Hello Thank you in advance.
I have installed it according to the tutorial.
Due to my limited knowledge, I am experiencing the following error in the log:
08:40:20.638 ERROR n.d.o.server.auth.OidcAuthenticator - No OIDC authentication possible
java.lang.IllegalStateException: No OIDC authentication possible
What should I do to resolve this?
Thank you. Best regards
Hello nihilego,
In order to provide targeted support, we need more information. Are there any clues in the Keycloak logs? Is the configuration correct?
Please send us some screenshots.
Best regards
Jasmin
We are also suffering from this same issue, although our setup used to work perfectly fine before, RS Version RS6.1.4-6125-2026-07-10-13-14-51-reportserver-ce.zip, Keycloak Version 26.7.3, Java version openjdk 21.0.12.1, Apache Tomcat Version 9.0.118 this issue seems to have only happened ever since the Keycloak server got upgraded, I do not know which version was used prior. The Keycloak configuration was set exactly as in the Installation guide: https://www.reportserver.net/de/dokumentation/tutorials/articles/installing-reportserver-on-ubuntu The only thing that was added was the correct Redirect URIs and Web Origin URLs required for the setup to work correctly.
Using the browser developer tools i can see that an access token is generated:
URL: POST https://sso.example.invalid/realms/example/protocol/openid-connect/token
body data:
code=xxxxxxxxxxxxxx-xxxxxxxxxxxxx-xxxxxxxx
grant_type=authorization_code
client_id=rs-fe
redirect_uri=https://reportserver.example.invalid/
code_verifier=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
{
"access_token": "ey...",
"expires_in": 300,
"refresh_expires_in": 1800,
"refresh_token": "ey........Q",
"token_type": "Bearer",
"id_token": "ey.....A",
"not-before-policy": 0,
"session_state": "zQ.....hK",
"scope": "openid email profile"
}
I can only guess that this is an Issue regarding ReportServer itself.
This is the stack trace seen in the ReportServer logs:
SEVERE [http-nio-8080-exec-9] net.datenwerke.oidc.server.auth.OidcAuthenticator.evaluate No OIDC authentication possible
java.lang.IllegalStateException: No OIDC authentication possible
at net.datenwerke.oidc.server.auth.OidcAuthenticator.evaluate(OidcAuthenticator.java:61)
at net.datenwerke.security.service.authenticator.AuthenticatorServiceImpl.authenticate(AuthenticatorServiceImpl.java:101)
at net.datenwerke.oidc.server.auth.OidcLoginHandlerImpl.authenticate(OidcLoginHandlerImpl.java:50)
at net.datenwerke.oidc.server.auth.OidcLoginHandlerImpl$$EnhancerByGuice$$6d123f8e.GUICE$TRAMPOLINE(<generated>)
at com.google.inject.internal.InterceptorStackCallback$InterceptedMethodInvocation.proceed(InterceptorStackCallback.java:74)
at com.google.inject.persist.jpa.JpaLocalTxnInterceptor.invoke(JpaLocalTxnInterceptor.java:66)
at com.google.inject.internal.InterceptorStackCallback$InterceptedMethodInvocation.proceed(InterceptorStackCallback.java:75)
at net.datenwerke.security.service.security.aop.SecurityCheckInterceptor.invoke(SecurityCheckInterceptor.java:112)
at com.google.inject.internal.InterceptorStackCallback$InterceptedMethodInvocation.proceed(InterceptorStackCallback.java:75)
at net.datenwerke.gf.service.gwtstacktrace.CatchStacktraceInterceptor.invoke(CatchStacktraceInterceptor.java:38)
at com.google.inject.internal.InterceptorStackCallback$InterceptedMethodInvocation.proceed(InterceptorStackCallback.java:75)
at com.google.inject.internal.InterceptorStackCallback.invoke(InterceptorStackCallback.java:55)
at net.datenwerke.oidc.server.auth.OidcLoginHandlerImpl$$EnhancerByGuice$$6d123f8e.authenticate(<generated>)
at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:103)
at java.base/java.lang.reflect.Method.invoke(Method.java:580)
at com.google.gwt.user.server.rpc.RPC.invokeAndEncodeResponse(RPC.java:587)
at com.google.gwt.user.server.rpc.RemoteServiceServlet.processCall(RemoteServiceServlet.java:333)
at net.datenwerke.oidc.server.auth.OidcLoginHandlerImpl$$EnhancerByGuice$$6d123f8e.GUICE$TRAMPOLINE(<generated>)
at com.google.inject.internal.InterceptorStackCallback$InterceptedMethodInvocation.proceed(InterceptorStackCallback.java:74)
at net.datenwerke.security.service.security.aop.SecurityCheckInterceptor.invoke(SecurityCheckInterceptor.java:112)
at com.google.inject.internal.InterceptorStackCallback$InterceptedMethodInvocation.proceed(InterceptorStackCallback.java:75)
at net.datenwerke.gf.service.gwtstacktrace.CatchStacktraceInterceptor.invoke(CatchStacktraceInterceptor.java:38)
at com.google.inject.internal.InterceptorStackCallback$InterceptedMethodInvocation.proceed(InterceptorStackCallback.java:75)
at com.google.inject.internal.InterceptorStackCallback.invoke(InterceptorStackCallback.java:55)
at net.datenwerke.oidc.server.auth.OidcLoginHandlerImpl$$EnhancerByGuice$$6d123f8e.processCall(<generated>)
at com.google.gwt.user.server.rpc.RemoteServiceServlet.processCall(RemoteServiceServlet.java:303)
at net.datenwerke.oidc.server.auth.OidcLoginHandlerImpl$$EnhancerByGuice$$6d123f8e.GUICE$TRAMPOLINE(<generated>)
at com.google.inject.internal.InterceptorStackCallback$InterceptedMethodInvocation.proceed(InterceptorStackCallback.java:74)
at net.datenwerke.security.service.security.aop.SecurityCheckInterceptor.invoke(SecurityCheckInterceptor.java:112)
at com.google.inject.internal.InterceptorStackCallback$InterceptedMethodInvocation.proceed(InterceptorStackCallback.java:75)
at net.datenwerke.gf.service.gwtstacktrace.CatchStacktraceInterceptor.invoke(CatchStacktraceInterceptor.java:38)
at com.google.inject.internal.InterceptorStackCallback$InterceptedMethodInvocation.proceed(InterceptorStackCallback.java:75)
at com.google.inject.internal.InterceptorStackCallback.invoke(InterceptorStackCallback.java:55)
at net.datenwerke.oidc.server.auth.OidcLoginHandlerImpl$$EnhancerByGuice$$6d123f8e.processCall(<generated>)
at com.google.gwt.user.server.rpc.RemoteServiceServlet.processPost(RemoteServiceServlet.java:373)
at com.google.gwt.user.server.rpc.AbstractRemoteServiceServlet.doPost(AbstractRemoteServiceServlet.java:62)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:555)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:623)
at net.datenwerke.oidc.server.auth.OidcLoginHandlerImpl$$EnhancerByGuice$$6d123f8e.GUICE$TRAMPOLINE(<generated>)
at com.google.inject.internal.InterceptorStackCallback$InterceptedMethodInvocation.proceed(InterceptorStackCallback.java:74)
at net.datenwerke.security.service.security.aop.SecurityCheckInterceptor.invoke(SecurityCheckInterceptor.java:112)
at com.google.inject.internal.InterceptorStackCallback$InterceptedMethodInvocation.proceed(InterceptorStackCallback.java:75)
at net.datenwerke.gf.service.gwtstacktrace.CatchStacktraceInterceptor.invoke(CatchStacktraceInterceptor.java:38)
at com.google.inject.internal.InterceptorStackCallback$InterceptedMethodInvocation.proceed(InterceptorStackCallback.java:75)
at com.google.inject.internal.InterceptorStackCallback.invoke(InterceptorStackCallback.java:55)
at net.datenwerke.oidc.server.auth.OidcLoginHandlerImpl$$EnhancerByGuice$$6d123f8e.service(<generated>)
at com.google.inject.servlet.ServletDefinition.doServiceImpl(ServletDefinition.java:293)
at com.google.inject.servlet.ServletDefinition.doService(ServletDefinition.java:283)
at com.google.inject.servlet.ServletDefinition.service(ServletDefinition.java:184)
at com.google.inject.servlet.ManagedServletPipeline.service(ManagedServletPipeline.java:89)
at com.google.inject.servlet.FilterChainInvocation.doFilter(FilterChainInvocation.java:85)
at com.google.inject.persist.PersistFilter.doFilter(PersistFilter.java:94)
at com.google.inject.servlet.FilterChainInvocation.doFilter(FilterChainInvocation.java:82)
at com.google.inject.servlet.ManagedFilterPipeline.dispatch(ManagedFilterPipeline.java:121)
at com.google.inject.servlet.GuiceFilter.doFilter(GuiceFilter.java:133)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:166)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:142)
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:166)
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:88)
at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:491)
at org.apache.catalina.valves.RemoteIpValve.invoke(RemoteIpValve.java:763)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127)
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:83)
at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:764)
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:72)
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:344)
at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:398)
at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:63)
at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:1309)
at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1854)
at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:52)
at org.apache.tomcat.util.threads.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:973)
at org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:491)
at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:63)
at java.base/java.lang.Thread.run(Thread.java:1583)
(URLs obviously censored)
Hello laeira,
Thanks for the detailed information.
The fact that Keycloak successfully returns an access token is important.
This means that the initial login and redirect to Keycloak are working.
The error occurs afterwards, when ReportServer tries to validate the token.
There is a relevant change in newer Keycloak versions which could explain this behavior.
The ReportServer installation guide currently uses Keycloak 26.5.1. Starting with Keycloak 26.6.2, token validation became stricter: the ReportServer backend client (rs) must be included in the access token’s aud (audience) claim.
Since your setup stopped working after upgrading Keycloak to 26.7.3, this is the first thing we would check.
Could you please decode the access token locally and tell us the values of:
aud
azp
iss
Please do not post the complete token or any client secrets.
In particular, please check whether rs is listed in the aud claim.
As a diagnostic test, you can also temporarily enable “Allow token introspection without audience check” for the rs client in Keycloak.
If ReportServer login works again after enabling this option, this would strongly indicate that the changed audience validation in Keycloak is the cause.
This option should only be used for testing. If this proves to be the issue, the proper solution is to configure the Keycloak token so that the rs client is included in its audience.
At this point, we would therefore not classify this as a ReportServer bug yet. First, let’s verify whether the Keycloak upgrade changed the token validation behavior in this setup.
Thank you very much for your patience and cooperation.
Kind regards,
Jasmin
After including the rs client in the rs-fe’s audience it now works again. Thanks a lot for the quick help. It would be great if the documentation could be updated to reflect this needed configuration.
Hello laeira,
We’re glad to hear that everything is working as expected again.
Thank you for your suggestion to include this configuration in our documentation. I have forwarded your feedback to the relevant team for review and consideration.
Kind regards,
Jasmin