v17/Quarkus Charset issue with LinkedIn IdP

Describe the bug

I’m running LinkedIn IdP on Keycloak v17/Quarkus on a staging environment, and v16.1.1/WildFly on a production environment, with same configurations.

Everything is working fine on v16.1.1/WildFly, but on v17/Quarkus my first name which contains a é accent is not properly synched.

Version

v17.0.0/v17.0.1

Expected behavior

User data grabbed from LinkedIn response should be properly encoded.

Actual behavior

First name is wrong

How to Reproduce?

• Create a linkedin account with a special character like é in the first name.
• Configure LinkedIn broker in Keycloak Quarkus v17.
• Login with LinkedIn in Keycloak.
• Check the created user in admin UI.
• First name has invalid characters instead of the special one.

Anything else?

No response

[wadahiro]

I also encountered the same problem with Keycloak v18/Quarkus with Azure AD as the external IdP.

The problem is happening when the external IdP does not send the charset in the HTTP response. For example, in Azure AD, the response for the UserInfo endpoint is as follows, with no charset.

< HTTP/1.1 200 OK
< Transfer-Encoding: chunked
< Content-Type: application/json
< Strict-Transport-Security: max-age=31536000
< request-id: 428a75b9-5ace-4c04-81b4-47bb288aeee7
< client-request-id: 428a75b9-5ace-4c04-81b4-47bb288aeee7
< x-ms-ags-diagnostic: {"ServerInfo":{"DataCenter": "Japan East", "Slice": "E", "Ring": "5", "ScaleUnit": "001", "RoleInstance": "TYO1EPF000009AD"}}
< Date: Mon, 02 May 2022 08:18:16 GMT

If Charset is not present, Keycloak’s SimpleHttp class uses the JVM default encoding. This causes garbled characters in some environments. https://github.com/keycloak/keycloak/blob/52ca546cfaa8ffc655a92f54fc35a46eaa23507e/server-spi-private/src/main/java/org/keycloak/broker/provider/util/SimpleHttp.java#L348

As a workaround, we can set the JVM default encoding. Just give -Dfile.encoding=UTF-8 as a system property. When using the official container, the garbled characters were resolved in my case by starting the following command:

docker run -it --rm -p 8080:8080 \
  -e KEYCLOAK_ADMIN=admin \
  -e KEYCLOAK_ADMIN_PASSWORD=admin \
  -e "JAVA_OPTS_APPEND=-Dfile.encoding=UTF-8" \
  quay.io/keycloak/keycloak:18.0.0 start-dev

[PacoVK]

I can confirm this issue occurs on other federations as well like Active Directories.