Invalid parameter: id_token_hint

[ctron]

After the upgrade from Keycloak 24 to 26, I see the following error after a bit. Initially it works.

[carlosthe19916]

Not sure how to reproduce this issue.

The only place am I aware we could have Keycloak official setup is https://github.com/trustification/trustify-helm-charts/blob/main/charts/trustify-infrastructure/Chart.yaml#L25-L28 and that points to a Bitnami Keycloak V22

Should I use trustify-helm-charts as a vehicle to reproduce the issue?

[ctron]

I am using this in a manually deployed version (trustify.dentrassi.de). I think it is necessary to have Keycloak 26.

[trustification-ci-bot]

This issue is currently awaiting triage.
If contributors determine this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.
The triage/accepted label can be added by org members.

[queria]

I've encountered this issue too now.

In my case it was actually after redeploying keycloak+trustify:

• first deployed infra+trustify and logged in trustify UI, viewed some page (e.g. Importers)
• left the tab open in browser on background
• helm uninstalled trustify and infrastructure (keycloak/postgresql)
• installed same versions again
• switch to the tab left previously open in browser and clicked Dashboard
• at this moment I was expecting to get Login prompt
• instead got this Invalid parameter: id_token_hint error
• it can be always reproduced this way

Example of the sso/keycloak url where the error appears is:

https://sso-tpa2psc.apps.example.com/realms/chicken/protocol/openid-connect/logout?id_token_hint=eyJhbGc...trimmed...MEA9Q&post_logout_redirect_uri=https%3A%2F%2Fserver-tpa2psc.apps.example.com

Now looking a bit around, this may not be exactly bug.
(although i can imagine it could be more user friendly too, but likely that would on keycloak side)

As per following the id_token_hint with post_logout_redirect_uri is needed to identify session to log out from and redirecting back:

• https://stackoverflow.com/questions/71984843/keycloak-using-react-user-can-login-but-when-i-try-logout-i-get-a-message-inva
• https://dev.to/austincunningham/keycloak-1901-and-setting-the-idtokenhint-220c

And then e.g. this points out that the error can appear when the param is sent but the token ID is not found in database:

• https://faq.miniorange.com/knowledgebase/handling-invalid-parameter-id-token-hint-error/
• this would be exactly my case, since i reinstalled keycloak/postgresl (while browser had active session/token)

Now I wonder if there is maybe some other way how it can be triggered,
@ctron can You confirm if wiping/resetting keycloak's db was involved when it happened for You?