Cannot setup OIDC with Keycloak : Unknown state in response

Question

On a new instance, I setup OIDC with Keycloak, and I cannot login. Is there any package that I should use to debug ? I tried to increase the log level of com.atlassian.plugins.authentication.sso but I did not have any information more than this log : 2026-02-09 12:44:58,794+0000 http-nio-8080-exec-7 url: /plugins/servlet/oidc/callback ERROR anonymous 764x1018142x1 zch5oj 10.244.208.192,10.252.0.20 /plugins/servlet/oidc/callback [c.a.p.a.s.web.filt2026-02-09 12:44:58,794+0000 http-nio-8080-exec-7 url: /plugins/servlet/oidc/callback ERROR anonymous 764x1018142x1 zch5oj 10.244.208.192,10.252.0.20 /plugins/servlet/oidc/callback [c.a.p.a.s.web.filter.ErrorHandlingFilter] [UUID: 3bc669a0-302f-451e-aa69-b2aba297cd01] Unknown state in response com.atlassian.plugins.authentication.sso.web.usercontext.AuthenticationFailedException: Unknown state in response at com.atlassian.plugins.authentication.sso.web.oidc.OidcConsumerServlet.lambda$doGet$0(OidcConsumerServlet.java:113) at java.base/java.util.Optional.orElseThrow(Optional.java:403) at com.atlassian.plugins.authentication.sso.web.oidc.OidcConsumerServlet.doGet(OidcConsumerServlet.java:113) at javax.servlet.http.HttpServlet.service(HttpServlet.java:529) at javax.servlet.http.HttpServlet.service(HttpServlet.java:623) at com.atlassian.plugin.servlet.DelegatingPluginServlet.service(DelegatingPluginServlet.java:37) at javax.servlet.http.HttpServlet.service(HttpServlet.java:623) at com.atlassian.plugin.servlet.ServletModuleContainerServlet.service(ServletModuleContainerServlet.java:49) at com.atlassian.jira.plugin.servlet.ServletModuleContainerServlet.service(ServletModuleContainerServlet.java:76) at javax.servlet.http.HttpServlet.service(HttpServlet.java:623) ... 48 filtered Increasing the HTTP log, I was able to trace the error : 10.252.0.34 o917x1031183x1 - [09/Feb/2026:15:17:39 +0000] "GET https://demo-jirasm-dev.cloud.example.com/plugins/servlet/oidc/callback HTTP/1.1" 400 893 0.0350 - "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:147.0) Gecko/20100101 Firefox/147.0" "lzi0s5" ___ Request _____________________________________________________ Request URL Parameters : state=PAlmhPP9hjvfC2mTfBTSONA5WvhMrkq4W6GhWlaB7kM session_state=b6cb0f41-9690-4a55-afb0-68828ba77e91 iss=https://keycloak.example.com/realms/development code=b1d11c5a-a784-492a-8de5-1a2f563d7ea0.b6cb0f41-9690-4a55-afb0-68828ba77e91.0716fd7e-e11f-4683-a389-d9bdb5972e17 Request HTTP Headers : host=demo-jirasm-dev.cloud.example.com x-request-id=f56eea5ed2794d0c40e9e33a7f03b0d7 x-real-ip=aa.bb.cc.dd x-forwarded-for=aa.bb.cc.dd x-forwarded-host=demo-jirasm-dev.cloud.example.com x-forwarded-port=80 x-forwarded-proto=http x-forwarded-scheme=http x-scheme=http x-original-forwarded-for=ee.ff.gg.hh user-agent=Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:147.0) Gecko/20100101 Firefox/147.0 accept=text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 accept-language=en-US,en;q=0.9 accept-encoding=gzip, deflate, br, zstd cookie=apt.uid=AP-YFGMCGUNNIFB-2-1761236851856-64929651.0.2.6b933aba-006b-4c12-b4b5-a0ddc2adfcf4; _ga_0C4M1PWYZ7=GS2.1.s1768898063$o12$g0$t1768898064$j59$l0$h0; _ga=GA1.1.1889413738.1761236852; _ga_T11SF3WXX2=GS2.1.s1768898064$o12$g0$t1768898064$j60$l0$h0; _ga_K2SPJK2C73=GS2.1.s1768898064$o12$g0$t1768898064$j60$l0$h0 upgrade-insecure-requests=1 sec-fetch-dest=document sec-fetch-mode=navigate sec-fetch-site=cross-site priority=u=0, i Request Cookies : apt.uid=AP-YFGMCGUNNIFB-2-1761236851856-64929651.0.2.6b933aba-006b-4c12-b4b5-a0ddc2adfcf4 path:null domain:null version:0 maxAge:-1 _ga_0C4M1PWYZ7=GS2.1.s1768898063$o12$g0$t1768898064$j59$l0$h0 path:null domain:null version:0 maxAge:-1 _ga=GA1.1.1889413738.1761236852 path:null domain:null version:0 maxAge:-1 _ga_T11SF3WXX2=GS2.1.s1768898064$o12$g0$t1768898064$j60$l0$h0 path:null domain:null version:0 maxAge:-1 _ga_K2SPJK2C73=GS2.1.s1768898064$o12$g0$t1768898064$j60$l0$h0 path:null domain:null version:0 maxAge:-1 Request Attributes : com.atlassian.jira.web.filters.pagebuilder.PageBuilderFilter_alreadyfiltered=true com.opensymphony.sitemesh.APPLIED_ONCE=true com.atlassian.jira.web.filters.accesslog.AccessLogFilter_already_filtered=true atlassian.core.seraph.original.url=/plugins/servlet/oidc/callback?state=PAlmhPP9hjvfC2mTfBTSONA5WvhMrkq4W6GhWlaB7kM&session_state=b6cb0f41-9690-4a55-afb0-68828ba77e91&iss=https%3A%2F%2Fkeycloak.example.com%2Frealms%2Fdevelopment&code=b1d11c5a-a784-492a-8de5-1a2f563d7ea0.b6cb0f41-9690-4a55-afb0-68828ba77e91.0716fd7e-e11f-4683-a389-d9bdb5972e17 com.atlassian.labs.botkiller.BotKillerFilter=true com.atlassian.gzipfilter.GzipFilter_already_filtered=true com.newrelic.agent.TRANSACTION_NAME=/plugins/servlet/oidc/* jira.request.assession.id=lzi0s5 com.atlassian.jira.security.xsrf.XsrfTokenAdditionRequestFilter_already_filtered=true page.builder=com.atlassian.jira.web.pagebuilder.DefaultPageBuilder@6a5c00fe jira.request.id=917x1031183x1 sanitized.query=?state=PAlmhPP9hjvfC2mTfBTSONA5WvhMrkq4W6GhWlaB7kM&session_state=b6cb0f41-9690-4a55-afb0-68828ba77e91&iss=https%3A%2F%2Fkeycloak.example.com%2Frealms%2Fdevelopment&code=b1d11c5a-a784-492a-8de5-1a2f563d7ea0.b6cb0f41-9690-4a55-afb0-68828ba77e91.0716fd7e-e11f-4683-a389-d9bdb5972e17 sitemesh.secondaryStorageLimit=-1 jira.xsrf.set.cookie.pending=BMUS-OFAA-5DJ8-XOAE_127e2a6b47835892ca51f684f3085f1417ef097c_lout jira.request.start.millis=1770650259012 jira.webwork.cleanup=false com.atlassian.jira.web.filters.johnson.JiraJohnson503Filter_already_filtered=true com.atlassian.jira.web.filters.JiraFirstFilter_alreadyfiltered=true com.atlassian.servicedesk.internal.web.CustomerContextSettingFilter=true B3-TraceId=55aab8e3fa4624 loginfilter.already.filtered=true com.atlassian.prettyurls.filter.PrettyUrlsSiteMeshFixupFilter=true com.atlassian.core.filters.HeaderSanitisingFilter_already_filtered=true com.atlassian.jira.web.filters.JiraPostEncodingFilter_alreadyfiltered=true os_securityfilter_already_filtered=true com.atlassian.prettyurls.filter.PrettyUrlsSiteMeshFilter=true Request Data (0 bytes). ___ Response ____________________________________________________ Response HTTP Headers : X-AUSERNAME=anonymous Referrer-Policy=origin-when-cross-origin Response Data (total 893 bytes) : We had trouble logging you in.

We can't log you in right now

Please contact your administrator. Give them this error identifier:

312f978e-257d-46bc-955d-d2a852c81fe2

Tomislav Tobijas · Answer

@Jean-René ROBIN I don't dig that deep into infrastructure, and I tend to ask the Support team for assistance when troubleshooting. They usually at least point me in the right direction (where to look)

As soon as you get the license, I'd suggest reaching out to them to see if they can help 👀

Jean-René ROBIN_6h8ol8 · Answer

I'm directly connecting to Jira and Keycloak. I should have the DC licence in a few days.

Tomislav Tobijas · Answer

Hey @Jean-René ROBIN ,

Are you integrating Keycloak with Crowd or with Jira directly?

This is a bit out of this community domain (in general), but maybe folks in Dev community could help 👀

I also know Atlassian Support does have a dedicated team for helping troubleshoot these kinds of things, so maybe they could take a look at it. Note that you need to have a valid DC license in order to submit a support ticket.

Cheers,
Tobi