Skip to content

Fix oidcc-prompt-login test for conformance suite v5.1.43 / Keycloak 26.6.3 - #2

Draft
tnorimat with Copilot wants to merge 1 commit into
mainfrom
copilot/fix-1021-issue
Draft

Fix oidcc-prompt-login test for conformance suite v5.1.43 / Keycloak 26.6.3#2
tnorimat with Copilot wants to merge 1 commit into
mainfrom
copilot/fix-1021-issue

Conversation

Copilot AI commented Jun 7, 2026

Copy link
Copy Markdown

oidcc-prompt-login results INTERRUPTED/FAILED with conformance suite v5.1.43 and Keycloak 26.6.3 (keycloak#1021).

Root cause

The browser automation URL match pattern for the "Prompted Login" task requires prompt=login to be the last query parameter:

auth*prompt=login

If the conformance suite reorders parameters so prompt=login is no longer terminal, this task never matches. The automation falls through to "Initial Login" which expects both username and password fields — but the re-auth page only has password, causing INTERRUPTED.

The existing oidcc-max-age-1 pattern already handles this correctly with a trailing wildcard: auth*max_age=*.

Changes

  • Version bumps: conformance suite v5.1.41v5.1.43, Keycloak 26.6.026.6.3 (in .env and CI workflow)
  • URL pattern fix: Added trailing * to the prompt=login match across all 18 OIDC automated test configs
- "match": "https://as.keycloak-fapi.org/auth/realms/test/protocol/openid-connect/auth*prompt=login"
+ "match": "https://as.keycloak-fapi.org/auth/realms/test/protocol/openid-connect/auth*prompt=login*"

Investigation notes

Diffed Keycloak templates between 26.6.0 and 26.6.3 — login page structure, alert XPath/classes, message text, authChecker.js, login-password.ftl, and buttons.ftl are all identical. The issue is entirely in the client-side test automation config.

Update conformance suite from v5.1.41 to v5.1.43 and Keycloak from
26.6.0 to 26.6.3 as reported in keycloak#1021.

Fix the browser automation URL match pattern for the oidcc-prompt-login
test by adding a trailing wildcard (*) to the prompt=login match. Without
this, the pattern only matches URLs where prompt=login is the last
parameter, which can fail if the conformance suite v5.1.43 places it
before other parameters in the authorization URL.

This is consistent with the existing oidcc-max-age-1 pattern which
already uses a trailing wildcard: auth*max_age=*

Closes keycloak#1021
Copilot AI changed the title fix: update versions and fix oidcc-prompt-login URL match pattern for conformance suite v5.1.43 and Keycloak 26.6.3 Fix oidcc-prompt-login test for conformance suite v5.1.43 / Keycloak 26.6.3 Jun 7, 2026
Copilot AI requested a review from tnorimat June 7, 2026 11:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants