prompt=create Parameter Propagates to Identity Provider Causing 400 Error
#45,959 opened on 2026/02/03
Repository metrics
- Stars
- (34,398 個のスター)
- PR merge metrics
- (平均マージ 6d 19h) (30d で 384 merged PRs)
説明
Before reporting an issue
- I have read and understood the above terms for submitting issues, and I understand that my issue may be closed without action if I do not follow them.
Area
identity-brokering
Describe the bug
When using a modified registration template to display Identity Provider login options (tested with Google) and accessing the registration page with prompt=create, the prompt parameter is incorrectly propagated to the Identity Provider's authentication URL. This causes a conflict with the IdP's own prompt parameter handling, resulting in a 400 Bad Request error.
Version
26.5.2
Regression
- The issue is a regression
Expected behavior
The Identity Provider authentication URL should not include the prompt=create parameter, or Keycloak should properly handle/translate the prompt parameter according to the IdP's specifications.
https://accounts.google.com/o/oauth2/v2/auth?client_id=...&redirect_uri=...&response_type=code&scope=...
Actual behavior
The prompt=create parameter is passed through to the Identity Provider URL, causing a 400 error.
https://accounts.google.com/o/oauth2/v2/auth?prompt=create&client_id=...&redirect_uri=...&response_type=code&scope=...
Error: Google returns 400 Bad Request because prompt=create is not a valid value for Google's OIDC implementation.
How to Reproduce?
- Configure an Identity Provider (Google) in Keycloak realm
- Modify the registration template to display Identity Provider login options
- Access the registration page with the prompt=create parameter:
https://keycloak-url.com/realms/test/protocol/openid-connect/auth?prompt=create&... - Click on the Google Identity Provider login button from the registration page
- Observe the redirected URL to Google
Anything else?
Currently, the only workaround is to avoid using the prompt=create parameter when displaying Identity Provider options, which limits the ability to direct users specifically to the registration flow.
This issue specifically manifests when customizing the registration template to show IdP options, which is a common use case for improving user experience by allowing social login during registration.