Hi,

We found that keycloak stores all additional (non-standard) request params of an auth request in special authentication session client notes. For example when we trigger an auth request like http://localhost:8180/realms/test/protocol/openid-connect/auth?...myname=myval, the following entry is stored as client note: client_request_param_myname=myval.

We used this feature to implement conditions in authenticators, based on a request parameter. We found that restarting login (e.g. with the link on the OTP form or the link on the error page when auth times out) clears those special client notes, leading to different behavior in authenticators relying on the request parameters from the original auth request.

Is the clearing of these special client notes an expected behavior?