Android "invalid redirect_uri" error with KeyCloak

Since a few days, on android users can not log in anymore with OpenID running because on android they get "invalid redirect_uri" error. The URL called is:

https://traccar.domain.tld/realms/traccar/protocol/openid-connect/auth?response_type=code&redirect_uri=org.traccar.manager%3A%2Fapi%2Fsession%2Fopenid%2Fcallback&state=abc&client_id=traccar&scope=openid+profile+email

Running KeyCloak 26.2.5 with "Valid redirect URIs" set to https://traccar.domain.tld/* and having this traccar config.

<entry key='openid.clientId'>traccar</entry>
<entry key='openid.clientSecret'>xxx</entry>
<entry key='openid.userInfoUrl'>https://iam.domain.tld/realms/realm/protocol/openid-connect/userinfo</entry>
<entry key='openid.authUrl'>https://iam.domain.tld/realms/realm/protocol/openid-connect/auth</entry>
<entry key='openid.tokenUrl'>https://iam.domain.tld/realms/realm/protocol/openid-connect/token</entry>
<entry key='web.url'>https://traccar.domain.tld</entry>
<entry key='openid.force'>true</entry>

After adding https://org.traccar.manger/* to the allowed redirect URIs in KeyCloak, the app keeps loading infinitely.

Anton Tananaev2 days ago

I think the allowed redirect URL should be org.traccar.manager:/....

Thanks for the hint, but even with the correct URL it do es not work https://org.traccar.manager/*

Anton Tananaev2 days ago

It's still not correct. There should be no https.

Got it working with "org.traccar.manager:/api/session/openid/callback". Seems like, the wildcards are not working as assumed. What puzzels me, is why it stopped working (did not have this setting previously). So in total it looks like this for KeyCloak:

Valid redirect URIs:

org.traccar.manager:/api/session/openid/callback
https://traccar.domain.tld/*

The last entry should also work with https://traccar.domain.tld/api/session/openid/callback

Thanks for your patients.