OIDC Login Error: "Your credentials aren't allowed" with Keycloak 12.0.4. Loop during OIDC integration between AXY and Keyclaock

Get Help
1

I am experiencing a redirect loop during OIDC integration between AWX and Keycloak v12.0.4. The user is redirected to Keycloak, authenticates successfully, but upon returning to AWX, the session is not established, and the system redirects to /sso/error/.

AWX Logs (awx-web): At the moment of the callback from Keycloak, the AWX log records the following error:

2026-02-12 13:20:57,850 ERROR [b9206eb3291b4eebb4725e747e810dcc] social Your credentials aren't allowed.

Immediately after, the redirect to the error page occurs:

  • GET /sso/complete/oidc/ ... (HTTP/1.1 302)
  • GET /sso/error/ => (HTTP/1.1 301)

Current Keycloak Client Configuration (awx-oidc):

  • Client ID: awx-oidc
  • Protocol: openid-connect
  • Access Type: confidential (client-secret)
  • Key Mappers Configured:
    • groups: Maps Group Membership to claim groups .
    • username: Maps user property username to claim sub .
    • user_permanet_id: Maps user attribute uid to claim uid .
    • roles: Maps client roles for awx-oidc to claim roles .
    • email/first_name/last_name: Standard property mappers.