Existing users can't login via OAuth/Keycloak

Description:

To initially access Rocketchat, users must log in through Keycloak, which is how accounts are provisioned. This functionality generally works without issue.

However, the problem arises seemingly at random. Users with existing Keycloak-created accounts are sometimes unable to successfully log in to Rocketchat. There are no error messages, password update prompts, or other indications of the issue. When the user attempts to log in through Keycloak, they are simply redirected back to the login page without gaining access.

According to Keycloak, these users have an active session for Rocketchat, but no corresponding cookies or tokens are set in the browser. As a result, the users cannot log in.

This issue forces the administrator to manually provision local Rocketchat accounts by manually resetting their password for affected users through the UI, which is an undesirable workaround.

I've tried reproducing this bug but I can't seem to find the exact cause.

Steps to reproduce:

1. Have a Rocketchat instance with Keycloak as the OAuth provider
2. Create an account via OAuth
3. Re-log in and get denied access -> No idea what the cause of this

Expected behavior:

The expected behavior is that the user is logged in successfully.

Actual behavior:

Unsuccessful log in to Rocketchat

Server Setup Information:

• Version of Rocket.Chat Server: 7.0.0
• Number of Users: 300+
• NodeJS Version: v20.18.1
• MongoDB Version: 7.0.15 / wiredTiger (oplog Enabled)

Client Setup Information

Happens in different browsers, on different versions and different operating systems.

Additional context

This issue has been around for at least 1.5-2 years, the user was able to log in fine via Keycloak until that bug occurred, no configuration settings were modified in either Rocketchat or Keycloak for affected users.

Start by reproducing the OAuth/Keycloak login flow described for Rocket.Chat 7.0.0, comparing browser cookies and tokens with the active Keycloak session. There are no source files or tests named; done means existing Keycloak-created users can log in successfully without manual local account provisioning.