keycloak Invalid parameter: redirect_uri

Question

When I am trying to hit from my api to authenticate user from keycloak, but its giving me error Invalid parameter: redirect_uri on keycloak page. I have created my own realm

Answer 1

Your redirect URI in your code(keycloak.init) should be the same as the redirect URI set on Keycloak server (client -> Valid Uri)

Answer 2

If you're seeing this problem after you've made a modification to the Keycloak context path, you'll need to make an additional change to a redirect url setting:

1. Change <web-context>yourchange/auth</web-context> back to <web-context>auth</web-context> in standalone.xml
2. Restart Keycloak and navigate to the login page (/auth/admin)
3. Log in and select the "Master" realm
4. Select "Clients" from the side menu
5. Select the "security-admin-console" client from the list that appears
6. Change the "Valid Redirect URIs" from /auth/admin/master/console/* to /yourchange/auth/admin/master/console/*
7. Save and sign out. You'll again see the "Invalid redirect url" message after signing out.
8. Now, put in your original change <web-context>yourchange/auth</web-context> in standalone.xml Restart Keycloak and navigate to the login page (which is now /yourchange/auth/admin)
9. Log in and enjoy

Answer 3

If you are using the Authorization Code Flow then the response_type query param must be equal to code. See https://www.keycloak.org/docs/3.3/server_admin/topics/sso-protocols/oidc.html

Answer 4

If you're trying to redirect to the keycloak login page after logout (as I was), that is not allowed by default but also needs to be configured in the "Valid Redirect URIs" setting in the admin console of your client.

Answer 5

You need to check the keycloak admin console for fronted configuration. It must be wrongly configured for redirect url and web origins.

Answer 6

Check that the value of the redirect_uri parameter is whitelisted for the client that you are using. You can manage the configuration of the client via the admin console.

The redirect uri should match exactly with one of the whitelisted redirect uri's, or you can use a wildcard at the end of the uri you want to whitelist. See: https://www.keycloak.org/docs/latest/server_admin/#_clients

Note that using wildcards to whitelist redirect uri's is allowed by Keycloak, but is actually a violation of the OpenId Connect specification. See the discussion on this at https://lists.jboss.org/pipermail/keycloak-dev/2018-December/011440.html