Re: ContextNotActiveException when using OpenIdAuthenticationMechanism with notifiyProvider

Hi,

Perhaps it would be best, if you could upload that reproducer, so we can =
replicate.

Gru=C3=9F
Richard

> Am 13.03.2026 um 12:24 schrieb Benedikt Lang <[email protected]>:
>=20
> Hello Markus,
>=20
>=20
> our Keycloak Client is indeed set up as a public client. However =
changing it to a confidential one and configuring the client secret did =
not change the outcome.
>=20
> A colleague of mine built a minimal reproducer and we experimented a =
bit. The exception only shows, when using the authentication mechanism =
with JAX-RS. When using a servlet directly the exception vanishes.
>=20
>=20
> Hope this helps
>=20
> Thanks
>=20
> Benedikt
>=20
> On 13.03.26 09:07, Markus Jung wrote:
>> Hello Benedikt,
>>=20
>>=20
>> your config is _very_ similar to the one we run at my company, I also =
added a test to verify this behavior works =
(https://github.com/apache/tomee/commit/9efdac831ae6a906664fd0c72b0ccd8410=
a528ce) which passes on my machine.  I noticed your =
@OpenIdAuthenticationMechanismDefinition does not contain a client =
secret. Did you simply remove it before copying into your mail or is =
your client in Keycloak maybe configured for public access (=3D Client =
authentication in Keycloak turned off)?
>>=20
>>=20
>> Thanks
>>=20
>> Markus
>>=20
>>=20
>> On 3/12/26 10:15, Benedikt Lang wrote:
>>> Hello Markus,
>>>=20
>>>=20
>>> thanks for the reply.
>>>=20
>>> The definition reads as follows:
>>>=20
>>> ```java
>>>=20
>>> @OpenIdAuthenticationMechanismDefinition(providerURI =
=3D"${openId.providerURI}", clientId =3D"${openId.clientId}", =
redirectURI =3D"${baseURL}", redirectToOriginalResource =3Dfalse, logout =
=3D@LogoutDefinition(notifyProvider =3Dtrue, redirectURI =3D"${baseURL}"))=

>>>=20
>>> ```
>>>=20
>>> With the providerUri being `https://<domain>/realms/<realmName>`.
>>>=20
>>> We are using Keycloak as our OIDC provider as well. Furthermore I'm =
pretty sure the Access Token validates as the Endpoint is secured.
>>>=20
>>>=20
>>> Thanks
>>>=20
>>> Benedikt
>>>=20
>>>=20
>>> On 11.03.26 19:05, Markus Jung wrote:
>>>> Hello Benedikt,
>>>>=20
>>>> from a first glance looks like either a bug in TomEE or your =
session hasn't been properly authenticated (Access token/ID token failed =
to verify?).
>>>> I'm curious about the rest of your =
@OpenIdAuthenticationMechanismDefinition. Could you possibly share that? =
Also, what OIDC provider are you using?
>>>>=20
>>>> We're running the OIDC authentication at my company with =
notifyProvider=3Dtrue on logout without any issues on Keycloak. That's =
also what I tested against during the implementation, so there could of =
course still be quirks to with other OIDC providers.
>>>>=20
>>>>=20
>>>> Thanks
>>>> Markus
>>>>=20
>>>> Am 11. M=C3=A4rz 2026 18:07:43 MEZ schrieb Benedikt =
Lang<[email protected]>:
>>>>> Hello,
>>>>>=20
>>>>> I am using TomEE 10.1.4 to serve a web application. For =
authentication I am using the OpenIdAuthenticationMechanisms via =
`@OpenIdAuthenticationMechanismDefinition`. When using =
notifyProvider=3Dfalse the logout endpoint runs fine, but when setting =
it to true I receive the following exception:
>>>>>=20
>>>>> ```
>>>>>=20
>>>>> jakarta.enterprise.context.ContextNotActiveException: WebBeans =
context with scope type annotation @SessionScoped does not exist within =
current thread
>>>>>          at =
org.apache.webbeans.container.BeanManagerImpl.getContext(BeanManagerImpl.j=
ava:339)
>>>>>          at =
org.apache.webbeans.intercept.NormalScopedBeanInterceptorHandler.getContex=
tualInstance(NormalScopedBeanInterceptorHandler.java:89)
>>>>>          at =
org.apache.webbeans.intercept.SessionScopedBeanInterceptorHandler.getConte=
xtualInstance(SessionScopedBeanInterceptorHandler.java:76)
>>>>>          at =
org.apache.webbeans.intercept.NormalScopedBeanInterceptorHandler.get(Norma=
lScopedBeanInterceptorHandler.java:71)
>>>>>          at =
org.apache.tomee.security.cdi.openid.TomEEOpenIdContext$$OwbNormalScopePro=
xy0.getIdentityToken(org/apache/tomee/security/cdi/openid/TomEEOpenIdConte=
xt.java)
>>>>>          at =
org.apache.tomee.security.cdi.OpenIdAuthenticationMechanism.cleanSubject(O=
penIdAuthenticationMechanism.java:87)
>>>>>          at =
org.apache.tomee.security.cdi.OpenIdAuthenticationMechanism$$OwbNormalScop=
eProxy0.cleanSubject(org/apache/tomee/security/cdi/OpenIdAuthenticationMec=
hanism.java)
>>>>>          at =
org.apache.tomee.security.cdi.DefaultAuthenticationMechanism.cleanSubject(=
DefaultAuthenticationMechanism.java:56)
>>>>>          at =
org.apache.tomee.security.cdi.DefaultAuthenticationMechanism$$OwbNormalSco=
peProxy0.cleanSubject(org/apache/tomee/security/cdi/DefaultAuthenticationM=
echanism.java)
>>>>>          at =
org.apache.tomee.security.provider.TomEESecurityServerAuthModule.cleanSubj=
ect(TomEESecurityServerAuthModule.java:60)
>>>>>          at =
org.apache.tomee.security.provider.TomEESecurityServerAuthContext.cleanSub=
ject(TomEESecurityServerAuthContext.java:37)
>>>>>          at =
org.apache.catalina.authenticator.AuthenticatorBase.logout(AuthenticatorBa=
se.java:1238)
>>>>>          at =
org.apache.catalina.connector.Request.logout(Request.java:2527)
>>>>>          at =
org.apache.catalina.connector.RequestFacade.logout(RequestFacade.java:764)=

>>>>>          at =
jakarta.servlet.http.HttpServletRequestWrapper.logout(HttpServletRequestWr=
apper.java:302)
>>>>>          at =
org.apache.openejb.server.httpd.EEFilter$NoCdiRequest.logout(EEFilter.java=
:95)
>>>>>          at =
org.apache.openejb.server.httpd.ServletRequestAdapter.logout(ServletReques=
tAdapter.java:92)
>>>>>          at =
jakarta.servlet.http.HttpServletRequestWrapper.logout(HttpServletRequestWr=
apper.java:302)
>>>>>          at =
org.apache.openejb.rest.ThreadLocalHttpServletRequest.logout(ThreadLocalHt=
tpServletRequest.java:398)
>>>>>          at =
<redacted>.LogoutRestAdapter.logout(LogoutRestAdapter.java:36)
>>>>>          at =
<redacted>t.LogoutRestAdapter$$OwbNormalScopeProxy0.logout(<redacted>/Logo=
utRestAdapter.java)
>>>>>          at =
java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native =
Method)
>>>>>          at =
java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMetho=
dAccessorImpl.java:77)
>>>>>          at =
java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(Delegat=
ingMethodAccessorImpl.java:43)
>>>>>          at =
java.base/java.lang.reflect.Method.invoke(Method.java:569)
>>>>>          at =
org.apache.openejb.server.cxf.rs.PojoInvoker.performInvocation(PojoInvoker=
.java:37)
>>>>>          at =
org.apache.cxf.service.invoker.AbstractInvoker.invoke(AbstractInvoker.java=
:96)
>>>>>          at =
org.apache.cxf.jaxrs.JAXRSInvoker.invoke(JAXRSInvoker.java:200)
>>>>>          at =
org.apache.cxf.jaxrs.JAXRSInvoker.invoke(JAXRSInvoker.java:103)
>>>>>          at =
org.apache.openejb.server.cxf.rs.AutoJAXRSInvoker.invoke(AutoJAXRSInvoker.=
java:68)
>>>>>          at =
org.apache.cxf.interceptor.ServiceInvokerInterceptor$1.run(ServiceInvokerI=
nterceptor.java:59)
>>>>>          at =
org.apache.cxf.interceptor.ServiceInvokerInterceptor.handleMessage(Service=
InvokerInterceptor.java:96)
>>>>>          at =
org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorCha=
in.java:307)
>>>>>          at =
org.apache.cxf.transport.ChainInitiationObserver.onMessage(ChainInitiation=
Observer.java:121)
>>>>>          at =
org.apache.cxf.transport.http.AbstractHTTPDestination.invoke(AbstractHTTPD=
estination.java:267)
>>>>>          at =
org.apache.openejb.server.cxf.rs.CxfRsHttpListener.doInvoke(CxfRsHttpListe=
ner.java:266)
>>>>>          at =
org.apache.tomee.webservices.CXFJAXRSFilter.doFilter(CXFJAXRSFilter.java:8=
0)
>>>>>          at =
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(Applicati=
onFilterChain.java:162)
>>>>>          at =
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilter=
Chain.java:138)
>>>>>          at =
org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:51)
>>>>>          at =
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(Applicati=
onFilterChain.java:162)
>>>>>          at =
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilter=
Chain.java:138)
>>>>>          at =
org.apache.openejb.server.httpd.EEFilter.doFilter(EEFilter.java:67)
>>>>>          at =
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(Applicati=
onFilterChain.java:162)
>>>>>          at =
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilter=
Chain.java:138)
>>>>>          at =
io.smallrye.metrics.jaxrs.JaxRsMetricsServletFilter.doFilter(JaxRsMetricsS=
ervletFilter.java:37)
>>>>>          at =
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(Applicati=
onFilterChain.java:162)
>>>>>          at =
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilter=
Chain.java:138)
>>>>>          at =
org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.=
java:165)
>>>>>          at =
org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.=
java:88)
>>>>>          at =
org.apache.tomee.catalina.OpenEJBValve.invoke(OpenEJBValve.java:45)
>>>>>          at =
org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBa=
se.java:607)
>>>>>          at =
org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:1=
13)
>>>>>          at =
org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:8=
3)
>>>>>          at =
org.apache.tomee.catalina.OpenEJBSecurityListener$RequestCapturer.invoke(O=
penEJBSecurityListener.java:97)
>>>>>          at =
org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLog=
Valve.java:654)
>>>>>          at =
org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.ja=
va:72)
>>>>>          at =
org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:342=
)
>>>>>          at =
org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:399)=

>>>>>          at =
org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.ja=
va:63)
>>>>>          at =
org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProto=
col.java:903)
>>>>>          at =
org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.j=
ava:1775)
>>>>>          at =
org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.jav=
a:52)
>>>>>          at =
org.apache.tomcat.util.threads.ThreadPoolExecutor.runWorker(ThreadPoolExec=
utor.java:973)
>>>>>          at =
org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker.run(ThreadPoolExe=
cutor.java:491)
>>>>>          at =
org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.=
java:63)
>>>>>          at java.base/java.lang.Thread.run(Thread.java:840)
>>>>>=20
>>>>> ```
>>>>>=20
>>>>>=20
>>>>> Is this a bug in TomEE? What should I look out for to determine =
what the culprit is?
>>>>>=20
>>>>>=20
>>>>> Best regards
>>>>>=20
>>>>> Benedikt Lang
>>>>>=20
>>>>>=20