title: Keycloak Authenticator SPI example not working
body: <p>I followed the <a href="https://www.keycloak.org/docs/latest/server_development/index.html#_auth_spi_walkthrough" rel="nofollow noreferrer">walkthrough</a> for setting up a custom authenticator spi for keycloak (version 4.8.3). I pretty much only use the example code i got from <a href="https://github.com/keycloak/keycloak/tree/master/examples/providers/authenticator" rel="nofollow noreferrer">here</a>. I only changed the <code>pom</code> so i could compile the project and deploy it with <code>mvn clean install wildfly:deploy</code>. And it works ... I can configure the new authentication flow in keycloak, update the Browser Flow and  set the required actions. But if i want to use the new Authentication with my application i get the following message: <code>Invalid username or password</code>. And in the console i get the following output:</p>
  <pre><code>17:12:20,721 WARN  [org.keycloak.events] (default task-1) type=REFRESH_TOKEN_ERROR, realmId=master, clientId=security-admin-console, userId=null, ipAddress=127.0.0.1, error=invalid_token, grant_type=refresh_token, client_auth_method=client-secret
  17:13:50,514 WARN  [org.keycloak.services] (default task-4) KC-SERVICES0013: Failed authentication: org.keycloak.authentication.AuthenticationFlowException: authenticator: secret-question-authenticator
          at org.keycloak.authentication.DefaultAuthenticationFlow.processFlow(DefaultAuthenticationFlow.java:194)
          at org.keycloak.authentication.AuthenticationProcessor.authenticateOnly(AuthenticationProcessor.java:910)
          at org.keycloak.authentication.AuthenticationProcessor.authenticate(AuthenticationProcessor.java:779)
          at org.keycloak.protocol.AuthorizationEndpointBase.handleBrowserAuthenticationRequest(AuthorizationEndpointBase.java:139)
          at org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint.buildAuthorizationCodeAuthorizationResponse(AuthorizationEndpoint.java:419)
          at org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint.process(AuthorizationEndpoint.java:152)
          at org.keycloak.protocol.oidc.endpoints.AuthorizationEndpoint.buildGet(AuthorizationEndpoint.java:108)
          at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
          at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
          at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
          at java.lang.reflect.Method.invoke(Method.java:498)
          at org.jboss.resteasy.core.MethodInjectorImpl.invoke(MethodInjectorImpl.java:140)
          at org.jboss.resteasy.core.ResourceMethodInvoker.internalInvokeOnTarget(ResourceMethodInvoker.java:509)
          at org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTargetAfterFilter(ResourceMethodInvoker.java:399)
          at org.jboss.resteasy.core.ResourceMethodInvoker.lambda$invokeOnTarget$0(ResourceMethodInvoker.java:363)
          at org.jboss.resteasy.core.interception.PreMatchContainerRequestContext.filter(PreMatchContainerRequestContext.java:358)
          at org.jboss.resteasy.core.ResourceMethodInvoker.invokeOnTarget(ResourceMethodInvoker.java:365)
          at org.jboss.resteasy.core.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:337)
          at org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(ResourceLocatorInvoker.java:137)
          at org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:106)
          at org.jboss.resteasy.core.ResourceLocatorInvoker.invokeOnTargetObject(ResourceLocatorInvoker.java:132)
          at org.jboss.resteasy.core.ResourceLocatorInvoker.invoke(ResourceLocatorInvoker.java:100)
          at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:443)
          at org.jboss.resteasy.core.SynchronousDispatcher.lambda$invoke$4(SynchronousDispatcher.java:233)
          at org.jboss.resteasy.core.SynchronousDispatcher.lambda$preprocess$0(SynchronousDispatcher.java:139)
          at org.jboss.resteasy.core.interception.PreMatchContainerRequestContext.filter(PreMatchContainerRequestContext.java:358)
          at org.jboss.resteasy.core.SynchronousDispatcher.preprocess(SynchronousDispatcher.java:142)
          at org.jboss.resteasy.core.SynchronousDispatcher.invoke(SynchronousDispatcher.java:219)
          at org.jboss.resteasy.plugins.server.servlet.ServletContainerDispatcher.service(ServletContainerDispatcher.java:227)
          at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:56)
          at org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher.service(HttpServletDispatcher.java:51)
          at javax.servlet.http.HttpServlet.service(HttpServlet.java:791)
          at io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:74)
          at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129)
          at org.keycloak.services.filters.KeycloakSessionServletFilter.doFilter(KeycloakSessionServletFilter.java:90)
          at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61)
          at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
          at io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84)
          at io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62)
          at io.undertow.servlet.handlers.ServletChain$1.handleRequest(ServletChain.java:68)
          at io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
          at org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78)
          at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
          at io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:132)
          at io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57)
          at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
          at io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)
          at io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)
          at io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)
          at io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77)
          at io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50)
          at io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)
          at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
          at org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)
          at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
          at org.wildfly.extension.undertow.deployment.GlobalRequestControllerHandler.handleRequest(GlobalRequestControllerHandler.java:68)
          at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
          at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:292)
          at io.undertow.servlet.handlers.ServletInitialHandler.access$100(ServletInitialHandler.java:81)
          at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:138)
          at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:135)
          at io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:48)
          at io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43)
          at org.wildfly.extension.undertow.security.SecurityContextThreadSetupAction.lambda$create$0(SecurityContextThreadSetupAction.java:105)
          at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)
          at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)
          at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)
          at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1502)
          at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:272)
          at io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81)
          at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:104)
          at io.undertow.server.Connectors.executeRootHandler(Connectors.java:360)
          at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:830)
          at org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35)
          at org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1985)
          at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1487)
          at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1378)
          at java.lang.Thread.run(Thread.java:748)
  
  17:13:50,523 WARN  [org.keycloak.events] (default task-4) type=LOGIN_ERROR, realmId=Test, clientId=test, userId=null, ipAddress=192.168.1.123, error=invalid_user_credentials, auth_method=openid-connect, auth_type=code, response_type=code, redirect_uri=http://localhost:8080/sso/login, code_id=102f9drs-15d2-4e68-b123-38c092640da7, response_mode=query
  </code></pre>
  <p>I looked up the file DefaultAuthenticationFlow.java:194 on <a href="https://github.com/keycloak/keycloak/blob/d593ac3e6fa28f98c3ea99ada29564791d467731/services/src/main/java/org/keycloak/authentication/DefaultAuthenticationFlow.java#L194" rel="nofollow noreferrer">github</a> and it seems to be a RuntimeException:</p>
  <pre><code>throw new RuntimeException(&quot;Unable to find factory for AuthenticatorFactory: &quot; + model.getAuthenticator() + &quot; did you forget to declare it in a META-INF/services file?&quot;);
  </code></pre>
  <p>I dont really know what to do about that. I have the META-INF/services from the example project included.</p>
  <p><a href="https://i.stack.imgur.com/gS4FF.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/gS4FF.png" alt="enter image description here" /></a></p>
  <p>any idea what the problem might be here?</p>
  <h1>Update:</h1>
  <p>Here my auth. flow settings:</p>
  <p><a href="https://i.stack.imgur.com/QMAr1.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/QMAr1.png" alt="enter image description here" /></a></p>
  <p>Bindings » Browser Flow: is set to test</p>
  <h1>Update:</h1>
  <p>I used something like this for my own authenticator.</p>
  <pre><code>public class TestAuthenticator extends UsernamePasswordForm {
  
      @Override
      public void action(AuthenticationFlowContext context) {
          MultivaluedMap&lt;String, String&gt; formData = context.getHttpRequest().getDecodedFormParameters();
          if (formData.containsKey(&quot;cancel&quot;)) {
              context.cancelLogin();
              return;
          }
          if (!validateTestForm(context, formData))
              return;
  
          context.success();
      }
  
      private boolean validateTestForm(AuthenticationFlowContext context, MultivaluedMap&lt;String, String&gt; formData) {
          String username = formData.getFirst(AuthenticationManager.FORM_USERNAME);
          String password = formData.getFirst(CredentialRepresentation.PASSWORD);
  
          // remove leading and trailing whitespace
          username = username.trim();
  
          context.getEvent().detail(Details.USERNAME, username);
          context.getAuthenticationSession().setAuthNote(AbstractUsernameFormAuthenticator.ATTEMPTED_USERNAME, username);
  
          if (username == null) {
              context.getEvent().error(Errors.USERNAME_MISSING);
              Response challengeResponse = challenge(context, Messages.INVALID_USER);
              context.failureChallenge(AuthenticationFlowError.INVALID_USER, challengeResponse);
              return false;
          }
          UserModel user;
          try {
              // Check if this user exists
              user = KeycloakModelUtils.findUserByNameOrEmail(context.getSession(), context.getRealm(), username);
              if (user != null) {
                  // do your own thing here ...
                  validateUserAndPassword(context, formData);
              } 
          } catch (ModelDuplicateException mde) {
              ServicesLogger.LOGGER.modelDuplicateException(mde);
  
              // Could happen during federation import
              if (mde.getDuplicateFieldName() != null &amp;&amp; mde.getDuplicateFieldName().equals(UserModel.EMAIL)) {
                  setDuplicateUserChallenge(context, Errors.EMAIL_IN_USE, Messages.EMAIL_EXISTS,
                          AuthenticationFlowError.INVALID_USER);
              } else {
                  setDuplicateUserChallenge(context, Errors.USERNAME_IN_USE, Messages.USERNAME_EXISTS,
                          AuthenticationFlowError.INVALID_USER);
              }
  
              return false;
          }
          if (user == null) {
              testInvalidUser(context, user);
              return false;
          }
  
          if (!enabledUser(context, user))
              return false;
  
          context.setUser(user);
          return true;
      }
  
  }
  
  public class TestAuthenticatorFactory implements AuthenticatorFactory, ConfigurableAuthenticatorFactory {
  
      public static final String PROVIDER_ID = &quot;test-authenticator&quot;;
      private static final TestAuthenticator SINGLETON = new TestAuthenticator();
  
      @Override
      public String getId() {
          return PROVIDER_ID;
      }
  
      @Override
      public Authenticator create(KeycloakSession session) {
          return SINGLETON;
      }
  
  
      private static AuthenticationExecutionModel.Requirement[] REQUIREMENT_CHOICES = {
              AuthenticationExecutionModel.Requirement.REQUIRED, AuthenticationExecutionModel.Requirement.DISABLED };
  
      @Override
      public AuthenticationExecutionModel.Requirement[] getRequirementChoices() {
          return REQUIREMENT_CHOICES;
      }
  
      @Override
      public boolean isUserSetupAllowed() {
          return true;
      }
  
      @Override
      public boolean isConfigurable() {
          return true;
      }
  
      @Override
      public List&lt;ProviderConfigProperty&gt; getConfigProperties() {
          return Collections.emptyList();
      }
  
      @Override
      public String getHelpText() {
          return &quot;Help&quot;;
      }
  
      @Override
      public String getDisplayType() {
          return &quot;Test Authenticator&quot;;
      }
  
      @Override
      public String getReferenceCategory() {
          return PasswordCredentialModel.TYPE;
      }
  
      @Override
      public void init(Config.Scope config) {
      }
  
      @Override
      public void postInit(KeycloakSessionFactory factory) {
      }
  
      @Override
      public void close() {
      }
  
  }
  </code></pre>