is 403 behaviour expected?

[BugZappa]

Good afternoon,

I just got this extension setup with my keycloak instance and i think i have it correctly setup however, i was expecting some sort of an error message pop-up explaining to the user that they do not have access to the particular client but in my testing a user with a mis-matched role they're just given a 403 error and after refreshing is asked to repeat the login form.

Am i mistaken in that there is no real error message on a failed login attempt?

This is what i was expecting to happen to occur:

[BugZappa]

Welp i should've read the documentation a bit closer.

I'm trying to define the invalidUserMessage=Invalid username or password. property that i found from here in my flow but every attempt still leads to the 403 error.

Update -
It appears none of my attempts at defining a property have worked in my flow, each attempt just leads to the 403 error, i've tried invalidUserMessage, invalidUserMessage=Invalid username or password., messages_en.properties.invalidUserMessage i even tried the accountUnusable message property with no luck.

I'm using the Keycloak v2 theme so i don't see why these aren't working?

[sventorben]

@BugZappa could you check the logs, please? Is there any error message?

I doubt this behavior has anything to do with the property - I'd rather assume some other configuration issue.

[BugZappa]

Good morning,

Here is the log captured by my keycloak -

user@debian:~/compose$ sudo docker compose up -d keycloak --force-recreate; sudo docker logs keycloak -f
WARN[0000] The "POSTGRES_DB" variable is not set. Defaulting to a blank string. 
[+] Running 2/2
 ✔ Container postgresql-kc  Running                                         0.0s 
 ✔ Container keycloak       Started                                         1.1s 
Changes detected in configuration. Updating the server image.
Updating the configuration and installing your custom providers, if any. Please wait.
2025-07-30 11:06:06,424 WARN  [org.keycloak.services] (build-26) KC-SERVICES0047: restrict-client-auth-authenticator (de.sventorben.keycloak.authorization.client.RestrictClientAuthAuthenticatorFactory) is implementing the internal SPI authenticator. This SPI is internal and may change without notice
2025-07-30 11:06:06,445 WARN  [org.keycloak.services] (build-26) KC-SERVICES0047: policy (de.sventorben.keycloak.authorization.client.access.policy.PolicyBasedAccessProviderFactory) is implementing the internal SPI restrict-client-auth-access-provider. This SPI is internal and may change without notice
2025-07-30 11:06:06,445 WARN  [org.keycloak.services] (build-26) KC-SERVICES0047: client-role (de.sventorben.keycloak.authorization.client.access.role.ClientRoleBasedAccessProviderFactory) is implementing the internal SPI restrict-client-auth-access-provider. This SPI is internal and may change without notice
2025-07-30 11:06:06,463 WARN  [org.keycloak.services] (build-26) KC-SERVICES0047: restrict-client-auth-auto-config (de.sventorben.keycloak.authorization.client.clientpolicy.executor.AutoConfigClientPolicyExecutorFactory) is implementing the internal SPI client-policy-executor. This SPI is internal and may change without notice
2025-07-30 11:06:06,701 WARN  [org.keycloak.services] (build-26) KC-SERVICES0047: restrict-client-auth-enabled (de.sventorben.keycloak.authorization.client.clientpolicy.condition.RestrictedClientAuthEnabledPolicyConditionProviderFactory) is implementing the internal SPI client-policy-condition. This SPI is internal and may change without notice
2025-07-30 11:06:10,014 INFO  [io.quarkus.deployment.QuarkusAugmentor] (main) Quarkus augmentation completed in 4816ms
Server configuration updated and persisted. Run the following command to review the configuration:

        kc.sh show-config

Next time you run the server, just run:

        kc.sh start --optimized

2025-07-30 11:06:13,009 INFO  [org.keycloak.spi.infinispan.impl.embedded.JGroupsConfigurator] (main) JGroups JDBC_PING discovery enabled.
2025-07-30 11:06:13,018 INFO  [org.keycloak.spi.infinispan.impl.embedded.JGroupsConfigurator] (main) JGroups Encryption enabled (mTLS).
2025-07-30 11:06:13,152 INFO  [org.keycloak.jgroups.certificates.CertificateReloadManager] (main) Starting JGroups certificate reload manager
2025-07-30 11:06:13,205 INFO  [org.infinispan.CONTAINER] (main) ISPN000556: Starting user marshaller 'org.infinispan.commons.marshall.ImmutableProtoStreamMarshaller'
2025-07-30 11:06:13,335 INFO  [org.infinispan.CLUSTER] (main) ISPN000078: Starting JGroups channel `ISPN` with stack `jdbc-ping`
2025-07-30 11:06:13,336 INFO  [org.jgroups.JChannel] (main) local_addr: b50eeced-1a8e-4993-b139-76d6803cb511, name: keycloak-8092
2025-07-30 11:06:13,345 INFO  [org.jgroups.protocols.FD_SOCK2] (main) server listening on *:57800
2025-07-30 11:06:13,351 INFO  [org.jgroups.protocols.pbcast.GMS] (main) keycloak-8092: no members discovered after 4 ms: creating cluster as coordinator
2025-07-30 11:06:13,368 INFO  [org.infinispan.CLUSTER] (main) ISPN000094: Received new cluster view for channel ISPN: [keycloak-8092|0] (1) [keycloak-8092]
2025-07-30 11:06:13,370 INFO  [org.keycloak.jgroups.certificates.CertificateReloadManager] (main) Reloading JGroups Certificate
2025-07-30 11:06:13,400 INFO  [org.infinispan.CLUSTER] (main) ISPN000079: Channel `ISPN` local address is `keycloak-8092`, physical addresses are `[172.18.0.30:7800]`
2025-07-30 11:06:13,645 INFO  [org.keycloak.connections.infinispan.DefaultInfinispanConnectionProviderFactory] (main) Node name: keycloak-8092, Site name: null
2025-07-30 11:06:14,308 INFO  [io.quarkus] (main) Keycloak 26.3.2 on JVM (powered by Quarkus 3.20.2) started in 4.179s. Listening on: http://0.0.0.0:8080 and https://0.0.0.0:8443
2025-07-30 11:06:14,308 INFO  [io.quarkus] (main) Profile prod activated. 
2025-07-30 11:06:14,309 INFO  [io.quarkus] (main) Installed features: [agroal, cdi, hibernate-orm, jdbc-postgresql, keycloak, narayana-jta, opentelemetry, reactive-routes, rest, rest-jackson, smallrye-context-propagation, vertx]
2025-07-30 11:06:18,548 WARN  [org.keycloak.events] (executor-thread-1) type="LOGIN_ERROR", realmId="2c278fed-734d-4579-b8ca-a2cffe9bd87c", realmName="restricted-realm", clientId="Homepage", userId="null", ipAddress="192.168.1.14", error="cookie_not_found"
2025-07-30 11:06:20,137 WARN  [org.keycloak.events] (executor-thread-1) type="LOGIN_ERROR", realmId="2c278fed-734d-4579-b8ca-a2cffe9bd87c", realmName="restricted-realm", clientId="Homepage", userId="null", ipAddress="192.168.1.14", error="cookie_not_found"
2025-07-30 11:06:21,287 WARN  [org.keycloak.events] (executor-thread-1) type="LOGIN_ERROR", realmId="2c278fed-734d-4579-b8ca-a2cffe9bd87c", realmName="restricted-realm", clientId="Homepage", userId="null", ipAddress="192.168.1.14", error="cookie_not_found"
2025-07-30 11:06:21,448 WARN  [org.keycloak.events] (executor-thread-1) type="LOGIN_ERROR", realmId="2c278fed-734d-4579-b8ca-a2cffe9bd87c", realmName="restricted-realm", clientId="Homepage", userId="null", ipAddress="192.168.1.14", error="cookie_not_found"
2025-07-30 11:06:22,976 WARN  [org.keycloak.cookie.DefaultCookieProvider] (executor-thread-1) Non-secure context detected; cookies are not secured, and will not be available in cross-origin POST requests. Please review whether this direct HTTP usage is expected.
2025-07-30 11:06:34,753 WARN  [de.sventorben.keycloak.authorization.client.access.role.ClientRoleBasedAccessProvider] (executor-thread-1) Access for user 'guest' to client 'Homepage' in realm 'restricted-realm' is denied. User does not have client role 'restricted-access' on client with id 'e8894492-1c92-4744-a6d8-a48c7b083b48'.
2025-07-30 11:06:34,766 WARN  [org.keycloak.events] (executor-thread-1) type="LOGIN_ERROR", realmId="2c278fed-734d-4579-b8ca-a2cffe9bd87c", realmName="restricted-realm", clientId="Homepage", userId="c1342e76-4ecb-4b34-9f0d-fedf83e5a471", ipAddress="192.168.1.14", error="access_denied", auth_method="openid-connect", auth_type="code", redirect_uri="https://admin.my.domain/oidc/callback", code_id="9ecff226-b26e-449c-b331-e1006c5a086f", username="Guest"