# Unexpected error when handling authentication request to identity provider after upgrade 21.0.1

**URL:** <https://forum.keycloak.org/t/unexpected-error-when-handling-authentication-request-to-identity-provider-after-upgrade-21-0-1/20997>\
**Category:** Securing applications\
**Tags:** authentication\
**Created:** [March 22, 2023, 12:03pm UTC](https://forum.keycloak.org/t/unexpected-error-when-handling-authentication-request-to-identity-provider-after-upgrade-21-0-1/20997 "2023-03-22T12:03:55Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Warlusfag](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/warlusfag/32/7987_2.png) [@Warlusfag](https://forum.keycloak.org/u/Warlusfag)\
**Post date:** [March 22, 2023, 12:03pm UTC](https://forum.keycloak.org/t/unexpected-error-when-handling-authentication-request-to-identity-provider-after-upgrade-21-0-1/20997/1 "2023-03-22T12:03:55Z")

</div>

Hi Community,

I need some help to secure my application because after upgrading my keycloak instance to version 21.0.1 (the last one) from the 16.1, I’m facing the error below trying to authentication client on this endpoint:

```auto
realms/"myrealm"/protocol/openid-connect/auth

```

It should ask for username/password with a login mask UI, instead I receive an exception:

> Unexpected error when handling authentication request to identity provider.

Looking at the logs this is the first part of the Exception stack:

```auto
2023-03-21 10:23:17,275 WARN [org.keycloak.services] (executor-thread-50) KC-SERVICES0013: Failed authentication: java.lang.NullPointerException
        at org.jboss.resteasy.plugins.server.BaseHttpRequest.getFormParameters(BaseHttpRequest.java:53)
        at org.jboss.resteasy.plugins.server.BaseHttpRequest.getDecodedFormParameters(BaseHttpRequest.java:74)
        at org.keycloak.services.HttpRequestImpl.getDecodedFormParameters(HttpRequestImpl.java:62)
        at org.keycloak.authentication.authenticators.directgrant.ValidateUsername.retrieveUsername(ValidateUsername.java:161)
        at org.keycloak.authentication.authenticators.directgrant.ValidateUsername.authenticate(ValidateUsername.java:52)
        at org.keycloak.authentication.DefaultAuthenticationFlow.processSingleFlowExecutionModel(DefaultAuthenticationFlow.java:445)
        at org.keycloak.authentication.DefaultAuthenticationFlow.processFlow(DefaultAuthenticationFlow.java:249)
        at org.keycloak.authentication.AuthenticationProcessor.authenticateOnly(AuthenticationProcessor.java:1025)
        at org.keycloak.authentication.AuthenticationProcessor.authenticate(AuthenticationProcessor.java:887)
        at org.keycloak.protocol.AuthorizationEndpointBase.handleBrowserAuthenticationRequest(AuthorizationEndpointBase.java:153)
        at org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint.buildAuthorizationCodeAuthorizationResponse(AuthorizationEndpoint.java:363)

```

With the following error:

```auto
2023-03-21 10:23:17,361 WARN [org.keycloak.events] (executor-thread-50) type=LOGIN_ERROR, realmId= *******, clientId=***** ,
userId=null, ipAddress= ******* , error=invalid_user_credentials, auth_method=openid-connect, auth_type=code, response_typ
e=code, redirect_uri= ************ , code_id=64b4911b-e9bf-4574-a6c6-bdd62951f23a, respons
e_mode=query, authSessionParentId=64b4911b-e9bf-4574-a6c6-bdd62951f23a, authSessionTabId=XguMC_VfO70

```

For sure, it is some my lack of knowledge but I cannot understand while it is expecting username/password since I’m going on such endpoint to insert them. Therefore it raises an exception since it found “null” the fields username/password.

Furthermore, before it was not necessary to add in the URI query the parameters response\_type, scope, redirect\_uri, client\_id, instead now they are compulsory. I understand that in the new Keycloak version, they are more strict regarding OAuth RFC (i.e. scope parameter) but I don’t understand the other query parameters requested.

The openid-client client had been imported from the previous version as well as realm configuration, when it is used to work. Nevertheless, I tried different configuration and query parameters without success.

How do I solve this problem?

---

<div class="post-metadata">

**Author:** ![Aghalaryan](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/aghalaryan/32/7708_2.png) [@Aghalaryan](https://forum.keycloak.org/u/Aghalaryan)\
**Post date:** [April 17, 2023, 8:03am UTC](https://forum.keycloak.org/t/unexpected-error-when-handling-authentication-request-to-identity-provider-after-upgrade-21-0-1/20997/2 "2023-04-17T08:03:31Z")

</div>

Hi, I’m facing exact same problem.  
Did you succeed with it?

---

<div class="post-metadata">

**Author:** ![Warlusfag](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/warlusfag/32/7987_2.png) [@Warlusfag](https://forum.keycloak.org/u/Warlusfag)\
**Post date:** [April 17, 2023, 11:24am UTC](https://forum.keycloak.org/t/unexpected-error-when-handling-authentication-request-to-identity-provider-after-upgrade-21-0-1/20997/3 "2023-04-17T11:24:09Z")

</div>

Dear Aghalaryan,

I was overwriting the authentication flow in the client’s advanced setting with a not correct one.  
I solved finding this setting and set up the default flow indicated for my case.