Explorer

Question

Fortiauthenticator oauth/openid token endpoint error if content-type include charset

Forum|Forum|11 months ago
August 22, 2025
10 replies
1352 views

Hello,

I'm trying to use Fortiauthenticator as IDP for Keycloak, but when keycloak send token request (/api/v1/oauth/token/) with Content-Type including charset=UTF-8 it doesn't work. I use Curl to test the request removing the charset and it worked.

HTTP headers:

"Content-Type: application/x-www-form-urlencoded; charset=UTF-8" --> not working
"Content-Type: application/x-www-form-urlencoded" --> works

Is there any method/config to allow Fortiauthenticator accept charset at Content-Type header ?

br,

FortiAuthenticator

Anthony_E

Staff

Hello,

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Thanks,

Best Regards

Anthony_E

Staff

Hello,

We are still looking for someone to help you.

We will come back to you ASAP.

Thanks,

Best Regards

Jean-Philippe_P

Staff & Editor

Hello commarmi,

I found this solution. Can you tell me if it helps, please?

When dealing with issues related to Content-Type headers and how they are processed by different systems, it's important to understand how each component handles these headers. In your case, it seems that FortiAuthenticator is not able to process the charset=UTF-8 parameter in the Content-Type header for the token request from Keycloak.

Here are a few approaches you can take to address this issue:

Modify Keycloak Configuration: If possible, check if there is a way to configure Keycloak to send requests without the charset parameter in the Content-Type header. This could involve customizing the client settings or the token request process.
Use Middleware: If you have control over the network or can implement middleware, you could potentially create a service that modifies the outgoing requests from Keycloak to remove the charset parameter before they reach FortiAuthenticator.
Logging and Debugging: Enable detailed logging on both Keycloak and FortiAuthenticator to capture the requests and responses. This may provide more insight into why the request fails with the charset included.
Check FortiAuthenticator Documentation: Look into the FortiAuthenticator documentation or support resources to see if there are any specific configurations or known issues related to handling Content-Type headers with charset specifications.
Contact Fortinet Support: If the documentation does not provide a solution, consider reaching out to Fortinet support. They may have insights or updates on whether this is a known limitation or if there are any workarounds.

Jean-Philippe - Fortinet Community Team

commarmiAuthor

Explorer

Thanks for you reply Jean-Philippe, here my coments on your approaches:

1. Isn’t possible to change this by configuration, is possible to change the source code but Keycloak developers say there are lots of idp that accept charset and they are scare to change keycloak behavior to not broke their integrations.

2. Isn’t possible, it is a SSL/TLS connection.

3. I did, this is how I found the problem

4. I didn't find anything, that's why I'm asking on the forum.

5. I will do.

Again, many thanks for your reply.

Jean-Philippe_P

Staff & Editor

Hello again commarmi,

Please, note that I found this solution from a GPT engine. I hope this further pieces of advice will help you:

Given the constraints you've mentioned, it sounds like you're facing a challenging situation with the integration between Keycloak and FortiAuthenticator. Since modifying the source code of Keycloak is not a viable option and middleware is not feasible due to the SSL/TLS connection, your options may be limited.

Here are a few additional suggestions you could consider:

Custom Proxy: If you have control over the network environment, consider setting up a reverse proxy (like Nginx or Apache) that can intercept the requests from Keycloak to FortiAuthenticator. This proxy could modify the headers as needed, removing the charset parameter before forwarding the request.
Feature Request: If you believe this is a significant issue that could benefit others, consider submitting a feature request to the Keycloak development community. They may consider adding an option to configure the Content-Type header behavior in future releases.
Community Forums: Engage with the Keycloak community forums or other developer communities. Other users may have encountered the same issue and could have found alternative solutions or workarounds.
Explore Other IDPs: If the integration continues to be problematic, you might want to explore whether other Identity Providers (IDPs) could meet your needs without these complications.
FortiAuthenticator Configuration: Double-check if there are any updates or configurations on FortiAuthenticator that might allow it to process the charset parameter. Sometimes, firmware updates or patches can address such issues.

While these suggestions may not provide an immediate solution, they could help you navigate the limitations you're facing.

Jean-Philippe - Fortinet Community Team

kiri

Staff & Editor

hey all,

this known issue 1177111 has been fixed in 6.6.7 FAC OS, planned to be released this fall

commarmiAuthor

Explorer

Thank for the info. Could you tell me when the 6.6.7 will be released ?

Debbie_FTNT

Staff & Editor

Hey commarmi,

there is no fixed date, but it looks like early to mid Q4.

You can subscribe to an RSS feed to get alerts on new firmware releases. RSS feeds are available here: https://www.fortiguard.com/rss-feeds

Cheers,

Debbie

floaty

Visitor III

utf8-error and problems related to configuration-discovery of relying-parties, could be related to incorrect url for issuer in '.well-known/openid-configuration/'

fortiauthenticator-oauth-autodetect-problem#.png