I just ran into a problem similar to pac4j raises “State cannot be determined” after OIDC callback and Keycloak provider with OIDC authentication (Azure) after upgrading to a version of our webapp which forced the samesite attribute to be set by the Tomcat CookieProcessor using the following context.xml file:

<Context>
    <Manager pathname="" />
    <CookieProcessor sameSiteCookies="strict"/>
</Context>

This setting was introduced as a result of a penetration test.

The network trace showed, that the JESSIONID cookie set in the 302 response redirecting to the IdP would not be used by the browser in the request to the callback URL after authentication. Therefore the state could not be determined , raising the TechnicalException.

Setting samesite=”lax” seems to work, though. So this might be a (the best?) solution.

It might also be an option to use setWithState(false) on the OidcClient, but this option is not available via the properties-based configuration as it is for oauth2 !? Are there plans to include a oidc.withState config parameter in a future release?

I am using the Java-11-based version of pac4j (5.7.2).