user(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/keycloak-user

OK, I think I have figured it out, at least on “paper”. If I am reading http://openid.net/specs/openid-connect-core-1_0.html#TokenRequest, section 3.1.3.3 right, then the token endpoint should be returning an id_token as well as access_token. I have already notified my IdP of the issue. Graham From: Graham Burgess Sent: Friday, August 17, 2018 3:00 PM To: keycloak-user(a)lists.jboss.org Subject: RE: [keycloak-user] Problem Integration with OAuth2 provider So to help me to understand what is going on being Keycloak and my IdP, I spun up an Nginx instance with a PHP script to dump the request to the /token endpoint on the IdP. The following is an example of the output that I can get from it: POST /dump.php HTTP/1.1 HTTP headers: X-Forwarded-Proto: https X-Forwarded-Port: 443 X-Forwarded-For: <REDACTED> Content-Type: application/x-www-form-urlencoded Accept-Encoding: gzip,deflate Content-Length: 266 User-Agent: Apache-HttpClient/4.5.2 (Java/1.8.0_161) Host: php-dump Request body: code=<AUTHORIZATION_CODE>&grant_type=authorization_code&client_secret=<CLIENT_SECRET>&redirect_uri=<REDIRECT_URI>&client_id=<CLIENT_ID> This allowed me to confirm the request was sending the right details to the IdP as part of the /token request. I was also able to get an output from the IdP’s /token endpoint: { "access_token": "<ACCESS_TOKEN>", "expires_in": 3600, "token_type": "Bearer", "scope": "openid cop profile email", "refresh_token": "<REFRESH_TOKEN>" } This looks right to me, so makes the “No token from server” error even weirder, or am I missing something? Kind regards, Graham