keycloak/keycloak · error · RuntimeException

Not supported.

Error message

Not supported.

What it means

EcpAuthenticationHandler explicitly throws this RuntimeException from its overridden logoutRequest — ECP (Enhanced Client Proxy) does not support logout requests, so any attempt to process a SAML LogoutRequest through the ECP handler is rejected outright. It is a deliberate capability limitation, not a transient fault.

Source

Thrown at adapters/saml/core/src/main/java/org/keycloak/adapters/saml/profile/ecp/EcpAuthenticationHandler.java:79

        HttpFacade.Request request = httpFacade.getRequest();
        String acceptHeader = request.getHeader("Accept");
        String contentTypeHeader = request.getHeader("Content-Type");

        return (acceptHeader != null && acceptHeader.contains(PAOS_CONTENT_TYPE) && request.getHeader(PAOS_HEADER) != null)
                || (contentTypeHeader != null && contentTypeHeader.contains(PAOS_CONTENT_TYPE));
    }

    public static SamlAuthenticationHandler create(HttpFacade facade, SamlDeployment deployment, SamlSessionStore sessionStore) {
        return new EcpAuthenticationHandler(facade, deployment, sessionStore);
    }

    private  EcpAuthenticationHandler(HttpFacade facade, SamlDeployment deployment, SamlSessionStore sessionStore) {
        super(facade, deployment, sessionStore);
    }

    @Override
    protected AuthOutcome logoutRequest(LogoutRequestType request, String relayState) {
        throw new RuntimeException("Not supported.");
    }


    @Override
    public AuthOutcome handle(OnSessionCreated onCreateSession) {
        String header = facade.getRequest().getHeader(PAOS_HEADER);

        if (header != null) {
            return doHandle(new SamlInvocationContext(), onCreateSession);
        } else {
            try {
                MessageFactory messageFactory = MessageFactory.newInstance();
                SOAPMessage soapMessage = messageFactory.createMessage(null, facade.getRequest().getInputStream());
                SOAPBody soapBody = soapMessage.getSOAPBody();
                Node authnRequestNode = soapBody.getFirstChild();
                Document document = DocumentUtil.createDocument();

                document.appendChild(document.importNode(authnRequestNode, true));

View on GitHub (pinned to 66c7e15a37)

Solutions

1. Do not route SAML logout requests through ECP — ECP has no logout profile; handle logout via the standard SP logout endpoint instead.
2. If ECP was enabled unintentionally, disable it in the deployment so the standard (non-ECP) handler processes logout.
3. Guard upstream: if the request is a LogoutRequest, dispatch to the non-ECP handler rather than EcpAuthenticationHandler.

Example fix

// before: ECP handler handles all
if (handler instanceof EcpAuthenticationHandler) { handler.logoutRequest(...); }
// after: skip logout on ECP, route to standard handler
if (request is LogoutRequest) { standardHandler.logoutRequest(...); }

if (handler instanceof EcpAuthenticationHandler && request instanceof LogoutRequestType) {
    // ECP does not support logout — route to the standard handler instead
    standardHandler.logoutRequest((LogoutRequestType) request, relayState);
    return;
}

boolean supportsLogout(SamlAuthenticationHandler h) {
    return !(h instanceof EcpAuthenticationHandler);
}

When it happens

Trigger: An ECP-enabled SAML deployment receives a SAML LogoutRequest and routes it to the EcpAuthenticationHandler; calling logoutRequest() programmatically on an ECP handler instance.

Common situations: Deployment is configured for ECP but the flow attempts logout, which the ECP profile does not define; misrouted logout through the ECP handler due to handler-selection logic picking ECP for a logout request.

Related errors

• Error creating fault message.
• Could not create AuthnRequest.
• Unexpected error processing callbacks during logout.
• Unexpected status = ${status}
• There was no entity.

AI-assisted analysis of keycloak/keycloak@66c7e15a37 (2026-08-14). Data as JSON: /api/errors/a7fa86599d085fe8. Report an issue: GitHub.