Hello everyone, I'm currently doing a POC to verify that I can use the Keycloak with Medplum Redirect to Keycloak sign in page (step 3+4) ✅ Submit Keycloak credentials (step 5) ✅ Receive 301 redirect response to http://localhost:8103/auth/external with code in URL (step 6+7) 🛑 When accessing the auth/external I have an error that you can see in the screenshot below, and my keycloak server is giving me the following error :

PKCE verification failed.

Here is the code I use and how I've configured the project :

import { useEffect } from 'react';
import './App.css';

import { MedplumClient } from '@medplum/core';

const medplum = new MedplumClient({
  clientId: 'b7072885-b0d8-44d6-98e7-2179a66f8c65', //Found in the ClientApplication in the Medplum server
  baseUrl: 'http://localhost:8103/', //Medplum server URL
});

function App() {

  useEffect(() => {
    const code = new URLSearchParams(window.location.search).get('code');
    if (code) {
      // Process the code
      // On success, remove the query string parameters
      medplum
        .processCode(code)
        .then(() => (window.location.href = window.location.href.split('?')[0]))
        .catch(console.error);
    }
  })

  let handleLogin = () => {
    medplum.signInWithExternalAuth(
      "http://localhost:8080/realms/medplumtest/protocol/openid-connect/auth",//Found in the Keycloak medplumtest realm settings
      "medplumtest", // Found in the Keycloak realm list
      "http://localhost:8103/auth/external",  //Redirection to the Medplum server
      {
        projectId: "c23721b0-00f8-4e55-8154-8478d12b65c8", //Found in Admin > Project > Details > Id
        clientId: "b7072885-b0d8-44d6-98e7-2179a66f8c65", //Found in the ClientApplication in the Medplum server
        redirectUri: "http://localhost:5173/",
    })
  }

  return (
    <>
      <button onClick={handleLogin}>Login</button>
    </>
  )
}

export default App

If anyone can help that would be great ! @rahul1

Hi @thomabig, I've been trying to do some research on KeyCloak to understand what level of PKCE they support. I will update

Hi, Thank @rahul1 ! I've tried disabling PKCE to see if it would be better, but even when disabling PKCE in Medplum and asking Keycloak not to use PKCE I have an error in Keycloak !

2024-04-05 00:40:22 2024-04-04 22:40:22,761 WARN  [org.keycloak.protocol.oidc.utils.PkceUtils] (executor-thread-58) PKCE code verifier not specified, authUserId = aec2fa5a-a724-4c20-a7e8-19b6f5f6cbaf, authUsername = thomabigueres
2024-04-05 00:40:22 2024-04-04 22:40:22,762 WARN  [org.keycloak.events] (executor-thread-58) type="CODE_TO_TOKEN_ERROR", realmId="8b7bcba1-8540-45f6-a43d-fb7193079034", clientId="medplumtest", userId="aec2fa5a-a724-4c20-a7e8-19b6f5f6cbaf", ipAddress="192.168.65.1", error="code_verifier_missing", grant_type="authorization_code", code_id="c2a51dd9-2763-4cbe-9771-02b310055bef", client_auth_method="client-secret"

Yes, using the Medplum Auth would be a fine place to start

Thank you so much @rahul1 ! Indeed I was sure that I've tested it at some point with pkceEnabled to false, but I guess when I did test it like that the keycloak configuration wasn't ok. I am wondering though, is it the expected behavior to disable pkce ? From what I understand, it is a must have security check. Do you have any idea why it doesn't work when pkce is enabled ?

We should be able to get it working with PKCE enabled as well. I first just wanted to confirm that was the issue

Yes without the pkceEnabled it works perfectly thanks 🙂