Home-Network/home-network-k3s-impl
2
0 Fork 0
Code Issues 2 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

keycloak: fix conditional-OTP role config key (blocked all admin SSO with 403)

Browse Source 
The browser-mfa conditional-user-role authenticator used config key 'condition.evaluated.user.role',
which is not a real Keycloak property — the role resolved to null, so Keycloak logged 'Invalid role
name submitted: null' and the REQUIRED conditional-OTP step threw, 403-ing every platform-admins login
(Headlamp, Grafana admin, etc.). Correct key for Keycloak 26 is condUserRole=platform-admin.

Co-Authored-By: Claude Opus 4.8 <[email protected]>
This commit is contained in:
jakman85andClaude Opus 4.8 committed 2026-08-30 21:56:13 -05:00
1 parent a720c73fcd
commit 45deac9d50
1 file changed
+6 -1
Download Patch File Download Diff File Expand all files Collapse all files
platform/keycloak/keycloak-realm-import.yaml
+6 -1
View File
@@ -423,6 +423,11 @@ spec:
authenticatorConfig:
- alias: conditional-otp-platform-admin
config:
"condition.evaluated.user.role": platform-admin
# Keycloak's conditional-user-role authenticator reads the role from `condUserRole`
# (ConditionalUserRoleAuthenticatorFactory.CONDITIONAL_USER_ROLE). The prior key
# "condition.evaluated.user.role" is not a real property, so the role resolved to null →
# "Invalid role name submitted: null" → the REQUIRED conditional-OTP step threw and blocked
# every platform-admins login (e.g. Headlamp) with a 403. Value is the realm role name.
condUserRole: platform-admin
negate: "false"
browserFlow: browser-mfa