Troubleshooting Keycloak Authentication Issues in Phoenix 26.0.7

Amith · 2025-10-20T13:54:57.817Z

Hi, I am running into issues with keycloak authentication. I get below error after redirect from idp. Any ideas on what could be wrong? Phoenix version : 26.0.7 Keycloak version : version-12.6.0-nonroot INFO: 10.244.6.232:41950 - "GET /login?returnUrl=%2Fprojects HTTP/1.1" 200 OK INFO: 10.244.6.232:41950 - "POST /oauth2/keycloak/login?returnUrl=/projects HTTP/1.1" 302 Found Sign in not allowed for IDP keycloak: Sign in is not allowed. INFO: 10.244.6.232:41950 - "GET /oauth2/keycloak/tokens?state=eyJhbGciOiJIUzI1NiI**********Qxz4ffqNNwE8qaXcjhUXFG8NNCV79UZilg&session_state=95e00f87-a5c7-4bfd-869a-9560617e5683&iss=https%3A%2F%2Fkeycloak********.com%2Frealms%2Fsso&code=e75aa04d-f598-4cb5-a43c-63fe960470.9540cbdd-8996-4297-bafd-9ee08509a263 HTTP/1.1" 307 Temporary Redirect INFO: 10.244.6.232:41950 - "GET /login?error=sign_in_not_allowed HTTP/1.1" 200 OK

Troubleshooting Keycloak Authentication Issues in Phoenix 26.0.7 | Arize AI Community

9 comments

· Sorted by Oldest

RunLLM
APP
·
·
The error "Sign in not allowed for IDP keycloak: Sign in is not allowed" typically means that Phoenix is rejecting the login attempt from Keycloak due to group or user restrictions. This can happen if you have configured environment variables like PHOENIX_OAUTH2_KEYCLOAK_ALLOWED_GROUPS and the user does not belong to any of the allowed groups, or if sign-up is disabled and the user does not already exist in Phoenix. Check your Phoenix environment variables for group-based access control or sign-up restrictions and ensure your user meets those requirements. For more details, see the group-based access control and sign-up restriction documentation in phoenix/config.py and the authentication docs. Would you like a step-by-step guide to debug or adjust these settings?Sources: - phoenix/config.py
💡 Hint: Mention RunLLM in the thread for followups.
Amith
·
·
Roger Y.
·
·
is there an existing user in the database with the same email?
Roger Y.
·
·
if a local user exists (with password), sign in is not currently supported via OIDC
Roger Y.
·
·
the other possibility is that the existing user is OIDC but already has a different OIDC user_id in the database
Roger Y.
·
·
you can start phoenix with PHOENIX_DISABLE_BASIC_AUTH=true then all the users you add will be OIDC only
Amith
·
·
RunLLM Roger Y. I had the sign up option disabled, it appears to be working now, thank you. Does Pheonix support roles inherited from Keycloak?
RunLLM
APP
·
·
Phoenix does not currently support automatic role mapping or inheritance from Keycloak OIDC claims; all new OIDC users are assigned the default role (typically member), and roles must be changed manually by a Phoenix admin after first login. There is an open feature request for mapping roles from OIDC claims, but it is not implemented as of now.See GitHub issue #9481 and authentication docs for details. Would you like more information on manual role management or updates on this feature?Sources: - GitHub issue #9481
💡 Hint: Mention RunLLM in the thread for followups.
Roger Y.
·
·
we have an outstanding issue for role mapping. you can upvote it and we’ll get it prioritized
👍1

RunLLM
APP
·
·
The error "Sign in not allowed for IDP keycloak: Sign in is not allowed" typically means that Phoenix is rejecting the login attempt from Keycloak due to group or user restrictions. This can happen if you have configured environment variables like PHOENIX_OAUTH2_KEYCLOAK_ALLOWED_GROUPS and the user does not belong to any of the allowed groups, or if sign-up is disabled and the user does not already exist in Phoenix. Check your Phoenix environment variables for group-based access control or sign-up restrictions and ensure your user meets those requirements. For more details, see the group-based access control and sign-up restriction documentation in phoenix/config.py and the authentication docs. Would you like a step-by-step guide to debug or adjust these settings?Sources: - phoenix/config.py
💡 Hint: Mention RunLLM in the thread for followups.
Amith
·
·
Roger Y.
·
·
is there an existing user in the database with the same email?
Roger Y.
·
·
if a local user exists (with password), sign in is not currently supported via OIDC
Roger Y.
·
·
the other possibility is that the existing user is OIDC but already has a different OIDC user_id in the database
Roger Y.
·
·
you can start phoenix with PHOENIX_DISABLE_BASIC_AUTH=true then all the users you add will be OIDC only
Amith
·
·
RunLLM Roger Y. I had the sign up option disabled, it appears to be working now, thank you. Does Pheonix support roles inherited from Keycloak?
RunLLM
APP
·
·
Phoenix does not currently support automatic role mapping or inheritance from Keycloak OIDC claims; all new OIDC users are assigned the default role (typically member), and roles must be changed manually by a Phoenix admin after first login. There is an open feature request for mapping roles from OIDC claims, but it is not implemented as of now.See GitHub issue #9481 and authentication docs for details. Would you like more information on manual role management or updates on this feature?Sources: - GitHub issue #9481
💡 Hint: Mention RunLLM in the thread for followups.
Roger Y.
·
·
we have an outstanding issue for role mapping. you can upvote it and we’ll get it prioritized
👍1