Failed to refresh expired token

[nussera]

Jenkins and plugins versions report

Environment

Jenkins: 2.479.2
OS: Linux - 3.10.0-1160.119.1.el7.x86_64
Java: 21.0.5 - Eclipse Adoptium (OpenJDK 64-Bit Server VM)
---
analysis-model-api:12.9.1
ansicolor:1.0.5
antisamy-markup-formatter:162.v0e6ec0fcfcf6
apache-httpcomponents-client-4-api:4.5.14-208.v438351942757
apache-httpcomponents-client-5-api:5.3.1-110.v77252fb_d4da_5
asm-api:9.7.1-97.v4cc844130d97
authentication-tokens:1.119.v50285141b_7e1
authorize-project:1.8.1
bootstrap5-api:5.3.3-1
bouncycastle-api:2.30.1.78.1-248.ve27176eb_46cb_
branch-api:2.1200.v4b_a_3da_2eb_db_4
caffeine-api:3.1.8-133.v17b_1ff2e0599
checks-api:2.2.1
cloud-stats:336.v788e4055508b_
cloudbees-folder:6.963.v6edc0fc71472
command-launcher:115.vd8b_301cc15d0
commons-compress-api:1.26.1-2
commons-lang3-api:3.17.0-84.vb_b_938040b_078
commons-text-api:1.12.0-129.v99a_50df237f7
configuration-as-code:1903.v004d55388f30
configuration-as-code-groovy:1.1
credentials:1393.v6017143c1763
credentials-binding:687.v619cb_15e923f
data-tables-api:2.1.8-1
display-url-api:2.209.v582ed814ff2f
docker-commons:445.v6b_646c962a_94
docker-java-api:3.4.0-94.v65ced49b_a_7d5
docker-plugin:1.7.0
durable-task:581.v299a_5609d767
echarts-api:5.5.1-4
eddsa-api:0.3.0-4.v84c6f0f4969e
email-ext:1861.vdb_d991590994
envinject:2.919.v009a_a_1067cd0
envinject-api:1.199.v3ce31253ed13
font-awesome-api:6.6.0-2
forensics-api:2.6.0
git:5.6.0
git-client:6.1.0
git-forensics:2.2.1
gitlab-api:5.6.0-97.v6603a_83f8690
gitlab-branch-source:715.v4c830b_ca_ef95
gradle:2.13.1
gson-api:2.11.0-85.v1f4e87273c33
handy-uri-templates-2-api:2.1.8-30.v7e777411b_148
hashicorp-vault-plugin:371.v884a_4dd60fb_6
http_request:1.19
instance-identity:201.vd2a_b_5a_468a_a_6
ionicons-api:74.v93d5eb_813d5f
jackson2-api:2.17.0-379.v02de8ec9f64c
jakarta-activation-api:2.1.3-1
jakarta-mail-api:2.1.3-1
javax-activation-api:1.2.0-7
javax-mail-api:1.6.2-10
jaxb:2.3.9-1
jdk-tool:80.v8a_dee33ed6f0
jersey2-api:2.44-151.v6df377fff741
job-dsl:1.90
job-restrictions:212.vc34d63a_6704b_
joda-time-api:2.13.0-93.v9934da_29b_a_e9
jquery3-api:3.7.1-2
json-api:20240303-101.v7a_8666713110
json-path-api:2.9.0-118.v7f23ed82a_8b_8
junit:1311.v39e1716e4eb_e
mailer:489.vd4b_25144138f
mask-passwords:173.v6a_077a_291eb_5
material-theme:0.5.2-rc100.6121925fe229
matrix-project:840.v812f627cb_578
metrics:4.2.21-458.vcf496cb_839e4
mina-sshd-api-common:2.14.0-133.vcc091215a_358
mina-sshd-api-core:2.14.0-133.vcc091215a_358
oic-auth:4.438.v6e62f6782770
okhttp-api:4.11.0-181.v1de5b_83857df
pipeline-build-step:540.vb_e8849e1a_b_d8
pipeline-graph-analysis:216.vfd8b_ece330ca_
pipeline-graph-view:382.vb_9a_27b_7b_ea_71
pipeline-groovy-lib:744.v5b_556ee7c253
pipeline-input-step:495.ve9c153f6067b_
pipeline-milestone-step:119.vdfdc43fc3b_9a_
pipeline-model-api:2.2218.v56d0cda_37c72
pipeline-model-definition:2.2218.v56d0cda_37c72
pipeline-model-extensions:2.2218.v56d0cda_37c72
pipeline-rest-api:2.34
pipeline-stage-step:312.v8cd10304c27a_
pipeline-stage-tags-metadata:2.2218.v56d0cda_37c72
pipeline-stage-view:2.34
pipeline-utility-steps:2.18.0
plain-credentials:183.va_de8f1dd5a_2b_
plugin-util-api:5.1.0
prism-api:1.29.0-18
prometheus:801.v98e119d8eeda_
pyenv-pipeline:2.1.2
remote-file:1.24
role-strategy:743.v142ea_b_d5f1d3
scm-api:698.v8e3b_c788f0a_6
script-security:1369.v9b_98a_4e95b_2d
shiningpanda:0.24
simple-theme-plugin:196.v96d9592f4efa_
snakeyaml-api:2.3-123.v13484c65210a_
ssh-credentials:349.vb_8b_6b_9709f5b_
ssh-slaves:2.973.v0fa_8c0dea_f9f
sshd:3.330.vc866a_8389b_58
structs:338.v848422169819
terraform:1.0.10
theme-manager:262.vc57ee4a_eda_5d
timestamper:1.28
token-macro:400.v35420b_922dcb_
trilead-api:2.147.vb_73cc728a_32e
variant:60.v7290fc0eb_b_cd
warnings-ng:11.12.0
workflow-aggregator:600.vb_57cdd26fdd7
workflow-api:1336.vee415d95c521
workflow-basic-steps:1058.vcb_fc1e3a_21a_9
workflow-cps:4000.v5198556e9cea_
workflow-durable-task-step:1398.vf6c9e89e5988
workflow-job:1472.ve4d5eca_143c4
workflow-multibranch:795.ve0cb_1f45ca_9a_
workflow-scm-step:427.v4ca_6512e7df1
workflow-step-api:678.v3ee58b_469476
workflow-support:936.v9fa_77211ca_e1

What Operating System are you using (both controller, and any agents involved in the problem)?

It's a docker deployment based on "jenkins/jenkins:lts-jdk21"

Reproduction steps

I've configured OIDC via CasC. The OIDC server is a Keycloak cluster:

jenkins:
  securityRealm:
    oic:
      allowTokenAccessWithoutOicSession: true
      allowedTokenExpirationClockSkewSeconds: 0
      clientId: "${oidc_client_id}"
      clientSecret: "${oidc_client_secret}"
      disableSslVerification: false
      disableTokenVerification: true
      emailFieldName: "email"
      fullNameFieldName: "given_name"
      groupsFieldName: "groups"
      logoutFromOpenidProvider: false
      serverConfiguration:
        wellKnown:
          wellKnownOpenIDConfigurationUrl: "${oidc_base_url}/.well-known/openid-configuration"
      userNameField: "preferred_username"

1. Login via OIDC/Keycloak
2. Work
3. Wait for some time (session timeout?)
4. Refresh the page

Expected Results

The page loads and I can continue to work.

Actual Results

I get an error page.
In the logs I can find an error and exception:

iacjenkins-jenkins-1  | 2024-12-11 08:43:25.734+0000 [id=192]   WARNING o.j.plugins.oic.OicSecurityRealm#refreshExpiredToken: Failed to refresh expired token
iacjenkins-jenkins-1  | java.net.SocketTimeoutException: Read timed out
iacjenkins-jenkins-1  |         at java.base/sun.nio.ch.NioSocketImpl.timedRead(Unknown Source)
iacjenkins-jenkins-1  |         at java.base/sun.nio.ch.NioSocketImpl.implRead(Unknown Source)
iacjenkins-jenkins-1  |         at java.base/sun.nio.ch.NioSocketImpl.read(Unknown Source)
iacjenkins-jenkins-1  |         at java.base/sun.nio.ch.NioSocketImpl$1.read(Unknown Source)
iacjenkins-jenkins-1  |         at java.base/java.net.Socket$SocketInputStream.read(Unknown Source)
iacjenkins-jenkins-1  |         at java.base/sun.security.ssl.SSLSocketInputRecord.read(Unknown Source)
iacjenkins-jenkins-1  |         at java.base/sun.security.ssl.SSLSocketInputRecord.readHeader(Unknown Source)
iacjenkins-jenkins-1  |         at java.base/sun.security.ssl.SSLSocketInputRecord.bytesInCompletePacket(Unknown Source)
iacjenkins-jenkins-1  |         at java.base/sun.security.ssl.SSLSocketImpl.readApplicationRecord(Unknown Source)
iacjenkins-jenkins-1  |         at java.base/sun.security.ssl.SSLSocketImpl$AppInputStream.read(Unknown Source)
iacjenkins-jenkins-1  |         at java.base/java.io.BufferedInputStream.fill(Unknown Source)
iacjenkins-jenkins-1  |         at java.base/java.io.BufferedInputStream.read1(Unknown Source)
iacjenkins-jenkins-1  |         at java.base/java.io.BufferedInputStream.implRead(Unknown Source)
iacjenkins-jenkins-1  |         at java.base/java.io.BufferedInputStream.read(Unknown Source)
iacjenkins-jenkins-1  |         at java.base/sun.net.www.http.HttpClient.parseHTTPHeader(Unknown Source)
iacjenkins-jenkins-1  |         at java.base/sun.net.www.http.HttpClient.parseHTTP(Unknown Source)
iacjenkins-jenkins-1  |         at java.base/sun.net.www.protocol.http.HttpURLConnection.getInputStream0(Unknown Source)
iacjenkins-jenkins-1  |         at java.base/sun.net.www.protocol.http.HttpURLConnection.getInputStream(Unknown Source)
iacjenkins-jenkins-1  |         at java.base/sun.net.www.protocol.https.HttpsURLConnectionImpl.getInputStream(Unknown Source)
iacjenkins-jenkins-1  |         at PluginClassLoader for oic-auth//com.nimbusds.oauth2.sdk.http.HTTPRequest.send(HTTPRequest.java:1016)
iacjenkins-jenkins-1  | Caused: java.net.SocketTimeoutException: Read timed out
iacjenkins-jenkins-1  |         at java.base/jdk.internal.reflect.DirectConstructorHandleAccessor.newInstance(Unknown Source)
iacjenkins-jenkins-1  |         at java.base/java.lang.reflect.Constructor.newInstanceWithCaller(Unknown Source)
iacjenkins-jenkins-1  |         at java.base/java.lang.reflect.Constructor.newInstance(Unknown Source)
iacjenkins-jenkins-1  |         at java.base/sun.net.www.protocol.http.HttpURLConnection$10.run(Unknown Source)
iacjenkins-jenkins-1  |         at java.base/sun.net.www.protocol.http.HttpURLConnection$10.run(Unknown Source)
iacjenkins-jenkins-1  |         at java.base/java.security.AccessController.doPrivileged(Unknown Source)
iacjenkins-jenkins-1  |         at java.base/sun.net.www.protocol.http.HttpURLConnection.getChainedException(Unknown Source)
iacjenkins-jenkins-1  |         at java.base/sun.net.www.protocol.http.HttpURLConnection.getInputStream0(Unknown Source)
iacjenkins-jenkins-1  |         at java.base/sun.net.www.protocol.http.HttpURLConnection.getInputStream(Unknown Source)
iacjenkins-jenkins-1  |         at java.base/java.net.HttpURLConnection.getResponseCode(Unknown Source)
iacjenkins-jenkins-1  |         at java.base/sun.net.www.protocol.https.HttpsURLConnectionImpl.getResponseCode(Unknown Source)
iacjenkins-jenkins-1  |         at PluginClassLoader for oic-auth//com.nimbusds.oauth2.sdk.http.HTTPRequest.send(HTTPRequest.java:1027)
iacjenkins-jenkins-1  |         at PluginClassLoader for oic-auth//org.pac4j.oidc.credentials.authenticator.OidcAuthenticator.executeTokenRequest(OidcAuthenticator.java:198)
iacjenkins-jenkins-1  |         at PluginClassLoader for oic-auth//org.pac4j.oidc.credentials.authenticator.OidcAuthenticator.refresh(OidcAuthenticator.java:177)
iacjenkins-jenkins-1  | Caused: org.pac4j.core.exception.TechnicalException
iacjenkins-jenkins-1  |         at PluginClassLoader for oic-auth//org.pac4j.oidc.credentials.authenticator.OidcAuthenticator.refresh(OidcAuthenticator.java:179)
iacjenkins-jenkins-1  |         at PluginClassLoader for oic-auth//org.pac4j.oidc.client.OidcClient.renewUserProfile(OidcClient.java:65)
iacjenkins-jenkins-1  |         at PluginClassLoader for oic-auth//org.jenkinsci.plugins.oic.OicSecurityRealm.refreshExpiredToken(OicSecurityRealm.java:1419)
iacjenkins-jenkins-1  |         at PluginClassLoader for oic-auth//org.jenkinsci.plugins.oic.OicSecurityRealm.handleTokenExpiration(OicSecurityRealm.java:1366)
iacjenkins-jenkins-1  |         at PluginClassLoader for oic-auth//org.jenkinsci.plugins.oic.OicSecurityRealm$1.doFilter(OicSecurityRealm.java:861)
iacjenkins-jenkins-1  |         at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:101)
iacjenkins-jenkins-1  |         at io.jenkins.servlet.FilterChainWrapper$1.doFilter(FilterChainWrapper.java:28)
iacjenkins-jenkins-1  |         at hudson.security.ChainedServletFilter2$1.doFilter(ChainedServletFilter2.java:94)
iacjenkins-jenkins-1  |         at jenkins.security.AcegiSecurityExceptionFilter.doFilter(AcegiSecurityExceptionFilter.java:52)
iacjenkins-jenkins-1  |         at hudson.security.ChainedServletFilter2$1.doFilter(ChainedServletFilter2.java:99)
iacjenkins-jenkins-1  |         at hudson.security.UnwrapSecurityExceptionFilter.doFilter(UnwrapSecurityExceptionFilter.java:54)
iacjenkins-jenkins-1  |         at hudson.security.ChainedServletFilter2$1.doFilter(ChainedServletFilter2.java:99)
iacjenkins-jenkins-1  |         at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:126)
iacjenkins-jenkins-1  |         at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:120)
iacjenkins-jenkins-1  |         at hudson.security.ChainedServletFilter2$1.doFilter(ChainedServletFilter2.java:99)
iacjenkins-jenkins-1  |         at org.springframework.security.web.authentication.AnonymousAuthenticationFilter.doFilter(AnonymousAuthenticationFilter.java:100)
iacjenkins-jenkins-1  |         at hudson.security.ChainedServletFilter2$1.doFilter(ChainedServletFilter2.java:99)
iacjenkins-jenkins-1  |         at org.springframework.security.web.authentication.rememberme.RememberMeAuthenticationFilter.doFilter(RememberMeAuthenticationFilter.java:110)
iacjenkins-jenkins-1  |         at org.springframework.security.web.authentication.rememberme.RememberMeAuthenticationFilter.doFilter(RememberMeAuthenticationFilter.java:101)
iacjenkins-jenkins-1  |         at hudson.security.ChainedServletFilter2$1.doFilter(ChainedServletFilter2.java:99)
iacjenkins-jenkins-1  |         at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:227)
iacjenkins-jenkins-1  |         at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:221)
iacjenkins-jenkins-1  |         at hudson.security.ChainedServletFilter2$1.doFilter(ChainedServletFilter2.java:99)
iacjenkins-jenkins-1  |         at jenkins.security.BasicHeaderProcessor.doFilter(BasicHeaderProcessor.java:98)
iacjenkins-jenkins-1  |         at hudson.security.ChainedServletFilter2$1.doFilter(ChainedServletFilter2.java:99)
iacjenkins-jenkins-1  |         at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:117)
iacjenkins-jenkins-1  |         at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:87)
iacjenkins-jenkins-1  |         at hudson.security.HttpSessionContextIntegrationFilter2.doFilter(HttpSessionContextIntegrationFilter2.java:63)
iacjenkins-jenkins-1  |         at hudson.security.ChainedServletFilter2$1.doFilter(ChainedServletFilter2.java:99)
iacjenkins-jenkins-1  |         at hudson.security.ChainedServletFilter2.doFilter(ChainedServletFilter2.java:111)
iacjenkins-jenkins-1  |         at io.jenkins.servlet.FilterWrapper$2.doFilter(FilterWrapper.java:83)
iacjenkins-jenkins-1  |         at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:101)
iacjenkins-jenkins-1  |         at hudson.security.ChainedServletFilter.doFilter(ChainedServletFilter.java:113)
iacjenkins-jenkins-1  |         at io.jenkins.servlet.FilterWrapper$1.doFilter(FilterWrapper.java:42)
iacjenkins-jenkins-1  |         at hudson.security.HudsonFilter.doFilter(HudsonFilter.java:173)
iacjenkins-jenkins-1  |         at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.servlet.FilterHolder.doFilter(FilterHolder.java:202)
iacjenkins-jenkins-1  |         at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1638)
iacjenkins-jenkins-1  |         at org.kohsuke.stapler.UncaughtExceptionFilter.doFilter(UncaughtExceptionFilter.java:26)
iacjenkins-jenkins-1  |         at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.servlet.FilterHolder.doFilter(FilterHolder.java:202)
iacjenkins-jenkins-1  |         at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1638)
iacjenkins-jenkins-1  |         at hudson.util.CharacterEncodingFilter.doFilter(CharacterEncodingFilter.java:86)
iacjenkins-jenkins-1  |         at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.servlet.FilterHolder.doFilter(FilterHolder.java:202)
iacjenkins-jenkins-1  |         at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1638)
iacjenkins-jenkins-1  |         at org.kohsuke.stapler.DiagnosticThreadNameFilter.doFilter(DiagnosticThreadNameFilter.java:31)
iacjenkins-jenkins-1  |         at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.servlet.FilterHolder.doFilter(FilterHolder.java:202)
iacjenkins-jenkins-1  |         at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1638)
iacjenkins-jenkins-1  |         at jenkins.security.SuspiciousRequestFilter.doFilter(SuspiciousRequestFilter.java:38)
iacjenkins-jenkins-1  |         at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.servlet.FilterHolder.doFilter(FilterHolder.java:202)
iacjenkins-jenkins-1  |         at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1638)
iacjenkins-jenkins-1  |         at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.servlet.ServletHandler.doHandle(ServletHandler.java:526)
iacjenkins-jenkins-1  |         at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.nested.ScopedHandler.handle(ScopedHandler.java:127)
iacjenkins-jenkins-1  |         at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.security.SecurityHandler.handle(SecurityHandler.java:574)
iacjenkins-jenkins-1  |         at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.nested.HandlerWrapper.handle(HandlerWrapper.java:124)
iacjenkins-jenkins-1  |         at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.nested.ScopedHandler.nextHandle(ScopedHandler.java:197)
iacjenkins-jenkins-1  |         at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.nested.SessionHandler.doHandle(SessionHandler.java:609)
iacjenkins-jenkins-1  |         at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.nested.ScopedHandler.nextHandle(ScopedHandler.java:195)
iacjenkins-jenkins-1  |         at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.nested.ContextHandler.doHandle(ContextHandler.java:1035)
iacjenkins-jenkins-1  |         at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.nested.ScopedHandler.nextScope(ScopedHandler.java:164)
iacjenkins-jenkins-1  |         at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.servlet.ServletHandler.doScope(ServletHandler.java:483)
iacjenkins-jenkins-1  |         at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.nested.ScopedHandler.nextScope(ScopedHandler.java:162)
iacjenkins-jenkins-1  |         at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.nested.SessionHandler.doScope(SessionHandler.java:586)
iacjenkins-jenkins-1  |         at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.nested.ScopedHandler.nextScope(ScopedHandler.java:162)
iacjenkins-jenkins-1  |         at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.nested.ContextHandler.doScope(ContextHandler.java:956)
iacjenkins-jenkins-1  |         at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.nested.ScopedHandler.handle(ScopedHandler.java:125)
iacjenkins-jenkins-1  |         at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.nested.ContextHandler.handle(ContextHandler.java:1694)
iacjenkins-jenkins-1  |         at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.nested.HttpChannel$RequestDispatchable.dispatch(HttpChannel.java:1576)
iacjenkins-jenkins-1  |         at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.nested.HttpChannel.dispatch(HttpChannel.java:738)
iacjenkins-jenkins-1  |         at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.nested.HttpChannel.handle(HttpChannel.java:511)
iacjenkins-jenkins-1  |         at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.nested.ContextHandler$CoreContextHandler$CoreToNestedHandler.handle(ContextHandler.java:2862)
iacjenkins-jenkins-1  |         at Jenkins Main ClassLoader//org.eclipse.jetty.server.handler.ContextHandler.handle(ContextHandler.java:1060)
iacjenkins-jenkins-1  |         at Jenkins Main ClassLoader//org.eclipse.jetty.server.handler.gzip.GzipHandler.handle(GzipHandler.java:549)
iacjenkins-jenkins-1  |         at Jenkins Main ClassLoader//org.eclipse.jetty.server.Server.handle(Server.java:181)
iacjenkins-jenkins-1  |         at Jenkins Main ClassLoader//org.eclipse.jetty.server.internal.HttpChannelState$HandlerInvoker.run(HttpChannelState.java:661)
iacjenkins-jenkins-1  |         at Jenkins Main ClassLoader//org.eclipse.jetty.server.internal.HttpConnection.onFillable(HttpConnection.java:406)
iacjenkins-jenkins-1  |         at Jenkins Main ClassLoader//org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:322)
iacjenkins-jenkins-1  |         at Jenkins Main ClassLoader//org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:99)
iacjenkins-jenkins-1  |         at Jenkins Main ClassLoader//org.eclipse.jetty.io.SelectableChannelEndPoint$1.run(SelectableChannelEndPoint.java:53)
iacjenkins-jenkins-1  |         at Jenkins Main ClassLoader//org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.runTask(AdaptiveExecutionStrategy.java:478)
iacjenkins-jenkins-1  |         at Jenkins Main ClassLoader//org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.consumeTask(AdaptiveExecutionStrategy.java:441)
iacjenkins-jenkins-1  |         at Jenkins Main ClassLoader//org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.tryProduce(AdaptiveExecutionStrategy.java:293)
iacjenkins-jenkins-1  |         at Jenkins Main ClassLoader//org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.run(AdaptiveExecutionStrategy.java:201)
iacjenkins-jenkins-1  |         at Jenkins Main ClassLoader//org.eclipse.jetty.util.thread.ReservedThreadExecutor$ReservedThread.run(ReservedThreadExecutor.java:311)
iacjenkins-jenkins-1  |         at Jenkins Main ClassLoader//org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:979)
iacjenkins-jenkins-1  |         at Jenkins Main ClassLoader//org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.doRunJob(QueuedThreadPool.java:1209)
iacjenkins-jenkins-1  |         at Jenkins Main ClassLoader//org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.run(QueuedThreadPool.java:1164)
iacjenkins-jenkins-1  |         at java.base/java.lang.Thread.run(Unknown Source)

Anything else?

This was working before. Unfortunatelly, I can't pin the exact time when it stopped working.

Are you interested in contributing a fix?

No response

[jtnord]

We use keycloak for some systems and it is working for refresh here which suggests (along with the exception) that this is environmental.

[nussera]

It might be the environment. How can I be sure? Sometimes it's enough to click on "Dashboard" again and to be logged in. Sometime, one needs to clear all cookies before login works again.
Is there a way to increase the read timeout? Can I configure some logging to shed some light on the "why"? Maybe Keycloaks response is to slow, but I don't know how it could be made faster, so I need Jenkins to be slower.

Thanks for your help.

[jtnord]

The default is 5 seconds and it is not currently user configurable.

This should be good enough, and any longer would indicate downstream issues.

Sometime, one needs to clear all cookies before login works again.

Cookies should not affect this, so I would sumize either there is a distinct issue with cookies (but that would generally result in HTTP Headers too Large from Jenkins) or it is coincidental.

Can I configure some logging to shed some light on the "why"?

The why is on keycloaks side (or the token server keycloak has told us to use.)

Maybe Keycloaks response is to slow, but I don't know how it could be made faster, so I need Jenkins to be slower.

If keycloak is too slow which this indicates focus on that not Jenkins.

There can be many reasons keycloak is slow depending on your deployment model and resources allocated to it, or even underlying authentication providers