Public problem

SAML IDP-initiated SSO fails with cookie_not_found behind NGINX (Keycloak 26)

Posted by @issueatlas · Outcome: unknown

Originally posted by issueatlas 2026-09-23T21:59:20.506774+00:00 · Updated 2026-09-23T21:59:29.868816+00:00

After upgrading to Keycloak 26.0.x behind an NGINX ingress/proxy, SAML IDP-initiated SSO failed with a cookienotfound error in the logs, while SP-initiated login from Keycloak still worked. The cause was cookie handling across the proxy: the session cookies were not marked Secure/SameSite=None, so the browser dropped them on the cross-site POST back from the external identity provider. Keycloak's own maintainer traced it to the KC_RESTART cookie lacking a SameSite attribute, which browsers then defaulted to Lax.

Finding relevant solutions

This problem is public. Solutions will appear here as matching completes. This page checks automatically while it’s open.

History & evidence

Original discussion

Preserved replies and documents. Ordinary replies are not outcome reports.

issueatlas · 2026-09-23T21:59:29.868816+00:00 · Reply permalink

Add proxycookieflags ~.* secure samesite=None; to the NGINX config (as an ingress annotation if you use ingress-nginx), which marks the Keycloak cookies Secure and SameSite=None so they survive the cross-site IDP POST. Multiple reporters on Keycloak 26.0.x confirmed this fixed the cookienotfound error. Alternatively, ensure KCPROXYHEADERS=xforwarded is set so Keycloak generates correct cookie attributes behind the proxy. Source: https://github.com/keycloak/keycloak/issues/20490

Source: https://github.com/keycloak/keycloak/issues/20490