"Error contacting userinfo endpoint" when trying to log in via Keycloak

[andscape-dev]

Describe the bug
I've been trying to set up this plugin to integrate with my Keycloak SSO using OpenID but with no success so far. Most of my attempts at configuration end up in an error page with the message "Error contacting userinfo endpoint: Unauthorized Try logging in again."

No error logs are emitted during the process, just two lines of: Jellyfin.Plugin.SSO_Auth.Api.SSOController: SSO Controller initialized

To Reproduce
Steps to reproduce the behavior:

1. Configure the plugin in a Jellyfin admin session.
2. Log out of the admin session
3. Restart Jellyfin by recreating the docker container
4. Reload the login page
5. Click on the "Log in with SSO" button created exactly as described in the plugin README
6. Be redirected to the keycloak login page
7. Fill in my details and enter
8. Wait a suspiciously long time (10s or more)
9. See an error page with the message "Error contacting userinfo endpoint: Unauthorized Try logging in again."

Expected behavior
After logging in on the Keycloak SSO page I am redirected to the Jellyfin homepage with a newly created account matching my Keycloak account's username and defined client permissions.

Screenshots

• Keycloak client config:

Configuration

<?xml version="1.0" encoding="utf-8"?>
<PluginConfiguration xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
    <SamlConfigs />
    <OidConfigs>
        <item>
            <key>
                <string>keycloak</string>
            </key>
            <value>
                <PluginConfiguration>
                    <OidEndpoint>https://auth.example.com/realms/myrealm/</OidEndpoint>
                    <OidClientId>jellyfin</OidClientId>
                    <OidSecret>mysecret</OidSecret>
                    <Enabled>true</Enabled>
                    <EnableAuthorization>true</EnableAuthorization>
                    <EnableAllFolders>false</EnableAllFolders>
                    <EnabledFolders>
                        <string>myfolder</string>
                    </EnabledFolders>
                    <AdminRoles>
                        <string>admin</string>
                    </AdminRoles>
                    <Roles>
                        <string>user</string>
                    </Roles>
                    <EnableFolderRoles>false</EnableFolderRoles>
                    <EnableLiveTvRoles>false</EnableLiveTvRoles>
                    <EnableLiveTv>false</EnableLiveTv>
                    <EnableLiveTvManagement>false</EnableLiveTvManagement>
                    <LiveTvRoles />
                    <LiveTvManagementRoles />
                    <FolderRoleMappings />
                    <RoleClaim>resource_access.roles</RoleClaim> <!-- I have a custom mapper for this, the default resource_access.jellyfin.roles wasn't being parsed correctly for some reason -->
                    <OidScopes>
                        <string>openid</string>
                    </OidScopes>
                    <DefaultProvider>Jellyfin.Server.Implementations.Users.DefaultAuthenticationProvider</DefaultProvider>
                    <NewPath>false</NewPath>
                    <CanonicalLinks />
                    <DisableHttps>false</DisableHttps>
                    <DoNotValidateEndpoints>false</DoNotValidateEndpoints>
                    <DoNotValidateIssuerName>false</DoNotValidateIssuerName>
                </PluginConfiguration>
            </value>
        </item>
    </OidConfigs>
</PluginConfiguration>

Example access token generated by Keycloak:

{
  "exp": 1737213641,
  "iat": 1737213341,
  "jti": "bd3c1f0f-d604-4e77-b795-70ae15054800",
  "iss": "https://auth.example/realms/myrealm",
  "aud": [
    "grafana",
    "account"
  ],
  "sub": "5a6b9e03-a98b-4289-95df-6514e22cf452",
  "typ": "Bearer",
  "azp": "jellyfin",
  "sid": "e7dac131-5cd5-4953-a9f4-5ee8e8bf1936",
  "acr": "1",
  "allowed-origins": [
    "https://jellyfin.example.com/*"
  ],
  "realm_access": {
    "roles": [
      "offline_access",
      "jellyfin-user",
      "uma_authorization",
      "default-roles-myrealm"
    ]
  },
  "resource_access": {
    "roles": [
      "admin"
    ]
  },
  "scope": "openid email profile",
  "email_verified": false,
  "name": "Jane Smith",
  "preferred_username": "janesmith",
  "given_name": "Jane",
  "family_name": "Smith",
  "email": "janesmith@myrealm.local"
}

EDIT:
Keycloak warning logs from multiple consecutive attempts at login, while changing plugin parameters:

2025-01-18 04:37:14,636 WARN  [org.keycloak.events] (executor-thread-4) type="USER_INFO_REQUEST_ERROR", realmId="c862aa39-a644-4580-a4e0-aba4993d41d5", realmName="myrealm", clientId="null", userId="null", ipAddress="10.10.10.10", error="invalid_token", reason="Failed to read access token from JWT", auth_method="validate_access_token"
2025-01-18 04:37:45,815 WARN  [org.keycloak.protocol.oidc.utils.OAuth2CodeParser] (executor-thread-4) Code '4177c722-e7a9-4166-83e1-777453b83288' already used for userSession '36711d5d-108e-467e-9036-823309ce881e' and client '28dcd3cd-b6b2-4051-afd8-78555bc7114a'.
2025-01-18 04:37:45,816 WARN  [org.keycloak.events] (executor-thread-4) type="CODE_TO_TOKEN_ERROR", realmId="c862aa39-a644-4580-a4e0-aba4993d41d5", realmName="myrealm", clientId="jellyfin", userId="null", sessionId="36711d5d-108e-467e-9036-823309ce881e", ipAddress="10.10.10.10", error="invalid_code", grant_type="authorization_code", code_id="36711d5d-108e-467e-9036-823309ce881e", client_auth_method="client-secret"
2025-01-18 04:38:37,816 WARN  [org.keycloak.events] (executor-thread-4) type="USER_INFO_REQUEST_ERROR", realmId="c862aa39-a644-4580-a4e0-aba4993d41d5", realmName="myrealm", clientId="null", userId="null", ipAddress="10.10.10.10", error="invalid_token", reason="Failed to read access token from JWT", auth_method="validate_access_token"
2025-01-18 04:53:28,421 WARN  [org.keycloak.events] (executor-thread-8) type="USER_INFO_REQUEST_ERROR", realmId="c862aa39-a644-4580-a4e0-aba4993d41d5", realmName="myrealm", clientId="null", userId="null", ipAddress="10.10.10.10", error="invalid_token", reason="Failed to read access token from JWT", auth_method="validate_access_token"
2025-01-18 15:46:38,719 WARN  [org.keycloak.events] (executor-thread-20) type="USER_INFO_REQUEST_ERROR", realmId="c862aa39-a644-4580-a4e0-aba4993d41d5", realmName="myrealm", clientId="null", userId="null", ipAddress="10.10.10.10", error="invalid_token", reason="Failed to read access token from JWT", auth_method="validate_access_token"
2025-01-18 15:50:37,682 WARN  [org.keycloak.events] (executor-thread-21) type="USER_INFO_REQUEST_ERROR", realmId="c862aa39-a644-4580-a4e0-aba4993d41d5", realmName="myrealm", clientId="null", userId="null", ipAddress="10.10.10.10", error="invalid_token", reason="Failed to read access token from JWT", auth_method="validate_access_token"
2025-01-18 15:51:46,019 WARN  [org.keycloak.events] (executor-thread-21) type="USER_INFO_REQUEST_ERROR", realmId="c862aa39-a644-4580-a4e0-aba4993d41d5", realmName="myrealm", clientId="null", userId="null", ipAddress="10.10.10.10", error="invalid_token", reason="Failed to read access token from JWT", auth_method="validate_access_token"
2025-01-18 15:54:38,639 WARN  [org.keycloak.events] (executor-thread-21) type="USER_INFO_REQUEST_ERROR", realmId="c862aa39-a644-4580-a4e0-aba4993d41d5", realmName="myrealm", clientId="null", userId="null", ipAddress="10.10.10.10", error="invalid_token", reason="Failed to read access token from JWT", auth_method="validate_access_token"
2025-01-18 16:10:59,073 WARN  [org.keycloak.events] (executor-thread-34) type="LOGIN_ERROR", realmId="c862aa39-a644-4580-a4e0-aba4993d41d5", realmName="myrealm", clientId="jellyfin", userId="null", ipAddress="myipaddress", error="invalid_redirect_uri", redirect_uri="https://jellyfin.example.com/sso/OID/redirect/keycloak"
2025-01-18 16:16:47,393 WARN  [org.keycloak.events] (executor-thread-37) type="USER_INFO_REQUEST_ERROR", realmId="c862aa39-a644-4580-a4e0-aba4993d41d5", realmName="myrealm", clientId="null", userId="null", ipAddress="10.10.10.10", error="invalid_token", reason="Failed to read access token from JWT", auth_method="validate_access_token"
2025-01-18 16:43:07,890 WARN  [org.keycloak.events] (executor-thread-41) type="USER_INFO_REQUEST_ERROR", realmId="c862aa39-a644-4580-a4e0-aba4993d41d5", realmName="myrealm", clientId="null", userId="null", ipAddress="10.10.10.10", error="invalid_token", reason="Failed to read access token from JWT", auth_method="validate_access_token"
2025-01-18 16:45:10,499 WARN  [org.keycloak.protocol.oidc.utils.OAuth2CodeParser] (executor-thread-41) Code '43af013e-efa6-421d-a11e-0888d3cc5593' already used for userSession 'fcdcd1c5-b872-4872-be6d-f7c53e3bded4' and client '66205fa1-8c3e-4b10-a6e1-1ca257a8f81d'.
2025-01-18 16:45:10,500 WARN  [org.keycloak.events] (executor-thread-41) type="CODE_TO_TOKEN_ERROR", realmId="c862aa39-a644-4580-a4e0-aba4993d41d5", realmName="myrealm", clientId="jellyfin", userId="null", sessionId="fcdcd1c5-b872-4872-be6d-f7c53e3bded4", ipAddress="10.10.10.10", error="invalid_code", grant_type="authorization_code", code_id="fcdcd1c5-b872-4872-be6d-f7c53e3bded4", client_auth_method="client-secret"
2025-01-18 16:52:36,112 WARN  [org.keycloak.events] (executor-thread-41) type="USER_INFO_REQUEST_ERROR", realmId="c862aa39-a644-4580-a4e0-aba4993d41d5", realmName="myrealm", clientId="null", userId="null", ipAddress="10.10.10.10", error="invalid_token", reason="Failed to read access token from JWT", auth_method="validate_access_token"
2025-01-18 16:54:42,430 WARN  [org.keycloak.events] (executor-thread-43) type="USER_INFO_REQUEST_ERROR", realmId="c862aa39-a644-4580-a4e0-aba4993d41d5", realmName="myrealm", clientId="null", userId="null", ipAddress="10.10.10.10", error="invalid_token", reason="Failed to read access token from JWT", auth_method="validate_access_token"

Versions (please complete the following information):

• Host OS: Debian 12
• Runtime: customized Docker image based on the LinuxServer.io one (just added an init script with some network routing)
• Browser: Firefox (Zen Browser)
• Jellyfin Version: 10.10.3
• Plugin Version: 3.5.2.4

Additional context
Plugin installed from within the app as usual.

[9p4]

What does your well-known for Keycloak look like?

[andscape-dev]

Hey thanks for the quick reply! Here it is:

well-known.json