Caution #
If you are using Keycloak as an Identity Provider (IdP) for HCL Domino and have Web Federated Login enabled, exercise caution before upgrading to Keycloak v26.6.0 or newer. Starting with v26.6.0, Keycloak possibly changed how it validates the RFC8707 resource parameter, which effectively breaks Domino Web Authentication over OIDC. Downgrading to Keycloak v26.5.7 resolves the issue while the root cause is investigated.
Long Story #
Recently, I decided to refresh my knowledge of Domino Authentication over OIDC. To do this, I started building and updating the necessary components in my test environment.
Environment #
I updated my current Keycloak deployment on my Kubernetes platform to v26.7, which I intended to use as an Identity Provider (IdP).
For the Service Provider (SP) hosting the HCL Verse client, I chose one of my Domino v14.5.1 FP1 test servers. For future reference, the Domino server is running in the “LAB” organization (O=LAB), and the ID-Vault used in this environment is named LAB_Vault.
Configuration #
Configuring basic web authentication over OIDC with Keycloak as the IdP went smoothly and without any issues. Thanks to the excellent documentation, I had it running in no time. After a few successful tests, I proceeded to configure Domino Web Federated Login. I am not a fan of users getting those pesky ID password prompts every time they try to send or read an encrypted email.
This is where I hit an issue. After configuring Domino Web Federated Login and making the necessary configuration changes on the Keycloak side, navigating to HCL Verse on Domino immediately presented users with the following screen:
As a result, the entire OIDC authentication process was effectively broken. :-/
Troubleshooting #
Looking at the Keycloak logs, I was able to get the exact information on why the authentication was failing:
2026-08-06 09:54:22,742 ERROR [org.keycloak.services] (executor-thread-76) KC-SERVICES0093: Invalid parameter value for: scope
2026-08-06 09:54:22,743 WARN [org.keycloak.events] (executor-thread-76) type="LOGIN_ERROR", realmId="b11f377f-af39-4619-a3ff-204d793e472f", realmName="WYDucks", clientId="domino_oidc_http", userId="null", ipAddress="10.0.2.36", error="invalid_request", reason="Invalid resource: LAB-O=LAB_Vault", response_type="code", redirect_uri="https://domino.wyducks.com/auth/protocol/oidc", response_mode="query"
Apparently, Keycloak does not accept the resource LAB-O=LAB_Vault, even though I had created the Domino.vault.LAB-O=LAB_Vault client scope with the LAB-O=LAB_Vault audience, and mapped it to the domino_oidc_http client I was using for Domino on Keycloak.
Solution #
After some research, I discovered that starting with Keycloak 26.6.0, Keycloak may have changed the way it validates the RFC8707 resource parameter.
To test this theory, I downgraded my Keycloak server to 26.5.7 (which is quick and easy to do when running Keycloak on Kubernetes), and voilà! Not only was the Domino Basic Web Authentication working again, but Web Federated Authentication also worked like a charm!
The exact culprit of this issue is still being verified, and we are currently working on this topic internally.
I just want to let you know to exercise caution before upgrading Keycloak if you have it functioning as an IdP for Domino and you have Web Federated Login enabled.