Repository: quarkusio/quarkus
Issue: Using oidc error-path doesn't keep the original path params used for session handling

### Describe the bug

I have an rest resource protected with OIDC, and wants to implement a customized web page when the authentication could not be performed.
I am trying to accomplish this with the setting: 
quarkus.oidc.authentication.error-path=/error

If I surf to my application with the following url: http://localhost/application?ref=xxxxx
Quarkus will redirect the browser with a 302 response and the location url as something like this: 
http://thirdPartyAuth/uas?state=yyyyy&redirect_uri=http://localhost/application

If the user perform a successful authentication and gets redirected back to the application I will land on this page:
http://localhost:8080/application?ref=xxxxx

i.e I have access to the original ref parameter and I can correlate this in my bigger session and a can mark this task as completed.

However when something gets wrong. For example when a user is canceling the authentication on the third party auth server the user is redirected to the error page with this uri:
http://localhost/application/error?state=yyyyy

The redirect on error is working and the user is presented with a correct error web page. The problem is that I am missing the ref=xxxxx parameter. I have only access to the parameter state=yyyyy whis is made up in the Quarkus extension.

If this is an expected behaviour is it possible for me to set the state=yyyyy parameter from the application myself or if it is possible to fetch this parameter when the authentication process is starting so that I now whet user is landing on the error page?

### Expected behavior

Using the property:
quarkus.oidc.authentication.error-path=/error 

Quarkus should keep the original path parameters so that the user land on the page:
http://localhost:8080/application/error?ref=xxxxx
when an error occurs during the authentication process.

### Actual behavior

Using the property:
quarkus.oidc.authentication.error-path=/error 

The user land on the page:
http://localhost:8080/application/error?state=yyyyy

I can't figure out how to map the state paramater to my original ref parameter?

### How to Reproduce?

_No response_

### Output of `uname -a` or `ver`

Quarkus 2.12.1.Final

### Output of `java -version`

_No response_

### GraalVM version (if different from Java)

_No response_

### Quarkus version or git rev

_No response_

### Build tool (ie. output of `mvnw --version` or `gradlew --version`)

_No response_

### Additional information

_No response_

Changed files:
integration-tests/oidc-code-flow/src/main/java/io/quarkus/it/keycloak/TenantHttps.java
integration-tests/oidc-code-flow/src/test/java/io/quarkus/it/keycloak/CodeFlowTest.java
extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/CodeAuthenticationMechanism.java

diff --git a/extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/CodeAuthenticationMechanism.java b/extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/CodeAuthenticationMechanism.java
index 84576f9348c..68e53d0a981 100644
--- a/extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/CodeAuthenticationMechanism.java
+++ b/extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/CodeAuthenticationMechanism.java
@@ -153,17 +153,41 @@ public Uni<SecurityIdentity> apply(TenantConfigContext tenantContext) {
             LOG.debugf("Authentication has failed, error: %s, description: %s", error, errorDescription);
 
             if (oidcTenantConfig.authentication.errorPath.isPresent()) {
-                URI absoluteUri = URI.create(context.request().absoluteURI());
+                Uni<TenantConfigContext> resolvedContext = resolver.resolveContext(context);
+                return resolvedContext.onItem()
+                        .transformToUni(new Function<TenantConfigContext, Uni<? extends SecurityIdentity>>() {
+                            @Override
+                            public Uni<SecurityIdentity> apply(TenantConfigContext tenantContext) {
+                                URI absoluteUri = URI.create(context.request().absoluteURI());
+
+                                String userQuery = null;
+
+                                // This is an original redirect from IDP, check if the original request path and query need to be restored
+                                CodeAuthenticationStateBean stateBean = getCodeAuthenticationBean(parsedStateCookieValue,
+                                        tenantContext);
+                                if (stateBean != null && stateBean.getRestorePath() != null) {
+                                    String restorePath = stateBean.getRestorePath();
+                                    int userQueryIndex = restorePath.indexOf("?");
+                                    if (userQueryIndex >= 0 && userQueryIndex + 1 < restorePath.length()) {
+                                        userQuery = restorePath.substring(userQueryIndex + 1);
+                                    }
+                                }
 
-                StringBuilder errorUri = new StringBuilder(buildUri(context,
-                        isForceHttps(oidcTenantConfig),
-                        absoluteUri.getAuthority(),
-                        oidcTenantConfig.authentication.errorPath.get()));
-                errorUri.append('?').append(getRequestParametersAsQuery(absoluteUri, requestParams, oidcTenantConfig));
+                                StringBuilder errorUri = new StringBuilder(buildUri(context,
+                                        isForceHttps(oidcTenantConfig),
+                                        absoluteUri.getAuthority(),
+                                        oidcTenantConfig.authentication.errorPath.get()));
+                                errorUri.append('?')
+                                        .append(getRequestParametersAsQuery(absoluteUri, requestParams, oidcTenantConfig));
+                                if (userQuery != null) {
+                                    errorUri.append('&').append(userQuery);
+                                }
 
-                String finalErrorUri = errorUri.toString();
-                LOG.debugf("Error URI: %s", finalErrorUri);
-                return Uni.createFrom().failure(new AuthenticationRedirectException(finalErrorUri));
+                                String finalErrorUri = errorUri.toString();
+                                LOG.debugf("Error URI: %s", finalErrorUri);
+                                return Uni.createFrom().failure(new AuthenticationRedirectException(finalErrorUri));
+                            }
+                        });
             } else {
                 LOG.error(
                         "Authentication has failed but no error handler is found, completing the code flow with HTTP status 401");
diff --git a/integration-tests/oidc-code-flow/src/main/java/io/quarkus/it/keycloak/TenantHttps.java b/integration-tests/oidc-code-flow/src/main/java/io/quarkus/it/keycloak/TenantHttps.java
index 4f752143d3e..f06cffa5a46 100644
--- a/integration-tests/oidc-code-flow/src/main/java/io/quarkus/it/keycloak/TenantHttps.java
+++ b/integration-tests/oidc-code-flow/src/main/java/io/quarkus/it/keycloak/TenantHttps.java
@@ -33,7 +33,8 @@ public String getTenantWithQuery(@QueryParam("code") String value) {
 
     @GET
     @Path("error")
-    public String getError(@QueryParam("error") String error, @QueryParam("error_description") String errorDescription) {
-        return "error: " + error + ", error_description: " + errorDescription;
+    public String getError(@QueryParam("error") String error, @QueryParam("error_description") String errorDescription,
+            @QueryParam("code") String value) {
+        return "code: " + value + ", error: " + error + ", error_description: " + errorDescription;
     }
 }
diff --git a/integration-tests/oidc-code-flow/src/test/java/io/quarkus/it/keycloak/CodeFlowTest.java b/integration-tests/oidc-code-flow/src/test/java/io/quarkus/it/keycloak/CodeFlowTest.java
index 0049d1d1eed..a808bf0c98a 100644
--- a/integration-tests/oidc-code-flow/src/test/java/io/quarkus/it/keycloak/CodeFlowTest.java
+++ b/integration-tests/oidc-code-flow/src/test/java/io/quarkus/it/keycloak/CodeFlowTest.java
@@ -148,7 +148,7 @@ public void testCodeFlowScopeErrorWithErrorPage() throws IOException {
             endpointErrorLocation = "http" + endpointErrorLocation.substring(5);
 
             HtmlPage page = webClient.getPage(URI.create(endpointErrorLocation).toURL());
-            assertEquals("error: invalid_scope, error_description: Invalid scopes: unknown",
+            assertEquals("code: b, error: invalid_scope, error_description: Invalid scopes: unknown",
                     page.getBody().asText());
             webClient.getCookieManager().clearCookies();
         }