From 45deac9d50f222cc8a77eac305ac14f186b80601 Mon Sep 17 00:00:00 2001 From: Keith Jackson Date: Sun, 30 Aug 2026 21:56:13 -0500 Subject: [PATCH] keycloak: fix conditional-OTP role config key (blocked all admin SSO with 403) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The browser-mfa conditional-user-role authenticator used config key 'condition.evaluated.user.role', which is not a real Keycloak property — the role resolved to null, so Keycloak logged 'Invalid role name submitted: null' and the REQUIRED conditional-OTP step threw, 403-ing every platform-admins login (Headlamp, Grafana admin, etc.). Correct key for Keycloak 26 is condUserRole=platform-admin. Co-Authored-By: Claude Opus 4.8 --- platform/keycloak/keycloak-realm-import.yaml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/platform/keycloak/keycloak-realm-import.yaml b/platform/keycloak/keycloak-realm-import.yaml index 2080a70..110f6b1 100644 --- a/platform/keycloak/keycloak-realm-import.yaml +++ b/platform/keycloak/keycloak-realm-import.yaml @@ -423,6 +423,11 @@ spec: authenticatorConfig: - alias: conditional-otp-platform-admin config: - "condition.evaluated.user.role": platform-admin + # Keycloak's conditional-user-role authenticator reads the role from `condUserRole` + # (ConditionalUserRoleAuthenticatorFactory.CONDITIONAL_USER_ROLE). The prior key + # "condition.evaluated.user.role" is not a real property, so the role resolved to null → + # "Invalid role name submitted: null" → the REQUIRED conditional-OTP step threw and blocked + # every platform-admins login (e.g. Headlamp) with a 403. Value is the realm role name. + condUserRole: platform-admin negate: "false" browserFlow: browser-mfa