Keycloak进阶认证二次登录时提示“用户名或密码无效”问题

问题现象 #

在Keycloak 23.0中配置进阶认证（Step Up Authentication）后：

• 首次可通过acr_values=basic完成基础登录，也能通过OTP完成进阶认证
• 再次发起acr_values=basic或acr_values=step-up认证请求时，会提示“用户名或密码无效”
• 清除用户会话或等待loa-max-age过期后，认证可恢复正常
• 测试默认browser-flow时，多次认证均无异常

已完成配置 #

• 配置ACR到LoA（等级 Assurance Level）的映射
• 创建自定义认证流

错误日志 #

2024-01-20 18:59:27,844 WARN  [org.keycloak.authentication.authenticators.util.AcrStore] (executor-thread-43) No condition found for level '1' in the authentication flow
2024-01-20 18:59:27,846 WARN  [org.keycloak.services] (executor-thread-43) KC-SERVICES0013: Failed authentication: org.keycloak.authentication.AuthenticationFlowException
at org.keycloak.authentication.AuthenticationProcessor.authenticateOnly(AuthenticationProcessor.java:1039)
at org.keycloak.authentication.AuthenticationProcessor.authenticate(AuthenticationProcessor.java:885)
at org.keycloak.protocol.AuthorizationEndpointBase.handleBrowserAuthenticationRequest(AuthorizationEndpointBase.java:153)
at org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint.buildAuthorizationCodeAuthorizationResponse(AuthorizationEndpoint.java:337)
at org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint.process(AuthorizationEndpoint.java:202)
at org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint.buildGet(AuthorizationEndpoint.java:113)
at org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint$quarkusrestinvoker$buildGet_4b690b27439f19dd29733dc5fd4004f24de0adb6.invoke(Unknown Source)
at org.jboss.resteasy.reactive.server.handlers.InvocationHandler.handle(InvocationHandler.java:29)
at io.quarkus.resteasy.reactive.server.runtime.QuarkusResteasyReactiveRequestContext.invokeHandler(QuarkusResteasyReactiveRequestContext.java:141)
at org.jboss.resteasy.reactive.common.core.AbstractResteasyReactiveContext.run(AbstractResteasyReactiveContext.java:145)
at io.quarkus.vertx.core.runtime.VertxCoreRecorder$14.runWith(VertxCoreRecorder.java:576)
at org.jboss.threads.EnhancedQueueExecutor$Task.run(EnhancedQueueExecutor.java:2513)
at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1538)
at org.jboss.threads.DelegatingRunnable.run(DelegatingRunnable.java:29)
at org.jboss.threads.ThreadLocalResettingRunnable.run(ThreadLocalResettingRunnable.java:29)
at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30)
at java.base/java.lang.Thread.run(Thread.java:840)
2024-01-20 18:59:27,848 WARN  [org.keycloak.events] (executor-thread-43) type=LOGIN_ERROR, realmId=628feb10-aa76-43c4-99a9-173430a72642, clientId=tenant-cli, userId=null, ipAddress=192.168.65.1, error=invalid_user_credentials, auth_method=openid-connect, auth_type=code, response_type=code, redirect_uri=https://oauth.pstmn.io/v1/callback, code_id=467dc632-1e1e-4bea-a744-1a851051c611, response_mode=query

问题分析与解决建议 #

核心错误是日志中的No condition found for level '1' in the authentication flow，说明Keycloak无法在自定义认证流中找到LoA等级1对应的触发条件，导致认证流程中断，最终返回“用户名或密码无效”的误导性错误。

解决步骤 #

1. 检查自定义认证流的LoA条件配置

   • 进入认证流配置页面，查看自定义流的每个执行分支，确保为LoA等级1（对应basic ACR）添加了LoACondition条件，并正确设置LoA值为1
   • 确认进阶认证分支（对应step-up ACR）的LoACondition设置了正确的更高等级（如2）

2. 验证ACR到LoA的映射

   • 进入Realm设置 → 登录 → 高级认证，确认：
     • basic映射到LoA等级1
     • step-up映射到LoA等级2
   • 确保映射的LoA等级与认证流中配置的条件完全匹配

3. 检查认证流分支逻辑

   • 对比默认browser-flow的结构，确保自定义流的分支逻辑正确：基础认证分支和进阶认证分支分别对应不同的LoA等级，且分支条件优先级设置合理

4. 测试会话复用场景

   • 完成一次基础认证后，直接发起进阶认证请求，检查是否能正常触发OTP验证；再发起基础认证请求，确认是否能复用会话或正确触发对应流程

内容的提问来源于stack exchange，提问作者Siddharth Eswaramoorthy