# OIDC KeyCloak, No authentication possible

**URL:** <https://forum.reportserver.net/t/oidc-keycloak-no-authentication-possible/1908>\
**Category:** ReportServer (EN)\
**Created:** [July 10, 2026, 9:48am UTC](https://forum.reportserver.net/t/oidc-keycloak-no-authentication-possible/1908 "2026-07-10T09:48:46Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![nihilego](https://forum.reportserver.net/user_avatar/forum.reportserver.net/nihilego/32/31_2.png) [@nihilego](https://forum.reportserver.net/u/nihilego)\
**Post date:** [July 10, 2026, 9:48am UTC](https://forum.reportserver.net/t/oidc-keycloak-no-authentication-possible/1908/1 "2026-07-10T09:48:46Z")

</div>

Hello Thank you in advance.  
I have installed it according to the tutorial.

> **[Installing ReportServer on Ubuntu - Reportserver](https://reportserver.net/de/dokumentation/tutorials/articles/installing-reportserver-on-ubuntu)**

Due to my limited knowledge, I am experiencing the following error in the log:

> 08:40:20.638 ERROR n.d.o.server.auth.OidcAuthenticator - No OIDC authentication possible  
> java.lang.IllegalStateException: No OIDC authentication possible

What should I do to resolve this?  
Thank you. Best regards

---

<div class="post-metadata">

**Author:** ![IF\_Jasmin](https://forum.reportserver.net/letter_avatar_proxy/v4/letter/i/5e9695/32.png) [@IF\_Jasmin](https://forum.reportserver.net/u/IF_Jasmin)\
**Post date:** [July 13, 2026, 9:34am UTC](https://forum.reportserver.net/t/oidc-keycloak-no-authentication-possible/1908/2 "2026-07-13T09:34:30Z")

</div>

Hello nihilego,

In order to provide targeted support, we need more information. Are there any clues in the Keycloak logs? Is the configuration correct?

Please send us some screenshots.

Best regards

Jasmin

---

<div class="post-metadata">

**Author:** ![laeira](https://forum.reportserver.net/letter_avatar_proxy/v4/letter/l/8e7dd6/32.png) [@laeira](https://forum.reportserver.net/u/laeira)\
**Post date:** [October 6, 2026, 8:43am UTC](https://forum.reportserver.net/t/oidc-keycloak-no-authentication-possible/1908/3 "2026-10-06T08:43:20Z")

</div>

We are also suffering from this same issue, although our setup used to work perfectly fine before, RS Version `RS6.1.4-6125-2026-07-10-13-14-51-reportserver-ce.zip`, Keycloak Version 26.7.3, Java version `openjdk 21.0.12.1`, Apache Tomcat Version `9.0.118` this issue seems to have only happened ever since the Keycloak server got upgraded, I do not know which version was used prior. The Keycloak configuration was set exactly as in the Installation guide: [https://www.reportserver.net/de/dokumentation/tutorials/articles/installing-reportserver-on-ubuntu](https://www.reportserver.net/de/dokumentation/tutorials/articles/installing-reportserver-on-ubuntu) The only thing that was added was the correct Redirect URIs and Web Origin URLs required for the setup to work correctly.

Using the browser developer tools i can see that an access token is generated:  
URL: POST `https://sso.example.invalid/realms/example/protocol/openid-connect/token`  
body data:

```ini
code=xxxxxxxxxxxxxx-xxxxxxxxxxxxx-xxxxxxxx
grant_type=authorization_code
client_id=rs-fe
redirect_uri=https://reportserver.example.invalid/
code_verifier=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

```

```json
{
  "access_token": "ey...",
  "expires_in": 300,
  "refresh_expires_in": 1800,
  "refresh_token": "ey........Q",
  "token_type": "Bearer",
  "id_token": "ey.....A",
  "not-before-policy": 0,
  "session_state": "zQ.....hK",
  "scope": "openid email profile"
}

```

I can only guess that this is an Issue regarding ReportServer itself.  
This is the stack trace seen in the ReportServer logs:

```auto
SEVERE [http-nio-8080-exec-9] net.datenwerke.oidc.server.auth.OidcAuthenticator.evaluate No OIDC authentication possible
        java.lang.IllegalStateException: No OIDC authentication possible
                at net.datenwerke.oidc.server.auth.OidcAuthenticator.evaluate(OidcAuthenticator.java:61)
                at net.datenwerke.security.service.authenticator.AuthenticatorServiceImpl.authenticate(AuthenticatorServiceImpl.java:101)
                at net.datenwerke.oidc.server.auth.OidcLoginHandlerImpl.authenticate(OidcLoginHandlerImpl.java:50)
                at net.datenwerke.oidc.server.auth.OidcLoginHandlerImpl$$EnhancerByGuice$$6d123f8e.GUICE$TRAMPOLINE(<generated>)
                at com.google.inject.internal.InterceptorStackCallback$InterceptedMethodInvocation.proceed(InterceptorStackCallback.java:74)
                at com.google.inject.persist.jpa.JpaLocalTxnInterceptor.invoke(JpaLocalTxnInterceptor.java:66)
                at com.google.inject.internal.InterceptorStackCallback$InterceptedMethodInvocation.proceed(InterceptorStackCallback.java:75)
                at net.datenwerke.security.service.security.aop.SecurityCheckInterceptor.invoke(SecurityCheckInterceptor.java:112)
                at com.google.inject.internal.InterceptorStackCallback$InterceptedMethodInvocation.proceed(InterceptorStackCallback.java:75)
                at net.datenwerke.gf.service.gwtstacktrace.CatchStacktraceInterceptor.invoke(CatchStacktraceInterceptor.java:38)
                at com.google.inject.internal.InterceptorStackCallback$InterceptedMethodInvocation.proceed(InterceptorStackCallback.java:75)
                at com.google.inject.internal.InterceptorStackCallback.invoke(InterceptorStackCallback.java:55)
                at net.datenwerke.oidc.server.auth.OidcLoginHandlerImpl$$EnhancerByGuice$$6d123f8e.authenticate(<generated>)
                at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:103)
                at java.base/java.lang.reflect.Method.invoke(Method.java:580)
                at com.google.gwt.user.server.rpc.RPC.invokeAndEncodeResponse(RPC.java:587)
                at com.google.gwt.user.server.rpc.RemoteServiceServlet.processCall(RemoteServiceServlet.java:333)
                at net.datenwerke.oidc.server.auth.OidcLoginHandlerImpl$$EnhancerByGuice$$6d123f8e.GUICE$TRAMPOLINE(<generated>)
                at com.google.inject.internal.InterceptorStackCallback$InterceptedMethodInvocation.proceed(InterceptorStackCallback.java:74)
                at net.datenwerke.security.service.security.aop.SecurityCheckInterceptor.invoke(SecurityCheckInterceptor.java:112)
                at com.google.inject.internal.InterceptorStackCallback$InterceptedMethodInvocation.proceed(InterceptorStackCallback.java:75)
                at net.datenwerke.gf.service.gwtstacktrace.CatchStacktraceInterceptor.invoke(CatchStacktraceInterceptor.java:38)
                at com.google.inject.internal.InterceptorStackCallback$InterceptedMethodInvocation.proceed(InterceptorStackCallback.java:75)
                at com.google.inject.internal.InterceptorStackCallback.invoke(InterceptorStackCallback.java:55)
                at net.datenwerke.oidc.server.auth.OidcLoginHandlerImpl$$EnhancerByGuice$$6d123f8e.processCall(<generated>)
                at com.google.gwt.user.server.rpc.RemoteServiceServlet.processCall(RemoteServiceServlet.java:303)
                at net.datenwerke.oidc.server.auth.OidcLoginHandlerImpl$$EnhancerByGuice$$6d123f8e.GUICE$TRAMPOLINE(<generated>)
                at com.google.inject.internal.InterceptorStackCallback$InterceptedMethodInvocation.proceed(InterceptorStackCallback.java:74)
                at net.datenwerke.security.service.security.aop.SecurityCheckInterceptor.invoke(SecurityCheckInterceptor.java:112)
                at com.google.inject.internal.InterceptorStackCallback$InterceptedMethodInvocation.proceed(InterceptorStackCallback.java:75)
                at net.datenwerke.gf.service.gwtstacktrace.CatchStacktraceInterceptor.invoke(CatchStacktraceInterceptor.java:38)
                at com.google.inject.internal.InterceptorStackCallback$InterceptedMethodInvocation.proceed(InterceptorStackCallback.java:75)
                at com.google.inject.internal.InterceptorStackCallback.invoke(InterceptorStackCallback.java:55)
                at net.datenwerke.oidc.server.auth.OidcLoginHandlerImpl$$EnhancerByGuice$$6d123f8e.processCall(<generated>)
                at com.google.gwt.user.server.rpc.RemoteServiceServlet.processPost(RemoteServiceServlet.java:373)
                at com.google.gwt.user.server.rpc.AbstractRemoteServiceServlet.doPost(AbstractRemoteServiceServlet.java:62)
                at javax.servlet.http.HttpServlet.service(HttpServlet.java:555)
                at javax.servlet.http.HttpServlet.service(HttpServlet.java:623)
                at net.datenwerke.oidc.server.auth.OidcLoginHandlerImpl$$EnhancerByGuice$$6d123f8e.GUICE$TRAMPOLINE(<generated>)
                at com.google.inject.internal.InterceptorStackCallback$InterceptedMethodInvocation.proceed(InterceptorStackCallback.java:74)
                at net.datenwerke.security.service.security.aop.SecurityCheckInterceptor.invoke(SecurityCheckInterceptor.java:112)
                at com.google.inject.internal.InterceptorStackCallback$InterceptedMethodInvocation.proceed(InterceptorStackCallback.java:75)
                at net.datenwerke.gf.service.gwtstacktrace.CatchStacktraceInterceptor.invoke(CatchStacktraceInterceptor.java:38)
                at com.google.inject.internal.InterceptorStackCallback$InterceptedMethodInvocation.proceed(InterceptorStackCallback.java:75)
                at com.google.inject.internal.InterceptorStackCallback.invoke(InterceptorStackCallback.java:55)
                at net.datenwerke.oidc.server.auth.OidcLoginHandlerImpl$$EnhancerByGuice$$6d123f8e.service(<generated>)
                at com.google.inject.servlet.ServletDefinition.doServiceImpl(ServletDefinition.java:293)
                at com.google.inject.servlet.ServletDefinition.doService(ServletDefinition.java:283)
                at com.google.inject.servlet.ServletDefinition.service(ServletDefinition.java:184)
                at com.google.inject.servlet.ManagedServletPipeline.service(ManagedServletPipeline.java:89)
                at com.google.inject.servlet.FilterChainInvocation.doFilter(FilterChainInvocation.java:85)
                at com.google.inject.persist.PersistFilter.doFilter(PersistFilter.java:94)
                at com.google.inject.servlet.FilterChainInvocation.doFilter(FilterChainInvocation.java:82)
                at com.google.inject.servlet.ManagedFilterPipeline.dispatch(ManagedFilterPipeline.java:121)
                at com.google.inject.servlet.GuiceFilter.doFilter(GuiceFilter.java:133)
                at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:166)
                at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:142)
                at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:166)
                at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:88)
                at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:491)
                at org.apache.catalina.valves.RemoteIpValve.invoke(RemoteIpValve.java:763)
                at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127)
                at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:83)
                at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:764)
                at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:72)
                at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:344)
                at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:398)
                at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:63)
                at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:1309)
                at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1854)
                at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:52)
                at org.apache.tomcat.util.threads.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:973)
                at org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:491)
                at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:63)
                at java.base/java.lang.Thread.run(Thread.java:1583)

```

(URLs obviously censored)

---

<div class="post-metadata">

**Author:** ![IF\_Jasmin](https://forum.reportserver.net/letter_avatar_proxy/v4/letter/i/5e9695/32.png) [@IF\_Jasmin](https://forum.reportserver.net/u/IF_Jasmin)\
**Post date:** [October 7, 2026, 1:04pm UTC](https://forum.reportserver.net/t/oidc-keycloak-no-authentication-possible/1908/4 "2026-10-07T13:04:36Z")

</div>

Hello laeira,

Thanks for the detailed information.

The fact that Keycloak successfully returns an access token is important.  
This means that the initial login and redirect to Keycloak are working.  
The error occurs afterwards, when ReportServer tries to validate the token.

There is a relevant change in newer Keycloak versions which could explain this behavior.

The ReportServer installation guide currently uses Keycloak 26.5.1. Starting with Keycloak 26.6.2, token validation became stricter: the ReportServer backend client (rs) must be included in the access token’s aud (audience) claim.

Since your setup stopped working after upgrading Keycloak to 26.7.3, this is the first thing we would check.

Could you please decode the access token locally and tell us the values of:

aud  
azp  
iss

**Please do not post the complete token or any client secrets.**

In particular, please check whether rs is listed in the aud claim.

As a diagnostic test, you can also temporarily enable **“Allow token introspection without audience check”** for the rs client in Keycloak.

If ReportServer login works again after enabling this option, this would strongly indicate that the changed audience validation in Keycloak is the cause.

This option should only be used for testing. If this proves to be the issue, the proper solution is to configure the Keycloak token so that the rs client is included in its audience.

At this point, we would therefore not classify this as a ReportServer bug yet. First, let’s verify whether the Keycloak upgrade changed the token validation behavior in this setup.

Thank you very much for your patience and cooperation.

Kind regards,

Jasmin

---

<div class="post-metadata">

**Author:** ![laeira](https://forum.reportserver.net/letter_avatar_proxy/v4/letter/l/8e7dd6/32.png) [@laeira](https://forum.reportserver.net/u/laeira)\
**Post date:** [October 8, 2026, 9:37am UTC](https://forum.reportserver.net/t/oidc-keycloak-no-authentication-possible/1908/5 "2026-10-08T09:37:58Z")

</div>

After including the `rs` client in the `rs-fe`’s audience it now works again. Thanks a lot for the quick help. It would be great if the documentation could be updated to reflect this needed configuration.

---

<div class="post-metadata">

**Author:** ![IF\_Jasmin](https://forum.reportserver.net/letter_avatar_proxy/v4/letter/i/5e9695/32.png) [@IF\_Jasmin](https://forum.reportserver.net/u/IF_Jasmin)\
**Post date:** [October 9, 2026, 9:19am UTC](https://forum.reportserver.net/t/oidc-keycloak-no-authentication-possible/1908/6 "2026-10-09T09:19:06Z")

</div>

Hello laeira,

We’re glad to hear that everything is working as expected again.

Thank you for your suggestion to include this configuration in our documentation. I have forwarded your feedback to the relevant team for review and consideration.

Kind regards,  
Jasmin