"Error contacting userinfo endpoint" when trying to log in via Keycloak

[andscape-dev]

Describe the bug
I've been trying to set up this plugin to integrate with my Keycloak SSO using OpenID but with no success so far. Most of my attempts at configuration end up in an error page with the message "Error contacting userinfo endpoint: Unauthorized Try logging in again."

No error logs are emitted during the process, just two lines of: Jellyfin.Plugin.SSO_Auth.Api.SSOController: SSO Controller initialized

To Reproduce
Steps to reproduce the behavior:

1. Configure the plugin in a Jellyfin admin session.
2. Log out of the admin session
3. Restart Jellyfin by recreating the docker container
4. Reload the login page
5. Click on the "Log in with SSO" button created exactly as described in the plugin README
6. Be redirected to the keycloak login page
7. Fill in my details and enter
8. Wait a suspiciously long time (10s or more)
9. See an error page with the message "Error contacting userinfo endpoint: Unauthorized Try logging in again."

Expected behavior
After logging in on the Keycloak SSO page I am redirected to the Jellyfin homepage with a newly created account matching my Keycloak account's username and defined client permissions.

Screenshots

• Keycloak client config:

Configuration

<?xml version="1.0" encoding="utf-8"?>
<PluginConfiguration xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
    <SamlConfigs />
    <OidConfigs>
        <item>
            <key>
                <string>keycloak</string>
            </key>
            <value>
                <PluginConfiguration>
                    <OidEndpoint>https://auth.example.com/realms/myrealm/</OidEndpoint>
                    <OidClientId>jellyfin</OidClientId>
                    <OidSecret>mysecret</OidSecret>
                    <Enabled>true</Enabled>
                    <EnableAuthorization>true</EnableAuthorization>
                    <EnableAllFolders>false</EnableAllFolders>
                    <EnabledFolders>
                        <string>myfolder</string>
                    </EnabledFolders>
                    <AdminRoles>
                        <string>admin</string>
                    </AdminRoles>
                    <Roles>
                        <string>user</string>
                    </Roles>
                    <EnableFolderRoles>false</EnableFolderRoles>
                    <EnableLiveTvRoles>false</EnableLiveTvRoles>
                    <EnableLiveTv>false</EnableLiveTv>
                    <EnableLiveTvManagement>false</EnableLiveTvManagement>
                    <LiveTvRoles />
                    <LiveTvManagementRoles />
                    <FolderRoleMappings />
                    <RoleClaim>resource_access.roles</RoleClaim> <!-- I have a custom mapper for this, the default resource_access.jellyfin.roles wasn't being parsed correctly for some reason -->
                    <OidScopes>
                        <string>openid</string>
                    </OidScopes>
                    <DefaultProvider>Jellyfin.Server.Implementations.Users.DefaultAuthenticationProvider</DefaultProvider>
                    <NewPath>false</NewPath>
                    <CanonicalLinks />
                    <DisableHttps>false</DisableHttps>
                    <DoNotValidateEndpoints>false</DoNotValidateEndpoints>
                    <DoNotValidateIssuerName>false</DoNotValidateIssuerName>
                </PluginConfiguration>
            </value>
        </item>
    </OidConfigs>
</PluginConfiguration>

Example access token generated by Keycloak:

{
  "exp": 1737213641,
  "iat": 1737213341,
  "jti": "bd3c1f0f-d604-4e77-b795-70ae15054800",
  "iss": "https://auth.example/realms/myrealm",
  "aud": [
    "grafana",
    "account"
  ],
  "sub": "5a6b9e03-a98b-4289-95df-6514e22cf452",
  "typ": "Bearer",
  "azp": "jellyfin",
  "sid": "e7dac131-5cd5-4953-a9f4-5ee8e8bf1936",
  "acr": "1",
  "allowed-origins": [
    "https://jellyfin.example.com/*"
  ],
  "realm_access": {
    "roles": [
      "offline_access",
      "jellyfin-user",
      "uma_authorization",
      "default-roles-myrealm"
    ]
  },
  "resource_access": {
    "roles": [
      "admin"
    ]
  },
  "scope": "openid email profile",
  "email_verified": false,
  "name": "Jane Smith",
  "preferred_username": "janesmith",
  "given_name": "Jane",
  "family_name": "Smith",
  "email": "janesmith@myrealm.local"
}

EDIT:
Keycloak warning logs from multiple consecutive attempts at login, while changing plugin parameters:

2025-01-18 04:37:14,636 WARN  [org.keycloak.events] (executor-thread-4) type="USER_INFO_REQUEST_ERROR", realmId="c862aa39-a644-4580-a4e0-aba4993d41d5", realmName="myrealm", clientId="null", userId="null", ipAddress="10.10.10.10", error="invalid_token", reason="Failed to read access token from JWT", auth_method="validate_access_token"
2025-01-18 04:37:45,815 WARN  [org.keycloak.protocol.oidc.utils.OAuth2CodeParser] (executor-thread-4) Code '4177c722-e7a9-4166-83e1-777453b83288' already used for userSession '36711d5d-108e-467e-9036-823309ce881e' and client '28dcd3cd-b6b2-4051-afd8-78555bc7114a'.
2025-01-18 04:37:45,816 WARN  [org.keycloak.events] (executor-thread-4) type="CODE_TO_TOKEN_ERROR", realmId="c862aa39-a644-4580-a4e0-aba4993d41d5", realmName="myrealm", clientId="jellyfin", userId="null", sessionId="36711d5d-108e-467e-9036-823309ce881e", ipAddress="10.10.10.10", error="invalid_code", grant_type="authorization_code", code_id="36711d5d-108e-467e-9036-823309ce881e", client_auth_method="client-secret"
2025-01-18 04:38:37,816 WARN  [org.keycloak.events] (executor-thread-4) type="USER_INFO_REQUEST_ERROR", realmId="c862aa39-a644-4580-a4e0-aba4993d41d5", realmName="myrealm", clientId="null", userId="null", ipAddress="10.10.10.10", error="invalid_token", reason="Failed to read access token from JWT", auth_method="validate_access_token"
2025-01-18 04:53:28,421 WARN  [org.keycloak.events] (executor-thread-8) type="USER_INFO_REQUEST_ERROR", realmId="c862aa39-a644-4580-a4e0-aba4993d41d5", realmName="myrealm", clientId="null", userId="null", ipAddress="10.10.10.10", error="invalid_token", reason="Failed to read access token from JWT", auth_method="validate_access_token"
2025-01-18 15:46:38,719 WARN  [org.keycloak.events] (executor-thread-20) type="USER_INFO_REQUEST_ERROR", realmId="c862aa39-a644-4580-a4e0-aba4993d41d5", realmName="myrealm", clientId="null", userId="null", ipAddress="10.10.10.10", error="invalid_token", reason="Failed to read access token from JWT", auth_method="validate_access_token"
2025-01-18 15:50:37,682 WARN  [org.keycloak.events] (executor-thread-21) type="USER_INFO_REQUEST_ERROR", realmId="c862aa39-a644-4580-a4e0-aba4993d41d5", realmName="myrealm", clientId="null", userId="null", ipAddress="10.10.10.10", error="invalid_token", reason="Failed to read access token from JWT", auth_method="validate_access_token"
2025-01-18 15:51:46,019 WARN  [org.keycloak.events] (executor-thread-21) type="USER_INFO_REQUEST_ERROR", realmId="c862aa39-a644-4580-a4e0-aba4993d41d5", realmName="myrealm", clientId="null", userId="null", ipAddress="10.10.10.10", error="invalid_token", reason="Failed to read access token from JWT", auth_method="validate_access_token"
2025-01-18 15:54:38,639 WARN  [org.keycloak.events] (executor-thread-21) type="USER_INFO_REQUEST_ERROR", realmId="c862aa39-a644-4580-a4e0-aba4993d41d5", realmName="myrealm", clientId="null", userId="null", ipAddress="10.10.10.10", error="invalid_token", reason="Failed to read access token from JWT", auth_method="validate_access_token"
2025-01-18 16:10:59,073 WARN  [org.keycloak.events] (executor-thread-34) type="LOGIN_ERROR", realmId="c862aa39-a644-4580-a4e0-aba4993d41d5", realmName="myrealm", clientId="jellyfin", userId="null", ipAddress="myipaddress", error="invalid_redirect_uri", redirect_uri="https://jellyfin.example.com/sso/OID/redirect/keycloak"
2025-01-18 16:16:47,393 WARN  [org.keycloak.events] (executor-thread-37) type="USER_INFO_REQUEST_ERROR", realmId="c862aa39-a644-4580-a4e0-aba4993d41d5", realmName="myrealm", clientId="null", userId="null", ipAddress="10.10.10.10", error="invalid_token", reason="Failed to read access token from JWT", auth_method="validate_access_token"
2025-01-18 16:43:07,890 WARN  [org.keycloak.events] (executor-thread-41) type="USER_INFO_REQUEST_ERROR", realmId="c862aa39-a644-4580-a4e0-aba4993d41d5", realmName="myrealm", clientId="null", userId="null", ipAddress="10.10.10.10", error="invalid_token", reason="Failed to read access token from JWT", auth_method="validate_access_token"
2025-01-18 16:45:10,499 WARN  [org.keycloak.protocol.oidc.utils.OAuth2CodeParser] (executor-thread-41) Code '43af013e-efa6-421d-a11e-0888d3cc5593' already used for userSession 'fcdcd1c5-b872-4872-be6d-f7c53e3bded4' and client '66205fa1-8c3e-4b10-a6e1-1ca257a8f81d'.
2025-01-18 16:45:10,500 WARN  [org.keycloak.events] (executor-thread-41) type="CODE_TO_TOKEN_ERROR", realmId="c862aa39-a644-4580-a4e0-aba4993d41d5", realmName="myrealm", clientId="jellyfin", userId="null", sessionId="fcdcd1c5-b872-4872-be6d-f7c53e3bded4", ipAddress="10.10.10.10", error="invalid_code", grant_type="authorization_code", code_id="fcdcd1c5-b872-4872-be6d-f7c53e3bded4", client_auth_method="client-secret"
2025-01-18 16:52:36,112 WARN  [org.keycloak.events] (executor-thread-41) type="USER_INFO_REQUEST_ERROR", realmId="c862aa39-a644-4580-a4e0-aba4993d41d5", realmName="myrealm", clientId="null", userId="null", ipAddress="10.10.10.10", error="invalid_token", reason="Failed to read access token from JWT", auth_method="validate_access_token"
2025-01-18 16:54:42,430 WARN  [org.keycloak.events] (executor-thread-43) type="USER_INFO_REQUEST_ERROR", realmId="c862aa39-a644-4580-a4e0-aba4993d41d5", realmName="myrealm", clientId="null", userId="null", ipAddress="10.10.10.10", error="invalid_token", reason="Failed to read access token from JWT", auth_method="validate_access_token"

Versions (please complete the following information):

• Host OS: Debian 12
• Runtime: customized Docker image based on the LinuxServer.io one (just added an init script with some network routing)
• Browser: Firefox (Zen Browser)
• Jellyfin Version: 10.10.3
• Plugin Version: 3.5.2.4

Additional context
Plugin installed from within the app as usual.

[9p4]

What does your well-known for Keycloak look like?

[9p4]

What algorithms is Keycloak using? This can be seen in the advanced section.

[andscape-dev]

Are you talking about the Authorization response signature algorithm? All those algorithm options are unset, so they're all defaults. Not sure what the default value is for that, I can try and check the JWT from the browser. Is there a preferred/supported algorithm?

[9p4]

Is Keycloak working for other apps?

[andscape-dev]

Yup, I have various other clients for it working fine.

[9p4]

I'm not sure what your issue is otherwise, since I run my plugin with Keycloak and it works fine.

[andscape-dev]

Popping back in to say: I tried the whole setup again from scratch and this time it works smoothly. The only thing I changed was making my Keycloak role claim mapper just a non nested "roles" instead of "resource_access.roles", it seems the plugin's claim parser doesn't handle nested objects well. Not sure if that was my previous problem, but I guess I can close this.