OmniAuth sends no redirect_uri to Keycloak — login broken #166

New issue

Closed

opened 2026-06-07 20:01:16 +00:00 by ldraney · 0 comments

ldraney commented

2026-06-07 20:01:16 +00:00

Owner

Type

Bug

Lineage

Regression from PR #161 (OmniAuth restore after ROPC revert). The original PR #134 likely had the same bug but wasn't caught because Keycloak may have had looser validation at that time.

Repo

ldraney/landscaping-assistant

What Broke

Clicking "Sign In" redirects to Keycloak with no redirect_uri parameter. Keycloak returns 400: "Invalid parameter: redirect_uri". Login is completely broken on both prod and dev.

The omniauth_openid_connect gem (v0.8.0) does NOT auto-derive redirect_uri from the request — when client_options.redirect_uri is nil, it sends nil to the OIDC client, which omits the parameter entirely.

Repro Steps

Navigate to https://landscaping-assistant.tail5b443a.ts.net/login
Click "Sign In"
Observe: Keycloak error page "Invalid parameter: redirect_uri"

Expected Behavior

Keycloak should show the login form. The redirect_uri should be https://landscaping-assistant.tail5b443a.ts.net/auth/keycloak/callback.

Environment

Cluster/namespace: prod (landscaping-assistant) and dev (docker-compose)
Service version/commit: current main
Related alerts: none

Acceptance Criteria

Clicking "Sign In" on prod shows Keycloak login form
Clicking "Sign In" on dev shows Keycloak login form
Login completes successfully with test users on both environments
redirect_uri parameter present in Keycloak authorization URL

project-landscaping-assistant — main project
ldraney/landscaping-assistant #161 — OmniAuth restore PR
Pattern: matches pal-enterprises approach (explicit APP_URL env var)

### Type Bug ### Lineage Regression from PR #161 (OmniAuth restore after ROPC revert). The original PR #134 likely had the same bug but wasn't caught because Keycloak may have had looser validation at that time. ### Repo `ldraney/landscaping-assistant` ### What Broke Clicking "Sign In" redirects to Keycloak with no `redirect_uri` parameter. Keycloak returns 400: "Invalid parameter: redirect_uri". Login is completely broken on both prod and dev. The `omniauth_openid_connect` gem (v0.8.0) does NOT auto-derive `redirect_uri` from the request — when `client_options.redirect_uri` is `nil`, it sends `nil` to the OIDC client, which omits the parameter entirely. ### Repro Steps 1. Navigate to `https://landscaping-assistant.tail5b443a.ts.net/login` 2. Click "Sign In" 3. Observe: Keycloak error page "Invalid parameter: redirect_uri" ### Expected Behavior Keycloak should show the login form. The redirect_uri should be `https://landscaping-assistant.tail5b443a.ts.net/auth/keycloak/callback`. ### Environment - Cluster/namespace: prod (landscaping-assistant) and dev (docker-compose) - Service version/commit: current main - Related alerts: none ### Acceptance Criteria - [ ] Clicking "Sign In" on prod shows Keycloak login form - [ ] Clicking "Sign In" on dev shows Keycloak login form - [ ] Login completes successfully with test users on both environments - [ ] `redirect_uri` parameter present in Keycloak authorization URL ### Related - `project-landscaping-assistant` — main project - `ldraney/landscaping-assistant #161` — OmniAuth restore PR - Pattern: matches `pal-enterprises` approach (explicit `APP_URL` env var)